Release v0.4.0-alpha: promote dev to main

.agents/inbox/2026-10-23-browser-startup-evidence.md

@@ -0,0 +1,74 @@
+# Distinguish the static loading shell from a mounted application and retain failure traces
+
+Date: 2026-10-23. Searched `tests/e2e/quality/button-content.spec.ts`, the unified
+manifest/adapter, Playwright configuration, prior responsive acceptance lessons,
+`packages/web/index.html`, and `App.tsx`. Public tracking: #156.
+
+The strict combined acceptance run on frozen
+`f8a11e16a593738d485547eb1dfe117438cc3ed6` reported this failure before button
+inspection on one route/viewport iteration:
+
+```text
+Locator: locator('main')
+Timeout: 5000ms
+Error: element(s) not found
+Snapshot: GraphDone Logo / GraphDone Loading...
+```
+
+The screenshot and DOM snapshot exactly match the static HTML shell in
+`packages/web/index.html`: Loading text and empty placeholder cards. React's
+authenticated initialization screen instead says Initializing and includes
+feature text; route Suspense appears inside Layout's main element. Thus this
+failure establishes that the mounted application was unavailable at the
+deadline, not that a button label was clipped. It does not by itself distinguish
+delayed module loading/execution from a startup error.
+
+The screenshot timestamp was 12:53:58 America/Los_Angeles. Docker build/export
+work overlapped the run and the generic image build log completed at 12:55:38.
+Resource contention is a hypothesis, not a proven cause. The original artifact
+did not identify the current route or exact viewport; its 375-by-1144 full-page
+PNG dimensions do not establish the viewport. No trace existed because the
+global setting was on-first-retry while the strict sequence used zero retries.
+Artifacts remain in the candidate worktree's ignored
+`test-artifacts/playwright-output/quality-button-content-*/` directory and must
+be preserved before another run.
+
+Corrective rule: keep zero retries and existing deadlines, but record
+retain-on-failure traces for required browser sequences. Label every route and
+viewport iteration and attach bounded browser errors when the sweep fails.
+Copy trace/diagnostic files into the retained unified report before another
+Playwright process can clear its shared output directory. Do not equate the
+absence of API errors with successful frontend startup.
+
+Evidence-only correction on public PR175 base `1a16d4e`: three new controlled
+child-process tests first failed because the actual Playwright command lacked
+failure-only tracing. A fourth failed because the adapter dropped trace and JSON
+attachments. After correction, Node 22.23.4 `npm run test:unified:lib` passed
+156/156 with zero skips, including bounded event capture, credential/URL
+sanitization, listener cleanup, and file retention after deleting the original
+Playwright output. Playwright `--list` still collected the single unchanged
+button sweep. Logs: `/tmp/core-browser-diagnostics-{red,retention-red,final}.log`.
+
+Independent review then reproduced a source-boundary defect inherited from the
+image/video materializer: an attachment could name an unrelated local file or
+follow a symlink, copying it into a downloadable report. Owned outside-root
+sentinels established the failure without reading real secrets. Four new CLI
+controls failed before correction (outside-root source, file symlink, parent
+directory symlink, and directory instead of a file). New downloadable files now
+require regular files under the canonical repository `test-artifacts` root with
+no symlink traversal; the adapter rejects unsafe evidence and the materializer
+rechecks immediately before copying. The legitimate copy/retention case still
+passes. Final stdlib validation: 160/160 passed, zero skips, recorded in
+`/tmp/core-browser-diagnostics-reviewed.log`.
+
+The custom JSON diagnostic capture applies bounded credential/URL redaction;
+Playwright trace ZIPs remain raw and can contain network headers and bodies.
+Retain those locally with the disposable test artifacts and share measured
+summaries, not raw authenticated traces. Standalone and dashboard report views
+both render these new files as escaped download links rather than images.
+
+Limits: these checks validate evidence collection and command forwarding, not
+the underlying startup failure or deployed health. No browser was launched and
+no application code, deadline, retry policy, or assertion threshold changed in
+this correction. A serialized complete acceptance rerun is still required;
+retain the earlier failed run and distinguish observations from causal claims.

