land: area/playback-qa 732a781104 (playback-qa)

2026-10-29 17:02:28 +00:00 · 2026-10-26 21:56:08 -04:00
commit a2dbaccc6c
@@ -1,9 +1,9 @@
 {
  "id": "playback-qa-4",
  "area": "playback-qa",
-  "status": "open",
+  "status": "deferred",
  "title": "Reproduce actual-app mobile Upload overflow and focus touch behavior",
-  "blockedOn": null,
+  "blockedOn": "Cleanup slice qualified at client10 aff88416 (landed5b0adf6b); original362/360+394/390 overflow, visual focus/AA, touch adequacy and real-device checks remain open pending bounded routing. No additional runtime assigned.",
  "addedOn": "2026-10-22",
  "filedAt": "e04549f816f6ec61f305e20df0ce2b59797c4651",
  "brief": "docs/agents/prompts/playback-qa.md"
@@ -0,0 +1,23 @@
+# QA4 causal A/B preparation blocker — 2026-10-26
+
+Source HEAD and unstable `0ffd92a8d2072a19fe61ac6edcf5097a9538fddd` printed by git. QA4 reclaimed; source comparison from filedAt `e04549f816f6ec61f305e20df0ce2b59797c4651` for index.html, js/index.js and css/tailwind.source.css returned no delta. All four existing untracked evidence notes and dirty backlog preserved.
+
+Interpreter mailbox `20261026T134112-interpreter-216b89.md` grants one separately saved360x800 causal A/B after health<75C/load<8/ampleRAM and no peer browser: reproduce failed native checkbox click first, then remove ONLY app.fade-in with unchanged geometry/points and native toggle. Stop on failure without retry. Independent reproduction/listener timing still precedes implementation routing.
+
+Recovery plan: inspect pinned artifacts and dependency provenance; reconstruct missing scratch from verified cache only; syntax-check a distinct runner; launch only after qualifying fresh health; preserve A/B plus cleanup. No product/CSS/test/helper/config changes.
+
+Preparation checks found `/tmp/playback-qa-4-cause-run.cjs` and `/tmp/playback-qa-4-cause-result.json` absent (ls/cat exit1). Prior runtime counts in earlier notes remain reported historical evidence; their raw temporary artifacts are unavailable after restart. Own node_modules is absent; dispatch Playwright/ws/esbuild paths exist, but no dependency was imported or executed.
+
+Fresh health2026-10-26T13:42:06.538Z: max75.1C, load1.98, availableRAM72.7%; fails the grant's <75C prerequisite. Peer .task reads show client browser RELEASED and dispatch reserving QA next brief browser; no peer browser launch performed here.
+
+Exact reconstruction command was an inline Python3 script reading docs/testing/playback-qa-3-buffer-provenance.json, decoding each recorded SHA512 SRI into the local npm-cache content path, requiring both SHA256/SHA512 before extraction. It exited1 on its FIRST archive read:
+
+`FileNotFoundError: /home/user/.npm/_cacache/content-v2/sha512/15/38/82a4dc6dc226591c465b71b4c87198c44552029fdcaafe90c591397de7f031cc3d6768172d37b60eebcae233f80b48363bb1dacc6f2f21a1f00362ebaa38`
+
+This is the recorded genuine buffer6.0.3 archive, expected SHA256555b6f49224afcf6b2c5a9aea7cd34a7f443f395b10532bc5580022d57aa51f5. No archive bytes read/hash checks passed; no package extraction, bundling, network download/install, substitute dependency or app launch. Stop at this preparation blocker as assigned. Need restored verified genuine mirror/cache provenance before an actual-app run; no new grant presumed after release.
+
+Counts: browser0, contexts0, private servers0, readiness0, runtime assertions0, A/B comparisons0, tests/builds/submissions0. No performance or causal qualification. Empty owned scratch directory /tmp/playback-qa-4-ab-20261026 removed by literal rmdir. Preview3000/peer processes untouched; no runtime resources created requiring cleanup.
+
+Original strict horizontal overflow362/360 and394/390 remains open; previous native checkbox failure1/1 remains historical. A/B sufficiency, startup listener timing, original overflow cause, Firefox CI-equivalent failure, real-device and AA remain unverified. No product fix proposed from this attempt.
+
+RELEASE recorded UTC: 2026-10-26T13:43:26.712816+00:00
@@ -0,0 +1,41 @@
+# QA4 separate causal A/B attempt — blocked by reconstructed runner
+
+Source HEAD/unstable `0ffd92a8d2072a19fe61ac6edcf5097a9538fddd` printed by git. Interpreter mailbox20261026T151946 grants one separate360x800 A/B after freshhealth;152449 permits bounded health rechecks. Client offline only/dispatch source-only, no competing browser recorded. No product/CSS/retained tests/helpers/config edited.
+
+## Preparation and command
+
+Durable reproduction directory: `/home/user/.local/state/agent-fleet/bitvid/evidence/playback-qa-4/ab-20261026/` contains prepare.py, README.md, run.cjs, entry.mjs, genuine extracted package sources, buffer.mjs, verified-provenance.json, bundle-provenance.json, health-snapshots.jsonl and result.json. No sole reliance on /tmp. Existing original dirty QA evidence retained.
+
+`python3 .../ab-20261026/prepare.py` exit0: all3 restored genuine archives independently verified byte count+SHA256+SHA512 before any extraction. Existing dispatch esbuild0.27.3 produced Buffer mirror65583bytes, SHA256ff1c4a2377a9df17eaffa1f5b00da3d835f748f3d832a0490bd309756434f73d; absolute-path comments differ from historical bundle, no claim of output byte equality. Runtime Buffer API sanity6/6. CSS hash283d0464 and two relay source hashesab11b299 match prior pins; relevant CSS/template/buildsource diff d9424fb7..HEAD exit0. No download/install/productbuild.
+
+`node --check /home/user/.local/state/agent-fleet/bitvid/evidence/playback-qa-4/ab-20261026/run.cjs` exit0. Runner SHA256ce95cf5c8ae04db564e38569859a750403ccb8f5b6505c8e19ae8eb3017c8e69 preserved exactly after execution.
+
+Prelaunch health15:25:13.754Z max74C/load6.15/availableRAM61.5%/battery70%49min, satisfying explicit short-run grant. Earlier15:22:58 load17.23 and15:24:11 max76/load8.74 were held, no launch. START.task written before execution. No unrelated process stopped.
+
+Exact command: `node /home/user/.local/state/agent-fleet/bitvid/evidence/playback-qa-4/ab-20261026/run.cjs` from own worktree, approved host execution. Natural exit1. START15:25:27.773Z; runtime15:25:28.223Z; RELEASE15:25:46.532Z (18.759s total). Chromium145.0.7632.6. Result SHA256868e6dd80a0887dce319b5a2a9e5f0be083721541a1f5820d306b8bfe12134a9.
+
+## Exact first failure and interpretation
+
+`page.waitForFunction: Timeout 15000ms exceeded` at run.cjs:84, after native I Understand locator.click resolved. Predicate incorrectly requires `disclaimerModal.hidden && dataset.open === "false"`. Source js/ui/components/staticModalAccessibility.js:125-143 uses `classList.add("hidden")` and data-open=false, rather than the HTML hidden property. This reconstructed-runner mistake makes the wait incompatible with normal source behavior. The run did not capture disclaimer DOM at failure, so do not claim it independently measured the closed state or a product disclaimer regression.
+
+A second independently visible setup mistake: routeWebSocket compares ws.url() exactly with `ws://127.0.0.1:31865`; recorded actual URL is `ws://127.0.0.1:31865/`. All8 local-relay attempts were denied by this faulty allowlist. These8 are LOCAL attempts, not public-network attempts; no remote WebSockets were recorded. The guard continued to deny other public WebSockets, but local relay functionality was not qualified.
+
+These two runner defects were identified after natural exit via source/result inspection only. Executed runner/results remain unchanged. At the first failure checkpoint no corrected script was created/executed and no retry occurred. Later source-only preparation is recorded below. A future independently reviewed preparation can normalize and compare allowed WebSocket URL components (only localhost31865 path/) and wait for class-hidden plus data-open=false; it must preserve exact public-deny scope and receive a distinct run grant/path. No longer timeout/force click/skip disclaimer/forced UI state substitute is justified.
+
+Counts: browser1/context1; actual applicationContext.getApplicationReady plus app/harness/videoList readiness1; resolved disclaimer native click1 but successful closed-state check0; Upload0, wheel0, checkbox native clicks0, interventions0, A/B comparisons0, width runtime assertions0, product edits0, tests/builds/submissions0. Pageerrors0. Genuine Buffer route served1; public HTTP denied10; localWS denied8. No fixture login/relay seeding/publishing/media/cloud action reached.
+
+Cleanup awaited context, browser, relay and server closure; tracked app sockets0, resourcesClosed=true. No separate OS socket inventory was taken. Private app31864/relay31865 only; preview3000/peers untouched. Durable evidence/dependency sources retained, no temporary runtime process intentionally left running. Slot RELEASED. No continuing browser qualification implied.
+
+## Remaining evidence boundary
+
+Original horizontal overflow362/360 and394/390 remains open. Previous native checkbox interception1/1 and prior width passes remain historical observations, not results of this attempt. Causal A/B, startup listener timing, original overflow cause, Firefox CI-equivalent failure, other viewport/device parity and real-device/AA remain unverified. No product/CSS fix recommendation follows from this setup failure. Independent causal reproduction and explicit ownership routing remain required before implementation.
+
+Recorded UTC: 2026-10-26T15:26:56.714504+00:00
+
+## Interpreter-directed corrected preparation (no runtime)
+
+Mailbox20261026T152632 explicitly requests source-only diagnosis/proposal, no immediate rerun. Separate durable `.../ab-20261026/corrected-prep/run.cjs` prepared with exactly two predicate substitutions: normalized URL href equality for the intended local WS root, and classList hidden + data-open=false for disclaimer closure. `node --check` exit0; runtime not executed. SHA25614f327b92c7adb4373761dece9359158300f944ab2270781e87de64ac5ed9181. Supporting Buffer/provenance copies are byte-identical to parent. README records exact future command and requires NEW explicit grant/fresh health/START. Existing A/B preconditions, strict widths, points/geometry, publicdeny and awaitedcleanup unchanged.
+
+After preparation original runner SHA256ce95cf5c and result SHA256868e6dd8 rechecked unchanged. No second browser/server launch, no A/B attempt or product changes. Post-release health15:26:59 max72.9C/load5.35/RAM62.1%/battery66%41min is advisory, not permission for another run. .task records RELEASE plus proposed preparation READY awaiting new routing.
+
+Mailbox20261026T152816 authorizes corrected preparation only, with stronger prerequisites. Updated prepared SHA256593fc0556257e1943f61e9496d3fcd5b906dee9025ccbb6368f7ea26d78fc5f2: exact WS protocol/hostname/port/rootpath plus empty search/hash/user/password; disclaimer class hidden+data-open=false+computed display none+hasSeenDisclaimer=true following genuine button click. Source js/disclaimer.js hide writes hasSeenDisclaimer=true; staticModalAccessibility.closeStaticModal adds CSS hidden/data-open=false. Two original lines replaced, all other assertions/deadlines unchanged. Prior prepared14f327b9 was never executed; updated preparation also runtime0. Await NEW grant.
@@ -0,0 +1,121 @@
+# QA4 bounded attempt: private server blocked
+
+- Own source SHA `4de357e4a7489d6a25466cdec9babd8ed1edd513`; dispatch browser grant21:04:02Z. Dirty prior preparation and claim preserved; no merge/product edits.
+- Plan: actual-app Upload through real UI at360×800,390×844,1280×720, strict document width, computed source rules, touch/focus/close restore; stop on boot blocker or culprit.
+- Read-only storage build provenance: `test_logs/TEST_LOG_2026-10-22_20-58-00_storage-cors-4-landed.md` reports artifact29cbe6f0 from source d9424fb7, runtime-equivalent7edc7ea8. Served source was intended to remain own checkout, with generated CSS alone reused. `git diff --stat HEAD d9424fb7 -- css components/upload-modal.html tailwind.config.cjs postcss.config.cjs` output empty (exit0).
