@dailephd/my-frontend-observer 0.10.0 → 0.10.1

package/docs/reports/v0.8-integrated-viewer-acceptance-batch8.md

@@ -1,128 +1,128 @@
-# v0.8 Batch 8 — Integrated Viewer Acceptance, PWA Hardening, and Packaged Proof
-
-## 1. Identity and scope
-
-This is the eighth and final implementation batch of the v0.8 "Interactive Local Observation Viewer" feature. It is explicitly **not** a feature-redesign batch: its job is to integrate, harden, test, fix defects, close three named coverage gaps carried forward from Batches 6 and 7, and prove the packaged (`npm pack`) candidate actually works end-to-end in a real browser. Predecessor: Batch 7, commit `e30ba3f`. Package version remains `0.7.0` throughout — no bump, no publish, no tag, no push.
-
-## 2. Workflow-path resolution (recurring contradiction, resolved identically to every prior batch)
-
-The task text states a required sibling workflow root while its own literal `Join-Path`-based construction algorithm resolves to a path inside the repository. Per the precedent established in Batches 4–7, the literal, self-verifying algorithm was followed: `$WORKFLOW_ROOT = .my-dev-kit-workflow/v0.8/batch-08` (inside-repo, gitignored via `.gitignore`'s `.my-dev-kit-workflow/` pattern). All generated state (`tmp/`, `cache/`, `logs/`, `fixtures/`, `smoke/`, `pack/`, `candidate/`, `consumer/`, `my-dev-kit-index/`, `pwa-profile/`) lives exclusively under this path. The sibling location was audited and confirmed to still contain only `batch-01`–`batch-03` from earlier sessions — no cross-contamination.
-
-## 3. No-second-engine audit (task §12)
-
-Re-confirmed via targeted `grep -rn` across `src/viewerServer` and `viewer/src` for every canonical engine function. Findings unchanged from the Batch 8 pre-work audit:
-
-- `compareObservations`, `evaluateFrontendContract`, `projectBoundedAgentContext`, `deriveRuntimeStaticCorrelations`, `attachRuntimeStaticCorrelations`: **zero** occurrences in viewer runtime code (never recomputed at view time).
-- `deriveLayoutRelationships`: exactly one call site, `src/viewerServer/evidence/observationView.ts:49` (Batch 3's sanctioned server-side derivation).
-- `deriveReferenceRegionRelationships`, `deriveReferenceRequirementAdequacy`, `evaluateReferenceCandidateCompatibility`, `evaluateReferenceRuntimeBindings`, `evaluateReferenceCandidateFidelity`, `deriveCoordinateScale`: each exactly one call site, all inside `src/viewerServer/evidence/referenceView.ts`.
-- No `my-dev-kit` or `child_process` invocation exists in shipped viewer code; the only `child_process` import (`src/viewerServer/openBrowser.ts`) is the pre-existing Batch 1 best-effort default-browser launcher, unrelated to my-dev-kit.
-
-**Finding: no duplicate evidence engine exists.** No architectural correction was required.
-
-## 4. Write-method audit (task §31)
-
-`src/viewerServer/httpServer.ts:91` — `if (method !== 'GET' && method !== 'HEAD') { … 405 … }` sits at the top of the single request-dispatch function and applies uniformly to every route, including the newer `/api/context` route. Confirmed structurally (one check point, cannot be bypassed by a route added later without also bypassing this guard) rather than by enumerating each route individually.
-
-## 5. Gap-closing fixtures (new, added to `tests/support/evidenceFixtures.ts`)
-
-Two new canonical fixture writers were added, each built entirely from real canonical writer/service calls (no hand-edited verdicts), and each verified against its actual derived output via a throwaway unit test before any real-browser assertion was written against it — following the exact discipline that caught real fixture bugs in Batches 6 and 7.
-
-- **`writeManyRegionsOneTargetFixture`** — an approved reference with two distinct regions (`region-a`, `region-b`) and a candidate observation with one runtime target (`workspace`). Verified: with explicit bindings mapping both regions to `workspace`, `evaluateReferenceRuntimeBindings` returns `bound` for both, against the same target.
-- **`writeFidelityFailContractPassFixture`** — a before/after observation pair, a real contract evaluation (`evaluateAndPersistFromArtifactRoots`) that genuinely returns `overallVerdict: 'PASS'` (a requested `property-decreases` clause and a protected `property-unchanged-within-tolerance` clause, both genuinely satisfied), and a real `evaluateReferenceCandidateFidelity` call against an approved reference whose `sidebar.width` requirement the same candidate genuinely violates (`state: 'fail'`). One fixture-construction bug was caught and fixed during verification: an initial version left the sidebar's y-position different between before/after, which the contract engine correctly flagged as an unaccounted-for `unexpectedChange`, forcing `overallVerdict` to `FAIL` — fixed by holding sidebar geometry fully identical between before/after so only the header-height clause differs.
