@dailephd/my-frontend-observer 0.10.0 → 0.10.1

package/docs/reports/v0.10-pre-release-readiness.md

@@ -1,120 +1,120 @@
-# v0.10 Pre-release Readiness
-
-## Provisional verdict
-
-RUN_A passed on the corrected validation candidate. This report is intentionally
-provisional: it is shipped by the package `files` allowlist, so committing it
-changes candidate bytes. A complete RUN_B against the report-containing HEAD is
-required before the final readiness verdict may be declared.
-
-## Repository and release state
-
-- Repository: `my-frontend-observer`
-- Validation branch: `validation/v0.10-pre-release`
-- Validation entry HEAD: `ce8bf7c7b0060b35cfb2fdd850c7a80ff0b340ad`
-- RUN_A HEAD: `b1c273d853dd9f00394b355522d06c344252e928`
-- Package: `@dailephd/my-frontend-observer@0.9.1`
-- Latest npm-published version: `0.9.1`
-- v0.10 release/tag/publication: not performed
-- Implementation-completeness reconciliation: `ce8bf7c7b0060b35cfb2fdd850c7a80ff0b340ad`
-
-## Local validation before RUN_A
-
-The canonical local chain passed on the corrected HEAD: `npm ci`, Chromium
-installation, typecheck, lint, unit tests (99 files / 1,524 tests), browser
-tests (32 files / 301 tests), security tests, isolated PWA hard gate, build,
-documentation check, `git diff --check`, and `npm pack --dry-run`.
-
-The local security result was PASS. The isolated PWA hard gate passed independently
-and also through the security command, preserving active-worker, controlled-page,
-shell-precache, zero-API-cache, server-down, offline-shell, unavailable-evidence,
-and stale-identity assertions.
-
-## RUN_A
-
-- Workflow: `Pre-release readiness`
-- Run ID: `35785226212`
-- URL: https://github.com/dailephd/my-frontend-observer/actions/runs/35785226212
-- Event: push
-- Branch: `validation/v0.10-pre-release`
-- Exact HEAD: `b1c273d853dd9f00394b355522d06c344252e928`
-- Conclusion: PASS
-
-All seven required jobs passed:
-
-| Job | Result |
-| --- | --- |
-| Package exact candidate (Linux, Node 24) | PASS |
-| ubuntu-latest exact-candidate smoke | PASS |
-| windows-latest exact-candidate smoke | PASS |
-| macos-latest exact-candidate smoke | PASS |
-| ubuntu-latest Observer tutorial readiness | PASS |
-| windows-latest Observer tutorial readiness | PASS |
-| macos-latest Observer tutorial readiness | PASS |
-
-## Exact candidate and matrix proof
-
-- Candidate filename: `dailephd-my-frontend-observer-0.9.1.tgz`
-- Candidate package version: `0.9.1`
-- Candidate SHA-256: `bda75f4f5ca441b3f58f9fe6ffa535f41904608a783961db8bcef4171f353ef5`
-- Independently downloaded/recomputed SHA-256: identical
-- Windows, Linux, and macOS each verified the candidate SHA and used the same tarball.
-- Each OS uploaded `smoke-summary.json`, `viewer-smoke-summary.json`,
-  `v09-annotation-smoke-summary.json`, and `v010-workflow-smoke-summary.json`.
-
-The four packed smokes passed on every OS: observation, Viewer/project workflow,
-v0.9 annotation, and v0.10 visual workflow. The v0.10 summaries prove installed
-package workflow creation/activation, two-attempt immutable correction history,
-non-PASS rejection and PASS acceptance, reference bindings, Viewer discovery,
-standalone read-only behavior, and absence of authoring token, note text, absolute
-project/temp paths, and orchestrator paths.
-
-The three tutorial-readiness jobs also passed, preserving the v0.9 tutorial
-regression on Windows, Linux, and macOS.
-
-## Security and package audit
-
-RUN_A exercised the existing formal security suite and PWA hard gate in the
-candidate job. The added v0.10 attack surface remains bounded by loopback,
-Host/Origin/token, JSON/body/compression, path-containment, immutable-parent,
-handoff-privacy, standalone-read-only, and orchestrator-non-authority controls.
-
-The candidate retained package version `0.9.1`, Viewer protocol `1.3.0`, all
-governed schema versions, and no dependency/schema/version changes. Package
-contents were audited locally for compiled v0.10 exports and Viewer assets, with
-tests, generated state, browser profiles, summaries, and nested tarballs excluded.
