redweb 0.12.0 → 0.13.0

package/docs/COVERAGE_COUNTER_VALIDATION.md

@@ -0,0 +1,109 @@
+# Exact coverage-counter validation
+
+Independent review found that the browser collector checked source maps but not
+the associated execution counters. A local reproduction supplied the unchanged
+maps with every counter set to `0.5`: the old collector accepted the payload and
+reported all-four 100%. Two regression tests failed before the correction.
+This demonstrates a report-validation defect, not a runtime defect or evidence
+that any saved native-browser report was corrupt.
+
+## One shared validator
+
+`assertCoverageFile` extracts the existing authored-coverage rules into a small,
+pure private helper. Both `ApplicationCoverage` and `BrowserCoverage` now require
+the exact file path, source maps, counter keys and branch arity, with nonnegative
+safe-integer counts. Validation precedes merging; a malformed later application
+module cannot partially commit an earlier valid module. The helper imports only
+Node's assertion module, not TypeScript or browser/runtime dependencies.
+
+The isolated browser harness copies this helper unchanged, increasing its input
+inventory from 24 to 25 files. Existing generator/addition/example verification
+fingerprints include the extracted dependency. No application/runtime API,
+workload threshold, frozen helper or evaluation file changed.
+
+## Maintained checks
+
+The collector portion of `npm run verify:browser:coverage` passes 27 tests across
+three suites in 4.370 seconds. Exactly three private files are all-four 100%:
+70 statements, 10 branches, 10 functions and 68 lines. Cases include explicit
+malformed-report units, real VM executions of instrumented JavaScript/TypeScript,
+multi-module no-partial-merge checks, package-harness compatibility, real child
+process reports, and a Windows exclusive-file-lock cleanup failure. They do not
+replace native browser acceptance.
+
+Five tiny preload-test commands now have explicit five-second limits instead of
+inheriting 120 seconds each. The test's outer limit is 45 seconds to accommodate
+the commands and managed cleanup. CI allows ten minutes for the expanded combined
+collector/browser command (formerly five), with unchanged native operation limits,
+and retains collector/runtime/refresh reports for 30 days on success or failure.
+This is test supervision, not a relaxed product performance limit.
+
+| Exact source | SHA-256 |
+| --- | --- |
+| `scripts/lib/assertCoverageFile.js` | `a3af85e92bfc3f6f83ea18301db1e31dab75f930b3c9045ff7a2dbc50f65b5ba` |
+| `scripts/lib/ApplicationCoverage.js` | `cf83c4c35baefa74ba431e5b0198ebfeba78f19f49c5eeac746205d6b2b12ae5` |
+| `scripts/lib/BrowserCoverage.js` | `73afb4961fbda1ac0f077dddef197b6d36d386304299d69f115ce61d131f6aa2` |
+| `scripts/lib/PackedBrowserHarness.js` | `0eb57075c391dbd32fd931c6647cdc1dbeb014cfbaf6df0afe631c7b790b24ce` |
+
+`coverage/browser-collector/coverage-final.json` SHA-256:
+`49f1230bf03006d0e8e49083e46ac33ca126a43a76b407717e6f1f1aa32d7132`.
+
+## Native acceptance and limits
+
+The complete ordinary/instrumented runtime and refresh browser gates pass with
+matching case inventories. Runtime remains all-four 100% over 426 statements,
+262 branches, 64 functions and 351 lines; refresh remains all-four 100% over
+82 statements, 44 branches, 12 functions and 71 lines. Real HTTP/WebSocket
+actions, selection updates, history restoration, outage/recovery and draft guards
+remain covered. Environment: Windows, Node 22.21.0, Chrome 152.0.7977.64.
+
+| Native report | Run | SHA-256 |
+| --- | --- | --- |
+| `coverage/browser-runtime/report.json` | `01b23ee2-aeda-4594-a5a0-3e11f1005c97` | `2b20f3e87cb5c22f870d90a53879611247ff37582558a22cf7f55ca253d42b39` |
+| `coverage/browser-refresh/report.json` | `d8f370d3-cf33-4b1a-b99d-3c45d3b8dae7` | `fdabcbf7de78568582f3bb2afd61aa8d443d8b4b05caaf8c71f43b527b4ce90f` |
+
+The linked-client gate also passes 77 tests per mode, five worker reports and
+native browser acceptance with 791 statements, 521 branches, 125 functions and
+659 lines all 100%. Run `09c44903-39bb-4741-8e24-60b511dc7245` is retained under
+`coverage/client-source/`. Its ordinary source-built bundles equal the linked
+production build. This does not relabel the Node-only V8 diagnostic as passing.
+
+The client `summary.json` SHA-256 is
+`302c162b655540152c5a1d4c5c562f768065c40431bf87852d5ba439d35b2348`;
+`coverage.json` SHA-256 is
+`8673e236f675d741cb0f55d4f4bf630f2e2a50c2f2f76f856622558491ac8009`.
+
+The complete isolated-package gate then exited successfully. It verified registry
+`redweb-client@0.2.0` and all four matching bundle identities, installed counter/chat,
+dependency isolation, generated additions, authenticated dashboard, browser runtime
+and refresh, all source-free starters, executable docs, compiled actions/rooms and
+static export. No runtime modules were replaced; TLS verification remained enabled.
+
+Tested Redweb archive SHA-256:
+`d66bf453c60bec4bef6a0ea728637131bd014fc8e4e57d6bcc02bafd680c1cf0`.
+This archive predates subsequent evidence-only README/documentation edits.
+The retained report is
+`coverage/packed-browser/d6c4db4d-fc0b-415c-b989-2241255e5e88/report.json`, SHA-256
+`465bdf7c5f6f63dd34ba603bb408b18bf63e3c2ffbb7c39a5379deb04546e0d4`.
+It records the three browser phases passing, 208 package files and 25 unchanged
+harness inputs, with harness SHA-256
+`1a999d87da59cd90e4bbea37e1324c3ab1e7b94fc1932d945c2878ff127651c7`.
+
+The senior critic approved all 17 actual remote blobs at `659f638`, including the
+shared validator, test supervision, attribution wording and evidence identities.
+Pretest/generated/type checks and four documentation units pass.
+
+The full regression for `9c29a6e` then passed 1,459 tests/138 suites in 770.875
+seconds, with two POSIX-only skips. It includes the three new validator cases.
+The unchanged 91-file library scope remains all-four 100%: 5,449 statements,
+4,046 branches, 978 functions and 4,468 lines.
+
+| Full regression evidence | SHA-256 |
+| --- | --- |
+| `coverage/counter-validation-full-results.json` | `0ae3268e1b911fbfe4b766210172a404fbd77e146d7f0ab435ce6e8ce9b807a8` |
+| `coverage/coverage-final.json` | `e3eff8cc021eb82fd323867a079c983c72abb5fe07f83255b302850684dda29e` |
+
+Both preceding `f96ba79` and `367e104` hosted workflows passed completely.
+Both `659f638` and `9c29a6e` hosted workflows also passed completely.
+No npm publication, deployment, benchmark waiver, new long soak or whole-repository
+100% claim is made.