Merge branch 'unstable' into area/client-reliability

docs/agents/backlog/playback-qa-2.json

@@ -0,0 +1,9 @@
+{
+  "id": "playback-qa-2",
+  "area": "playback-qa",
+  "status": "open",
+  "title": "Capture actual-app local core-flow/mobile baseline before UI changes",
+  "blockedOn": null,
+  "addedOn": "2026-10-20",
+  "filedAt": "1bb3a4fc452969f060c09a286b72b8cd7ac4123e"
+}

docs/agents/prompts/client-reliability.md

@@ -1,10 +1,12 @@
 # Area: Client reliability (client-reliability)
 
-## Current assignment: client-reliability-6 — profile history wiring audit
+## Current assignment: client-reliability-6 — retain actual history wiring regression
 
-Owner continuing quality objective is in GOAL/PROGRAM; use fleet/QUALITY.md. Item5 done0bd0b1c3/closuredc852597. Claim item6,merge verified unstable non-destructively,read current rules/KNOWN_ISSUES/test integrity. High-priority TODO2 explicitly asks profile-pane remove wiring regression. Current controller comment says no-op onHistoryReady override was removed; current history-pane test injects fake renderer and validates lazy init,not real remove. Revalidate whole test corpus before assuming a gap.
+Investigation complete:actual profile→real renderer→DOM remove→real controller/service works locally and through fake synced publish/read. Historical no-op override resurrects removal while existing profile27 tests still pass (worker evidence). Dispatch independently ran local/synced actual wiring exit0 and historical-noop local exit1 after cleanup. No current product failure established.
 
-Investigation/scratch/evidence only now: trace actual ProfileModalController→createWatchHistoryRenderer→default removal→history controller/service with controlled local state/IO; verify local-only delete/clear and synced callback options only through fake publish boundary,no signer/relay/private data. Prove what current assertions cover and whether historical no-op override would escape them. Prefer actual wiring invocation over source-string assertions. Classify a remaining product failure separately from missing regression; send exact HEAD/commands/counts/reproduction or mutant result,proposed smallest retained test/fix scope. If already covered,close audit with evidence and next priority. No product or committed test changes until dispatch routes scope; no app/history service/cache ownership expansion. Your existing profile modal modules/tests read-only for investigation;unique notes/backlog allowed. QA owns full/normal gate;cheap focused checks only,no browser/build/full gate. No subagents/kit/scheduler/cloud/real signer/wallet/production activity. Send immediate read+next-action,then blocker/completion;keep .task current.
+Test-only retention now authorized: own new tests/profile-history-removal-wiring.test.mjs plus unique integrity/evidence/backlog. No product or existing profile-suite edits. Use actual profile config/factory,renderer,DOM remove,controller/local service;fake only persistence/publish IO and metadata boundaries. Retain local delete+clear+renderer recreation,zero local publishes;synced remove reduced-list replace:true/actor/real recreation through fake publish/read;separate assertions catch historical no-op. Explicitly distinguish any not-yet-proven synced-clear path and report real failure before product routing. Fixture cleanup restores globals/app/module state and blocks network/signers/relays. No source-string or merely config-presence test.
+
+New scenarios need restored failing mutants (historical no-op must kill real wiring cases);no sleeps/retries/expectation weakening. Relevant focused lower-layer/profile suites and lint;request full normal slot after ready. QA now gets bounded actual-app mobile browser baseline after old QA gate ends,so no browser/full/build until dispatch grant. Commit item6,merge verified unstable,normal unchanged full gate/durable ancestry before close. Metadata can be claimed now landed. No app/history service/cache/product scope or new feature authority. Send ready/blocker/landing/final events.
 
