@beyondwork/docx-react-component 1.0.0 → 1.0.1

package/docs/plans/waves/reviews/wave-8-live-proof.md

@@ -1,140 +0,0 @@
-# Wave 8 Live Proof
-
-## Status Note
-
-This note is now historical evidence only.
-
-The Wave 8 hardening changes landed after this public `early-access` capture. A fresh private-mode Railway redeploy and proof recapture are still required before the harness or validator promotions can be treated as current closure truth again.
-
-The checked-in [deploy-runbook-check.json](/home/coder/docx-react-component/.tmp/wave-8-railway-pilot/deploy-runbook-check.json) is therefore retained as a historical Wave 8 artifact, not an authoritative current-state manifest.
-
-## Scope
-
-- Proof owner: A6
-- Effective Railway project/environment: `Fabric` / `early-access`
-- Prompt delta:
-  - requested environment: `staging`
-  - actual environment: `early-access`
-  - requested harness service: `react-word-editor`
-  - actual harness service: `docx-react-component`
-
-## Artifact Bundle
-
-- [validator-status-before-restart.json](/home/coder/docx-react-component/.tmp/wave-8-railway-pilot/validator-status-before-restart.json)
-- [validator-status-after-restart.json](/home/coder/docx-react-component/.tmp/wave-8-railway-pilot/validator-status-after-restart.json)
-- [harness-status.json](/home/coder/docx-react-component/.tmp/wave-8-railway-pilot/harness-status.json)
-- [harness-health.json](/home/coder/docx-react-component/.tmp/wave-8-railway-pilot/harness-health.json)
-- [validation-smoke.json](/home/coder/docx-react-component/.tmp/wave-8-railway-pilot/validation-smoke.json)
-- [deploy-manifest.json](/home/coder/docx-react-component/.tmp/wave-8-railway-pilot/deploy-manifest.json)
-- [artifact-retention-check.json](/home/coder/docx-react-component/.tmp/wave-8-railway-pilot/artifact-retention-check.json)
-- [review-save-validate-upload.json](/home/coder/docx-react-component/.tmp/wave-8-railway-pilot/review-save-validate-upload.json)
-- [mounted-review-proof.json](/home/coder/docx-react-component/.tmp/wave-8-railway-pilot/mounted-review-proof.json)
-- [review-save-validate-export.docx](/home/coder/docx-react-component/.tmp/wave-8-railway-pilot/review-save-validate-export.docx)
-- [review-save-validate-validation.json](/home/coder/docx-react-component/.tmp/wave-8-railway-pilot/review-save-validate-validation.json)
-- [review-save-validate-proof-source.json](/home/coder/docx-react-component/.tmp/wave-8-railway-pilot/review-save-validate-proof-source.json)
-
-## Live Deploy Proof
-
-- Validator service: `openxml-validator`
-  - before redeploy artifact captured deployment `c42c4ce4-a8f6-4e07-8415-d6b1da1543e9`
-  - `railway restart` was not available for the current deployment (`Deployment is not restartable`), so the restart proof surface used `railway redeploy`
-  - after redeploy artifact captured deployment `d664455a-a39e-427b-afff-bfdfc52b93ea`
-  - Railway CLI status artifacts both report `FAILED`
-  - public health: `https://openxml-validator-early-access.up.railway.app/health`
-  - drift note:
-    - public `/health` stayed `status=ok`
-    - mounted and smoke validation traffic returned clean results on the live service after the redeploy
-    - the latest standalone validator smoke was recaptured at `2026-03-26T21:18:18.2927855+00:00`
-- Harness service: `docx-react-component`
-  - deployment `c32405ea-0818-45de-9576-0d3309870086`
-  - status: `SUCCESS`
-  - public health: `https://docx-react-component-early-access.up.railway.app/api/health`
-- Harness health result:
-  - service status: `ok`
-  - validator bridge configured to `http://openxml-validator.railway.internal:8080`
-  - storage path: `/data/react-word-editor-harness`
-  - retention mode: `volume-backed-manual-review`
-- Validator smoke:
-  - source file: `test/fixtures/docx/F01-basic-contract.docx`
-  - result: `isValid=true`, `packageFindingCount=0`, `sdkFindingCount=0`
-
-## Freshness Recheck
-
-- Rechecked the live Railway surface at `2026-03-26T21:18:24Z`
-- `railway service status -s openxml-validator -e early-access --json` still reported deployment `d664455a-a39e-427b-afff-bfdfc52b93ea` with CLI status `FAILED`
-- `railway service status -s docx-react-component -e early-access --json` still reported deployment `c32405ea-0818-45de-9576-0d3309870086` with CLI status `SUCCESS`
-- Public validator `/health`, harness `/api/health`, and a fresh harness-backed smoke validation at `2026-03-26T21:18:18.2927855+00:00` all stayed healthy
-- Because neither live deployment id changed, this bundle remained a coherent record of the public `early-access` surface at capture time. It is still historical evidence only and does not satisfy the later private-mode recapture requirement.
