Publish DevRunbook source

CURRENT_STATE.md

@@ -0,0 +1,731 @@
+# Current state
+
+## Current milestone
+
+Milestone 13 — continuous repository freshness: complete
+
+Status: `MILESTONE_13_COMPLETE`
+
+Next: execute Milestone 14 accessibility and interaction regression under
+`docs/51-post-audit-product-roadmap.md`.
+
+## Completed scope
+
+- Added fail-closed Node.js 24/pnpm 10.33 runtime preflight, explicit runtime
+  marker files and CI enforcement.
+- Made the PostgreSQL integration command fail when the database is missing,
+  zero tests execute or any required test is skipped, with explicit executed,
+  skipped, failed and duration counts.
+- Stabilized exhaustive content validation under measured Windows filesystem
+  load and proved the 21-test content suite in three consecutive runs.
+- Corrected Windows migration URL conversion and removed host/database clock
+  coupling from immediate PostgreSQL job availability; the repaired three-test
+  lease suite passed three consecutive real PostgreSQL runs.
+- Removed the transitive moderate esbuild advisory through a patched override;
+  the production dependency audit now reports zero advisories.
+- Implemented the first Phase 10/11 slices: governed usability defaults,
+  human-readable simple-mode errors, five-item project suggestions, 500-item
+  search, recents/favorites presentation, real authenticated identity and
+  removal of nested composer/start `main` landmarks.
+- Made the ordinary-language task statement part of the two-choice Start flow
+  and deterministically normalized bugfix, feature, usability and inspection
+  requests into existing governed inputs; added the missing documentation
+  journey without changing the server composition contract.
+- Added a simple review of every resolved task value with human-readable labels
+  and explicit task-detail versus playbook-default provenance.
+- Added workspace-authorized, same-origin simple-flow funnel events backed by
+  append-only audit evidence. Metrics retain only an event, playbook slug and
+  coarse duration bucket; task text and project identity are never submitted.
+- Added server-owned, per-user and per-workspace project favorites and last-used
+  history with an additive migration, deterministic ordering, optimistic UI
+  rollback and fail-closed cross-workspace repository matching.
+- Linked the real account identity menu to authenticated identity and
+  password/session management pages; active sessions can be inspected and
+  non-current owned sessions revoked through the existing protected API.
+- Replaced the PostgreSQL readiness probe with a real query against the target
+  database, preventing Compose migration from starting during PostgreSQL's
+  temporary bootstrap server window.
+- Started Phase 12 with persistent same-origin Simple/Expert and Dutch/English
+  presentation preferences, browser-language detection, a matching document
+  language and owner-only Management navigation in Simple mode.
+- Reduced Simple primary navigation to Start, My tasks, Projects and More while
+  retaining the established technical navigation unchanged in Expert mode.
+- Completed Phase 12 with governed Dutch/English copy for Start and the simple
+  composer, translated task search, localized document language and dates, and
+  persistent draft-safe language switching.
+- Added working My tasks, More and owner-only Management destinations so every
+  Simple primary-navigation item resolves to a useful, role-appropriate page.
+- Added an application icon and eliminated the final browser-console resource
+  error from authenticated desktop and mobile flows.
+- Started Phase 13 by exposing same-origin, workspace-authorized per-project and
+  Refresh-all endpoints over the existing idempotent PostgreSQL snapshot jobs;
+  refreshes remain bounded to 500 imported projects and read-only forge access.
+- Added actionable project freshness labels, exact snapshot timestamps and
+  optimistic refresh progress without replacing last-known-good profile data.
+- Completed Phase 13 with a PostgreSQL-backed periodic repository planner. It
+  selects only due, enabled, imported Gitea repositories, atomically creates
+  the queue job and collecting snapshot, excludes queued/running duplicates
+  and reuses a stable time-bucket idempotency key across worker restarts.
+- Added configurable refresh cadence and stale thresholds. Planner failure is
+  contained independently of job polling; snapshot jobs retain leased retry,
+  backoff and stale-lease recovery.
+- Added a bounded preflight over the default-branch commit, forge capabilities,
+  tags, releases, governance and workflow availability. Unchanged repositories
+  stop before tree/file reads and never create a profile revision; meaningful
+  changes continue through bounded full analysis.
+- Added task-dependent stale-context guidance to Start with an exact collection
+  time and a direct, actionable Projects refresh path.
+- Documented the disabled Gitea webhook threat model and its mandatory HMAC,
+  timestamp, replay, flood, body, event and workspace-isolation gates. No
+  webhook endpoint or forge write scope was added.
+
+- Established the pnpm/Turborepo modular-monolith contract, pinned Node.js 24,
+  PostgreSQL 17, application dependencies, strict TypeScript, formatting, lint,
+  Vitest, Playwright, production builds, CI, and typed configuration.
+- Validated all 28 P0 packages, six normative examples, 72 roadmap catalog
+  entries, nine schemas, 28 golden prompts, and 68 release-evidence fields.
+- Implemented the production TypeScript composer with byte-identical output for
+  all 28 supplied golden fixtures.
+- Implemented the 26-table Drizzle schema, two ordered migrations, immutable
+  generated runs, persistent artifacts, setup locking, job idempotency, leases,
+  fencing, retry, and stale-lease recovery.
+- Implemented safe built-in package ingestion and PostgreSQL-backed searchable
+  projections with digest conflict protection.
+- Completed structured path/code/message/remediation validation, aggregated
+  multi-package failures, seed-catalog schema validation and exact 72-entry to
+  28-P0 runtime cross-checking.
+- Added the application-owned built-in import contract, advisory-locked
+  PostgreSQL importer, immutable published-version trigger, correct Semantic
+  Version ordering and lifecycle-aware current-version selection.
+- Added typed search/filter, full detail/history and exact-version catalog
+  queries plus their list, detail and exact-version HTTP boundaries.
+- Made worker startup validate and synchronize all built-ins before polling,
+  including both production and development container content layouts.
+- Implemented Better Auth behind the application-owned authentication boundary,
+  first-run owner/workspace creation, local sign-in/logout, session limits,
+  versioned password hashing and upgrade, and single-use operator reset tokens.
+- Implemented workspace-scoped viewer/editor/owner authorization without an
+  instance-administrator bypass.
+- Implemented the first vertical slice through live production boundaries:
+  first-run setup, 28 imports, API listing, package detail UI, deterministic
+  composition, immutable run storage, artifact storage, and restart recovery.
+- Implemented hardened Docker/Compose web, worker, migrate, and PostgreSQL
+  roles. Web and worker run non-root with read-only roots and no arbitrary code
+  execution.
