feat/discovery

?descubre strip fires on non-200 response, silently losing the pull

apps/platform/src/components/discovery/FeatureSpotlight.tsx:170

The useEffect that removes ?descubre fires when `requested && response && !isPlaceholderData` — it does NOT require response.status === 200. On a 500 error, ok is false so no card shows, but the param is deleted. The pull is lost silently with no retry path. Fix: add `&& ok` (or `&& response.status === 200`) to the guard.

No DELETE RLS policy on discovery_state for authenticated users

packages/database/drizzle/0062_discovery_state.sql:26

SELECT/INSERT/UPDATE policies exist for 'authenticated'; DELETE is missing. RLS default-deny means users cannot self-delete rows through the API. service_role ALL covers server-side deletes. FK cascade on profile_id handles lifecycle cleanup. Worth documenting the intentional omission if a self-service reset path is planned.

Test passes `exposures` to `listEligibleKeysOnPage` which doesn't accept it

domains/cross-domain/src/__tests__/feature-discovery.decisions.test.ts:413

The test helper passes an `exposures` property to listEligibleKeysOnPage, but the function signature has no such parameter. TypeScript's excess property check on object literals flags this as a compile error. Either the signature was trimmed without updating tests, or the param was supposed to be added. Will fail tsc in strict mode.

`isFirstRunTourPending` placed in cross-domain instead of core discovery decisions

domains/cross-domain/src/feature-discovery.decisions.ts:222

The predicate operates solely on DiscoveryState rows (core-domain entity) with no cross-domain dependency. Per canonical form, single-domain predicates belong in the owning domain's decisions file (domains/core/src/discovery/discovery.decisions.ts). The shortcut avoids a circular import concern but inverts the dependency direction: core shells now implicitly depend on cross-domain.

setState during render comment overstates the no-repaint guarantee

apps/platform/src/components/discovery/FeatureSpotlight.tsx:144

Comment says setPick during render avoids 'a paint flash'. React's guarantee is synchronous re-render in the same pass only before commit; the convergence guard is necessary. The comment could mislead maintainers into dropping the guard. The code is correct; the comment needs tightening.

Double blank line left after isFirstRunTourPending removal

domains/cross-domain/src/feature-discovery.shells.ts:87

Two consecutive blank lines between FeatureDiscoveryErrors closing brace and the shell section comment — stray artifact from the extraction. Project convention is one blank line between top-level declarations.

Double blank line left after isFirstRunTourPending removal

domains/cross-domain/src/feature-discovery.shells.ts:87

Duplicate of above — de-deduplicated in counts.

7-line JSDoc on isFirstRunTourPending exceeds project altitude

domains/cross-domain/src/feature-discovery.decisions.ts:215

Per CLAUDE.md: no multi-paragraph docstrings. The architectural placement rationale belongs in the cross-domain CLAUDE.md caveats file, not in the function JSDoc. Trim to the function contract.

No regression test for pull-card blink fix (keepPreviousData + isPlaceholderData)

apps/platform/src/components/discovery/FeatureSpotlight.tsx:129

The pull-card blink was a production bug: response going undefined during refetch caused firstRunTourPending to flip true and blink the card; ?descubre stripped before the pulled key was picked. Fixed with keepPreviousData + isPlaceholderData guard. No test pins this interaction. A mock simulating isPlaceholderData=true should assert the strip does NOT fire and firstRunTourPending stays stable.

No regression test for add_contract routing through tutorialHref

apps/platform/src/components/discovery/DescubreMenu.tsx:61

The bug was that add_contract routed to ?descubre=add_contract (ambient coachmark) instead of the RPU sub-tour. Fixed by routing through tutorialHref(next). No test asserts tutorialHref({ key: 'add_contract', ... }) returns a subtour URL. High consequence: wrong surface = confusing UX for the highest-intent moment in the discovery flow.

No regression test for timer-leak fix in TourOverlay

apps/platform/src/components/discovery/TourOverlay.tsx:93

The timers[] fix prevents in-flight retries from firing after cleanup. A vi.useFakeTimers() test that triggers cleanup mid-retry and asserts no further state mutations would pin this regression. Without it, the bug is invisible to TypeScript.

No regression test for parked-state reset in RpuSubTour on re-open

apps/platform/src/components/discovery/RpuSubTour.tsx:86

Bug: parked=true from a prior session persisted into a fresh re-open. Fixed with setParked(false) in the open effect. No test covers the re-open scenario: open tour → park → close → reopen → assert parked=false and step=0.

SpotlightCoachmark may have the same single-timer leak pattern as TourOverlay

apps/platform/src/components/discovery/FeatureSpotlight.tsx:282

SpotlightCoachmark has a retry loop with `let timer = window.setTimeout(...)`. If it reassigns `timer` across retries (same pattern as the TourOverlay bug), only the last timer is cleared on cleanup. This diff fixed TourOverlay but not SpotlightCoachmark. Worth confirming the structure is safe and, if not, applying the same timers[] fix.

Three scattered ternaries for the same `ok` guard could be one block

apps/platform/src/components/discovery/FeatureSpotlight.tsx:133

resolvedKey, eligibleKeys, and firstRunTourPending are all `ok ? <real> : <default>`. A single destructure block would make loading/error defaults visible as a unit. Minor readability improvement.

keepPreviousData prose duplicated across two comment blocks

apps/platform/src/components/discovery/FeatureSpotlight.tsx:124

Lines 124-130 explain keepPreviousData interaction; lines 157-169 re-narrate for firstRunTourPending. Per project convention (no multi-paragraph docstrings), collapse to one definitive note.