[EPIC] Working Capital loan servicing — four backend endpoints with no UI, and the gaps found alongside them

[Aman-Mittal]

Summary

The Working Capital loan detail screen (src/app/features/working-capital/loans/wc-loan-view.component.ts) presents a loan as read-only. Four Working Capital capabilities exist on the Fineract backend and are already generated into src/app/api, but nothing in this UI reaches them:

• delinquency actions — listed, but cannot be created
• breach actions — no tab at all
• near-breach actions — no tab at all
• loan originators — cannot be attached to or detached from a loan

An operator who needs to record a breach action on a working capital loan has to leave this UI and call the API directly.

Working through those four surfaced several unrelated defects and coverage gaps in the same neighbourhood, tracked here as sub-issues so each can be reviewed on its own terms rather than as one undifferentiated diff.

Scope

Sub-issues cover:

1. The four missing Working Capital write paths.
2. A generated-client sync against apache/fineract:latest, and the interop loan-repayment command that the sync turns into a call with a missing body.
3. The dashboard guidance tour highlighting the sidebar instead of the card its own copy describes.
4. Global search silently swallowing a result click under load.
5. RBAC dimensions the existing backend RBAC spec does not reach.
6. A repeatable demo dataset for manual release-candidate testing.

Out of scope

• Editing or deleting existing delinquency/breach/near-breach actions. This epic covers create and list; correction paths are a separate concern (compare An interest pause can be created and deleted but never corrected #283 for the equivalent gap on interest pauses).
• Working Capital screens still using the browser's native confirm() — tracked in Working capital, accounting and scheduling screens use the browser's native confirm box (8 sites) #232.

Notes

Items 1 and 2 depend on Fineract 1.15.0+ endpoints that are not reachable on the public community sandbox, so their e2e cover is mocked.

[Aman-Mittal]

Closing — all six sub-issues are complete, delivered by #408 (merged as 23705cd3), with the two follow-up defects it exposed fixed in #412.

Sub-issue	Delivered by	Evidence
#396 WC loan read-only	wc-loan-view gains breach / near-breach / originator tabs, three action-form components on routes guarded by UPDATE_WORKINGCAPITALLOAN	npm run check:route-permissions — 309 screens, 274 gated, guard order and nav visibility agree
#397 Interop repayment sent with no body	Spec re-synced (1472 → 1475 schemas); the call now sends dateFormat + locale	public/api/fineract.provenance.json records image digest sha256:dd7721fa…; npm run verify-api-client clean
#398 Tour highlighted the sidebar	targetSelector moved from 'ul' to .status-list; tour buttons routed through COMMON.*	e2e/guidance-tour-dashboard.spec.ts asserts the highlighted element, not merely that the tour advanced
#399 Search click swallowed by blur timeout	Result items preventDefault() on mousedown, so the searchbar never blurs for a result click	header.component.test.ts, plus e2e/global-search-nav-shortcuts.spec.ts
#400 RBAC coverage gaps	e2e/rbac-multi-permission.spec.ts — OR-semantics routes, ALL_FUNCTIONS_READ against Fineract's real catalogue, a second action-level gate, reload persistence	Registered in BACKEND_SPECS; every refusal asserted both as Access Denied and as a 403 from Fineract
#401 No repeatable demo dataset	npm run seed:demo-data, its own demo-seed Playwright project	Composed from existing seed-api.ts helpers; not a member or dependency of BACKEND_SPECS, so it cannot run as a side effect of --project=backend

Suite state at merge: Karma 921 + Vitest 270 = 1191, unchanged from before the branch, so nothing was lost.

Two defects this epic's own CI gates caught after merge

Worth recording, because both are the gates working rather than noise, and both are fixed in #412:

• unlink-outline on the originator detach control was never added to APP_ICONS. Ionic resolves an unregistered name by fetching an SVG over the network, which the production CSP blocks (The production CSP blocks Angular's critical-CSS onload and the federation blob: module, so the main stylesheet never applies in the container #360), so the control rendered as blank space with nothing in the console.
• api-surface.json did not record the eight operations the new screens call — 8 added, 0 removed, 142 → 145 services, 564 → 572 operations.

Deliberately still open

• Editing and deleting existing delinquency / breach / near-breach actions — create and list only, as scoped above.
• Working capital, accounting and scheduling screens use the browser's native confirm box (8 sites) #232, Working Capital screens still using the browser's native confirm().