@dailephd/my-frontend-observer 0.9.1 → 0.10.1

package/docs/reports/v0.9.1-batch2-hard-gate-validation-integration.md

@@ -1,262 +1,262 @@
-# v0.9.1 Batch 2 report: hard-gate validation integration
-
-## 1. VERDICT
-
-`PASS_V0_9_1_PWA_HARD_GATE_ISOLATION`
-
-The isolated PWA hard gate is now a permanent npm command. It is part of
-`npm run test:security`, and through that it is part of pre-release readiness.
-The full regression chain passed. No production file, dependency, or version
-changed. v0.9.1 implementation is complete. v0.9.1 is not released.
-
-## 2. Repository identity
-
-1. Repository: `C:\Users\daile\Projects\my-frontend-observer`
-2. Branch: `feature/v0.9.1-pwa-hard-gate-isolation`
-3. Starting HEAD: `6874fd4b9690244673bd1b0e39bad0dd01cf397d` (Batch 1 commit)
-4. Package version: `0.9.0` in `package.json`, in `package-lock.json`, and in
-   `package-lock.json` `packages[""]`
-5. `docs/reports/v0.9-architecture-retrieval.md` is still marked skip-worktree
-   (`git ls-files -v` shows `S`). It was not touched.
-6. Runtime: Node `v24.20.0`, Playwright `1.62.1`, Vitest `4.1.11`, Windows 11
-
-## 3. Batch 1 entry gate
-
-PASS. Batch 1 ended with `PASS_V0_9_1_BATCH1_PWA_HARD_GATE_ISOLATED` at
-`6874fd4`. At the start of Batch 2 the worktree was clean and HEAD was that
-commit. `tests/browser/pwaHardening.test.ts` still has every Batch 1 element: a
-fresh evidence root, server, temporary persistent profile, and BrowserContext
-for the gate. It also has the separate activation and control proofs, the shell
-precache proof, the `/api/` cache exclusion proof, the live evidence proof, the
-Node-side server-down proof, the offline shell reload, the stale-evidence
-absence checks, and deterministic cleanup. Batch 2 did not change that file.
-
-## 4. Root cause carried forward
-
-1. `OLD_READINESS_PREDICATE`: `(await navigator.serviceWorker.getRegistration())?.active !== undefined`
-2. `OLD_ACTIVE_VALUE_AT_FAILURE`: `null` (the worker was still installing)
-3. `OLD_CLIENT_CONTROLLER_AT_FAILURE`: `null`
-4. `WHY_OLD_PREDICATE_PASSED`: `null !== undefined` is `true`. The check passed
-   as soon as a registration existed, before activation or control. The server
-   then closed too early. The precache held only 5 entries, and the reload
-   failed with `net::ERR_CONNECTION_REFUSED`.
-5. `CORRECT_ACTIVE_PROOF`: `registration.active !== null`, read from
-   `await navigator.serviceWorker.ready`
-6. `CURRENT_CLIENT_CONTROL_PROOF`: `navigator.serviceWorker.controller !== null`
-
-Shared state hid the bug in normal order. Earlier tests in the same describe
-block had already activated a controlling worker on the same server origin.
-Selected alone, the server starts on a new random port, so no worker existed yet
-for that origin.
-
-Classification remains `TEST_DEFECT`. No product defect was found.
-
-## 5. Dedicated isolated command
-
-`package.json` now has exactly one new script:
-
-`"test:pwa-hard-gate": "vitest run --config vitest.browser.config.ts tests/browser/pwaHardening.test.ts -t \"HARD GATE\""`
-
-No alias was added. The command exists because a passing full browser or
-security suite does not prove that the hard gate can run on its own.
-
-Direct runs after adding the script:
-
-1. `npm run test:pwa-hard-gate` run 1: PASS (1 passed, 6 skipped)
-2. `npm run test:pwa-hard-gate` run 2, straight after: PASS (1 passed,
-   6 skipped)
-
-## 6. Security-suite integration
-
-`test:security` now runs three stages joined with `&&`:
-
-1. the existing unit security tests (unchanged)
-2. the existing browser security tests, including the full
-   `tests/browser/pwaHardening.test.ts` (unchanged)
-3. `npm run test:pwa-hard-gate` (new)
-
-The isolated run is added on top. The full PWA file still runs in stage 2.
