test: cover null resource envelopes for account pages (#70 ) (#71 )

build: use native openapi-typescript --check (#60 )
2026-10-13 22:41:25 +03:00 · 2026-10-13 21:24:24 +03:00
42 changed files with 134 additions and 907 deletions
@@ -71,7 +71,6 @@ Peer-конфликт решай совместимыми версиями бе
 | Итерация | Адресные тесты, typecheck и lint по затронутому поведению и риску. При изменении поведения добавь/обнови содержательную регрессию, если существующая проверка не ловит её; для косметики не создавай искусственный тест. |
 | Итоговый code/dependency diff | Перед объявлением готовности и передачей к интеграции выполни один полный `npm run verify` на итоговых входах. Дополнительные risk checks из testing convention и явно утверждённые task checks обязательны; CI проверяет независимо. |
 | Только Markdown | Проверь тексты, ссылки/якоря, маршруты чтения и `git diff --check`; application build не нужен. При изменении verification-контура проверь его работу. |
-| Pre-commit | Hook не скачивает tools: вызывай установленные бинарники из `node_modules/.bin` (не `npx`). Full graph не входит в hook; он выполняется в `npm run verify` и CI. |

 Повтори routing по staged/unstaged/new files. В отчёте по задаче/PR запиши
 проверенные входы, команду, exit code, результат и ограничения. Повторяй
@@ -89,9 +88,4 @@ Commits и PR titles — Conventional Commits с parser-recognized Issue referen
 содержит одну связанную задачу. Исключения release и правила ссылки — в
 Engineering Workflow из AGENTS. Root другого checkout не управляет этим repo.
 Прямой push в `main`, force-push и перенос опубликованных тегов не входят в
-обычную работу. PR сливается squash или rebase-merge; merge-коммит не
-используется. `main` обновляется только fast-forward из `develop`, поэтому
-`origin/main` всегда предок `origin/develop`:
-`git merge-base --is-ancestor origin/main origin/develop`. Срочный fix —
-обычная ветка `fix/*` от `develop`; пути hotfix от `main` нет.
-Перед релизом прочитай местный README, раздел «Релизы».
+обычную работу. Перед release/hotfix прочитай местный README, раздел «Релизы».
@@ -1,34 +0,0 @@
-name: Frontend verify
-
-# Metadata-only: refreshes only the `commits` context after a PR title edit.
-# Same workflow name keeps the required context; `security` and `verify`
-# statuses of the head revision stay untouched (no skipped overwrite).
-on:
-  pull_request:
-    types: [edited]
-
-concurrency:
-  group: frontend-pr-title-${{ gitea.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  commits:
-    timeout-minutes: 15
-    runs-on: ubuntu-latest
-    steps:
-      - uses: https://github.com/actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          fetch-depth: 0
-      - uses: https://github.com/actions/setup-node@v4
-        with:
-          node-version-file: .nvmrc
-      - run: npm ci --ignore-scripts
-      - name: Check PR title and commits
-        env:
-          PR_TITLE: ${{ github.event.pull_request.title }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          printf '%s\n' "$PR_TITLE" | npm run commitlint -- --strict
-          npm run commitlint -- --strict --from "$BASE_SHA" --to "$HEAD_SHA"
@@ -34,11 +34,7 @@ jobs:
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          printf '%s\n' "$PR_TITLE" | npm run commitlint -- --strict
-          if [[ "$PR_TITLE" =~ ^chore\(release\):\ [0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            npm run commitlint -- --strict --from "$HEAD_SHA^" --to "$HEAD_SHA"
-          else
-            npm run commitlint -- --strict --from "$BASE_SHA" --to "$HEAD_SHA"
-          fi
+          npm run commitlint -- --strict --from "$BASE_SHA" --to "$HEAD_SHA"

  security:
    needs: commits
@@ -1,6 +1,3 @@
 gitleaks git --pre-commit --staged --redact=100 --no-banner || exit $?
-if [ ! -x node_modules/.bin/lint-staged ]; then
-	echo "lint-staged is not installed; run npm ci" >&2
-	exit 1
-fi
-node_modules/.bin/lint-staged
+npx lint-staged
+npm run deps
@@ -1,71 +1,5 @@
 # Changelog

-## [1.2.0](https://git.personal.ksv741.ru/WealthLedger/frontend/compare/v1.1.0...v1.2.0) (2026-10-18)
-
-### Features
-
-* unify income payment cards and remove comparisons (WealthLedger/main[#33](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/33)) ([#74](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/74)) ([43b0f55](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/43b0f5574a79e26de0abae35de16d8aa8700f718))
-
-### Bug Fixes
-
-* align password validation with backend ASCII policy (WealthLedger/backend[#60](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/60)) ([#89](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/89)) ([ebe9268](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/ebe92684a74b4e2617b04ef00d9406b8a0f674ea))
-* **auth,bank:** guard switch-auth nav and surface banking retry ([e38ecd8](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/e38ecd87d6f69968bb56e6035ceeb6cfda208a3f)), closes [#56](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/56) [#57](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/57)
-* **bank:** break BankFeedback's shared/api edge for stories ([#80](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/80)) ([2336804](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/233680448f97dc3ec57d7665ec14c68ac92410e5))
-* deliver screener OpenAPI constraints (WealthLedger/backend[#70](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/70)) ([#85](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/85)) ([ed63ada](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/ed63adad94f5d0e20f7d0d1446a235f953d10ec2))
-* **events:** seven-date default period and picker from today (WealthLedger/frontend[#63](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/63)) ([612ab62](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/612ab6250979bf8d9b57f4feb6e1476ed3d759e4))
-* respect query eligibility in screen sync (WealthLedger/frontend[#54](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/54)) ([f295dea](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/f295dea6a6a33c597c753b52aff629d5382c963a))
-
-### Refactoring
-
-* derive payment-system options from schema tuple ([#58](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/58)) ([#75](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/75)) ([e67c47b](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/e67c47b102329877eb5d9c9d8bb4ea7c0bc70883))
-
-### Build
-
-* use native openapi-typescript --check ([#60](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/60)) ([#77](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/77)) ([df05c8c](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/df05c8c7dbb5d6816fb95d54ca43cd0d83eecd48))
-
-### CI
-
-* keep pre-commit proportionate and avoid tool downloads (WealthLedger/frontend[#62](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/62)) ([#86](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/86)) ([d409a29](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/d409a297e5f9ae5658d4efa958bda9a012a859a1))
-* recheck PR title on edited without the full pipeline (WealthLedger/frontend[#64](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/64)) ([bc28973](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/bc28973d1ad5e15bfbc2e5b73b00ba63449933db))
-
-### Tests
-
-* await client settlement in late-response cases (WealthLedger/frontend[#61](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/61)) ([#81](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/81)) ([f3725c2](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/f3725c202bd8cef4ba711085df82a921a2da6b7d))
-* cover non-retry of INVALID_TBANK_TOKEN reads (WealthLedger/backend[#59](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/59)) ([#90](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/90)) ([5134106](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/513410669680480a1f68f5720744cc85e43c8286))
-* cover null events and income envelopes on account pages ([#72](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/72)) ([#79](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/79)) ([e5f8bbe](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/e5f8bbe33cd438f432281818c5276abe9a425646))
-* cover null resource envelopes for account pages ([#70](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/70)) ([#71](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/71)) ([#78](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/78)) ([f7f53ff](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/f7f53ff8e4de3c1d06fac6063974ff9667145ed6))
-
-### Maintenance
-
-* adopt linear git model in frontend docs ([#91](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/91)) ([eefdde2](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/eefdde29f8da269581e90bd797078e10a39e472f))
-
-## [1.1.0](https://git.personal.ksv741.ru/WealthLedger/frontend/compare/v1.0.0...v1.1.0) (2026-10-12)
-
-### Features
-
-* add stock screener ([a84411d](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/a84411df39dc131290e9f5b5d9313fed17cc629a))
-* align investment client with hourly sync ([432cca2](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/432cca299f3a9a9e45b2697527369ee95f2d0adc))
-* render hourly investment states ([3c226f8](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/3c226f8c29efceccb75af0d6424639a757534f39))
-
-### Bug Fixes
-
-* align frontend workflow rules (WealthLedger/main[#27](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/27)) ([c315f80](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/c315f80b1b07ae0888366512ec157b8e29c81d62))
-* preserve latest stock screener result ([cec9c63](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/cec9c6348a389f16f272dac5533aebc9d12ceae8))
-* show bank summary totals ([20b2cdf](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/20b2cdfd432f8b01e447f68657cf5c685a297f1e))
-
-### Documentation
-
-* clarify frontend verification policy ([cac4351](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/cac4351bc4abf2cec7c5b6611a74d87bf4ec2f70))
-* pin frontend workflow reference (WealthLedger/main[#27](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/27)) ([0d747cc](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/0d747cc93ee08c337cf300c0367612708f45dfb9))
-
-### CI
-
-* skip checks on PR metadata edits ([c882120](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/c8821200ce699dab1ce65360d1968d5877a2e78b))
-
-### Maintenance
-
-* align frontend engineering workflow (WealthLedger/main[#27](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/27)) ([617edfd](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/617edfd489a6a84bb33b57386eca4eb54661f4f0))
-
 ## [1.0.0](https://git.personal.ksv741.ru/WealthLedger/frontend/compare/v0.4.0...v1.0.0) (2026-10-07)

