Release notes

Hotfix: tolerate a string-typed projects:index state value (capsule state can return JSON as text — the app already coerces objects via coerceObj, but the array readers didn't). New coerceArr used in /bootstrap, POST /projects (which would otherwise CLOBBER the index to a single entry), and /outreach/template. Direct-to-live: the client list was rendering empty.

Reskin to Bento Design System defaults (bento-ds.com / buildo defaultTokens): brandPrimary violet #5C17E5 (hover interactive60 #360090, soft interactive05 #D0DCFF), textPrimary #1A212B / textSecondary #728197 on backgroundSecondary #F6F8FB canvas with white cards, outlineContainer/Decorative hairlines + visible outlineInput #9AA8BC input borders, Bento semantic sets (informative/positive/warning/negative bg+text tokens, #F2930D warning stars, #17BF33 positive tick), 8/16px radii + Bento elevation shadows, Lexend-first stack. Survey header (public + preview) back to the friendly solid-brand block with white text. Slider keeps the filled-track/white-thumb pattern recolored to brand violet with decorative track.

Excel export for approved participants: toolbar button (visible on the Approved filter) fetches missing emails for ALL approved (8/batch, live progress + cost), then builds an .xlsx client-side (exceljs) matching the client's example format — bold header row: Email, First Name, Last Name, LinkedIn (link, hyperlinked), Job Title, Employer, State (if US), Country. Loading card with spinner during the run, then a download card (file icon, name, row count/size/lookup cost, Download button). New GET /export/approved returns export rows (profile-derived title/employer + US state/country parsed from location) + which recruits still need a lookup.

Drafting UI removed (server drafting endpoints stay dormant): the selection action is now "Get emails" — it just resolves addresses. Bulk button looks up every selected person without an address (8/batch, live progress + real cost, previously-failed lookups skipped); every candidate card gets a "Get email" button (retries with force when a prior lookup found nothing) and shows the found address as a badge (or "no email found"). /candidates now hydrates contact so emails render in the list; /outreach/resolve returns slim per-recruit results and accepts force. Addresses persist to the global recruit panel via op_resolve_participant_contact as before.

Logo: replace the plain violet square with a proper mark — Bento-violet rounded tile, white head-and-shoulders person, four-point sparkle in Bento tertiary #B3BEFF (echoes the ✦ AI affordance) — inline SVG in the sidebar brand and a matching data-URI SVG favicon.

Reskin to Park UI (park-ui.com default theme: neutral accent + neutral gray, i.e. Radix gray scale): near-black #202020 solid buttons/selected states, white cards with gray.5 hairlines on gray.1 canvas, l1/l2/l3 radii (6/8/12) with full-round badges, Panda xs/md/lg shadows, Inter stack, grass/amber/red 9-11 semantic colors, amber #ffc53d stars. Park UI slider per docs: 8px rounded-full track with solid filled range (CSS --pct custom property, JS-updated on the public page), 20px white circular thumb with 2px accent border + xs shadow — applied to editor ghost, preview modal, and hosted public page. Public survey page header switched from solid accent block to Park white card.

Fix textarea Shift+Tab with a bare caret (no selection): the line-wise branch sliced an empty segment (start==end) so outdent was a no-op — it now operates on the caret's whole current line.

Bento DS restyle (bento-ds.com defaults): Lexend variable font (wght 400-600, ASCII+punctuation subset, 11KB) inlined as a data URI in src/fonts.css (external font hosts are CSP-blocked and the bundler has no woff2 loader); Bento neutral scale #F6F8FB/#DEE4ED/#728197/#1A212B, brand violet #5C17E5 (hover #360090), Bento semantic greens/ambers/negatives, 8px controls / 16px cards radii, soft shadows. Replaces the Fluent token theme.