-`test:browser` was not changed and still runs every `tests/browser/**/*.test.ts`
-file, including the full PWA file.
-
-## 7. Pre-release-readiness integration
-
-1. `PRE_RELEASE_WORKFLOW_ALREADY_CALLS_TEST_SECURITY = true`. The `candidate`
-   job in `.github/workflows/pre-release-readiness.yml` has the step
-   `Security test suite (npm run test:security)`.
-2. `WORKFLOW_YAML_CHANGE_REQUIRED = false`. Candidate readiness now gets the
-   isolated gate through the updated npm script. The workflow YAML was not
-   modified.
-
-## 8. Full PWA file validation
-
-`npx vitest run --config vitest.browser.config.ts tests/browser/pwaHardening.test.ts`
-
-PASS. 7 passed.
-
-## 9. Isolated hard-gate repeated validation
-
-1. Direct run 1 (section 5): PASS
-2. Direct run 2 (section 5): PASS
-3. First step of the regression chain: PASS (1 passed, 6 skipped)
-4. Inside `npm run test:security`: PASS (1 passed, 6 skipped)
-5. Last step of the regression chain, after every full suite: PASS
-   (1 passed, 6 skipped)
-
-Run 5 shows that the full suites did not become a hidden prerequisite again.
-
-## 10. Browser-suite validation
-
-`npm run test:browser`: PASS. 29 test files, 275 tests passed.
-
-## 11. Security-suite validation
-
-`npm run test:security`: PASS. The output shows all three stages ran:
-
-1. unit security: 16 files, 168 tests passed
-2. browser security: 3 files, 77 tests passed
-3. the npm banner `> @dailephd/my-frontend-observer@0.9.0 test:pwa-hard-gate`,
-   then 1 file, 1 test passed, 6 skipped
-
-Stage 3 was confirmed from the command output, not only from `package.json`.
-
-## 12. Full unit regression
-
-`npm test`: PASS. 89 test files, 1454 tests passed.
-
-No repository test checks package script strings, so no static script test was
-added. Running `npm run test:pwa-hard-gate` is the primary proof.
-
-## 13. Build validation
-
-`npm run build`: PASS. The Workbox precache still has 10 entries (7 unique
-URLs). `sw.js` has no runtime caching rules.
-
-## 14. Documentation validation
-
-`npm run check:docs`: PASS (17 required files). It ran in the regression chain
-after the documentation edits. It was run again after this report was written
-(see section 19).
-
-## 15. Package-boundary validation
-
-`npm pack --dry-run`: PASS. Candidate filename
-`dailephd-my-frontend-observer-0.9.0.tgz`, 369 files, 1.0 MB packed, 4.0 MB
-unpacked.
-
-The file list was searched for `tests/`, `.my-dev-kit-workflow`, `examples/`,
-`pwa-profile`, `hard-gate`, and the agent-control files. The only match was
-`docs/reports/v0.9.1-batch1-pwa-hard-gate-isolation.md`. That is a report
-included by the existing `"files": ["dist", "README.md", "CHANGELOG.md", "docs",
-"LICENSE"]` allowlist, like every other report. No tests, `examples/v09-demo`,
-workflow state, Chromium profiles, or evidence roots are in the package.
-
-## 16. Product-code audit
-
-`git diff --name-only 6874fd4` shows no path under `src/`, `viewer/`, or
-`.github/`. `viewer/vite.config.ts` and the service-worker caching policy were
-not changed.
-
-1. `PRODUCTION_FILES_CHANGED = false`
-2. `PRODUCT_SEMANTICS_CHANGED = false`
-3. `PRODUCT_DEFECT_DISCOVERED = false`
-
-## 17. Dependency/version audit
-
-1. `dependencies`, `devDependencies`, `peerDependencies`, and
-   `optionalDependencies` are the same as at `6874fd4`.
-2. `package-lock.json` did not change.
-3. The version is `0.9.0` in all three places.
-4. No `npm version`, `npm publish`, tag, GitHub Release, or release branch.