 ### ⚠ BREAKING CHANGES
@@ -19,10 +19,8 @@ npm run dev

 Для commits установите [Gitleaks](https://github.com/gitleaks/gitleaks/releases/tag/v8.30.1)
 8.30.1 в `PATH` (macOS: `brew install gitleaks`). Pre-commit сначала проверяет
-staged diff с полной редакцией секретов, затем запускает установленный
-`node_modules/.bin/lint-staged` только для staged JS/TS. Hook не скачивает tools и
-не запускает full graph: полный `npm run verify` выполняется в CI и перед передачей.
-Находка или отсутствие Gitleaks либо lint-staged блокирует commit.
+staged diff с полной редакцией секретов, затем запускает formatting и FSD checks.
+Находка или отсутствие Gitleaks блокирует commit.
 Проверка этого поведения: `node --test scripts/test-pre-commit.mjs`.

 ## Контейнерный image
@@ -118,8 +116,7 @@ Chromium при ширинах 375 и 1280 px. Browser project не исполь
 Единый `.gitea/workflows/verify.yml` запускает `commits → security → verify`
 последовательно на PR; на push в `develop`/`main` — `security → verify`.
 Рабочие ветки проверяются после открытия PR, без дублирующего push-запуска.
-Изменение заголовка PR запускает `.gitea/workflows/pr-title.yml` (то же имя workflow,
-только job `commits`): статусы `security` и `verify` на HEAD не перезаписываются.
+Изменение заголовка PR тоже повторяет проверки Conventional Commits.
 Новый запуск отменяет устаревший для того же PR/ветки и типа события
 (требуется Gitea 1.26+). Ежедневно в 05:17 UTC выполняется только `security`.
 Job `security` проверяет полную доступную историю Gitleaks 8.30.1 и выполняет
@@ -217,59 +214,36 @@ preset по имени из `.release-it.json`. Версия preset закреп
 Репозиторий выпускается независимо. `develop` — интеграция, `main` — принятые
 релизы. Обычная работа: issue-linked ветка от актуального `develop`, PR в `develop`;
 общие правила — в Engineering Workflow по ссылке из AGENTS.
-PR сливается squash или rebase-merge; merge-коммит не используется. `main`
-обновляется только fast-forward из `develop`, поэтому история линейна:
-
-```text
-<type>/<issue>-<slug> --squash--> develop --ff-only--> main --> tag vX.Y.Z
-```
-
-Инвариант: `origin/main` всегда предок `origin/develop`. Проверка:
-
-```bash
-git fetch -q origin
-git merge-base --is-ancestor origin/main origin/develop && echo ok || echo BROKEN
-```
-
+Обычные PR допускают squash; release и обратная синхронизация сохраняют историю.
 Commits и PR titles — Conventional Commits со ссылкой на Issue (кроме release),
 включая `spec:`. Версии вручную не повышай.

-1. Получи `main`, `develop` и теги: `git fetch origin --tags`. Проверь
-   инвариант. Создай `release/X.Y.Z` от проверенного `develop`;
-   `nvm use --silent`, `npm ci`.
+1. Получи `main`, `develop` и теги: `git fetch origin --tags`. Убедись, что
+   `develop` содержит последний релиз. Создай `release/<name>` от проверенного
+   `develop`; `nvm use --silent`, `npm ci`. Hotfix начинается от `main` в
+   `release/hotfix-<name>` и проходит тот же процесс.
 2. На чистой ветке выполни `npm run release:preview`, просмотри версию/changelog,
   затем `npm run release:prepare`. Команда создаёт `chore(release): X.Y.Z`,
   обновляет manifest/lockfile/CHANGELOG; тег и push не выполняет. Не обходи
   guards ветки, чистого дерева, отсутствующих тегов или уже подготовленной версии.
 3. Проверь diff и штатные gates этого репозитория. Отправь только release-ветку,
-   открой PR в **`develop`** с заголовком `chore(release): X.Y.Z`. После зелёных
-   `verify`, `security`, `commits` выполни fast-forward-only merge. Если
-   `develop` изменился, обнови release-ветку и повтори проверки кандидата.
-4. Открой PR `develop → main` с тем же заголовком и слей fast-forward-only.
-5. Получи удалённый `main`, сравни его HEAD с проверенным release SHA и версией
+   открой PR в `main` с заголовком `chore(release): X.Y.Z`. После зелёных
+   `verify`, `security`, `commits` выполни fast-forward-only merge. Если `main`
+   изменился, согласуй историю и повтори проверки кандидата.
+4. Получи удалённый `main`, сравни его HEAD с проверенным release SHA и версией
   manifest/lockfile. Создай аннотированный `vX.Y.Z` именно на этом SHA:
   `git tag -a vX.Y.Z <release-sha> -m "Release X.Y.Z"`, затем отправь только
   `git push origin refs/tags/vX.Y.Z`. Не запускай release-it повторно на `main`.
-
-Обратная синхронизация не нужна: release-коммит попал в `develop` на шаге 3.
-Опубликованные теги не перемещай. При сбое после merge создай отсутствующий тег
-без нового bump; до merge исправь и проверь существующий кандидат без
-повторного повышения версии.
-
-Freeze релиза не поддерживается: пока открыт релизный PR, `develop` не двигают.
-Срочный fix — обычная ветка `fix/*` от `develop` с последующим релизом;
-пути от `main` нет, он сделал бы `main` не-предком `develop`. Исключение
-требует явного решения: `release/hotfix-<name>` от `main`, PR в `main`, тег,
-затем merge `main → develop` для восстановления инварианта.
+5. Верни release-коммит через PR `main → develop` без squash/rebase; проверь,
+   что `develop` содержит тег. Опубликованные теги не перемещай. При сбое после
+   merge создай отсутствующий тег без нового bump; до merge исправь и проверь
+   существующий кандидат без повторного повышения версии.

 `feat:` повышает minor, `fix:`/`perf:` и прочие разрешённые типы — patch;
 `!`/`BREAKING CHANGE:` — major, включая версии до 1.0. `chore(release):`
 исключён из рекомендации и changelog. Конфигурация — `.release-it.json`.
 В Gitea для `main`/`develop` должны быть запрещены прямой/force push и обход
-администратором, включена блокировка устаревшей ветки, обязательны `verify`,
-`security`, `commits`; теги `v*` защищены. Линейность обеспечивают merge styles
-репозитория: merge-коммиты и rebase `--no-ff` выключены, доступны squash,
-rebase-merge и fast-forward-only; стиль по умолчанию — squash.
+администратором, обязательны `verify`, `security`, `commits`; теги `v*` защищены.
 Workflow сам не включает эти настройки. Отдельное review approval для одного
 владельца не требуется. Npm publishing, deploy и Gitea Releases не включены.

@@ -1,12 +1,12 @@
 {
 	"name": "wealth-ledger-frontend",
-	"version": "1.2.0",
+	"version": "1.0.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "wealth-ledger-frontend",
-			"version": "1.2.0",
+			"version": "1.0.0",
 			"workspaces": [
 				"packages/*"
 			],
@@ -1,7 +1,7 @@
 {
 	"name": "wealth-ledger-frontend",
 	"private": true,
-	"version": "1.2.0",
+	"version": "1.0.0",
 	"type": "module",
 	"engines": {
 		"node": "24.21.0"
@@ -47,12 +47,6 @@ test("pre-commit scans the index, redacts findings and fails closed", () => {
 		}