-
-## Review-Save-Validate Attempt
-
-- Source fixture uploaded to the live harness: `F11-redlines-basic.docx`
-- Upload/source id: `upload:d600a47c-0708-4053-b3ed-c5c4c8775c31`
-- Mounted session id: `6d4fefaa-327a-4aa0-918a-4b5287722f76`
-- Harness document id: `harness-doc-9a38b2b7-624`
-- Added comment id: `comment-20260326204812790-0`
-
-Mounted editor proof from [mounted-review-proof.json](/home/coder/docx-react-component/.tmp/wave-8-railway-pilot/mounted-review-proof.json):
-
-- `/editor/6d4fefaa-327a-4aa0-918a-4b5287722f76` loaded successfully on the live Railway harness.
-- The mounted control strip completed:
-  - `Add Harness Comment`
-  - `Accept All Changes`
-  - `Export`
-- The event log recorded:
-  - `Added comment comment-20260326204812790-0.`
-  - `Accepted all actionable tracked changes in the current session.`
-  - repeated `Editor ready ...` status entries from the mounted route while the live shell rerendered
-
-The persisted export from that same mounted session was then validated through the live harness
-`/api/validate` route for the exact stored export id.
-
-Durable export and validation from the same mounted session:
-
-  - persisted export id: `6d41f8b1-f704-4491-8b3b-95b06e0c329f`
-  - validation run id: `f3519888-fd28-479e-b797-5c0c9dcd2c89`
-  - exported artifact: [review-save-validate-export.docx](/home/coder/docx-react-component/.tmp/wave-8-railway-pilot/review-save-validate-export.docx)
-  - validation report: [review-save-validate-validation.json](/home/coder/docx-react-component/.tmp/wave-8-railway-pilot/review-save-validate-validation.json)
-
-This mounted proof was captured after validator redeploy `d664455a-a39e-427b-afff-bfdfc52b93ea`, so the export and validation artifacts match that public `early-access` redeploy rather than the earlier pre-redeploy pass. They do not establish that the current live validator posture matches the later repo-owned private-mode hardening.
-
-## Validation Result
-
-The mounted export passed the validator cleanly.
-
-- Package findings: `0`
-- SDK findings: `0`
-- Validation summary from [review-save-validate-validation.json](/home/coder/docx-react-component/.tmp/wave-8-railway-pilot/review-save-validate-validation.json):
-  - `isValid=true`
-  - `packageFindingCount=0`
-  - `sdkFindingCount=0`
-
-## Retention Check
-
-From [artifact-retention-check.json](/home/coder/docx-react-component/.tmp/wave-8-railway-pilot/artifact-retention-check.json):
-
-- uploads: `27`
-- sessions: `31`
-- exports: `6`
-- validation runs: `6`
-- upload bytes: `37044`
-- export bytes: `10614`
-- limits:
-  - export artifact limit: `100`
-  - validation run limit: `200`
-  - max upload bytes: `20971520`
-- current proof artifacts are within the declared limits.
-
-## Historical Outcome
-
-- `openxml-sdk-validator-service`
-  - the public early-access redeploy artifacts, health proof, and smoke validation proof remain recorded here as historical evidence
-  - the later Wave 8 security review now treats the still-public validator ingress and stale deploy contract as an active blocker against current `pilot-live` claims
-- `railway-test-harness`
-  - the public early-access upload, mounted review action, artifact persistence, and validator-bridge bundle remain recorded here as historical evidence
-  - this note is no longer sufficient to claim current `baseline-proved` or `pilot-live` status after the private-mode hardening changes
-
-## Follow-Up Needed
-
-- Carry the broader reviewer-task, scenario, performance, and deeper `src/ui` token-consolidation work into Wave 9.
-- Keep the public validator ingress plus stale-deploy mismatch explicit as a current blocker, while keeping the older Railway CLI status drift caveat in its historical context.

