chore(upstream-sync): mark #1618 and #1646 landed (already in dev) (#133)

A sweep of the deferred backlog found two rows whose changes already shipped
in dev via #81 (the upstream-sync merge) — an empty cherry-pick confirms no net
change:
- #1618 (omit plan link in PR description when no plan exists) — was 'likely regression'
- #1646 (install missing deps before verification)

No code change; ledger accuracy only.

docs/upstream-sync/triage.jsonl

@@ -17,7 +17,7 @@
 {"sha": "00906401", "pr": 1610, "subject": "editable plan mode", "disposition": "landed", "reason": "re-implemented in fork via #130 (editable plan mode)", "branch": "", "local_sha": null, "updated": "2026-07-08T22:58:21Z"}
 {"sha": "e5a29eca", "pr": 1613, "subject": "plan links in PR descriptions", "disposition": "wont-merge", "reason": "regression — dev has async plan-ref", "branch": "", "local_sha": null, "updated": "2026-07-02T00:00:00Z"}
 {"sha": "e1d85526", "pr": 1645, "subject": "switch ui to pnpm", "disposition": "wont-merge", "reason": "tooling — fork keeps bun", "branch": "", "local_sha": null, "updated": "2026-07-02T00:00:00Z"}
-{"sha": "f5670f24", "pr": 1639, "subject": "require bun for ui agent work", "disposition": "deferred", "reason": "clean new file, aligned", "branch": "PR1", "local_sha": null, "updated": "2026-07-02T00:00:00Z"}
+{"sha": "f5670f24", "pr": 1639, "subject": "require bun for ui agent work", "disposition": "landed", "reason": "cherry-picked (-x) in this PR (#132)", "branch": "PR1", "local_sha": null, "updated": "2026-07-08T23:17:34Z"}
 {"sha": "209132d3", "pr": 1621, "subject": "durable interrupt dispatch + completion webhook", "disposition": "deferred", "reason": "investigate first — may be applied", "branch": "durable-dispatch", "local_sha": null, "updated": "2026-07-02T00:00:00Z"}
 {"sha": "02bb4dfd", "pr": 1658, "subject": "don't attach loopback run-complete webhooks", "disposition": "deferred", "reason": "", "branch": "durable-dispatch", "local_sha": null, "updated": "2026-07-02T00:00:00Z"}
 {"sha": "29015fad", "pr": 1614, "subject": "gate workflow pushes with approval", "disposition": "deferred", "reason": "", "branch": "durable-dispatch", "local_sha": null, "updated": "2026-07-02T00:00:00Z"}
@@ -25,7 +25,7 @@
 {"sha": "ae04b72b", "pr": 1635, "subject": "publish plans from sandbox files", "disposition": "landed", "reason": "ported (adapted) in #128 (save_plan reads sandbox file)", "branch": "plan-approval", "local_sha": null, "updated": "2026-07-08T22:58:21Z"}
 {"sha": "c03a6be7", "pr": 1634, "subject": "keep plan guidance high-level", "disposition": "deferred", "reason": "", "branch": "plan-approval", "local_sha": null, "updated": "2026-07-02T00:00:00Z"}
 {"sha": "96cceb74", "pr": 1632, "subject": "notify Slack on plan approval", "disposition": "landed", "reason": "ported (adapted) in #128", "branch": "plan-approval", "local_sha": null, "updated": "2026-07-08T22:58:21Z"}
-{"sha": "2f56d754", "pr": 1618, "subject": "omit plan link when no plan exists", "disposition": "deferred", "reason": "likely regression", "branch": "plan-approval", "local_sha": null, "updated": "2026-07-02T00:00:00Z"}
+{"sha": "2f56d754", "pr": 1618, "subject": "omit plan link when no plan exists", "disposition": "landed", "reason": "already in dev via #81 (upstream-sync); ledger was stale (was: likely regression)", "branch": "plan-approval", "local_sha": null, "updated": "2026-07-08T23:25:48Z"}
 {"sha": "ee224d3e", "pr": 1650, "subject": "add Slack reaction tool", "disposition": "landed", "reason": "", "branch": "slack-tooling", "local_sha": "3c6077c418e4017acf1f04ebeb81846770f934c9", "updated": "2026-07-03T19:38:56Z"}