 		git("init", "--quiet");
-		// The hook must run the installed lint-staged binary, never download one.
-		const localBin = nodePath.join(cwd, "node_modules", ".bin");
-		// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
-		mkdirSync(localBin, { recursive: true });
-		// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
-		writeFileSync(nodePath.join(localBin, "lint-staged"), "#!/bin/sh\necho ran >> downstream\n", { mode: 0o755 });
 		// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
 		writeFileSync(nodePath.join(cwd, "sample.txt"), "safe staged content\n");
 		git("add", "sample.txt");
@@ -83,37 +77,3 @@ test("pre-commit scans the index, redacts findings and fails closed", () => {
 		rmSync(cwd, { force: true, recursive: true });
 	}
 });
-
-test("pre-commit never downloads tools and blocks when lint-staged is missing", () => {
-	const hook = nodePath.resolve(".husky/pre-commit");
-	const cwd = mkdtempSync(nodePath.join(tmpdir(), "frontend-hook-"));
-	const bin = nodePath.join(cwd, "bin");
-	const marker = nodePath.join(cwd, "downstream");
-
-	try {
-		// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
-		mkdirSync(bin);
-		// Gitleaks passes; npx/npm must never be reached, even if present on PATH.
-		// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
-		writeFileSync(nodePath.join(bin, "gitleaks"), "#!/bin/sh\nexit 0\n", { mode: 0o755 });
-
-		for (const command of ["npx", "npm"]) {
-			// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
-			writeFileSync(nodePath.join(bin, command), "#!/bin/sh\necho ran >> downstream\n", { mode: 0o755 });
-		}
-
-		const result = spawnSync("/bin/sh", ["-e", hook], {
-			cwd,
-			encoding: "utf8",
-			env: { ...process.env, PATH: `${bin}${nodePath.delimiter}${process.env.PATH}` },
-		});
-
-		assert.notEqual(result.status, 0, "missing lint-staged must block commit");
-		assert.match(result.stderr, /lint-staged is not installed/);
-		// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
-		assert.ok(!existsSync(marker), "hook must not invoke npx or npm");
-	}
-	finally {
-		rmSync(cwd, { force: true, recursive: true });
-	}
-});
@@ -18,21 +18,12 @@ import type { IncomeAnalytics } from "@/entities/income";
 import type { Portfolio } from "@/entities/portfolio";

 import { AuthProvider } from "@/features/auth";
-import { defaultPeriod, formatDate } from "@/shared/lib";
 import { createTestQueryClient } from "@/test/query";
 import { resource } from "@/test/resource";
 import { server } from "@/test/server";

 import { AppRoutes } from "./AppRoutes";

-// Mantine calendar labels follow dayjs default (English) locale.
-function dayLabel(date: string) {
-	const monthName = new Intl.DateTimeFormat("en", { month: "long" })
-		.format(new Date(`${date}T12:00:00Z`));
-
-	return `${Number(date.slice(8))} ${monthName} ${date.slice(0, 4)}`;
-}
-
 const accounts = [
 	{ id: "a", name: "Основной" },
 	{ id: "b", name: "ИИС" },
@@ -242,7 +233,7 @@ describe("All accounts routes", () => {
 		);
 	});

-	it.each(["operations", "income"])(
+	it.each(["operations", "events", "income"])(
 		"restores applied dates when switching accounts in %s",
 		async (section) => {
 			const search = "?from=2026-08-01&to=2026-08-31";
@@ -270,31 +261,6 @@ describe("All accounts routes", () => {
 		},
 	);

-	it("restores applied dates when switching accounts in events", async () => {
-		// The events calendar blocks past dates, so pick within selectable dates.
-		const search = `?from=${defaultPeriod()[0]}&to=${defaultPeriod()[1]}`;
-		renderPage(`/accounts/all/events${search}`);
-		const picker = await screen.findByLabelText("Период");
-		fireEvent.click(picker);
-		const [fromDate, toDate] = defaultPeriod();
-		fireEvent.click(
-			await screen.findByRole("button", { name: dayLabel(fromDate) }),
-		);
-		fireEvent.click(
-			await screen.findByRole("button", { name: dayLabel(toDate) }),
-		);
-		expect(screen.getByLabelText("Период")).toHaveTextContent(
-			`${formatDate(fromDate)} – ${formatDate(toDate)}`,
-		);
-		fireEvent.click(screen.getByRole("combobox", { name: "Счёт" }));
-		fireEvent.click(await screen.findByRole("option", { name: "ИИС" }));
-		await waitFor(() =>
-			expect(screen.getByLabelText("Текущий путь")).toHaveTextContent(
-				`/accounts/b/events${search}`,
-			),
-		);
-	});
-
 	it("groups the same security and links its accounts and overview sections", async () => {
 		renderPage("/accounts/all");
 		expect(await screen.findAllByText("Сбербанк")).toHaveLength(1);
@@ -1,7 +0,0 @@
-function errorCode(error: unknown): string | undefined {
-	return typeof error === "object" && error !== null && "code" in error
-		? String(error.code)
-		: undefined;
-}
-
-export { errorCode };
@@ -3,7 +3,7 @@ import type { FC } from "react";
 import { Alert, Button, Group, Text } from "@mantine/core";
 import { useTranslation } from "react-i18next";

-import { errorCode } from "../model/error-code";
+import { apiErrorCode } from "@/shared/api";

 type BankFeedbackProps = {
 	cached?: boolean;
@@ -14,7 +14,7 @@ type BankFeedbackProps = {

 const BankFeedback: FC<BankFeedbackProps> = (props) => {
 	const { t } = useTranslation();
-	const code = errorCode(props.error);
+	const code = apiErrorCode(props.error);

 	return (
 		<Alert color="orange" role="alert">
@@ -10,7 +10,6 @@ import { formatMoney } from "@/shared/lib";
 import type { BankSummary } from "../../api/types";

 import { bankOperationAppearance } from "../../model/operation-appearance";
-import { BankFeedback } from "../BankFeedback";
 import classes from "./BankSummary.module.css";

 const CATEGORY_COLUMNS = 2;
@@ -18,10 +17,9 @@ const CATEGORY_COLUMNS = 2;
 type BankSummaryViewProps = {
 	all?: boolean;
 	data?: BankSummary;
-	error: unknown;
+	error: boolean;
 	fetching: boolean;
 	loading: boolean;
-	retry?: () => void;
 };

 const BankSummaryViewCategories: FC<BankSummaryViewProps> = (props) => {
@@ -124,14 +122,7 @@ const BankSummaryView: FC<BankSummaryViewProps> = (props) => {

 			<BankSummaryViewCategories {...props} />

-			{Boolean(props.error) && (
-				<BankFeedback
-					cached={Boolean(props.data)}
-					error={props.error}
-					loadingError={!props.data}
-					retry={props.retry}
-				/>
-			)}
+			{props.error && !props.data && <Text role="alert">{t("bank.error")}</Text>}
 		</Stack>
 	);
 };
@@ -1,55 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { loginSchema, registerSchema } from "./auth.schema";
-
-const email = "user@example.com";
-
-function canLogIn(password: string) {
-	return loginSchema.safeParse({ email, password }).success;
-}
-
-function canRegister(password: string, confirmation = password) {
-	return registerSchema.safeParse({
-		email,
-		password,
-		passwordConfirmation: confirmation,
-	}).success;
-}
-
-// Register policy: 8..72 printable ASCII (bcrypt reads 72 bytes, so non-ASCII could be
-// truncated). Login stays lenient so accounts created under the old policy still sign in.
-describe("auth password policy", () => {
-	it.each([
-		["7 chars", "a".repeat(7), false],
-		["8 chars", "a".repeat(8), true],
-		["72 chars", "a".repeat(72), true],
-		["73 chars", "a".repeat(73), false],
-		["printable symbols and space", "Aa1 !~\"#$%&'()*+,-./:;<=>?@", true],
-		["Cyrillic, 8+ chars", "пароль-пароль", false],
-		["emoji", "passw😀rd", false],
-		["tab", "pass\tword1", false],
-		["newline", "password1\n", false],
-		["DEL", "password\u{7F}1", false],
-	])("register: %s", (_, password, accepted) => {
-		expect(canRegister(password)).toBe(accepted);
-	});
-
-	it("register compares the raw password with its confirmation", () => {
-		const padded = "  spaced pass  ";
-
-		expect(canRegister(padded)).toBe(true);
-		expect(canRegister(padded, padded.trim())).toBe(false);
-	});
-
-	it.each([
-		["legacy Cyrillic password", "пароль-пароль", true],
-		["short legacy password", "short", true],
-		["72 bytes", "a".repeat(72), true],
-		["73 bytes", "a".repeat(73), false],
-		["36 Cyrillic letters = 72 bytes", "я".repeat(36), true],
-		["37 Cyrillic letters = 74 bytes", "я".repeat(37), false],
-		["empty", "", false],
-	])("login: %s", (_, password, accepted) => {
-		expect(canLogIn(password)).toBe(accepted);
-	});
-});
@@ -7,10 +7,8 @@ const EMAIL_PART_COUNT = 2;
 const ASCII_SPACE = 32;
 const ASCII_DELETE = 127;
 const MAX_EMAIL_LENGTH = 254;
-const MIN_PASSWORD_LENGTH = 8;
+const MIN_PASSWORD_BYTES = 12;
 const MAX_PASSWORD_BYTES = 72;
-// Printable ASCII keeps characters == bytes, within the bcrypt 72-byte limit.
-const ASCII_TILDE = 126;

 function isEmailCharacterInvalid(character: string): boolean {
 	const codePoint = character.codePointAt(0);
@@ -22,14 +20,6 @@ function isEmailCharacterInvalid(character: string): boolean {
 	);
 }

