Merge branch 'unstable' into area/client-reliability

docs/agents/CAMPAIGN-2026-10-22.md

@@ -1,6 +1,6 @@
 # Six-priority campaign — 2026-10-22
 
-Owner: "yeah lets get the fleet spun up and address all of these", relayed by interpreter at14:02:34Z. Routine YES14:03:29Z. Prior holds superseded only within this foreground scope. Baseline unstable fb54cea3. Team is dispatch plus three existing workers; windows alive, assignments sent after durable coordination landing. A sent assignment is not an acknowledgement.
+Owner: "yeah lets get the fleet spun up and address all of these", relayed by interpreter at14:02:34Z. Routine YES14:03:29Z. Prior holds superseded only within this foreground scope. Baseline unstable fb54cea3. Team is dispatch plus three existing workers; windows alive. Coordination c6022f21 landed c5b678f7 (durable status/log/ancestry checked). All three assignments acknowledged at c5b678f7: storage14:08:34Z, QA14:08:41Z, client14:08:44Z; each reports safe fast-forward and claim. No browser/expensive process started at acknowledgement; QA retains initial narrow slot. No current tool blocker reported.
 
 | Priority | Accountable owner / item | Immediate action | Acceptance / boundary |
 |---|---|---|---|
@@ -21,3 +21,9 @@ Owner: "yeah lets get the fleet spun up and address all of these", relayed by in
 6. Verify required focused/lint/mutants and unchanged normal gates; land via queue, verify durable status + unstable ancestry before closing. Integrated build/artifact/local preview and final six-row status, honest live/manual blockers.
 
 No deploy/push/spend/production data/real-wallet/credential/live signer/cron authority. No retries, sleeps, force exits, weaker assertions or speculative fixes. No background monitoring claim. Read KNOWN_ISSUES before debugging; existing Firefox flakes and logout failure are baselines, not presumed causes of this CI failure.
+
+## 14:12UTC evidence/routing checkpoint
+
+QA released first browser14:11:17Z: original3 scenarios pass but app bootstrap failed because Buffer CDN was denied, so not CI reproduction. Next exclusive narrow Firefox diagnostic authorized only with pinned genuine cached Buffer and actual readiness, preserving assertions and isolated control; no broad/full/build.
+
+Storage3 dispatch-independent scratch on7369f1fe/runtime-equivalentc5b678f7:7scenarios/3pass/4fail/network0, naturalexit1/29.89ms. Service snapshot/persistent cache leaks original deleted version; old tombstone unconditionally removes newer live active version in buffer; overlapped coordinator older result renders deleted reference at renderVideoList boundary. Two smallest service/buffer fixes routed in separate commits with mutants/controls; coordinator remains open/read-only pending faithful registered lifecycle evidence. No DOM/production proof.

docs/agents/prompts/client-reliability.md

@@ -1,3 +1,11 @@
+## Implementation routing 2026-10-22 — client-reliability-9 HEAD only
+
+Dispatch independently ran11 scratch modes via dispatch imports at169d894f (runtime identicalc5b678f7):3 fail naturally(disposed/same-turn/later),8 pass(shared/cross/legacy/live-success/error/timeout/late-success/error),cancelled0. Final owner retains1HEAD/0abort/1timer5000ms/unsettled/original inflight; media slots0/queue0. Minimal implementation authorized ONLY js/ui/urlHealthController.js HEAD probe lifecycle cancellation hook/cleanup plus tests/url-health-lifecycle.test.mjs or unique HEAD lifecycle tests and strict integrity/spec/evidence notes. Existing observer/cache/app/HLS/torrent modules remain read-only.
+
+Explicit spec correction permitted: prior queued/media-only completion does not fulfil source-backed Stage3 active HEAD last-owner cleanup. Preserve failed baseline and existing live/shared/legacy controls; equally strict or stricter changed expectations with Test Integrity Note. Release final-owner HEAD by marking cancelled synchronously, abort transport, settle null promptly without waiting for ignored abort/timeout, remove timer/hook exactly once; no cache, stale badge, fallback media/mirror start or replacement deletion. Fresh same-turn and later owner must start fresh request, old success/error/timer/finalizer cannot affect it. Preserve live HEAD success/error/timeout fallback, shared/cross/ownerless legacy ownership, media-hook handoff and FIFO/queue bounds. Add transport ignoring abort, missing AbortController, cancellation-before-start/at-handoff, late callbacks and replacement controls where applicable. HEAD only, do not conflate Range GET task or HLS/torrent completion; measure those later separately.
+
+Focused regression + restored failing mutants + lint now, request serialized full/browser slot when ready, no expensive job or normal product submission without grant. QA has conditional next narrow Firefox slot. Normal local queue/gates/durable ancestry required. No retries/sleeps/force exits/relaxed expectations, external/signer/cloud/credential authority unchanged.
+
 ## Current assignment 2026-10-22: client-reliability-9 — remaining active cancellation
 
