fix(ui): refresh stale lists, theme native controls, validate IPC payloads

[chrystiamjr]

Fixes everything reported while testing 0.1.4 in the real app. The multi-schedule feature itself was confirmed working — two Quick/Daily tasks at 03:00 and 05:00 coexist.

Stale lists

A task deleted in taskschd.msc stayed on screen. Root cause: src/App.tsx dispatched the GET_* actions only on mount — no polling, no refetch on navigation, none after a mutation. The data is always read live from Windows (there is no sidecar index), but the UI never asked again.

• DataTable gains an optional refresh control, so all three management screens get it at once.
• Each screen re-queries its own data set on entry. Settings is deliberately excluded: it holds unsaved local edits a refetch would clobber.
• Refresh is a read, so it uses handleAction and does not take the action lock — but it is disabled while a mutation is in flight.

Two placement details that are load-bearing:

• The control sits above the scroll wrapper. Inside it, scrolling a narrow table sideways would carry the button out of view.
• It renders outside the empty-state branch. An empty list is precisely when the host needs re-querying — deleting the last task in Windows leaves nothing to hang a control off.

The refetch is deliberately not hooked to subscribeActionFinished: the host emits onActionFinished for every action including the GET_* reads themselves (MainWindow.xaml.cs finally block), which would loop forever.

Native controls painted light

The clock indicator on the time field rendered black and <select> popups opened white on dark fields. The app never declared color-scheme, and WebView2 is Chromium, so it painted every native control in its light default. Declared dark in index.css and in the document head so the first paint is already correct.

With that fixed the native time picker opens dark and legible, so it is kept rather than replaced.

Atomic Design gaps

Select and FormField are documented in AGENTS.md but did not exist. The label pattern was repeated 5× in SchedulingPage and selectClass was a loose const, so the appearance-none + inset chevron fix would have been copy-pasted across four controls. Extracted both.

The 31-option day-of-month <select> is replaced by a calendar grid — the one control where the native element is genuinely worse than a custom one. It is a radiogroup, which is not labelable, so it takes its accessible name from aria-label rather than <label for>.

Design token violations

Badge defaulted text to the hardcoded Portuguese 'Administrador Ativo' — dead code that bypassed i18n. Now required. Both Badge and Dot used the raw Tailwind palette (emerald/amber/rose/sky) and hardcoded hex glows instead of the design tokens, against the explicit rule in AGENTS.md. The glows are now boxShadow tokens. Expected visual change: the "Pronto" badge moves from emerald-400 to the project's success green, matching the Schedule button.

Found while testing

• React.StrictMode double-invokes effects in dev, so bootstrap GET_* counts are doubled locally. Absolute IPC call counts are therefore not assertable — the new tests compare before/after deltas.
• The i18n context recreated setLang on every render, so the bootstrap effect (which lists it as a dependency) re-ran and re-requested every data set whenever the language changed. Memoized. This was real in production, independent of StrictMode.
• Cypress run artifacts (cypress/screenshots/) were untracked and ungitignored. Added.

Verification

npm run validate    21 files, 132 tests green (from 108)
npx cypress run     78 e2e green (from 70)
npm run build       clean
dotnet build        clean

Both new guards were proven falsifiable: emptying SCREEN_REFRESH_ACTIONS[Scheduling] fails the navigation test, and hiding the refresh control fails 4 DataTable tests.

Manual check

Reproduce the original report: schedule two tasks, delete one in taskschd.msc, click Atualizar → the row disappears; leaving and re-entering the screen does it without a click. Then confirm the chevrons are inset, the clock icon is white, the time picker opens dark, and the monthly grid produces day: "15".

🤖 Generated with Claude Code

---

Also in this PR

IPC payload validation (was #28, merged into this branch)

Every inbound channel did an unchecked cast — JSON.parse returns any and TS types are erased at runtime, so the host could change a shape and the table would render blank with no diagnostic. Each shape is now a Zod schema in src/domain/schemas.ts, with the interfaces in types.ts inferred from it, and bridge.ts validates with safeParse and logs the failing fields. Collections fall back to []; settings keep app defaults.

React Hook Form was considered and declined: the only form has closed-set fields with nothing to validate. The full rationale is in learning record 0003.

All 13 schema fields were individually probed by relaxing each to z.any(). That surfaced four fields (Size, Description, Path, url) that only had "field missing" cases — which z.any() accepts, so the type was never asserted. Fixed.

Learned rules

Three artifacts capturing what this work taught, indexed in AGENTS.md (now 11 rules):

• os-backed-list-freshness.md — the stale-list report had an architectural cause, plus the two traps hit while fixing it: onActionFinished fires for the GET_* reads themselves so refetching there loops, and a refresh is a read that must not take the action lock.
• webview2-native-control-theming.md — records that the black clock icon and white select popup shared one cause, to prevent the wrong conclusion that was nearly drawn: replacing a native picker that only needed theming.
• falsifiable-test-guards.md (extended) — per-field probing, why a "field missing" case does not test that field's type, and why StrictMode makes absolute IPC call counts unassertable.

Combined verification

npm run validate    164 unit tests green (from 108)
npx cypress run     80 e2e green (from 70)
npm run build       clean
dotnet build        clean

[chrystiamjr]

🎉 This PR is included in version 0.1.5 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