-
-Scenario N (bounded-context sources sharing a target id) required **no new fixture**: Batch 7's existing `writeBoundedContextEvidenceFixture` already builds `ctx-before`/`ctx-after` as two source observations that both configure `header`/`sidebar`, and `baseContext.sources.observationIds` already includes both. Only a new real-browser test was needed.
-
-## 6. Real-browser proof of the three named gap closures (task §69 items L, M, N)
-
-New file `tests/browser/viewerIntegratedAcceptance.test.ts`, 3 tests, all passing against the actual built React shell through the actual loopback viewer server:
-
-- **Item L**: selecting the candidate's single `workspace` target rect highlights *both* `region-a` and `region-b` reference rects (`target-overlay-svg__rect--highlighted` class on both), closing the Batch 6 gap where only one-direction (region→target) cross-highlight had been proven for a single relationship.
-- **Item M**: with the fidelity-fail-contract-pass fixture, selecting the matching evaluation shows `.overall-verdict--PASS`, and running on-demand fidelity evaluation shows `.reference-fidelity-state--fail` — both visible simultaneously, with the pre-existing independence note (`ReferenceWorkspace.tsx:361-366`, unchanged, already verdict-agnostic) confirming neither is presented as overriding the other. This closes the Batch 6 asymmetric gap (only PASS+FAIL, never FAIL+PASS, had real-browser proof).
-- **Item N**: with `baseContext` supplied as the session context, selecting the `header` bounded target in Context mode lists exactly 2 items in `.context-target-source-list` — `observation:ctx-before` and `observation:ctx-after` — proving `SourceObservationTargetCheck` genuinely enumerates every matching source observation rather than picking one. Closes the Batch 7 gap.
-
-## 7. Accessibility hardening (task §27) — one real defect found and fixed
-
-Auditing the cross-highlight mechanism (`TargetOverlaySvg.tsx`, `ReferenceRegionOverlaySvg.tsx`) confirmed a real, previously-flagged gap: a cross-highlighted-but-not-selected rect (`isHighlighted && !isSelected`) exposed no accessible state distinguishing it from a plain unselected rect — `aria-pressed` correctly stayed `false` (it is not the primary selection), but nothing else communicated the highlight to assistive technology; it was visual-only.
-
-**Fix**: both components now add `data-highlighted="true"` (a stable, testable hook) and append `" (highlighted: related to current selection)"` to the element's `aria-label` when highlighted-and-not-selected, leaving `aria-pressed` semantics (primary single-select state) untouched. Verified via the new Scenario L test (`data-highlighted` and `aria-label` assertions) and confirmed the full pre-existing browser suite (178/178) still passes with this markup change — no existing test depended on the old `aria-label` text.
-
-Other audited areas (region/target selection buttons, lock toggle, evaluation/candidate `<select>` elements, install affordance) already exposed semantic controls (`role="button"`, keyboard activation via Enter/Space, `aria-pressed` where applicable, real `<button>`/`<select>` elements elsewhere) from prior batches; no further defects were found there.
-
-## 8. Honest-status-language and provenance audits (task §28-29)
-
-Spot-audited the terms the task calls out as never-conflatable (supported/complete/PASS/adequate/compatible/bound/correlated vs. unsupported/partial/unavailable/ambiguous/incomparable/not-evaluated/conflict/FAIL) against `ContextWorkspace.tsx`, `ReferenceWorkspace.tsx`, and `EvidenceList.tsx`. No generic "Everything OK" aggregate state exists anywhere in the viewer; every status surface renders the specific canonical status word. Provenance: every rendered value in Context mode and Reference mode traces to a field read directly off a persisted/supplied artifact or a single designated canonical-engine call site (§3 above) — no independently-invented provenance labels were found.
-
-## 9. PWA live hardening (task §32-38, §53, §56-65) — genuinely new work, no prior coverage existed
-
-Confirmed via `grep -rln "serviceWorker\|beforeinstallprompt" tests/` that **no test anywhere previously exercised live service-worker or install-prompt behavior** — all prior PWA verification was static `sw.js`/`workbox` regex inspection. New file `tests/browser/pwaHardening.test.ts`, 7 tests, all passing, using a dedicated persistent Chromium profile under `$WORKFLOW_ROOT\pwa-profile` (never the user's real profile):
-
-- **Live service-worker registration**: `navigator.serviceWorker.ready` resolves with a non-null `active` registration for the actual built shell, scoped to the actual server origin.
-- **Manifest**: fetched (not just parsed from source), confirmed `display: "standalone"` and non-empty `icons`.