+- SHA256 Buffer `2f1f8730af8c9fb08068a41c9c18356b9f48f21635fe5deed6d17fc6b9b97be7`; CSS `283d04642d201edba1e9bd5cbc3ede8d74fbd11b50ff0cd2732d463847d2adf3`: both checked in script before bind and matched. Existing genuine cached dependency provenance retained in `/tmp/playback-qa-3-assets/provenance.json`; no network fetch or dependency substitution.
+- Command `node /tmp/playback-qa-4-run.cjs`, natural exit1. Started21:05:04.269Z, ended21:05:04.281Z. Exact failure: `Error: listen EPERM: operation not permitted 127.0.0.1:31864` at Server.setupListenHandle. No assertion relaxation or rerun.
+- Counts: runtime cases0, browser launches0, app readiness checks0, measured width/focus/touch cases0. Two byte-hash guards passed before server bind; not app qualification.
+- Cleanup: failure handler closed own server object; browser never created, no listening private server created. No peer process/server or preview3000 touched. Slot RELEASE21:05:04.281Z. Script and JSON preserved under `/tmp/playback-qa-4-run.cjs` and `/tmp/playback-qa-4-result.json`.
+- Unverified: actual app boot, dependency browser execution, current overflow/source culprit, touch/focus/scroll/zoom, real device/AA audit. Original strict QA2 failures362/360 and394/390 remain open; desktop1280 control remains historical. QA3 remains unreproduced/open.
+- Next: dispatch disposition for denied local server execution before another bounded attempt; no substitute app or module harness, product/CSS/test/helper/config edit, build/full gate, or submission.
+
+## 2026-10-23 source/prep disposition
+
+- Dispatch12:49Z keeps QA4 source/prep only; HLS sole full/normal slot, no launch. Saved source runner and failed-attempt JSON remain present. Runner SHA256 `238b9ea5fdf04d5af6170b90f7525c8e0d3008860f47219465f3f217921ba542`; first failed attempt JSON SHA256 `6d1f61de37359c05bbaf402918dff36cee26701c5062815ed8dbd0690f9ad507` unchanged.
+- Rechecked genuine Buffer mirror SHA256 `2f1f8730af8c9fb08068a41c9c18356b9f48f21635fe5deed6d17fc6b9b97be7` and generated CSS SHA256 `283d04642d201edba1e9bd5cbc3ede8d74fbd11b50ff0cd2732d463847d2adf3`, matching the runner guards. Provenance for Buffer is `/tmp/playback-qa-3-assets/provenance.json`; generated CSS is the read-only artifact29cbe6f0 from source d9424fb7, documented in the storage-cors-4 landing evidence. `git diff --exit-code d9424fb7 HEAD -- index.html components/upload-modal.html css/tailwind.source.css` exit0: the relevant actual-app/template/source CSS files have no drift. Their SHA256 at current source: index `3df4e6fdbccb8982b3df0b973fd1f1ef988c9323a67a95f42cba04dfec2b9c17`, Upload template `9dc3e8fc8514cf4d19eb1e513764c80680b559c1069247a31367613ac925b017`, Tailwind source `2bc5b0bdf34a6c82e53c15977d7df438dd54af19eceb10518a72d662d0160e78`.
+- Exact eventual command: `node /tmp/playback-qa-4-run.cjs` from `/home/user/Documents/GitHub/bitvid-playback-qa`. It contains the same pinned Buffer/CSS SHA guards, fixed private bind `127.0.0.1:31864`, local-origin-only HTTP allowance, public HTTP abort and WebSocket close, exact three viewports, and original strict `document.scrollWidth <= width` per viewport. It first binds the private app server, then launches Chromium; the first recorded run stopped before browser launch at that bind.
+- Needed sandbox approval when dispatch renews browser grant: normal host execution approval for this exact command, so Node may bind only its assigned private `127.0.0.1:31864` app server and launch the bounded Chromium run. No approval requested/consumed and no command rerun now; no alternate port or edited guard.
+
+## QA4 host-approved run: actual-app readiness, Upload obstructed
+
+- Dispatch conditional grant active after client build/artifact release13:00:59Z and health13:01:10Z. Normal host escalation was accepted; no automatic-review rejection. Worktree source SHA `4de357e4a7489d6a25466cdec9babd8ed1edd513`; no product/CSS/test/config/build/full changes.
+- Command `node /tmp/playback-qa-4-run.cjs`, host execution, natural exit1. Browser Chromium `145.0.7632.6`. Start13:01:39.395Z, end13:02:11.082Z, 31.687s. Actual app readiness succeeded once at360×800 (`applicationContext.getApplicationReady()`, app, test harness and `#videoList` present); local synthetic test-key login helper invoked.
+- Next actual UI action, Playwright click `[data-testid="upload-button"]`, timed out at30s. Locator resolved visible/enabled/stable. Repeated native click attempts report `<div class="flex justify-center pt-1">…</div>` inside `#modalContainer` intercepts pointer events. Therefore Upload did not open. Exact error and call log preserved in `/tmp/playback-qa-4-result.json`. This is an app/harness UI blocker to reaching Upload; cause not diagnosed from this run.
+- Counts: browser launches1; actual readiness1; strict viewport geometry0; Upload modal openings0; touch/focus/scroll measurements0; page errors0. Public HTTP deny intercepted CDN esm.sh/jsdelivr requests; public relay WSS attempts were blocked, plus local relay `ws://127.0.0.1:31865` had no server. This runtime cannot claim genuine fully offline app readiness beyond the above harness signal; Upload click blocker supersedes source culprit measurement.
+- Strict QA2 baselines remain362/360 and394/390 FAIL; desktop1280 historical result only. No relaxed tolerance. Browser and private server closed naturally; report resourcesClosed true; slot RELEASE13:02:11.082Z. Preview3000 untouched. No retries or further viewport/browser reruns.
+- Unverified: current document overflow and exact source rule, 390/1280, critical target bounds, focus/tab/restore, scroll/zoom, real device/AA. QA3 Firefox CI failure remains open/unreproduced.
+
+## Dispatch source diagnosis: disclaimer setup correction (2026-10-23)
+
+- Source at current QA HEAD: `js/index.js:1325` calls `disclaimerModal.show()` after `bootstrapInterface()` loads and initializes the disclaimer at `js/index.js:1197-1202`. `show()` opens `#disclaimerModal` when localStorage has no `hasSeenDisclaimer` (`js/disclaimer.js:56-64`). Actual button is `#acceptDisclaimer`, accessible name “I Understand” (`components/disclaimer.html:127-135`); its production click handler calls `hide()` (`js/disclaimer.js:21-37`), which uses `closeStaticModal`, writes `hasSeenDisclaimer=true`, dispatches `bitvid:disclaimer-dismissed`, and therefore releases the modal focus trap / returns prior focus (`js/disclaimer.js:40-53`; `staticModalAccessibility.js:125-143`).
+- Official Playwright fixture `tests/e2e/helpers/bitvidTestFixture.ts:114-121` bypasses the onboarding by setting `localStorage.hasSeenDisclaimer=true` before `page.goto`. Our actual-app runner does not do this, appropriately, so first-run UI covers Upload. Next bounded plan: leave disclaimer unseen, wait until `#disclaimerModal` is visible, click it by normal user interaction/accessibility name (`getByRole('button',{name:'I Understand'})`), then await `#disclaimerModal.hidden` and verify `data-open=false` before logging in and clicking Upload. Do not use force click, remove DOM, set storage, skip the interstitial, or inflate timeout.
+- Previous runtime also showed blocked `ws://127.0.0.1:31865` and public WSS defaults. Start the existing `scripts/agent/simple-relay.mjs` on fixed private WS31865 with HTTP disabled (no events needed), install test-relay override before app initialization and confirm harness `setTestRelays([relay],{persist:false})`; allow only static app origin31864 and this relay WebSocket. Keep all public HTTP aborted and other WS closed. This avoids relying on the unused relay port or requiring feed content. No new browser run launched; wait for renewed dispatch slot after HLS browser stage.
+
+## QA4 corrected host run preparation and prior artifact preservation
+
+- Client-reliability released HLS browser/server13:08:47Z, no processes. Dispatch13:06:23Z conditionally granted one corrected run after release+fresh health. Latest health13:10:19.701Z: RAM available63.3%, max74.9C, load2.88/8; swap-only88% threshold warning, treated advisory under dispatch13:01:18 clarification. No competing browser/full gate reported.
+- Preserved prior disclaimer blocker JSON at `/tmp/playback-qa-4-disclaimer-blocker-result.json` (SHA256 `2264955f74fc8c36deee43177eecb885aa02d8db57ff6016ad743cd8d657fd97`) and EPERM event JSON at `/tmp/playback-qa-4-eprem-blocker-result.json` (SHA256 `943794b810ddecd4c28334008a873d16b5ea85f430c4591f3aae84e95781cea1`); the earlier textual record remains above.
+- Corrected runner SHA256 `7e1b6a8433e7ce34ea6c6e7d9b0c548ff75424356fb1e6f0d963bc89c25e677b`; `node --check /tmp/playback-qa-4-run.cjs` exit0. Same genuine Buffer/CSS hash guards re-read and passed; relevant source diff d9424fb7..HEAD exit0. It now starts only the existing `simple-relay.mjs` at31865 with HTTP disabled, installs the official test relay override before navigation and invokes `setTestRelays`, accepts visible disclaimer via accessible “I Understand” click and waits hidden/data-open=false before login/Upload. Static app remains fixed31864; external HTTP abort and all nonlocal WS close. Third run writes a distinct `/tmp/playback-qa-4-corrected-result.json`. Preserves strict geometry result for360/390/1280, control/touch rects, focus/Tab/restore evidence and matched rules on overflow candidates.
+- No third run has started yet.
+
+## Corrected run stopped at local relay dependency blocker
+
+- Dispatch conditional slot was active after client HLS browser release13:08Z and fresh health13:08:57Z; dispatch classifies swap-only88% with ample RAM as advisory. Exact prepared command `node /tmp/playback-qa-4-run.cjs`, host execution approval accepted.
+- Corrected runner SHA256 `7e1b6a8433e7ce34ea6c6e7d9b0c548ff75424356fb1e6f0d963bc89c25e677b`; node syntax check exit0. Buffer and generated CSS hash guards passed2/2 before setup. Natural exit1; start13:10:37.868Z, stop13:10:37.889Z (21ms).
+- Exact blocker: `Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'ws' imported from /home/user/Documents/GitHub/bitvid-playback-qa/scripts/agent/simple-relay.mjs`. ESM resolver cannot find ws from this worktree. Failure occurred before relay listener, static app server, or Chromium launch. Runtime cases0; no disclaimer/Upload/geometry assertions ran. Resources closed, no port bound. Report `/tmp/playback-qa-4-corrected-result.json`.
+- This run did not reject host execution; it exposed missing local relay dependency resolution. Stopped under first-blocker rule. No alternate port, shim relay, install, substitute, or retry. QA browser/private server/relay slot RELEASE13:10:37.889Z; preview3000 untouched. Prior EPERM and disclaimer artifacts preserved separately.
+- Remaining: genuine mock relay dependency is unavailable from this worktree's ESM resolution; next attempt needs dispatch source/prep disposition and a renewed browser slot. No actual mobile geometry/focus/touch measured.
+
+## Dispatch source/prep correction: relay module resolution
+
+- Dispatch authorized importing the byte-identical existing simple-relay module from its worktree because that worktree resolves the installed genuine `ws` package. No package install, shim, or product module copy.
+- Verified own relay source and dispatch relay source with `cmp` exit0; both SHA256 `ab11b29937690810900d3a16e01e16571ce68d7f02d50c86656b76f47776cba4`. Import-only command from dispatch module: `node --input-type=module -e "const m=await import('file:///home/user/Documents/GitHub/bitvid-dispatch/scripts/agent/simple-relay.mjs'); if(typeof m.startRelay!=='function') process.exit(1); process.stdout.write('import-only PASS startRelay=function; no server started\\n')"`, exit0. It imports only; module's standalone server guard did not run.
