Merge branch 'unstable' into area/client-reliability

docs/TODO.md

@@ -2,6 +2,9 @@
 
 ## dispatch
 
+- 2026-10-20 parallel trial: rosterbbc1be79 durably green,3 workers launched/read-next-action verified. Item5 ready12f92732 focused28/6mutants/lint/build awaits full+browser; storage-cors real origin loss independently reproduced/fix routed; playback-qa controlled native local fallback3/browser reviewed,test retention approved. Remaining trial product/test full gates,orderly durable landings and preview; actual WebTorrent/live peers/CPU unverified. Initial gate transport/capture failure corrected only by clean environment; QA browser coordination deviation recorded.
+
+
 - 2026-10-20: continuing owner direction: item5 investigation assigned to same worker, active URL media last-owner/shared-owner controls first. Remaining: reproduction and narrow fix routing or next evidenced TODO. No product fix assumed; active abort/live playback/CPU-RSS unverified.
 
 
@@ -47,3 +50,11 @@
 - 2026-10-19: client-reliability-3 ready for normal queue at607d5ce1: full426/426 files exit0 with60s/file bound;27 focused scenarios,14 reverted mutants rejected, lint11/11, build/artifact verification pass. Corrected Chromium/Firefox built-dist/native-observer smoke:0 obsolete starts/stale callbacks/page errors/external requests; hidden reveal and source-health visibility pass. Remaining: normal queue/durable landing/ancestry then close and dispatch landing/final evidence events. Actual playback fallback/live peers, active abort/URL cancellation, CPU/RSS and full Stage3 remain unverified/out of scope.
 
 - 2026-10-19: client-reliability-3 finished and closed after verified normal landing7d20a509 (submissione522efc1, gate exit0, unstable ancestry exit0). Full426/426 files,focused27/27,14 reverted mutants,lint11/11,build/artifact verification and native Chromium/Firefox controlled-IO smokes pass; obsolete starts1→0. Dispatch landing evidence sent; closure metadata/final report follow. Dispatch owns preview sync/rebuild after its resume; mailbox does not wake idle sessions. Actual media fallback/live peers/CPU-RSS, active abort/URL cancellation and whole Stage3 remain outside qualification; no new work without routing.
+
+## storage-cors
+
+- Parallel trial item1: reproduce CORS existing-origin preservation offline before routing fix; no cloud changes.
+
+## playback-qa
+
+- Parallel trial item1: local fallback qualification/regression; browser initially reserved to QA; product read-only.

docs/agents/PROGRAM.md

@@ -13,6 +13,13 @@ Work through the existing TODO backlog and fix reproducible bugs that make the c
 
 ## Rulings log (newest first)
 
+### 2026-10-20 — Bounded parallel trial, owner words relayed by interpreter
+
+> "id really like to stress test the multi agent process so if it needs more agents to get more done faster. do it" — owner, relayed by interpreter; not represented as typed by owner in dispatch.
+
+Interpreter requests executing dispatch plus up to3 workers now with disjoint worktrees/scopes. Routine launches are authorized; retain existing restricted-action limits. Trial measures acknowledged assignments, actual parallel evidence/checks, durable queued landings and contention, not process count.
+
+
 ### 2026-10-19 — Roster-only bootstrap gate (session manager call, VETOABLE)
 
 The first approved worker is assigned to the pre-existing profile-modal test hang. Normal roster-before-launch ordering otherwise invokes that same hanging full-suite gate before a worker can investigate. For this one administrative roster/brief commit only, dispatch will use a temporary queue configuration whose gate verifies the exact committed change contains only the expected area registration and documentation/backlog metadata, with product code, tests, and persistent gates unchanged. No product fix is covered by this exception. Preserve normal full gates for subsequent code. Record the actual gate result and disclose the unresolved unit failure.

docs/agents/backlog/playback-qa-1.json

@@ -0,0 +1,9 @@
+{
+  "id": "playback-qa-1",
+  "area": "playback-qa",
+  "status": "open",
+  "title": "Qualify local hosted-source fallback with independent regression and browser evidence",
+  "blockedOn": null,
+  "addedOn": "2026-10-20",
+  "filedAt": "0c1dd7e86be3e28edc96aca47f7753a98990dde0"
+}

docs/agents/backlog/storage-cors-1.json

@@ -0,0 +1,9 @@
+{
+  "id": "storage-cors-1",
+  "area": "storage-cors",
+  "status": "open",
+  "title": "Reproduce existing-origin loss in bucket CORS provisioning using offline transport",
+  "blockedOn": null,
+  "addedOn": "2026-10-20",
+  "filedAt": "0c1dd7e86be3e28edc96aca47f7753a98990dde0"
+}

docs/agents/prompts/client-reliability.md

@@ -1,6 +1,14 @@
 # Area: Client reliability (client-reliability)
 