+- Implemented explicit liveness/readiness, database-degraded readiness, a
+  persistent safe worker loop, and an operator persistence validator.
+- Delivered the authenticated Library Explorer with URL-owned search, facets,
+  sorting, card/dense views, persisted favorites and match reasons.
+- Delivered responsive detail/version views, governed lifecycle handling, an
+  exact version/digest composer handoff, light/dark/system themes, mobile
+  navigation and a keyboard command palette.
+- Aligned playbook and favorite API error/status/query contracts with OpenAPI,
+  including same-origin failures and UUID request IDs.
+- Established the Milestone 3 governed RepositoryProfile boundary with strict
+  JSON/YAML parsing, semantic path/command checks, deterministic export and
+  exact digest parity with the published example.
+- Added authorized repository use cases, strong profile ETags, atomic manual
+  creation, workspace-scoped immutable revision persistence, semantic no-op
+  handling and generated-run snapshot-independence coverage.
+- Added an additive repository-list index plus database-enforced positive
+  revision and lowercase SHA-256 invariants without adding a mutable current
+  revision pointer.
+- Delivered the authenticated repository overview, governed profile detail,
+  manual/import creation and immutable revision editor with explicit viewer,
+  degraded, validation and conflict-recovery states.
+- Exposed strict workspace-authorized repository HTTP routes with same-origin
+  mutation checks, strong ETags, bounded JSON/YAML imports and deterministic
+  JSON/YAML exports that re-import successfully.
+- Carried immutable repository revision, digest and protected-path context into
+  the composer handoff without executing repository commands.
+- Added the governed composition resolver with typed input normalization,
+  three-valued condition evaluation, fail-closed policy outcomes, repository
+  compatibility, protected scope resolution, prompt lint, block provenance and
+  deterministic preview digests while retaining all 28 reference-v1 bytes.
+- Added server-authoritative preview and immutable generation boundaries that
+  load published playbook versions and exact repository revisions, compute
+  snapshots/lint/prompt bytes server-side and reject substituted store data.
+- Added workspace-authorized composition drafts with strong ETags, monotonic
+  revisions, atomic compare-and-swap updates and secure draft HTTP routes.
+- Added persisted-run JSON/digest integrity checks, mandatory idempotency keys
+  and an atomic append-only audit event on first immutable generation.
+- Delivered the seven-step responsive guided composer with exact-version and
+  historical-profile pinning, live deterministic preview, block outline,
+  provenance, linked lint findings and explicit degraded/viewer states.
+- Linked guided immutable generation back to its authorized persisted draft,
+  while preserving the generic direct-composition API path.
+- Proved Milestone 4 in the production Unraid stack; exact evidence is recorded
+  in `docs/47-milestone-four-guided-composer.md`.
+- Added exact prompt copy, deterministic Markdown and Run Pack ZIP exports,
+  review-only AGENTS recommendations, authorized artifact history/download and
+  bounded historical Run Pack verification without extraction.
+- Added strict archive, manifest, inventory, digest, TASK-envelope, filename,
+  retention, idempotency and workspace-authorization enforcement with hostile
+  traversal, symlink, duplicate, overlap, CRC and size-limit coverage.
+- Proved Milestone 5 in the production Unraid stack, including export/import,
+  artifact persistence after container recreation and five responsive widths;
+  exact evidence is recorded in
+  `docs/48-milestone-five-export-run-packs.md`.
+- Implemented workspace-authorized Gitea connection, capability, discovery,
+  encrypted-token, rotation, deletion and repository-import boundaries with no
+  write-capable forge methods.
+- Added DNS/IP/redirect SSRF enforcement, response and file limits, safe error
+  projection, capability-level degradation and redacted logging.
+- Added bounded deterministic repository evidence collection, immutable
+  evidence digests, findings, create-initial-only profile generation and a
+  durable ID-only worker job handoff.
+- Delivered imported-repository status and last-known-good snapshot continuity
+  in the integration UI, including after remote outage and integration deletion.
+- Proved Milestone 6 against an isolated live Gitea 1.27.0 fixture and the
+  production Unraid stack; exact evidence is recorded in
+  `docs/49-milestone-six-gitea-repository-intelligence.md`.
+- Delivered bounded private package import/export, complete persisted draft
+  inventories, strong ETags, atomic revision updates and field-specific
+  schema/semantic diagnostics without extraction or execution.
+- Delivered the responsive Prompt Lab with deterministic example reproduction,
+  lint/evidence display, exact-digest editorial review, governed publication,
+  immutable published versions and coherent next-version cloning.
+- Persisted evaluation cases/results with exact playbook, fixture, environment
+  and rendered-prompt digests while keeping editorial review separate from
+  objective evidence and transactionally rechecking publication policy.
+- Proved Milestone 7 in production through import, invalid-edit recovery,
+  review, publication, versioning, composer reproduction, restart persistence
+  and a five-width browser matrix; exact evidence is recorded in
+  `docs/50-milestone-seven-prompt-lab.md`.
+
+## Changed modules
+
+- Root workspace commands, CI, container definitions, environment contract, and
+  validation scripts.
+- `apps/web`: health, catalog, package detail, setup, status, login, logout, and
+  password-reset boundaries and accessible pages.
+- `apps/worker`: standalone ESM-safe worker, safe job dispatch, and operator
+  password reset.
+- `packages/application`, `artifacts`, `composer`, `config`, `content`, `db`,
+  `domain`, `integrations`, `observability`, `testing`, and `ui`.
+- Deployment and host evidence in `docs/42-implemented-deployment.md` and
+  `docs/43-milestone-zero-host-validation.md`.
+- Milestone 1 package-ingestion and live API evidence in
+  `docs/44-milestone-one-package-ingestion.md`.
+- Milestone 2 library, detail, API and browser evidence in
+  `docs/45-milestone-two-library-explorer.md`.
+- Milestone 3 repository profile, PostgreSQL, API and browser evidence in
+  `docs/46-milestone-three-repository-profiles.md`.
+- Milestone 4 composer and production evidence in
+  `docs/47-milestone-four-guided-composer.md`.
+- Milestone 5 artifact, archive, PostgreSQL, security and browser evidence in
+  `docs/48-milestone-five-export-run-packs.md`.
+- Milestone 6 Gitea adapter, snapshot worker, persistence, outage and browser
+  evidence in `docs/49-milestone-six-gitea-repository-intelligence.md`.
+- Milestone 7 private package, quality evidence, publication, migration and
+  browser evidence in `docs/50-milestone-seven-prompt-lab.md`.