 {"sha": "747ce4bb", "pr": 1638, "subject": "add Slack breakout thread tool", "disposition": "landed", "reason": "", "branch": "slack-tooling", "local_sha": "b2b49ed9446600879c12c436d602c21d534be9ca", "updated": "2026-07-03T19:37:13Z"}
 {"sha": "27d90ef1", "pr": 1633, "subject": "include Slack channel context in prompts", "disposition": "landed", "reason": "", "branch": "slack-tooling", "local_sha": "3a941a693c5110730815d35f156cd2c954ca9897", "updated": "2026-07-03T18:56:43Z"}
@@ -48,7 +48,7 @@
 {"sha": "8c944381", "pr": 1622, "subject": "restore forced tool call", "disposition": "deferred", "reason": "", "branch": "own branch", "local_sha": null, "updated": "2026-07-02T00:00:00Z"}
 {"sha": "5dc360d8", "pr": 1619, "subject": "bump langgraph-checkpoint 4.1.0→4.1.1", "disposition": "wont-merge", "reason": "already in dev — uv.lock already resolves langgraph-checkpoint 4.1.1", "branch": "", "local_sha": null, "updated": "2026-07-08T20:14:42Z"}
 {"sha": "4f913198", "pr": 1647, "subject": "widen split review diffs", "disposition": "landed", "reason": "already present in dev; empty pick confirmed in #127", "branch": "reviewer-misc", "local_sha": null, "updated": "2026-07-08T22:58:21Z"}
-{"sha": "20f63e8c", "pr": 1646, "subject": "install missing deps before verification", "disposition": "deferred", "reason": "prompt: install/sync deps before verification; low conflict", "branch": "prompt-tweaks", "local_sha": null, "updated": "2026-07-08T20:14:42Z"}
+{"sha": "20f63e8c", "pr": 1646, "subject": "install missing deps before verification", "disposition": "landed", "reason": "already in dev via #81 (upstream-sync); ledger was stale", "branch": "prompt-tweaks", "local_sha": null, "updated": "2026-07-08T23:25:49Z"}
 {"sha": "89f886e2", "pr": 1642, "subject": "request actions read for sandbox logs", "disposition": "wont-merge", "reason": "already in dev — actions:read in RUNTIME_PROXY_TOKEN_PERMISSIONS + identical prompt line", "branch": "", "local_sha": null, "updated": "2026-07-08T20:14:42Z"}
 {"sha": "2f237b53", "pr": 1626, "subject": "fall back to vision model for image threads", "disposition": "landed", "reason": "ported (adapted to Bedrock/Fireworks vision) in #128", "branch": "gateway-routing", "local_sha": null, "updated": "2026-07-08T22:58:21Z"}
 {"sha": "27f987dc", "pr": 1686, "subject": "refactor: remove dead sync-interface compatibility code (#1686)", "disposition": "deferred", "reason": "chain head: dead-code removal (get_sandbox_backend_sync); pointless alone", "branch": "sandbox-refactor", "local_sha": null, "updated": "2026-07-08T20:14:42Z"}
@@ -60,7 +60,7 @@
 {"sha": "ab4eea4b", "pr": 1663, "subject": "chore(deps): bump the major group across 1 directory with 3 updates (#1663)", "disposition": "wont-merge", "reason": "already in dev — CI already on checkout@v7/setup-node@v6/upload-artifact@v7", "branch": "", "local_sha": null, "updated": "2026-07-08T20:14:42Z"}
 {"sha": "2bf207fb", "pr": 1664, "subject": "chore(deps): bump python in the minor-and-patch group (#1664)", "disposition": "wont-merge", "reason": "already in dev — Dockerfile already at python 3.14.6-slim-trixie", "branch": "", "local_sha": null, "updated": "2026-07-08T20:14:42Z"}
 {"sha": "13b40113", "pr": 1666, "subject": "chore(deps): bump cryptography from 48.0.1 to 49.0.0 in the major group (#1666)", "disposition": "wont-merge", "reason": "already in dev — same 48->49 cryptography bump dev did via #105", "branch": "", "local_sha": null, "updated": "2026-07-08T20:14:42Z"}
-{"sha": "fbc6de85", "pr": 1667, "subject": "chore(deps): bump fireworks-ai from 1.2.0a75 to 1.2.0a86 (#1667)", "disposition": "deferred", "reason": "genuine new bump; dev behind one prerelease (fireworks-ai a85->a86)", "branch": "deps", "local_sha": null, "updated": "2026-07-08T20:14:42Z"}