+- Scratch runner now checks own+dispatch module byte equality and the pinned hash, imports dispatch module and checks `startRelay` before starting the local relay or Chromium. `node --check /tmp/playback-qa-4-run.cjs` exit0. New runner SHA256 `80b2bd6a45b78c7d5e5dc1691ecff7a9b0370b5f6a2ce275064e5f21d42c1973`; no browser/server launched by this preparation.
+- Await client HLS review/release and renewed separate browser grant plus fresh health. No product changes or second run yet.
+
+## QA4 corrected actual-app mobile run completed
+
+- Own worktree source SHA `4de357e4a7489d6a25466cdec9babd8ed1edd513`; dispatch conditional run after client HLS browser release13:17Z and fresh health13:17:39Z (RAM67.7%, max72.9C, swap-only84% advisory). Normal host approval accepted. Exact `node /tmp/playback-qa-4-run.cjs`, Chromium145.0.7632.6, natural exit0, 7.131s (13:17:53.184–13:18:00.315Z), resourcesClosed true. No product/CSS/test/config/build edits.
+- Genuine Buffer SHA guard and generated CSS SHA guard passed2/2. Existing relay source pinned and identity checked before launch. Local simple-relay WS31865 started with HTTP disabled; no events seeded. Static app served from own checkout on private31864. Browser allowed only local app HTTP and local relay WS; public HTTP/other WS denied. 42 blocked requests, 9 unique destinations (5 external HTTP URLs and4 public WSS relays); pageErrors0. No real identity/relay/cloud/media or publishing.
+- Actual app readiness and genuine UI disclaimer acceptance succeeded3/3 at360×800,390×844,1280×720. `#disclaimerModal` ended hidden/data-open=false and hasSeenDisclaimer=true. Upload opened through actual header button in all3. Strict document scrollWidth<=viewport retained and passed3/3 in this run: 360/360,390/390,1280/1280. Bounding overflow candidates0 in each. This new pass does NOT replace prior QA2 strict failures362/360 and394/390; those historic observations remain open and unexplained. No current overflowing node/rule culprit was demonstrated, so no CSS fix scope is proposed. Source trace confirms mobile `.modal-sheet` uses `inline-size:100vw` under border-box; computed sheet edges were exactly viewport edges.
+- Focus: 12 keyboard Tab steps per viewport, all12 stayed within Upload and matched `:focus-visible`; after closing, focus returned to `#uploadButton` in3/3. This is local Chromium behavior, not real-device or WCAG/AA certification.
+- Horizontal/zoom probe: `window.scrollTo(100,0)` left `scrollX=0` and document width equal viewport at all3; `visualViewport.scale=1`. No pinch/zoom interaction or real touch device tested.
+- Direct bounding-box measurements include touch-size concerns: close Upload32×32 mobile/30×30 desktop; Upload File toggle97×23.6 mobile; External Link106×23.6; Storage Status84.8×12.8; Browse66.9×28.8; Add Tag67.1×22.1; Advanced Options full width but14 high; Submit full width but40.4 high mobile/38 desktop. Checkbox input boxes16×16; associated label hit areas were not measured. Most measured button boxes are shorter than44px. At360, Submit begins y819.6 below viewport800; at390 it begins819.6 and extends to860 beyond844; desktop Submit y809–847 beyond the modal bottom684. Upload `.modal-body` source is `overflow-y-auto`; actual vertical scroll-to-submit reachability was not exercised.
+- Exact current Upload style source was the verified generated stylesheet hash `283d04642d201edba1e9bd5cbc3ede8d74fbd11b50ff0cd2732d463847d2adf3`, with known source version d9424fb7; relevant index/template/Tailwind source comparison remained unchanged. No overflow node existed to map to a culprit selector.
+- Artifacts: `/tmp/playback-qa-4-corrected-result.json` and `/tmp/playback-qa-4-{360,390,1280}.png`; hashes recorded in the run output/tool log. Browser, static server, local relay closed naturally. Slot RELEASE13:18:00.315Z; preview3000 untouched.
+- Unverified: prior strict overflow failure's exact source/cause and same-run reproduction; actual vertical scrolling to lower controls; checkbox label target sizes; mobile real-device touch/zoom; color contrast/AA; Firefox; production/live relay or media behavior. QA3 Firefox CI remains unreproduced/open.
+
+## QA4 vertical/effective label actual-app result — 2026-10-24
+- Source SHA `4de357e4a7489d6a25466cdec9babd8ed1edd513`. Dispatch NEW slot02:58:48; local preflight02:58:59.979 max66.1C/load1.89/RAM63.3%, swap82% advisory. Exact command `node /tmp/playback-qa-4-vertical-run.cjs`, pinned runner8bb9fcff, normal host approval accepted; no auto-review rejection. Chromium145.0.7632.6, start02:59:14.538Z/end02:59:22.300Z, natural exit0/7.762s.
+- Thermal limitation: dispatch measured91C at02:59:19 during this short run; its stop-if-still>=85C mail02:59:31 was read after natural completion/release. No sustained temperature qualification; all further heavy work HOLD, no retries.
+- Genuine dependency/CSS/relay identity guards retained; actual readiness/disclaimer acceptance/Upload3/3. No events seeded or submitted. Public deny42 attempts/9 unique destinations; pageErrors0. Browser/private app31864/local relay31865 closed via awaited finally cleanup; resourcesClosed true. Separate `ss` netlink inventory unavailable (Operation not permitted), so no independent socket inventory claim. Preview3000/peer resources untouched.
+- Strict document width passes3/3 initially and21/21 vertical snapshots (initial, three wheel, expanded, expanded-bottom, collapsed per viewport). Original historical362/360 and394/390 failures remain unexplained and retained; no source overflow culprit demonstrated or CSS fix scope proposed.
+
+| Viewport | Body client/scroll height | Body scrollTop after first wheel | Advanced expanded scrollTop at bottom | Publish visible after wheel (height) |
+|---|---|---|---|---|
+| 360x800 | 693/798 | 105 | 319 | 40.4px |
+| 390x844 | 737/798 | 61 | 275 | 40.4px |
+| 1280x720 | 537/749 | 212 | 371 | 38.0px |
+
+- Userwheel moved `.modal-body`, while document/modal/sheet scrollTop stayed0. Initial Publish was outside/mostly clipped; the first wheel made Publish and Advanced fully visible with3/3 sampled points owned by each control in all viewports. Pre-click geometry proves wheel reach independently of locator auto-scroll. Expanded bottom wheel exposed webseed/xs/Publish with owned samples3/3 per target per viewport; Publish was never clicked. Advanced expansion/collapse via ordinary UI3/3.
+- Four associated flag labels per viewport were visible after wheel. Native label text clicks changed checked state and restored it:12/12 checks pass. This establishes sampled effective label activation, not every point in the label rectangle. Mobile label bounding dimensions:118.2x16,53.2x16,64.5x16,249.5x16; desktop110.9x15,50.0x15,60.6x15,234.1x15. Label widths extend native input hit area; measured heights remain small. No missing-label/unreachable inference was needed.
+- Source trace for label geometry: template290-310 wraps each checkbox+text in flex/items-center/gap-2 label with no label padding/min-height; spans use text-sm. CSS checkbox rule1458 applies h-5/w-5; matched generated rule1.25rem, text-sm uses font-size-sm/line-height-snug; tokens font-size-sm at442 and Tailwind config359 map text sizing. These are measured/source-associated small dimensions, not a reproduced historical overflow cause or authorization for token/CSS redesign.
+- Keyboard40Tab steps per viewport: containment120/120 and focus-visible120/120; traversed flags/Advanced/Publish. Close restores Upload trigger3/3. Expanded optional inputs were geometrically measured; Tab traversal occurred after collapse, so expanded-input keyboard qualification remains unverified. Horizontal scroll probe still scrollX0/scale1 in3/3; no real pinch/zoom/touch/device/AA or contrast audit.
+- Evidence JSON `/tmp/playback-qa-4-vertical-result.json`, SHA256 `c94c2cc1097fa2b3df8c42165b4ca51b2cda818c869f849f0c91db872e4522fb`. Bottom screenshots360 `8e88c0fe6e7731e38e48f359a164f3f57a1588041fa99b472e556cb6ee4403f6`,390 `125316df039ab5512a539e5c51fd4434f72000204ac9000db262bc0f7a6ad4a6`,1280 `a67d664f2b3b973d1180397fe400b9590d7aa01699461ef070ed196cb197dff5`; original runner/results retained. No product/CSS/test/helper/config/build/full/submission changes. QA3 CI remains open/unreproduced.
+
+## Source/results-only follow-up: mobile checkbox input interception
+
+Dispatch independently identified input sampling obstruction, distinct from passing associated-label activation. Reanalysis of the same JSON (no new browser): at360 and390 the three native input samples for `check-comments` and `check-no-nip71-mirror` hit `ASIDE#sidebar`, owned=false, in all seven recorded snapshots:42 samples per mobile viewport/84 total. Desktop sampled obstruction0. Other two flag input samples hit their inputs. This establishes point interception; no direct checkbox-box native click was executed, so do not report a measured checkbox click failure or unclickable overall label.
+
+Exact pre-Advanced-click lower snapshot:
+
+| Viewport/input | Input rectangle left/top/width/height | Three sampled x at common y | Hit |
+|---|---|---|---|
+|360/comments|38.375/584.4375/16/16|46.375,41.575,51.175 at592.4375|ASIDE#sidebar all3|
+|360/no mirror|38.375/613.234375/16/16|46.375,41.575,51.175 at621.234375|ASIDE#sidebar all3|
+|390/comments|38.375/628.4375/16/16|46.375,41.575,51.175 at636.4375|ASIDE#sidebar all3|
+|390/no mirror|38.375/657.234375/16/16|46.375,41.575,51.175 at665.234375|ASIDE#sidebar all3|
+
+Associated label text points (e.g. comments x108.65625 and no-mirror x174.296875) were owned and native toggle+restore passed. Bounding label height16px mobile remains a separate size observation. Preserved extracted obstruction entries under `/tmp/playback-qa-4-input-obstruction-{360,390,1280}.json`; complete original JSON retains all input/label rectangles and matched rules. Visually inspected retained360-bottom screenshot: sidebar rail/icons visibly occupy left edge over Upload; screenshot is expanded-bottom state, not the pre-click table state. Existing hashes above unchanged.
+
+Source/rule trace and bounded hypothesis, not proven cause/fix:
+
+- `index.html:147` sidebarContainer is a body sibling of app; modalContainer is nested inside app at375. Sidebar template7 initially marks collapsed; CSS5076-5100 fixes sidebar top/left0, full dynamic height, width sidebar-width, z-sidebar, isolation:isolate. Token224 collapsed width4rem; tokens203-207 define sidebar20/modal100/110/120. Generated matched #sidebar rule confirms those declarations, but runtime computed sidebar rectangle/z-index/pointer-events and complete ancestor stacking contexts were NOT recorded. Do not derive actual stacking from declared z numbers alone.
+- CSS101-108 hides/disables sidebar only under body.modal-open; CSS111 adds the is-modal-hidden guard. Modal container CSS4602-4623 sets fixed/inset/z-modal-root/pointer-events-none/isolation then direct-child pointer-events-auto. Generated matched modal/sheet and sidebar rules preserved; modalContainer itself was not one of the rule collector's selected elements, so its matched/computed runtime cascade is incomplete.
+- Upload `js/ui/components/UploadModal.js:1507-1544` removes hidden, updates shared modal state and activates focus accessibility; it does not itself add body.modal-open/is-modal-hidden. Shared state setter `js/state/appState.js:167-182` updates/notifies state only. Its focus helper `js/ui/components/modalAccessibility.js:142-174` installs key/click listeners and schedules focus; it does not itself apply sidebar guard classes. This makes missing modal/sidebar suppression or an ancestor stacking context a source-supported hypothesis; it is NOT a demonstrated causal chain because other state subscribers/runtime class history were not fully traced or measured.
