agnets done

docs/api-audit.md

@@ -263,14 +263,21 @@ ids, so they are suppression preferences over a namespace, not definitions.
 `GET /api/v1/owliver/suggestions?page={surface}&query={typed}` — specified in
 the backend contract's §2A.
 
-**Called, registered in backend source, and NOT deployed.** This is the one row
-in this document where those three come apart, so it is worth stating plainly:
+**Called, registered in backend source, and NOT deployed on every host.** This
+is the one row in this document where those three come apart, so it is worth
+stating plainly:
 
 | | |
 | --- | --- |
-| Frontend calls it | `src/api/base44Client.js:300`, via `useSuggestions.js` |
-| Backend source registers it | `go-api/internal/httpserver/owliver.go:22`, commit `b6f8655`, pushed to `origin/main` |
-| `https://mcp.krowforce.com` serves it | **No — 404** |
+| Frontend calls it | `src/api/base44Client.js` (`base44.owliver.suggestions`) → `src/lib/krowHooks.js` (`fetchOwliverSuggestions`, `useOwliverSuggestions`) → `src/lib/skills/serverSuggestions.js` → `KrowAssistant.jsx` |
+| Backend source registers it | `go-api/internal/httpserver/owliver.go:22` |
+| `https://mcp.krowforce.com` serves it | **No — 404 as of this writing** |
+
+The endpoint now also builds real context: with no `query`, the backend counts
+the organization's positions, applications, interviews, staff, profiles,
+courses and activity in one statement and ranks the page's readings against
+them, so a suggestion changes when the data does. See the backend contract's
+§2A.
 
 So a signed-in dev server pointed at `mcp.krowforce.com` answers this route
 `404 Not Found`, and no prompt chips appear. **That is a deployment lag, not a
@@ -291,10 +298,12 @@ reaching for the frontend code again:
   means the session is not signed in; `404` means the session is fine and the
   route is not on that backend.
 
-The panel treats the two differently as of `useSuggestions.js`: a `404` closes a
-circuit breaker and it stops asking for the rest of the page load, because no
-further keystroke can change the answer. A `401`, a `500` and an unreachable API
-are all still retried.
+The panel treats the two differently, in `fetchOwliverSuggestions`
+(`src/lib/krowHooks.js`): a `404` closes a circuit breaker and it stops asking
+for the rest of the page load, because no further keystroke can change the
+answer. A `401`, a `500` and an unreachable API are all still retried. Against a
+host that does not serve the route the chip row is simply empty — the panel, the
+composer and every answer are unaffected.
 
 The endpoint replaces the *selection*, not
 the answering: it returns at most three `{ text, intent }` pairs, where `intent`
@@ -636,8 +645,8 @@ Recorded, not fixed — each belongs in its own repo.
 | Where | Issue |
 | --- | --- |
 | `krow-backend/docs/api-contract.md` §1 | Says "Auth: None in v1. Every endpoint is unauthenticated." Sessions and cookie middleware have been implemented since. |
-| `krow-demo/src/api/store.js` | 173 lines, **imported by nothing**. Superseded by `httpClient.js`. Dead. |
-| `krow-demo/src/api/seed.js` | 1,928 lines, retained for one export — `DEMO_USER.preferences`, the default shape the synchronous accessor needs. Entity data lives in PostgreSQL. |
+| ~~`krow-demo/src/api/store.js`~~ | **Fixed.** The file is deleted. It was 173 lines and imported by nothing. |
+| ~~`krow-demo/src/api/seed.js`~~ | **Fixed.** The default user shape moved to `src/api/demoUser.js`, so no production module imports the fixture and its 1,928 lines are out of the bundle. `seed.js` remains, serving `scripts/skill-check.mjs` and `scripts/owliver-capture.mjs` as the test fixture it now is. |
 | `krow-demo/src/lib/krowHooks.js:537` | `useBadges` has no consumers and no route. |
 | `krow-demo/src/api/httpClient.js:96` | `User: 'users'` names a resource the backend does not have. No call site, so harmless today. |