-
-## Failed-run history and correction
-
-Earlier same-HEAD runs are retained as historical diagnosis:
-
-1. Run `35780908327` exposed hosted browser flakes in an existing screenshot
-   comparison and materialization toast assertion; it was cancelled after the
-   candidate failed and its matrix was not promoted.
-2. A same-HEAD rerun reproduced the materialization toast synchronization issue.
-   The test was corrected to rely on the already asserted HTTP 201 response and
-   exact canonical artifact reselection.
-3. Run `35783718376` then exposed a separate Chromium adapter flake and a
-   macOS-only packed activation failure.
-4. The packed smoke was corrected to canonicalize its disposable temp root before
-   deriving relative artifact paths. Local validation passed, and RUN_A above
-   passed all seven jobs on the corrected candidate.
-
-No product semantics, governed schema, dependency, package version, or readiness
-workflow architecture changed.
-
-## RUN_B requirement
-
-This tracked report changes the npm candidate bytes because `docs/` is included
-in the package. Commit it with:
-
-`docs: record v0.10 pre-release readiness`
-
-Push the resulting `REPORT_HEAD` to this validation branch and require a new
-complete `Pre-release readiness` run whose exact HEAD equals `REPORT_HEAD`.
-RUN_B must independently pass the candidate job, all three exact-candidate smoke
-lanes, and all three tutorial-readiness lanes. Only then may the overall verdict
-become `PASS_V0_10_PRERELEASE_READY_FOR_RELEASE_PREP`.
-
-Release operations performed: none. Version bump, tag, publication, merge, and
-GitHub Release remain unauthorized and incomplete.
+# v0.10 Pre-release Readiness
+
+## Provisional verdict
+
+RUN_A passed on the corrected validation candidate. This report is intentionally
+provisional: it is shipped by the package `files` allowlist, so committing it
+changes candidate bytes. A complete RUN_B against the report-containing HEAD is
+required before the final readiness verdict may be declared.
+
+## Repository and release state
+
+- Repository: `my-frontend-observer`
+- Validation branch: `validation/v0.10-pre-release`
+- Validation entry HEAD: `ce8bf7c7b0060b35cfb2fdd850c7a80ff0b340ad`
+- RUN_A HEAD: `b1c273d853dd9f00394b355522d06c344252e928`
+- Package: `@dailephd/my-frontend-observer@0.9.1`
+- Latest npm-published version: `0.9.1`
+- v0.10 release/tag/publication: not performed
+- Implementation-completeness reconciliation: `ce8bf7c7b0060b35cfb2fdd850c7a80ff0b340ad`
+
+## Local validation before RUN_A
+
+The canonical local chain passed on the corrected HEAD: `npm ci`, Chromium
+installation, typecheck, lint, unit tests (99 files / 1,524 tests), browser
+tests (32 files / 301 tests), security tests, isolated PWA hard gate, build,
+documentation check, `git diff --check`, and `npm pack --dry-run`.
+
+The local security result was PASS. The isolated PWA hard gate passed independently
+and also through the security command, preserving active-worker, controlled-page,
+shell-precache, zero-API-cache, server-down, offline-shell, unavailable-evidence,
+and stale-identity assertions.
+
+## RUN_A
+
+- Workflow: `Pre-release readiness`
+- Run ID: `35785226212`
+- URL: https://github.com/dailephd/my-frontend-observer/actions/runs/35785226212
+- Event: push
+- Branch: `validation/v0.10-pre-release`
+- Exact HEAD: `b1c273d853dd9f00394b355522d06c344252e928`
+- Conclusion: PASS
+
+All seven required jobs passed:
+
+| Job | Result |
+| --- | --- |
+| Package exact candidate (Linux, Node 24) | PASS |
+| ubuntu-latest exact-candidate smoke | PASS |
+| windows-latest exact-candidate smoke | PASS |
+| macos-latest exact-candidate smoke | PASS |
+| ubuntu-latest Observer tutorial readiness | PASS |
+| windows-latest Observer tutorial readiness | PASS |
+| macos-latest Observer tutorial readiness | PASS |
+
+## Exact candidate and matrix proof
+
+- Candidate filename: `dailephd-my-frontend-observer-0.9.1.tgz`
+- Candidate package version: `0.9.1`
+- Candidate SHA-256: `bda75f4f5ca441b3f58f9fe6ffa535f41904608a783961db8bcef4171f353ef5`
+- Independently downloaded/recomputed SHA-256: identical
+- Windows, Linux, and macOS each verified the candidate SHA and used the same tarball.