+- Minimal independent reproduction/ownership review scope: Upload open/close sidebar suppression/state wiring (`UploadModal.js` and existing modal integration), sidebar-vs-modal stacking/guard rules in `css/tailwind.source.css`, and app/modal ancestor context in index.html. No token-value/color/redesign change proposed; no patch/product/CSS scope assigned. Need independent exact point/stack/computed-style confirmation before deciding which file owns a fix. No browser/full/build/submission granted now; client owns next Firefox diagnostic.
+
+Evidence retention candidate consists ONLY of existing dirty `docs/agents/backlog/playback-qa-4.json` plus the two unique notes `docs/testing/playback-qa-4-preparation.md` and `docs/testing/playback-qa-4-boot-blocker-2026-10-22.md`. No commit/merge/submission performed; await docs-only retention review. Historical overflow cause, expanded-field keyboard, real device/AA/contrast, live/media and QA3 CI remain unverified.
+
+## Parked source/results conclusion — 2026-10-24T19:24:15.475268+00:00
+
+Dispatch19:23:54 requests a completed source-only outcome and parking, not a browser dependency. Source/results inspection is complete within available artifacts. The mobile input-point interception is measured, but its **cause is inconclusive**: saved evidence lacks computed sidebar/ancestor stacking geometry, actual modal-open/sidebar suppression class history and a direct checkbox-input click. Associated-label usability remains separately measured12/12. No further causal source evidence was established; declared stacking values alone do not prove effective ordering. Existing exact samples, screenshots and minimal CSS/template/lifecycle inspection scope above are the review handoff; no fix is proposed or authorized.
+
+Exact retention paths (all own dirty work preserved):
+
+1. `docs/agents/backlog/playback-qa-4.json`
+2. `docs/testing/playback-qa-4-preparation.md`
+3. `docs/testing/playback-qa-4-boot-blocker-2026-10-22.md`
+
+No additional browser/fix/gate/build/submission performed. All prior browser grants expired; heavy work remains HOLD. QA4 is parked pending review/routing, not waiting on browser availability. Historical strict overflow failures and QA3 CI limits remain open.
@@ -0,0 +1,30 @@
+# QA4 smallest causal intervention recommendation
+
+Source HEAD `0ffd92a8d2072a19fe61ac6edcf5097a9538fddd`; source-only continuation requested by interpreter20261025T032539. Client owns sole short Firefox control. No QA browser/server/full/build slot granted.
+
+Plan: review preserved measured evidence, isolate one explanatory variable, record strict interpretation and likely owner before any implementation. No product/CSS/retained test/helper/config changes.
+
+## Evidence confirmed without execution
+
+Read-only Python verification exited0: saved result SHA256 ea7a6aa358c488e4937ff3df7c21e24b7cd25488ad81232e21196aa3c255b742 unchanged; native comments input click before=true/after=true and event target sidebar; app finished opacity animation has forwards fill. Previous run supplies one failed native click,18/18 sidebar-first input hits,4/4 strict360 widths,0 page errors. This verification is artifact inspection, not new runtime qualification. All prior notes/dirty backlog preserved.
+
+## Recommended separate one-run A/B measurement
+
+After explicit exclusive-slot grant and fresh resource health, create a distinct scratch script/result path. Reuse genuine actual-app setup/pins, readiness/disclaimer/UI flow, private31864/31865, local synthetic harness identity only and public HTTP/WS deny. Revalidate HEAD and dependency hashes before launch. Do not edit the completed runner or overwrite any original artifact. One360x800 context, one normal wheel to the same lower state.
+
+1. A: capture exact current classes, computed ancestor styles, finished app animation, strict document/client/scroll widths and ordered hit stacks. Make one native comments-input center click; capture before/after and event composedPath. Require the original failure (sidebar target, unchanged checkbox) to reproduce as prerequisite. If it does not, stop naturally and report NOT REPRODUCED without mutation or retry. Preserve this baseline independently of B.
+2. B: remove ONLY the `fade-in` class from `#app` in the scratch DOM (`document.getElementById("app").classList.remove("fade-in")`). This mirrors the existing cleanup action in js/index.js. Do not alter sidebar classes/pointer events, modal-open, z-index, tokens, opacity/style properties, modal nesting or any other CSS. Capture the resulting animation list, computed style, class mutation events and exact rectangles before clicking. No timed sleep or synthetic animationend event.
+3. Require checkbox rectangle/scroll position unchanged; otherwise record geometry change and stop causal comparison. At the same six comments/no-mirror sample points, capture ordered elementsFromPoint. Make one native comments-input center click at the original coordinates and capture checked-state change and event composedPath. Successful B must target checkbox and toggle once; a completed script exit alone does not count. Restore checked state through the previously safe label text only if needed, then close Upload and all owned resources. No restoring fade-in/replaying animation or third trial needed; context closure discards the sole DOM intervention.
+4. Preserve strict width<=viewport checks in both A/B; keep original historical362/360 and394/390 failures explicit. Never describe B as replacing an earlier strict failure or certifying mobile/AA. No publish/file/cloud/media operation. Stop on first blocker, no reruns/retries, no CSS or product mutation retained.
+
+If A fails and B succeeds with unchanged geometry and suppression state, removal of retained app fade-in is sufficient to eliminate this local interception; it supports the retained animation-context diagnosis. It does not establish why animation cleanup was missed, whether suppression integration is independently defective, or parity across viewports/browsers/devices. If B fails, retain that failure and return to measured stacking ancestry; do not add a second suppression intervention to salvage the run.
+
+## Likely owning file and gate before fix
+
+First implementation review target: `js/index.js` animation cleanup at514-553, because the measured retained class is exactly the class that this existing handler intends to remove. This is a likely owner, not assigned write authority or an implementation recommendation. Need independent reproduction of A/B plus startup event timing (whether listener was registered before animation completion, and whether its callback ran) before choosing a minimal fix. A passing class-removal B alone does not justify an arbitrary timer, event dispatch, opacity/z-index change or unconditional global removal.
+
+`index.html` app nesting and `css/tailwind.source.css` opacity animation are read-only supporting scope. Upload suppression is a separate path: UploadModal.open sets appState but does not set body.modal-open; measured absence is real, yet no suppression intervention is proposed in this A/B because it would confound the variable. If dispatch chooses that path instead, it needs separately scoped modal open/close/state ownership and shared-modal lifecycle evidence. No app.js or token/color/redesign scope requested.
+
+Recommendation READY; script not created/executed for this new intervention. New browser/server/test/build/gate/commit/submission counts0. Await resource/ownership routing. No outgoing message attempted or denied-message retry. QA3 CI, historical horizontal overflow, cleanup mechanism and real-device/AA remain unverified.
+
+Recorded UTC: 2026-10-25T03:26:41.740021+00:00
@@ -0,0 +1,42 @@
+# QA4 corrected actual-app causal diagnostic
+
+Printed HEAD `0ffd92a8d2072a19fe61ac6edcf5097a9538fddd`. One native Chromium360x800 run, no retry. Runtime2026-10-26T19:09:24.032Z–19:09:25.820Z; natural exit0. Dispatch190837 and interpreter190751 granted one corrected run; installed health190904 OK/TCPU73.1C/swap-in0. Prior startup90.1C and transient swap-in3/1page snapshots retained in post-restart note; no health configuration change.
+
+Exact command from own checkout:
+
+```
+node /home/user/.local/state/agent-fleet/bitvid/evidence/playback-qa-4/ab-20261026/corrected-prep/run.cjs
+```
+
+Host execution used for private loopback bind; public HTTP/WS denied. Actual application readiness, native disclaimer acceptance/closed-state, existing test-only identity login and native Upload entry all completed. No substitute app, relay seeding or publishing. Genuine dependency archives byte/SHA256/SHA5123/3; original runner/result and corrected runner digest3/3; expected HEAD/source/unique-output guards passed. Runtime genuine Buffer API6/6. Original failed runnerce95cf5c/result868e6dd8 unchanged.
+
+## Measured comparison
+
+- A: native click at(46.375,592.4375) targets `ASIDE#sidebar`; checked true→true. All6 sampled checkbox points hit sidebar first.
+- Sole B intervention: remove `fade-in` from `#app` via DOM classList, matching existing intended cleanup action. No retained product edit, sidebar/style/suppression intervention or synthetic event.
+- B: same native coordinates target `INPUT#check-comments`; checked true→false. All6 sampled points hit intended inputs first. Both checkbox rectangles, body/sheet/document scroll and suppression class state deep-equal before/after intervention.
+- Comments input rectangle x38.375/y584.4375/16x16; modal body scrollTop105; document x/y0. This is an input measurement, not total associated-label touch area or an AA audit.
+- Strict widths A and B: inner/client/document/body360/360/360/360, width<=viewport true. Historical strict failures362/360 and394/390 remain open and unexplained; no390/1280 rerun in this diagnostic.
+- Safe label restoration succeeded. Upload close restored focus to Upload button. No new Tab containment/zoom/real-device coverage.
+
+Result `A_FAIL_B_PASS_SAME_GEOMETRY`. This demonstrates that removing retained app fade-in is sufficient to eliminate the local sidebar interception under unchanged measured geometry. It does not establish why animation cleanup failed, whether startup listener installation missed completion, or that changing CSS/modal suppression is the right fix. Existing js/index.js514–553 listens for animationend/animationcancel and removes fade-in; independent reproduction and startup event/listener timing are required before implementation ownership. Relevant css/components/js/index.js source unchanged since filedAt.
+
+Counts: browser1/readiness1/disclaimer1/Upload1/wheel1/native-input-click2/intervention1. Page errors0; blocked public HTTP10/WS4; local relay events0. Context/browser/relay/server closed; tracked app sockets0 and resourcesClosedtrue. Browser slot RELEASE19:09:25.820Z, recorded in.task/progress and sent dispatch. Sandbox ss socket-list confirmation unavailable (netlink EPERM); cleanup proof is runner finalization plus natural process exit, not a successful independent OS socket inventory. Preview3000 and peers untouched.
+
+Durable runner SHA256 `593fc0556257e1943f61e9496d3fcd5b906dee9025ccbb6368f7ea26d78fc5f2`; result SHA256 `ecf85211a9a9c9c90f002cd925767c0bda5c546cbb2a5bcbc6147bde5f2aac3e`. Full ordered hits/computed styles/animations/mutation events/native composedPaths and cleanup reside in `/home/user/.local/state/agent-fleet/bitvid/evidence/playback-qa-4/ab-20261026/corrected-prep/result.json`.
+
+No product/CSS/helper/config/existing-test edits, retained test, commit/merge/build/full-suite/submission. This scratch diagnostic preserves failing A as its prerequisite and contains no weakened baseline. QA4 stays open pending independent cause/cleanup timing/routing and durable evidence landing; QA3 CI failure remains blocked. Live media/decoder/peers/real accounts/signers/cloud/CDN/release/AA qualification unverified.
+
+Computed evidence: A app animation `0.28s ease-out forwards interface-fade-in`; finished app animation currentTime280ms/fillforwards/progress1 remains. B app animation `none` and app animation absent. Sidebar stays fixed/z-index20/isolationisolate/pointer-eventsauto. These values support the retained animation-context explanation; exact startup listener/event ordering was not instrumented.
+
+## Available startup timing data and source-only follow-up
+
+Runner init script installs a class MutationObserver and capture click observer before navigation. It does **not** instrument animationstart/end/cancel, document.addEventListener registration, module evaluation, cleanup callback entry, CSS load or performance resource timings. Consequently no measured cleanup-listener registration/event ordering can be recovered from this result.
+
+Observed performance.now(ms): app sidebar-collapsed class added957.4; Upload-open snapshot1340.9; A snapshot1396.7; A nativeclick1421.2; sole app.fade-in removal1446.2; B snapshot1449.0; B nativeclick1464.0. No earlier app fade-in removal appears in the captured class mutations. Finished app animation reports localTime280ms, which is animation timeline time, **not** measured navigation-time completion.
