Portal — Decisions

Settled

Portal should consume API-normalized state, not talk directly to agents for normal status/actions.
agentStatus === online is not enough by itself for game action eligibility.
ready === false does not automatically mean a stopped server is unstartable.
backup actions should not be blocked purely by frontend readiness assumptions when backend can decide validity.
Portal is now tracked on a Node 24 baseline aligned with the API runtime line.
Portal linting should use the current ESLint / Next 16-compatible path rather than removed next lint behavior.
confirmed-unused HUD wrapper components and stale legacy CSS should stay removed rather than being reintroduced as dead scaffolding.
runtime/tooling cleanup is allowed when it preserves user-visible behavior and keeps lint/build green.
Portal should preserve compatibility with API auth and hosted IDE flows even when API token verification is tightened.
password reset request UX must remain account-enumeration safe: the user-facing success copy is generic and must not show account-not-found state.
reset-password confirmation must not auto-login; successful reset should direct the user to log in again.
authenticated profile password changes use POST /api/auth/change-password with { currentPassword, newPassword }.

when Portal work completes, remove it from OPEN_ITEMS.md
if it changes long-lived UX/state model assumptions, update CURRENT_STATE.md or this file