+- Each OS uploaded `smoke-summary.json`, `viewer-smoke-summary.json`,
+  `v09-annotation-smoke-summary.json`, and `v010-workflow-smoke-summary.json`.
+
+The four packed smokes passed on every OS: observation, Viewer/project workflow,
+v0.9 annotation, and v0.10 visual workflow. The v0.10 summaries prove installed
+package workflow creation/activation, two-attempt immutable correction history,
+non-PASS rejection and PASS acceptance, reference bindings, Viewer discovery,
+standalone read-only behavior, and absence of authoring token, note text, absolute
+project/temp paths, and orchestrator paths.
+
+The three tutorial-readiness jobs also passed, preserving the v0.9 tutorial
+regression on Windows, Linux, and macOS.
+
+## Security and package audit
+
+RUN_A exercised the existing formal security suite and PWA hard gate in the
+candidate job. The added v0.10 attack surface remains bounded by loopback,
+Host/Origin/token, JSON/body/compression, path-containment, immutable-parent,
+handoff-privacy, standalone-read-only, and orchestrator-non-authority controls.
+
+The candidate retained package version `0.9.1`, Viewer protocol `1.3.0`, all
+governed schema versions, and no dependency/schema/version changes. Package
+contents were audited locally for compiled v0.10 exports and Viewer assets, with
+tests, generated state, browser profiles, summaries, and nested tarballs excluded.
+
+## Failed-run history and correction
+
+Earlier same-HEAD runs are retained as historical diagnosis:
+
+1. Run `35780908327` exposed hosted browser flakes in an existing screenshot
+   comparison and materialization toast assertion; it was cancelled after the
+   candidate failed and its matrix was not promoted.
+2. A same-HEAD rerun reproduced the materialization toast synchronization issue.
+   The test was corrected to rely on the already asserted HTTP 201 response and
+   exact canonical artifact reselection.
+3. Run `35783718376` then exposed a separate Chromium adapter flake and a
+   macOS-only packed activation failure.
+4. The packed smoke was corrected to canonicalize its disposable temp root before
+   deriving relative artifact paths. Local validation passed, and RUN_A above
+   passed all seven jobs on the corrected candidate.
+
+No product semantics, governed schema, dependency, package version, or readiness
+workflow architecture changed.
+
+## RUN_B requirement
+
+This tracked report changes the npm candidate bytes because `docs/` is included
+in the package. Commit it with:
+
+`docs: record v0.10 pre-release readiness`
+
+Push the resulting `REPORT_HEAD` to this validation branch and require a new
+complete `Pre-release readiness` run whose exact HEAD equals `REPORT_HEAD`.
+RUN_B must independently pass the candidate job, all three exact-candidate smoke
+lanes, and all three tutorial-readiness lanes. Only then may the overall verdict
+become `PASS_V0_10_PRERELEASE_READY_FOR_RELEASE_PREP`.
+
+Release operations performed: none. Version bump, tag, publication, merge, and
+GitHub Release remain unauthorized and incomplete.

package/docs/reports/v0.10-release-preparation.md

@@ -1,70 +1,70 @@
-# v0.10.0 Release Preparation
-
-## 1. Verdict and identity
-
-Verdict: `PASS_READY_TO_PUBLISH_AFTER_USER_APPROVAL`
-
-Repository: `dailephd/my-frontend-observer` (`C:\Users\daile\Projects\my-frontend-observer`)
-Workflow: `RELEASE_PREPARATION`
-Source validation branch: `validation/v0.10-pre-release`
-Starting RUN_B-validated SHA: `4ae5b9e0328364dd27e0761b8f243093bdcb3f45`
-Inherited RUN_B: `35789033295`, workflow `Pre-release readiness`, conclusion success. Its seven required jobs all succeeded. Readiness was inherited; RUN_B was not rerun.
-Release branch: `release/v0.10.0`, created directly from the exact validated SHA without merge or rebase.
-Package: `@dailephd/my-frontend-observer`
-Old package version: `0.9.1`
-Target package version: `0.10.0`
-
-## 2. Release-state preflight
-
-- npm current version before preparation: `0.9.1`.
-- npm `0.10.0`: absent (npm returned E404 for the exact version).
