release: dev to prod (UX Core audit fixes, Umami, SEO fixes)

[manager]

Promotes dev to production.

Includes since the last release:

• Top-10 UX Core functional audit fixes (fix: UX Core functional audit fixes + OffSec bias cases #181) + review follow-up (fix(uxcore): address PR #181 review comments #183): UXCAT answer delivery confirmed before advancing, server-trusted final-test resume, rating vote integrity, Strapi bias-cache TTL (no more 404-poisoning, content edits reach prod), fixed per-bias share previews and encoded share links, Back/Forward bias-modal sync, search zero-hit state and count labels, truthful persona save with per-call auth, persisted PM/HR view choice.
• OffSec layer stays fully gated to the dev preview: the switcher row, #offsec deep link and persisted flag are all inert on staging/prod.
• Everything already on dev since the last prod release (self-hosted Umami tracker + CSP, SEO/canonical fixes, workflow gating).

🤖 Generated with Claude Code

[github-actions]

Claude finished @manager's task in 3m 35s —— View job

---

Review of PR #184 (dev → main release)

Todo list

• Gather context (read diff vs origin/main, read CLAUDE.md/AGENTS.md)
• Review React/hooks correctness & SSR safety
• Review TypeScript quality
• Review project convention compliance (AGENTS.md)
• Review accessibility & UX
• Review security (XSS, secrets, URL handling)
• Review styling (SCSS hygiene, design tokens)
• Flag any UX Core bias data/schema changes for explicit approval
• Post inline comments for specific issues
• Post final summary

Summary

This is a release PR bundling commits already reviewed individually in #181 and its follow-up #183, plus the earlier Umami/CSP/SEO/library-polish work already on dev. I diffed against origin/main directly and re-read the substantive hunks rather than re-litigating what #181/#183 already covered. No blocking issues found; a couple of minor, non-blocking observations below (no inline comments needed — nothing rises to actionable-fix level).

What's solid:

• src/uxcore/api/biases.ts — the TTL cache with an isComplete guard is a real fix for the described 404-poisoning bug: a partial/failed Strapi response no longer overwrites a good cached copy, and a genuinely complete fetch now expires and refreshes so CMS edits reach prod.
• src/uxcore/api/personas.ts / rating.ts — moving the auth header from a module-level snapshot (frozen at first load) to a per-call getAuthHeaders() closes a real "stuck logged out" bug; response .ok checks now correctly propagate failures instead of resolving with a parsed error body.
• src/uxcore/layouts/OngoingLayout/OngoingLayout.tsx — submittedAnswer now returns a boolean tied to whether the request actually landed (getUXCatSubmitTest returns null on failure per src/uxcore/api/uxcat/submit-test.ts), and the test only advances on success; a isSubmittingRef ref (not state) correctly guards against double-submit races that state wouldn't catch before the next render.
• src/uxcore/lib/offsec.ts — gating flips from "hidden only in prod" to "enabled only in dev", matching the PR description that OffSec must be dark on staging too. initUseUXCoreGlobals in useUXCoreGlobals.ts correctly forces isOffsecView to false whenever isOffsecEnabled is false, regardless of what's in localStorage, so a flag persisted on the dev preview can't resurface the layer on a public build.
• src/pages/uxcore/[slug].tsx — the mentionedQuestionsIds JSON.parse is now wrapped in try/catch with an array-type check, closing a crash-on-bad-Strapi-data path; the Back/Forward modal-sync effect now depends on currentActiveBias.number instead of running mount-only.
• Import ordering throughout the touched files matches the documented ESLint sort order (side-effect → node → third-party → local aliases → relative → styles).
• classnames/cn used consistently instead of raw template-string class concatenation (e.g. OffsecBiasView.tsx).
• No 'use client', no App Router imports, no Tailwind/CSS-in-JS, no new state libraries, no global CSS imported outside _app.tsx, no <img> for SVGs, no empty barrels introduced.
• src/uxcore/data/biasOffsec/* — the 10 new OffSec case files are internal "attack simulation" demo content (not UX Core's canonical bias library), and the whole layer stays gated behind isOffsecEnabled (dev-only) per offsec.ts. This doesn't touch UX Core bias names/slugs/citations, so it doesn't fall under the "explicit approval" bar in CLAUDE.md — flagging here only for visibility, not blocking.

Minor, non-blocking observations:

• src/uxcore/data/decisionTable/hy.ts adds saveFailed with the same English string as en.ts, rather than a real Armenian translation or omitting the key (AGENTS.md notes hy.ts should only be provided "if you have real Armenian translations"; since this file already exists and is used directly for the hy locale, the English string will render as-is rather than triggering any fallback). Cosmetic — same pattern likely exists already elsewhere in this file.
• src/uxcore/layouts/OngoingLayout/OngoingLayout.module.scss adds $error-red: #fb1717 — confirmed this reuses the existing hardcoded color from DecisionTable.module.scss rather than inventing a new value, so it's consistent with (if not exactly compliant with) current styling conventions.

No security, SSR/hydration, or hooks-dependency issues found in the reviewed hunks.