+
+## Validation evidence
+
+Post-audit Phase 9/10/11 additions through commit `3cf2167`:
+
+| Command/check | Result | Evidence |
+| --- | --- | --- |
+| Wrong-runtime preflight | PASS | Node 23.7.0 rejected; Node 24.14.0 with pnpm 10.33.0 accepted. |
+| Content regression repetition | PASS | Three consecutive runs, 21/21 each; no timeout or skip. |
+| Missing-database integration gate | PASS | No `DATABASE_URL` exits non-zero before Vitest. |
+| Disposable PostgreSQL 17 integration | PASS | Fresh isolated Unraid container, migrations applied, executed 33, skipped 0, failed 0; container verified removed. |
+| Job lease regression repetition | PASS | Three consecutive real-PostgreSQL runs, 3/3 each. |
+| Focused simple/project/identity tests | PASS | Four files, 14 tests; web typecheck passed. |
+| Security suite | PASS | Two files, 11/11 tests. |
+| Pack and golden contract | PASS | 28 P0, 6 examples, 72 catalog entries, 9 schemas and 28 byte-identical prompts. |
+| Production dependency audit | PASS | Zero advisories after the esbuild override. |
+| Direct uncached `pnpm verify` | PASS | Node 24.14.0/pnpm 10.33.0; all 14 package lint/typecheck scripts, unit suites, pack/golden contracts and production builds passed with exit 0 in 855,316 ms. |
+| Clean-room frozen install and verify | PASS | Detached checkout at `164fa49`, no copied dependencies/build output; frozen install succeeded and the direct gate passed with exit 0 in 585,617 ms. |
+| Gate cache/process safety | PASS | Release qualification now invokes package scripts directly through topological `pnpm -r`; stale Turbo cache reuse and a Windows post-build Turbo hang cannot produce release evidence. |
+| Phase 10 focused model/UI tests | PASS | Three focused files, 11/11 tests; web typecheck passed. |
+| Phase 10 live desktop browser | PASS | Isolated PostgreSQL-backed owner/project flow reached a ready usability task with ordinary task text and visible default provenance; no browser warnings/errors. |
+| Phase 10 live 390px browser | PASS | Start and simple composer had one `main`, no horizontal overflow and 44px primary/detail actions; task text and provenance remained readable. |
+| Phase 10 privacy-safe funnel contract | PASS | Two focused application tests plus application/database/web lint and typecheck; raw task text is rejected as a metric dimension. |
+| Phase 11 preference unit contracts | PASS | Application preference tests 3/3, schema tests 9/9 and Start ordering tests 8/8; 0, 5, 31 and 500 repository boundaries are covered. |
+| Phase 11 API/spec regression | PASS | Pack validation covers 28 P0 packages, 6 examples, 72 catalog entries and 9 schemas; all 28 reference prompts remain byte-identical. |
+| Phase 11 server PostgreSQL gate | PASS | Isolated PostgreSQL 17.9 on Unraid applied all nine migrations; the preference integration executed 2/2 with cross-workspace, missing and archived mutations denied. |
+| Phase 11 production build/replay | PASS | Node 24.18.0/pnpm 10.33 server build completed 14/14 packages. A fresh Compose volume then migrated with exit 0 after the PostgreSQL initialization health race was repaired. |
+| Phase 11 desktop browser | PASS | Live server flow created a real repository, persisted favorite state across refresh, created a simple draft, showed exact owner name/email/role and loaded the current session without console warnings/errors. |
+| Phase 11 mobile browser | PASS | At 390×844 Start retained one main landmark, 390px viewport with 375px content width, a 44px favorite action, persistent selection/favorite state and no console warnings/errors. |
+| Phase 12 presentation foundation | PASS | Server Node 24 checks: 7/7 preference/navigation tests, web lint, typecheck and production build; default Simple navigation, Dutch labels, Expert parity and viewer Management denial are covered. |
+| Phase 12 complete server gate | PASS | Unraid Node 24.18.0: formatting, all 14 package lint/typecheck scripts and all unit suites passed (web 227/227); the Compose production build completed 14/14 packages. The aggregate `pnpm verify` then stopped only because its Node image intentionally has no Python, so both Python gates were executed separately. |
+| Phase 12 pack and golden post-check | PASS | Unraid Python 3.13: 28 P0 packages, 6 examples, 72 catalog entries, 9 schemas and all 28 reference prompts verified. |
+| Phase 12 bilingual browser flow | PASS | Live PostgreSQL-backed Unraid flow created a real project and draft, matched Dutch search text, preserved draft `59b580b2-5d9c-4f04-a2a7-cb7f041a7263` across Dutch/English changes, and retained technical Expert navigation. |
+| Phase 12 navigation and mobile browser | PASS | My tasks, More and owner-only Management loaded in Dutch; at 390×844 the four mobile shortcuts remained visible and keyboard-addressable. A fresh post-favicon browser session reported zero errors and warnings. |
+| Phase 13 refresh vertical slice | PASS | Unraid Node 24.18.0: production Compose build 14/14 packages; web lint and typecheck passed; 50 files and 230 tests passed, including same-origin, invalid-ID, missing-idempotency-key and refresh-all boundaries. |
+| Phase 13 API post-check | PASS | Unraid Python 3.13 pack validation retained 28 P0 packages, 6 examples, 72 catalog entries and 9 schemas; all 28 golden prompts remain byte-identical. |
+| Phase 13 continuous-freshness gate | PASS | Unraid Node 24.13.0: formatting, 14/14 lint and typecheck packages, all unit suites and 14/14 production builds passed. Web retained 50 files and 230 tests; worker passed 18 tests. |
+| Phase 13 PostgreSQL scheduler gate | PASS | Fresh PostgreSQL 17.9 on Unraid applied all migrations; 35/35 integration tests executed with zero skips. A new scheduler instance produced one atomic job/snapshot pair and a same-bucket restart produced zero duplicates. |
+| Phase 13 live browser gate | PASS | Fresh production Compose on Unraid reached authenticated Dutch Start with the rebuilt worker active, correct progressive disclosure and zero browser warnings or errors. |
+
+Authoritative host: Unraid 7.2, Docker 27.5.1, Compose 2.40.3, Node.js 24.18.0
+container, PostgreSQL 17.9 container. The Windows workstation's Node.js 23.7.0
+is unsupported and is not release evidence.