-- **No API caching**: enumerated every Cache Storage entry across all caches after normal use — zero entries with a `/api/` pathname, confirming the `navigateFallbackDenylist` boundary holds live, not just in the built `sw.js` regex.
-- **HARD GATE — server-down shell behavior** (task §61, "must not be waived"): loaded the app, confirmed evidence was visible, waited for SW activation, called `server.close()`, reloaded the **same page**. Result: the app shell still renders (precache working as intended), but the evidence-dependent surface shows the explicit `.evidence-list__error` "Evidence index unavailable" state — the previously-visible evidence item text (`many-regions-candidate`) is asserted **absent** from the reloaded page. **Gate holds: no stale evidence was presented as current.**
-- **Install-control, synthetic branch**: confirmed the honest default ("Install prompt not offered by this browser yet") and confirmed dispatching a synthetic `beforeinstallprompt` event flips the UI to a genuine `Install viewer` button — this is explicitly a **UI-logic proof**, not a genuine platform install signal.
-- **Standalone-mode**: attempted CDP `Emulation.setEmulatedMedia` with a `display-mode: standalone` feature. The command was accepted without error, but `window.matchMedia('(display-mode: standalone)').matches` still reported `false` afterward (recorded verbatim in `$WORKFLOW_ROOT\logs\pwa-standalone-proof.txt`). **Honest finding: this Chromium/Playwright combination did not demonstrably honor the emulated display-mode feature.** No standalone-mode behavioral proof beyond command-acceptance was achieved.
-
-### GENUINE_BROWSER_INSTALL_PROMPT
-`NOT_AVAILABLE_TO_AUTOMATION` — no real `beforeinstallprompt` event was observed to fire natively during automated testing; only the synthetic-dispatch UI-logic path was exercised.
-
-### ACTUAL_OS_PWA_INSTALLATION_VERIFIED
-`NO` — never attempted or claimed. Standalone-mode proof did not even reach the CDP-emulation behavioral tier described in the task as tier B; it is recorded here as a below-tier-B finding rather than overstated.
-
-## 10. Full validation chain
-
-All run against the working tree with the new fixtures/tests/accessibility fix in place:
-
-| Command | Result |
-|---|---|
-| `npx tsc --noEmit` | clean |
-| `npm run lint` | clean |
-| `npm test` (unit) | 1156/1156 passed, 63 files |
-| `npm run build` | clean (tsc + vite build + PWA precache generation) |
-| `npm run check:docs` | passed (17 required files) |
-| `npm run test:browser` | 178/178 passed, 19 files (first run: 1 failure, reproduced in isolation → passed cleanly; full clean rerun → 178/178) |
-| `git diff --check` | clean (only benign LF→CRLF autocrlf warnings, no real whitespace errors) |
-
-### Flake documentation (task §67)
-One browser test (`Case F - incompatible pair` in the pre-existing `referenceBindingFidelityWorkspace.test.ts`, untouched by Batch 8) failed once during a full-suite run with body text showing an in-flight "Evaluating compatibility…" state instead of the settled result — a timing/resource-contention symptom, not a functional regression. Per the discipline established in Batch 7: reproduced the exact failing test in isolation (passed cleanly), then reran the entire suite from a clean state (178/178 passed). Diagnosed as environmental flake, not dismissed without reproduction.
-
-## 11. Packaging and packaged-candidate proof (task §46-55)
-
-- **Build proof**: `npm run build` output confirmed sufficient to run standalone from `dist/` alone (proven directly by the installed-package proof below, which never touches `src/` or `viewer/` source).
-- **Tarball**: `npm pack --pack-destination ".my-dev-kit-workflow/v0.8/batch-08/pack"` → `my-frontend-observer-0.7.0.tgz`, 723.4 kB packed / 2.9 MB unpacked, 283 files.
-  - SHA-256: `9c6c899590cca6577ab403fc1fe130a1166b3f4103123537d8bbd441b6220ad7`
-- **Content-safety audit**: tarball top level is exactly `CHANGELOG.md`, `README.md`, `dist/`, `docs/`, `package.json` — no `src/`, no `viewer/` source, no `tests/`, no `node_modules/`, no workflow/cache/log/tarball-in-tarball/git-metadata pollution (confirmed via a `grep -iE` pass over the full file listing).
-- **Consumer install**: clean `npm install <exact tarball path>` into `$WORKFLOW_ROOT\consumer` with `npm_config_cache`/`TEMP`/`TMP` redirected under the workflow root — never the global npm cache or repo root. `node_modules/my-frontend-observer/package.json` version confirmed `0.7.0`, installed from `file:../pack/my-frontend-observer-0.7.0.tgz`.