-
-## 18. Documentation reconciliation
-
-1. `docs/CURRENT_STATE.md`: the v0.9.1 section now says implementation complete
-   and unreleased. It records the reproduction, the two-part root cause, the
-   new ownership and proofs, the command integration, and that production
-   behavior is unchanged. The planning background is kept below it.
-2. `docs/ROADMAP.md`: only the v0.9.1 status wording changed, from planned to
-   implemented and unreleased. The objective, constraints, exclusions, and
-   acceptance are unchanged.
-3. `docs/PROJECT_OVERVIEW.md`: v0.9.1 is complete but unreleased. PWA
-   hard/security acceptance no longer depends on prior test order or
-   persistent browser state. v0.10 is still future.
-4. `docs/PROJECT_MILESTONES.md`: a status line was added to the existing
-   v0.9.1 maintenance note. It says the invariant is implemented and release is
-   pending. Milestone 9 semantics are unchanged.
-5. `docs/DEVELOPMENT.md`: the gate-isolation section now gives
-   `npm run test:pwa-hard-gate`, says when to run it, and says it must pass on
-   its own.
-6. `docs/CI_CD.md`: the v0.9.1 wording is now implemented. It says
-   `test:security` runs the isolated gate, that candidate readiness gets it
-   automatically, and that the workflow YAML did not change.
-7. `CHANGELOG.md`: one maintenance bullet under `[Unreleased]`. No `0.9.1`
-   section was created.
-
-`docs/plans/v0.9.1-implementation-plan.md`, the historical `docs/reports/v0.9-*.md`
-reports, and the Batch 1 report were not changed.
-
-The durable rule stays in `DEVELOPMENT.md`, `CI_CD.md`, and
-`PROJECT_MILESTONES.md`: tests labeled `HARD GATE`, `SECURITY GATE`, or
-`ACCEPTANCE GATE` must set up their own material prerequisites and pass on
-their own from fresh state. It is now implemented policy.
-
-## 19. Changed files
-
-1. `package.json`
-2. `CHANGELOG.md`
-3. `docs/CURRENT_STATE.md`
-4. `docs/ROADMAP.md`
-5. `docs/PROJECT_MILESTONES.md`
-6. `docs/PROJECT_OVERVIEW.md`
-7. `docs/DEVELOPMENT.md`
-8. `docs/CI_CD.md`
-9. `docs/reports/v0.9.1-batch2-hard-gate-validation-integration.md`
-
-Generated paths:
-
-1. Regression logs in the Claude Code session scratchpad `regression\` folder,
-   outside the repository and not committed
-2. `dist/` from `npm run build` (ignored build output)
-3. Temporary test directories under the OS temp directory. They were all
-   removed. After every run, no `my-frontend-observer-pwa-hard-gate-profile-*`,
-   `my-frontend-observer-pwa-hard-gate-evidence-*`, or
-   `my-frontend-observer-pwa-profile-*` directories remained.
-4. `npm pack --dry-run` wrote no tarball.
-
-Full regression order, all exit 0:
-
-1. `npm run test:pwa-hard-gate`
-2. `npm run typecheck`
-3. `npm run lint`
-4. `npm test`
-5. `npm run test:browser`
-6. `npm run test:security`
-7. `npm run build`
-8. `npm run check:docs`
-9. `npm pack --dry-run`
-10. `npm run test:pwa-hard-gate`
-
-After this report was written, `npm run check:docs` and `git diff --check`
-were run again before the commit.
-
-## 20. Remaining release-readiness work
-
-Not done in this batch, and not claimed:
-
-1. the v0.9.1 integration PR from this feature branch into `master`, with
-   required PR CI
-2. exact-candidate cross-platform pre-release readiness: one tarball, hashed,
-   installed on Windows, Linux, and macOS. `test:security` now includes the
-   isolated gate on each platform.
-3. release preparation: version bump to `0.9.1`, a `0.9.1` CHANGELOG section,
-   and final state documents
-4. user-authorized publication, tag, and GitHub Release
-
-Notes carried from Batch 1:
-
-1. The focused `/api/` cache test still uses the old weak `?.active !== undefined`
-   wait. It is correct in file order because it runs after the registration
-   test on the same origin. It is not labeled as a gate.