+
+| Command/check | Result | Evidence |
+| --- | --- | --- |
+| `python3 scripts/validate_pack.py` | PASS | 28 P0, 6 examples, 72 catalog entries, 9 schemas, 28 goldens, 68 release fields. |
+| `python3 scripts/reference_compose.py --check` | PASS | All 28 reference prompts verified. |
+| Frozen `pnpm install` under Node 24.18.0 | PASS | Clean Git checkout without copied dependencies or build output. |
+| `pnpm verify` under Node 24.18.0 | PASS | Formatting, 13-workspace lint/typecheck, unit tests, pack checks, composer checks, and 13 builds. |
+| PostgreSQL integration gates | PASS | Six files and 15 tests; setup, import, composition, artifact, authorization, job, lease, retry, and reconnect coverage. |
+| `pnpm test:security` | PASS | 11 hostile-input, redaction, secret-at-rest, origin, and dependency-boundary tests. |
+| Production Compose build/start | PASS | Fresh migration; web, worker, and PostgreSQL healthy; non-root hardened services. |
+| First-run/authentication | PASS | Setup `201`, closure `409`, wrong login `401`, correct login/session `200`, logout revocation, reset/replay/expiry/session-revocation/rehash proof. |
+| Workspace authorization | PASS | Viewer/editor/owner permissions, disabled user, cross-workspace denial, and no admin bypass. |
+| Worker persistence | PASS | Safe health job succeeded; unsupported job failed safely; no duplicate after restart; stale lease covered by PostgreSQL test. |
+| `pnpm validate:m0-persistence` | PASS | Golden run and 6,806-byte artifact persisted and restored at SHA-256 `8389b948158cc35fa1716e170c9893bd3939dc3aaad9311971b6c267f835ae1b`. |
+| Full Compose restart | PASS | Readiness recovered; catalog, identity, run, and artifact remained; validation retries were idempotent. |
+| PostgreSQL outage/recovery | PASS | Readiness `503 database-unavailable`, liveness `200`; readiness returned to `200` after restart. |
+| Migration replay/failure | PASS | Initialized replay exited zero; unreachable test database exited non-zero visibly without a secret. |
+| Backup/restore drill | PASS | Logical dump and artifact archive restored into empty isolated volumes; run bytes and digest matched. |
+| Production log scan | PASS | Configured secret values, authorization headers, and bearer markers absent. |
+
+Milestone 1 authoritative additions at commit `b7dcb5d`:
+
+| Command/check | Result | Evidence |
+| --- | --- | --- |
+| Clean Node 24 `pnpm verify` | PASS | 13-workspace format/lint/typecheck/build, unit tests, 28 packages, 72 catalog entries, 9 schemas and 28 golden prompts. |
+| Content validation tests | PASS | Structured errors, invalid UTF-8, hardlinks, multi-package aggregation, catalog mismatch and duplicate identity. |
+| Catalog/import tests | PASS | SemVer ordering, lifecycle recommendation, exact history/version reads, idempotency and digest conflicts. |
+| Fresh PostgreSQL migration and replay | PASS | Empty PostgreSQL 17 volume migrated; post-test replay exited zero. |
+| `pnpm test:integration` | PASS | 3 files, 7 tests with database and artifact targets, including immutable published-version rejection. |
+| `pnpm test:security` | PASS | 2 files, 11 tests. |
+| Fresh production Compose | PASS | Worker inserted 28/28, web/worker/PostgreSQL healthy, exact-version route live. |
+| Worker restart | PASS | Zero inserts, 28 unchanged versions, healthy after restart. |
+| Live API matrix | PASS | 28 list items; combined search/filter exact match; detail/history/exact-version; invalid filter `422`. |
+| Production log scan | PASS | No configured secret values, authorization headers or bearer markers. |
+
+Milestone 2 authoritative additions at commit `3397226`:
+
+| Command/check | Result | Evidence |
+| --- | --- | --- |
+| Pack and reference composition checks | PASS | 28 P0, 6 examples, 72 catalog entries, 9 schemas, valid OpenAPI and 28 golden prompts. |
+| Database and web unit gates | PASS | Database 29 passed/3 optional integration skipped; web 80 passed. |
+| `pnpm test:security` | PASS | 2 files and 11 tests, including route/persistence dependency boundaries. |
+| Production Compose build/start | PASS | Final web/worker/migrate images built; web, worker and PostgreSQL healthy. |
+| Live API matrix | PASS | Auth boundary, 28 items, facets, search/filter, detail/version digest, favorites round-trip and origin rejection. |
+| Production Playwright matrix | PASS | 23 passed and 3 intentional skips across desktop and 390×844 narrow projects. |
+| Production log/boundary scan | PASS | No sensitive or stack patterns; web/worker non-root and read-only. |
+
+Milestone 3 authoritative additions through commit `76b28de`:
+
+| Command/check | Result | Evidence |
+| --- | --- | --- |
+| Repository intelligence package gates | PASS | Lint, typecheck, build and 23 focused tests; exact example digest remains `041e20f67e299665e85e5f14800a4bbcfa5e6c42ccdd7b22d29206e2c3f6727e`. |
+| Application repository gates | PASS | 13 files and 67 tests, including actor matrix, server-owned metadata, validation, ETags and export. |
+| Database repository gates | PASS | 41 unit tests plus 7 live PostgreSQL integration tests for atomicity, isolation, concurrency, no-op behavior and frozen snapshots. |
+| PostgreSQL 17.9 invariant drill on Unraid | PASS | Fresh 0000→0001→0002 SQL application; valid insert; invalid revision/digest rejection; immutable update rejection; cascade preservation; index-only workspace-list scan. Ephemeral container and test files removed. |
+| Pack and reference composition gates after schema changes | PASS | 28 P0, 6 examples, 72 catalog entries, 9 schemas and all 28 reference prompts remain valid. |
+| Production Compose and migration replay | PASS | Corrected runtime at `184af5c`; migrate completed twice, then web, worker and PostgreSQL were healthy. |
+| Live repository API matrix | PASS | Manual create, revision summary, ETag/no-op/append/conflict/precondition, JSON/YAML export and re-import, traversal and origin rejection. |
+| Production browser matrix | PASS | 4 passed, 2 duplicate-mutation skips across desktop and narrow projects; zero console/page errors. |
+| Restart, container and log evidence | PASS | Full-stack restart preserved 9 repositories/13 revisions; web/worker non-root and read-only; zero sensitive/error patterns. |
+
+Milestone 4 authoritative additions through commit `80b95bc`:
+
+| Command/check | Result | Evidence |
+| --- | --- | --- |
+| Integrated Node 24 `pnpm verify` | PASS | 14-workspace formatting, lint, typecheck, tests and build with isolated Python pack validation. |
+| Composer/application/web gates | PASS | 37 composer tests, 96 application tests and 132 web tests. |
+| Pack and golden contract | PASS | 28 P0, 6 examples, 72 catalog entries, 9 schemas and 28 byte-identical prompts. |
+| Live PostgreSQL and migration | PASS | Migration count 4; draft/source/history integrations green; existing repositories preserved. |
+| Production browser matrix | PASS | Exact handoff, autosave, lint gate, preview/provenance, immutable task, historical pinning, responsive matrix and zero console issues. |
+| Draft-linked generation | PASS | Run `a87ae11c-54b7-41c6-ba70-3a2d2a9aac0e` persisted exact source draft, digest and one creation audit event. |