.agents/inbox/2026-10-23-core-startup-and-save-evidence.md

@@ -0,0 +1,17 @@
+# Builds and save acknowledgements need boundary-specific validation
+
+Date: 2026-10-23. Existing guidance searched: `docs/quality/TEST_STRATEGY.md`,
+the dated runtime/durability lessons, and `.agents/issues/INDEX.md`. This pointer
+keeps the detailed incident records canonical rather than duplicating them.
+
+| Symptom / cause | Canonical dated evidence, correction and limits |
+| --- | --- |
+| A successful build hid API peer-resolution and launcher failures | [Runtime validation](../../docs/quality/RUNTIME_VALIDATION_2026-10-23.md): use a pinned clean install, actual startup, supported runtimes and owned browser fixtures. Container/build success alone is not deployment evidence. |
+| Missing/default production secrets were accepted; `.env` loaded after key capture | [Production secrets](../../docs/quality/PRODUCTION_SECRETS_2026-10-23.md): validate configuration before authentication initializes; negative controls must stop before DB/listen, with configured positive controls. The later integrated lint check found an ambient type annotation missed by typecheck; the type-only follow-up preserves runtime behavior. |
+| A delayed save/refetch erased a newer date edit or repopulated cleared undo history | [Details-save completion](../../docs/quality/DETAILS_SAVE_COMPLETION_2026-10-23.md): preserve newer fields, scope completion to the current editor, require the expected acknowledgement, and retain the undo clear generation. Real Apollo regressions preserve failing-before evidence; they do not replace the combined browser gate. |
+
+Commands, observed outputs, source revisions and scope limits remain in those
+dated records and the [Core merge-validation ledger](../../docs/quality/CORE_VALIDATION_2026-10-23.md).
+Keep failed runs and synthetic execution failures distinguishable from product
+cases. Carry these pointers and their regressions through public review; neither
+an unpublished local note nor a pending ledger field is a release pass.

.agents/inbox/2026-10-23-dependency-audit-scope.md

@@ -0,0 +1,11 @@
+# Audit counts need source reachability and bounded regression evidence
+
+On 2026-10-23, the unchanged runtime lock at `6b2a007` produced 23 full-audit package entries and eight production-only entries. An isolated lint-tool correction reduced the full count to 17, while production remained eight. The canonical [security scope](../../docs/quality/SECURITY_SCOPE_2026-10-23.md) records families, priorities, authentication probes, and limits.
+
+Evidence: `npm audit --package-lock-only --json`, `npm audit --omit=dev --json`, a clean lockfile install, `npm run lint`, `npm run test:unified:lib` (106 passed), and `npm run test` (434 passed, 25 database-gated skips). The minimatch regression fails against 9.0.3 at its bounded two-second child deadline and passes against the scoped 9.0.7 override. A separate real in-memory SQLite probe returned two successful verifications of one magic-link token; a synthetic CAPTCHA code was also accepted. No deployed credentials or shared database were inspected.
+
+Cause: advisory severity and dependency classification do not describe the actual call site. Conversely, a browser-only lockout and a green production dependency gate do not establish backend abuse controls. Historical documentation had described UI attempt tracking as completed brute-force protection.
+
+Corrective rule: record the exact source/lock snapshot, distinguish package entries from distinct vulnerabilities, trace runtime inputs and deployment packaging, reproduce suspected application gaps in owned fixtures, and keep version updates narrow enough to validate. Preserve negative controls in the existing harness; do not suppress findings by relabeling dependency categories.
+
+Limits: reachability conclusions are bounded source observations, not proof of non-exploitability. Authentication follow-ups remain open. The security-scope document is the reviewable record; local log paths alone are not published validation.

.agents/inbox/2026-10-23-dev-admin-integration.md

@@ -0,0 +1,42 @@
+# Owner-authorized admin integration still needs independent evidence and post-merge checks
+
+Date: 2026-10-23. Searched `CLAUDE.md`, the symptom index and the existing
+live-ref/transport lesson. Earlier audit notes recorded a non-author approval
+blocker. The owner then explicitly authorized leaving `dev` administrator
+enforcement disabled permanently, with a high testing bar for agent integration.
+This changed the operating authorization; it did not create a non-author review.
+
+The first integration used the native admin merge for
+[PR #157](https://github.com/GraphDone/GraphDone-Core/pull/157); no SSH fallback
+was needed. Read-only
+verification on 2026-10-23 returned:
+
+```text
+gh pr view 157 --repo GraphDone/GraphDone-Core --json state,headRefOid,mergeCommit,mergedAt
+state: MERGED
+head: 385e7679fabc60b80cd65cf0a1aa4cdf3d592514
+merge: 9068cd31824991330c6d92196654e53e04e29063
+mergedAt: 2026-10-23T22:22:22Z
+
+git ls-remote origin refs/heads/dev
+9068cd31824991330c6d92196654e53e04e29063 refs/heads/dev
+```
+
+The merge parents are `8a7de052eb60fe517f45681dc42b5b169d09c660` and the frozen
+`385e767` head. Its complete tree `6bf014bcc30eb6e21c0deeae4db9c7d4effeaac2`
+equals that validated source. A read-only protection query confirmed
+`enforce_admins: false`, configured approval count 1, and force pushes/deletions
+disabled. The owner-directed exemption is not an approval record. Post-merge
+CI was still running when this lesson was prepared; issue closure remains gated
+on its actual result.
+
+Corrective rule: use the [canonical dev integration playbook](../playbooks/dev-admin-integration.md),
+freeze and independently review the diff, preserve failed/passing evidence,
+verify source/base/result provenance and complete post-merge checks. Keep the
+standing exception scoped to `dev`; do not toggle protection or change identity.
+Historical pre-authorization notes remain historical evidence.
+
+Limits: this authorization does not cover `main`, release or deployment actions,
+force pushes, history rewriting, expanded credentials or any other protection
+change. The documented docs-only exception requires exhaustive non-document
+byte-equivalence proof and independent review; it does not excuse final CI.

