fix(ui): honor plan notice period in purchase date defaults

[cristim]

Add Purchases prefilled tomorrow even when the plan required several days of notice, leaving the first empty purchase inside its veto window. The default now uses the displayed plan's configured notice period and UTC calendar day + N + 2, where N is that notice period. Earlier dates remain selectable with a warning, and missing or invalid notice metadata disables submission.

Verified exact head cc73905e1ff8bf99260ac32c18ba982079ddc002 on merged creator base 5134af444026276c6cdbf7a135ca00e54d656ef0:

• Pinned Node 24: 211 affected Jest tests, typecheck, changed-file lint and production webpack build passed. Normal hooks passed; the existing bundle-size warning remains.
• Independent headless Chromium desktop and phone checks passed in UTC, Los Angeles and Berlin, using the production bundle. Browser API responses were mocked; earlier user-selected dates and the unchanged picker minimum were checked.
• Captured suggested and earlier selected dates were separately replayed through the actual routed GET/POST handler and native PostgreSQL schema 119 fixture. Both durable root dates and the plan clock matched exactly. Authentication and cloud accounts were fixtures; no provider, notification or purchase execution ran.
• Actual veto helper checks and explicitly source-derived notification admission arithmetic passed at the same later ticks and boundaries. Exact-parent default and guard-deletion controls failed with behavioral assertions, then restored tests passed. This does not establish production scheduler cadence.

Two retained exact-tree reviews and two fresh independent cold verification passes are clean at this head, tree b6d5dd8357570b2a874e3d17f14a58038d53e61c. The cold verifier reproduced the tests, browser scenarios, native handler/store checks and negative controls itself. This satisfies the project's exact-revision independent-review alternative to CodeRabbit; any later review finding still blocks merge.

Refs #631. This PR does not close or implement the separately requested graph editor.

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 4 billable files and costs up to $1.00.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 17 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 64 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-platform/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: 8e0847f7-8586-4b4f-bbfd-68eb99dc46b7

📥 Commits

Reviewing files that changed from the base of the PR and between 5134af4 and cc73905.

📒 Files selected for processing: 4

• frontend/src/__tests__/plans-range-validation.test.ts
• frontend/src/__tests__/plans.test.ts
• frontend/src/plans.ts
• frontend/tests-e2e/plan-purchase-notice.spec.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Independent non-author verification is clean in two passes at exact SHA cc73905e1ff8bf99260ac32c18ba982079ddc002, tree b6d5dd8357570b2a874e3d17f14a58038d53e61c, base 5134af444026276c6cdbf7a135ca00e54d656ef0.

The verifier independently ran 211 affected Jest tests before and after restoring its scratch mutations, typecheck, changed-source ESLint and an isolated archived-head production build. Its own desktop and phone Chromium scenarios passed in UTC, Los Angeles and Berlin, with screenshots inspected and no captured console/network errors. Browser APIs were mocked.

Its own captured suggested date 2026-10-20 and earlier selected date 2026-10-16 were replayed through the actual routed GET/POST handler and native PostgreSQL schema 119 fixture. Durable root dates and plan clock matched; authentication/accounts were fixtures. Test database inventory was empty before and after. No notification, provider or purchase execution occurred.

Behavioral controls: exact parent source failed the date assertion (expected 2026-10-19, received 2026-10-16); removing the invalid-notice submit guard caused six API-call assertion failures. Restored source matched the author and 211 tests passed. Timing checks called the real veto helper and separately reproduced notification admission arithmetic at fixed later ticks; they did not call an actual notification tick or prove production cadence.

Source trace: displayed notice → escaped button metadata/callback at plans.ts:1168 and :1243 → validated modal default/warning/submit guard at :2247–2297; backend date parse at handler_plans.go:638, notification admission at notifications.go:67–70 and veto cutoff at plan_step_attach.go:99 and :345–346. Retained source review also completed two clean passes on this exact tree. Root retains final normal merge; CI runs are watched individually.

CodeRabbit's automatic comment is a review-limit notice, not a completed clean review. The exact-revision independent-review alternative is used; no paid review was requested and the quota message is not counted as a review pass. Any actionable finding from a later review still blocks merge.

[cristim]

Current-main compatibility check for the existing date fix:

• Published head remains cc73905e1ff8bf99260ac32c18ba982079ddc002; no source, refs or published history changed.
• Tested main is 9da13c6cefee4dbbdb9515c483ed92acaf5ae81a. Conflict-free combined tree is 2b982c9b3c3e2186c871110c87442f4d4f9ddc3c. Its only backend difference from the PR head is the already merged fix(api): show attached planned purchase quantities #876 mapper/test patch. Frontend source and the independently rebuilt archive bundle are byte-identical.
• Two independent local compatibility passes found no actionable findings: 211 Jest tests, typecheck, changed-source lint, production build, mapper race tests, and six desktop/phone production-bundle browser cases passed. Browser APIs/auth were mocked.
• Native named tests replayed the browser's UTC suggested/user-selected dates through the actual Handler and local PostgreSQL at schema119, with fixture authentication and fresh owned databases. Stored dates/clock matched; database inventories were empty before/after. Timing tests passed using the actual veto helper and explicitly source-derived notification admission, not a notification-manager or cadence test.

These are local fixture compatibility results. They do not satisfy the latest AGENTS real-scenario or exact Codex-opus-5-5 review requirements and do not establish CI on the combined tree. Existing green CI and the earlier review evidence remain bound to the unchanged published head. GitHub still advertises an older test-merge based on 5134af4; final normal merge requires checking current main/protections and retaining #876. No live purchase, provider execution or deployment was performed.

[cristim]

Owner gate assessment: the owner's explicit standing decision uses independent gpt-6.1-sol at medium for all reviews and supersedes the earlier exact-Opus requirement. The owner accepted realistic local verification for this date UI and authorized normal pushes/merges after adversarial review, local verification and normal checks. The earlier model/fixture merge-hold wording in this thread is superseded; the evidence itself remains explicitly labeled.

Current main f038e2de88eb55b4679113fcb6cce789593403f9 adds only the #879 integration test to previously verified 9da13c6. The conflict-free candidate with unchanged PR head cc73905e1ff8bf99260ac32c18ba982079ddc002 is tree ebd2a5b67e77bd99ab44bf65f46bd9609343ab2f, preserving #876 and #879. Independent compatibility review checks that this is solely the test addition over the previously verified combined tree; existing local proof transfers without a broad test restart. Required checks and the exact published head are rechecked before an ordinary squash merge, with no bypass. No live purchase is authorized or performed.

[cristim]

Post-merge verification:

• Normal squash merge 149544fe7d57f1b7b0b4cf651d8fb9f8ba3c7920 has parent f038e2de and the expected tree ebd2a5b6, preserving fix(api): show attached planned purchase quantities #876 and test(api): retain guarded planned purchase execution proof #879.
• All five post-merge workflows succeeded: full CI, pre-commit, frontend sentinel, frontend E2E and automatic AWS deployment.
• Read-only deployed identity verification returned HTTP200 from /version, reporting git_sha: 149544f and build 20261015051348. The running Lambda and corresponding image digest matched the same build/source.
• Behavior was verified locally through the actual form, fixture-backed browser cases and native Handler/PostgreSQL date persistence checks. No authenticated live plan write, purchase or notification-manager execution was performed; the timing evidence distinguishes the real veto helper from source-derived admission arithmetic.

The date-default fix is complete. The broader graph editor remains tracked with #631; #880 is the separate no-write preview leaf, while atomic graph scheduling is still being developed. This fix does not close that broader work.