+| Restart and security boundary | PASS | Run survived restart; services non-root/read-only/cap-drop/no-new-privileges; zero sensitive log patterns. |
+
+Milestone 5 authoritative additions through commit `5ba0caf`:
+
+| Command/check | Result | Evidence |
+| --- | --- | --- |
+| Integrated Node 24 verification | PASS | 14-workspace formatting, lint, typecheck, tests and production build; focused mobile regression test also passed after the live defect repair. |
+| Artifact/application/web gates | PASS | 23 artifact, 100 application and 147 web tests, including 18 hostile/deterministic archive cases. |
+| Pack and golden contract | PASS | 28 P0, 6 examples, 72 catalog entries, 9 schemas and all 28 production prompts remain byte-identical. |
+| Live PostgreSQL artifact integration | PASS | 6 focused files and 17 tests; three production-created artifact rows retained exact sizes, hashes and valid expiry. |
+| Production export/import flow | PASS | Exact copy plus Markdown, ZIP and AGENTS creation; downloaded ZIP verified against the immutable historical run without extraction. |
+| Restart and download persistence | PASS | Web/worker recreation preserved the run, artifact count and all three authorized download rows. |
+| Responsive/browser gate | PASS | 390, 768, 1024, 1440 and 2560 widths without overflow after the status-digest regression repair; zero console entries. |
+| Runtime security boundary | PASS | Non-root, read-only, all capabilities dropped, `no-new-privileges`; zero token, password or error log matches. |
+
+Milestone 6 authoritative additions through commit `0af5254`:
+
+| Command/check | Result | Evidence |
+| --- | --- | --- |
+| Clean Node 24 quality gate | PASS | Formatting, lint and typecheck across 14 workspaces; all unit tests; 14 production builds; 11 security tests. |
+| Pack and golden contract | PASS | Clean Python 3.12 validation of 28 P0 packages, 6 examples, 72 catalog entries, 9 schemas and 28 byte-identical prompts. |
+| Live PostgreSQL integration | PASS | Focused Gitea persistence test, including encrypted projection, workspace isolation, snapshot status and retention. |
+| Live Gitea pipeline | PASS | Gitea 1.27.0 capability probe, one-item discovery, `202` import, worker completion, evidence digest, finding and immutable profile revision. |
+| Outage and deletion continuity | PASS | Imported state remained visible with discovery offline; after integration deletion, one repository, one complete snapshot and one profile revision remained and both local APIs returned `200`. |
+| Responsive browser gate | PASS | Healthy and unavailable states, safe token suffix, imported repository and retained snapshot rendered; 390 by 844 had no horizontal overflow. |
+| Runtime security boundary | PASS | Web/worker healthy, non-root, read-only and capability-dropped; secret/header log scan passed; temporary fixture resources removed. |
+
+Milestone 7 authoritative additions through commit `07cba0f`:
+
+| Command/check | Result | Evidence |
+| --- | --- | --- |
+| Clean Node 24 quality gate | PASS | Formatting, lint, typecheck, all unit tests, 14 production builds and the configured security suite. |
+| Pack and golden contract | PASS | Clean Python 3.12 validation of 28 P0 packages, 6 examples, 72 catalog entries, 9 schemas and 28 byte-identical prompts. |
+| Fresh PostgreSQL integration | PASS | Migrations `0000` through `0006`; private draft, package-file and publication/evaluation persistence suites passed. |
+| Production authoring flow | PASS | ZIP import, exact-path invalid edit, reset, exact-digest review, immutable publication, coherent next-version creation and deterministic export. |
+| Example reproduction | PASS | Stored example rendered twice through the production composer with a byte-identical repeat and persisted render digest. |
+| Responsive browser gate | PASS | 390, 768, 1024, 1440 and 2560 widths without overflow; fresh-tab console log was empty after the hydration repair. |
+| Migration and restart boundary | PASS | Corrected `0005` trigger ordering applied; `0006` applied; web recreation retained draft/publication/version evidence; services healthy. |
+
+Milestone 8 release-candidate additions through commit `3b255f3`:
+
+| Command/check | Result | Evidence |
+| --- | --- | --- |
+| Node 24 quality gate | PASS | Formatting, lint and typecheck each completed across 14 workspaces; 25/25 test tasks passed, including 212 web, 160 application, 97 database unit and 16 worker tests; security suite 11/11. |
+| Fresh PostgreSQL integration | PASS | Eight migrations applied to a disposable PostgreSQL 17 database; 15 files and 33 integration tests passed for invitations, sessions, personal data, collections, operations, immutable audit and existing persistence contracts. |
+| Pack and golden contract | PASS | Python 3.12 validated 28 P0 packages, 6 examples, 72 catalog entries, 9 schemas and all 28 byte-identical production prompt fixtures. |
+| Operations and identity | PASS | Authorized queue/audit console, safe retry, sessions, single-use invitations, password-confirmed personal export/deletion, collections and bounded artifact retention are implemented and tested. |
+| Backup and restore | PASS | Backup `pre-m8-b2fb5a5` passed strict checksums; isolated restore applied migration `0007`, matched users/runs/artifacts/audit/migration counts and reproduced all artifact SHA-256 values before exact temporary-resource removal. |
+| Clean-room installation | PASS | Independent project `devrunbook-release-cleanroom-56cbbab` built from the documented Compose path, applied all eight migrations, completed protected setup (`201`, repeat `409`), imported 28/28 built-ins, passed preflight/readiness and remained healthy after restart. Temporary project resources were then removed. |
+| Performance | PASS | Deterministic 10,000-version fixture, 30 iterations: search P95 241.913 ms against 500 ms target; detail P95 24.469 ms against 400 ms target. See `evidence/performance-report.json`. |
+| Security and supply chain | PASS | Production audit has no high/critical dependency findings; final web and worker images have zero high/critical Trivy findings; Gitleaks found no leaks across 153 commits; 161 production package records have classified licenses. |
+| Production browser | PASS | Collections create/membership, operations safe failures/audit, invitation generic failure, desktop and 390 by 844 layouts were exercised. A narrow Operations overflow was found and repaired; the fresh verification tab had zero warnings/errors. |
+| Host-capacity recovery | PASS | Repeated release builds exhausted unused Docker build cache. PostgreSQL completed crash recovery after space was reclaimed; the worker was explicitly restarted, resynchronized 28 unchanged built-ins and returned healthy. No application volume was removed. |
+
+## Browser verification
+
+- The 2026-07-29 Unraid consolidation replaced 23 accumulated DevRunbook
+  validation and production containers with one healthy `DevRunbook` DockerMan
+  container. A restored production backup was first verified on port 23004,
+  including 2 users, 43 repository profiles and both health endpoints. The
+  final port-1231 container retained authenticated access and Gitea project
+  selection after a container restart, with zero browser warnings or errors.