-2. `.my-dev-kit-workflow/v0.8/batch-08/pwa-profile` still exists on disk. No
-   test uses it.
+# v0.9.1 Batch 2 report: hard-gate validation integration
+
+## 1. VERDICT
+
+`PASS_V0_9_1_PWA_HARD_GATE_ISOLATION`
+
+The isolated PWA hard gate is now a permanent npm command. It is part of
+`npm run test:security`, and through that it is part of pre-release readiness.
+The full regression chain passed. No production file, dependency, or version
+changed. v0.9.1 implementation is complete. v0.9.1 is not released.
+
+## 2. Repository identity
+
+1. Repository: `C:\Users\daile\Projects\my-frontend-observer`
+2. Branch: `feature/v0.9.1-pwa-hard-gate-isolation`
+3. Starting HEAD: `6874fd4b9690244673bd1b0e39bad0dd01cf397d` (Batch 1 commit)
+4. Package version: `0.9.0` in `package.json`, in `package-lock.json`, and in
+   `package-lock.json` `packages[""]`
+5. `docs/reports/v0.9-architecture-retrieval.md` is still marked skip-worktree
+   (`git ls-files -v` shows `S`). It was not touched.
+6. Runtime: Node `v24.20.0`, Playwright `1.62.1`, Vitest `4.1.11`, Windows 11
+
+## 3. Batch 1 entry gate
+
+PASS. Batch 1 ended with `PASS_V0_9_1_BATCH1_PWA_HARD_GATE_ISOLATED` at
+`6874fd4`. At the start of Batch 2 the worktree was clean and HEAD was that
+commit. `tests/browser/pwaHardening.test.ts` still has every Batch 1 element: a
+fresh evidence root, server, temporary persistent profile, and BrowserContext
+for the gate. It also has the separate activation and control proofs, the shell
+precache proof, the `/api/` cache exclusion proof, the live evidence proof, the
+Node-side server-down proof, the offline shell reload, the stale-evidence
+absence checks, and deterministic cleanup. Batch 2 did not change that file.
+
+## 4. Root cause carried forward
+
+1. `OLD_READINESS_PREDICATE`: `(await navigator.serviceWorker.getRegistration())?.active !== undefined`
+2. `OLD_ACTIVE_VALUE_AT_FAILURE`: `null` (the worker was still installing)
+3. `OLD_CLIENT_CONTROLLER_AT_FAILURE`: `null`
+4. `WHY_OLD_PREDICATE_PASSED`: `null !== undefined` is `true`. The check passed
+   as soon as a registration existed, before activation or control. The server
+   then closed too early. The precache held only 5 entries, and the reload
+   failed with `net::ERR_CONNECTION_REFUSED`.
+5. `CORRECT_ACTIVE_PROOF`: `registration.active !== null`, read from
+   `await navigator.serviceWorker.ready`
+6. `CURRENT_CLIENT_CONTROL_PROOF`: `navigator.serviceWorker.controller !== null`
+
+Shared state hid the bug in normal order. Earlier tests in the same describe
+block had already activated a controlling worker on the same server origin.
+Selected alone, the server starts on a new random port, so no worker existed yet
+for that origin.
+
+Classification remains `TEST_DEFECT`. No product defect was found.
+
+## 5. Dedicated isolated command
+
+`package.json` now has exactly one new script:
+
+`"test:pwa-hard-gate": "vitest run --config vitest.browser.config.ts tests/browser/pwaHardening.test.ts -t \"HARD GATE\""`
+
+No alias was added. The command exists because a passing full browser or
+security suite does not prove that the hard gate can run on its own.
+
+Direct runs after adding the script:
+
+1. `npm run test:pwa-hard-gate` run 1: PASS (1 passed, 6 skipped)
+2. `npm run test:pwa-hard-gate` run 2, straight after: PASS (1 passed,
+   6 skipped)
+
+## 6. Security-suite integration
+
+`test:security` now runs three stages joined with `&&`:
+
+1. the existing unit security tests (unchanged)
+2. the existing browser security tests, including the full
+   `tests/browser/pwaHardening.test.ts` (unchanged)
+3. `npm run test:pwa-hard-gate` (new)
+
+The isolated run is added on top. The full PWA file still runs in stage 2.