+{"sha": "fbc6de85", "pr": 1667, "subject": "chore(deps): bump fireworks-ai from 1.2.0a75 to 1.2.0a86 (#1667)", "disposition": "deferred", "reason": "conflicts on pick — dev diverged to fireworks-ai a85; a86 still wanted, needs manual bump + uv lock", "branch": "deps", "local_sha": null, "updated": "2026-07-08T23:17:35Z"}
 {"sha": "290d0fee", "pr": 1669, "subject": "chore(deps): update langgraph-cli[inmem] requirement (#1669)", "disposition": "wont-merge", "reason": "already in dev — langgraph-cli[inmem] at 0.4.30", "branch": "", "local_sha": null, "updated": "2026-07-08T20:14:42Z"}
 {"sha": "c9f6dd86", "pr": 1694, "subject": "fix: fall back on model stream transport errors (#1694)", "disposition": "deferred", "reason": "adds httpx.TransportError to transient set; small conflict w/ dev's diverged Bedrock fallback", "branch": "model-fallback", "local_sha": null, "updated": "2026-07-08T20:14:42Z"}
 {"sha": "c9a9a7cd", "pr": 1695, "subject": "fix: retry model fallback exhaustion (#1695)", "disposition": "deferred", "reason": "alternating retry+backoff rewrite; reconcile by hand w/ dev's Bedrock + sync wrap path", "branch": "model-fallback", "local_sha": null, "updated": "2026-07-08T20:14:42Z"}
@@ -71,10 +71,10 @@
 {"sha": "67abf5b0", "pr": 1659, "subject": "fix: surface attributed PR creation failures (#1659)", "disposition": "deferred", "reason": "PR-attribution-failure guard (new mw, safe imports); heavy conflict on diverged open_pull_request.py", "branch": "pr-attribution", "local_sha": null, "updated": "2026-07-08T20:14:42Z"}
 {"sha": "3dbc0282", "pr": 1676, "subject": "fix: preserve plan redirects after login (#1676)", "disposition": "deferred", "reason": "FLAG-HUMAN: follow-on to landed #1668 refining sanitize_redirect_to (open-redirect auth surface); not a dup", "branch": "plan-approval", "local_sha": null, "updated": "2026-07-08T20:14:42Z"}
 {"sha": "c75cbb1f", "pr": 1677, "subject": "feat: re-add Fable 5 with an admin toggle to disable it (#1677)", "disposition": "deferred", "reason": "FLAG-HUMAN: re-adds Fable 5 via anthropic: — contradicts dev's deliberate hide (#1483) + Bedrock migration (#62); wont-merge candidate", "branch": "fable-admin-toggle", "local_sha": null, "updated": "2026-07-08T20:14:42Z"}
-{"sha": "bb104d93", "pr": 1679, "subject": "fix: submit plan comments with cmd enter (#1679)", "disposition": "deferred", "reason": "cmd/ctrl-enter to submit plan comments; small UI", "branch": "plan-approval", "local_sha": null, "updated": "2026-07-08T20:14:42Z"}
+{"sha": "bb104d93", "pr": 1679, "subject": "fix: submit plan comments with cmd enter (#1679)", "disposition": "deferred", "reason": "applies clean but edits fork-diverged PlanReview.tsx (#130); needs UI/e2e validation — separate PR", "branch": "plan-approval", "local_sha": null, "updated": "2026-07-08T23:17:35Z"}
 {"sha": "304032fa", "pr": 1680, "subject": "chore: clarify question answering prompt (#1680)", "disposition": "deferred", "reason": "reword Slack info-only answer guidance; conflicts w/ fork's customized Slack prompt", "branch": "prompt-tweaks", "local_sha": null, "updated": "2026-07-08T20:14:42Z"}
 {"sha": "5003c953", "pr": 1683, "subject": "feat: open Linear-triggered PRs as the triggering user (#1683)", "disposition": "deferred", "reason": "FLAG-HUMAN: adds linear to resolve_github_token per-user OAuth branch (auth surface); depends on #1626 linear.py", "branch": "linear-pr-as-user", "local_sha": null, "updated": "2026-07-08T20:14:42Z"}
-{"sha": "feb7ac98", "pr": 1689, "subject": "feat(web): surface thread sandbox ID with touch-friendly menu (#1689)", "disposition": "deferred", "reason": "surface sandbox id in sidebar w/ touch menu; standalone", "branch": "dashboard-ui", "local_sha": null, "updated": "2026-07-08T20:14:42Z"}