-- Local `v0.10.0` tag: absent.
-- Remote `origin` `v0.10.0` tag: absent.
-- GitHub Release `v0.10.0`: absent.
-- Local and remote `release/v0.10.0` branches: absent before creation.
-- GitHub identity: `dailephd/my-frontend-observer`, default branch `master`; `gh auth status` succeeded.
-- `package.json` identity: `@dailephd/my-frontend-observer`.
-
-## 3. Version and documentation state
-
-`package.json` version, `package-lock.json` version, and `package-lock.json` `packages[""]` version are all `0.10.0`. The version was changed with `npm version 0.10.0 --no-git-tag-version`; no version commit or tag was created by npm.
-
-The changelog keeps `## [Unreleased]` for future work and adds `## 0.10.0 - 2026-09-23` describing the shipped Visual Change workflow, actual/reference entry, artifact/handoff versions, explicit activation, bounded coding-agent handoff, immutable correction history, PASS-only acceptance, separate governance, installed-package/Viewer support, and security boundaries.
-
-README identifies v0.10.0 as current and accurately describes the normal user-facing Visual Change workflow. `docs/CURRENT_STATE.md` records the current release, complete shipped workflow, formal Windows/Linux/macOS readiness, package version, independently versioned schemas, and Viewer protocol. `docs/ROADMAP.md` changes only the high-level v0.10 release status and preserves future-version planning. `docs/PROJECT_OVERVIEW.md`, `docs/RELEASE.md`, `docs/CI_CD.md`, `docs/SECURITY.md`, and `docs/QUICKSTART.md` state the final v0.10 release and readiness facts while retaining relevant security limitations. Commands, workflows, contracts, and architecture semantics were not changed.
-
-`docs/reports/v0.10-pre-release-readiness.md` was preserved unchanged. The existing `scripts/check-docs.mjs` was narrowly updated to enforce final release consistency: a dated 0.10.0 changelog entry plus an Unreleased section, current package/release/readiness/protocol facts, roadmap release status, and canonical contract markers. It was not disabled and no second checker was added. `npm run check:docs` passed after the change.
-
-## 4. Source, dependencies, schemas, and package
-
-Production source audit: `git diff -- src viewer/src` is empty; no executable product changes were made. Dependency audit: `dependencies` and `devDependencies` are identical to the starting commit (`DEPENDENCY_CHANGED = false`).
-
-Schema/protocol inventory is unchanged: observation `1.2.0`; comparison `1.0.0`; frontend contract `1.0.0`; evaluation `1.0.0`; bounded-agent-context `1.0.0`; external-reference `1.0.0`; visual annotation `1.0.0`; visual-change-workflow `1.0.0`; handoff `1.0.0`; Viewer protocol `1.3.0`.
-
-Package hygiene: `.gitignore` excludes `node_modules/`, `dist/`, and the `.my-dev-kit-*` generated workflow/context roots. No `.npmignore` is present. `package.json#files` allowlists `dist`, README, CHANGELOG, docs, and LICENSE. `npm pack --dry-run` reports package `@dailephd/my-frontend-observer@0.10.0`, 437 files in the final dry run (436 before adding this report), and includes compiled visual-change workflow owners, Viewer/PWA assets, README, changelog, and release docs. The JSON dry-run content audit found no tests, private workflow/context roots, caches, browser profiles, smoke summaries, nested tarballs, or `node_modules`. No tarball was created by the dry run.
-
-## 5. Local validation
-
-All requested commands passed after release-preparation edits:
-
-- `npm run typecheck`: PASS.
-- `npm run lint`: PASS.
-- `npm test`: PASS, 99 files and 1,524 tests.
-- `npm run test:browser`: PASS, 32 files and 301 tests.
-- `npm run test:security`: PASS, including 16 security unit files (168 tests), 3 browser files (77 tests), and the PWA hard gate.
-- `npm run test:pwa-hard-gate`: PASS, one hard-gate test; six unrelated tests filtered by the task's script.
-- `npm run build`: PASS.
-- `npm run check:docs`: PASS (17 required documentation files).
-- `git diff --check`: PASS.
-- `npm pack --dry-run`: PASS, package identity/version and content audit as above.
-- `node dist/cli.js --version`: `0.10.0`.
-- `node dist/cli.js --help`: PASS; expected command surface displayed.
-
-## 6. Git, publication boundary, and handoff
-
-Release-preparation commit message: `chore: prepare v0.10.0 release`.