 ## Archived completed assignment: client-reliability-5 — prevent orphaned mirror continuation
 

docs/agents/prompts/playback-qa.md

@@ -1,6 +1,14 @@
 # Area: Playback fallback QA (playback-qa)
 
-## Assignment: playback-qa-1
+## Current assignment: playback-qa-2 — actual-app local core/mobile baseline
+
+Old QA1 prepared output independently verified64143f42→1bb3a4fc(normal gate0),dispatch retained regression4/4;finish old docs closure/final evidence,then claim QA2. The full/gate slot is released;no old regression/full/browser reruns. Ongoing owner goal is in QUALITY/GOAL/PROGRAM.
+
+New bounded baseline uses actual app,existing docs/testing/agent-playwright-harness.md and tests/e2e/helpers/bitvidTestFixture.ts/local mock relay on private ports. Read KNOWN_ISSUES first. Do one controlled Chromium pass at360x800,390x844,1280x720:feed initial load/navigation (Home/Explore/ForYou where applicable),open/close Profile and Upload,card controls/touch targets/horizontal overflow/focus/required-field validation. Use local synthetic notes,test-only identities from existing harness only if needed;no real signer/peers/cloud/public media/credential access and no publishing outside local relay. Block/log all non-local HTTP/WebSocket attempts. If app cannot boot offline with existing harness,record exact blocker before substituting app/module behavior;do not call a module harness an actual-app pass.
+
+Investigation/evidence only,no product/CSS/token/helper/config/existing test edits or speculative redesign. Own scratch/QA notes/backlog only until dispatch routes a reproduced issue or useful retained scenario. Report actual viewport/flow checklist,evidence/screenshots,console/network failures and exact reproduction for any defect;distinguish known Firefox/test fixture issue from product bug. No broad E2E or build now. Browser-ONLY resource slot GRANTED after acknowledging old release/starting new baseline;record .task BEFORE opening,send starting event and close own private server/browser after this single pass or first hard blocker. No full-suite/normal submission for new task until ready+explicit slot;other workers may focused-test only while your browser run. Firefox followup only on specific parity/reproduction need after reporting. Do not repeat prior no-clearance intervention.
+
+## Archived completed assignment: playback-qa-1
 
 Independent regression/browser QA slice of pre-launch TODO34/performance-efficiency-plan Stage3 acceptance: dead hosted source falls back to viable torrent/mirror. Recent queued-probe fixes89ccb907/7d20a509 have controlled health lifecycle qualification but real playback fallback remains explicitly unverified. Existing webseed-playback.spec.ts uses public archive media and tolerates decode failure; do not modify or treat that as real offline success.
 

docs/agents/prompts/storage-cors.md

@@ -1,12 +1,14 @@
 # Area: Storage CORS reliability (storage-cors)
 
-## Current assignment: storage-cors-2 — remaining storage/delete safety audit
+## Current assignment: storage-cors-2 — best-effort cleanup metadata guard
 
-Storage item1 doneproductd3f4c215/closure7f99c045. Latest interpreter checkpoint14:57:03 steers this existing worker toward remaining todo/TODO_2026-06-16_r2-followups.md and current upload/delete safety. Earlier feed/view audit is deferred as storage-cors-3,not cancelled;preserve any scratch notes. Claim item2,merge verified unstable,read GOAL/PROGRAM/QUALITY/RULE-CHANGES/KNOWN_ISSUES and docs/lessons/cloudflare-s3-upload-gotchas.md.
+Investigation independently confirmed by dispatch:actual R2Service.resolveConnection→StorageService metadata→deleteVideoStorage rejects2 malformed cached cases(bucket number/publicBaseUrl object),6 controls pass,zero network attempts. /tmp/bitvid-dispatch-delete-audit.mjs exit1(expected0 rejections,actual2) after controls. App/edit callers catch this,so do not claim note deletion itself blocked. Best-effort/no-throw cleanup contract is violated.
 
-Bounded investigation only:validate current deleteVideoStorage best-effort/no-throw/owner-bucket invariant and remaining cleanup followups at actual service/caller boundary. Dispatch inspected settings/npub .trim calls before catch in r2Service:potential malformed cached connection/metadata boundary is evidence to check,not a presumed active bug. Inspect existing delete/storage-key tests and call normalization first;construct real service offline scenario with fake SDK/delete transport,valid owned/external URL controls and meaningful malformed/locked/partial-failure cases. Characterize existing all-versions/thumbnail followups without inventing retention/deletion policy. If no current defect,give evidence and choose one current managed-domain/idempotency followup from same backlog via actual callgraph;stop after one bounded actionable result or documented already-covered outcome.
+Temporary explicit product ownership for this item overrides prior roster exclusion ONLY for deleteVideoStorage in js/services/r2Service.js,plus new focused tests/storage-delete-malformed-settings.test.mjs and unique integrity/evidence. Normalize only primitive strings/validate malformed fields safely;preserve structured skip/result semantics,never coerce arbitrary objects into URL/credentials,never widen owner base or content-addressed key collection. Cover malformed cached resolution and meaningful direct caller/settings types,valid owned/external+prefix-sibling,locked/external,partial failure and generic-S3/provider controls. No blanket catch masking valid-operation failures without structured result. No real SDK/cloud/delete calls.
 