package/docs/plans/waves/reviews/wave-8-security.md

@@ -1,47 +0,0 @@
-# Wave 8 Security Review
-
-Generated on `2026-03-27` for Wave 8 / A7.
-Refreshed against the current source and live Railway early-access surface at `2026-03-27T07:39Z`.
-
-## Repo Status Update
-
-- Repo-only update on `2026-03-28`: [route.ts](/home/coder/docx-react-component/services/react-word-editor/app/api/exports/route.ts) now applies the same pre-parse `content-length` guard used by the upload and validation routes.
-- No fresh live Railway recheck was performed as part of that source-only fix, so the live-surface findings below still describe the `2026-03-27T07:39Z` capture.
-
-## Threat Model
-
-- Trust boundaries reviewed: anonymous internet traffic to the Railway early-access domains, browser-to-harness routes, harness-to-validator private-network calls, and volume-backed harness storage.
-- Attacker-controlled inputs reviewed: uploaded `.docx` payloads, validator multipart requests, public route access on the harness and validator domains, and any future operator proof capture that re-enables the harness surface.
-- Sensitive assets reviewed: operator-uploaded source packages, stored export and validation artifacts, private validator hostname assumptions, volume-backed retention posture, and the deploy state behind the Wave 8 promotion claims.
-- Approval-sensitive actions reviewed: Wave 8 closure itself, the `baseline-proved` and `pilot-live` promotion claims, and any decision to rely on public-domain operator access without repo-owned auth or explicit network restriction.
-- Browser-path conclusion: I rechecked the current source and still did not find a browser fetch path that calls `openxml-validator.railway.internal` directly. The browser-facing harness client in [harness-editor-session-client.tsx](/home/coder/docx-react-component/services/react-word-editor/components/harness-editor-session-client.tsx) fetches only harness-local routes such as `/api/exports`, `/api/validate`, and `/api/sessions/[sessionId]/source`, while the server-only validator bridge lives in [validator-client.ts](/home/coder/docx-react-component/services/react-word-editor/lib/validator-client.ts). Fresh live rechecks at `2026-03-27T07:39Z` still show the public harness root, `GET /api/health`, and `POST /api/uploads` failing closed with `503 private_mode_required`, so the old browser-visible private-host leak is not reproduced on the current harness deploy.
-
-## Risky Surfaces
-
-- The validator public domain `https://openxml-validator-early-access.up.railway.app` is still reachable from the public internet and still accepts live traffic at `2026-03-27T07:39Z`.
-- The current validator source in [Program.cs](/home/coder/docx-react-component/services/openxml-validator/Program.cs) and [README.md](/home/coder/docx-react-component/services/openxml-validator/README.md) requires `VALIDATOR_PRIVATE_MODE=enabled`, returns a structured `503` when disabled, and exposes `privateMode` plus `limits` metadata on `/health`. The live public `/health` response at `2026-03-27T07:39Z` still returned `200` with only `service`, `status`, `sdk`, and `endpoints`, so the deployed validator does not match the current repo-owned contract.
-- The harness public domain `https://docx-react-component-early-access.up.railway.app` is still reachable from the public internet, but the current live surface still fails closed with `503 private_mode_required` on `/`, `GET /api/health`, and `POST /api/uploads` at `2026-03-27T07:39Z`.
-- That harness fail-closed posture depends on deployment configuration rather than repo-owned identity. If `HARNESS_PRIVATE_MODE=enabled` is turned on for the public `docx-react-component-early-access` domain, the operator-facing routes in [middleware.ts](/home/coder/docx-react-component/services/react-word-editor/middleware.ts), [private-mode.ts](/home/coder/docx-react-component/services/react-word-editor/lib/private-mode.ts), [route.ts](/home/coder/docx-react-component/services/react-word-editor/app/api/uploads/route.ts), [route.ts](/home/coder/docx-react-component/services/react-word-editor/app/api/exports/route.ts), [route.ts](/home/coder/docx-react-component/services/react-word-editor/app/api/validate/route.ts), [route.ts](/home/coder/docx-react-component/services/react-word-editor/app/api/exports/[exportId]/route.ts), and [route.ts](/home/coder/docx-react-component/services/react-word-editor/app/api/sessions/[sessionId]/source/route.ts) reopen without a separate repo-owned auth layer.
