V13-FE-011: finalize search list layout slice

TECH_DEBT_REGISTER.md

@@ -63,6 +63,14 @@
 | DEBT-028 | `ActivateModelHandler` had no HTTP endpoint, and would have corrupted approval data if wired naively | High (3) | Low (1) | Completed (DB verification pending) | Found via a systematic sweep of every `*Handler` registered in `Program.cs`'s DI container, checking whether each is actually referenced by an `Endpoint.cs` or a job (the same method that found DEBT-026/027) — `ActivateModelHandler` was the only remaining orphan in `Features/ApprovalWorkflow/`: no `POST /approvals/{id}/activate` existed, so an `Approved` proposal could never reach `Active`, the step this whole slice exists for. While wiring it up, found the handler's original call — `_sql.UpdateProposalStatusAsync(proposalId, ApprovalStatus.Active, userEmail, "Model activated by SRE", ct)` — would have passed the *activating SRE's* email/note through the `approvedBy`/`approvalNotes` parameters, overwriting the checker's real `approved_by`/`approval_notes` on activation, and never touched the schema's `activated_by`/`activated_at` columns at all (they existed since migration `0036` but nothing ever wrote them). Added a dedicated `ApprovalWorkflowSql.ActivateProposalAsync(proposalId, activatedBy, ct)` that only sets `status='ACTIVE'`, `activated_by`, `activated_at`, leaving `approved_by`/`approval_notes` untouched, and switched `ActivateModelHandler` to call it. Added `ActivateApprovalEndpoint` (`POST /approvals/{id}/activate`). Strengthened the existing `Activate_BySreAfterApproval_TransitionsToActive` test to assert `activated_by`/`activated_at` are set and the checker's `approved_by`/`approval_notes` survive activation unchanged — this would have caught the bug. `dotnet build -c Release` clean (0/0). Not run against a live database this session. | @claude | Session 2026-08-09 (BE/scheduler priority pass) |
 | DEBT-029 | `LogAuditEventCommandHandler` (VS-27 audit trail) is never called by any other slice | High (3) | Medium (2) | Backlog | Found during the same orphaned-handler sweep that found DEBT-027/028 — but unlike those, this one is NOT a missing single endpoint; it's a missing *cross-cutting integration*. `LogAuditEventCommandHandler` (`src/KArtSell.Modules.ModelOperations/Compliance/LogAuditEventHandler.cs`) is the intended call point for every other slice to record an auditable action (per `compliance.audit_event_types`'s seed data: `APPROVAL_PROPOSED`, `APPROVAL_APPROVED`, `MODEL_ACTIVATED`, `SELL_DECISION_MADE`, `SELL_EXECUTED`, etc.) — but nothing in `ApprovalWorkflow/Handlers.cs`, `TradeExecution/TradeHandlers.cs`, `SellDecision/*`, or `PortfolioReconciliation/ReconcileTradeHandler.cs` actually calls it. VS-27 ("Immutable Audit Trail") is marked `COMPLETED` in the WBS tracker with 5/5 tests passing, but those tests only exercise `AuditSql` directly — they don't prove the rest of the system ever produces an audit trail in practice. Net effect: the compliance/GDPR audit trail this system's governance model depends on (CLAUDE.md's "Evidence & Audit: Update/delete are blocked; new state appended as new revision") is currently empty in production regardless of how many approvals/trades/sell-decisions happen, because nothing populates it outside of direct `AuditSql` test calls. **Not fixed this session** — wiring it in touches 4+ handler classes across 3+ slices (a genuine cross-cutting integration, not a single bounded fix like DEBT-026/027/028), and each call site needs to decide what `EventType`/`Details`/`EvidenceLinks` are correct for that action rather than a mechanical change. Recommend one slice at a time, starting with `ApprovalWorkflow` (highest governance stakes) via its outbox events (`ApprovalWorkflowPolicy.CreateStateChangeEvent` already emits an event per transition — a downstream consumer job could call `LogAuditEventCommandHandler` from there instead of wiring it into every handler directly, matching this repo's existing Outbox→Inbox→consumer pattern). | @claude | Session 2026-08-09 (BE/scheduler priority pass, discovery only) |
 