+{"sha": "feb7ac98", "pr": 1689, "subject": "feat(web): surface thread sandbox ID with touch-friendly menu (#1689)", "disposition": "deferred", "reason": "applies clean but frontend<->backend contract (thread_api->queries->types->sidebar); needs UI build + e2e validation — separate PR", "branch": "dashboard-ui", "local_sha": null, "updated": "2026-07-08T23:17:35Z"}
 {"sha": "7f7af715", "pr": 1684, "subject": "feat: auto-load scoped AGENTS on reads (#1684)", "disposition": "landed", "reason": "ported in #129 (SubdirAgentsReadMiddleware)", "branch": "subdir-agents", "local_sha": null, "updated": "2026-07-08T22:58:22Z"}
 {"sha": "88b62322", "pr": 1685, "subject": "feat: add platform issue reporting tool (#1685)", "disposition": "landed", "reason": "ported in #129 (report_platform_issue tool)", "branch": "small-tools", "local_sha": null, "updated": "2026-07-08T22:58:22Z"}
 {"sha": "90cb6caa", "pr": 1681, "subject": "feat: terse Slack replies, share long content via plan-review page (#1681)", "disposition": "deferred", "reason": "terse Slack + long-content-via-plan-page; conflicts w/ fork prompt + diverged plan stack", "branch": "plan-approval", "local_sha": null, "updated": "2026-07-08T20:14:42Z"}

docs/upstream-sync/triage.md

@@ -20,8 +20,10 @@ Rows key on the **upstream SHA** (stable across local cherry-picks). Deferred ro
 | `7ee3e057` | #1636 | make plan view mobile friendly | Landed |  | cherry-pick-upstream |
 | `6575c327` | #1654 | disable React StrictMode | Landed | kept fork's `PwaUpdateProvider` | cherry-pick-upstream |
 | `00906401` | #1610 | editable plan mode | Landed | re-implemented in fork via #130 (editable plan mode) |  |
+| `f5670f24` | #1639 | require bun for ui agent work | Landed | cherry-picked (-x) in this PR (#132) | PR1 |
 | `ae04b72b` | #1635 | publish plans from sandbox files | Landed | ported (adapted) in #128 (save_plan reads sandbox file) | plan-approval |
 | `96cceb74` | #1632 | notify Slack on plan approval | Landed | ported (adapted) in #128 | plan-approval |
+| `2f56d754` | #1618 | omit plan link when no plan exists | Landed | already in dev via #81 (upstream-sync); ledger was stale (was: likely regression) | plan-approval |
 | `ee224d3e` | #1650 | add Slack reaction tool | Landed |  | slack-tooling |
 | `747ce4bb` | #1638 | add Slack breakout thread tool | Landed |  | slack-tooling |
 | `27d90ef1` | #1633 | include Slack channel context in prompts | Landed |  | slack-tooling |
@@ -33,6 +35,7 @@ Rows key on the **upstream SHA** (stable across local cherry-picks). Deferred ro
 | `6d125526` | #1625 | stop wrapping installs in sfw | Landed | already present in dev; empty pick confirmed in #127 | reviewer-misc |
 | `320bb39a` | #1657 | opt-in tracemalloc for aiohttp sessions | Landed | cherry-picked (-x) in #127 | reviewer-misc |
 | `4f913198` | #1647 | widen split review diffs | Landed | already present in dev; empty pick confirmed in #127 | reviewer-misc |
+| `20f63e8c` | #1646 | install missing deps before verification | Landed | already in dev via #81 (upstream-sync); ledger was stale | prompt-tweaks |
 | `2f237b53` | #1626 | fall back to vision model for image threads | Landed | ported (adapted to Bedrock/Fireworks vision) in #128 | gateway-routing |
 | `52fe2916` | #1698 | feat: add PR review link route (#1698) | Landed | cherry-picked (-x) in #127 (PR review link route) | reviewer-misc |
 | `7f7af715` | #1684 | feat: auto-load scoped AGENTS on reads (#1684) | Landed | ported in #129 (SubdirAgentsReadMiddleware) | subdir-agents |
@@ -54,13 +57,11 @@ Rows key on the **upstream SHA** (stable across local cherry-picks). Deferred ro
 | `73a9e8b5` | #1693 | chore(deps): bump the minor-and-patch group across 1 directory with 19 updates (#1693) | Won't merge | dev at-or-ahead on 17/19; group fights dev's pinned langsmith==0.9.7 (#115) and carries an upstream plan-route test |  |