-## Current assignment: client-reliability-5 — active probe investigation
+## Current assignment: client-reliability-5 — prevent orphaned mirror continuation
+
+Investigation at0c1dd7e8 found a narrow defect, independently reproduced by dispatch at47953970 (administrative roster only): after last-owner disposal during active primary media, primary error starts1 fresh mirror HEAD(expected0). /tmp/bitvid-dispatch-5-active-url.mjs mirror-disposed --expect-no-obsolete-head exits1 after cleanup/retry; mirror-shared control exits0/healthy,resources0/slots0. Bounded active retention/success caching itself is intentional and not a defect.
+
+Implement controller-only lifecycle guard before next mirror request: temporary ownership js/ui/urlHealthController.js, focused tests/url-health-lifecycle.test.mjs and your unique integrity/evidence notes. Existing ownership hook is sufficient. Do not change observer/app/shared cache/HEAD-media-HLS-torrent abort,TTLs/limits/mirror order. Ensure cancellation settles with explicit cancelled outcome, no negative cache, no stale UI or newer inflight deletion. Preserve shared/rejoining live owners and ordered mirrors, active healthy cache and normal timeout/retry behavior. No competing writers: storage-cors owns only storage helper; playback-qa product read-only.
+
+Read current rules/test integrity before edits; retain actual observer/controller/cache regression with controlled external IO and mock clock, no sleeps/retries. Test disposed active failure starts0 mirror HEAD; shared/rejoin owner continues; active success cache,timeout/retry and inflight identity preserved. Every new scenario needs reverted failing mutant. Relevant focused tests/lint/build; coordinate full suite/normal queue through dispatch before expensive run (roster full gate currently underway). QA initially owns shared browser: do not launch browser until dispatch allocates it; request availability and use only your own server/port. No blanket prior-suite reruns for administrative edits. Commit item5, merge unstable (never rebase), unchanged gate/durable ancestry before close. CLI/agent/lander launch must unset inherited NODE_TEST_CONTEXT test transport (operational environment correction, no assertion/gate change). Send blocker/product landing/final events with exact checks/counts/gaps. Dispatch owns preview3000 refresh. No subagents/kit/scheduler/external operations. Continue next actions via dispatch routing under existing owner direction.
+
+## Archived investigation: client-reliability-5
 
 Interpreter checkpoint2026-10-20 confirms continuing development under existing direction. Claim item5 after non-destructive merge of unstable. Read RULE-CHANGES, KNOWN_ISSUES, PROGRAM, and performance-efficiency-plan Stage3. Items3/4 are completed: queued torrent/URL cancellation shipped; do not repeat their full qualification.
 

docs/agents/prompts/playback-qa.md

@@ -0,0 +1,13 @@
+# Area: Playback fallback QA (playback-qa)
+
+## Assignment: playback-qa-1
+
+Independent regression/browser QA slice of pre-launch TODO34/performance-efficiency-plan Stage3 acceptance: dead hosted source falls back to viable torrent/mirror. Recent queued-probe fixes89ccb907/7d20a509 have controlled health lifecycle qualification but real playback fallback remains explicitly unverified. Existing webseed-playback.spec.ts uses public archive media and tolerates decode failure; do not modify or treat that as real offline success.
+
+Inspect actual playbackCoordinator/service and current test harness. Build a bounded local-only deterministic fallback scenario against actual orchestration: failed primary, alternate selected once, original magnet hash and hosted webseed preserved, terminal failure settles if both fail. Start scratch investigation; report fidelity of substituted IO. Prefer local decodable media if available; no downloading public samples or live peers. Browser is initially allocated to YOU: record ownership in .task, tell dispatch before opening and on release, clean only your own server/browser. Use your worktree/private port, never preview3000. Native Chromium+Firefox where available; no claim of real torrent/decoding unless measured.
+
+Own only new tests/e2e/fleet-playback-fallback.spec.ts or tests/fleet-playback-fallback.test.mjs plus docs/testing/playback-qa-* evidence/integrity and own backlog. Product JS and existing tests/helpers/config read-only. Propose retained regression approach before adding it; no app.js competing writer. Deliberately disable fallback in a temporary mutant in your own isolated tree and require failure, restore without committing product mutation. If actual product defect found, report exact trigger and minimal owner/file scope to dispatch; do not patch product. Scope stop after bounded QA result, retained valuable test if approved, evidence and durable normal landing. Full gate/build scheduling through dispatch; do not run full E2E suite in parallel with other gates.
+
+## Coordination and limits
+
+Send dispatch a read/next-action acknowledgement immediately, then claim your item and keep .task current. Record start/end UTC and time blocked by tools/browser/gates. Report exact SHA/commands/counts/unverified scope; mailbox on blocker, reproduced result, landing and final. Read RULE-CHANGES, PROGRAM, KNOWN_ISSUES, repo memory, and test-integrity before changes. New tests require failing mutants; no weakened expectations/retries/sleeps. Product/test fixes must be scoped from demonstrated evidence. No shared TEST_INTEGRITY.md or docs/TODO.md edits: keep uniquely prefixed integrity/evidence notes under docs/testing and ask dispatch to integrate status. Do not edit another area worktree or stop another process. Full-suite runs and product landings need dispatch resource coordination (one expensive gate at a time, unchanged normal landq). Focused offline checks can overlap. Commit named files via fleet tool; merge unstable, never rebase; normal queue/durable status+ancestry before close. No subagents initially. No deploy/push/spend/real-wallet/production-data/secrets/scheduler/kit changes. Preserve preview3000. Public network/real buckets/signers/peers forbidden in fixtures.