+  DockerMan metadata includes the WebUI URL and the installed DevRunbook SVG
+  icon.
+
+- The 2026-07-28 production re-audit verified authenticated library search and
+  URL state, all seven primary application surfaces, a governed composer draft
+  with live deterministic preview and blocking lint, explicit Gitea degraded
+  state, Ctrl+K command palette behavior and theme switching. Desktop Library
+  and Composer plus all primary routes at 390 by 844 had no horizontal page
+  overflow, and the browser console contained zero warnings or errors. See
+  `evidence/functional-visual-audit-2026-07-28.md`.
+
+- Live Unraid home page loaded 28 persisted built-ins without Gitea.
+- Setup remained closed and displayed `Instance ready` after restart.
+- Invalid local login used a generic failure and cleared the password field.
+- The `root-cause-bugfix` detail displayed the persisted package identity and
+  source digest.
+- At 390 by 844 there was no horizontal overflow; semantic form and navigation
+  roles remained present.
+- Browser console warnings and errors: zero.
+- The canonical Playwright suite covers keyboard focus, reduced-motion,
+  responsive, security-header, setup, login, and recovery behavior.
+- Milestone 1 rechecked the live Root-Cause Bug Fix detail and its immutable
+  version/digest at 390 by 844 with no horizontal overflow and zero browser
+  warnings or errors.
+- Milestone 2 verified URL-preserved search/filter/view state, favorites,
+  complete detail governance, composer handoff, command palette, themes,
+  keyboard behavior and horizontal-overflow absence in desktop and 390×844
+  production projects. The final matrix passed 23 tests with 3 documented
+  environment/isolation skips.
+- Milestone 3 verified manual repository creation, immutable editing,
+  protected-path and inert-command display, export/re-import, composer context,
+  keyboard/theme/reduced-motion behavior and horizontal-overflow absence. The
+  production matrix passed 4 tests with 2 deliberate duplicate-mutation skips.
+- Milestone 4 verified the production guided composer at 390, 768, 1024,
+  1440 and 2560 widths, exact historical profile pinning, live preview,
+  immutable generation and restart persistence with zero browser console issues.
+- Milestone 5 verified exact prompt copy, three persisted export formats,
+  historical Run Pack re-import without extraction, download history after
+  container recreation and the same five-width responsive matrix with zero
+  browser console entries.
+- Milestone 6 verified safe Gitea connection metadata, repository discovery and
+  import, worker-completed snapshot/profile creation, explicit offline state,
+  retained local profile use and 390-pixel responsive layout.
+- Milestone 7 verified package import, path-linked validation recovery,
+  exact-digest review, immutable publication, next-version creation and stored
+  example reproduction. The Prompt Lab passed 390, 768, 1024, 1440 and 2560
+  widths without horizontal overflow; a fresh tab had zero console messages.
+- Milestone 8 verified personal collection creation and membership, operations
+  queue/audit rendering, safe invalid-invitation feedback and the new navigation
+  entries on the live Unraid release candidate. Collections and Operations were
+  checked at desktop and 390 by 844; the final tab had zero console messages.
+
+## Migrations and configuration
+
+- Nine forward migrations are authored. Migration `0003` adds governed draft
+  revision/output state and mandatory generated-run idempotency; migration
+  `0004` hardens Gitea persistence, secret envelopes and snapshot integrity;
+  `0005` adds private package drafts/files, `0006` adds immutable quality,
+  review and publication evidence, `0007` adds personal collections and `0008`
+  adds workspace/user-scoped repository preferences. All nine pass fresh
+  PostgreSQL 17.9 application and production replay on Unraid.
+- Production Compose keeps baked built-ins separate from persistent operator
+  content, artifacts, and database volumes.
+- Unraid DockerMan can alternatively use the `all-in-one` image target. Its
+  private PostgreSQL database, artifacts and operator content share the single
+  `/config` persistence boundary; only HTTP port 3000 is published.
+- The installed DockerMan template uses a cached PNG icon through DockerMan's
+  `file://` convention and exposes managed-container, shell and WebUI metadata.
+- The secure validation environment file is mode `0600`; no values are recorded
+  in repository evidence.
+- Ordinary backups intentionally exclude session and encryption keys. Operators
+  must preserve those separately.
+
+## Risks and limitations
+
+- Release qualification was exercised on `linux/amd64`; other architectures are
+  not claimed by this release evidence.
+- The live validation stack and backup evidence remain in the restricted Unraid
+  validation directory. Temporary restore resources were removed.
+- Gitea remains deliberately read-only and optional. No GitHub/GitLab adapters,
+  arbitrary command execution, semantic search or scheduled remote health
+  monitoring are included in the MVP.
+- Operational log rotation is configured in the Docker logging layer; audit
+  pruning is intentionally manual until append-only governance and backup
+  policy are reconciled.
+- The former transitive `esbuild` advisory was removed through the governed
+  package override; the latest recorded production dependency audit reports
+  zero advisories.
+- The shared validation host approached Docker storage capacity during repeated
+  image builds. Only unused build cache was pruned; operators should monitor
+  Docker storage so PostgreSQL always retains write headroom.
+
+## Active delegated work
+
+- No delegated work remains active. The lead thread integrated and validated
+  all Milestone 8 slices in the canonical branch.
+
+## Next action
+
+Post-audit Phases 14 through 16 are complete. Review the recorded evidence and
+create a release tag only after explicit operator approval; no tag was created
+automatically.
+
+## Usability recovery — active 2026-07-30
+
+The operator accepted `docs/52-usability-recovery-roadmap.md` after a live
+visual audit showed that technical qualification had not produced a sufficiently
+readable product. Phase A is active. Its first slice standardizes authenticated
+navigation around tasks and projects, localizes command labels, introduces
+unique primary-route metadata, and reduces Task library density. Server and
+browser evidence will be added before this phase is declared complete.
+
+First-slice evidence: on Unraid Node 24, Prettier, web lint and web typecheck
+passed; the web unit suite executed 51 files and 233 tests with zero failures;
+the all-in-one production Docker build completed all 14 package builds. The
+candidate was deployed at a private validation host, reported ready and healthy,
+and retained its `/config` data, LAN port and DockerMan labels. The new
+authenticated browser regression could not log in because the stored validation
+credential no longer matches the active account (HTTP 403). No account password
+was changed. Phase A therefore remains active pending authenticated browser
+evidence and the remaining primary-page localization work.
