feat(explorer): session display-format columns (#4722)

[natechadwick-intsof]

Summary

Slice 20 of #4530. Operators change columns on the current Explorer folder list without editing the shared display format. GET/PUT /Rhythmyx/services/explorer/list-columns stores the overlay in server memory for that user and folder (sys_title required). Unknown or duplicate sources and a bad path are HTTP 400. No request user is HTTP 403.

Parent: #4530. Fixes #4722.

Operator: Grok: night-issue-prs (model grok-4.6)

Test plan

• ExplorerListColumnsResourceTest (save/get, other user, 400, 403)
• Vitest listColumnsApi.test.ts
• Playwright tests/explorer-list-columns.spec.js on H2 (3 passed)
• Human QA: open Explorer, Columns, add Workflow, confirm the header stays for that folder until the server restarts

Product documentation

• Updated product-docs/8.2/admin/content-explorer.md (Columns control, 400/403, session scope)

Pre-PR Maven

• cd rest && bash ../mvnw clean install — BUILD SUCCESS. Tests run: 1547, Failures: 0
• cd projects/sitemanage && bash ../../mvnw clean install — BUILD SUCCESS. Tests run: 2966, Failures: 0, Skipped: 125
• cd WebUI && bash ../mvnw clean install — BUILD SUCCESS. Tests run: 69, Failures: 0
• downstream_checked: none (no public type made final/sealed; no signature change of an existing cross-module API). New JAX-RS bean is registered in sitemanage-beans.xml and locked by CatalogRestJaxrsRegistrationTest.

UI proof (H2)

• python3 docker/scripts/perc-devctl.py qa-up — TEST_CMS_URL=http://127.0.0.1:9993, container perc-matrix-cms-h2
• qa-health RESULT:OK HEALTH:healthy
• qa-deploy-war-jars --restart-jetty plus docker cp of sitemanage-beans.xml (CXF service bean) and qa-deploy-webui
• qa-health again RESULT:OK
• rtk npm run test:surface -- --path tests/explorer-list-columns.spec.js — 3 passed
• console-clean=yes (pageerror list empty)
• server.log-clean=yes (no ERROR/FATAL lines in the test window)
• qa-down removed perc-matrix-cms-h2

Pre-push local code review

Erlang review — PR #4743

Scope

• Persona: erlang 0.1.1
• Persona source: /home/nate/.local/share/mkd/agents/erlang
• Status: mkd-code-review 0.1.18, pack percussion, --gate advisory, --git-base origin/main
• PR: feat(explorer): session display-format columns (#4722) #4743
• Base: origin/main
• Head: f0c1997
• Files analyzed: 15
• In-diff bugs: 0 (preexisting rows do not block)
• Reviewer: independent Erlang pass. Recommendation: approve.

CLI stdout (mkd-code-review analyze --format markdown)

Summary

Machine analysis found 15 finding(s), 0 bug(s).

Scope

• Base: origin/main
• Head: HEAD
• Files: 15 analyzed
• In-diff: 0 finding(s); preexisting: 15
• Persona: erlang 0.1.1
• Persona source: /home/nate/.local/share/mkd/agents/erlang

Recommendation

approve

Gate

• Blocking bugs: 0
• May commit/push: yes

Issues

Issue 1 -- Severity: bug

• File: projects/sitemanage/src/main/resources/Rhythmyx/AppServer/server/rx/deploy/rxapp.ear/rxapp.war/WEB-INF/config/spring/projects/sitemanage-beans.xml:1440 (preexisting)
• Rule: secrets.heuristic
• Tool: secrets.heuristic
• Description: Possible secret or credential material (line 1440)
• Suggestion: Remove secrets from source; use env, vault, or mkd-secrets.
• Status: open

Issue 2 -- Severity: bug

• File: projects/sitemanage/src/test/java/com/percussion/rest/CatalogRestJaxrsRegistrationTest.java:135 (preexisting)
• Rule: paths.hardcoded_sep
• Tool: paths.hardcoded_sep
• Pattern-id: paths.hardcoded-sep
• Description: Possible non-portable path construction (line 135)
• Suggestion: Use Path/PathBuf, path.join, File.separator, or pathSeparator — not literal / or \ joins.
• Status: open

Issue 3 -- Severity: bug

• File: projects/sitemanage/src/test/java/com/percussion/rest/CatalogRestJaxrsRegistrationTest.java:159 (preexisting)
• Rule: paths.hardcoded_sep
• Tool: paths.hardcoded_sep
• Pattern-id: paths.hardcoded-sep
• Description: Possible non-portable path construction (line 159)
• Suggestion: Use Path/PathBuf, path.join, File.separator, or pathSeparator — not literal / or \ joins.
• Status: open

Issue 4 -- Severity: bug

• File: projects/sitemanage/src/test/java/com/percussion/rest/CatalogRestJaxrsRegistrationTest.java:160 (preexisting)
• Rule: paths.hardcoded_sep
• Tool: paths.hardcoded_sep
• Pattern-id: paths.hardcoded-sep
• Description: Possible non-portable path construction (line 160)
• Suggestion: Use Path/PathBuf, path.join, File.separator, or pathSeparator — not literal / or \ joins.
• Status: open

Issue 5 -- Severity: bug

• File: projects/sitemanage/src/test/java/com/percussion/rest/CatalogRestJaxrsRegistrationTest.java:161 (preexisting)
• Rule: paths.hardcoded_sep
• Tool: paths.hardcoded_sep
• Pattern-id: paths.hardcoded-sep
• Description: Possible non-portable path construction (line 161)
• Suggestion: Use Path/PathBuf, path.join, File.separator, or pathSeparator — not literal / or \ joins.
• Status: open