-Push target: `origin release/v0.10.0`. The commit is pushed and the post-push check confirms the remote branch matches the local release-preparation commit. The tracked worktree is clean after push. The final commit SHA and branch tip are recorded in the handoff summary.
-
-No product-semantic changes, dependency changes, tag, GitHub Release, npm publication, dist-tag change, PR, or merge were made. The historical pre-release readiness report was not edited. Generated build output remains ignored; no local/private generated files are staged or packaged.
-
-Exact next action: await explicit user approval. After approval, run the standardized GitHub release + final npm publication workflow from `release/v0.10.0`. The publication workflow must create/validate the release PR, merge it, validate master, create/push `v0.10.0`, create/verify the GitHub Release, verify release-channel parity, and run `npm publish --access public` as the final state-changing command.
+# v0.10.0 Release Preparation
+
+## 1. Verdict and identity
+
+Verdict: `PASS_READY_TO_PUBLISH_AFTER_USER_APPROVAL`
+
+Repository: `dailephd/my-frontend-observer` (`C:\Users\daile\Projects\my-frontend-observer`)
+Workflow: `RELEASE_PREPARATION`
+Source validation branch: `validation/v0.10-pre-release`
+Starting RUN_B-validated SHA: `4ae5b9e0328364dd27e0761b8f243093bdcb3f45`
+Inherited RUN_B: `35789033295`, workflow `Pre-release readiness`, conclusion success. Its seven required jobs all succeeded. Readiness was inherited; RUN_B was not rerun.
+Release branch: `release/v0.10.0`, created directly from the exact validated SHA without merge or rebase.
+Package: `@dailephd/my-frontend-observer`
+Old package version: `0.9.1`
+Target package version: `0.10.0`
+
+## 2. Release-state preflight
+
+- npm current version before preparation: `0.9.1`.
+- npm `0.10.0`: absent (npm returned E404 for the exact version).
+- Local `v0.10.0` tag: absent.
+- Remote `origin` `v0.10.0` tag: absent.
+- GitHub Release `v0.10.0`: absent.
+- Local and remote `release/v0.10.0` branches: absent before creation.
+- GitHub identity: `dailephd/my-frontend-observer`, default branch `master`; `gh auth status` succeeded.
+- `package.json` identity: `@dailephd/my-frontend-observer`.
+
+## 3. Version and documentation state
+
+`package.json` version, `package-lock.json` version, and `package-lock.json` `packages[""]` version are all `0.10.0`. The version was changed with `npm version 0.10.0 --no-git-tag-version`; no version commit or tag was created by npm.
+
+The changelog keeps `## [Unreleased]` for future work and adds `## 0.10.0 - 2026-09-23` describing the shipped Visual Change workflow, actual/reference entry, artifact/handoff versions, explicit activation, bounded coding-agent handoff, immutable correction history, PASS-only acceptance, separate governance, installed-package/Viewer support, and security boundaries.
+
+README identifies v0.10.0 as current and accurately describes the normal user-facing Visual Change workflow. `docs/CURRENT_STATE.md` records the current release, complete shipped workflow, formal Windows/Linux/macOS readiness, package version, independently versioned schemas, and Viewer protocol. `docs/ROADMAP.md` changes only the high-level v0.10 release status and preserves future-version planning. `docs/PROJECT_OVERVIEW.md`, `docs/RELEASE.md`, `docs/CI_CD.md`, `docs/SECURITY.md`, and `docs/QUICKSTART.md` state the final v0.10 release and readiness facts while retaining relevant security limitations. Commands, workflows, contracts, and architecture semantics were not changed.
+
+`docs/reports/v0.10-pre-release-readiness.md` was preserved unchanged. The existing `scripts/check-docs.mjs` was narrowly updated to enforce final release consistency: a dated 0.10.0 changelog entry plus an Unreleased section, current package/release/readiness/protocol facts, roadmap release status, and canonical contract markers. It was not disabled and no second checker was added. `npm run check:docs` passed after the change.
+
+## 4. Source, dependencies, schemas, and package
+
+Production source audit: `git diff -- src viewer/src` is empty; no executable product changes were made. Dependency audit: `dependencies` and `devDependencies` are identical to the starting commit (`DEPENDENCY_CHANGED = false`).