 This supersedes the old item8/idle scope below. Read current dispatch campaign brief, PROGRAM/RULE-CHANGES/KNOWN_ISSUES and test integrity. All worktrees were clean at dispatch inspection; inspect your own status then fast-forward own branch to unstable if safe (never discard work); report exact SHA and ack next action. Claim item9. Start actual observer/controller active HEAD-request last-owner/shared/same-turn+later rejoin offline measurements. Use controlled fetch/abort, count settlement/slot/cache/mirrors/stale callbacks; retain live success/error/timeout/FIFO and replacement identity controls. HEAD first, HLS/torrent separately tracked, no wider completion claim. Source/scratch/unique evidence only; NO product or committed test changes until demonstrated defect and dispatch routing/spec note. Do not inherit previous item8 implementation permission for HEAD. Own future health files as roster, app/services/cache read-only. No full suite/build/browser/normal product submission yet; QA has initial expensive/browser slot. env -u NODE_TEST_CONTEXT for commands, no force exit/retries/sleeps. Send read/next action, reproduced result/blocker and READY for checks. After this slice, playback and Amber remain staged in campaign; await bounded routing, not optional self-selection.

docs/agents/prompts/storage-cors.md

@@ -1,3 +1,11 @@
+## Implementation routing 2026-10-22 — storage-cors-3
+
+Dispatch independently reproduced all7 scratch scenarios using dispatch imports at7369f1fe (runtime diff0 vsc5b678f7):3pass/4fail, naturalexit1/29.89ms/network0. Temporary ownership ONLY js/nostr/videoEventBuffer.js and js/services/nostrService.js plus new uniquely named focused regression/integrity/evidence files. This supersedes investigation-only restriction for these two boundaries; existing client.js and app/feedCoordinator.js remain read-only.
+
+Separate commits: first buffer timestamp-safe deletion (recordTombstone already protects strictly newer active content; remove no valid newer version), then service snapshot/persistent eligibility + obsolete affected-record cleanup. Retain failed baseline and independently failing mutants for every new scenario. Do not invent root/address/author rules or broaden deletion across authors; use existing authoritative tombstone semantics and verified conversion path. Cover deletion-marker ID differing from original; late older tombstone against newer live; late older content; multiple versions/unrelated roots/authors; deleted/invalid persistent entries; empty-result persistence so deleted-only caches do not resurrect; warm/second-load/latest-consumer and stale-subscription controls. Preserve live cache/moderation/access/ordering and publication semantics. Report any preexisting identity weakness separately rather than opportunistic rewrite.
+
+Coordinator stale-refresh result remains OPEN: current scratch pauses actual feed engine decorator and calls actual coordinator, but is not full registered UI lifecycle proof. Gather faithful registered-feed/view/disposal overlap evidence only after first fixes; no coordinator/app edits yet. No tests/runner/helpers changes to bypass contract. If new test needs explicit registration, ask dispatch for narrow ownership. Run focused suites, failing restored mutants and lint; request serialized full gate before product submit; QA holds narrow Firefox browser slot. Normal gates/durable ancestry mandatory. No real signer/cloud/relay/deletion/credential operations.
+
 ## Current assignment 2026-10-22: storage-cors-3 — feed/view tombstone stale-refresh
 
 Supersedes old idle/storage2 and deferred3 scope below. Read dispatch campaign brief, PROGRAM/RULE-CHANGES/KNOWN_ISSUES and docs/nips before Nostr investigation. Inspect own worktree and safely fast-forward clean branch to unstable; preserve any unexpected work; report SHA, claim item3, send read/next-action. Read actual tombstone/deletion/cache/view lifecycle; reproduce delete ingest followed by stale refresh/late older event/view switch with synthetic offline events/controlled IO. Check unrelated live/newer valid content and existing deletion semantics; do not invent new policy. Source read/scratch/unique evidence/backlog only; NO product/committed test edits until demonstrated defect and precise ownership routing. App/feed/services/Nostr shared modules remain read-only for now. No real signer/relay/cloud/credentials/delete; no browser/build/full suite/normal product submission yet, QA owns initial expensive/browser slot. Focused offline checks permitted, env -u NODE_TEST_CONTEXT. Report path and strict failed/control counts or already-fixed evidence, proposed smallest files/retained regression and remaining limits. No optional new storage work after this slice without campaign routing.