-function isPrintableAscii(value: string): boolean {
-	return value.split("").every((character) => {
-		const code = character.codePointAt(0) ?? 0;
-
-		return code >= ASCII_SPACE && code <= ASCII_TILDE;
-	});
-}
-
 const email = z
 	.string()
 	.trim()
@@ -43,42 +33,28 @@ const email = z
 		{ error: validationMessage("auth.validation.invalidEmail") },
 	);

-// Login stays lenient: accounts created under an older policy must still sign in.
-const loginPassword = z
+const password = z
 	.string()
-	.min(1)
 	.refine(
-		value => new TextEncoder().encode(value).length <= MAX_PASSWORD_BYTES,
-		{ error: validationMessage("auth.validation.passwordTooLong") },
+		value =>
+			new TextEncoder().encode(value).length >= MIN_PASSWORD_BYTES
+				&& new TextEncoder().encode(value).length <= MAX_PASSWORD_BYTES,
+		{ error: validationMessage("auth.validation.invalidPasswordLength") },
 	);

-const registerPassword = z
-	.string()
-	.min(MIN_PASSWORD_LENGTH, {
-		error: validationMessage("auth.validation.invalidPasswordLength"),
-	})
-	.max(MAX_PASSWORD_BYTES, {
-		error: validationMessage("auth.validation.invalidPasswordLength"),
-	})
-	.refine(isPrintableAscii, {
-		error: validationMessage("auth.validation.invalidPasswordLength"),
-	});
-
 const loginSchema = z.object({
 	email,
-	password: loginPassword,
+	password,
 	passwordConfirmation: z.string().optional(),
 });

-const registerSchema = loginSchema
-	.extend({ password: registerPassword })
-	.refine(
-		value => value.password === value.passwordConfirmation,
-		{
-			error: validationMessage("auth.validation.passwordsDoNotMatch"),
-			path: ["passwordConfirmation"],
-		},
-	);
+const registerSchema = loginSchema.refine(
+	value => value.password === value.passwordConfirmation,
+	{
+		error: validationMessage("auth.validation.passwordsDoNotMatch"),
+		path: ["passwordConfirmation"],
+	},
+);

 type AuthFormValues = z.input<typeof loginSchema>;

@@ -30,79 +30,4 @@ describe("AuthForm", () => {
 		await waitFor(() => expect(onSubmit).not.toHaveBeenCalled());
 		expect(await screen.findByText("Пароли не совпадают")).toBeInTheDocument();
 	});
-
-	it.each([
-		["register", "Регистрация", "Уже есть аккаунт? Войти"],
-		["login", "Вход", "Нет аккаунта? Зарегистрироваться"],
-	])("blocks the switch-auth link while %s is submitting", async (_mode, submitLabel, linkLabel) => {
-		const { promise, resolve } = Promise.withResolvers<void>();
-		const onSubmit = vi.fn(() => promise);
-		render(
-			<MantineProvider>
-				<MemoryRouter>
-					<AuthForm
-						onSubmit={onSubmit}
-						register={_mode === "register"}
-					/>
-				</MemoryRouter>
-			</MantineProvider>,
-		);
-
-		fireEvent.change(screen.getByLabelText("Email"), {
-			target: { value: "user@example.com" },
-		});
-		fireEvent.change(screen.getByLabelText("Пароль"), {
-			target: { value: "a secure password" },
-		});
-
-		if (_mode === "register") {
-			fireEvent.change(screen.getByLabelText("Подтвердите пароль"), {
-				target: { value: "a secure password" },
-			});
-		}
-
-		fireEvent.click(screen.getByRole("button", { name: submitLabel }));
-
-		await waitFor(() => expect(onSubmit).toHaveBeenCalled());
-		expect(screen.queryByRole("link", { name: linkLabel })).not.toBeInTheDocument();
-		expect(screen.getByRole("button", { name: linkLabel })).toBeDisabled();
-
-		resolve();
-		await screen.findByRole("link", { name: linkLabel });
-	});
-
-	// Register policy is 8..72 printable ASCII; login accepts legacy passwords.
-	it.each([
-		["register", "Регистрация", "пароль-пароль", false],
-		["register", "Регистрация", "passw😀rd", false],
-		["register", "Регистрация", "a".repeat(7), false],
-		["register", "Регистрация", "a".repeat(8), true],
-		["register", "Регистрация", "a".repeat(72), true],
-		["register", "Регистрация", "a".repeat(73), false],
-		["login", "Вход", "пароль-пароль", true],
-	])("%s submits password %j: %s", async (mode, submitLabel, password, submitted) => {
-		const onSubmit = vi.fn().mockResolvedValue(undefined);
-
-		render(
-			<MantineProvider>
-				<MemoryRouter>
-					<AuthForm onSubmit={onSubmit} register={mode === "register"} />
-				</MemoryRouter>
-			</MantineProvider>,
-		);
-
-		fireEvent.change(screen.getByLabelText("Email"), { target: { value: "user@example.com" } });
-		fireEvent.change(screen.getByLabelText("Пароль"), { target: { value: password } });
-
-		if (mode === "register") {
-			fireEvent.change(screen.getByLabelText("Подтвердите пароль"), { target: { value: password } });
-		}
-
-		fireEvent.click(screen.getByRole("button", { name: submitLabel }));
-
-		await waitFor(() => expect(
-			screen.queryByText(/Пароль: от 8 до 72 символов/) === null,
-		).toBe(submitted));
-		expect(onSubmit).toHaveBeenCalledTimes(submitted ? 1 : 0);
-	});
 });
@@ -1,4 +1,4 @@
-import type { FC, ReactNode } from "react";
+import type { FC } from "react";

 import { zodResolver } from "@hookform/resolvers/zod";
 import { Alert, Button, Fieldset, PasswordInput, Stack, TextInput } from "@mantine/core";
@@ -15,7 +15,7 @@ import {

 type AuthFormProps = {
 	onSubmit: (email: string, password: string) => Promise<void>;
-	register?: boolean;
+	register?: true;
 };

 const AuthForm: FC<AuthFormProps> = (props) => {
@@ -45,24 +45,6 @@ const AuthForm: FC<AuthFormProps> = (props) => {
 	});

 	const to = register ? "/login" : "/register";
-	const switchLabel = t(register ? "auth.haveAccount" : "auth.noAccount");
-
-	let switchLink: ReactNode;
-
-	if (isSubmitting) {
-		switchLink = (
-			<Button aria-disabled disabled variant="subtle">
-				{switchLabel}
-			</Button>
-		);
-	}
-	else {
-		switchLink = (
-			<Button component={Link} to={to} variant="subtle">
-				{switchLabel}
-			</Button>
-		);
-	}

 	return (
 		<FormProvider {...methods}>
@@ -95,7 +77,9 @@ const AuthForm: FC<AuthFormProps> = (props) => {
 							{t(register ? "auth.register" : "auth.login")}
 						</Button>

-						{switchLink}
+						<Button component={Link} to={to} variant="subtle">
+							{t(register ? "auth.haveAccount" : "auth.noAccount")}
+						</Button>
 					</Stack>
 				</Fieldset>
 			</form>
@@ -78,35 +78,4 @@ describe("read-only screen synchronization", () => {
 		await act(async () => result.current.refresh());
 		await waitFor(() => expect(gets).toBe(2));
 	});
-
-	it("does not manually refetch disabled resources", async () => {
-		vi.useFakeTimers();
-		const refetch = vi.fn(() => Promise.resolve());
-
-		const resource = {
-			isEnabled: false,
-			isError: true,
-			isFetching: false,
-			queryKey: [],
-			refetch,
-		};
-
-		try {
-			const { result, unmount } = renderHook(() =>
-				useScreenSync({ screen: "accounts" }, [resource]),
-			);
-
-			await act(async () => {
-				await result.current.refresh();
-				await result.current.retry();
-			});
-			await act(() => vi.advanceTimersByTime(1_800_000));
-
-			expect(refetch).not.toHaveBeenCalled();
-			unmount();
-		}
-		finally {
-			vi.useRealTimers();
-		}
-	});
 });
@@ -5,7 +5,6 @@ import { useEffect, useRef } from "react";
 import type { InvestmentResourceMeta } from "@/shared/api";

 type ScreenResource = {
-	isEnabled: boolean;
 	isError: boolean;
 	isFetching: boolean;
 	meta?: InvestmentResourceMeta;
@@ -28,31 +27,23 @@ function useScreenSync(_scope: ScreenScope, resources: ScreenResource[]) {

 	useEffect(() => {
 		const timer = setInterval(() => {
-			for (const resource of resourcesRef.current) {
-				if (!resource.isEnabled || resource.isFetching) continue;
+			for (const resource of resourcesRef.current)
 				void resource.refetch().catch(() => {});
-			}
 		}, READ_INTERVAL_MS);

 		return () => clearInterval(timer);
 	}, []);

