Merge branch 'unstable' into area/storage-cors

docs/TODO.md

@@ -2,6 +2,8 @@
 
 ## dispatch
 
+- 2026-10-22 client9 HEAD independently11modes(3fail/8controls pass),finalowner fetch/timer retained(no media slot leak);controller HEAD-only fix+strict contract/identity/ignoringabort regressions routed. HLS/torrent/RangeGET remain open;QA offline genuineBuffer rebuild prep, mobile/Amber staged.
+
 - 2026-10-22 storage3 independent7/3pass/4fail: buffer newer-version loss and service deleted snapshot/cache leakage routed separate small commits; coordinator stale render still open/read-only pending registered lifecycle evidence. QA3 app-less3pass not CI proof; genuine cached Buffer followup granted exclusive narrow browser.
 
 - 2026-10-22 resumed six-priority campaign: Firefox QA3, active cancellation client9, tombstones storage3 now; playback dispatch4, Amber dispatch5, mobile dispatch6 staged with acceptance criteria. See docs/agents/CAMPAIGN-2026-10-22.md. All six remain unfinished; old idle/quiet-hours hold superseded for this foreground scope. Final integrated checks/build/preview and live/manual disclosure outstanding.

docs/agents/prompts/client-reliability.md

@@ -1,3 +1,11 @@
+## Implementation routing 2026-10-22 — client-reliability-9 HEAD only
+
+Dispatch independently ran11 scratch modes via dispatch imports at169d894f (runtime identicalc5b678f7):3 fail naturally(disposed/same-turn/later),8 pass(shared/cross/legacy/live-success/error/timeout/late-success/error),cancelled0. Final owner retains1HEAD/0abort/1timer5000ms/unsettled/original inflight; media slots0/queue0. Minimal implementation authorized ONLY js/ui/urlHealthController.js HEAD probe lifecycle cancellation hook/cleanup plus tests/url-health-lifecycle.test.mjs or unique HEAD lifecycle tests and strict integrity/spec/evidence notes. Existing observer/cache/app/HLS/torrent modules remain read-only.
+
+Explicit spec correction permitted: prior queued/media-only completion does not fulfil source-backed Stage3 active HEAD last-owner cleanup. Preserve failed baseline and existing live/shared/legacy controls; equally strict or stricter changed expectations with Test Integrity Note. Release final-owner HEAD by marking cancelled synchronously, abort transport, settle null promptly without waiting for ignored abort/timeout, remove timer/hook exactly once; no cache, stale badge, fallback media/mirror start or replacement deletion. Fresh same-turn and later owner must start fresh request, old success/error/timer/finalizer cannot affect it. Preserve live HEAD success/error/timeout fallback, shared/cross/ownerless legacy ownership, media-hook handoff and FIFO/queue bounds. Add transport ignoring abort, missing AbortController, cancellation-before-start/at-handoff, late callbacks and replacement controls where applicable. HEAD only, do not conflate Range GET task or HLS/torrent completion; measure those later separately.
+
+Focused regression + restored failing mutants + lint now, request serialized full/browser slot when ready, no expensive job or normal product submission without grant. QA has conditional next narrow Firefox slot. Normal local queue/gates/durable ancestry required. No retries/sleeps/force exits/relaxed expectations, external/signer/cloud/credential authority unchanged.
+
 ## Current assignment 2026-10-22: client-reliability-9 — remaining active cancellation
 
 This supersedes the old item8/idle scope below. Read current dispatch campaign brief, PROGRAM/RULE-CHANGES/KNOWN_ISSUES and test integrity. All worktrees were clean at dispatch inspection; inspect your own status then fast-forward own branch to unstable if safe (never discard work); report exact SHA and ack next action. Claim item9. Start actual observer/controller active HEAD-request last-owner/shared/same-turn+later rejoin offline measurements. Use controlled fetch/abort, count settlement/slot/cache/mirrors/stale callbacks; retain live success/error/timeout/FIFO and replacement identity controls. HEAD first, HLS/torrent separately tracked, no wider completion claim. Source/scratch/unique evidence only; NO product or committed test changes until demonstrated defect and dispatch routing/spec note. Do not inherit previous item8 implementation permission for HEAD. Own future health files as roster, app/services/cache read-only. No full suite/build/browser/normal product submission yet; QA has initial expensive/browser slot. env -u NODE_TEST_CONTEXT for commands, no force exit/retries/sleeps. Send read/next action, reproduced result/blocker and READY for checks. After this slice, playback and Amber remain staged in campaign; await bounded routing, not optional self-selection.

fleet/LOG.md

@@ -166,3 +166,4 @@
 
 - QA3 first controlled3/3 PASS excludes actual app bootstrap(Bufferdenied3); not CI repro/pass. Browserreleased14:11:17Z. Authorized pinned genuine cached Buffer scratch prep + one narrow app-ready Firefox/control diagnostic; no product/tests/config writes or broad suite.
 - Storage3 independently run env -u NODE_TEST_CONTEXT node /tmp/bitvid-dispatch-tombstone-audit.mjs at7369f1fe(runtime JS/tests/config diff0 vsc5b678f7):7tests,3pass/4fail,0network, naturalexit1/29.89ms. Deleted original persists/emits, reload briefly emits it, oldtombstone deletes strictly newer active, older refresh renders deleted reference after newer result. Buffer/service minimal fixes routed as separate commits with tests/mutants; coordinator open/read-only pending full registered-lifecycle fidelity. No browser/DOM or real-event signature qualification.
+- Client9 dispatch-independent11mode audit via /tmp/bitvid-dispatch-head-audit.mjs: disposed/same-turn/later exit1(3),shared/cross/legacy/live-success/error/timeout/late-success/error exit0(8),allcancelled0/naturalexit. Finalowner leavesHEAD1/abort0/timer1(5000ms)/unsettled/inflight;media slots0. Routed controller HEAD-only lifecycle cleanup+strict spec/integrity/regressions,including ignoring-abort/replacement/handoff controls;HLS/torrent/RangeGET remain separate/open. QA genuineartifact missing;offline exactcachedpackage reconstruction explicitly routed(no fetch/install scripts),before app-ready narrowbrowser.