.agents/inbox/2026-10-23-folder-delete-legacy-hierarchy.md

@@ -0,0 +1,21 @@
+# Deletion authority includes pre-existing descendant folders
+
+On 2026-10-23, review of SEC-FOLDER-1 found that validating a folder's owner was insufficient when older records could place another user's folder below it. The new creation/reparenting checks prevent new cross-domain trees, but do not repair existing records.
+
+## Evidence
+
+The real in-memory SQLite fixture initializes with `PRAGMA foreign_keys=0`, matching the store's current connection defaults. Deleting an owned parent succeeds and leaves a foreign descendant with a missing ancestor. With `PRAGMA foreign_keys=1`, the declared `ON DELETE CASCADE` removes the foreign descendant. Both the standalone and Neo4j-generated GraphQL schemas reached this SQLite behavior. No shared or production database was used.
+
+Command: `npm run test --workspace @graphdone/server -- tests/folder-authorization.test.ts` with the new tests copied onto commit `0c2322cdfb2669c7fb2c057ea62df583736aba62`.
+
+Observed on 2026-10-23: **10 failed, 32 passed**. The failures cover nested foreign descendants with foreign keys off/on, another writable ownership domain, and destinations inside the deleted subtree. With foreign keys on, the foreign descendant query returns an empty array after deletion. A legitimate same-domain cascading deletion remains a passing control.
+
+After correction, `npm run test --workspace @graphdone/server` reports **70 passed**, including all 42 folder cases; server typechecking passes. Local evidence: `/tmp/graphdone-folder-subtree-baseline-final.log` and `/tmp/graphdone-folder-subtree-full-green.log`. These local paths are evidence pointers, not published validation artifacts.
+
+## Cause and corrective rule
+
+Authorization must cover every record a destructive operation can affect, including records connected through database cascades. Before moving any graph references or deleting a folder, recursively enumerate existing descendants, require write access to each, and require the same ownership domain. Reject a graph destination that is the deleted folder or one of its descendants. Use a cycle-safe recursive query so malformed legacy trees cannot loop indefinitely.
+
+## Limits
+
+This change does not migrate malformed hierarchies, enable foreign-key enforcement, or redefine valid same-domain folder deletion. It tests actual SQLite and both GraphQL schemas; graph metadata and the Neo4j version probe are simulated. Live backend and browser validation remain separate release gates. The repository had no `.agents/WRITING-IT-DOWN.md` or existing lesson index when this incident was recorded; the related API guidance and regression suite carry the rule with the fix.

.agents/inbox/2026-10-23-magic-link-consumption.md

@@ -0,0 +1,9 @@
+# Consume single-use identity tokens with a guarded database update
+
+On 2026-10-23, real in-memory SQLite regressions on runtime base `5f0f454` reproduced concurrent magic-link replay and inactive-account acceptance. The selected before-fix run failed two cases and passed one. A further controlled delayed-write regression failed against the first fix `4f4b782` because its expiry timestamp was captured before the statement executed. The final full server run passed 39 cases, including all eleven new magic-link cases. Commands and evidence are recorded in the [review note](../../docs/quality/MAGIC_LINK_REPLAY_2026-10-23.md).
+
+Cause: selecting an unused token does not reserve it. The previous update neither checked unused/expiry state again nor waited for its outcome before returning identity.
+
+Corrective rule: atomically transition unused state using the database's execution-time expiry predicate, await completion, and require exactly one affected row before returning or creating identity. Check current account activity. Exercise real concurrent requests, expiry boundaries, and actual database failures; mock success callbacks alone cannot establish single-use behavior.
+
+Limits: this shared verifier still serves both login and reset flows. Purpose separation, other authentication controls, and deployed HTTP/email behavior remain separate work. A failure after successful consumption deliberately requires a fresh link. No shared database or deployed secrets were used.