-	const isRefreshing = resources.some(
-		resource => resource.isEnabled && resource.isFetching,
-	);
-
-	const eligible = resources.filter(
-		resource => resource.isEnabled && !resource.isFetching,
-	);
+	const isRefreshing = resources.some(resource => resource.isFetching);

 	const refresh = async () => {
 		if (isRefreshing) return;
-		await Promise.allSettled(eligible.map(resource => resource.refetch()));
+		await Promise.allSettled(resources.map(resource => resource.refetch()));
 	};

 	// Retry only the HTTP read; source attempts are reported in resource metadata.
 	const retry = async () => {
-		const failed = eligible.filter(resource => resource.isError);
+		const failed = resources.filter(resource => resource.isError);

 		if (failed.length > 0)
 			await Promise.allSettled(failed.map(resource => resource.refetch()));
@@ -20,7 +20,7 @@ import {
 import { beforeEach, describe, expect, it, vi } from "vitest";

 import { configureAuthClient } from "@/shared/api";
-import { defaultPeriod, formatDate, moscowDate } from "@/shared/lib";
+import { defaultPeriod, formatDate } from "@/shared/lib";
 import { createTestQueryClient } from "@/test/query";
 import { resource } from "@/test/resource";
 import { server } from "@/test/server";
@@ -253,58 +253,37 @@ describe("Upcoming event date filters", () => {
 			expect(from).toHaveTextContent("01.02.2026 – 28.02.2026");
 			expect(screen.getByRole("button", { name: "Применить" })).toBeDisabled();
 			expect(searches).toEqual(["?from=2026-02-01&to=2026-02-28"]);
-
-			// The calendar opens on the applied month, so reset to the default
-			// range first, then pick today and a future date.
-			fireEvent.click(screen.getByRole("button", { name: "Сбросить" }));
-			await waitFor(() => expect(screen.getByLabelText("URL")).toBeEmptyDOMElement());
-			const picker = await screen.findByLabelText("Период");
-
-			const [today] = defaultPeriod();
-			const [year = 1970, month = 0, day = 1] = today.split("-").map(Number);
-
-			const future = moscowDate(new Date(
-				Date.UTC(year, month - 1, day + 10, 12),
-			));
-
-			// Mantine calendar labels follow dayjs default (English) locale.
-			const calendarLabel = (date: string) => {
-				const monthName = new Intl.DateTimeFormat("en", { month: "long" })
-					.format(new Date(`${date}T12:00:00Z`));
-
-				const pattern = `${Number(date.slice(8))} ${monthName} ${date.slice(0, 4)}`;
-
-				// Dates are constructed above from validated defaultPeriod output.
-				// eslint-disable-next-line security/detect-non-literal-regexp -- see comment above
-				return new RegExp(pattern, "i");
-			};
-
-			fireEvent.click(picker);
+			fireEvent.click(from);
 			fireEvent.click(
-				await screen.findByRole("button", { name: calendarLabel(today) }),
+				await screen.findByRole("button", { name: /10 February 2026/i }),
 			);
 			fireEvent.click(
-				await screen.findByRole("button", { name: calendarLabel(future) }),
+				await screen.findByRole("button", { name: /28 February 2026/i }),
 			);
-			// The reset itself fetched the default range; picking dates applies only on submit.
-			expect(searches).toEqual([
-				"?from=2026-02-01&to=2026-02-28",
-				`?from=${defaultFrom}&to=${defaultTo}`,
-			]);
+			expect(searches).toHaveLength(1);
 			fireEvent.click(screen.getByRole("button", { name: "Применить" }));
 			await waitFor(() =>
-				expect(searches.at(-1)).toBe(`?from=${today}&to=${future}`),
+				expect(searches.at(-1)).toBe("?from=2026-02-10&to=2026-02-28"),
 			);
 			expect(await screen.findByLabelText("Период")).toHaveTextContent(
-				`${formatDate(today)} – ${formatDate(future)}`,
+				"10.02.2026 – 28.02.2026",
 			);
 			fireEvent.click(screen.getByRole("button", { name: "History back" }));
 			await waitFor(() =>
 				expect(screen.getByLabelText("Период")).toHaveTextContent(
-					`${formatDate(defaultFrom)} – ${formatDate(defaultTo)}`,
+					"01.02.2026 – 28.02.2026",
 				),
 			);
-			expect(screen.getByLabelText("URL")).toBeEmptyDOMElement();
+			expect(screen.getByLabelText("URL")).toHaveTextContent(
+				"?from=2026-02-01&to=2026-02-28",
+			);
+			fireEvent.click(screen.getByRole("button", { name: "Сбросить" }));
+			await waitFor(() =>
+				expect(searches.at(-1)).toBe(`?from=${defaultFrom}&to=${defaultTo}`),
+			);
+			expect(await screen.findByLabelText("Период")).toHaveTextContent(
+				`${formatDate(defaultFrom)} – ${formatDate(defaultTo)}`,
+			);
 			expect(screen.getByRole("button", { name: "Применить" })).toBeDisabled();
 			expect(
 				screen.getByText("За выбранный период событий не найдено"),
@@ -211,30 +211,4 @@ describe("AccountEventsPage", () => {
 		expect(status).toHaveAttribute("aria-busy", "true");
 		expect(within(status).queryByRole("button")).not.toBeInTheDocument();
 	});
-
-	it("keeps a null events envelope loading instead of an empty period", () => {
-		query.mockReturnValue(
-			{
-				data: null,
-				isError: false,
-				isLoading: false,
-				meta: {
-					availability: "available",
-					completeness: "complete",
-					lastAttempt: { finishedAt: null, problems: [], startedAt: null, state: "none" },
-				},
-				refetch: vi.fn(),
-			} as never,
-		);
-
-		renderPage();
-
-		expect(screen.getByRole("status", { name: "Загрузка" })).toHaveAttribute(
-			"aria-busy",
-			"true",
-		);
-		expect(
-			screen.queryByText("За выбранный период событий не найдено"),
-		).not.toBeInTheDocument();
-	});
 });
@@ -21,7 +21,7 @@ type AccountEventsPageViewModel
 		canApply: boolean;
 		draftPeriod: [null | string, null | string];
 		events: BrokerageEvent[];
-		minDate: string;
+		maxDate: string;
 		onApply: () => void;
 		onPeriodChange: (value: [null | string, null | string]) => void;
 		onPeriodPopoverOpen: () => void;
@@ -49,7 +49,7 @@ function useAccountEventsPageViewModel(): AccountEventsPageViewModel {

 	const [draftFrom, draftTo] = draftPeriod;

-	const [minDate, setMinDate] = useState(() => moscowDate(new Date()));
+	const [maxDate, setMaxDate] = useState(() => moscowDate(new Date()));

 	const scope = JSON.stringify([accountId, appliedFrom, appliedTo]);
 	const [previousScope, setPreviousScope] = useState(scope);
@@ -105,7 +105,7 @@ function useAccountEventsPageViewModel(): AccountEventsPageViewModel {
 			&& isValidPeriod(draftFrom, draftTo),
 		draftPeriod,
 		events: events.data.events,
-		minDate,
+		maxDate,
 		onApply: () => {
 			if (!isValidPeriod(draftFrom, draftTo)) return;
 			setSearchParameters({
@@ -116,7 +116,7 @@ function useAccountEventsPageViewModel(): AccountEventsPageViewModel {
 		onPeriodChange: value => setDraftPeriod(
 			value[0] === null && value[1] === null ? defaultPeriod() : value,
 		),
-		onPeriodPopoverOpen: () => setMinDate(moscowDate(new Date())),
+		onPeriodPopoverOpen: () => setMaxDate(moscowDate(new Date())),
 		onReset,
 		partial: events.meta?.completeness === "incomplete",
 		source: events.meta,
@@ -72,7 +72,7 @@ const AccountEventsPageLoaded: FC<AccountEventsPageLoadedProps> = (props) => {
 					clearable
 					clearButtonProps={{ "aria-label": t("ledger.clearPeriod") }}
 					label={t("ledger.period")}
-					minDate={props.minDate}
+					maxDate={props.maxDate}
 					onChange={props.onPeriodChange}
 					popoverProps={{
 						middlewares: { shift: { crossAxis: true } },
@@ -314,24 +314,6 @@ describe("AccountIncomePage", () => {
 		).not.toBeInTheDocument();
 	});