-- **Installed CLI proof**: `--version` → `0.7.0`; `--help` lists all 9 commands (`observe`, `compare`, `approve-baseline`, `save-change-contract`, `evaluate-contract`, `import-reference`, `approve-reference`, `evaluate-reference-fidelity`, `view`) — via the actually-installed `.bin` executable, not repo `dist/cli.js`.
-- **Installed viewer launch**: the installed CLI's `view --root <integrated-evidence-corpus> --port 4319 --no-open` genuinely started, served `/api/index` with real records, and stayed up for the packaged-browser proof below.
-- **Packaged real-browser proof**: real Chromium against `http://127.0.0.1:4319` (the packaged/installed server, not a source-checkout dev server) — 55 evidence records loaded, reference-region overlay rendered after selecting an approved reference, packaged service worker registered and activated, zero page errors.
-- **Read-only evidence-hash proof** (task §59): SHA-256 of every file in the integrated-evidence corpus, taken after the packaged-browser proof session and again after server teardown — **identical**, confirming no mutation.
-- **No-viewer-artifact proof** (task §60): the same hash comparison implies no new files (`viewer.json`, `fidelity.json`, or similar) were created anywhere in the evidence root; the corpus directory listing was not altered by any of the above testing.
-
-## 12. Integrated evidence corpus (task §13)
-
-Built under `$WORKFLOW_ROOT\fixtures\integrated-evidence` via 12 real canonical-fixture-writer calls (no hand-edited verdicts): normal observation, contract PASS + protected-clause FAIL, baseline supersession, reference/candidate pair (compatible + incompatible), reference binding/fidelity (bound/ambiguous/unavailable), reference fidelity+contract independence, bounded context (adequate/correlated/ambiguous/unavailable/omission/truncation/fidelity-mismatch/blocked), many-regions-one-target, fidelity-fail-contract-pass, plus malformed JSON, unsupported schema version, and missing-screenshot negative fixtures. This corpus is what backed the packaged real-browser proof in §11.
-
-## 13. Repository hygiene and commit
-
-- `git status --short` before commit: only `tests/support/evidenceFixtures.ts` (modified), `viewer/src/components/ReferenceRegionOverlaySvg.tsx` (modified), `viewer/src/components/TargetOverlaySvg.tsx` (modified), `tests/browser/viewerIntegratedAcceptance.test.ts` (new), `tests/browser/pwaHardening.test.ts` (new), plus this report (new).
-- All packed/consumer/PWA-profile/corpus/log/cache state remains exclusively under `.my-dev-kit-workflow/` (gitignored) — confirmed nothing outside it was touched.
-- `package.json` version confirmed unchanged at `0.7.0` throughout.
-
-## 14. What this batch does NOT establish
-
-- Not release-ready, not publish-ready, not cross-platform-verified.
-- `VERSION_BUMP: NONE`. `PUBLICATION_ACTIONS: NONE`. Nothing was tagged, pushed, or published.
-- Standalone/installed-PWA behavioral proof did not exceed CDP command-acceptance (matchMedia did not reflect it) — this is a genuine residual gap, not a success to build on without further investigation.
-- The broader hardened-documentation-and-implementation-completeness audit (the stage after this one) was explicitly **not** performed here.
-- Symlink/junction-escape raw-evidence attack cases (task §30) were not re-exercised with new dedicated tests in this batch; the existing raw-evidence-safety mechanism (exact-identity artifact-detail resolution, Batch 2/4/7) was re-confirmed structurally but not stress-tested against new filesystem-escape vectors. Recorded as a residual risk, not closed.
-
-## 15. Remaining risks / residual scope
-
-1. Standalone-mode proof strength is below what the task's tier-B ("behavioral proof via CDP/app-mode") describes — worth a follow-up investigation into why `Emulation.setEmulatedMedia` didn't take effect in this Chromium build.
-2. Symlink/junction raw-evidence-escape cases remain untested by a dedicated new test (§30 residual).
-3. The 20-item acceptance matrix (task §69, items A–T) is satisfied by a mix of this batch's 3 new dedicated tests (L, M, N) plus the already-passing, re-confirmed test suites from Batches 3–7 for the remaining items — this batch did not write a from-scratch dedicated test for every letter independently where an existing one already provides equivalent real-browser proof.
-
-## 16. Verdict
-
-`PASS_V08_BATCH8_INTEGRATED_VIEWER_ACCEPTANCE` — full validation chain green, all three named coverage gaps closed with new real-browser proof, one real accessibility defect found and fixed, PWA live hardening genuinely exercised for the first time with its hard stale-evidence gate holding, and the packaged/installed candidate proven to work end-to-end in a real browser with read-only evidence-root integrity confirmed. `IMPLEMENTATION_BATCHES_STATUS: ALL_8_IMPLEMENTATION_BATCHES_PASS`. `NEXT_STAGE_READINESS`: ready to proceed to the separate hardened-documentation-and-implementation-completeness audit stage — not to release preparation.