+
+Source: index.html164 places fade-in on app; module entry is index.html453. js/index.js static imports1–59 include Buffer mirror dependency via bufferPolyfill.js, plus bootstrap/services. Cleanup listeners are registered at552–553 after synchronous setup calls; function-local awaits earlier in the file do not themselves prove delayed top-level registration. No top-level awaited startup was demonstrated before these listeners. Module fetch/evaluation and initial animation timing remain a plausible race requiring independent instrumentation, not an established mechanism. Later initialization calls startApplication and bootstrapInterface. Do not infer a missing-listener fix from line order alone.
+
+Runner inputs guarded at runtime: peer generated CSS SHA256283d04642d201edba1e9bd5cbc3ede8d74fbd11b50ff0cd2732d463847d2adf3; relay source in both checkouts SHA256ab11b29937690810900d3a16e01e16571ce68d7f02d50c86656b76f47776cba4; genuine mirror buffer.mjs SHA256ff1c4a2377a9df17eaffa1f5b00da3d835f748f3d832a0490bd309756434f73d. Existing peer Playwright loaded read-only; own app31864/local relay31865, synthetic fixture identity only. Archive pins/bytes/SHA256/SHA512 remain in corrected-prep/verified-provenance.json and parent verification record. No dependency installation or product build.
+
+Dispatch191024 directs independent inspection and later browser timing after client RELEASE; no extra QA runtime authorized. Consumed browser hold cleared; next source-only review. Unique evidence remains uncommitted pending normal documentation routing; not a landing claim.
@@ -0,0 +1,37 @@
+# QA4 acceptance plan for client10 animation cleanup
+
+Preparation only at printed QA HEAD0ffd92a8d2072a19fe61ac6edcf5097a9538fddd. Dispatch013223 routes source-only acceptance preparation; exact boundaries read in docs/agents/ROUTING-2026-10-27-client10-animation-cleanup.md from dispatch worktree. Client sole product writer. No runner execution or new browser/full/build/submit grant; implementation API/candidate not yet reviewed.
+
+## Before validation
+
+1. Review READY candidate, exact product SHA/source diff, focused scenarios, per-case failing mutants, meaningful real initialization wiring evidence and lint. Read current primary rules/KNOWN_ISSUES and candidate contract. Obtain separate exclusive bounded browser slot and fresh installed healthOK; START/task/progress before launch. Preserve preview3000/peer servers and use private own app/relay ports only.
+2. Preserve original QA boot failure, native-click A failure and strict historical362/360+394/390 overflow. Keep593fc055 causal runner and all original results immutable. Prepare a new uniquely named durable candidate runner/result, hash/record all inputs and list dependencies in manifest; source/hash guards must identify the actual candidate and matching generated CSS. No fake application, installs/downloads/builds without routing. Verified genuine archive+Buffer mirror, actual application readiness, real disclaimer close UI, existing fixture-only identity, local relay/no events; block/log all other HTTP/WS, including media/trackers. No real account/signer/cloud/publishing.
+
+## Actual-app acceptance matrix (pending execution)
+
+| Scenario | Entry/action | Required observation |
+| --- | --- | --- |
+| 360x800, default motion | Fresh actual-app navigation, disclaimer through native UI, fixture login, native Upload; one bounded wheel to original saved rectangle if reachable | No intervention: native point(46.375,592.4375) hits INPUT#check-comments and toggles exactly once; retain exact checkbox rectangles and modal/document scroll before click. If geometry differs, report it and stop exact-coordinate comparison; do not silently replace with a convenient point. |
+| 390x844, default motion | Same actual UI Upload flow | Measure input rectangle and native center hit/toggle, associated label target size, close and focus restoration; record control rather than assert historical360 coordinates apply. |
+| 1280x720, default motion | Same actual UI Upload flow | Same measured native input/control/close-focus checks, no mobile coordinate assumption. |
+| 360x800, reduced motion | Fresh context with browser reduced-motion preference, same actual UI | Input reachable/toggles once; app visible, no stuck transient context; record actual computed animations. Do not require an animationend event when CSS suppresses animation. |
+
+Every viewport records innerWidth/documentElement.clientWidth/documentElement.scrollWidth/body.scrollWidth plus component rectangles, scroll positions, ordered elementsFromPoint at original six checkbox sample points where applicable, computed app/sidebar/modal animation/stacking/pointer state, native event composedPath and checked before/after. Require strict document width<=viewport as a distinct original assertion, with each failure retained. A width failure must be reported independently of native-click recovery; never relax tolerance or label whole mobile baseline all-green. No app.fade-in removal or other causal B intervention in candidate acceptance: success must come from product initialization itself. Prior failed-A/passed-B remains historical evidence and is not a requirement for the fixed candidate to fail again.
+
+Capture Tab/focus-visible containment and close-focus restoration using native keyboard events with unchanged real UI, critical target rectangles and vertical reachability. Report exact number of Tab steps and element identities; stop if focus escapes. Input16x16 alone is not total associated-label target size/AA compliance. No unsupported zoom or real-device claim; horizontal scroll/zoom coverage only if explicitly included in the bounded run grant. Keep dimensions separate from usability and original overflow diagnosis.
+
+## Animation lifecycle controls
+
+Client focused regressions own deterministic helper/wiring behavior; QA reviews those results before using browser budget. Each retained new case needs its own failing mutant per routing. Candidate API determines the smallest real-module control harness; never claim a module harness is actual-app acceptance.
+
+- Late initialization: native finished interface animation exists before actual cleanup installation. Record native animationend timestamp and real listener/helper initialization timestamp; require finished fade-in/delay cleanup and original input reachability. Instrument transparently before navigation, forwarding original listener registration arguments. If natural app ordering does not exercise late-init, report boundary; do not force delays/retry to manufacture a passing assertion. Use approved deterministic real-module scenario for that branch.
+- Active initialization: still-running matching entrance keeps class/delay until genuine finish/cancel; record native animation state and completion event. Future matching animation retains animation until completion. No synthetic animationend, arbitrary sleep, timeout extension or forced layout.
+- Cancellation: genuine cancellation cleans only the matching supported transient state. Distinguish runtime event semantics from a helper test event model; report whichever was measured.
+- Unrelated animation/classes remain; thumbnail cleanup keeps its existing target/data-attribute contract; repeated initialization does not duplicate listener effects/resources. Review existing controlled regressions/mutants for these rather than invent additional app navigation solely to repeat their coverage.
+- Reduced-motion CSS may yield no animation object/event; review expected initialization behavior in candidate contract and independently record actual browser state. Do not assume no event is a product defect without matching accepted contract.
+
+## Stop, release and reporting
+
+One bounded pass only as granted; stop at first readiness/network/geometry/runtime hard blocker, preserve natural exit and partial counts, no retries or assertion weakening. Discrete strict-width failure remains FAIL even if other authorized measurements continue. Close only owned context/browser/relay/server; relay events must remain0. Record START/endUTC, exact command/SHA/hashes, browser/version/viewports, named checks/pass/fail/unexecuted counts, page/network errors and explicit cleanup evidence plus RELEASE/task/progress. New defect goes to dispatch for ownership; no QA CSS/product/helper/config/test patch.
+
+Remaining gates: READY/candidate review, fresh slot+health, actual candidate execution, unchanged normal landing/build/artifact proof by assigned owner, independent acceptance as routed. Source-only plan executes0 checks and proves no fixed behavior. Missed cleanup demonstrated in prior controlled runs; original horizontal overflow, FirefoxCI, real-device/AA/live playback qualification remain open.
@@ -0,0 +1,44 @@
+# QA4 client10 prelanding native candidate acceptance
+
+Source candidate `aff884169484bd8be01c2620efa8b3b052b31b70` printed from frozen client worktree before launch and checked again after all flows. Read-only sourceRoot `/home/user/Documents/GitHub/bitvid-client-reliability`; actual new helper served directly from candidate. QA ownHEAD0ffd92a8 unchanged; no product/CSS/config/test/helper edits. Dispatch014100 sole bounded grant, prepared runner/input guards reviewed014348. Client full gate/build/landing remain pending, not proved by this pass.
+
+Exact command from own QA worktree (approved host loopback execution):
+
+```
+node /home/user/.local/state/agent-fleet/bitvid/evidence/playback-qa-4/client10-aff88416-20261027/run.cjs
+```
+
+RunnerSHA256 `4fb07ae4bf1c0c45ae0326945b7a37951d89fc216b41e58c91a3117a47202e99`; resultSHA256 `1adb3067cefdac8138d8dcb22c10130a7f7da3f052ff2715440b845c27104e15`. Unique output and immutable original causal runner/results preserved; exact.diff/manifest/README/dependency provenance durable beside runner and registered in state/deps/manifest.txt. Syntax node --check exit0; runtime naturalexit0, `CANDIDATE_ACCEPTANCE_PASS`, 2026-10-27T01:44:11.731Z–2026-10-27T01:44:17.902Z. Native Chromium145.0.7632.6. No retries/sleeps/relaxed widths or diagnostic class removal/intervention.
+
+Startup preparation health014116swap-in82pages,0142368pages,0143052pages recorded tight with ampleRAM/coolCPU; no runtime launched then. Own immediate014352.800 installedhealthOK TCPU58.1C/swap-in0/RAM68.3%/charging70%; no config override or unrelated process stop. START/progress then one browser, sequential fresh contexts.
+
+## Measured outcomes
+
+| Case | Native input center | Strict document/viewport | App animationend/listener registration ms | Native toggle |
+| --- | --- | --- | --- | --- |
+| 360-default | (46.375, 592.4375) | 360/360 | 339.9/758.9 | PASS |
+| 390-default | (46.375, 636.4375) | 390/390 | 320.8/701.8 | PASS |
+| 1280-default | (438.5, 592.765625) | 1280/1280 | 316/687.2 | PASS |
+| 360-reduced | (46.375, 592.4375) | 360/360 | none/677.1 | PASS |
+
+All four native events targeted INPUT#check-comments, changed checked true→false exactly once and label text restored original checked state. Original360 center exactly(46.375,592.4375), same prior16x16 rectangle x38.375/y584.4375 and scroll placement; no intervention. Strict document<=viewport before+after click8/8 true; historical362/360+394/390 failures remain preserved/unexplained separately, not replaced or closed by these passes.
+
+Actual app readiness4/disclaimer native acceptance+closure4/Upload native entry4/nativewheel4/nativeinputclick4/intervention0. Native click controls4/4 pass; Tab containment24/24 across6stepspercase; closefocusrestore4/4; contextclose4/4. Zero widthfailures, zero pageerrors, relay events0. These are named count groups, not a whole release test count.
+
+Each Tab active element matched :focus-visible and stayed inside Upload, order check-nsfw→check-kids→check-no-nip71-mirror→btn-advanced-toggle→btn-submit→closeUploadModal. Immediate default-motion computed focus outlines/rings for several controls were transparent; reduced-motion rings colored. This run measures containment and selector matches, **not** visual ring visibility/contrast after transition or AA compliance. Do not label all focus accessibility green. No added sleep or second paint/visual rerun to salvage this limitation.
+
+Comments label target measured118.171875x16 at mobile widths and110.890625x15 desktop; no-mirror label249.453125x16 mobile/234.109375x15 desktop. Input16x16 mobile (desktop source measurement in full result). Both sampled inputs vertically inside viewport at measured wheel position. Target heights are measurements, not certification of adequate effective touch area or spacing. No real-device or zoom qualification.
+
+## Lifecycle coverage boundary
+
+All three default-motion navigations naturally exercised **late initialization**: genuine app animationend preceded real onComplete registration, yet candidate removed stale app.fade-in before native input click. Native event observer and registration hook installed before navigation; registration forwards original arguments unchanged. Reduced-motion360 had no app animation events and computed app animation none; fade-in class remained, input reachable. Class retention without an animation is not the original animation-context obstruction.
+
+No native active-at-initialization or cancellation branch was exercised, and no extra navigation was added merely to duplicate helper coverage. Those behaviors rely on separately reviewed client focused17case/19mutant evidence; this browser pass does not independently qualify them. Future animations/thumbnail/unrelated/idempotence/disposal likewise remain controlled helper/wiring evidence rather than newly measured native cases. Full timing/mutation/animation state/computed styles/ordered sixpoint hit stacks/click paths are in result.json.