+`test:browser` was not changed and still runs every `tests/browser/**/*.test.ts`
+file, including the full PWA file.
+
+## 7. Pre-release-readiness integration
+
+1. `PRE_RELEASE_WORKFLOW_ALREADY_CALLS_TEST_SECURITY = true`. The `candidate`
+   job in `.github/workflows/pre-release-readiness.yml` has the step
+   `Security test suite (npm run test:security)`.
+2. `WORKFLOW_YAML_CHANGE_REQUIRED = false`. Candidate readiness now gets the
+   isolated gate through the updated npm script. The workflow YAML was not
+   modified.
+
+## 8. Full PWA file validation
+
+`npx vitest run --config vitest.browser.config.ts tests/browser/pwaHardening.test.ts`
+
+PASS. 7 passed.
+
+## 9. Isolated hard-gate repeated validation
+
+1. Direct run 1 (section 5): PASS
+2. Direct run 2 (section 5): PASS
+3. First step of the regression chain: PASS (1 passed, 6 skipped)
+4. Inside `npm run test:security`: PASS (1 passed, 6 skipped)
+5. Last step of the regression chain, after every full suite: PASS
+   (1 passed, 6 skipped)
+
+Run 5 shows that the full suites did not become a hidden prerequisite again.
+
+## 10. Browser-suite validation
+
+`npm run test:browser`: PASS. 29 test files, 275 tests passed.
+
+## 11. Security-suite validation
+
+`npm run test:security`: PASS. The output shows all three stages ran:
+
+1. unit security: 16 files, 168 tests passed
+2. browser security: 3 files, 77 tests passed
+3. the npm banner `> @dailephd/my-frontend-observer@0.9.0 test:pwa-hard-gate`,
+   then 1 file, 1 test passed, 6 skipped
+
+Stage 3 was confirmed from the command output, not only from `package.json`.
+
+## 12. Full unit regression
+
+`npm test`: PASS. 89 test files, 1454 tests passed.
+
+No repository test checks package script strings, so no static script test was
+added. Running `npm run test:pwa-hard-gate` is the primary proof.
+
+## 13. Build validation
+
+`npm run build`: PASS. The Workbox precache still has 10 entries (7 unique
+URLs). `sw.js` has no runtime caching rules.
+
+## 14. Documentation validation
+
+`npm run check:docs`: PASS (17 required files). It ran in the regression chain
+after the documentation edits. It was run again after this report was written
+(see section 19).
+
+## 15. Package-boundary validation
+
+`npm pack --dry-run`: PASS. Candidate filename
+`dailephd-my-frontend-observer-0.9.0.tgz`, 369 files, 1.0 MB packed, 4.0 MB
+unpacked.
+
+The file list was searched for `tests/`, `.my-dev-kit-workflow`, `examples/`,
+`pwa-profile`, `hard-gate`, and the agent-control files. The only match was
+`docs/reports/v0.9.1-batch1-pwa-hard-gate-isolation.md`. That is a report
+included by the existing `"files": ["dist", "README.md", "CHANGELOG.md", "docs",
+"LICENSE"]` allowlist, like every other report. No tests, `examples/v09-demo`,
+workflow state, Chromium profiles, or evidence roots are in the package.
+
+## 16. Product-code audit
+
+`git diff --name-only 6874fd4` shows no path under `src/`, `viewer/`, or
+`.github/`. `viewer/vite.config.ts` and the service-worker caching policy were
+not changed.
+
+1. `PRODUCTION_FILES_CHANGED = false`
+2. `PRODUCT_SEMANTICS_CHANGED = false`
+3. `PRODUCT_DEFECT_DISCOVERED = false`
+
+## 17. Dependency/version audit
+
+1. `dependencies`, `devDependencies`, `peerDependencies`, and
+   `optionalDependencies` are the same as at `6874fd4`.
+2. `package-lock.json` did not change.
+3. The version is `0.9.0` in all three places.
+4. No `npm version`, `npm publish`, tag, GitHub Release, or release branch.
+
+## 18. Documentation reconciliation
+
+1. `docs/CURRENT_STATE.md`: the v0.9.1 section now says implementation complete
+   and unreleased. It records the reproduction, the two-part root cause, the
+   new ownership and proofs, the command integration, and that production
+   behavior is unchanged. The planning background is kept below it.
