docs(desktop-client): spec v2.2 applies 4C+9W from second cross-review
Second-round Claude+Codex+Gemini cross-review surfaced implementation-
level gaps in the v2.1 admin-web coordination layer. All 4 Critical
and 9 Warning findings addressed:
Critical:
- C1 (multi-account routing): desktop_tasks now has first-class columns
job_id, target_account_id, target_client_id, platform with indexes;
new desktop_publish_jobs aggregation table; §6.3 SSE only pushes to
target_client_id; lease rejects non-target requesters.
- C2 (account consistency): Replace vague "client=SoT, server=projection"
with CAS + Tombstone protocol. platform_accounts gains sync_version
and deleted_at; all client writes require if_sync_version CAS; web-side
delete writes delete_requested_at intent, client resync completes the
delete via normal DELETE path. Added 3-way merge rules and concurrent
case table in §6.8.6.
- C3 (/api/tenant/events auth): WorkspaceScope middleware required
(TenantScope insufficient); topics must be server-derived from
actor+workspace, never accept free query params; symmetric contract
table between /api/desktop/events and /api/tenant/events (multi-
instance fanout, Last-Event-ID replay, snapshot first frame, monotonic
event_id, client dedup).
- C4 (route migration): Full migration map added in §6.8.4 listing
media/platform-accounts -> accounts, articles/:id/publish-batches ->
publish-jobs, publish-records -> publish-jobs/{id} subtasks.
Warning:
- Kimi binary-framed gRPC-Web path added to §5.2 transport table;
login methods (Kimi: wechat/phone; Hunyuan: wechat/qq/email +
loopback) noted in §4.4.
- Offline->online dual-sided reclaim: server scans queued tasks and
re-pushes task_available; client heartbeats+resyncs then enters
lease(limit=20) loop until empty.
- GET /api/desktop/accounts?client=self added to §6.4 for resync.
- Account.tags added; Modal gains tag multiselect + search + three-
level batch select.
- §6.8.5 exposes queue_ahead + eta_seconds for capacity feedback.
- Deep link gains intermediate-state modal + manual-launch/copy
fallbacks + one-time nonce JWT on tasks/<id>/review; Windows/mac/
Linux protocol registration specified.
- content_ref is now polymorphic {type, id} supporting article_draft /
template_gen / video / brand_asset.
- retry endpoint accepts JSON body, not query string.
Info: §10.3 title corrected to 9 blocks; §12 opening synced to 24-28
weeks; §6.8.3 adds "attention-needed accounts" card + per-platform
summary; monitoring LLM UI switched to Grid/Tag responsive layout.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
root
a83faff211