+
+## Isolation, release and pending gates
+
+Public HTTP40/WS16 attempts denied/logged; only own app31864/local relay31865 permitted, genuine Buffer CDN import fulfilled with independently verified mirror. Archive bytes/SHA256/SHA5123/3 and candidate source/index-helper-test hashes3/3 guarded at runtime; Buffer APIs6/6. Peer generatedCSS283d0464 and relayab11b299 matched guarded provenance/source. No local relay seeding/publishing, real signer/accounts/cloud/media or public peers. No build/dependency installation. Preview3000/peer resources untouched.
+
+All4 contexts closed; browser/relay/server closed, tracked app sockets0/resourcesClosedtrue; natural process exit0. RELEASE2026-10-27T01:44:17.902Z recorded task/progress and dispatch outcome. No active runtime left from this diagnostic. No independent OS socket inventory claimed.
+
+Remaining: dispatch exact outcome review, unchanged fullgate/durablelanding+ancestry and build/artifact verification by assigned owner. Original overflow, FirefoxCI, real-device/AA/zoom/visual focus-ring qualification and live playback remain open. QA evidence currently uncommitted; no queue/landing claim.
@@ -0,0 +1,13 @@
+# QA4 evidence landing and remaining scope
+
+This index reconciles historical status language in the preserved preparation/blocker/handoff notes. Those notes describe the time they were written, not new launch authority. QA4's demonstrated native checkbox interception/late animation cleanup slice is complete; whole mobile QA is **not** complete. Backlog QA4 remains deferred for unresolved work rather than marked done.
+
+- Causal diagnostic: playback-qa-4-causal-result-2026-10-26.md. QAHEAD0ffd92a8, naturalexit0, original failed click then only app.fade-in removal toggles at same point/geometry. Original failed boot result and source hypotheses retained in preceding uniquely dated notes.
+- Independent startup timing: playback-qa-4-independent-handoff-2026-10-27.md. Dispatch-attributed actualapp evidence at2754a8af; native app animationend514.8ms before cleanupregistration3245.7ms. One independent hostrun naturalexit0/resourcesclosed, not an additional QA run.
+- Reviewed acceptance plan: playback-qa-4-client10-acceptance-plan-2026-10-27.md.
+- Actual candidate outcome: playback-qa-4-client10-candidate-result-2026-10-27.md. Exactaff884169484bd8be01c2620efa8b3b052b31b70, nativeChromium4flows360/390/1280default+360reduced; original360point toggles with **zero intervention**. Naturalexit0, native4/strictwidth8/Tabcontainment24/closefocus4, lateinit3/reducedmotion1, all resourcesclosed01:44:17.902UTC. Full hashes/runtimeinputs/deniednetwork/counts/limitations in note and durable state evidence.
+- Dispatch015221 reports product landed5b0adf6b via unchanged439-filegate exit0/439unique/discovery/ancestry0;015439 reports hostbuild36716dfe exit0/artifactPASS86fc5236/indexSHA50a89bd6/helperbyteequality and RELEASE. These gate/build details are dispatch evidence, not duplicate QA executions; QA verifies Git ancestry/source equality during documentation landing. This docs-only queue must have its own durable status/ancestry before declaring evidence landed.
+
+Still open: historical strict horizontal overflow362/360+394/390 and its cause; immediate computed default focusring transparency is not visual focus visibility/AA proof; short measured label heights do not certify touch adequacy; real-device/zoom/manual release remain unqualified. Native active/cancel/future/thumbnail lifecycle branches were not exercised in the fourflow acceptance; reviewed client focused/mutant evidence covers the controlled boundary only. QA3 FirefoxCI remains blocked on CI-equivalent failing evidence. No real signer/account/cloud/media/peer/live playback certification.
+
+No CSS/token/z-index/modal suppression/product/config/existing-test changes in this QA evidence slice. No native baseline rerun required absent input change. Next disposition after this docs landing: source-only/idle pending explicit bounded routing. Preserve all historical failures and artifact hashes.
@@ -0,0 +1,9 @@
+# QA4 independent timing handoff
+
+Own printed HEAD0ffd92a8d2072a19fe61ac6edcf5097a9538fddd; no new QA runtime or product change. Dispatch002408 mailbox and independent note read directly at /home/user/Documents/GitHub/bitvid-dispatch/test_logs/TEST_LOG_2026-10-26_19-44-00_dispatch-qa4-independent.md.
+
+Dispatch evidence, not a second QA execution: appHEAD2754a8af1f8e83912e09068135671c453c6de0ce with relevant input diff0; host command naturalexit0,2026-10-26T19:43:59.797–19:44:06.690, A_FAIL_B_PASS_SAME_GEOMETRY. Browser1/readiness1/disclaimer1/Upload1/wheel1/nativeclick2/intervention1/pageerrors0; resourcesClosedtrue/context/browser/relay/serverclosed. Strict360/360. Same native point sidebar true→true, only app.fade-in removal then INPUT true→false. Original sandbox preparation gitEPERM/browser0 result retained separately.
+
+Independent pre-navigation observations: app animationend514.8ms; production animationend cleanup listener registration3245.7ms, lag2730.9ms. This supplies the event/listener order absent in QA's original result, establishing missed startup cleanup in this controlled run. No universal production/network timing claim. RunnerSHA2566feacc4f2c3339db7747f237b3543eccfa1351919c6c02f2aa397060a89ac12c; resultSHA25610f1d3e3ce03504f8e094182f85bb7741a1929096d17f7081a46deb4092c40a5 per directly read dispatch note. QA did not independently hash or rerun dispatch artifacts this turn.
+
+Recovery/handoff only: await dispatch evidence-based cleanup ownership and validation routing. No new browser/test/build/product/CSS/config/submit authority. Original boot failure, native-click evidence, and historical362/360+394/390 overflow remain preserved; original overflow cause and real-device/AA/manual/live qualification remain open. No baseline rerun needed absent changed inputs.
@@ -0,0 +1,11 @@
+# QA4 post-restart checkpoint
+
+HEAD `0ffd92a8d2072a19fe61ac6edcf5097a9538fddd`; QA4 re-claimed, QA3 remains blocked on unavailable CI-equivalent failing evidence. Existing dirty notes and original failed result retained.
+
+- Read primary Oct26 RULE-CHANGES and updated COMMON following interpreter grant20261026T190751. One corrected360 A/B permitted only after fresh installed health OK. Old75C/load8 blanket prerequisite superseded for this bounded run; 85C CPU threshold preserved.
+- Startup ready deps missing0, TCPU90.1C. Subsequent health19:08:21 TCPU77.1C/RAM65% but tight swap-in3pages;19:08:42 TCPU79.1C/RAM63.8% but tight swap-in1page. No launch while verdict tight; no unrelated process stops or config override.
+- Independent archive byte/SHA256/SHA512 verification3/3. Original runnerce95cf5c/result868e6dd8 and corrected runner593fc055 digest checks3/3. Expected HEAD/source/unique output guards pass. Corrected runtime not yet executed.
+- Read-only source review: css/components/js/index.js unchanged versus QA4 filedAt; animationend/animationcancel cleanup still removes fade-in. No conclusion on missed event timing or causal fix.
+- Pending: one corrected actual-app/native UI A/B, strict widths, resources cleanup, independent reproduction/ownership. Historical362/360+394/390 overflow remains open; real-device/AA/CI/live playback unverified. No product/CSS/test/helper/config edits, commit/merge/submission/build/full-suite.
+
+Saved UTC 2026-10-26T19:09:04.589658+00:00
@@ -0,0 +1,62 @@
+# QA4 mobile investigation preparation
+
+2026-10-22, HEAD `4de357e4a7489d6a25466cdec9babd8ed1edd513`. QA4 claimed after newest rules/current prefix read. Prior QA3 remains blocked, not fixed/done; its evidence checkpoint is durable. Latest dispatch20261022T142538 HOLD supersedes the earlier browser grant: no Chromium, server, full suite or build started. Storage may consume the exclusive expensive slot. This note is source preparation, not a new actual-app reproduction.
+
+Plan after explicit browser resume:
+
+1. Serve own current actual app on a private port with verified genuine Buffer; require actual application/harness readiness. Reuse verified generated CSS only with explicit source/output provenance; no build or product rewrite. Deny public HTTP/WebSocket. Synthetic existing harness identity only if needed to reach Upload; no real account, relay events, signer/cloud/media.
+2. Open Upload through real UI at360×800,390×844,1280×720. Capture strict document scrollWidth<=viewport separately per viewport; preserve every failure and prior QA2 failure. No tolerance or alternate relaxed pass.
+3. Persist full DOM node identity/path, bounding/client/scroll geometry, overflow/position/transform/width/padding/border/computed source rules. Account for clipped and animated descendants before identifying a culprit; bounding-box overflow alone is not proof of document overflow.
+4. Measure critical control size/reachability, actual Tab containment, focus-visible styles and close-trigger restoration. Capture screenshot and scroll positions. Local Chromium measurements do not qualify real-device/accessibility/AA behavior.
+5. Stop/report first boot blocker or demonstrated culprit and minimal implicated source scope; release all own resources. No CSS/product/helper/config/retained test edits before independent reproduction/routing.
+
+Source checks: `git diff b1174163 HEAD -- css components/upload-modal.html index.html tailwind.config.cjs postcss.config.cjs` empty. Existing generated CSS at dispatch dist has SHA256 `283d04642d201edba1e9bd5cbc3ede8d74fbd11b50ff0cd2732d463847d2adf3`, equal prior QA2 pin; no build run. Current source checkout lacks generated CSS. Existing genuine reconstructed Buffer bundle SHA256 `2f1f8730af8c9fb08068a41c9c18356b9f48f21635fe5deed6d17fc6b9b97be7` matches QA3 checks; different from historical bundle, with upstream cache/source pins and6 API sanity controls retained in QA3 evidence.
+
+Candidate source locations to inspect against runtime evidence: Upload `components/upload-modal.html` root/modal-sheet/header/body/source-selector; CSS `css/tailwind.source.css` modal rules around1525–1650 including mobile100vw padding, plus modal stack rules around4618. These are inspection locations, not established causes. Prior raw overflowing spans also appeared at desktop without document overflow, so do not infer culprit from that heuristic.
+
+Retained required baseline: QA2 Upload document362/360 and394/390; desktop1280/1280, critical controls horizontally inside, original strict FAIL remains open. No current runtime width/focus/touch result yet. Preview3000 and peer resources untouched. Await explicit resume/browser grant after storage release; no optional Firefox reruns.
+
+Restart checkpoint 2026-10-22: user fleet-start received; PROGRAM/RESUME/TODO/.task/mailbox (0 unread), repo memory, known issues and local/current-unstable RULE-CHANGES read. Current unstable `75bc92f3a47c06ead43c3e715ef8793475635518` newest rule explicitly retains QA4 HOLD/sourceprep. QA4 claim renewed; `git diff --quiet e04549f816f6ec61f305e20df0ce2b59797c4651 HEAD -- css components/upload-modal.html` exit0: relevant source unchanged, runtime applicability remains unverified. Preserved both dirty files without merge. Reported resource blocker to dispatch. No new test/build/browser/server/commit/submission; browser grant remains unconsumed; preview3000 untouched. Await explicit browser resume.
+
+Restart check 2026-10-22T20:40:52.521539+00:00: renewed QA4 claim; mailbox0 unread. HEAD `4de357e4a7489d6a25466cdec9babd8ed1edd513`, unstable `26e9a787cfdc31b77ac35417a5f10e218e2b9662`. Read newest unstable RULE-CHANGES: storage3 full/build, client9 next, QA4 HOLD/sourceprep. Relevant source comparison `git diff --quiet e04549f816f6ec61f305e20df0ce2b59797c4651 HEAD -- css components/upload-modal.html` exit0 (no changes); runtime applicability unverified. Fleet health at20:40:34UTC reports tight: swap52%; memory64.3% available, load3.81/8cores. Preserved dirty claim/preparation, no merge/commit/submission or browser/server/test/build. Await explicit browser allocation; preview3000 untouched.