+
+The next continuous slice localized the Projects overview and task-history
+recovery, added a bounded case-insensitive project-name query across UI, API,
+application and PostgreSQL store, and moved dense project evidence behind a
+technical-details disclosure on project detail. Unraid validation passed all
+14-package lint and typecheck tasks, 51 web test files with 233 tests, pack
+validation and all 28 golden prompt checks. The production all-in-one image was
+rebuilt and the single DockerMan container returned healthy and ready with its
+existing persistence and LAN mapping.
+
+The final usability-recovery slice completed the generated-task and task-history
+surfaces. Generated tasks now use locale-aware ordinary-language headings and
+actions, keep immutable status explicit, and move provenance, prompt details and
+technical evidence behind disclosures. Task history now supports bounded search,
+readiness filtering, localized status summaries, result counts and distinct empty
+and no-match recovery paths.
+
+Final Unraid evidence on 2026-07-30: repository format, all 14 lint tasks, all 14
+typecheck tasks, all unit suites and all 14 production builds passed. The focused
+web suite passed 51 files and 233 tests; security passed 11 tests; the production
+dependency audit found no known vulnerabilities. A fresh PostgreSQL 17.9 database
+applied all migrations and executed 36 integration tests with zero skips or
+failures. Pack validation covered 28 P0 packages, 6 examples, 72 catalog entries
+and 9 schemas, and all 28 golden prompts remained byte-identical.
+
+The release image was built and deployed on the Unraid server. Exactly one
+`DevRunbook` container is present, reports healthy and ready on a private
+validation port,
+retains `/mnt/user/appdata/devrunbook:/config`, and exposes the DockerMan managed,
+WebUI and local-icon labels. A live Chrome check found no horizontal overflow at
+390 by 844, 50-pixel login fields, a 52-pixel primary action and zero console
+warnings or errors. Public home/start routing and the login surface were visually
+checked. Authenticated production browser replay remains unavailable because the
+stored validation credential no longer matches the operator account; no password,
+account or production data was changed to manufacture a green browser result.
+
+## Post-audit Phases 14–16 — 2026-07-30
+
+- Completed scope: single-main authenticated landmarks, named compact controls,
+  accessible light/dark contrast, keyboard/touch/reflow/reduced-motion checks,
+  human-readable operations status, storage and backup evidence, hardened
+  Compose limits, HTTPS/security headers and final release qualification.
+- Changed modules: authenticated pages and shell controls, operations service/UI,
+  PostgreSQL system-status store, Compose/Next configuration, deployment and
+  operator documentation, Playwright accessibility coverage and migration
+  readiness/preflight constants.
+- Server gates: Node 24 format, lint, typecheck, unit and production build passed;
+  fresh PostgreSQL 17.9 migration plus integration gate executed 36, skipped 0,
+  failed 0. Security tests and production dependency audit were included in the
+  final verification command.
+- Browser evidence: production Compose on Unraid passed 24/24 Phase 14 tests
+  across desktop and 390-pixel projects for Start, composer, Projects, My tasks,
+  account and Management, with no serious/critical Axe findings. The existing
+  repository creation/edit/context handoff flow also passed after regression
+  repair.
+- Deployment evidence: web and worker report read-only root filesystems,
+  `CapDrop=[ALL]`, PID limit 256, 1 GiB memory and 64 MiB `/tmp` tmpfs. HSTS,
+  frame/CSP protection and suppressed framework disclosure were observed.
+- Recovery evidence: restart preserved 1 owner and 28 built-ins and returned
+  readiness to `ready`; an isolated pg_dump restore matched 1 owner, 28
+  playbooks and 9 migration rows. Restore database and dump were removed.
+- Migration/configuration: no new migration was introduced. Readiness and
+  migration preflight now correctly expect the existing nine migrations.
+- Remaining limitation: qualification is `linux/amd64`; HTTPS termination and
+  off-host backup scheduling remain operator infrastructure responsibilities.
+- Next milestone: optional Phase 17 Codex-native exports, only after operator
+  release approval. No release tag has been created.
+
+## Usability follow-up audit — 2026-08-01
+
+- Completed scope: localized every shared authenticated shell control, the Dutch
+  expert navigation, account preferences, password/session management, new-project
+  entry and workspace-management denial. Account and security routes now receive
+  the common command set by default instead of opening an empty search dialog.
+- Role clarity: owner, editor and viewer labels use ordinary language. Viewers no
+  longer receive the write-only advanced composition destination in expert
+  navigation or search. An empty viewer workspace explains who can add a project
+  and links to the readable Projects overview instead of offering an unauthorized
+  Gitea action. Editor and viewer denial states preserve context and recovery.
+- Changed modules: authenticated presentation/layout, shared shell, workspace,
+  account, theme and command controls, account/security pages, management and
+  new-project entry, Start copy/empty state, plus localization and browser
+  regression suites. No schema, migration or runtime configuration changed.
+- Server gates: the final Linux/Node 24 candidate passed formatting, all
+  repository lint and typecheck tasks, all unit suites (including 52 web files
+  and 235 web tests), pack validation for 28 P0 packages, 6 examples and 72
+  catalog entries, all 28 byte-identical golden prompts, all 14 production
+  builds, 11 security tests and the production dependency audit with zero known
+  vulnerabilities. A fresh PostgreSQL 17.9 run applied migrations and executed
+  36 integration tests with zero skips or failures.
+- Browser evidence: an isolated all-in-one image on the Unraid server was set up
+  from a clean volume and exercised as a new owner plus invited editor and viewer.
+  Invalid login, empty workspace, account, sessions, management denial,
+  new-project rights, simple/expert, Dutch/English, keyboard mobile navigation,
+  390-pixel mobile, 640-pixel 200%-equivalent reflow and desktop presentation
+  were inspected. The final browser had no horizontal overflow and zero console
+  warnings or errors. The focused Chromium/Axe matrix passed 17/17 scenarios on
+  eight critical authenticated routes with no serious accessibility findings.
+- Remaining boundary: the active-workspace control intentionally exposes only the
+  deterministic current membership; selecting among multiple memberships is not
+  implemented by the current authorization lookup. Advanced repository-profile
+  and integration authoring retain canonical technical/English contract labels.
+  Public first-run setup, login and invitation acceptance also remain English; the
+  authenticated primary navigation, explanations, rights and recovery are
+  localized. These are explicit future product capabilities, not hidden
+  fallbacks in this release.