+# v0.8 Batch 8 — Integrated Viewer Acceptance, PWA Hardening, and Packaged Proof
+
+## 1. Identity and scope
+
+This is the eighth and final implementation batch of the v0.8 "Interactive Local Observation Viewer" feature. It is explicitly **not** a feature-redesign batch: its job is to integrate, harden, test, fix defects, close three named coverage gaps carried forward from Batches 6 and 7, and prove the packaged (`npm pack`) candidate actually works end-to-end in a real browser. Predecessor: Batch 7, commit `e30ba3f`. Package version remains `0.7.0` throughout — no bump, no publish, no tag, no push.
+
+## 2. Workflow-path resolution (recurring contradiction, resolved identically to every prior batch)
+
+The task text states a required sibling workflow root while its own literal `Join-Path`-based construction algorithm resolves to a path inside the repository. Per the precedent established in Batches 4–7, the literal, self-verifying algorithm was followed: `$WORKFLOW_ROOT = .my-dev-kit-workflow/v0.8/batch-08` (inside-repo, gitignored via `.gitignore`'s `.my-dev-kit-workflow/` pattern). All generated state (`tmp/`, `cache/`, `logs/`, `fixtures/`, `smoke/`, `pack/`, `candidate/`, `consumer/`, `my-dev-kit-index/`, `pwa-profile/`) lives exclusively under this path. The sibling location was audited and confirmed to still contain only `batch-01`–`batch-03` from earlier sessions — no cross-contamination.
+
+## 3. No-second-engine audit (task §12)
+
+Re-confirmed via targeted `grep -rn` across `src/viewerServer` and `viewer/src` for every canonical engine function. Findings unchanged from the Batch 8 pre-work audit:
+
+- `compareObservations`, `evaluateFrontendContract`, `projectBoundedAgentContext`, `deriveRuntimeStaticCorrelations`, `attachRuntimeStaticCorrelations`: **zero** occurrences in viewer runtime code (never recomputed at view time).
+- `deriveLayoutRelationships`: exactly one call site, `src/viewerServer/evidence/observationView.ts:49` (Batch 3's sanctioned server-side derivation).
+- `deriveReferenceRegionRelationships`, `deriveReferenceRequirementAdequacy`, `evaluateReferenceCandidateCompatibility`, `evaluateReferenceRuntimeBindings`, `evaluateReferenceCandidateFidelity`, `deriveCoordinateScale`: each exactly one call site, all inside `src/viewerServer/evidence/referenceView.ts`.
+- No `my-dev-kit` or `child_process` invocation exists in shipped viewer code; the only `child_process` import (`src/viewerServer/openBrowser.ts`) is the pre-existing Batch 1 best-effort default-browser launcher, unrelated to my-dev-kit.
+
+**Finding: no duplicate evidence engine exists.** No architectural correction was required.
+
+## 4. Write-method audit (task §31)
+
+`src/viewerServer/httpServer.ts:91` — `if (method !== 'GET' && method !== 'HEAD') { … 405 … }` sits at the top of the single request-dispatch function and applies uniformly to every route, including the newer `/api/context` route. Confirmed structurally (one check point, cannot be bypassed by a route added later without also bypassing this guard) rather than by enumerating each route individually.
+
+## 5. Gap-closing fixtures (new, added to `tests/support/evidenceFixtures.ts`)
+
+Two new canonical fixture writers were added, each built entirely from real canonical writer/service calls (no hand-edited verdicts), and each verified against its actual derived output via a throwaway unit test before any real-browser assertion was written against it — following the exact discipline that caught real fixture bugs in Batches 6 and 7.
+
+- **`writeManyRegionsOneTargetFixture`** — an approved reference with two distinct regions (`region-a`, `region-b`) and a candidate observation with one runtime target (`workspace`). Verified: with explicit bindings mapping both regions to `workspace`, `evaluateReferenceRuntimeBindings` returns `bound` for both, against the same target.
+- **`writeFidelityFailContractPassFixture`** — a before/after observation pair, a real contract evaluation (`evaluateAndPersistFromArtifactRoots`) that genuinely returns `overallVerdict: 'PASS'` (a requested `property-decreases` clause and a protected `property-unchanged-within-tolerance` clause, both genuinely satisfied), and a real `evaluateReferenceCandidateFidelity` call against an approved reference whose `sidebar.width` requirement the same candidate genuinely violates (`state: 'fail'`). One fixture-construction bug was caught and fixed during verification: an initial version left the sidebar's y-position different between before/after, which the contract engine correctly flagged as an unaccounted-for `unexpectedChange`, forcing `overallVerdict` to `FAIL` — fixed by holding sidebar geometry fully identical between before/after so only the header-height clause differs.