-R2Service.deleteVideoStorage must stay best-effort,never throw,and never delete outside owner bucket. r2Service/s3UploadService are mirrored copies;any later fix would require explicit symmetric scope. For NOW all product/existing tests/read-only including js/services/r2Service.js,s3UploadService.js,storagePointer and storage/r2-mgmt.js. No real delete,cloud/provider credentials,public requests,signer/wallet/private data or app edits. Scratch/evidence/own backlog and docs/testing/storage-cors-* only;report exact HEAD/command/counts,fidelity and smallest proposed test/fix scope before product/committed regression changes. QA owns full/normal slot;cheap focused local checks only,no browser/full/build. Send immediate corrected read+next-action,then evidence/blocker;keep .task current. No new agents/features/kit/scheduler changes.
+Mirror rule decision from actual code:duplicated upload hashing/magnet logic stays untouched in BOTH services. s3UploadService has NO deleteVideoStorage counterpart (dispatch rg verified);the existing provider-aware R2Service delete method already handles genericS3. Do not add a duplicate delete implementation or unrelated upload edits merely to touch two files. Explain this in integrity/decision evidence and prove both supported provider paths;if a duplicated affected counterpart is found,route before edits. No s3UploadService write without that evidence.
+
+Read test integrity;new retained real-service regression must reject old helper (all affected malformed cases),mutants restored. Focused existing delete/key suites+lint/build;no full/browser until dispatch slot. QA actual-app baseline gets next bounded browser slot;you may implement/focused now. Commit item2,merge verified unstable,normal full gate/durable ancestry then close. No upload/CORS/retention-policy/features/owner-bucket behavior changes. Feed audit deferred3,not cancelled. Send ready/blocker/landing/final with exact claims and limits.
 
 ## Archived completed assignment: storage-cors-1 — preservation fix routed
 

fleet/LOG.md

@@ -100,3 +100,10 @@
 - Existing client worker item6 assigned profile-history actual-removal wiring gap from TODO2;existing storage worker item2 temporarily lent to independent feed/view tombstone gap TODO1. Investigation/evidence only before routing,cheap focused checks while QA full/normal slot active. No extra agents,new product definitions or competing app/Nostr/URL writes.
 
 - Latest interpreter checkpoint14:57:03 consumed14:57:16 asks storage-followup/default rather than prior feed candidate. Client6 and initial storage read-next-action verified14:57:29/14:57:22. Adapt storage2 to actual current best-effort delete safety/backlog followups read-only;retain agreed feed gap deferredstorage3. Inspection sees .trim on caller/settings before catches,requires call-normalization/current-test investigation,not assumed defect. QA full429/429 diagnostic pass,normal submission64143f42 gating since14:56:10;slot unchanged.
+
+## 2026-10-20 — Prepared trial outputs durable;continued scoped work
+
+- QA64143f42 durable landed1bb3a4fc(normal full gate0),dispatch synced3f9c26e3 and independently ran retained regression4/4 exit0(17.36ms). Runtime JS/config/CSS/components/views/index unchanged from verified storage7f99c045,so no redundant preview build;existing refreshed preview remains current. Worker429/429 diagnostic+lint11+6mutants and earlier local native smoke are evidence-derived. Await worker final closure metadata.
+- Trial roster submission13:26:20→final prepared output landing15:02:17=95m57s. Parallel implementation evidence exists,but no controlled serial baseline/no speedup claim. Slot waits client10m57/storage15m49/QA65m43 to grant are overlapping metrics,not additive wall time.39m57 dispatch wake gap and repeated serial local/normal/admin full gates materially limited throughput. No scheduler/kit change.
+- Client6 independent actual wiring local/synced exit0,local clear+recreation and0publish;historical no-op local exit1 after cleanup,worker existing27 stillpass. Route test-only new real wiring regression,not product fix. Storage2 independent real service/cached metadata2rejects expected0,6controls/0network;route bounded primitive-field guard in deleteVideoStorage only. Actual S3UploadService has no deletion method;duplicated upload logic untouched,require provider-aware R2/S3 controls and decision note.
+- QA2 next actual-app local core/mobile baseline assigned,existing mock relay/private ports,3viewports,one Chromium pass/browser-only slot,all UI/product read-only. No speculative redesign. All same3 workers;full slots after validated-ready and browser release.