fleet/RULE-CHANGES.md

@@ -9,6 +9,8 @@ a landing rule changes.
 
 ## 2026-10-22
 
+- Client9 HEAD cancellation independently reproduced by dispatch11modes: disposed/same-turn/later fail3, shared/cross/legacy/live-success/error/timeout/late-success/error controls pass8, naturalexit/cancelled0. Finalowner retains HEAD1/abort0/timer1(5000ms)/unsettled inflight;media slots0 so no slot-leak claim. Route ONLY js/ui/urlHealthController.js HEAD lifecycle cancel/settle/timer-hook cleanup + focused lifecycle tests/unique strict integrity/spec notes. Explicit Stage3 contract extends immediate final-owner cleanup to active HEAD, preserving live/shared/legacy behavior. Abort transport AND settle via cancellation even if transport ignores abort; synchronous cancelled/rejoin identity safety; suppress obsolete fallback/cache/mirror/badge work. Preserve live error/timeout fallback, HEAD success/media handoff/FIFO, non-abort support. HEAD only; HLS/torrent and RangeGET separate. Focused/mutants/lint then request full/browser slot; QA conditional next narrow browser, no competing expensive gate.
+
 - Storage3 independently reproduced by dispatch on runtime-equivalent7369f1fe: actual subscription/buffer/service/feed-engine/coordinator scratch7=3pass/4fail, naturalexit1/29.89ms/network0. Route storage3 implementation in separate small commits: first ONLY js/nostr/videoEventBuffer.js timestamp-safe active deletion + unique focused tests, then ONLY js/services/nostrService.js snapshot/persistent-cache deleted/invalid eligibility and affected-record cleanup + unique integration tests after buffer controls. Existing client.js tombstone/address/author semantics preserved; no root-only widened deletion. Temporary ownership overrides roster exclusion only for those modules/tests. Coordinator stale-render remains reproduced/open but app/feedCoordinator.js READ-ONLY until faithful registered-feed/lifecycle evidence and separate routing. Focused+mutants+lint now; full/normal product queue/browser via explicit slot. QA owns next narrow Firefox bootstrap diagnostic using pinned genuine cached Buffer; first app-less3pass is not CI reproduction. No gate/expectation weakening.
 
 - Owner six-priority resume relayed by interpreter14:02:34UTC and routine YES14:03:29UTC supersedes local-review/quiet-hours hold for this foreground campaign. Existing client9 active HEAD cancellation first (HLS/torrent separately tracked); QA3 Firefox deterministic CI run39536282396/job119013565277; storage3 tombstone stale-refresh. Investigation/source/scratch evidence only until reproduced defect and explicit implementation routing. QA owns next browser/expensive slot, must announce start/release; no full suite/normal product submission without slot. Client/storage focused offline checks only. Playback enhancements, Amber and mobile remain tracked/acceptance-scoped, not dropped. All worktrees inspected clean, no unlanded unique commits; each worker safely fast-forwards own branch before work, reports SHA. No app.js writer, new launch, test weakening, kit/scheduler or restricted external authority. See campaign brief; newer current assignments override archived prompt bodies.

test_logs/TEST_LOG_2026-10-22_14-15-00_dispatch-head.md

@@ -0,0 +1,5 @@
+- Dispatch runtime at169d894f (docs-only descendant7369f1fe; controller/observer/cache unchanged sincec5b678f7).
+- Inspected /tmp/client9-head-repro.mjs; copied only absolute imports to dispatch /tmp/bitvid-dispatch-head-audit.mjs. Python subprocess env removesNODE_TEST_CONTEXT, invokes direct node once per11 named modes, captures exact exit/TAP/trace; process timeout20 not hit. Harness command exits0 because all results inspected, not because all scenarios pass.
+- disposed/same-turn/later each naturalexit1/pass0/fail1/cancelled0. shared/cross/legacy/live-success/live-error/live-timeout/late-success/late-error each exit0/pass1/fail0/cancelled0. Full TAP /tmp/bitvid-dispatch-head-<mode>.tap; aggregate /tmp/bitvid-dispatch-head-results.json.
+- After disposalHEAD1/abort0/timer1(5000ms)/unsettled/original inflight,media0/active0/queue0. Late completion already suppresses disposed cache/mirror/badge;shared/live fallback controls preserved. Controlled fetch/media/timers/JSDOM,actual observer/controller/cache entrypoints;no real network/CPU/transport byte or browser proof.
+- Minimal controller HEAD-only fix routed with strict explicit active HEAD contract note; ignoring abort/replacement/media handoff additional controls required before READY. No product/test edits by dispatch. HLS/torrent/RangeGET remain open.