Issue 6 -- Severity: bug

• File: projects/sitemanage/src/test/java/com/percussion/rest/CatalogRestJaxrsRegistrationTest.java:163 (preexisting)
• Rule: paths.hardcoded_sep
• Tool: paths.hardcoded_sep
• Pattern-id: paths.hardcoded-sep
• Description: Possible non-portable path construction (line 163)
• Suggestion: Use Path/PathBuf, path.join, File.separator, or pathSeparator — not literal / or \ joins.
• Status: open

Issue 7 -- Severity: bug

• File: projects/sitemanage/src/test/java/com/percussion/rest/CatalogRestJaxrsRegistrationTest.java:164 (preexisting)
• Rule: paths.hardcoded_sep
• Tool: paths.hardcoded_sep
• Pattern-id: paths.hardcoded-sep
• Description: Possible non-portable path construction (line 164)
• Suggestion: Use Path/PathBuf, path.join, File.separator, or pathSeparator — not literal / or \ joins.
• Status: open

Issue 8 -- Severity: bug

• File: projects/sitemanage/src/test/java/com/percussion/rest/CatalogRestJaxrsRegistrationTest.java:165 (preexisting)
• Rule: paths.hardcoded_sep
• Tool: paths.hardcoded_sep
• Pattern-id: paths.hardcoded-sep
• Description: Possible non-portable path construction (line 165)
• Suggestion: Use Path/PathBuf, path.join, File.separator, or pathSeparator — not literal / or \ joins.
• Status: open

Issue 9 -- Severity: bug

• File: projects/sitemanage/src/test/java/com/percussion/rest/CatalogRestJaxrsRegistrationTest.java:166 (preexisting)
• Rule: paths.hardcoded_sep
• Tool: paths.hardcoded_sep
• Pattern-id: paths.hardcoded-sep
• Description: Possible non-portable path construction (line 166)
• Suggestion: Use Path/PathBuf, path.join, File.separator, or pathSeparator — not literal / or \ joins.
• Status: open

Issue 10 -- Severity: bug

• File: projects/sitemanage/src/test/java/com/percussion/rest/CatalogRestJaxrsRegistrationTest.java:167 (preexisting)
• Rule: paths.hardcoded_sep
• Tool: paths.hardcoded_sep
• Pattern-id: paths.hardcoded-sep
• Description: Possible non-portable path construction (line 167)
• Suggestion: Use Path/PathBuf, path.join, File.separator, or pathSeparator — not literal / or \ joins.
• Status: open

Issue 11 -- Severity: bug

• File: projects/sitemanage/src/test/java/com/percussion/rest/CatalogRestJaxrsRegistrationTest.java:169 (preexisting)
• Rule: paths.hardcoded_sep
• Tool: paths.hardcoded_sep
• Pattern-id: paths.hardcoded-sep
• Description: Possible non-portable path construction (line 169)
• Suggestion: Use Path/PathBuf, path.join, File.separator, or pathSeparator — not literal / or \ joins.
• Status: open

Issue 12 -- Severity: bug

• File: projects/sitemanage/src/test/java/com/percussion/rest/CatalogRestJaxrsRegistrationTest.java:171 (preexisting)
• Rule: paths.hardcoded_sep
• Tool: paths.hardcoded_sep
• Pattern-id: paths.hardcoded-sep
• Description: Possible non-portable path construction (line 171)
• Suggestion: Use Path/PathBuf, path.join, File.separator, or pathSeparator — not literal / or \ joins.
• Status: open

Issue 13 -- Severity: bug

• File: projects/sitemanage/src/test/java/com/percussion/rest/CatalogRestJaxrsRegistrationTest.java:173 (preexisting)
• Rule: paths.hardcoded_sep
• Tool: paths.hardcoded_sep
• Pattern-id: paths.hardcoded-sep
• Description: Possible non-portable path construction (line 173)
• Suggestion: Use Path/PathBuf, path.join, File.separator, or pathSeparator — not literal / or \ joins.
• Status: open

Issue 14 -- Severity: bug

• File: projects/sitemanage/src/test/java/com/percussion/rest/CatalogRestJaxrsRegistrationTest.java:175 (preexisting)
• Rule: paths.hardcoded_sep
• Tool: paths.hardcoded_sep
• Pattern-id: paths.hardcoded-sep
• Description: Possible non-portable path construction (line 175)
• Suggestion: Use Path/PathBuf, path.join, File.separator, or pathSeparator — not literal / or \ joins.
• Status: open

Issue 15 -- Severity: bug

• File: projects/sitemanage/src/test/java/com/percussion/rest/CatalogRestJaxrsRegistrationTest.java:177 (preexisting)
• Rule: paths.hardcoded_sep
• Tool: paths.hardcoded_sep
• Pattern-id: paths.hardcoded-sep
• Description: Possible non-portable path construction (line 177)
• Suggestion: Use Path/PathBuf, path.join, File.separator, or pathSeparator — not literal / or \ joins.
• Status: open

Co-Authored by Grok Build 1.0.40 using grok-4.6 with agent night-issue-prs-erlang.

[natechadwick-intsof]

LGTM. Erlang 0.1.1 / mkd-code-review 0.1.18 (pack percussion, gate advisory, base origin/main). In-diff findings: 0. Preexisting rows are outside the diff and do not block. Tests cover the new 400/403 (and 404 on #4744) paths. Same-login APPROVE is rejected by GitHub; this comment is the review.

Co-Authored by Grok Build 1.0.40 using grok-4.6 with agent night-issue-prs-erlang.