-- The harness source enforces `.docx` extension/MIME checks and a `20 MiB` cap in [storage.ts](/home/coder/docx-react-component/services/react-word-editor/lib/storage.ts), and the upload, export, and validation routes now reject oversized requests by `content-length` before multipart parsing. That closes the earlier export-route defense-in-depth gap in source, but it does not change the live-surface blocker or the need to keep any future public operator access behind reviewed controls.
-- Count-based retention and manual operator review remain the only cleanup controls for uploads, sessions, exports, and validation snapshots in [storage.ts](/home/coder/docx-react-component/services/react-word-editor/lib/storage.ts) and [README.md](/home/coder/docx-react-component/services/react-word-editor/README.md). That retention posture is documented, but it is still an internal-only assumption rather than a hardened public-service posture.
-
-## Findings
-
-- `High` | Surface: live validator ingress at `https://openxml-validator-early-access.up.railway.app` versus [Program.cs](/home/coder/docx-react-component/services/openxml-validator/Program.cs), [README.md](/home/coder/docx-react-component/services/openxml-validator/README.md), and [wave-8-railway-staging.md](/home/coder/docx-react-component/docs/plans/operations/wave-8-railway-staging.md). Exploit/failure mode: anonymous internet users can still call `/health` and `POST /validate` directly, bypassing the documented harness-only/private-network trust boundary and bypassing the private-mode gate that the current source says should exist. Fresh live confirmation at `2026-03-27T07:39Z`: `GET /health` returned `200` with only `service`, `status`, `sdk`, and `endpoints`; `curl -F file=@test/fixtures/docx/F01-basic-contract.docx https://openxml-validator-early-access.up.railway.app/validate` returned `200` with `validatedAtUtc=2026-03-27T07:39:36.243453+00:00`, `isValid=true`, `packageFindingCount=0`, and `sdkFindingCount=0`; and the live `/health` payload still omitted the `privateMode` and `limits` fields present in the current source contract, which shows the deployed validator is stale relative to the repo-owned hardening. Owner expected to fix: `A3`.
-
-## Required Approvals
-
-- Security exception required if Wave 8 wants to keep either public early-access domain as the operator access path without additional auth or explicit network restriction. That includes any attempt to treat the current public validator ingress as acceptable, or any future attempt to set `HARNESS_PRIVATE_MODE=enabled` on `https://docx-react-component-early-access.up.railway.app` without a reviewed access-control layer. No such exception is recorded in the wave artifacts or coordination state reviewed on this pass.
-
-## Requested Fixes
-
-- `A3`: remove the public `openxml-validator` domain from the closure path or redeploy the current private-mode source so anonymous `GET /health` and `POST /validate` no longer succeed on `https://openxml-validator-early-access.up.railway.app`. The fixed deploy should match the current [Program.cs](/home/coder/docx-react-component/services/openxml-validator/Program.cs) contract, including the private-mode behavior, structured health fields, and the current `ServiceEndpointDescriptor` response shape.
-- `A3`: update [wave-8-railway-staging.md](/home/coder/docx-react-component/docs/plans/operations/wave-8-railway-staging.md) once the live validator posture changes so the runbook names the exact current service/domain state instead of leaving the public validator URL as an acceptable pilot surface.
-- `A6 + A8 + A9`: refresh the Wave 8 proof and status language so it reflects the narrowed blocker accurately: the harness public domain is currently fail-closed, but the validator public ingress is still live and stale relative to source, so `openxml-sdk-validator-service` cannot stand at `pilot-live` yet.
-- `A1 + A2 + A3`: keep the harness public domain fail-closed until there is a reviewed private operator access path. If the next proof recapture intends to re-enable `https://docx-react-component-early-access.up.railway.app`, route explicit auth or network-restriction work first or obtain the approval above. Preserve the now-landed early body-size guard on [route.ts](/home/coder/docx-react-component/services/react-word-editor/app/api/exports/route.ts) as part of that future public-surface review.
-
-## Final Disposition
-
-- Wave 8 security review remains blocked, but the blocker has narrowed. Fresh live checks at `2026-03-27T07:39Z` still show the public harness domain failing closed with `503 private_mode_required` on `/`, `GET /api/health`, and `POST /api/uploads`, so the earlier anonymous harness metadata and artifact exposure is no longer reproduced on the current live surface. The validator public domain is still directly callable and is still serving a response schema that does not match the current private-mode source contract. The export-route pre-parse body-size guard has now landed in source, so that earlier defense-in-depth gap should no longer be cited as an open repo issue. Wave 8 should not close or promote `openxml-sdk-validator-service` until the live validator ingress is removed, gated, or redeployed and the proof bundle is refreshed against the fixed posture. The remaining approval item is any attempt to rely on public-domain operator access without auth or explicit network restriction.