+
+## Recovery and vertical/effective target audit plan — 2026-10-24T02:51:26.565965+00:00
+
+Own HEAD `4de357e4a7489d6a25466cdec9babd8ed1edd513`; observed unstable `d1d6e0fed1737312129ce4c8a59d129cf3db5b7c`. Read newest unstable rules as well as local rules, latest dispatch/interpreter mail, PROGRAM, RESUME, TODO, repo memory and known issues. QA4 claim renewed. Dirty backlog and both unique notes preserved; no merge/reset/cleanup. Relevant filing applicability command `git diff --exit-code e04549f816f6ec61f305e20df0ce2b59797c4651 HEAD -- css components/upload-modal.html` exit0: no relevant source changes. This does not reproduce the historical failure. Current width3/3 and focus containment/restore3/3 are previous runtime evidence; no new runtime check performed.
+
+Source trace: `components/upload-modal.html:15` sheet combines flex-column, max-h-modal-shell and overflow-hidden; line45 body combines overflow-y-auto, flex-1 and min-h-0. `css/tailwind.source.css:1559-1598` sheet/mobile rules and1631 body rules must be checked against actual computed cascade, because mobile sheet also declares overflow:auto. Flags at template290-310 nest input and span inside clickable labels. Controller `js/ui/components/UploadModal.js:318-324` binds flags/advanced selectors. Submit at template365 is inside the body/form. These identify measurement locations, not demonstrated defects.
+
+Bounded measurement sequence for a NEW explicitly granted browser run:
+
+1. Preserve prior runner/results/screenshots; use a distinct scratch runner and unique result paths. Reuse pinned genuine Buffer/CSS/byte-identical genuine relay guards and prior successful disclaimer acceptance + harness relay setup. Fixed own app31864/local WS31865, no relay seeding, public HTTP/other WS denied. Verify source hashes again before launch; no build/install or blind setup retry.
+2. Same actual-app viewports360x800,390x844,1280x720 and real Upload trigger. Record strict document/client/scroll widths initially AND after scrolling/expansion, without tolerance; retain historical362/360,394/390 failures and later passes separately.
+3. Before keyboard auto-scroll, record viewport/visualViewport and document/modal/sheet/body scrollTop, clientHeight, scrollHeight, rectangles, computed overflowY/maxHeight/minHeight/flex and clipping ancestors. Position pointer over the modal body and send a bounded wheel delta based on its measured scroll range. Record which ancestor actually scrolls. Do not infer scrolling from offscreen rectangles alone or substitute scrollIntoView for the initial user-scroll check.
+4. For each flag, record native input rectangle plus every associated label (`input.labels`), label text rectangles and intersection with viewport and clipping ancestors. Use elementFromPoint at visible label text/center sample points to establish unobstructed ownership. Click one safe visible label text point via native pointer, require exactly one checked-state change, then restore the flag via the same UI. Report effective sampled clickable area separately from input16x16; do not assume the full label bounding rectangle is usable or equate local geometry with an AA audit.
+5. Scroll to lower flags, Advanced Options and Publish. For each, record visible clipped rectangle, obstruction at center, enabled state and whether user wheel scrolling made it reachable. Expand Advanced by normal UI, measure webseed/xs fields and submit reach again, then collapse. Do NOT click Publish, file pickers or cloud actions. If any control stays unreachable, preserve geometry/active matched rules and report first demonstrated culprit for independent reproduction/routing.
+6. Check keyboard reachability of lower controls without activating submit; record focus-visible, modal containment and focus-trigger restoration on close. Prior12-Tab evidence did not traverse every lower control. No real pinch/zoom/touch or device claim; retain prior horizontal scrollX0/scale1 as its limited measurement.
+7. Stop on first setup blocker or demonstrated culprit, record natural exit/counts and cleanup browser/private app/relay only. No browser/full/build/submission until fresh dispatch slot and resource clearance. No CSS/product/existing test/helper/config change or proposed CSS fix without reproduced cause and routing.
+
+This checkpoint executed source inspection and applicability diff only: browser launches0, servers0, tests0, builds0, submissions0. Existing source note and boot-blocker note remain unlanded. Next dependency: dispatch NEW browser slot after HLS qualification/cooling. Preview3000 and peer resources untouched.
+
+## Exact source-only runner prepared — 2026-10-24T02:57:28.454244+00:00
+
+Dispatch02:56:07 accepts the plan but retains HOLD: HLS released02:55:23, latest dispatch79.8C reading02:55:40 requires two cooling snapshots and NEW grant. No browser/server launched.
+
+- Exact eventual command: `node /tmp/playback-qa-4-vertical-run.cjs` from own worktree, only after NEW grant/normal host execution approval. Distinct runner SHA256 `8bb9fcff8791b6dd7a19a5f4049a37eac41379c474977cd9355b8e20e60b541d`. `node --check /tmp/playback-qa-4-vertical-run.cjs` exit0. This verifies syntax only, not runtime.
+- Original runner preserved at `/tmp/playback-qa-4-run.cjs`, SHA256 `80b2bd6a45b78c7d5e5dc1691ecff7a9b0370b5f6a2ce275064e5f21d42c1973`. New results `/tmp/playback-qa-4-vertical-result.json`; screenshots `/tmp/playback-qa-4-vertical-<width>.png` and `...-<width>-bottom.png`, leaving prior artifacts intact.
+- New scratch instrumentation records initial container/label/control clipping/scroll/computed geometry; three bounded user wheel actions; associated label text native clicks+restoration for four flags if visible/unobstructed; lower controls; Advanced expanded/bottom/collapsed geometry; forty nonactivating Tab steps and existing close restore. Strict width flags retained at every snapshot. Matched stylesheet rules include controls and labels. No submit/filepicker/cloud action. Direct native pointer ownership checks precede label clicks; unreachable labels remain recorded, not silently counted as passes.
+- Rechecked Buffer mirror SHA256 `2f1f8730af8c9fb08068a41c9c18356b9f48f21635fe5deed6d17fc6b9b97be7`; generated CSS `283d04642d201edba1e9bd5cbc3ede8d74fbd11b50ff0cd2732d463847d2adf3`; own and dispatch genuine relay source `ab11b29937690810900d3a16e01e16571ce68d7f02d50c86656b76f47776cba4`, `cmp` exit0. Runner retains these guards before any launch.
+- Genuine Buffer provenance `/tmp/playback-qa-3-assets/provenance.json` records cached upstream buffer6.0.3, base64-js1.5.1, ieee7541.2.1 archive integrity+SHA256. CSS remains read-only storage artifact29cbe6f0/source d9424fb7, relevant sources previously verified identical to own HEAD4de357e4. No download/install/build. Relay imported from dispatch only for genuine ws resolution after pinned byte equality; no peer process action.
+- New runtime counts remain0: browser/server/viewport/label/keyboard cases. No new tests or product/CSS/config edits or submission. Historical strict failures and subsequent3/3 width/focus passes retained separately. Execution remains unverified until grant.
+
+## Dispatch interpretation limits — 2026-10-24T02:58:20.718762+00:00
+
+Dispatch02:58:03 reviewed runner8bb9fcff and retains HOLD pending a second cooling snapshot/new explicit grant. First cooling snapshot reported71C/load1.55/RAM62.7% at02:57:40; not a browser grant.
+
+Interpret eventual scratch fields narrowly: `reachable:false` in label sampling means **not measured visible at the sampled final scroll position**, not proven unreachable. Three large wheel deltas may scroll past a label; preserve and inspect all intermediate snapshots before drawing any conclusion. Do not classify a missing final label as a defect. Advanced `locator.click()` may auto-scroll; only recorded **pre-click** wheel geometry can support userwheel reachability. Post-click visibility proves only locator-assisted/native activation visibility. No runner change or retry required; these limitations govern the report. Original8bb9fcff runner remains pinned. Browser/server/new runtime cases still0.
+
+## Fleet restart — 2026-10-24T19:45:35Z
+
+Read mailbox (0 unread), newest RULE-CHANGES, PROGRAM, RESUME, area TODO, .task, known issues and repo memory. Own branch area/playback-qa and unstable both at `0ffd92a8d2072a19fe61ac6edcf5097a9538fddd`. QA4 claim renewed; QA3 remains blocked. Filing applicability check `git diff --exit-code e04549f816f6ec61f305e20df0ce2b59797c4651 HEAD -- index.html components/upload-modal.html css/tailwind.source.css` exit0: relevant source unchanged. This is source equality, not a new reproduction.
+
+Preserved three dirty retention paths; no merge or commit. Saved vertical runner/result SHA256 still match `8bb9fcff8791b6dd7a19a5f4049a37eac41379c474977cd9355b8e20e60b541d` / `c94c2cc1097fa2b3df8c42165b4ca51b2cda818c869f849f0c91db872e4522fb`. Queue check exit0: queue0/lander not running. New browser/server/test/build/submission counts0. Existing parked source/results conclusion stands; awaiting dispatch retention review/routing, all browser grants expired. Historical overflow cause and measured sidebar interception cause remain inconclusive; real-device/AA/CI qualification unverified.
@@ -0,0 +1,19 @@
+# QA4 safe restart handoff
+
+Interpreter mailbox20261026T185756 requests handoff for owner-requested kit update/config approval/restart. This worker does not perform that update or alter config. HOLD all browser/test/build/submission until interpreter update+readiness complete and explicit renewed routing/health guidance. SAFE TO RESTART.
+
+Printed HEAD `0ffd92a8d2072a19fe61ac6edcf5097a9538fddd`. Prior browser slot released; no owned runtime resources left by completed diagnostic. No new process launch, test/build, commit, merge, submission, product/CSS/helper/config edit during handoff.
+
+Durable root: `/home/user/.local/state/agent-fleet/bitvid/evidence/playback-qa-4/ab-20261026/`.
+
+- Corrected preparation `corrected-prep/run.cjs` SHA256593fc0556257e1943f61e9496d3fcd5b906dee9025ccbb6368f7ea26d78fc5f2. Previously syntax exit0; runtime never executed. `corrected-prep/exact.diff` shows only two changed lines versus original: source-correct disclaimer closed-state predicates after native button click, and exact local WebSocket URL components/root slash. No other assertions/deadlines changed. Read corrected-prep/README.md before any future run.
+- Original `run.cjs` SHA256ce95cf5c8ae04db564e38569859a750403ccb8f5b6505c8e19ae8eb3017c8e69 and `result.json` SHA256868e6dd80a0887dce319b5a2a9e5f0be083721541a1f5820d306b8bfe12134a9 rechecked unchanged at handoff. Natural exit1 BOOT_STOPPED at15:25:46.532Z; actualready1, Upload0, wheel0, checkboxclick0/intervention0/A-B0. Failed reconstructed runner mistakenly checked HTML hidden property and denied normalized local WS slash. All context/browser/relay/server resources closed; tracked app sockets0. No causal result.
+- Genuine restored archive directory `/home/user/.local/share/agent-fleet/bitvid/verified-fixtures/npm/` contains buffer6.0.3/base64-js1.5.1/ieee7541.2.1/provenance.json. Own `verified-provenance.json` records independent byte+SHA256+SHA512 checks3/3 before extraction. Durable prepare.py and original repo docs/testing/playback-qa-3-buffer-provenance.json supply recipe/pins.
+- Genuine Buffer support `buffer.mjs` SHA256ff1c4a2377a9df17eaffa1f5b00da3d835f748f3d832a0490bd309756434f73d,65583bytes; six runtime API sanity controls passed on first attempt. Support copied byte-identically into corrected-prep. Bundle output differs from historic tmp mirror because absolute path comments differ; archive provenance exact. Existing dispatch esbuild0.27.3 used only for this dependency mirror.
+- Actual-app serving relies on own checkout; existing dispatch generated CSS hash283d04642d201edba1e9bd5cbc3ede8d74fbd11b50ff0cd2732d463847d2adf3 with source equality guard; genuine relay source hashab11b29937690810900d3a16e01e16571ce68d7f02d50c86656b76f47776cba4; installed dispatch Playwright/ws/esbuild read-only. These are dependencies to register/revalidate after kit update. Never install/download/build/launch merely to test readiness without routing.