Outreach moves into the Candidates selection flow: bulk bar gains "Generate emails" for the selected people (OutreachPanel with template + AI draft + durable generate job + address lookup for the selection); Outreach tab/page removed; /outreach/generate + /outreach/resolve now take explicit recruit_ids, new /outreach/contacts read. Textareas get Tab/Shift+Tab indentation and Word-friendly paste normalization (CRLF, nbsp, bullet glyphs to markdown dashes). Cost display fixed to sub-cent precision — $0.005 no longer rounds up to $0.01 (client fmtUsd + server log fmt).

Reskin to Thumbtack's Thumbprint design system (thumbprint.design tokens): blue #009fd9 accent (blue-500 hover, blue-100 soft), black #2f3033 / black-300 text, gray-200/300 surfaces + hairlines, token radii (xsmall 4 / small 6 / medium 8, sides 9999 for answer pills), shadow-100/300/400, Rise font stack at 14px app / 16px respondent page, yellow #febe14 stars, red/green/yellow 100+500 semantic pairs. Applied across app chrome, question editor, preview modal, hosted public survey page, and favicon.

Move outreach generation into a durable server job (worker 'outreach'): /outreach/generate now snapshots the approved ids + template into a run record, kicks the job (batches of 20, per-batch idempotency keys, resume-safe) and returns job_id; new GET /outreach/status; client polls with batch progress. Fixes the sync_route_fanout finding for large approved sets. Removed the unused op_get_project_outreach permission.

Outreach page: generate emails for all approved candidates — AI drafts a merge template (subject/body with {{first_name}}/{{company}}/{{title}} tokens) from the brief, op_add_outreach_draft renders+saves one per approved recruit (batched 50/call), results mirrored to app state (bodies aren't in the list read); address lookup for approved without email via op_resolve_participant_contact in 10-person batches with running cost shown. Permissions +op_add_outreach_draft +op_get_project_outreach. Full restyle: Fluent design tokens (Segoe UI stack, neutral #fafafa/#e0e0e0, brand blue #0f6cbd, 4px control radius) with Swiss restraint — flat cards, hairline borders, no gradients, subtle motion; violet accent retired.

Search cost + 200-result cap: the worker budgets each query's Exa ask against RUN_RESULT_CAP=200 (stops the run when reached; panel resurfacing stays free/uncapped), accumulates the op's cost envelope into progress + per-query log lines; live banner shows results/cap and spend; completion persists a run_id-keyed per-search history (last 12) in project meta; /project returns it; Project page renders a Recent searches card (when · results · new · cost, ~ = estimated) and the find bar mentions the cap.

Survey creation UX rebuild: type-mapped question editors (Google Forms-style option rows for choice modes with Enter-to-add/blur-to-remove, fixed Yes/No rows, star/NPS/slider/text ghost previews, per-type config fields) + custom answer-format picker with SVG icons replacing the bare select + full-screen interactive Survey Preview modal mirroring the hosted respondent page (wired into both the New Survey flow and the survey overlay editor) + option sanitization and needs-2-options guardrails on create/save.

Planner prompt: reason-first (name the core subject, enumerate who actually does the work, write in their profile language) with calibrated anchoring — niche-equipment briefs tether peripheral titles to the trade/setting (fixes DMMV pulling HVAC/building managers), broad-role briefs keep clean persona+geo queries (preserves principals/counselors quality); portfolio of tight+broad queries; thinking+personas in output and logged; exclude cap 15; add POST /debug/plan preview route.

Review fixes (frontend): C1 — scope pollStatus finally cleanup to the owning poll (no clobber of a newly-attached poll on project switch). C4 — loadMore offset derives from rows.length so it self-corrects after review drops rows. C5 — clear selection+comment on filter/origin change (no bulk verdict on off-screen rows). M1 — auto-focus 'New this search' via a searchDoneTick that fires only on genuine completion, not on stop/project-switch. C2 — show 'top N by fit' when the list is capped.

Review fixes (server): C6 — classify HTTP 500 / internal_operation_error as infra-retryable (they're transient; were being silently dropped, losing queries). C2 — raise /candidates fetch cap to 5000 (page up to 60) so realistic projects sort+paginate over the full set (no unreachable tail, correct score order); add capped flag. C7 — fresh_count now reflects fresh rows within the active filter, not the global set.