-	it("keeps a null analytics envelope loading instead of an empty page", async () => {
-		server.use(
-			http.get("*/api/v1/brokerage-accounts/account-1/income-analytics", () =>
-				HttpResponse.json(resource(null)),
-			),
-		);
-		renderPage();
-		expect(
-			await screen.findByRole("status", { name: "Загрузка" }, { timeout: 4000 }),
-		).toBeVisible();
-		expect(
-			screen.queryByRole("heading", { name: "Пассивный доход" }),
-		).not.toBeInTheDocument();
-		expect(
-			screen.queryByRole("button", { name: "Повторить" }),
-		).not.toBeInTheDocument();
-	});
-
 	it("renders the signed drill-down using opaque membership rather than instrument identity", async () => {
 		const response
 			= {
@@ -420,32 +420,6 @@ describe("AccountPage states", () => {
 		).toMatchObject({ data: null });
 	});

-	it("keeps null events and income envelopes loading in the previews", async () => {
-		server.use(
-			http.get("*/api/v1/brokerage-accounts/:accountId/events", () =>
-				HttpResponse.json(resource(null)),
-			),
-			http.get("*/api/v1/brokerage-accounts/:accountId/income-summary", () =>
-				HttpResponse.json(resource(null)),
-			),
-		);
-		renderAccountRoute(createTestQueryClient());
-
-		expect(
-			await screen.findByText("Портфель пока пуст", undefined, {
-				timeout: 4000,
-			}),
-		).toBeVisible();
-		expect(
-			screen.getByRole("status", { name: "Загрузка будущих событий" }),
-		).toBeVisible();
-		expect(
-			screen.queryByText("На ближайшие 30 дней событий не найдено."),
-		).not.toBeInTheDocument();
-		expect(screen.getByText("Загрузка дохода текущего месяца")).toBeVisible();
-		expect(screen.queryByText("Нет текущих сумм")).not.toBeInTheDocument();
-	});
-
 	it("renders a stale portfolio in upstream order with nullable values hidden", () => {
 		renderPage(<AccountPageLoaded {...loadedProps()} />);

@@ -88,6 +88,7 @@ const quote
 function setup(
 	options: {
 		ambiguousTicker?: boolean;
+		failBond?: boolean;
 		failCoupons?: boolean;
 		noPosition?: boolean;
 		path?: string;
@@ -99,7 +100,11 @@ function setup(
 	const resolved = { ...bond, slug: options.slug ?? uid };
 	let isFailQuote = false;
 	server.use(
-		http.get("*/api/v1/bonds/:uid", () => HttpResponse.json(resource(resolved))),
+		http.get("*/api/v1/bonds/:uid", () =>
+			options.failBond
+				? HttpResponse.json({ code: "NOT_FOUND" }, { status: 404 })
+				: HttpResponse.json(resource(resolved)),
+		),
 		http.get("*/api/v1/bonds/by-ticker/:ticker", ({ request }) => {
 			requests.push(new URL(request.url));

@@ -17,7 +17,6 @@ import { useTranslation } from "react-i18next";
 import { Link } from "react-router";

 import {
-	BankFeedback,
 	bankOperationAppearance,
 } from "@/entities/bank-card";

@@ -109,17 +108,6 @@ const CardHistory: FC<CardHistoryProps> = (props) => {
 		return <Text>{t("bank.noOperations")}</Text>;
 	}

-	if (vm.history.error) {
-		return (
-			<BankFeedback
-				cached={Boolean(vm.rows)}
-				error={vm.history.error}
-				loadingError={!vm.rows}
-				retry={vm.history.refetch}
-			/>
-		);
-	}
-
 	if (vm.history.loading) {
 		return (
 			<LoadingSkeleton label={t("bank.loadingHistory")}>
@@ -316,47 +316,12 @@ describe("CardPage", () => {
 		setup({ summaryError: true });
 		await screen.findByRole("heading", { name: "Повседневная" });
 		expect(
-			await screen.findByText("Перевод на «Запасная»"),
-		).toBeInTheDocument();
-		expect(await screen.findByRole("alert", {}, { timeout: 5000 })).toHaveTextContent(
-			"Не удалось загрузить данные карт.",
-		);
-		expect(screen.queryByText("0 ₽")).not.toBeInTheDocument();
-	});
-
-	it("recovers summary with retry while keeping card and journal", async () => {
-		const { summaryRequests } = setup({ summaryError: true });
-		await screen.findByRole("heading", { name: "Повседневная" });
+			screen.queryByRole("alert"),
+		).not.toBeInTheDocument();
 		expect(
 			await screen.findByText("Перевод на «Запасная»"),
 		).toBeInTheDocument();
-
-		const retry = await screen.findByRole(
-			"button",
-			{ name: "Повторить" },
-			{ timeout: 5000 },
-		);
-
-		const requestsBefore = summaryRequests.length;
-		server.use(
-			http.get("*/api/v1/bank-cards/summary", ({ request }) => {
-				summaryRequests.push(new URL(request.url).search);
-
-				return HttpResponse.json({
-					cardId: "a",
-					categories: [],
-					expenses: money("0"),
-					net: money("-50"),
-					refunds: money("50"),
-				});
-			}),
-		);
-		fireEvent.click(retry);
-
-		await waitFor(() =>
-			expect(screen.queryByRole("alert")).not.toBeInTheDocument(),
-		);
-		expect(summaryRequests).toHaveLength(requestsBefore + 1);
+		expect(screen.queryByText("0 ₽")).not.toBeInTheDocument();
 	});
 	it("keeps cached card and history after refetch failure", async () => {
 		const { client } = setup();
@@ -366,8 +331,9 @@ describe("CardPage", () => {
 			http.get("*/api/v1/bank-cards/a/operations", () => HttpResponse.error()),
 		);
 		await client.invalidateQueries();
-		const alerts = await screen.findAllByRole("alert", {}, { timeout: 5000 });
-		expect(alerts.length).toBeGreaterThanOrEqual(1);
+		await waitFor(() => {
+			expect(screen.queryByRole("alert")).not.toBeInTheDocument();
+		});
 		expect(
 			screen.getByRole("heading", { name: "Повседневная" }),
 		).toBeInTheDocument();
@@ -435,11 +401,11 @@ describe("CardPage", () => {
 		]);
 	});
 	it("recovers the prerequisite card list while preserving the visible balance and journal", async () => {
-		const { client } = setup({ cardsError: true });
+		setup({ cardsError: true });
 		await screen.findByText("Перевод на «Запасная»");
 		expect(
-			await screen.findByRole("alert", {}, { timeout: 5000 }),
-		).toHaveTextContent("Не удалось загрузить данные карт.");
+			screen.queryByRole("alert"),
+		).not.toBeInTheDocument();
 		expect(
 			screen.getByRole("button", { name: "Добавить операцию" }),
 		).toBeDisabled();
@@ -448,7 +414,6 @@ describe("CardPage", () => {
 				HttpResponse.json([card, { ...card, id: "b", name: "Запасная" }]),
 			),
 		);
-		await client.invalidateQueries();
 		await waitFor(() =>
 			expect(
 				screen.getByRole("button", { name: "Добавить операцию" }),
@@ -75,11 +75,6 @@ const CardPageView: FC<CardPageViewProps> = (props) => {
 							{t("bank.back")}
 						</Button>

-						{!vm.notFound && (
-							<Button onClick={vm.cardRetry} variant="default">
-								{t("bank.retry")}
-							</Button>
-						)}
 					</Group>
 				)}
 				error
@@ -133,27 +128,18 @@ const CardPageView: FC<CardPageViewProps> = (props) => {
 				)}

 				{card.archivedAt && <Text>{t("bank.archiveHint")}</Text>}
-
-				{vm.cardError && vm.card && (
-					<BankFeedback
-						cached
-						error={vm.cardError}
-						retry={vm.cardRetry}
-					/>
-				)}
 			</Stack>

 			{vm.cardsFeedback && (
 				<BankFeedback
 					{...vm.cardsFeedback}
 					loadingError
-					retry={vm.cardsRetry}
 				/>
 			)}

 			<BankPeriodPicker onChange={vm.setPeriod} period={vm.period} />

-			<BankSummaryView {...vm.summary} retry={vm.summary.refetch} />
+			<BankSummaryView {...vm.summary} />

 			<Group align="end" justify="space-between">
 				<Group gap="xs">
@@ -197,6 +183,8 @@ const CardPageView: FC<CardPageViewProps> = (props) => {
 				<CardHistory history={vm.history} period={vm.period} rows={vm.rows} />
 			</Stack>