+### Frontend Shell / Home (KBX Design Philosophy Adoption, V13-FE-007+)
+
+| ID | Category | Impact | Effort | Status | Notes | Owner | ADR |
+|----|----------|--------|--------|--------|-------|-------|-----|
+| DEBT-030 | `HomePage.vue` "확인 필요" section has no real signal source | Medium (2) | Medium (2) | Backlog | `frontend/src/features/home/pages/HomePage.vue`'s Attention section (KBX Business UX-AX Standard §2.4 "Exception Driven") currently always renders the empty state — there is no cross-feature aggregation endpoint yet for failed batch jobs, pending maker-checker approvals, or reconciliation breaks. Only `model-operations` and `sell-decision` features have `queries.ts`; other features (data-quality, marketData, portfolio) have no query hooks to source counts from. Wire real counts feature-by-feature once each has a stable query hook, rather than fabricating a placeholder aggregation API now. | @claude | V13-FE-007 (KBX shell/home adoption) |
+| DEBT-031 | Workspace tab dirty-guard has no feature screen wired to report dirty state | Low (1) | Medium (2) | Backlog | `frontend/src/shared/shell/workspaceStore.ts`'s `setDirty(screenId, path, dirty)` action and `KsWorkspaceTabs.vue`'s close-confirmation dialog (Business UX-AX Standard §58~59) are implemented and functional, but no feature page currently calls `setDirty`. `StandardScreenBoundary.vue` already receives a `state==='DIRTY'` prop per screen, but nothing bridges that per-screen signal up into the shared workspace store yet. Until a screen calls `setDirty`, tab close always takes the non-dirty path (closes immediately, no confirm). Wire via a small composable (e.g. `useWorkspaceDirtyBridge(screenId, path)`) called from screens that pass `state: 'DIRTY'`, one feature at a time — do not force every screen to adopt it in one sweep. Also note: the confirm dialog only offers "계속 편집"/"변경 버리기" (no generic "저장 후 이동", since there is no cross-screen save-orchestration hook to call). | @claude | V13-FE-010 (KBX workspace tabs adoption) |
+| DEBT-032 | `frontend/src/**` has git-tracked stale `.js`/`.vue.js` twins next to every `.ts`/`.vue` source, and they can silently shadow the source under default Vite/Vitest module resolution | High (3) | High (3) | Backlog | Discovered while adding two entries to `screen-types/catalogue.ts` (V13-FE-009): `vitest.config.ts` had no `resolve.extensions` override, so Vitest fell back to Vite's default order (`.js` before `.ts`), causing `catalogue.spec.ts`'s extensionless `import '../catalogue'` to silently resolve to a stale, git-tracked `catalogue.js` twin instead of the edited `catalogue.ts` — the new T11/T12 entries were invisible to the test. `vite.config.ts` already declares `extensions: ['.ts', '.tsx', '.vue', '.js', ...]` (so the dev server was never at risk), but `vitest.config.ts` did not match it. Fixed the immediate blocker: added the same `resolve.extensions` order to `vitest.config.ts`, and deleted the three stale twins directly implicated (`screen-types/catalogue.js`, `screen-types/tests/catalogue.spec.js`, `app/router.js` — confirmed unreferenced by any `.gitea/workflows/*.yml` and not emitted by any `package.json` script). **Not fixed**: this is a repo-wide pattern (confirmed present across most of `frontend/src`, deliberately git-committed across multiple past sessions per `git log`, e.g. commit `cada8fe`) — dozens/hundreds of other stale `.js`/`.vue.js` files likely still exist alongside their `.ts`/`.vue` sources and were not swept in this session (out of scope for the KBX design-philosophy adoption this debt was found during). Needs a dedicated session to (a) determine why these were being dual-maintained in the first place — no `package.json` script emits them, so likely a leftover from an earlier tsc/build config or manual habit — and (b) either delete them all (now safe, since `vitest.config.ts`/`vite.config.ts` both prefer `.ts`) or explain why they must stay. | @claude | V13-FE-009 (KBX Fast Entry/Work Queue template adoption, discovery) |
+
 ---
 
 ## Impact/Effort Matrix (Updated: PR 4)