# M13 UI/OpenAPI evidence

- OpenAPI is deterministically exported to `openapi/v2.json`; generated browser client drift is checked by `npm --prefix frontend run api:check`.
- `text/event-stream` is declared in OpenAPI for execution events. The generated client intentionally emits `executionEventsUrl(...) -> URL`, not a misleading JSON `Promise`; UI opens that URL using browser `EventSource`.
- Notification delivery retry requests send an `Idempotency-Key` and the browser CSRF header.
- Recovery status is CLI/runbook-only. The browser has no export, import, bundle, key, or passphrase transfer control.
- v2.1 PostgreSQL, MySQL, and TAR/download controls remain absent.

## Green M13 checks

```text
npm --prefix frontend test -- --run  # 9 passed
npm --prefix frontend run typecheck  # passed
npm --prefix frontend run build      # passed
npx --prefix frontend playwright test --config frontend/playwright.config.ts  # 1 passed
.venv/bin/python tools/export_openapi.py --check openapi/v2.json  # current
npm --prefix frontend run api:check  # current
```

Final verification: `make check` passed — 90 unit/contract, 61 integration, 14 fault, and 28 security tests; Ruff, mypy, TypeScript, and the frontend build passed. `git diff --check` and the staged-file check also passed.