+
+Schema/protocol inventory is unchanged: observation `1.2.0`; comparison `1.0.0`; frontend contract `1.0.0`; evaluation `1.0.0`; bounded-agent-context `1.0.0`; external-reference `1.0.0`; visual annotation `1.0.0`; visual-change-workflow `1.0.0`; handoff `1.0.0`; Viewer protocol `1.3.0`.
+
+Package hygiene: `.gitignore` excludes `node_modules/`, `dist/`, and the `.my-dev-kit-*` generated workflow/context roots. No `.npmignore` is present. `package.json#files` allowlists `dist`, README, CHANGELOG, docs, and LICENSE. `npm pack --dry-run` reports package `@dailephd/my-frontend-observer@0.10.0`, 437 files in the final dry run (436 before adding this report), and includes compiled visual-change workflow owners, Viewer/PWA assets, README, changelog, and release docs. The JSON dry-run content audit found no tests, private workflow/context roots, caches, browser profiles, smoke summaries, nested tarballs, or `node_modules`. No tarball was created by the dry run.
+
+## 5. Local validation
+
+All requested commands passed after release-preparation edits:
+
+- `npm run typecheck`: PASS.
+- `npm run lint`: PASS.
+- `npm test`: PASS, 99 files and 1,524 tests.
+- `npm run test:browser`: PASS, 32 files and 301 tests.
+- `npm run test:security`: PASS, including 16 security unit files (168 tests), 3 browser files (77 tests), and the PWA hard gate.
+- `npm run test:pwa-hard-gate`: PASS, one hard-gate test; six unrelated tests filtered by the task's script.
+- `npm run build`: PASS.
+- `npm run check:docs`: PASS (17 required documentation files).
+- `git diff --check`: PASS.
+- `npm pack --dry-run`: PASS, package identity/version and content audit as above.
+- `node dist/cli.js --version`: `0.10.0`.
+- `node dist/cli.js --help`: PASS; expected command surface displayed.
+
+## 6. Git, publication boundary, and handoff
+
+Release-preparation commit message: `chore: prepare v0.10.0 release`.
+Push target: `origin release/v0.10.0`. The commit is pushed and the post-push check confirms the remote branch matches the local release-preparation commit. The tracked worktree is clean after push. The final commit SHA and branch tip are recorded in the handoff summary.
+
+No product-semantic changes, dependency changes, tag, GitHub Release, npm publication, dist-tag change, PR, or merge were made. The historical pre-release readiness report was not edited. Generated build output remains ignored; no local/private generated files are staged or packaged.
+
+Exact next action: await explicit user approval. After approval, run the standardized GitHub release + final npm publication workflow from `release/v0.10.0`. The publication workflow must create/validate the release PR, merge it, validate master, create/push `v0.10.0`, create/verify the GitHub Release, verify release-channel parity, and run `npm publish --access public` as the final state-changing command.

package/docs/reports/v0.10.1-project-check-baseline-context-implementation.md

@@ -0,0 +1,86 @@
+# v0.10.1 Project Check Baseline Context Replay — Implementation Report
+
+## Result
+
+At implementation completion, the bounded maintenance fix was recorded at
+`82dc7745b1935b827a57870ff9a942d166d4cca5` on
+`fix/v0.10.1-project-check-baseline-context`, while package version `0.10.0`
+remained unchanged. This report preserves that implementation-time snapshot;
+formal readiness passed later, and release-preparation state is tracked in
+`docs/RELEASE.md`.
+
+## Defect and correction
+
+Project-aware `check` validated an immutable baseline before capture, but the candidate capture used only the project configuration. When the baseline carried `requestConfig.scrollScenario` or `requestConfig.explicitState`, the candidate omitted those dimensions and could be classified as incomparable even when rendered evidence had no differences.
+
+After baseline validation, `checkProject` now derives an optional, narrow replay context from the validated baseline artifact and passes only `scrollScenario` and `explicitState` to candidate capture. Current project configuration still owns URL, viewport, semantic targets, and ordinary capture defaults. The canonical request normalization and browser observation path remain responsible for validation and actual scroll execution. Unrelated baseline request fields are not replayed.
+
+`scrollScenario` replay executes the same bounded browser scroll action. `explicitState` replay retains caller-declared identity metadata only; it does not establish theme, application, authentication, cookie, storage, or session state. No state inference or setup was added. Controlled state/session setup remains future v0.12 scope.
+
+## Changed owners and preserved boundaries
+
+The implementation extends `src/application/projectCheckService.ts` and the existing candidate capture path in `src/application/projectWorkflowService.ts`, with unit, workflow, and real-Chromium regression coverage. It does not alter the comparison rules or weaken comparability.