-
-[wave-security] state=blocked findings=1 approvals=1 detail=07:39Z live harness still fails closed; public validator ingress still serves /health and /validate on a stale deploy.

package/docs/plans/waves/reviews/wave-9-editor-embedding.md

@@ -1,39 +0,0 @@
-# Wave 9 A1 Review: Real Editor Embedding In The Harness
-
-## Scope
-
-Wave 9 A1 closes the gap between the harness session shell and a durable session lifecycle contract.
-The mounted `/editor/[sessionId]` route runs the real `WordReviewEditor` from `src/ui/WordReviewEditor.tsx`
-through the harness-owned session API, datastore-backed autosave, and durable export persistence.
-
-## Landed files
-
-- `services/react-word-editor/lib/editor-session.ts`
-- `services/react-word-editor/app/api/sessions/[sessionId]/route.ts`
-- `services/react-word-editor/app/editor/[sessionId]/page.tsx`
-
-## Implementation notes
-
-- `lib/editor-session.ts` is server-only and keeps session durability under the existing harness storage root.
-- The mounted client now resolves editor load through the session contract: saved snapshots hydrate first, and the
-  source package remains the fallback when no checkpoint exists.
-- Session saves write a persisted editor snapshot sidecar at
-  `<HARNESS_STORAGE_DIR>/editor-sessions/<sessionId>.json` using atomic rename semantics.
-- Session export persistence now flows through `/api/sessions/[sessionId]` for the mounted runtime, so the editor
-  toolbar export and the harness operator bridge both create the same durable export record used by validation and
-  certification.
-- The session page now states that harness buttons are pilot-only operator controls and that Word reopen evidence is
-  still external to the route.
-- The page-level contract copy avoids assuming paragraph-only content. It describes the session interface in terms
-  of source packages, persisted snapshots, and exported artifacts so later table/font work can extend the runtime
-  without reshaping the harness shell.
-
-## Proof
-
-- `.tmp/wave-9-pilot/editor-session-smoke.json`
-- `.tmp/wave-9-pilot/editor-load-events.json`
-
-## Follow-through
-
-- Keep the mounted client on the same `/api/sessions/[sessionId]` contract for future save/export work rather than
-  reintroducing a parallel harness-specific persistence path.

package/docs/plans/waves/reviews/wave-9-fixture-runner.md

@@ -1,56 +0,0 @@
-# Wave 9 Fixture Runner
-
-## Scope
-
-- Owner: A2
-- Components:
-  - `railway-test-harness`
-  - `compatibility-and-word-validation`
-- Owned routes:
-  - `POST /api/fixtures/[fixtureId]/run`
-  - `POST /api/scenarios/[scenarioId]/run`
-  - `POST /api/validate`
-
-## Run Story Contract
-
-Wave 9 adds a linked run-story layer under `.tmp/wave-9-pilot/` so one durable `runId` can connect:
-
-- the source that was launched
-- the created harness session
-- the persisted export artifact
-- the persisted validator snapshot
-- the reserved manual Word certification attachment slot
-
-The canonical machine-readable outputs are:
-
-- [fixture-runner-smoke.json](/home/coder/docx-react-component/.tmp/wave-9-pilot/fixture-runner-smoke.json)
-- [artifact-manifest.json](/home/coder/docx-react-component/.tmp/wave-9-pilot/artifact-manifest.json)
-- [run-linkage-check.json](/home/coder/docx-react-component/.tmp/wave-9-pilot/run-linkage-check.json)
-
-Each run also gets a per-run story file:
-
-- `.tmp/wave-9-pilot/runs/<runId>/story.json`
-
-That story reserves:
-
-- `.tmp/wave-9-pilot/runs/<runId>/manual-certification.json`
-
-for A4's manual certification capture so manual Word evidence can attach by `runId` without
-rewriting fixture or scenario source records.
-
-## Behavior
-
-- Fixture runs remain keyed to the frozen `fixture:<fixtureId>` registry.
-- Scenario runs remain keyed to the separate `scenario:<scenarioId>` registry and do not collapse
-  into the release-gate fixture corpus.
-- Validation stays server-side and continues to bridge through the harness route instead of
-  exposing the validator to the browser.
-- `POST /api/validate` accepts an optional `runId` and, when present, attaches the stored
-  validator result into the same run story instead of leaving an isolated validation snapshot.