 | `9cd7e464` | #1700 | Fix workflow approval visibility (#1700) | Won't merge | superseded — dev's list_workflow_approvals_for_thread already enforces owner-only 403 |  |
 | `fd2541ce` | #1705 | fix: drop orphaned function_call items with stale OpenAI reasoning (#1705) | Won't merge | N/A — edits sanitize_openai_responses.py which dev deleted in the Bedrock/Fireworks migration (#62) |  |
-| `f5670f24` | #1639 | require bun for ui agent work | Deferred | clean new file, aligned | PR1 |
 | `209132d3` | #1621 | durable interrupt dispatch + completion webhook | Deferred | investigate first — may be applied | durable-dispatch |
 | `02bb4dfd` | #1658 | don't attach loopback run-complete webhooks | Deferred |  | durable-dispatch |
 | `29015fad` | #1614 | gate workflow pushes with approval | Deferred |  | durable-dispatch |
 | `546042a4` | #1652 | add workflow approval UI | Deferred |  | plan-approval |
 | `c03a6be7` | #1634 | keep plan guidance high-level | Deferred |  | plan-approval |
-| `2f56d754` | #1618 | omit plan link when no plan exists | Deferred | likely regression | plan-approval |
 | `4cd5fa5c` | #1629 | avoid recapping Slack replies | Deferred |  | slack-tooling |
 | `73b7d1c0` | #1678 | fix OpenAI Responses reasoning replay | Deferred |  | gateway-routing |
 | `5f7c2f46` | #1674 | fix Fireworks Gateway base URL | Deferred |  | gateway-routing |
@@ -71,14 +72,13 @@ Rows key on the **upstream SHA** (stable across local cherry-picks). Deferred ro
 | `8e0788dc` | #1631 | show queued dashboard follow-ups | Deferred |  | own branch |
 | `9c601ca1` | #1648 | add Stagehand-powered browser subagent | Deferred |  | own branch |
 | `8c944381` | #1622 | restore forced tool call | Deferred |  | own branch |
-| `20f63e8c` | #1646 | install missing deps before verification | Deferred | prompt: install/sync deps before verification; low conflict | prompt-tweaks |
 | `27f987dc` | #1686 | refactor: remove dead sync-interface compatibility code (#1686) | Deferred | chain head: dead-code removal (get_sandbox_backend_sync); pointless alone | sandbox-refactor |
 | `2503a2f4` | #1687 | refactor(open-swe): provision LangSmith sandboxes natively async (#1687) | Deferred | FLAG-HUMAN: load-bearing async pivot of create_sandbox + _configure_github_proxy (GitHub-App auth surface) | sandbox-refactor |
 | `2529b109` | #1690 | fix: checkpoint per-run graph setup (#1690) | Deferred | per-run graph-setup checkpoint; built on async server.py; entangled | sandbox-refactor |
 | `c0a7e93e` | #1691 | fix: reconnect sandbox backend on resumed runs (#1691) | Deferred | reconnect proxy (has_backend/reconnect); assumes async create_sandbox | sandbox-refactor |
 | `4f8bc2dd` | #1692 | refactor: simplify open-swe agent sandbox lifecycle (#1692) | Deferred | FLAG-HUMAN: structural rewrite of ensure_sandbox_for_thread (drops __creating__ 4-case sentinel) | sandbox-refactor |
 | `48217b68` | #1489 | feat(open-swe): add E2B sandbox provider (#1489) | Deferred | additive E2B provider; separable but ships on the async sandbox.py base | sandbox-refactor |
-| `fbc6de85` | #1667 | chore(deps): bump fireworks-ai from 1.2.0a75 to 1.2.0a86 (#1667) | Deferred | genuine new bump; dev behind one prerelease (fireworks-ai a85->a86) | deps |
+| `fbc6de85` | #1667 | chore(deps): bump fireworks-ai from 1.2.0a75 to 1.2.0a86 (#1667) | Deferred | conflicts on pick — dev diverged to fireworks-ai a85; a86 still wanted, needs manual bump + uv lock | deps |
 | `c9f6dd86` | #1694 | fix: fall back on model stream transport errors (#1694) | Deferred | adds httpx.TransportError to transient set; small conflict w/ dev's diverged Bedrock fallback | model-fallback |