fleet/QUALITY.md

@@ -5,16 +5,16 @@ Updated2026-10-20. Goal: improve robustness/usability against pre-launch TODO an
 | Area | Current local evidence | Next bounded work | Still unverified / release gate |
 |---|---|---|---|
 | Feed/load/navigation | Existing client tombstone/buffer guards and broad428-file normal gate; current CRUD spec includes delete-modal/cancel coverage | Feed/view tombstone gap deferred as storage-cors-3 behind latest storage safety priority, TODO1 seed→delete→stale refresh scenario | Full app/feed behavior and documented parallel Firefox hydration flakes; live zombie reports |
-| Playback/fallback/magnets | Queued torrent/URL lifecycle fixes7d20a509/89ccb907; mirror guard0bd0b1c3; independent URL18 scenarios. QA actual coordinator/service scratch4 and local Chromium/Firefox3 each, literal hash/webseed checks | playback-qa-1 retained regression full/normal landing currently active | Actual WebTorrent/live peers; full-app fallback; local decoded mirror/substituted torrent does not prove real torrent |
-| Profile/session/history | Profile fixture hang fixedde6918ce;27 focused historical scenarios and current broad suite. History lazy-init test injects fake renderer | client-reliability-6 read-only actual history removal wiring audit, TODO2 regression gap | Amber NIP46 identity/switch/logout across refresh, real signers; KNOWN_ISSUES isolated logout UI failure |
-| Storage/upload safety | CORS productd3f4c215,closure7f99c045; independent9 CORS scenarios,worker focused13/10mutants/full428/lint/build; content-addressed/cleanup safeguards documented | storage-cors-2 read-only best-effort delete safety/current remaining followups audit | Live bucket/IAM/provider serialization; concurrent read-modify-write has no CAS; no credentials/cloud writes tested |
-| Mobile usability | No fresh local mobile flow/visual qualification from trial | After current investigations, select bounded viewport navigation/modal/card smoke from TODO7; inspect before redesign | Real-device/manual accessibility and UX; visual baselines remain CI-canonical |
-| Trustworthy validation | Unchanged normal gates and restored failing mutants; latest product gate428 files. QA new regression full run in progress | Finish QA gate; retain exact counts, ancestry, fixture boundaries, failed mutants and Known Issues classification | Full broad E2E/release/manual cross-browser checks; never weaken assertions or treat mocked boundaries as live proof |
+| Playback/fallback/magnets | Queued torrent/URL lifecycle fixes7d20a509/89ccb907; mirror guard0bd0b1c3; independent URL18 scenarios. QA actual coordinator/service scratch4 and local Chromium/Firefox3 each, literal hash/webseed checks | Retained QA1 landed1bb3a4fc;dispatch independently4/4,normal gate429 files | Actual WebTorrent/live peers; full-app fallback; local decoded mirror/substituted torrent does not prove real torrent |
+| Profile/session/history | Profile fixture hang fixedde6918ce;27 focused historical scenarios and current broad suite. History lazy-init test injects fake renderer | client-reliability-6 test-only real wiring regression after current pass/historical-noop failure, TODO2 regression gap | Amber NIP46 identity/switch/logout across refresh, real signers; KNOWN_ISSUES isolated logout UI failure |
+| Storage/upload safety | CORS productd3f4c215,closure7f99c045; independent9 CORS scenarios,worker focused13/10mutants/full428/lint/build; content-addressed/cleanup safeguards documented | storage-cors-2 narrow metadata no-throw guard after2 reproduced rejects/6controls | Live bucket/IAM/provider serialization; concurrent read-modify-write has no CAS; no credentials/cloud writes tested |
+| Mobile usability | No fresh local mobile flow/visual qualification from trial | playback-qa-2 actual-app local Chromium core/mobile3-viewport baseline,existing mock-relay harness,private port,no UI edits | Real-device/manual accessibility and UX; visual baselines remain CI-canonical |
+| Trustworthy validation | Unchanged normal gates and restored failing mutants; latest product gate428 files. QA retained regression429-file diagnostic+normal gate passed1bb3a4fc | Retain exact counts, ancestry, fixture boundaries, failed mutants and Known Issues classification | Full broad E2E/release/manual cross-browser checks; never weaken assertions or treat mocked boundaries as live proof |
 | Preview | Preserved localhost3000,storage integrated7f99c045; build/artifact pass,HTTP200/index matches dist | Refresh after each verified product landing; QA is test-only so inspect product delta before rebuilding | Production/live-site state not touched or qualified |
 