.agents/inbox/2026-10-23-main-promotion-release-gates.md

@@ -0,0 +1,80 @@
+# A validated dev tree does not validate main-only publication or persistence
+
+## Correction and verified runtime evidence — 2026-10-24 UTC
+
+The original findings below led to the reviewed correction in
+[PR #191](https://github.com/GraphDone/GraphDone-Core/pull/191). Publishing is now
+read-only build validation; unfinished Release/Deploy actions explicitly fail.
+Selected production validation is part of CI Success and runs on main PRs.
+SQLite uses the actual server workspace volume path with migration guidance.
+
+On clean `abc29d9dbe0da966cbc22976feebaa2dfced21c1`, the corrected owned HTTPS
+stack passed all six headed smoke cases with zero Playwright retries, all seven
+persistence checks, source invariance and owned container/volume/network cleanup.
+The initial production browser failure is retained; it exposed a helper that
+relied on development quick login instead of selecting the existing Password tab.
+[Public result and limits](https://github.com/GraphDone/GraphDone-Core/pull/191#issuecomment-6377298729).
+
+The actual main merge and its final CI remain tracked in
+[#189](https://github.com/GraphDone/GraphDone-Core/issues/189). Exact-SHA publication
+and real deployment are intentionally disabled and tracked in
+[#190](https://github.com/GraphDone/GraphDone-Core/issues/190). This evidence does
+not claim deployment to graphdone.com. The original inspection below is preserved
+as historical cause and boundary evidence, not a current list of unfixed defects.
+
+
+Date: 2026-10-23. Searched the symptom index, the dev admin-integration
+playbook, and the validation ledger before inspecting main promotion.
+The owner requested a clean, quota-conscious finish and promotion of good work
+to main. Dev validation is complete; the remaining release work is tracked in
+[issue #189](https://github.com/GraphDone/GraphDone-Core/issues/189).
+
+Dated composition evidence:
+
+```text
+main: 775362eace0723c57b7ba3c7936645c9d0d36cb4
+validated dev: ef495eff15ed7aac51e72dc7a1db1bb96d2b3695
+local normal merge: 88ce10dc8c39b1687c180ff22db20744c4bf2996
+merge parents: main775362ea + dev ef495eff
+merge conflicts: none
+merge tree: 6bdd9d820f98b9882c3dcf6a110badd88bfe78bc
+all 683 tracked entries equal validated dev, including modes/types/blob IDs
+```
+
+The two main-only commits were merge wrappers whose trees equal their source
+parents. Independent review confirmed the candidate's complete composition,
+not its release readiness. The two documentation paths added by this handoff
+are separate from that original byte-identical candidate; no runtime code was
+changed for the checkpoint.
+
+Read-only source findings at `ef495eff`:
+
+- `.github/workflows/docker-publish.yml` runs even for main-target PRs and sets
+  `push: true` before validation; main publication can move `latest`.
+- Main-only production smoke has no matching generated admin credential, weak
+  HTTP readiness and retry-tolerant raw smoke; `CI Success` omits that job.
+- Compose mounts SQLite at `/app/data`, while the API workspace resolves its
+  database under `/app/packages/server/data`; recreation persistence needs an
+  owned-container negative/positive test.
+- Deploy uses a missing root Dockerfile, unpinned CI-completion checkout and
+  echo/TODO deployment steps. A successful message is not a deployment.
+
+Cause: development browser/API validation does not exercise the different
+production Compose paths, registry event conditions or deployment actions.
+A mergeable tree can therefore still have release blockers.
+
+Corrective rule: inspect event side effects before opening the promotion PR;
+make PR builds nonpublishing, pin publication to validated source, repair the
+owned production fixture/readiness/result propagation, and verify SQLite
+persistence through container recreation. Run one deliberate production-stack
+gate after the focused correction. Preserve the existing main protections
+unless the owner explicitly authorizes a different admin policy. The standing
+dev exemption does not silently extend to main.
+
+Resume in the order and acceptance criteria in issue #189. Do not open a main
+PR while its existing hook still publishes to GHCR. Keep the reviewed source
+and this handoff committed; do not force-push or rewrite either history.
+
+Limits: these are source findings, not newly executed production failures.
+No production-stack run, registry publication, deployment or main protection
+change was performed for this review. No runtime resources were started.