+			{vm.history.error && !vm.rows && <Text role="alert">{t("bank.error")}</Text>}
+
 			{vm.history.page !== undefined && vm.pageSize !== "all" && (
 				<Group
 					aria-label={t("bank.pagination")}
@@ -97,16 +97,13 @@ function useCardPageVm() {
 		archivePending: updateCard.isPending,
 		canAddOperation: !card.data?.archivedAt && Boolean(cards.data),
 		card: card.data,
-		cardError: card.error,
 		cardLoading: card.isLoading,
 		cardRefreshError: card.isError,
 		cardRefreshing: card.isFetching,
-		cardRetry: () => card.refetch(),
 		cards: cards.data,
 		cardsFeedback: cards.isError
 			? { cached: Boolean(cards.data), error: cards.error }
 			: undefined,
-		cardsRetry: () => cards.refetch(),
 		closeDeletion: () => setDeleting(null),
 		closeEditing: () => setEditingCard(false),
 		closeOperation: () => setOperation(null),
@@ -115,10 +112,9 @@ function useCardPageVm() {
 		editingCard,
 		history: {
 			changingPage: history.isPlaceholderData,
-			error: history.error,
+			error: history.isError,
 			loading: history.isLoading,
 			page: history.data?.page,
-			refetch: () => history.refetch(),
 		},
 		notFound: isApiErrorCode(
 			apiErrorCode(card.error),
@@ -143,10 +139,9 @@ function useCardPageVm() {
 		},
 		summary: {
 			data: summary.data,
-			error: summary.error,
+			error: summary.isError,
 			fetching: summary.isFetching,
 			loading: summary.isLoading,
-			refetch: () => summary.refetch(),
 		},
 		toggleArchive: () => {
 			if (!card.data) return;
@@ -47,9 +47,8 @@ function renderCards(isFail = false, hasCategoryFailure = false) {
 		),
 	);

-	const client = createTestQueryClient();
-	render(
-		<QueryClientProvider client={client}>
+	return render(
+		<QueryClientProvider client={createTestQueryClient()}>
 			<MantineProvider env="test">
 				<MemoryRouter initialEntries={["/cards?month=2026-09"]}>
 					<CardsPage />
@@ -57,8 +56,6 @@ function renderCards(isFail = false, hasCategoryFailure = false) {
 			</MantineProvider>
 		</QueryClientProvider>,
 	);
-
-	return client;
 }

 describe("CardsPage", () => {
@@ -235,76 +232,4 @@ describe("CardsPage", () => {
 		});
 		expect(screen.queryByRole("alert")).not.toBeInTheDocument();
 	});
-
-	it("shows a cold cards error with retry", async () => {
-		renderCards(true);
-
-		expect(
-			await screen.findByRole("alert", {}, { timeout: 5000 }),
-		).toHaveTextContent("Не удалось загрузить данные карт.");
-		expect(
-			screen.getByRole("button", { name: "Повторить" }),
-		).toBeInTheDocument();
-
-		server.use(
-			http.get("*/api/v1/bank-cards", () =>
-				HttpResponse.json([
-					{
-						archivedAt: null,
-						balance: money("10000"),
-						bankName: null,
-						id: "a",
-						lastFour: null,
-						name: "Повседневная",
-						openingBalance: money("10000"),
-						openingDate: "2026-01-01",
-						version: 1,
-					},
-				]),
-			),
-		);
-		fireEvent.click(screen.getByRole("button", { name: "Повторить" }));
-
-		await waitFor(() =>
-			expect(screen.queryByRole("alert")).not.toBeInTheDocument(),
-		);
-		expect(
-			screen.getByRole("link", { name: /Повседневная/ }),
-		).toBeInTheDocument();
-	});
-
-	it("shows a cached cards error while keeping the grid", async () => {
-		const view = renderCards();
-
-		await screen.findByRole("heading", { name: "Добавьте первую карту" });
-		server.use(
-			http.get("*/api/v1/bank-cards", () =>
-				HttpResponse.json([
-					{
-						archivedAt: null,
-						balance: money("10000"),
-						bankName: null,
-						id: "a",
-						lastFour: null,
-						name: "Повседневная",
-						openingBalance: money("10000"),
-						openingDate: "2026-01-01",
-						version: 1,
-					},
-				]),
-			),
-		);
-		await view.invalidateQueries();
-		await screen.findByRole("link", { name: /Повседневная/ });
-
-		server.use(http.get("*/api/v1/bank-cards", () => HttpResponse.error()));
-		await view.invalidateQueries();
-
-		expect(
-			await screen.findByRole("alert", {}, { timeout: 5000 }),
-		).toHaveTextContent("Не удалось обновить данные. Показаны последние полученные.");
-		expect(
-			screen.getByRole("link", { name: /Повседневная/ }),
-		).toBeInTheDocument();
-	});
 });
@@ -18,7 +18,6 @@ import { Link } from "react-router";

 import {
 	BankCardFace,
-	BankFeedback,
 	BankPeriodPicker,
 	BankSummaryView,
 } from "@/entities/bank-card";
@@ -52,17 +51,15 @@ const CardsPageViewCards: FC<CardsPageViewProps> = (props) => {
 			);
 		}

-		if (!vm.cards.error) {
-			const text = t(vm.archive ? "bank.emptyHint" : "bank.noActive");
+		const text = t(vm.archive ? "bank.emptyHint" : "bank.noActive");

-			return (
-				<StateView
-					action={<Button onClick={vm.onAddCard}>{t("bank.addCard")}</Button>}
-					text={text}
-					title={t("bank.empty")}
-				/>
-			);
-		}
+		return (
+			<StateView
+				action={<Button onClick={vm.onAddCard}>{t("bank.addCard")}</Button>}
+				text={text}
+				title={t("bank.empty")}
+			/>
+		);
 	}

 	if (vm.cards.isLoading) {
@@ -106,15 +103,6 @@ const CardsPageView: FC<CardsPageViewProps> = (props) => {
 				onChange={vm.onArchiveChange}
 			/>

-			{vm.cards.error && (
-				<BankFeedback
-					cached={Boolean(vm.cards.data)}
-					error={vm.cards.error}
-					loadingError={!vm.cards.data}
-					retry={vm.retryCards}
-				/>
-			)}
-
 			<CardsPageViewCards {...props} />

 			<Group align="flex-end" justify="space-between">
@@ -135,10 +123,9 @@ const CardsPageView: FC<CardsPageViewProps> = (props) => {
 			<BankSummaryView
 				all
 				data={vm.summary.data}
-				error={vm.summary.error}
+				error={vm.summary.isError}
 				fetching={vm.summary.isFetching}
 				loading={vm.summary.isLoading}
-				retry={vm.retrySummary}
 			/>
 		</Stack>
 	);
@@ -39,8 +39,6 @@ function useCardsPageVm() {
 			setArchive(event.currentTarget.checked),
 		onCategories: () => setManagingCategories(true),
 		period,
-		retryCards: () => cards.refetch(),
-		retrySummary: () => summary.refetch(),
 		setPeriod: (value: [null | string, null | string]) => {
 			if (value[0] && value[1]) setParameters({ from: value[0], to: value[1] });
 		},
@@ -1,6 +1,6 @@
 import { MantineProvider } from "@mantine/core";
 import { QueryClientProvider } from "@tanstack/react-query";
-import { act, fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
 import { http, HttpResponse } from "msw";
 import { MemoryRouter } from "react-router";
 import { afterEach, describe, expect, it, vi } from "vitest";
@@ -12,37 +12,19 @@ import { server } from "@/test/server";
 import { StocksPage } from "./StocksPage";
 import { useStocksPageVm } from "./StocksPage.vm";

-const pageOperations: Promise<void>[] = [];
-
 const StocksPageVmProbe = () => {
 	const vm = useStocksPageVm();

 	return (
 		<>
-			<button
-				onClick={() => {
-					pageOperations.push(vm.search());
-				}}
-			>
-				search
-			</button>
-			<button
-				onClick={() => {
-					pageOperations.push(vm.changePage(2));
-				}}
-			>
-				page
-			</button>
+			<button onClick={vm.onSearch}>search</button>
+			<button onClick={() => vm.onPage(2)}>page</button>
 			<output>{vm.items.map(item => item.name).join(", ")}</output>
 		</>
 	);
 };

-afterEach(() => {
-	pageOperations.length = 0;
-
-	return vi.useRealTimers();
-});
+afterEach(() => vi.useRealTimers());

 describe("stock search", () => {
 	it("waits for a meaningful query and uses the server-verified ticker link", async () => {
@@ -248,12 +230,9 @@ describe("stock search", () => {
 		fireEvent.click(screen.getByRole("button", { name: "page" }));
 		fireEvent.click(screen.getByRole("button", { name: "search" }));
 		await screen.findByText("Новый");
-		await act(async () => {
-			oldPage.resolve();
-			await pageOperations[0];
-		});
+		oldPage.resolve();

-		expect(screen.getByText("Новый")).toBeVisible();
+		await waitFor(() => expect(screen.getByText("Новый")).toBeVisible());
 		expect(screen.queryByText("Старый результат")).not.toBeInTheDocument();
 	});