 ## Milestones
 
-1. Finish prepared trial outputs: two product fixes are durable; retained QA regression still needs full/normal landing. Report actual timings: implementation parallelism exists, but serialized duplicate full gates and39m57 dispatch wake/checkpoint lag prevent an overall speedup claim.
+1. Finish prepared trial outputs: two product fixes are durable; retained QA regression is durable1bb3a4fc;next work continues under sustained goal. Report actual timings: implementation parallelism exists, but serialized duplicate full gates and39m57 dispatch wake/checkpoint lag prevent an overall speedup claim.
 2. Revalidate high-priority history wiring and storage/delete safety at current HEAD;feed-view deletion gap remains deferred,not cancelled using real wiring plus controlled IO; route only reproduced defects or valuable mutant-proven regressions. No product changes authorized by investigation assignments.
 3. Establish fresh local core-flow/mobile baseline after those checks; keep live Amber/cloud/peer/manual release gates separate. Continue useful bounded work under existing authority; surface substantive blockers/owner product choices instead of inventing features or keeping agents busy.
 

fleet/RULE-CHANGES.md

@@ -9,6 +9,9 @@ a landing rule changes.
 
 ## 2026-10-20
 
+- QA1 retained regression64143f42 landed1bb3a4fc,dispatch4/4. New QA2 actual-app local core/mobile baseline has bounded browser-only slot,no UI changes/full E2E. Client6 test-only actual history wiring regression routed after current pass/historical no-op failure. Storage2 temporary ownership deleteVideoStorage-only in r2Service+new test after2 real cached-metadata rejects/6controls;upload-copy logic unchanged,s3UploadService has no deletion counterpart,prove shared provider-aware delete for R2/S3. Full slots allocated only when validated-ready after browser release.
+
+
 - Latest14:57:03 interpreter checkpoint prioritizes remaining storage/upload/delete safety for storage worker. storage-cors-2 now read-only best-effort delete safety/current followups audit;prior feed/view audit retained deferred as storage-cors-3. Client6 history audit unchanged. No product/test writes before evidence/routing;QA expensive slot stays exclusive.
 
 

test_logs/TEST_LOG_2026-10-20_15-03-00_dispatch-next-evidence.md

@@ -0,0 +1,6 @@
+# Dispatch QA integration and next evidence
+
+- QA64143f42 durable landed1bb3a4fc;git log main3f9c26e3/metadata wrappers. env -u NODE_TEST_CONTEXT node tests/fleet-playback-fallback.test.mjs:4/4,exit0,17.36ms. git diff --quiet7f99c045 HEAD -- js config css components views index.html exit0;no runtime delta from verified preview,build not repeated.
+- env -u NODE_TEST_CONTEXT NODE_ENV=test node /tmp/bitvid-dispatch-6-history-audit.mjs local:exit0,removed absent/localclear0/recreationempty/0fakepublish/0network. synced:exit0,reduced persistence+recreation,2fakepublishesreplace:true/0network. local --historical-noop:exit1 after cleanup,removed item remains/noop1/0publish. Worker existing-profile27pass under historical override is evidence-derived.
+- env -u NODE_TEST_CONTEXT NODE_ENV=test node /tmp/bitvid-dispatch-delete-audit.mjs:exit1,2malformed cachedmetadata reject vs expected0;6controls pass/0network. Real service.resolveConnection/storage metadata/delete/key helpers,transport-only SDK fake. No claim of note deletion blocked because callers catch.
+- New routes require mutant-proven focused tests/unchanged normal gates;no live signer/relay/cloud/bucket/concurrentCAS/mediapeer qualification.