+- Deployment evidence: commit 5b8d207 was pushed to origin/main and its
+  verified all-in-one image replaced production with automatic rollback protection.
+  Exactly one DevRunbook container remains, is healthy and ready on LAN port
+  1231, retains /mnt/user/appdata/devrunbook:/config, and exposes the DockerMan
+  managed, shell, WebUI and local-icon labels. Temporary candidate, gate and
+  PostgreSQL resources were removed.
+- Next action: create a release tag only after explicit operator approval.
+
+## Complete usability closure — 2026-08-12
+
+- Completed scope: the public home, setup, login, invitation and password-reset
+  journeys now follow Dutch or English presentation preferences; compact language
+  controls use an authoritative same-origin cookie endpoint. On narrow screens the
+  actionable form precedes explanatory copy. Sign-out and Gitea connection tests
+  remain inside the application and expose accessible failures instead of raw API
+  responses.
+- Workspace and role clarity: every active authorized membership is selectable.
+  The server re-authorizes the preference on every request and falls back safely
+  when it is missing, stale or unauthorized. Owner, editor and viewer flows were
+  exercised with two memberships each; write and management destinations remain
+  permission-aware.
+- Expert usability: repository-profile and Gitea authoring now localize primary
+  labels, explanations, policy values and status feedback while preserving exact
+  canonical contract values in requests and stored profiles.
+- Changed modules: public presentation and authentication pages, locale and
+  workspace preference endpoints, application workspace queries, authenticated
+  layout and shell, repository-profile and integration presentation, plus focused
+  unit and browser regression coverage. No schema or migration changed.
+- Verification: format, all 14 lint and typecheck tasks, unit suites including 53
+  web files and 242 web tests, all 14 production builds and 11 security tests pass.
+  Pack validation still covers 28 P0 packages, 6 examples, 72 catalog entries and
+  9 schemas; all 28 golden prompts are byte-identical. The production dependency
+  audit has zero known vulnerabilities after pinning patched `fast-uri` and
+  `nanoid` transitives. A fresh PostgreSQL 17.9 gate executes all 36 integration
+  tests with zero skips or failures.
+- Browser evidence: an isolated all-in-one server candidate was exercised as a
+  new owner plus invited editor and viewer across both workspaces. Public NL/EN,
+  invalid invitation/reset recovery, sign-out, workspace switching, management
+  denial and expert authoring were checked at desktop and 390 by 844 without
+  horizontal overflow. The focused Chromium/Axe matrix passed 17/17 scenarios on
+  eight critical routes at desktop, mobile and 200%-equivalent reflow.
+- Deployment: the verified all-in-one image is deployed as the sole `DevRunbook`
+  container, healthy and ready on a private validation port with the persistent `/config`
+  mount and DockerMan managed, shell, WebUI and local-icon labels. Temporary
+  candidate and gate resources were removed after qualification.
+- Remaining infrastructure boundary: qualification remains `linux/amd64`; HTTPS
+  termination and off-host backup scheduling are operator responsibilities. No
+  release tag was created.
+
+## Deep presentation follow-up — 2026-08-12
+
+- Completed scope: closed remaining mixed-language presentation on Collections,
+  complete playbook details and favorite actions, technical repository evidence,
+  the advanced composer, Prompt Lab overview/import and Operations. Dutch and
+  English now share the same interaction and safety boundaries; canonical policy,
+  mode, lifecycle and autonomy values remain unchanged in requests and storage.
+- Interaction quality: collection creation and optimistic membership rollback
+  announce localized outcomes; composer conflicts, expired sessions, preview
+  readiness and blocking reasons stay actionable; Operations formats dates and
+  sizes for the selected locale and reuses formatters across rows.
+- Changed modules: collection, playbook-detail, repository-detail, composer,
+  Prompt Lab and Operations pages/components plus their focused presentation and
+  contract tests. No schema, migration, API contract or stored content changed.
+- Verification: Node 24 formatting, all 14 lint and typecheck tasks, all unit
+  suites including 54 web files and 244 web tests, all 14 production builds,
+  11 security tests and the production dependency audit pass with zero known
+  vulnerabilities. Pack validation and all 28 golden prompt fixtures remain
+  valid and byte-identical. A fresh PostgreSQL 17.9 database applied all nine
+  migrations and executed 36/36 integration tests with zero skips or failures.
+- Live evidence: the exact server-built `devrunbook:ux-audit-v9` image replaced
+  v8 with automatic rollback protection. Production is healthy and ready on LAN
+  validation port. A 390 by 844 live Chrome check confirmed Dutch login/recovery copy,
+  no horizontal overflow and zero console warnings or errors. Authenticated
+  presentation changes are covered by the exact Linux build, unit contracts and
+  the previously qualified role/accessibility flows; no production credential
+  was changed to manufacture a signed-in replay.
+- Deployment shape: exactly one `DevRunbook` container remains with the persistent
+  `/config` mount and DockerMan managed, shell, WebUI and local-icon labels.
+
+## Public-repository consolidation — 2026-08-31
+
+- Consolidated the later recovery branch into the publication candidate so the
+  Dutch/English onboarding, setup, login, invitation/reset, workspace selection
+  and plain-language presentation work are no longer stranded on a side branch.
+- Replaced the implementation-pack landing page with a user-oriented README and
+  documented the difference between historical build-pack version 1.2 and
+  application version 0.1.
+- Removed private validation addresses from the current tree. Historical commits
+  still contain those addresses and three work-email author records; the
+  recommended public-history decision is recorded in
+  `docs/PUBLICATION_READINESS.md` without rewriting shared history.
+- Hardened deployment defaults: development and production web ports bind to
+  host loopback, production requires an explicit `PUBLIC_BASE_URL`, and the
+  development stack no longer contains a shared first-run bootstrap token.
+- Added a 16 KiB streaming limit to the unauthenticated setup request before JSON
+  parsing, including declared-length and streamed-overflow regression tests.
+- Replaced the ineffective Gitea placeholder validation with Node 24, pinned
+  pnpm, PostgreSQL-backed unit/integration/security gates. Automatic Unraid
+  deployment now depends on the same exact-revision publication gates.
+- Corrected security and configuration documentation that incorrectly described
+  the implemented application as an undeployed archive or claimed enforcement
+  for reserved proxy/CIDR settings.
+- Local evidence at this point: both Python contract validators pass, the focused
+  setup-body suite passes 3/3, Compose renders successfully with fixture secrets,
+  `git diff --check` passes and Gitleaks found no secret across 207 commits.
+  Final Node 24, PostgreSQL, security and audit authority remains the managed
+  Gitea run for the final candidate commit.