fix(ui): /m approval card sends the tapped option as the decision — select → note → explicit Send, alert Got it, real type labels; one respond-payload builder shared with desktop (#2370)

[webmixgamer]

Summary

• The bug: the /m mobile admin's queue card POSTed { response: 'approved', response_text: <tapped option> } for every answer — a Deny was recorded as an approval, a typed answer became a note, the card answered on one tap with no note and no explicit submit (desktop QueueCard is select → optional note → Send), and the type line read a nonexistent request_type (blank). The agent reads response as the decision (sync write-back + the ent#329 resume framing), so the field is load-bearing. Live artifact: the two cards answered on /m during the bug: background polls re-flash loaded content and reset UI state (design-system p13/p14) #1927 eyeball sit in the agent's queue file as response='approved', response_text='Approve'.
• The fix: utils/operatorQueue.js is now the ONE builder of the respond payload, shared by the desktop store and /m (the bug class was a second hand-built producer). /m reaches desktop parity: select (aria-pressed, inset ring) → restated consequence → optional note (no Enter-submit) → Cancel (focused on reveal, p19) + Send: <option>; question = text + Send; alert = Got it; title line; real type labels (Needs approval / Question / Heads up, shared with QueueCard).
• Honest state: success drops the card locally before the refetch (fetchQueue swallows its own errors) and a monotonic guard stops a stale poll from resurrecting an answered card; a 5xx/transport failure renders an InlineError inside the card (p18) with the selection + note kept for a retry; a 409/400/404 "no longer pending" refusal drops the card and shows a persistent page-level notice, scrolled into view. Per-card state is keyed by item id, pruned on every poll, cleared on logout. Colour-free CSS only.

Changes

• src/frontend/src/utils/operatorQueue.js (new) — queueResponseBody / buildQueueResponse / queueResponseKind (by item type: approval-with-options → buttons, alert → Got it, else text answer) / optionsOf (the DB stores whatever JSON the agent wrote) / queueTypeLabel / QUEUE_RESPONSE_NOT_RECORDED + respondRefusedAsNotPending (409/400/404)
• src/frontend/src/stores/operatorQueue.js — body via the shared builder (note trimmed, empty → null; a blank decision never reaches the wire); 400/404 join 409 with the shared attribution-free copy
• src/frontend/src/components/operator/QueueCard.vue — imports the shared type label
• src/frontend/src/views/MobileAdmin.vue — the card rebuild above; .ops-card-type off gray-500 (the contract's dark-ink floor); data-testid hooks
• src/frontend/tests/unit/operatorQueueResponse.spec.js (new) — decision table, behavioural store test (vi.mock('axios')), source-wiring + residue guards
• src/frontend/e2e/mobile-admin-queue-respond.spec.js (new, @smoke) — one method-aware page.route serves the GET and captures the real POST body; "no POST on tap" is proved by order (tap → form → Send → exactly one captured body)
• Docs: feature-flows/mobile-admin-pwa.md, feature-flows/operating-room.md, requirements/public-access.md §27.3, flows index, 2 learnings.md entries, CSO diff report

Test Plan

• vitest run — 57 files / 1224 tests (45 new)
• Playwright against the live stack — 16/16: the new spec (7) + the bug: background polls re-flash loaded content and reset UI state (design-system p13/p14) #1927 /m (5) + Operations (3) regression
• Proved to fail on the pre-fix code (source stashed, spec kept): test 1 fails with a tap must not answer; captured POSTs: [{"id":"e2e-2370-approval","body":{"response":"approved","response_text":"Deny"}}]
• vite build ✓ · check:tokens ✓ · loading-gate ratchet ✓ · raw-colour scan (review-enforced, not CI): views/MobileAdmin.vue 0 / 4 / 128 (baseline 0 / 4 / 130), QueueCard.vue 28 / 59 / 0, stores/operatorQueue.js 4 / 0 / 0 — all unchanged or smaller
• Operator eyeball on localhost /m (three seeded cards), then the agent's own queue file: approval → response='Approve', response_text='test' · question → response='test answer' · alert → response='acknowledged' — never 'approved'
• /review — 0 critical, 7 low items applied · /cso --diff — 0 findings (docs/security-reports/cso-diff-2026-08-21-2370-mobile-approval-payload.md)

Notes for reviewers

• AC Setup improvements #5 deviation (deliberate): a failed respond no longer goes through the old top-of-page reportActionFailure banner — 5xx/transport → per-card InlineError (design-system p18: next to the control; also drops the untrue "Nothing was changed" for a timed-out POST), 409/400/404 → the persistent page banner (the card is about to leave). Honest failure is preserved and more visible.
• Desktop touches are DRY plumbing only: the store now trims the note (" " → null) and shares the refusal copy; QueueCard renders the same label set. No desktop UX change.
• Follow-ups filed: bug: Workspace asks panel sends a typed answer as response_text (the agent reads response: "") and answers approval asks one-tap — same class as #2370 #2375 (Workspace asks panel — same inversion for typed answers, different endpoint/model), bug: POST /api/operator-queue/{id}/respond accepts any string as an approval decision — no layer checks response ∈ options #2376 (server-side response ∈ options check — the guard that would have made this a 422 five months ago), bug: Operations feed never shows "your response was not recorded" after a respond race — fetchItems() wipes the copy and the UI only renders it as a refresh-failure detail #2377 (desktop never shows the not-recorded copy; fetchItems() wipes it). Residual registered in trinity-dev DEBT_INBOX (options size-cap marker selectable on both surfaces — parity). Notes left on refactor: decompose oversized Vue views (Settings 3061 lines, MobileAdmin, Agents, AgentDetail, ...) #1030 and refactor: route destructive confirms through ConfirmDialog — eliminate native confirm() (design-system p19) #1924.

Fixes #2370

🤖 Generated with Claude Code