-
-## Proof Notes
-
-- The Wave 9 proof bundle is integration-level and durable.
-- The smoke artifact exercises the route handlers with real harness storage writes and a mocked
-  validator response so the linkage contract is reproducible without claiming fresh live Railway
-  evidence from A2's slice.

package/docs/plans/waves/reviews/wave-9-live-proof.md

@@ -1,105 +0,0 @@
-# Wave 9 Live Proof
-
-## Scope
-
-- Harness surface: `https://docx-react-component-early-access.up.railway.app`
-- Railway project/environment: `Fabric` / `early-access`
-- Harness service: `docx-react-component`
-- Proof bundle: `.tmp/wave-9-pilot/`
-
-The operator command sequence in the wave used stale `react-word-editor` / `staging` names.
-The live Railway surface for this proof was the current `docx-react-component` service in
-`early-access`, consistent with `docs/plans/operations/wave-8-railway-staging.md`.
-
-## Live Status
-
-- `railway service status -s docx-react-component -e early-access --json` reported `SUCCESS`
-  for deployment `c32405ea-0818-45de-9576-0d3309870086`.
-- `/api/health` reported harness `status: ok`, validator `status: ok`, storage mode
-  `configured-volume-path`, and post-capture counts of `35` sessions, `10` exports, and
-  `10` validation runs.
-- The environment-wide Railway service list still showed `openxml-validator` as `FAILED/stopped`.
-  The proof bundle treats current harness health plus successful validation traffic as
-  authoritative and records the drift in `.tmp/wave-9-pilot/harness-status.json`.
-
-## Captured Run Chain
-
-Each run artifact records the durable chain:
-
-- exact source id
-- exact harness session id
-- exact persisted export id
-- exact persisted validation run id
-
-The four captured live runs are:
-
-| Source | Session | Export | Validation run | Validator result |
-| --- | --- | --- | --- | --- |
-| `F01` | `383cb0d2-735d-4e81-b34d-06d6e1f57719` | `875074c4-8437-4189-bd9e-fa493d0539c8` | `a8b65cde-1b90-4fc2-a71d-d854915888b9` | clean |
-| `F11` | `b8a6d1bc-3ea5-4d1b-921c-5c5d6c8611bb` | `18fc2891-187d-4374-bb23-3e3427f798b0` | `ae7fc5e3-38b9-44fd-98e1-351efa8467ba` | clean |
-| `S01` | `9860a071-da8a-491a-b26f-d2e0da966a05` | `63a4a8ad-f284-4d6d-b996-38988c12e6f5` | `8b87c8a5-4360-40b0-b111-26275b2bc4ca` | 10 SDK findings |
-| `S02` | `ba3b2665-d7af-4433-92ec-51cc33c1242f` | `3e39f4a8-8668-4629-ae6a-7866521ced25` | `e7f44f93-7c1c-4711-be53-794c58e5d8ef` | 48 SDK findings |
-
-`F01` and `F11` were validator-clean. `S01` and `S02` kept their scenario-specific validator
-findings visible instead of being flattened into a false pass.
-
-## Capture Method
-
-The live harness did not expose the planned Wave 9 convenience routes yet:
-
-- `/api/fixtures/[fixtureId]/run`
-- `/api/scenarios/[scenarioId]/run`
-- `/api/runs/latest/validator`
-
-To keep the bundle grounded in the currently deployed surface, this proof used the live harness
-paths that do exist today:
-
-1. POST the `/fixtures` server action for the exact source id to mint a live session.
-2. Read the session package from `/api/sessions/[sessionId]/source`.
-3. Persist that exact package to `/api/exports`.
-4. Persist validation through multipart `/api/validate` with `sessionId`, `sourceId`, and
-   `exportId`.
-5. Read the stored run from `/api/runs/[runId]`.
-
-This keeps the proof durable and fully linked, but it does not prove that the browser-only
-mounted-editor `Export` button was exercised in this shell session.
-
-## Linkage Proof
-
-- `.tmp/wave-9-pilot/latest-export-validator.json` points to the latest captured export/run pair
-  for `S02`.
-- `.tmp/wave-9-pilot/run-linkage-check.json` confirms:
-  - each run references the same `sourceId`, `sessionId`, and `exportId` as its paired live-run
-    artifact
-  - `latest-export-validator.json` matches the same top-level ids as its embedded run detail
-  - manual notes mention every captured `runId` and every captured `exportId`
-
-## Manual Certification State
-
-`.tmp/wave-9-pilot/manual-certification-notes.md` records the exact run/export ids for `F01`,
-`F11`, `S01`, and `S02`.
