feat: Detach or Stick Apps - eXIP7.3.0.32

[AzmiTouil]

eXIP 7.3.0.32 — Detach or Stick Apps

Integration PR of the eXip onto feature/mips. Tech Spec: note 51636, revision 4 — board: project 8376 (all stories Tested & Validated on the qa-ui ACC).

Classification: N1 (Liquibase schema change, new REST surface applications/placements, shared component exo-drawer ~106 consumers — max-severity over the full eXip diff). Per ai-review-and-merge.md §5: the approver must be an Architect/Senior Developer who knows this is N1 — not an approval on AI review alone; author ≠ approver.

Release order: social → layout → app-center → contributing addons (matrix, task, email-connector, web-conferencing, ai, analytics). One PR per repo, same eXip.

Knowledge: Meeds-io/eng-standards#64 — app-center & social domain refresh (placement model, provider extension, incident-born pitfalls).

This repo: page-layout-rendered readiness event; commonLayoutComponents dependency of the portlet quick action.

Commits (one per task, fixes folded where the history allowed)

• feat: Expose page body side panel anchors for stuck applications - EXO-89874 - eXIP7.3.0.32
• fix: Declare the layout commons dependency of the portlet quick action module - EXO-89873 - eXIP7.3.0.32
• fix: Confine the stuck panel stacking below the sidebar and overlays - EXO-90109 - eXIP7.3.0.32
• feat: Signal page layout readiness for the stuck panels host - EXO-90151 - eXIP7.3.0.32

🤖 Generated with Claude Code

[AzmiTouil]

This repo's round-5 verdict: CLEAN

Self-review close-out — eXIP 7.3.0.32 integration (round 5, cross-repo)

An independent review round was run over the whole eXip (the 9 PRs together, full diffs vs feature/mips), following four earlier rounds on the FB. Round-4 findings: all verified fixed in source. Mips-base compatibility explicitly verified: anchors' target DOM (UIParentSiteContainer.gtmpl on portal mips), skin clamps and the .v-application transparent rule (platform-ui mips), ExoDrawer.vue base byte-identical, appLauncher.jsp bootstrap contract present, changeset ids unique on the mips changelog, cross-repo contracts symbol-by-symbol (extension ids, events, payload shape, descriptor urls ↔ QuickAction ids), placement REST security surfaces, 53/53 placement tests green on this base.

Round-5 findings and their status

Sev	Finding	Status
🟠	Stuck PORTLET's preview drawer docks into the host-owned panel (no type gate in the placement match); refuter-confirmed, incl. stranded-drawer breakage on side replacement	✅ Fixed — social 4c22598aff (type gate in matchesPlacement; robust undock), refuter validated the fix variant
🟡	Cross-type side replacement leaves the previous representation in the panel / detaches a docked drawer	✅ Fixed — app-center 00702107 (clean portlet before drawer path; hand docked drawer back before replaceChildren) + social robust undock
🟡	standalone computed once at creation — per-agent detach rendered degraded	✅ Fixed — social 4c22598aff (standalone is now a computed on the drawer identity)
🟢	Stuck-panels bootstrap double-init window	✅ Fixed — app-center 00702107 (synchronous flag)
🟢	app-viewer page access-permissions=Everyone broader than the catalog ACL (users+externals)	⏳ PO/Architect decision — align the page ACL with the REST surface, or keep Everyone deliberately
🟢	Stale eligibility kept on portlet lookup failure (defensive)	✅ Fixed — social 4c22598aff

The same fixes were applied to feature/meeds-qaui for ACC parity (the defects pre-existed in the validated state — unexercised flows, not integration regressions).

Classification

N1 — DB schema changeset, new REST surface (applications/placements), shared component exo-drawer (~106 consumers), page ACL. Per ai-review-and-merge.md: the approver must be an Architect/Senior Developer who knows this is N1 — not an approval on AI review alone; author ≠ approver.

Remains for humans before merge

• D7: the Architects Lead's ack of the A3 amendment (US11 host-owned site-edge anchors) — spec note 51636 rev 4, ledger.
• A1/A2 assumptions sign-off (420px fixed width; side replacement — round-5 🟡2 sat exactly on A2's edge).
• The Knowledge: line — the eng-standards domain-doc PR (drawer placement is absent from the KB) is owed and follows.
• 401-vs-403 convention divergence (carried), mobile expand-display facet (PO/design), D3/D5/D6 deferrals.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud