@dailephd/my-frontend-observer 0.9.0 → 0.9.1

package/docs/reports/v0.9.1-batch1-pwa-hard-gate-isolation.md

@@ -0,0 +1,359 @@
+# v0.9.1 Batch 1 report: PWA hard-gate isolation
+
+## 1. VERDICT
+
+`PASS_V0_9_1_BATCH1_PWA_HARD_GATE_ISOLATED`
+
+The PWA server-down hard gate is now a self-contained experiment. It passes when
+selected alone and when the whole PWA file runs. No production file changed. No
+product defect was found.
+
+This report covers Batch 1 only. v0.9.1 is not released. Full repository
+regression and cross-platform release readiness are not complete. Batch 2 owns
+them.
+
+## 2. Repository identity
+
+1. Repository: `C:\Users\daile\Projects\my-frontend-observer`
+2. Package: `@dailephd/my-frontend-observer`, version `0.9.0` (unchanged)
+3. Branch: `feature/v0.9.1-pwa-hard-gate-isolation`, created from `master`
+4. Starting HEAD: `985d0ce47a070fd9f84eae478f4098df00d57bd8` (merge of PR #15)
+5. Released baseline: v0.9.0 at `eacd543f64d45d8b721e766173af87e6a878152c`
+6. Runtime: Node `v24.20.0`, Playwright `1.62.1`, Vitest `4.1.11`, Windows 11
+
+## 3. Planning authority
+
+1. PR #15 (`docs: plan v0.9.1 PWA hard-gate isolation`) was merged into `master`
+   at 2026-09-21T15:11:04Z as `985d0ce`.
+2. `docs/plans/v0.9.1-implementation-plan.md` is present on `master` and was
+   read in full. It is the frozen authority for this batch.
+3. The planning doc changes in `ROADMAP.md`, `CURRENT_STATE.md`,
+   `DEVELOPMENT.md`, `CI_CD.md`, and `PROJECT_MILESTONES.md`, plus
+   `DOCUMENTATION_PRESERVATION_POLICY.md`, were read.
+4. A first attempt at this prompt stopped with
+   `BLOCKED_V0_9_1_PLANNING_NOT_MERGED` because PR #15 was still open. No changes
+   were made in that attempt.
+
+## 4. Original isolated failure reproduction
+
+After `npm run build` (exit 0), this command ran against the unchanged test:
+
+`npx vitest run --config vitest.browser.config.ts tests/browser/pwaHardening.test.ts -t "HARD GATE"`
+
+1. Exit code: 1
+2. Result: 1 failed, 6 skipped
+3. Failure step: `await page.reload()` right after `server.close()`
+4. Failure message: `page.reload: net::ERR_CONNECTION_REFUSED`
+5. Shell reload failed: yes. The page was not served by a service worker.
+6. Evidence-unavailable assertion reached: no. The test failed before it.
+
+A diagnostic outside the repository (scratchpad only, not committed) repeated
+the original steps and recorded service-worker and cache state at the moment the
+original test shut the server down. The result was the same with the historical
+fixed profile and with a fresh temporary profile:
+
+1. Registration present: true
+2. Worker state: `installing` = true, `active` = null
+3. `navigator.serviceWorker.controller`: null
+4. Cache Storage: one `workbox-precache-v2-<origin>/` cache with 5 entries, so
+   the precache was still being filled
+5. Reload after close: `net::ERR_CONNECTION_REFUSED`
+
+So service-worker control and a complete shell cache were both absent at the
+shutdown boundary.
+
+## 5. Root cause
+
+Two faults combined.
+
+1. The wait condition was wrong. The old test waited for
+   `(await navigator.serviceWorker.getRegistration())?.active !== undefined`.
+   `registration.active` is `null`, not `undefined`, while a worker is still
+   installing. The condition was therefore true as soon as any registration
+   existed. It never proved activation, control, or a filled precache.
+2. The test relied on shared state. In normal file order, earlier tests in the
+   same describe had already used the same server origin and the same
+   persistent context. By the time the hard gate ran, the worker was active and
+   controlling that origin, so the weak wait did not matter.
+
+When selected alone, the viewer server starts on a new random port (`port: 0`).
+That is a new origin with no worker. The fixed profile's older registrations
+belong to other origins and do not help. The page was still uncontrolled when
+the server closed, so the reload went to the network and failed.
+
+Classification stays `TEST_DEFECT`. `PRODUCT_CHANGE_REQUIRED = false`.
+
+## 6. Previous shared-state topology
+
+In the first describe block, `beforeAll` created and shared:
+
+1. one evidence root from `mkdtemp`
+2. one viewer server
+3. one persistent Chromium context launched from the fixed profile
+   `.my-dev-kit-workflow/v0.8/batch-08/pwa-profile`
+
+The hard gate was the fourth `it()` in that block. The three earlier tests
+registered the worker, fetched the manifest, and warmed the cache on the same
+origin. The fixed profile also kept service-worker and cache data between local
+runs. That block's `afterAll` never closed its server. Only the hard gate's
+mid-test `server.close()` shut it down.
+
+## 7. New hard-gate resource ownership
+
+The hard gate now lives in its own describe block:
+`PWA server-down safety - self-contained hard-gate experiment`. It has no
+`beforeAll` and uses no describe-level variables. Inside the test it creates and
+owns:
+
+1. an evidence root:
+   `mkdtemp(path.join(tmpdir(), 'my-frontend-observer-pwa-hard-gate-evidence-'))`
+2. the fixture, through the existing helpers `writeManyRegionsOneTargetFixture`
+   and `persistAnnotationUnder`. These are now wrapped by a local
+   `writePwaFixture` helper that both describe blocks use. The real annotation
+   is kept so the annotation view and media routes are part of the cache
+   boundary.
+3. a dedicated viewer server from `startViewer` on port 0
+4. a persistent profile:
+   `mkdtemp(path.join(tmpdir(), 'my-frontend-observer-pwa-hard-gate-profile-'))`
+5. a `BrowserContext` from
+   `chromium.launchPersistentContext(profileRoot, { headless: true })`
+6. a fresh page
+
+The test name is unchanged, so `-t "HARD GATE"` still selects it.
+
+## 8. Fresh-profile design
+
+1. The hard gate uses its own temporary profile and context. It never shares
+   one with any other test.
+2. The first describe block, which keeps the focused registration, manifest,
+   and `/api/` cache tests, now creates its own temporary profile
+   (`my-frontend-observer-pwa-profile-*`) in `beforeAll` and deletes it in
+   `afterAll`.
+3. That `afterAll` now also closes its viewer server, since the hard gate no
+   longer closes it.
+4. The constant for `.my-dev-kit-workflow/v0.8/batch-08/pwa-profile` was
+   removed. No test uses that path any more. The historical directory itself was
+   left on disk untouched.
+5. Profile and evidence removal uses
+   `rm(dir, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })`,
+   because Chromium can briefly hold profile files after close on Windows.
+
+## 9. Service-worker registration proof
+
+After the first navigation, the test evaluates `navigator.serviceWorker.ready`
+in the real page and requires:
+
+1. `registration.active !== null` is true
+2. `registration.scope` equals `<viewer origin>/`
+
+`ready` only resolves when a worker is active, so there is no fixed sleep.
+
+Observed: `serviceWorkerActive = true`.
+
+## 10. Current-client control proof
+
+Control is checked on its own, apart from activation:
+
+1. The test reads `navigator.serviceWorker.controller !== null`.
+2. If it is null, the page reloads while the server is still live.
+3. The test then waits (bounded at 10 seconds) for
+   `navigator.serviceWorker.controller !== null`.
+4. It requires `controller.scriptURL` to equal `<viewer origin>/sw.js`.
+
+Observed: `controlledOnFirstLoad = true` and `clientControlled = true`. The
+generated worker calls `self.skipWaiting()` and `clientsClaim()`, so once
+activation finishes it takes control of the first page. The reload branch
+stays in place for any platform where control arrives later.
+
+## 11. App-shell cache proof
+
+The test reads every Cache Storage entry from the page before shutdown. It
+requires:
+
+1. at least one cache whose name starts with `workbox-precache`
+2. cached pathnames that include `/index.html`, `/registerSW.js`, and
+   `/manifest.webmanifest`
+3. a cached `/index.html` (matched with `ignoreSearch`, because Workbox adds
+   `__WB_REVISION__`) whose body contains `<div id="root"></div>`
+4. that the module entry script named inside that cached `index.html` matches
+   `/assets/*.js` and is itself in the cache
+
+Why this is stable: the generated `sw.js` precaches `index.html`,
+`registerSW.js`, and `manifest.webmanifest` under fixed names, and serves
+navigations with `createHandlerBoundToURL("index.html")`. Only the Vite asset
+names are hashed. The test never hardcodes a hash. It reads the entry script
+name from the cached shell, so the check stays valid across rebuilds.
+
+Observed: 7 cached entries (index, registerSW, manifest, two icons, one JS
+bundle, one CSS bundle).
+
+## 12. API cache-exclusion proof
+
+From the controlled page, the hard gate first fetches `/api/index`, the
+annotation view route, and the annotation overlay media route. It requires each
+to return `200` with `cache-control: no-store`. It then counts cached requests
+whose pathname starts with `/api/` across every cache.
+
+Observed: `apiCacheEntryCount = 0`.
+
+The separate focused test `never caches /api/ responses at the service-worker
+cache-storage layer` was kept. The hard gate does not depend on it.
+
+## 13. Live evidence proof
+
+Before shutdown the test:
+
+1. waits for the first `.evidence-list__item`
+2. requires it to be visible
+3. requires the `.evidence-list` text to contain the fixture candidate id
+   `many-regions-candidate` (read from the fixture helper's return value, not
+   hardcoded)
+4. makes a direct Node-side `fetch` to `/api/index` (5 second timeout) and
+   requires HTTP 200 with a body that contains the same candidate id
+
+## 14. Server-down proof
+
+After `await server.close()` the test makes a direct Node-side `fetch` to the
+same `/api/index` URL with a 5 second timeout. A Node request cannot be
+intercepted by the page's service worker, so this tests the origin server alone.
+The test requires the request to fail. If it gets any HTTP response, the test
+fails with that status in the message.
+
+The page was not navigated away. The controlled page and worker stayed in place.
+
+## 15. Offline reload proof
+
+Only after the checks in sections 9 to 14 pass does the test call
+`page.reload()`. It then requires:
+
+1. `h1, header` to render within 10 seconds, so the shell was served from the
+   precache
+2. `navigator.serviceWorker.controller !== null` after the reload
+
+## 16. Stale-evidence safety proof
+
+After the offline reload the test requires:
+
+1. `.evidence-list__error` to appear
+2. body text to contain `Evidence index unavailable`
+3. body text not to contain the previously visible candidate id
+4. zero `.evidence-list__item` elements
+
+These assertions are unchanged from the original or stricter. None were
+weakened.
+
+## 17. Cleanup proof
+
+Cleanup runs in `finally` in a fixed order: close the context, close the server
+unless it was already closed on purpose, remove the evidence root, remove the
+profile. Each step runs even if an earlier step fails. Errors are collected.
+
+1. If the experiment failed, cleanup errors are logged with `console.error` and
+   the original assertion error is what the test reports.
+2. If the experiment passed but cleanup failed, the test fails with every
+   cleanup error listed.
+3. After cleanup, the test requires that neither the evidence root nor the
+   profile directory exists.
+
+A leak audit counted `my-frontend-observer-pwa-*` and
+`my-frontend-observer-b8-pwa*` directories under the OS temp directory before
+and after each run. All counts were 0. That covers the hard gate's profile and
+evidence root and the first describe block's temporary profile and evidence
+root.
+
+Not executed: the failure-path cleanup (steps 1 and 2 above) was not triggered
+on purpose. It is supported by code inspection only.
+
+## 18. Isolated run #1
+
+`npx vitest run --config vitest.browser.config.ts tests/browser/pwaHardening.test.ts -t "HARD GATE"`
+
+PASS. 1 passed, 6 skipped. Exit 0. The run came right after a fresh
+`npm run build`.
+
+## 19. Isolated run #2
+
+The same command was run again right away. PASS. 1 passed, 6 skipped. Exit 0.
+
+The isolated command was run five times in total over the edits. The final two
+runs, on the committed test content, both passed. One of them used
+`--reporter=verbose` and printed the boundary line:
+
+`HARD GATE pre-shutdown boundary {"serviceWorkerActive":true,"controlledOnFirstLoad":true,"clientControlled":true,"shellEntryScriptCached":true,"precacheEntryCount":7,"apiCacheEntryCount":0,"liveEvidenceVisible":true}`
+
+That line was produced by the test itself after its assertions passed.
+
+## 20. Full PWA file result
+
+`npx vitest run --config vitest.browser.config.ts tests/browser/pwaHardening.test.ts`
+
+PASS. 7 passed. Exit 0.
+
+## 21. Typecheck/lint
+
+1. `npm run typecheck`: PASS (exit 0).
+2. `npm run lint`: PASS (exit 0). The first lint run failed with
+   `no-unsafe-finally` because the cleanup error was thrown inside `finally`.
+   The throw was moved after the `try/finally` block, then isolated runs 1 and 2,
+   the full file, typecheck, and lint were all run again and passed.
+
+## 22. Production-code audit
+
+`git diff --name-only` lists only `tests/browser/pwaHardening.test.ts` plus this
+report. No file under `src/` or `viewer/` changed. `viewer/vite.config.ts`,
+the service-worker caching policy, `package.json`, `package-lock.json`,
+`.github/workflows/`, and `CHANGELOG.md` were not touched. `git diff --check`
+passed.
+
+## 23. Product-defect decision
+
+1. `PRODUCT_DEFECT_DISCOVERED = false`
+2. `PRODUCT_CHANGE_REQUIRED = false`
+
+With every precondition proven, the released v0.9.0 viewer shell loads offline
+from the precache. The evidence surface shows its explicit unavailable state.
+Previously fetched evidence is not shown as current. The original failure came
+only from the test's weak wait and its reliance on shared state.
+
+## 24. Changed files
+
+1. `tests/browser/pwaHardening.test.ts`
+2. `docs/reports/v0.9.1-batch1-pwa-hard-gate-isolation.md`
+
+Generated paths (all removed by the tests or kept outside the repository):
+
+1. `%TEMP%\my-frontend-observer-pwa-hard-gate-evidence-*` (removed)
+2. `%TEMP%\my-frontend-observer-pwa-hard-gate-profile-*` (removed)
+3. `%TEMP%\my-frontend-observer-pwa-profile-*` and
+   `%TEMP%\my-frontend-observer-b8-pwa-*` (removed)
+4. The diagnostic script and config in the Claude Code session scratchpad
+   (outside the repository, not committed)
+5. `dist/` from `npm run build` (ignored build output)
+
+These small temporary directories sit under the OS temp directory on `C:\`, as
+the task's `mkdtemp(tmpdir())` design specifies. They are deleted at the end of
+every passing run.
+
+## 25. Batch 2 handoff
+
+Batch 2 still owns:
+
+1. the permanent `test:pwa-hard-gate` package script
+2. wiring that command into the security or pre-release readiness path
+3. moving `CURRENT_STATE.md`, `ROADMAP.md`, `DEVELOPMENT.md`, `CI_CD.md`, and
+   `CHANGELOG.md` from planned to implemented wording
+4. the full unit, browser, security, build, docs, and pack validation
+
+Notes for Batch 2:
+
+1. The focused test `never caches /api/ responses` still uses the same weak
+   `?.active !== undefined` wait that the old hard gate used. It stays correct
+   in file order, because it runs after the registration test on the same
+   origin. If it is ever meant to stand alone, it should wait on
+   `navigator.serviceWorker.ready` instead. It was not changed here to keep
+   Batch 1 narrow.
+2. The standalone display-mode test still writes a log to
+   `.my-dev-kit-workflow/v0.8/batch-08/logs`. That is a log file, not a browser
+   profile, and was not changed.
+3. The historical directory `.my-dev-kit-workflow/v0.8/batch-08/pwa-profile`
+   still exists on disk. No test needs it now. It was not deleted.