Live search chain-of-thought: worker appends a running log (planned N, 'Searching i/N: <query>', per-query 'X new / Y from panel / total', retry pauses, complete) to progress; /search/status already returns it. Banner renders the log + current query live; removed the Stop watching button.

Redesign v1 (public survey page): match the app — kill every gradient (solid violet header + brand mark, solid accent submit button, solid green thank-you tick), single restrained violet accent (#5b45e0) on 1px hairline borders, crisp 8px radii on cards/inputs/answer controls, 6px chips (no 999px pills). Respondent-facing emoji-scale answer options are content and left intact.

Per user: keep also_search_panel (resurface + filter). Remove the untriaged-count cap + query truncation in /search/start (it wrongly blocked resurfacing-heavy projects); run the full plan. Frontend: after a search completes, auto-focus the 'New this search' filter so the reviewer isn't buried under resurfaced panel members.

Frontend for durable-job search: App uses a SINGLE status-poll loop (no step loop, no concurrent polling — item 3). Candidates: default to New (review queue) filter (item 7), origin filter fresh/panel (item 6), Exa rank + source_query badge (item 4), flag chips (item 5), fit-score band colors (item 9); reviewed rows leave a status-filtered view.

Durable-job search (item 10): search runs entirely in workers.search with per-query infra/409 backoff (fixes retry storm 1); removed /search/step + /search/adopt; /search/start kicks startJob, client polls /search/status only (fixes concurrent loops 3). Worker captures find-only fields rank/source_query/origin into searchmeta. /candidates merges searchmeta + supports origin (fresh/panel) & status filters (items 4,6,7). Improved query-plan prompt (item 11).

Redesign v1 (frontend): full-bleed shell, kill all gradients → single restrained violet accent (#5b45e0) on 1px hairline borders + minimal shadow, crisp 8px cards / 6px badges (no pills), remove all emoji from chrome (SVG gear + trash icons, text-only answer-mode dropdown), denser/tighter type scale, left-aligned Home header (no gradient hero), remove survey-card top stripes. Fold in the settings-overlay crop fix: drop animation-fill-mode `both` from .fade-in so the ProjectPage wrapper no longer establishes a containing block for the fixed overlay.

Frontend: single serialized search driver with exponential backoff (no concurrent status poll); Candidates grid is lean + paginated (Load more) with on-demand profile hydration on expand and counts-only polling during search.

Perf/OOM fixes: (1) /candidates is now lean + score-sorted + paginated (no profile hydration); add /candidates/count for polling and /candidate for on-demand single-recruit hydration. (2) /search/step separates infra 5xx (stop + backoff) from in-flight 409 (skip), removes retry-storm and dead code. (3) /search/start caps the untriaged backlog (800) and truncates queries to headroom. (4) add op_get_participant permission.

WAF probe: helper exercising generics, .test and a regex literal to learn the firewall ruleset before the real edits.

Public page: CSP on the public host blocks fetch() — switch submission to a native form POST via hidden inputs (validation-gated, Enter-key guarded). Host thanks page confirms recording.

CandidatesPage rebuilt: vertical full-detail cards (headline, meta, why-matched, full bio, complete experience/education/certificates with years and descriptions, no Show more), bulk + per-card review; createElement style.

ProjectPage rebuilt: three markdown text fields (titles, questions, additional info) with explicit save keeping text as pasted; AI populate overrides them; createElement style.

Add lightweight markdown renderer (createElement style, match-based parsing).

Design refresh (retry after 502): typography, chevron dropdowns, markdown styles, vertical candidate card entry styles.

Wire the full app in one atomic patch: ProjectPage workspace, real App shell (routing + bridge), full server (surveys CRUD + working-copy sync + styled public page + infer drafting + candidates).

Candidate types gain education/certification description fields.