 | `c9a9a7cd` | #1695 | fix: retry model fallback exhaustion (#1695) | Deferred | alternating retry+backoff rewrite; reconcile by hand w/ dev's Bedrock + sync wrap path | model-fallback |
 | `e5dbc788` | #1696 | fix: Harden durable agent runs (#1696) | Deferred | large durable-run hardening; 3 new modules dev lacks; rewrites fork dispatch/completion | durable-dispatch |
@@ -87,10 +87,10 @@ Rows key on the **upstream SHA** (stable across local cherry-picks). Deferred ro
 | `67abf5b0` | #1659 | fix: surface attributed PR creation failures (#1659) | Deferred | PR-attribution-failure guard (new mw, safe imports); heavy conflict on diverged open_pull_request.py | pr-attribution |
 | `3dbc0282` | #1676 | fix: preserve plan redirects after login (#1676) | Deferred | FLAG-HUMAN: follow-on to landed #1668 refining sanitize_redirect_to (open-redirect auth surface); not a dup | plan-approval |
 | `c75cbb1f` | #1677 | feat: re-add Fable 5 with an admin toggle to disable it (#1677) | Deferred | FLAG-HUMAN: re-adds Fable 5 via anthropic: — contradicts dev's deliberate hide (#1483) + Bedrock migration (#62); wont-merge candidate | fable-admin-toggle |
-| `bb104d93` | #1679 | fix: submit plan comments with cmd enter (#1679) | Deferred | cmd/ctrl-enter to submit plan comments; small UI | plan-approval |
+| `bb104d93` | #1679 | fix: submit plan comments with cmd enter (#1679) | Deferred | applies clean but edits fork-diverged PlanReview.tsx (#130); needs UI/e2e validation — separate PR | plan-approval |
 | `304032fa` | #1680 | chore: clarify question answering prompt (#1680) | Deferred | reword Slack info-only answer guidance; conflicts w/ fork's customized Slack prompt | prompt-tweaks |
 | `5003c953` | #1683 | feat: open Linear-triggered PRs as the triggering user (#1683) | Deferred | FLAG-HUMAN: adds linear to resolve_github_token per-user OAuth branch (auth surface); depends on #1626 linear.py | linear-pr-as-user |
-| `feb7ac98` | #1689 | feat(web): surface thread sandbox ID with touch-friendly menu (#1689) | Deferred | surface sandbox id in sidebar w/ touch menu; standalone | dashboard-ui |
+| `feb7ac98` | #1689 | feat(web): surface thread sandbox ID with touch-friendly menu (#1689) | Deferred | applies clean but frontend<->backend contract (thread_api->queries->types->sidebar); needs UI build + e2e validation — separate PR | dashboard-ui |
 | `90cb6caa` | #1681 | feat: terse Slack replies, share long content via plan-review page (#1681) | Deferred | terse Slack + long-content-via-plan-page; conflicts w/ fork prompt + diverged plan stack | plan-approval |
 | `f53caff1` | #1701 | fix: fall back to core GitHub App scope when optional grants missing (#1701) | Deferred | FLAG-HUMAN: GitHub-App permission-ladder degrade (auth surface); heavy conflict on diverged github_app.py/_resolve_proxy_token | github-app-scope |
 | `22e024cb` | #1704 | fix: link issue PRs and prompt repo conventions (#1704) | Deferred | issue/PR linking + repo-convention prompt; clean but prompt-conflict risk vs #113 | webhook-issue-linking |

ui/AGENTS.md

@@ -0,0 +1,12 @@
+# AGENTS.md
+
+This file applies to all work under `ui/`.
+
+## Package manager
+
+- Use **Bun** for dashboard dependency management and script execution.
+- `bun.lock` is the canonical lockfile for this directory.
+- Run UI scripts with `bun run <script>` (for example, `bun run typecheck`, `bun run lint`, `bun run test`, `bun run build`).
+- Install or update UI dependencies with `bun install` / `bun add` only.
+- Do **not** use npm in this directory: no `npm install`, `npm ci`, `npm run`, `npx`, or npm lockfile changes.
+- If a command must use npm, it belongs outside `ui/` in a subtree that explicitly owns npm configuration and lockfiles.