package/docs/reports/v0.9.1-batch2-hard-gate-validation-integration.md

@@ -0,0 +1,262 @@
+# v0.9.1 Batch 2 report: hard-gate validation integration
+
+## 1. VERDICT
+
+`PASS_V0_9_1_PWA_HARD_GATE_ISOLATION`
+
+The isolated PWA hard gate is now a permanent npm command. It is part of
+`npm run test:security`, and through that it is part of pre-release readiness.
+The full regression chain passed. No production file, dependency, or version
+changed. v0.9.1 implementation is complete. v0.9.1 is not released.
+
+## 2. Repository identity
+
+1. Repository: `C:\Users\daile\Projects\my-frontend-observer`
+2. Branch: `feature/v0.9.1-pwa-hard-gate-isolation`
+3. Starting HEAD: `6874fd4b9690244673bd1b0e39bad0dd01cf397d` (Batch 1 commit)
+4. Package version: `0.9.0` in `package.json`, in `package-lock.json`, and in
+   `package-lock.json` `packages[""]`
+5. `docs/reports/v0.9-architecture-retrieval.md` is still marked skip-worktree
+   (`git ls-files -v` shows `S`). It was not touched.
+6. Runtime: Node `v24.20.0`, Playwright `1.62.1`, Vitest `4.1.11`, Windows 11
+
+## 3. Batch 1 entry gate
+
+PASS. Batch 1 ended with `PASS_V0_9_1_BATCH1_PWA_HARD_GATE_ISOLATED` at
+`6874fd4`. At the start of Batch 2 the worktree was clean and HEAD was that
+commit. `tests/browser/pwaHardening.test.ts` still has every Batch 1 element: a
+fresh evidence root, server, temporary persistent profile, and BrowserContext
+for the gate. It also has the separate activation and control proofs, the shell
+precache proof, the `/api/` cache exclusion proof, the live evidence proof, the
+Node-side server-down proof, the offline shell reload, the stale-evidence
+absence checks, and deterministic cleanup. Batch 2 did not change that file.
+
+## 4. Root cause carried forward
+
+1. `OLD_READINESS_PREDICATE`: `(await navigator.serviceWorker.getRegistration())?.active !== undefined`
+2. `OLD_ACTIVE_VALUE_AT_FAILURE`: `null` (the worker was still installing)
+3. `OLD_CLIENT_CONTROLLER_AT_FAILURE`: `null`
+4. `WHY_OLD_PREDICATE_PASSED`: `null !== undefined` is `true`. The check passed
+   as soon as a registration existed, before activation or control. The server
+   then closed too early. The precache held only 5 entries, and the reload
+   failed with `net::ERR_CONNECTION_REFUSED`.
+5. `CORRECT_ACTIVE_PROOF`: `registration.active !== null`, read from
+   `await navigator.serviceWorker.ready`
+6. `CURRENT_CLIENT_CONTROL_PROOF`: `navigator.serviceWorker.controller !== null`
+
+Shared state hid the bug in normal order. Earlier tests in the same describe
+block had already activated a controlling worker on the same server origin.
+Selected alone, the server starts on a new random port, so no worker existed yet
+for that origin.
+
+Classification remains `TEST_DEFECT`. No product defect was found.
+
+## 5. Dedicated isolated command
+
+`package.json` now has exactly one new script:
+
+`"test:pwa-hard-gate": "vitest run --config vitest.browser.config.ts tests/browser/pwaHardening.test.ts -t \"HARD GATE\""`
+
+No alias was added. The command exists because a passing full browser or
+security suite does not prove that the hard gate can run on its own.
+
+Direct runs after adding the script:
+
+1. `npm run test:pwa-hard-gate` run 1: PASS (1 passed, 6 skipped)
+2. `npm run test:pwa-hard-gate` run 2, straight after: PASS (1 passed,
+   6 skipped)
+
+## 6. Security-suite integration
+
+`test:security` now runs three stages joined with `&&`:
+
+1. the existing unit security tests (unchanged)
+2. the existing browser security tests, including the full
+   `tests/browser/pwaHardening.test.ts` (unchanged)
+3. `npm run test:pwa-hard-gate` (new)
+
+The isolated run is added on top. The full PWA file still runs in stage 2.