+
+At implementation completion, project config remained schema `1.1.0` and rejected top-level `scrollScenario` and `explicitState`. Normal `init` and `capture` remained project-config-driven. The machine-facing CLI remained `check <baseline> --json`; no flags were added. Observation schema remained `1.2.0`; comparison schema remained `1.0.0`; check-result schema remained `1.0.0`. Viewer protocol was unchanged. No dependency was added, and package version was `0.10.0`.
+
+## Verification evidence
+
+The implementation acceptance run recorded:
+
+- Typecheck, lint, build: PASS.
+- Unit tests: 1,527 passed.
+- Browser tests: 302 passed.
+- Security tests: 170 unit and 78 browser tests passed.
+- PWA hard gate: PASS.
+- Real-Chromium project-check reproducer: baseline and candidate retained both low-level dimensions; the bounded scroll action executed; check returned `PASS`, comparison was comparable with zero differences, configured contract passed, and blockers were empty.
+- Negative target-scroll case: missing/incompatible project target fails through the existing honest blocked/failure path.
+- Project-config boundary, immutable baseline, and current-history regressions: PASS.
+
+Downstream consumer validation used the unchanged `iworkhere.space` candidate `b0ee1bb251571ce2f83b08c55285a12ee68dc4c4` with this maintenance implementation. Five document routes at desktop `1440×900` and mobile `390×844` produced 10/10 passing Observer checks, comparable results, zero differences, and passing configured contracts. This proves the original missing-context blocker is removed for that consumer candidate; it is not a release claim for iworkhere.space v0.3.0.
+
+## Release lifecycle at implementation completion
+
+At this report's implementation-time snapshot, current published release and
+package version were `0.10.0`. Documentation reconciliation and the packed-
+readiness coverage correction were complete, while formal readiness, release
+preparation, version bump, publication, PR, and merge had not occurred. These
+are historical lifecycle facts; subsequent release state is recorded in
+`docs/CURRENT_STATE.md` and `docs/RELEASE.md`.
+
+## Pre-readiness packed-acceptance coverage correction
+
+PRE_READINESS_PACKED_ACCEPTANCE_GAP: FOUND. The existing packed project/viewer
+smoke exercised installed `check` but did not include a baseline carrying both
+`scrollScenario` and `explicitState`. Source/unit/browser validation and the
+downstream consumer smoke did not close that installed-tarball acceptance gap.
+
+Correction: `scripts/ci/runPackedViewerSmoke.mjs`, the existing installed
+project/viewer smoke owner, now creates a canonical low-level observation with
+both dimensions through the installed CLI, registers its generated identities
+in the existing schema-1.0.0 catalog, and checks it using installed
+`check <baseline> --json` with no added flags. The assertion requires real
+scroll evidence, matching candidate request context, a comparable zero-
+difference result, passing configured contract, no blockers, and immutable
+baseline/source/configuration. The smoke summary records bounded v0.10.1
+acceptance fields. The existing three-OS matrix already invokes this same
+smoke on the one frozen tarball, so readiness workflow architecture is
+unchanged.
+
+PRODUCT_SOURCE_CHANGED: NO
+READINESS_WORKFLOW_ARCHITECTURE_CHANGED: NO
+At the time of this packed-acceptance correction, formal v0.10.1 readiness had
+not yet run; local packed regression was validation evidence only.
+
+### Local exact-packed-candidate evidence
+
+One local `0.10.0` tarball was installed and exercised by the existing packed
+observation, Viewer/project, v0.9 annotation, and v0.10 workflow smokes. The
+updated `runPackedViewerSmoke.mjs` passed on Windows and wrote
+`viewer-smoke-summary.json`; its `projectCheckBaselineContextReplay` section
+records check exit 0/PASS, comparable/zero differences, contract PASS, zero
+blockers, both context matches, real baseline/candidate scroll to 240,
+immutable baseline/source/configuration, and current-only alias advancement.
+Exact local tarball identity and summaries are retained in project-local
+workflow evidence.
+
+Validation after this correction: typecheck PASS; lint PASS; 1,527 unit tests PASS; 302 browser tests PASS; security 170 unit + 78 browser tests PASS; the nested PWA hard-gate invocation PASS; build PASS; docs check PASS. No hosted workflow or formal readiness run was started.