@@ -101,7 +101,6 @@ function useStocksPageVm() {
 	};

 	return {
-		changePage,
 		criteria,
 		error,
 		items: page?.items ?? [],
@@ -112,8 +111,6 @@ function useStocksPageVm() {
 		onSearch: () => void search(),
 		page: page?.page,
 		resultTime: page?.asOf,
-		// Test seam: settle the actual operation instead of the handler release.
-		search,
 		searched: page !== null,
 		totalPages: page ? page.page + Number(page.hasNext) : 0,
 	};
@@ -281,33 +281,6 @@ describe("apiClient transient read recovery", () => {
 		},
 	);

-	it("does not retry a read refused with INVALID_TBANK_TOKEN", async () => {
-		let requests = 0;
-		server.use(
-			http.get("*/api/v1/brokerage-accounts", () => {
-				requests += 1;
-
-				return HttpResponse.json(
-					{ code: "INVALID_TBANK_TOKEN", status: 400 },
-					{ status: 400 },
-				);
-			}),
-		);
-		configureAuthClient({
-			accessToken: () => "token",
-			clear: vi.fn(),
-			refresh: () => Promise.resolve(false),
-		});
-
-		const { error, response } = await apiClient.GET(
-			"/api/v1/brokerage-accounts",
-		);
-
-		expect(response.status).toBe(400);
-		expect(error).toMatchObject({ code: "INVALID_TBANK_TOKEN" });
-		expect(requests).toBe(1);
-	});
-
 	it("does not retry mutations", async () => {
 		let requests = 0;
 		server.use(
@@ -746,13 +746,10 @@ export interface components {
                detail: string;
            }[];
        };
-        RegisterDto: {
+        CredentialsDto: {
            /** @example user@example.com */
            email: string;
-            /**
-             * @description Raw password: 8-72 printable ASCII characters (letters, digits, symbols, space). Not trimmed or normalized.
-             * @example a secure password
-             */
+            /** @example a secure password */
            password: string;
        };
        UserDto: {
@@ -763,15 +760,6 @@ export interface components {
            accessToken: string;
            user: components["schemas"]["UserDto"];
        };
-        LoginDto: {
-            /** @example user@example.com */
-            email: string;
-            /**
-             * @description Raw password, at most 72 UTF-8 bytes. Not trimmed or normalized.
-             * @example a secure password
-             */
-            password: string;
-        };
        MoneyDto: {
            currency: string;
            value: string;
@@ -1720,7 +1708,7 @@ export interface operations {
        };
        requestBody: {
            content: {
-                "application/json": components["schemas"]["RegisterDto"];
+                "application/json": components["schemas"]["CredentialsDto"];
            };
        };
        responses: {
@@ -1788,7 +1776,7 @@ export interface operations {
        };
        requestBody: {
            content: {
-                "application/json": components["schemas"]["LoginDto"];
+                "application/json": components["schemas"]["CredentialsDto"];
            };
        };
        responses: {
@@ -164,16 +164,10 @@ describe("persistent resource query lifecycle", () => {
 		});

 		await waitFor(() => expect(isStarted).toBe(true));
-		// Capture the observation promise before releasing the old handler; the
-		// final assertion must follow its settlement, not the handler release.
-		let observation: Promise<unknown> = Promise.resolve();
-		await act(async () => {
-			observation = result.current.observe() ?? Promise.resolve();
-			await observation;
-		});
+		await act(() => result.current.observe());
 		await act(async () => {
 			release();
-			await observation;
+			await blocked;
 		});
 		expect(result.current.data).toEqual(snapshot);
 	});
@@ -10,7 +10,7 @@
          "content": {
            "application/json": {
              "schema": {
-                "$ref": "#/components/schemas/RegisterDto"
+                "$ref": "#/components/schemas/CredentialsDto"
              }
            }
          }
@@ -91,7 +91,7 @@
          "content": {
            "application/json": {
              "schema": {
-                "$ref": "#/components/schemas/LoginDto"
+                "$ref": "#/components/schemas/CredentialsDto"
              }
            }
          }
@@ -5236,7 +5236,7 @@
          "code"
        ]
      },
-      "RegisterDto": {
+      "CredentialsDto": {
        "type": "object",
        "properties": {
          "email": {
@@ -5245,8 +5245,8 @@
          },
          "password": {
            "type": "string",
-            "description": "Raw password: 8-72 printable ASCII characters (letters, digits, symbols, space). Not trimmed or normalized.",
-            "pattern": "^[\\x20-\\x7E]{8,72}$",
+            "minLength": 12,
+            "maxLength": 72,
            "example": "a secure password"
          }
        },
@@ -5285,24 +5285,6 @@
          "user"
        ]
      },
-      "LoginDto": {
-        "type": "object",
-        "properties": {
-          "email": {
-            "type": "string",
-            "example": "user@example.com"
-          },
-          "password": {
-            "type": "string",
-            "description": "Raw password, at most 72 UTF-8 bytes. Not trimmed or normalized.",
-            "example": "a secure password"
-          }
-        },
-        "required": [
-          "email",
-          "password"
-        ]
-      },
      "MoneyDto": {
        "type": "object",
        "properties": {
@@ -7478,8 +7460,7 @@
            "type": "integer",
            "minimum": 1
          }
-        },
-        "additionalProperties": false
+        }
      },
      "StockScreenerItemDto": {
        "type": "object",
@@ -7525,8 +7506,7 @@
          },
          "lot": {
            "type": "integer",
-            "nullable": true,
-            "minimum": 1
+            "nullable": true
          }
        },
        "required": [
@@ -55,9 +55,8 @@ const ru = {
 			requestError: "Не удалось выполнить запрос. Попробуйте ещё раз.",
 			validation: {
 				invalidEmail: "Некорректный email",
-				invalidPasswordLength: "Пароль: от 8 до 72 символов, только латинские буквы, цифры, спецсимволы и пробел",
+				invalidPasswordLength: "Пароль должен содержать от 12 до 72 байт",
 				passwordsDoNotMatch: "Пароли не совпадают",
-				passwordTooLong: "Пароль не должен превышать 72 байта",
 			},
 		},
 		bank: {
@@ -38,11 +38,11 @@ describe("calendar dates", () => {
 		expect(moscowDate(new Date("2026-12-31T21:00:00Z"))).toBe("2027-01-01");
 	});

-	it("defaults to 7 calendar dates starting with today", () => {
+	it("defaults to the last 7 days including today", () => {
 		const [from, to] = defaultPeriod();

 		expect(calendarDate.safeParse(from).success).toBe(true);
-		expect(from).toBe(moscowDate(new Date()));
+		expect(to).toBe(moscowDate(new Date()));
 		expect((Date.parse(to) - Date.parse(from)) / 86_400_000).toBe(6);
 		expect(from <= to).toBe(true);
 	});
@@ -9,7 +9,8 @@ function isValidPeriod(from: null | string, to: null | string) {
 	);
 }

-const DEFAULT_PERIOD_LAST_INDEX = 6;
+const DAY_MS = 86_400_000;
+const DEFAULT_PERIOD_DAYS = 6;

 const moscowFormatter = new Intl.DateTimeFormat("en-CA", {
 	day: "2-digit",
@@ -24,17 +25,12 @@ function compareDateDesc(a: null | string, b: null | string) {
 	return (b ?? "").localeCompare(a ?? "");
 }

-// 7 calendar dates starting with today (Moscow calendar arithmetic).
+// Last 7 days including today. An empty period always means this range.
 function defaultPeriod(): [string, string] {
-	const from = moscowDate(new Date());
+	const to = new Date();
+	const from = new Date(to.getTime() - DEFAULT_PERIOD_DAYS * DAY_MS);

-	const [year = 1970, month = 0, day = 1] = from.split("-").map(Number);
-	const noon = 12;
-	const lastDay = day + DEFAULT_PERIOD_LAST_INDEX;
-	const end = new Date(Date.UTC(year, month - 1, lastDay, noon));
-	const to = moscowDate(end);
-
-	return [from, to];
+	return [moscowDate(from), moscowDate(to)];
 }

 function moscowDate(value: Date): string {
Author	SHA1	Message	Date
ksv741	871f798c93	test: cover null resource envelopes for account pages (#70 ) (#71 ) Frontend verify / commits (pull_request) Successful in 42s Details Frontend verify / security (pull_request) Successful in 10s Details Frontend verify / verify (pull_request) Canceled after 5s Details	2026-10-13 22:41:25 +03:00
ksv741	b75ca72ea7	build: use native openapi-typescript --check (#60 ) Frontend verify / commits (pull_request) Successful in 44s Details Frontend verify / security (pull_request) Successful in 11s Details Frontend verify / verify (pull_request) Successful in 6m44s Details	2026-10-13 21:24:24 +03:00