-
-Current manual review status:
-
-- `Word Desktop`: `Not Yet Reviewed`
-- `Word Web`: `Not Yet Reviewed`
-
-No manual Word reopen observations were captured from this shell session, so the proof bundle
-keeps those surfaces explicitly pending instead of implying a pass.
-
-## Verdict
-
-The Wave 9 proof bundle is durable and live for:
-
-- current Railway harness health
-- exact live session/export/run linkage
-- validator-clean proof for `F01` and `F11`
-- explicit preserved findings for `S01` and `S02`
-
-The bundle is still short of full `pilot-live` closure for this proof owner because:
-
-- manual Word Desktop/Web reopen was not executed here
-- the mounted-editor export control was not browser-automated from this shell
-
-Until those two surfaces are captured, this proof should be treated as a grounded live bundle with
-an explicit certification gap, not as final Word-verified closure.

package/docs/plans/waves/reviews/wave-9-usability-and-performance.md

@@ -1,152 +0,0 @@
-# Wave 9 Reviewer Workflow Usability And Performance Pilot
-
-## Scope
-
-- Owner: A5
-- Owned components:
-  - `react-editor-ui`
-  - `tracked-changes-and-review-actions`
-  - `railway-test-harness`
-- Live harness surface: `https://docx-react-component-early-access.up.railway.app`
-- Proof bundle: `.tmp/wave-9-pilot/`
-
-This pilot exercised the live staging reviewer loop on the mounted editor, not only the backing
-API chain. The bounded task set was:
-
-1. open a document
-2. interpret warnings and health signals
-3. switch markup display modes
-4. navigate comments and revisions
-5. accept or reject a change
-6. export
-7. inspect the stored export and validation artifacts
-
-The measured sources were:
-
-- `F01` plain-text baseline
-- `F10` comment-heavy threaded comments
-- `S02` redline-heavy real-world scenario
-
-The comparison sources were:
-
-- `F05` table-heavy agreement
-- `S01` table/preserve-only scenario
-- `/demo` prototype route for intended trust, table, and typography posture
-
-## Method
-
-- Browser automation ran against the live Railway harness and persisted proof under
-  `.tmp/wave-9-pilot/`.
-- Timing budgets were intentionally bounded:
-  - load: `5000 ms` plain text, `6000 ms` comment heavy, `12000 ms` redline heavy
-  - review navigation: `1000 ms`
-  - revision action: `1500 ms`
-  - export: `5000 ms` plain text, `8000 ms` comment heavy, `15000 ms` redline heavy
-- The canonical summary artifact is `.tmp/wave-9-pilot/performance-smoke.json`.
-- Task-level evidence lives in:
-  - `.tmp/wave-9-pilot/reviewer-task-matrix.md`
-  - `.tmp/wave-9-pilot/raw/plain-text-f01.json`
-  - `.tmp/wave-9-pilot/raw/comment-heavy-f10.json`
-  - `.tmp/wave-9-pilot/raw/redline-heavy-s02.json`
-  - `.tmp/wave-9-pilot/source-validation-f10.json`
-  - `.tmp/wave-9-pilot/source-validation-s02.json`
-
-## Verdict
-
-Wave 9 does not close `pilot-live` for the owned reviewer-facing components.
-
-Performance itself stayed within the bounded budgets on the successful flows:
-
-- `F01` loaded in `508 ms` and exported in `131 ms`
-- `S02` loaded in `3735 ms` and exported in `3877 ms`
-
-The blocking findings are not latency failures. They are reviewer-trust and workflow-correctness
-failures, which the pilot treats as release blockers at Sev-1 or Sev-2 severity.
-
-## Blocking Findings
-
-### 1. Markup mode switching is not trustworthy on the mounted editor
-
-- `F01` and `S02` both rendered the markup controls, but the canvas chip stayed `markup all`
-  after toggle attempts.
-- This blocks a core reviewer trust task even on the plain-text path, because the operator cannot
-  confirm that the requested markup view actually changed.
-- Severity: Sev-2 blocker against `react-editor-ui` and `tracked-changes-and-review-actions`.
-
-## 2. The comment-heavy live path fails on a validator-clean source package
-
-- `F10` source validation run `8e072df8-4561-4d03-a5b9-89587f70a306` was clean: zero package
-  findings and zero SDK findings.