docs/agents/prompts/storage-cors.md

@@ -0,0 +1,17 @@
+# Area: Storage CORS reliability (storage-cors)
+
+## Assignment: storage-cors-1 — preservation fix routed
+
+Implementation routed after worker and independent dispatch offline reproduction: adding second origin replaces the entire existing rule, existingRulesPreserved0/1. Dispatch command env -u NODE_TEST_CONTEXT node /tmp/bitvid-dispatch-storage-cors-reproduce.mjs exits1 at strict false!==true after all5 characterization controls. No cloud IO.
+
+Now implement only s3-multipart.js plus GetBucketCorsCommand export in s3-client.js and new storage-cors-preservation test/integrity note. Preserve every existing rule and all fields verbatim; add a separate existing-default-shaped rule for uncovered requested origins without broadening arbitrary rules. Idempotence: no PUT when existing equivalent default rule already covers all requested origins; explicitly test equivalent-rule detection and repeated calls. Missing config only on NoSuchCORSConfiguration; other read failures propagate with no PUT. Do not guess wildcard equivalence or merge restrictive/custom rule semantics. Preserve empty-origin no-op. Tests must use actual helper/command export, fake transport only, cover existing rules/wildcards/duplicates/no-config/read-denied/idempotence and bounded provider errors; do not silently replace on read failure. Do not change current default methods/headers/TTL as unrelated policy; if SDK/provider limits make safe preservation impossible, report before broadening. Offline mutants for every new scenario; preserve normal assertions/gates. Relevant focused storage suites/lint/build; request full-suite slot (client ahead), no browser/cloud need. CLI/test/lander launches clear NODE_TEST_CONTEXT. Commit item1, merge unstable, normal queue/durable ancestry before close; no premature qualification of real S3.
+
+Historical investigation context follows; its before-product restriction is superseded by the routed scope above.
+
+Bounded parallel trial: validate todo/TODO_2026-06-16_r2-followups.md CORS replace-not-merge report at current HEAD. Dispatch inspected ensureBucketCors in js/storage/s3-multipart.js: constructs PutBucketCors with requested origins only, no GetBucketCors. This is evidence for investigation, not proof every caller loses policy. Trace actual callers and required existing-origin behavior. Reproduce offline via real helper and fake S3 transport/SDK boundary: an existing origin/rule, adding a second origin, idempotent repeated call, missing config and read-failure cases. No cloud credentials/network/bucket mutation.
+
+First report smallest demonstrated loss plus proposed preservation semantics/files to dispatch before product changes. Inspect AWS command export in s3-client read-only. You own s3-multipart.js/s3-client.js and new tests/storage-cors-preservation.test.mjs only after fix routing; no R2/S3 upload service copies, app, signer or UI edits. Existing wildcard/method/header/non-origin rule semantics must not be guessed; read failure must not silently overwrite a policy. Do not add broad SDK/dependency upgrade. If stale/already fixed, close with evidence and propose next independent TODO. No browser initially. Relevant focused storage checks, lint, full normal gate/build after approved fix; ask dispatch before expensive runs. Integrity notes docs/testing/storage-cors-integrity.md.
+
+## Coordination and limits
+
+Send dispatch a read/next-action acknowledgement immediately, then claim your item and keep .task current. Record start/end UTC and time blocked by tools/browser/gates. Report exact SHA/commands/counts/unverified scope; mailbox on blocker, reproduced result, landing and final. Read RULE-CHANGES, PROGRAM, KNOWN_ISSUES, repo memory, and test-integrity before changes. New tests require failing mutants; no weakened expectations/retries/sleeps. Product/test fixes must be scoped from demonstrated evidence. No shared TEST_INTEGRITY.md or docs/TODO.md edits: keep uniquely prefixed integrity/evidence notes under docs/testing and ask dispatch to integrate status. Do not edit another area worktree or stop another process. Full-suite runs and product landings need dispatch resource coordination (one expensive gate at a time, unchanged normal landq). Focused offline checks can overlap. Commit named files via fleet tool; merge unstable, never rebase; normal queue/durable status+ancestry before close. No subagents initially. No deploy/push/spend/real-wallet/production-data/secrets/scheduler/kit changes. Preserve preview3000. Public network/real buckets/signers/peers forbidden in fixtures.