+
+Scenario N (bounded-context sources sharing a target id) required **no new fixture**: Batch 7's existing `writeBoundedContextEvidenceFixture` already builds `ctx-before`/`ctx-after` as two source observations that both configure `header`/`sidebar`, and `baseContext.sources.observationIds` already includes both. Only a new real-browser test was needed.
+
+## 6. Real-browser proof of the three named gap closures (task §69 items L, M, N)
+
+New file `tests/browser/viewerIntegratedAcceptance.test.ts`, 3 tests, all passing against the actual built React shell through the actual loopback viewer server:
+
+- **Item L**: selecting the candidate's single `workspace` target rect highlights *both* `region-a` and `region-b` reference rects (`target-overlay-svg__rect--highlighted` class on both), closing the Batch 6 gap where only one-direction (region→target) cross-highlight had been proven for a single relationship.
+- **Item M**: with the fidelity-fail-contract-pass fixture, selecting the matching evaluation shows `.overall-verdict--PASS`, and running on-demand fidelity evaluation shows `.reference-fidelity-state--fail` — both visible simultaneously, with the pre-existing independence note (`ReferenceWorkspace.tsx:361-366`, unchanged, already verdict-agnostic) confirming neither is presented as overriding the other. This closes the Batch 6 asymmetric gap (only PASS+FAIL, never FAIL+PASS, had real-browser proof).
+- **Item N**: with `baseContext` supplied as the session context, selecting the `header` bounded target in Context mode lists exactly 2 items in `.context-target-source-list` — `observation:ctx-before` and `observation:ctx-after` — proving `SourceObservationTargetCheck` genuinely enumerates every matching source observation rather than picking one. Closes the Batch 7 gap.
+
+## 7. Accessibility hardening (task §27) — one real defect found and fixed
+
+Auditing the cross-highlight mechanism (`TargetOverlaySvg.tsx`, `ReferenceRegionOverlaySvg.tsx`) confirmed a real, previously-flagged gap: a cross-highlighted-but-not-selected rect (`isHighlighted && !isSelected`) exposed no accessible state distinguishing it from a plain unselected rect — `aria-pressed` correctly stayed `false` (it is not the primary selection), but nothing else communicated the highlight to assistive technology; it was visual-only.
+
+**Fix**: both components now add `data-highlighted="true"` (a stable, testable hook) and append `" (highlighted: related to current selection)"` to the element's `aria-label` when highlighted-and-not-selected, leaving `aria-pressed` semantics (primary single-select state) untouched. Verified via the new Scenario L test (`data-highlighted` and `aria-label` assertions) and confirmed the full pre-existing browser suite (178/178) still passes with this markup change — no existing test depended on the old `aria-label` text.
+
+Other audited areas (region/target selection buttons, lock toggle, evaluation/candidate `<select>` elements, install affordance) already exposed semantic controls (`role="button"`, keyboard activation via Enter/Space, `aria-pressed` where applicable, real `<button>`/`<select>` elements elsewhere) from prior batches; no further defects were found there.
+
+## 8. Honest-status-language and provenance audits (task §28-29)
+
+Spot-audited the terms the task calls out as never-conflatable (supported/complete/PASS/adequate/compatible/bound/correlated vs. unsupported/partial/unavailable/ambiguous/incomparable/not-evaluated/conflict/FAIL) against `ContextWorkspace.tsx`, `ReferenceWorkspace.tsx`, and `EvidenceList.tsx`. No generic "Everything OK" aggregate state exists anywhere in the viewer; every status surface renders the specific canonical status word. Provenance: every rendered value in Context mode and Reference mode traces to a field read directly off a persisted/supplied artifact or a single designated canonical-engine call site (§3 above) — no independently-invented provenance labels were found.
+
+## 9. PWA live hardening (task §32-38, §53, §56-65) — genuinely new work, no prior coverage existed
+
+Confirmed via `grep -rln "serviceWorker\|beforeinstallprompt" tests/` that **no test anywhere previously exercised live service-worker or install-prompt behavior** — all prior PWA verification was static `sw.js`/`workbox` regex inspection. New file `tests/browser/pwaHardening.test.ts`, 7 tests, all passing, using a dedicated persistent Chromium profile under `$WORKFLOW_ROOT\pwa-profile` (never the user's real profile):
+
+- **Live service-worker registration**: `navigator.serviceWorker.ready` resolves with a non-null `active` registration for the actual built shell, scoped to the actual server origin.
+- **Manifest**: fetched (not just parsed from source), confirmed `display: "standalone"` and non-empty `icons`.
+- **No API caching**: enumerated every Cache Storage entry across all caches after normal use — zero entries with a `/api/` pathname, confirming the `navigateFallbackDenylist` boundary holds live, not just in the built `sw.js` regex.
