TODO

• logs/prod/prod.log in the suitecrm_data volume still holds the Redis password from the SessionHandler::read(): open(tcp://...) warnings written before the session handler override in files/session.yaml. Options: truncate the file once after the password was rotated, or let a log rotation drop it.

• The biber logout spec (files/playwright/saml.spec.js, “the in-app logout ends the session”) passes about three runs in five. A user created by the SAML login has no completed login wizard, so the shell’s route guard redirects every navigation to /users/Wizard, and inAppLogout triggers one such navigation per attempt. When the logout click lands inside one of them, the shell reads no logout system config and falls back to POST /logout, which the SAML firewall does not intercept: the controller throws “This will be intercepted by the logout key” (HTTP 500) and the session stays. The administrator hits the same guard on a fresh install: the first shell navigation of the design spec (“the shell takes frame, bars, rows, links and menus”) lands on the “Welcome to SuiteCRM!” wizard instead of the accounts list, so that test fails its first attempt and passes on the retry (fresh deploy of 2026-10-17). Options: complete the login wizard for the administrator and for users the SAML user factory creates, or let the spec finish the wizard before it logs out.

• The design spec “the shell takes frame, bars, rows, links and menus from the palette” fails on its first run after a fresh install or container start (the shell list or its rows are not visible yet) and passes on the retry.