-- The mounted session `42bfbe23-7ed2-4e6a-98ad-1102d384ec4f` then showed a fatal runtime error:
-  unresolved internal relationships under `/word/word/...`.
-- The live rails simultaneously reported `0 comments` and `0 revisions`, so the reviewer gets a
-  misleading empty-review state instead of a trustworthy compatibility diagnosis.
-- Severity: Sev-1 blocker against `railway-test-harness`, `react-editor-ui`, and the mounted
-  import path that underpins comment review.
-
-## 3. The redline-heavy live path does not provide trustworthy review actions
-
-- `S02` loaded into session `a1d18816-8e73-4e3c-a664-060829b3cee8` with `276` visible revisions,
-  so the review rails were populated.
-- Revision cards exposed accept/reject actions only; there was no direct anchor-jump or
-  open-in-canvas navigation control for targeted review.
-- A single-item accept attempt left the visible pending count unchanged at `276`, so the reviewer
-  could not trust that the action landed.
-- Severity: Sev-1 blocker against `tracked-changes-and-review-actions` and `react-editor-ui`.
-
-## 4. The mounted export path regressed validator findings on the redline-heavy scenario
-
-- `S02` source validation run `27b9cc6f-9367-4c45-a215-0122ee2541ad` reported `48` SDK findings.
-- Export from mounted session `a1d18816-8e73-4e3c-a664-060829b3cee8` produced export
-  `3269c5fb-9d49-47f2-ab14-84a8e731f312`.
-- Validation run `0d2be9ad-07d3-44fc-89d6-ec559247a9bb` on that export reported `74` SDK findings.
-- The reviewer surface did not surface a trust cue explaining that the mounted export worsened the
-  validator state by `26` findings.
-- Severity: Sev-1 blocker against `railway-test-harness` and the reviewer trust model around
-  tracked-change exports.
-
-## Prototype And Deferred-Expansion Delta
-
-The `/demo` prototype still communicates the intended reviewer posture more clearly than the live
-staging shell:
-
-- the prototype exposes a posture label, reduced-motion toggle, session switcher, and unified
-  `Comments`, `Changes`, and `Health` rail tabs
-- the live harness keeps comments and revisions in separate panels, carries more operator chrome,
-  and did not produce an equivalent unified health/trust surface during the pilot
-- the prototype renders prototype-only table previews, while the live harness renders table-heavy
-  content as `Locked preserve-only` atomic regions
-
-That difference matters for claim discipline:
-
-- table-heavy documents are harder to review on the live shell because the reviewer can only
-  inspect preserved table regions as whole units
-- the pilot should not claim prototype-style table review behavior for `F05` or `S01`
-- no `font_substitution` warning fired on the measured runs, but the live shell also does not
-  expose a font-intent or substitution trust cue, so the pilot should not claim the prototype's
-  curated-typography posture on font-sensitive documents
-
-## Owned Component Status
-
-- `react-editor-ui`: gap
-  - markup mode controls are inert on the mounted editor
-  - live reviewer health/trust cues trail the prototype posture materially
-- `tracked-changes-and-review-actions`: gap
-  - revision navigation is not targeted enough for reviewer workflow
-  - accept/reject did not show a trustworthy state transition in `S02`
-- `railway-test-harness`: gap
-  - `F10` fails in the mounted import loop despite a validator-clean source package
-  - `S02` mounted export regressed SDK findings without a reviewer-visible warning
-
-## Follow-Through
-
-Before these components can credibly move to `pilot-live`, the next closure pass needs to prove:
-
-- markup mode changes alter the mounted canvas state visibly and deterministically
-- comment-heavy mounted sessions do not collapse validator-clean sources into fatal `/word/word/*`
-  relationship errors
-- revision navigation and single-item accept/reject produce observable, trustworthy state changes
-- mounted export preserves or improves the source validator baseline for the redline-heavy scenario
-
-Until then, this pilot should be treated as authoritative live evidence of a reviewer-workflow
-gap, not as a pass.

package/docs/plans/waves/specs/README.md

@@ -1,5 +0,0 @@
-# Wave Specs
-
-This directory stores implementation-facing contract packets and handoff docs that sit between the shared plan and the source tree.
-
-Wave 1 freezes the initial contract set here. Later-wave or off-sequence extensions should live under [docs/plans/waves/deferred/README.md](/home/coder/docx-react-component/docs/plans/waves/deferred/README.md) when they are not part of the active numbered wave sequence.