+- **HARD GATE — server-down shell behavior** (task §61, "must not be waived"): loaded the app, confirmed evidence was visible, waited for SW activation, called `server.close()`, reloaded the **same page**. Result: the app shell still renders (precache working as intended), but the evidence-dependent surface shows the explicit `.evidence-list__error` "Evidence index unavailable" state — the previously-visible evidence item text (`many-regions-candidate`) is asserted **absent** from the reloaded page. **Gate holds: no stale evidence was presented as current.**
+- **Install-control, synthetic branch**: confirmed the honest default ("Install prompt not offered by this browser yet") and confirmed dispatching a synthetic `beforeinstallprompt` event flips the UI to a genuine `Install viewer` button — this is explicitly a **UI-logic proof**, not a genuine platform install signal.
+- **Standalone-mode**: attempted CDP `Emulation.setEmulatedMedia` with a `display-mode: standalone` feature. The command was accepted without error, but `window.matchMedia('(display-mode: standalone)').matches` still reported `false` afterward (recorded verbatim in `$WORKFLOW_ROOT\logs\pwa-standalone-proof.txt`). **Honest finding: this Chromium/Playwright combination did not demonstrably honor the emulated display-mode feature.** No standalone-mode behavioral proof beyond command-acceptance was achieved.
+
+### GENUINE_BROWSER_INSTALL_PROMPT
+`NOT_AVAILABLE_TO_AUTOMATION` — no real `beforeinstallprompt` event was observed to fire natively during automated testing; only the synthetic-dispatch UI-logic path was exercised.
+
+### ACTUAL_OS_PWA_INSTALLATION_VERIFIED
+`NO` — never attempted or claimed. Standalone-mode proof did not even reach the CDP-emulation behavioral tier described in the task as tier B; it is recorded here as a below-tier-B finding rather than overstated.
+
+## 10. Full validation chain
+
+All run against the working tree with the new fixtures/tests/accessibility fix in place:
+
+| Command | Result |
+|---|---|
+| `npx tsc --noEmit` | clean |
+| `npm run lint` | clean |
+| `npm test` (unit) | 1156/1156 passed, 63 files |
+| `npm run build` | clean (tsc + vite build + PWA precache generation) |
+| `npm run check:docs` | passed (17 required files) |
+| `npm run test:browser` | 178/178 passed, 19 files (first run: 1 failure, reproduced in isolation → passed cleanly; full clean rerun → 178/178) |
+| `git diff --check` | clean (only benign LF→CRLF autocrlf warnings, no real whitespace errors) |
+
+### Flake documentation (task §67)
+One browser test (`Case F - incompatible pair` in the pre-existing `referenceBindingFidelityWorkspace.test.ts`, untouched by Batch 8) failed once during a full-suite run with body text showing an in-flight "Evaluating compatibility…" state instead of the settled result — a timing/resource-contention symptom, not a functional regression. Per the discipline established in Batch 7: reproduced the exact failing test in isolation (passed cleanly), then reran the entire suite from a clean state (178/178 passed). Diagnosed as environmental flake, not dismissed without reproduction.
+
+## 11. Packaging and packaged-candidate proof (task §46-55)
+
+- **Build proof**: `npm run build` output confirmed sufficient to run standalone from `dist/` alone (proven directly by the installed-package proof below, which never touches `src/` or `viewer/` source).
+- **Tarball**: `npm pack --pack-destination ".my-dev-kit-workflow/v0.8/batch-08/pack"` → `my-frontend-observer-0.7.0.tgz`, 723.4 kB packed / 2.9 MB unpacked, 283 files.
+  - SHA-256: `9c6c899590cca6577ab403fc1fe130a1166b3f4103123537d8bbd441b6220ad7`
+- **Content-safety audit**: tarball top level is exactly `CHANGELOG.md`, `README.md`, `dist/`, `docs/`, `package.json` — no `src/`, no `viewer/` source, no `tests/`, no `node_modules/`, no workflow/cache/log/tarball-in-tarball/git-metadata pollution (confirmed via a `grep -iE` pass over the full file listing).
+- **Consumer install**: clean `npm install <exact tarball path>` into `$WORKFLOW_ROOT\consumer` with `npm_config_cache`/`TEMP`/`TMP` redirected under the workflow root — never the global npm cache or repo root. `node_modules/my-frontend-observer/package.json` version confirmed `0.7.0`, installed from `file:../pack/my-frontend-observer-0.7.0.tgz`.
+- **Installed CLI proof**: `--version` → `0.7.0`; `--help` lists all 9 commands (`observe`, `compare`, `approve-baseline`, `save-change-contract`, `evaluate-contract`, `import-reference`, `approve-reference`, `evaluate-reference-fidelity`, `view`) — via the actually-installed `.bin` executable, not repo `dist/cli.js`.