+
+Proposed future ONE command, NOT currently authorized to execute: `node /home/user/.local/state/agent-fleet/bitvid/evidence/playback-qa-4/ab-20261026/corrected-prep/run.cjs` from own worktree. Requires update/readiness, resource routing/new health rules, source/hash guards and START.task. Own app31864/relay31865 only; actual disclaimer/Upload UI, synthetic existing fixture identity, local relay/no seed or publishing; public HTTP/WS denied. A original failed native checkbox click is prerequisite; B removes ONLY app.fade-in at same geometry/points then requires genuine native toggle. Stop at first blocker/no retry/second intervention. Preserve strict width<=viewport and historical362/360+394/390 failures. No implementation before independent causal reproduction/startup listener timing and explicit ownership routing.
+
+Dirty existing work preserved: docs/agents/backlog/playback-qa-4.json plus six untracked QA4 evidence notes shown by git status before this handoff. This new note is a seventh untracked QA4 note. No stash/reset/merge/commit or worktree cleanup. QA3 remains blocked on CI-equivalent execution evidence. Original overflow cause, causal A/B, startup cleanup timing, real-device/AA and broader playback/live qualification remain unverified.
+
+Saved UTC: 2026-10-26T18:58:45.907920+00:00
@@ -0,0 +1,53 @@
+# QA4 source-only cause checkpoint
+
+Current source `0ffd92a8d2072a19fe61ac6edcf5097a9538fddd`; saved runtime source `4de357e4a7489d6a25466cdec9babd8ed1edd513`. Interpreter mail20261024T195244 requests source-only continuation, with no browser/server/build/tests and client next heavy slot. Existing three dirty retention paths preserved.
+
+## Measured evidence reanalysis
+
+Read-only Python inspection of `/tmp/playback-qa-4-vertical-result.json` exited0. Seven snapshots per viewport reconfirm42 native-input sample hits on sidebar at360,42 at390,0 at1280; associated-label toggle/restoration4/4 per viewport,12/12 total. Inputs are check-comments/check-no-nip71-mirror. These are sampled hit-test interceptions, not measured failed native-input clicks or a proven stacking cause. Existing strict widths21/21 and Tab120/120 are prior results, not newly executed tests. Historical362/360 and394/390 strict failures remain retained.
+
+## Additional source trace
+
+- ModalManager.js:64-83 obtains modalContainer and passes the imported appState setter through initUploadModal. initUploadModal.js:21-46 passes it unchanged to UploadModal. UploadModal.open:1507-1535 reveals root, sets upload state and activates focus; no body/sidebar suppression class write exists in that path.
+- appState.js:167-182 updates modal state and notifies named/key subscribers. Repository JS search for subscribeToModalState and subscribeToAppState finds their definitions but no consumers; subscribeToAppStateKey consumers in app.js subscribe to pubkey/current user. No source connection from upload state to sidebar suppression was found. This narrows the lifecycle trace; it does not establish actual runtime classes or effective cascade.
+- CSS:100-114 sidebar suppression requires body.modal-open or sidebar.is-modal-hidden. Search of JS/HTML found modal-open writes in other controllers and staticModalAccessibility, no is-modal-hidden writer. staticModalAccessibility synchronizes classes only when its own open/close functions execute; Upload uses createModalAccessibility directly, whose activate handles focus/listeners without that synchronization.
+- index.html:162-166 app initially has fade-in; modalContainer is its descendant, sidebarContainer a body sibling. CSS:4412-4415 fade-in uses opacity animation with forwards fill; js/index.js:514-553 removes transient fade classes on animationend/animationcancel. Source therefore contains transient animation context, but saved results omit app class/animation state. No claim that animation persisted or caused interception is supported.
+- CSS:5576-5604 app width/margin rules do not themselves declare z-index/transform/isolation. Sidebar and modal declarations alone cannot identify an intervening runtime stacking context. No minimal product/CSS patch is justified from these observations.
+
+## Exact missing evidence and smallest next measurement
+
+Cause remains INCONCLUSIVE. Saved snapshots omit body/html/sidebar/app class history, computed sidebar/modalContainer and ancestor styles/rectangles, and complete ordered elementsFromPoint at the intercepted points. A native checkbox-box click was not executed. Rule collector selected html/body/modal/sheet/controls/labels and overflow candidates; it did not deliberately include app/modalContainer/sidebar ancestor chains, so matched-rule presence cannot fill those gaps.
+
+Smallest proposed ONE new bounded run, only after explicit resource grant: reuse pinned genuine offline actual-app preparation and public deny; at360x800 only accept disclaimer/open Upload and wheel once to the same lower state. Before any click capture body/html/sidebar/app classes; sidebar and both ancestor chains with computed position/z-index/opacity/transform/filter/backdrop-filter/isolation/contain/will-change/animation/pointer-events/visibility/display, rectangles and active matched rules; record elementsFromPoint at the three saved relative input points plus label control point. Record class mutations from before Upload open through capture and document.getAnimations timing so transient context is distinguishable. Perform one native click at visible comments input center, recording checked state before/after and event target/composedPath; restore through known safe label UI if changed. Close Upload and capture suppression/stack state again. No style/class mutation experiment, publish, product patch or broad viewport campaign. If this does not reproduce, preserve that result without retries. This run is proposed only, not authorized or started.
+
+No new runtime/test/build/gate/commit/submission; no outgoing acknowledgement required by interpreter. QA3 CI-equivalent execution, historical overflow cause, real-device/AA and live media remain unverified.
+
+Recorded UTC: 2026-10-24T19:54:01.260766+00:00
+
+## Post-outage measurement preparation
+
+Interpreter22:03:18 routes sourceprep only; client sole brief Firefox slot. New scratch script `/tmp/playback-qa-4-cause-run.cjs` SHA256 `fd70de6956c2df0dcdc0f08bfe35b38aae90520c2fdb45ba1c7019d3436e7c04`; `node --check` exit0. Syntax/preparation READY, runtime NOT executed. Exact eventual command `node /tmp/playback-qa-4-cause-run.cjs` from own worktree, only after client RELEASE, fresh health and explicit next-slot approval. Runtime guard requires HEAD `0ffd92a8d2072a19fe61ac6edcf5097a9538fddd`; drift stops before bind. Relevant source comparison against saved runtime4de357e4 returned no diff for index/template/CSS/index.js/appState/ModalManager/initUploadModal/UploadModal/modalAccessibility.
+
+Revalidated existing Buffer/CSS hashes2/2 and both genuine relay hashes2/2, matching prior pins. Script preserves actual-app readiness, real disclaimer/Upload UI, local synthetic identity, no relay seeding/submission, private31864/31865 and public HTTP/WS denial. Original runner/results untouched. One360x800 context; one wheel action then same relative input/label sample coordinates. Captures ancestor computed styles/rectangles/active rules, ordered hit stacks, class mutation history from pre-open and active animation timings; one native comments-input center click/event composedPath, conditional safe label restoration, close-state capture. It makes no style/class mutations. Result/screenshot paths unique `/tmp/playback-qa-4-cause-result.json` and `/tmp/playback-qa-4-cause-360.png`. Awaited browser/app/relay finally cleanup retained; stop on first blocker, no retry.
+
+No browser/server/build/tests/full gate/commit/submission executed. Historical strict failures and prior evidence retained; source cause remains inconclusive until runtime measurement. All earlier browser grants expired; no outgoing ACK sent as instructed.
+
+Prepared UTC: 2026-10-24T22:04:09.008941+00:00
+
+## Approved ONE measurement result — 2026-10-24T22:06Z
+
+Interpreter grant22:05:39 after client RELEASE22:04:51. Verified exact runner SHAfd70de6956c2df0dcdc0f08bfe35b38aae90520c2fdb45ba1c7019d3436e7c04 and Buffer/CSS/relay pins before execution. Fresh fleet health22:05:50 max66C/load1.86/RAM70.5%/battery53%41min; swap91% advisory. Command `node /tmp/playback-qa-4-cause-run.cjs` received normal host approval; no review rejection. Source `0ffd92a8d2072a19fe61ac6edcf5097a9538fddd`, Chromium145.0.7632.6. START22:06:01.125Z, natural exit0, RELEASE22:06:03.621Z, elapsed2.496s. Diagnostic exit0 means completed capture, NOT a passing input interaction.
+
+Counts: one browser/context/360x800 viewport; actual readiness/disclaimer/Upload1/1 each; one wheel; one native checkbox-center click; failed intended checked-state change1/1. Click before=true/after=true at requested46.375,592.4375. Actual click event rounded46,592 targets ASIDE#sidebar; composedPath sidebar/sidebarContainer/body/html excludes checkbox/label. No restoration needed because state did not change. Before-wheel/lower/after-click six input samples each hit sidebar first with checkbox second:18/18 interceptions. Label-text sample points hit spans as expected; no label activation repeated in this run. Prior12/12 label toggles remain separate evidence.
+
+Strict widths360/360 at all four captures, including closed state4/4. Historical362/360 and394/390 failures remain unexplained. Page errors0; blocked public requests14; genuine Buffer route served from hash-pinned mirror, other public HTTP/WS denied. No relay events seeded or notes/media submitted. Own app31864/relay31865/browser closed via awaited finally; resourcesClosed=true. No independent socket inventory performed; preview3000 and peers untouched. Posthealth22:06:10 max63.9C/load1.93/RAM70.2%/battery52%37min, swap91%; no continuous peak-temperature claim.
+
+### Newly measured ordering and source-associated explanation
+
+Sidebar left0/right51.1875, fixed, z-index20, pointer-events auto, visible, opacity1/isolation isolate. modalContainer fixed viewport bounds, z-index100/isolation isolate inside app; Upload fixed z-index100/pointer-events auto. These exact declarations coexist with sidebar first in ordered input hit stacks. Both html/body class sidebar-collapsed; sidebar class sidebar-collapsed, no is-modal-hidden. No watched class changes from before Upload open through close. Suppression selectors body.modal-open #sidebar and #sidebar.is-modal-hidden do not match the measured classes. This confirms absent sidebar suppression during this run rather than merely assuming it from Upload source.
+
+App retains fade-in class with computed animation 0.28s ease-out forwards interface-fade-in. getAnimations records its opacity animation finished/currentTime280/fill forwards/progress1 before wheel, after wheel and after click. Matched generated .fade-in rule confirms opacity0 plus forwards animation; keyframes animate opacity0→1. App ancestors have transform/filter none, opacity1, z-index auto/isolation auto/contain none/will-change auto. This retained opacity-animation context is the source-supported explanation for why the modal descendant does not outrank the sibling sidebar despite its numeric100 vs20. Causal intervention (remove animation/class or apply suppression) was NOT performed. Animation-cleanup failure mechanism/timing remains unverified; do not claim why js/index.js animationend/cancel listener missed cleanup, or generalize to every boot/device.
+
+Minimal independent review/ownership scope is now narrower: index.html app fade-in/modal nesting; js/index.js:514-553 transient animation cleanup; css/tailwind.source.css:4412-4415/5758 opacity animation plus100-114 sidebar suppression and4602 modal root; UploadModal/appState modal-open integration as previously traced. No token/color/z-index value change or redesign proposed. Dispatch must independently reproduce and assign implementation before product/CSS edits. This measurement does not establish the original horizontal-overflow cause.
+
+Artifacts: `/tmp/playback-qa-4-cause-result.json` SHA256 ea7a6aa358c488e4937ff3df7c21e24b7cd25488ad81232e21196aa3c255b742; screenshot `/tmp/playback-qa-4-cause-360.png` SHA256 beb7fc91d13223021951a7f13363ad73181e92c40fbbbf81ccda22fa6eaaa383. Original artifacts unchanged. No retry/product/CSS/test/helper/config/build/gate/commit/submission. QA3 CI, historical overflow cause, causal intervention, other viewport parity and real-device/AA remain unverified.