+`test:browser` was not changed and still runs every `tests/browser/**/*.test.ts`
+file, including the full PWA file.
+
+## 7. Pre-release-readiness integration
+
+1. `PRE_RELEASE_WORKFLOW_ALREADY_CALLS_TEST_SECURITY = true`. The `candidate`
+   job in `.github/workflows/pre-release-readiness.yml` has the step
+   `Security test suite (npm run test:security)`.
+2. `WORKFLOW_YAML_CHANGE_REQUIRED = false`. Candidate readiness now gets the
+   isolated gate through the updated npm script. The workflow YAML was not
+   modified.
+
+## 8. Full PWA file validation
+
+`npx vitest run --config vitest.browser.config.ts tests/browser/pwaHardening.test.ts`
+
+PASS. 7 passed.
+
+## 9. Isolated hard-gate repeated validation
+
+1. Direct run 1 (section 5): PASS
+2. Direct run 2 (section 5): PASS
+3. First step of the regression chain: PASS (1 passed, 6 skipped)
+4. Inside `npm run test:security`: PASS (1 passed, 6 skipped)
+5. Last step of the regression chain, after every full suite: PASS
+   (1 passed, 6 skipped)
+
+Run 5 shows that the full suites did not become a hidden prerequisite again.
+
+## 10. Browser-suite validation
+
+`npm run test:browser`: PASS. 29 test files, 275 tests passed.
+
+## 11. Security-suite validation
+
+`npm run test:security`: PASS. The output shows all three stages ran:
+
+1. unit security: 16 files, 168 tests passed
+2. browser security: 3 files, 77 tests passed
+3. the npm banner `> @dailephd/my-frontend-observer@0.9.0 test:pwa-hard-gate`,
+   then 1 file, 1 test passed, 6 skipped
+
+Stage 3 was confirmed from the command output, not only from `package.json`.
+
+## 12. Full unit regression
+
+`npm test`: PASS. 89 test files, 1454 tests passed.
+
+No repository test checks package script strings, so no static script test was
+added. Running `npm run test:pwa-hard-gate` is the primary proof.
+
+## 13. Build validation
+
+`npm run build`: PASS. The Workbox precache still has 10 entries (7 unique
+URLs). `sw.js` has no runtime caching rules.
+
+## 14. Documentation validation
+
+`npm run check:docs`: PASS (17 required files). It ran in the regression chain
+after the documentation edits. It was run again after this report was written
+(see section 19).
+
+## 15. Package-boundary validation
+
+`npm pack --dry-run`: PASS. Candidate filename
+`dailephd-my-frontend-observer-0.9.0.tgz`, 369 files, 1.0 MB packed, 4.0 MB
+unpacked.
+
+The file list was searched for `tests/`, `.my-dev-kit-workflow`, `examples/`,
+`pwa-profile`, `hard-gate`, and the agent-control files. The only match was
+`docs/reports/v0.9.1-batch1-pwa-hard-gate-isolation.md`. That is a report
+included by the existing `"files": ["dist", "README.md", "CHANGELOG.md", "docs",
+"LICENSE"]` allowlist, like every other report. No tests, `examples/v09-demo`,
+workflow state, Chromium profiles, or evidence roots are in the package.
+
+## 16. Product-code audit
+
+`git diff --name-only 6874fd4` shows no path under `src/`, `viewer/`, or
+`.github/`. `viewer/vite.config.ts` and the service-worker caching policy were
+not changed.
+
+1. `PRODUCTION_FILES_CHANGED = false`
+2. `PRODUCT_SEMANTICS_CHANGED = false`
+3. `PRODUCT_DEFECT_DISCOVERED = false`
+
+## 17. Dependency/version audit
+
+1. `dependencies`, `devDependencies`, `peerDependencies`, and
+   `optionalDependencies` are the same as at `6874fd4`.
+2. `package-lock.json` did not change.
+3. The version is `0.9.0` in all three places.
+4. No `npm version`, `npm publish`, tag, GitHub Release, or release branch.
+
+## 18. Documentation reconciliation
+
+1. `docs/CURRENT_STATE.md`: the v0.9.1 section now says implementation complete
+   and unreleased. It records the reproduction, the two-part root cause, the
+   new ownership and proofs, the command integration, and that production
+   behavior is unchanged. The planning background is kept below it.