+- **Installed viewer launch**: the installed CLI's `view --root <integrated-evidence-corpus> --port 4319 --no-open` genuinely started, served `/api/index` with real records, and stayed up for the packaged-browser proof below.
+- **Packaged real-browser proof**: real Chromium against `http://127.0.0.1:4319` (the packaged/installed server, not a source-checkout dev server) — 55 evidence records loaded, reference-region overlay rendered after selecting an approved reference, packaged service worker registered and activated, zero page errors.
+- **Read-only evidence-hash proof** (task §59): SHA-256 of every file in the integrated-evidence corpus, taken after the packaged-browser proof session and again after server teardown — **identical**, confirming no mutation.
+- **No-viewer-artifact proof** (task §60): the same hash comparison implies no new files (`viewer.json`, `fidelity.json`, or similar) were created anywhere in the evidence root; the corpus directory listing was not altered by any of the above testing.
+
+## 12. Integrated evidence corpus (task §13)
+
+Built under `$WORKFLOW_ROOT\fixtures\integrated-evidence` via 12 real canonical-fixture-writer calls (no hand-edited verdicts): normal observation, contract PASS + protected-clause FAIL, baseline supersession, reference/candidate pair (compatible + incompatible), reference binding/fidelity (bound/ambiguous/unavailable), reference fidelity+contract independence, bounded context (adequate/correlated/ambiguous/unavailable/omission/truncation/fidelity-mismatch/blocked), many-regions-one-target, fidelity-fail-contract-pass, plus malformed JSON, unsupported schema version, and missing-screenshot negative fixtures. This corpus is what backed the packaged real-browser proof in §11.
+
+## 13. Repository hygiene and commit
+
+- `git status --short` before commit: only `tests/support/evidenceFixtures.ts` (modified), `viewer/src/components/ReferenceRegionOverlaySvg.tsx` (modified), `viewer/src/components/TargetOverlaySvg.tsx` (modified), `tests/browser/viewerIntegratedAcceptance.test.ts` (new), `tests/browser/pwaHardening.test.ts` (new), plus this report (new).
+- All packed/consumer/PWA-profile/corpus/log/cache state remains exclusively under `.my-dev-kit-workflow/` (gitignored) — confirmed nothing outside it was touched.
+- `package.json` version confirmed unchanged at `0.7.0` throughout.
+
+## 14. What this batch does NOT establish
+
+- Not release-ready, not publish-ready, not cross-platform-verified.
+- `VERSION_BUMP: NONE`. `PUBLICATION_ACTIONS: NONE`. Nothing was tagged, pushed, or published.
+- Standalone/installed-PWA behavioral proof did not exceed CDP command-acceptance (matchMedia did not reflect it) — this is a genuine residual gap, not a success to build on without further investigation.
+- The broader hardened-documentation-and-implementation-completeness audit (the stage after this one) was explicitly **not** performed here.
+- Symlink/junction-escape raw-evidence attack cases (task §30) were not re-exercised with new dedicated tests in this batch; the existing raw-evidence-safety mechanism (exact-identity artifact-detail resolution, Batch 2/4/7) was re-confirmed structurally but not stress-tested against new filesystem-escape vectors. Recorded as a residual risk, not closed.
+
+## 15. Remaining risks / residual scope
+
+1. Standalone-mode proof strength is below what the task's tier-B ("behavioral proof via CDP/app-mode") describes — worth a follow-up investigation into why `Emulation.setEmulatedMedia` didn't take effect in this Chromium build.
+2. Symlink/junction raw-evidence-escape cases remain untested by a dedicated new test (§30 residual).
+3. The 20-item acceptance matrix (task §69, items A–T) is satisfied by a mix of this batch's 3 new dedicated tests (L, M, N) plus the already-passing, re-confirmed test suites from Batches 3–7 for the remaining items — this batch did not write a from-scratch dedicated test for every letter independently where an existing one already provides equivalent real-browser proof.
+
+## 16. Verdict
+
+`PASS_V08_BATCH8_INTEGRATED_VIEWER_ACCEPTANCE` — full validation chain green, all three named coverage gaps closed with new real-browser proof, one real accessibility defect found and fixed, PWA live hardening genuinely exercised for the first time with its hard stale-evidence gate holding, and the packaged/installed candidate proven to work end-to-end in a real browser with read-only evidence-root integrity confirmed. `IMPLEMENTATION_BATCHES_STATUS: ALL_8_IMPLEMENTATION_BATCHES_PASS`. `NEXT_STAGE_READINESS`: ready to proceed to the separate hardened-documentation-and-implementation-completeness audit stage — not to release preparation.