Adopt Framework 4.5.0 cache correctness and typed form lifecycle

[andrewzolotukhin]

Original request

Adopt the published stable Framework 4.5.0 release in Xpenser, simplify the nine existing schema forms with the new submission lifecycle and typed renderer registry, and exercise the cache correctness fixes. Publish the work so it can be reviewed and tested in a PR environment.

What changed

• Pin all 15 directly used Framework packages to 4.5.0 across six workspaces; npm-generated lockfile has shared package instances and no unrelated version changes.
• Export XpenserFormSystem from the shared UI package and compose a typed web SchemaField registry with currency multiselect support.
• Migrate feedback, transaction, quick-capture, quick-category, category, vendor-profile, login, registration, and preference forms to handleSubmit, submitting, and error.
• Remove schema-value mirrors and forced-remount keys; retain transaction filters, editable amount/date text, suggestion/search, confirmation, and undo state.
• Reset closed dialog controllers to suppress obsolete submission callbacks.
• Add regressions for feedback close/reopen while pending, duplicate submits, retry errors, mounted preference field resets, millisecond date cache partitioning, separators, failed writes, stale reads, and versioned external cache tags.
• Preserve existing cache namespaces, TTLs, client/auth scope, and literal Next cache invalidation.
• Make shared-variant callbacks explicit and update typed headless bindings; controls and layout remain unchanged.
• Extend the feedback e2e flow to verify a successful submission reopens with the default type, empty text, and an enabled submit button.
• Document typed form ownership and Framework/Next cache boundaries in docs/cleverbrush-reference.md.

Reasoning

The Framework controller should own schema values and submission state. Typed registries make field-specific options checkable without unchecked prop-bag casts. Existing application-specific parsing, timezone conversion, redirects, and successful-feedback toast behavior remain in Xpenser.

The original beta's defaulted-field and declaration-export blocker was resolved by merged Framework PR #224. This branch now uses the stable npm 4.5.0 release, including @cleverbrush/log, without local patches, type assertions to bypass the issue, or weakened CI gates. The stable-promotion commit changes only six workspace manifests and the npm-generated lockfile; no unrelated package versions or application behavior were changed.

Blog post

Skipped: internal Framework adoption/refactor, not a new public-facing feature.

Screenshots / preview evidence

Preview: https://xpenser-pr-094.cleverbrush.com

Fresh 4.5.0 Playwright report and screenshots — includes feedback-success-confirmation and feedback-reset-after-success attachments, generated for commit 93a34fb.

Manual browser QA passed: login and top-menu navigation; empty-feedback validation; all three feedback types; success dismissal/toast; reset after successful submission and unsent-draft dismissal; populated preference fields; preference save/navigation/reload/restore; vendor-report drilldown, filtered transactions, and matching vendor profile/history. Browser console and error buffers were empty. The seeded account's original weekly-report setting was restored and verified on a fresh page.

Validation

• npm ci --ignore-scripts: passed locally; GitHub's normal npm ci also passed.
• npm run lint: passed.
• npm run typecheck: passed across all seven workspaces against published 4.5.0 packages.
• npm test: passed, 723 tests across 110 files.
• git diff --check: passed.
• Lockfile and installed-package audit: one root-level copy of each of the 17 installed Framework packages, all 4.5.0; no unrelated dependency version changes or beta dependencies remain.
• New logic/tests: not needed for the version-only promotion; existing form/cache regression tests and e2e coverage were rerun successfully.
• All required GitHub checks passed on 93a34fb75a614de980b6bbe8a9aea63698803a84: Lint and test, Deploy PR environment, and Playwright e2e.
• Preview Playwright suite: all 28 tests passed (2.6 minutes).
• Manual preview QA: passed, as described above.
• SigNoz window: 2026-09-09T22:05:51.564Z–2026-09-09T22:16:02.263Z, restricted to xpenser-web-pr-94 and xpenser-api-pr-94. Both emitted traces/logs; no error-level logs.
• Six error spans were investigated: the expected invalid-email-confirmation-token test (HTTP 400), and five handled optional Brandfetch lookups (three ~2-second aborts, one HTTP 400, one HTTP 404). All five parent vendor-create operations returned HTTP 201 without server-span errors. Both warning logs correlated with the expected invalid-token test. No errors/warnings occurred during manual browser QA.
• API event-loop utilization peaked at 3.51%. Web runtime metrics skipped because the existing web setup does not register runtime instrumentation; web traces/logs verified. Bot-specific telemetry was not exercised because no bot behavior changed.

PR-ready notification: sent successfully through the configured local notifier (HTTP 200).

Residual observations

• Optional vendor enrichment can still take approximately two seconds, as it did before this stable-version promotion; the fallback succeeded.
• npm reports 60 dependency audit findings. This update does not include broad audit fixes or unrelated upgrades.

The temporary docs/framework-consumer-experience.md remains local and untracked in the main checkout, unchanged by this update. No Framework changes, blog post, merge, or production deployment performed.