Fields become raw text kept as pasted; AI populate joins to text and returns *_text; planner prompt rewritten for 10-15 facet-varied queries at 25 hits; education/certification descriptions included.

probe edit 3 anchor only

Phase 2d: add NewSurveyPage + SurveyOverlay (completes ProjectPage's imports).

Additive: GET /project now also returns docText + lastPlan so Survey Studio's same-origin bridge can show the brief document and search plan (own UI unchanged — it ignores extra fields).

search/step is now a reconcile pass over ALL unclaimed queries (cached claims instant, conflicts skip instead of blocking); orphaned reservations abandoned after 15 conflict-only attempts; client surfaces abandoned counts. (retry)

Durable search: launch ALL queries in parallel inside /search/start (ops continue at the gateway after the route ends, so the run completes even with the tab closed); step loop becomes a claim/reconcile pass; retry cap raised to 60; button navigates immediately. (retry)

Phase 2b: add HomePage, QuestionEditor, ProjectPage, NewSurveyPage, SurveyOverlay views (wired in next patch).

Add zero-cost ping worker + /debug/ping to probe the job runner; step retries now cover generic refusal wrappers with an 8-attempt cap per query.

search/step: on a write error, re-read progress first — a finished run reports done instead of surfacing a stray refusal. (retry after 502)

Classify idempotency conflicts (already running for the supplied key) as retryable in both the step route and the client loop — they mean the query is still finishing, not a failure.

Coerce string-stored search progress records via JSON.parse in status/step/adopt/start so externally-written state still resumes; next setProgress rewrites as an object. (retry 2 after platform 502)

Phase 2a: add design system CSS, mode catalog, shared types/api helpers, HomePage, QuestionEditor.

search/step: bridge timeouts and idempotency conflicts no longer kill the run — return retryable and let the client re-claim the committed result; client waits 8s on retryable steps.

Treat took_too_long/timeout/5xx step responses as retryable (the query commits server-side; the retry claims the cached result); the status poller restarts the step loop if it is not running.

Add /search/adopt route: when a background job dies mid-run, the client adopts the same run (same plan, same idempotency keys) and continues stepping automatically. (retry after platform 502)

Hybrid search engine: /search/start plans + tries the background worker, falls back to client-stepped mode; /search/step runs one query exactly-once via deterministic idempotency keys; client resumes stepping after reload.

Switch background search from the jobs step-API to the workers dialect this deployment wires (export const workers + startJob); deterministic per-query idempotency keys make re-driven runs spend-safe; pass run_id from /search/start.

search/start: ignore a previous job that already failed/errored when deciding already_running.

Move the whole search into a durable background job (plan + 4-8 queries as checkpointed steps, progress in state); routes /search/start + /search/status; client polls progress and resumes watching after reload; no 60s-driven limits.

Default the client picker to the first existing client once projects load (was stuck on New client).

Lazy-load mammoth/pdfjs inside extractText so nothing executes at mount (fixes first-paint crash); drop unused op_get_participant permission.

Full redesign: left-nav light UI; Project page with client/project pickers, titles/questions/info fields, docx-pdf AI populate; silent AI query planning; one-query-per-request Exa search with background-completion polling (fixes took_too_long); rich candidate cards with bulk approve/maybe/reject; Communicate and Responses removed.

Send one email per request (gateway replaces responses on refusal, so batch loops lose per-recipient outcomes); extract blocked-envelope error messages in the client api helper.

Wire all four wireframe tabs (Criteria, Results, Communicate, Responses) into the App shell with project selector and cross-tab recipient handoff.

Add CommunicatePage: recipients, subject/message with merge tokens, survey question builder, signature, save drafts and Gmail send with per-recipient outcomes.

Add ResultsPage (lead review with star/select/resolve) and ResponsesPage (survey answers pivot table).

Add CriteriaPage: project creation, source doc upload, AI criteria with editable rows, version approval, query planning and lead generation.

Full server: projects, doc ingest, AI criteria + approval, Exa lead generation, participant status/resolve, surveys, outreach drafts + Gmail send, responses pivot, prefs, debug probe (fixed ||/?? parens).

initial deploy