+2. `docs/ROADMAP.md`: only the v0.9.1 status wording changed, from planned to
+   implemented and unreleased. The objective, constraints, exclusions, and
+   acceptance are unchanged.
+3. `docs/PROJECT_OVERVIEW.md`: v0.9.1 is complete but unreleased. PWA
+   hard/security acceptance no longer depends on prior test order or
+   persistent browser state. v0.10 is still future.
+4. `docs/PROJECT_MILESTONES.md`: a status line was added to the existing
+   v0.9.1 maintenance note. It says the invariant is implemented and release is
+   pending. Milestone 9 semantics are unchanged.
+5. `docs/DEVELOPMENT.md`: the gate-isolation section now gives
+   `npm run test:pwa-hard-gate`, says when to run it, and says it must pass on
+   its own.
+6. `docs/CI_CD.md`: the v0.9.1 wording is now implemented. It says
+   `test:security` runs the isolated gate, that candidate readiness gets it
+   automatically, and that the workflow YAML did not change.
+7. `CHANGELOG.md`: one maintenance bullet under `[Unreleased]`. No `0.9.1`
+   section was created.
+
+`docs/plans/v0.9.1-implementation-plan.md`, the historical `docs/reports/v0.9-*.md`
+reports, and the Batch 1 report were not changed.
+
+The durable rule stays in `DEVELOPMENT.md`, `CI_CD.md`, and
+`PROJECT_MILESTONES.md`: tests labeled `HARD GATE`, `SECURITY GATE`, or
+`ACCEPTANCE GATE` must set up their own material prerequisites and pass on
+their own from fresh state. It is now implemented policy.
+
+## 19. Changed files
+
+1. `package.json`
+2. `CHANGELOG.md`
+3. `docs/CURRENT_STATE.md`
+4. `docs/ROADMAP.md`
+5. `docs/PROJECT_MILESTONES.md`
+6. `docs/PROJECT_OVERVIEW.md`
+7. `docs/DEVELOPMENT.md`
+8. `docs/CI_CD.md`
+9. `docs/reports/v0.9.1-batch2-hard-gate-validation-integration.md`
+
+Generated paths:
+
+1. Regression logs in the Claude Code session scratchpad `regression\` folder,
+   outside the repository and not committed
+2. `dist/` from `npm run build` (ignored build output)
+3. Temporary test directories under the OS temp directory. They were all
+   removed. After every run, no `my-frontend-observer-pwa-hard-gate-profile-*`,
+   `my-frontend-observer-pwa-hard-gate-evidence-*`, or
+   `my-frontend-observer-pwa-profile-*` directories remained.
+4. `npm pack --dry-run` wrote no tarball.
+
+Full regression order, all exit 0:
+
+1. `npm run test:pwa-hard-gate`
+2. `npm run typecheck`
+3. `npm run lint`
+4. `npm test`
+5. `npm run test:browser`
+6. `npm run test:security`
+7. `npm run build`
+8. `npm run check:docs`
+9. `npm pack --dry-run`
+10. `npm run test:pwa-hard-gate`
+
+After this report was written, `npm run check:docs` and `git diff --check`
+were run again before the commit.
+
+## 20. Remaining release-readiness work
+
+Not done in this batch, and not claimed:
+
+1. the v0.9.1 integration PR from this feature branch into `master`, with
+   required PR CI
+2. exact-candidate cross-platform pre-release readiness: one tarball, hashed,
+   installed on Windows, Linux, and macOS. `test:security` now includes the
+   isolated gate on each platform.
+3. release preparation: version bump to `0.9.1`, a `0.9.1` CHANGELOG section,
+   and final state documents
+4. user-authorized publication, tag, and GitHub Release
+
+Notes carried from Batch 1:
+
+1. The focused `/api/` cache test still uses the old weak `?.active !== undefined`
+   wait. It is correct in file order because it runs after the registration
+   test on the same origin. It is not labeled as a gate.
+2. `.my-dev-kit-workflow/v0.8/batch-08/pwa-profile` still exists on disk. No
+   test uses it.