+2. `docs/ROADMAP.md`: only the v0.9.1 status wording changed, from planned to
+   implemented and unreleased. The objective, constraints, exclusions, and
+   acceptance are unchanged.
+3. `docs/PROJECT_OVERVIEW.md`: v0.9.1 is complete but unreleased. PWA
+   hard/security acceptance no longer depends on prior test order or
+   persistent browser state. v0.10 is still future.
+4. `docs/PROJECT_MILESTONES.md`: a status line was added to the existing
+   v0.9.1 maintenance note. It says the invariant is implemented and release is
+   pending. Milestone 9 semantics are unchanged.
+5. `docs/DEVELOPMENT.md`: the gate-isolation section now gives
+   `npm run test:pwa-hard-gate`, says when to run it, and says it must pass on
+   its own.
+6. `docs/CI_CD.md`: the v0.9.1 wording is now implemented. It says
+   `test:security` runs the isolated gate, that candidate readiness gets it
+   automatically, and that the workflow YAML did not change.
+7. `CHANGELOG.md`: one maintenance bullet under `[Unreleased]`. No `0.9.1`
+   section was created.
+
+`docs/plans/v0.9.1-implementation-plan.md`, the historical `docs/reports/v0.9-*.md`
+reports, and the Batch 1 report were not changed.
+
+The durable rule stays in `DEVELOPMENT.md`, `CI_CD.md`, and
+`PROJECT_MILESTONES.md`: tests labeled `HARD GATE`, `SECURITY GATE`, or
+`ACCEPTANCE GATE` must set up their own material prerequisites and pass on
+their own from fresh state. It is now implemented policy.
+
+## 19. Changed files
+
+1. `package.json`
+2. `CHANGELOG.md`
+3. `docs/CURRENT_STATE.md`
+4. `docs/ROADMAP.md`
+5. `docs/PROJECT_MILESTONES.md`
+6. `docs/PROJECT_OVERVIEW.md`
+7. `docs/DEVELOPMENT.md`
+8. `docs/CI_CD.md`
+9. `docs/reports/v0.9.1-batch2-hard-gate-validation-integration.md`
+
+Generated paths:
+
+1. Regression logs in the Claude Code session scratchpad `regression\` folder,
+   outside the repository and not committed
+2. `dist/` from `npm run build` (ignored build output)
+3. Temporary test directories under the OS temp directory. They were all
+   removed. After every run, no `my-frontend-observer-pwa-hard-gate-profile-*`,
+   `my-frontend-observer-pwa-hard-gate-evidence-*`, or
+   `my-frontend-observer-pwa-profile-*` directories remained.
+4. `npm pack --dry-run` wrote no tarball.
+
+Full regression order, all exit 0:
+
+1. `npm run test:pwa-hard-gate`
+2. `npm run typecheck`
+3. `npm run lint`
+4. `npm test`
+5. `npm run test:browser`
+6. `npm run test:security`
+7. `npm run build`
+8. `npm run check:docs`
+9. `npm pack --dry-run`
+10. `npm run test:pwa-hard-gate`
+
+After this report was written, `npm run check:docs` and `git diff --check`
+were run again before the commit.
+
+## 20. Remaining release-readiness work
+
+Not done in this batch, and not claimed:
+
+1. the v0.9.1 integration PR from this feature branch into `master`, with
+   required PR CI
+2. exact-candidate cross-platform pre-release readiness: one tarball, hashed,
+   installed on Windows, Linux, and macOS. `test:security` now includes the
+   isolated gate on each platform.
+3. release preparation: version bump to `0.9.1`, a `0.9.1` CHANGELOG section,
+   and final state documents
+4. user-authorized publication, tag, and GitHub Release
+
+Notes carried from Batch 1:
+
+1. The focused `/api/` cache test still uses the old weak `?.active !== undefined`
+   wait. It is correct in file order because it runs after the registration
+   test on the same origin. It is not labeled as a gate.
+2. `.my-dev-kit-workflow/v0.8/batch-08/pwa-profile` still exists on disk. No
+   test uses it.