Documentation for Redweb 0.13.0. Install that exact version when following these examples.

Developer and agent experience release: acceptance checklist

This is the full implementation checklist for the requested improvements. Unchecked items are not release-complete; green coverage alone is not evidence for them.

Discovery and honest positioning

Package repository, homepage, issue tracker, and meaningful search keywords.
README leads with the current integrated site/socket workflow, a runnable example, fit/non-fit guidance, and no stale release-specific introduction.
Website presents the same supported capabilities and release version.

Complete starters and repair loop

redweb init offers realtime, chat, site, and socket templates with no undefined application placeholders.
Existing-project initialization does not generate a second application or overwrite user files; conflicts are reported honestly.
Explicit noninteractive options, dry-run, machine-readable output, actionable errors, and safe filesystem handling.
One development command rebuilds/restarts on changes, one test command verifies behavior, and production startup is documented.
redweb doctor --json inspects effective JSX configuration, package/tool versions, assets, duplicate routes/handlers, and an optional port without executing user application code or silently repairing it.

Automatic reactive rendering

Ordinary TSX expressions over decorated state update automatically, including derived expressions and conditionals.
Owner-scoped component/page boundaries; batched changes; unchanged HTML sends no patch.
Stable keyed list updates preserve appropriate DOM identity, input state, and focus.
Reconnection snapshots, connection/shared state isolation, nested components, cancellation, bounded work, and disposal remain correct.
Existing explicit bindings remain usable without duplicate/conflicting updates.
Counter and multi-client chat pass real browser + HTTP/WebSocket tests using the simpler public syntax.

Shared socket contracts

One contract defines payload validation and inferred client/server types.
/match routing and join/move/resume handler dispatch stay separate, without socket decorators or a secondary action dispatcher.
Invalid payloads never enter handlers; errors are stable; existing uncontracted routes still work.
Type-negative tests and real-network positive/negative protocol tests cover the public contract API.

Documentation and executable recipes

Plain Markdown per topic, compact llms.txt, versioned release docs, task-oriented recipes, and clear prerequisites/filenames/commands/results (implementation and local serving verified; publication remains a separate gate).
Human pages, agent docs, and code snippets derive from one maintained recipe/content source.
Recipes compile against a packed npm release and pass real HTTP/WebSocket acceptance tests.
Read-only documentation access can be exposed through an optional MCP adapter without enlarging the normal runtime or claiming automatic agent selection (separate private/unpublished integration).

Trust and release verification

Current checkpoint: the original split coordinator/worker coverage maps are complete in the maintained 161-test gate, all-four 100%. Full Windows df58f94 regression passed 1,943 tests with five skips, but its Node 24 PR job failed the ten-second soak delivery assertion at 98.47715736040608%. The original raw measurement was not retained. Failure-time evidence preservation is now corrected; real-socket controls establish a possible pending-reply rotation loss mechanism, not the historical cause. No acceptance limit changed. See SPLIT_RECOVERY_COVERAGE.md and SOAK_ROTATION_OBSERVATION.md.

Split-runner correctness follow-up: three reproduced failure-channel defects are corrected using the shared error normalizer and existing request cleanup. Forty-seven unit/native regressions pass; one fresh normal server recovery run reconciles all 7,400 replies, peaks at 108.18707393318519% of warm server heap and exits normally without forced cleanup. Client growth remains diagnostic. This does not itself close the two runner coverage maps or historical release failures; see SPLIT_RECOVERY_ERROR_HANDLING.md.

Original recovery follow-up: the maintained 45-test scope passes with all-four 100% authored coverage. Exact integer bytes correct false rejection at the 110% equality boundary without relaxing the limit, final/intermediate checks, or workload. Real socket tests now observe session release at its lifecycle boundary and await expiry, including a delayed-observer regression. The earlier full Windows run remains failed (two npm certificate-trust timeouts and the session assertion); focused passes do not replace full-suite evidence. Both hosted runs at the preceding 0e3e257 passed, but predate these changes. See ORIGINAL_RECOVERY_VERIFICATION.md; the later authored-map closure is above, and release remains open.

Frozen Live HTML tool coverage follow-up: 52 tests pass in 27.384s with all-four 100% of the unchanged authored tool (336 statements / 86 branch outcomes / 47 functions / 282 lines). One native CLI test runs the existing full browser workload; 51 explicit boundary units cover rejection and cleanup paths without claiming simulated observations are DOM evidence. Windows Node 18 passes the 51 units and explicitly skips the native dashboard workload under its canonical engine requirement; this does not claim Node 18 dashboard support. Native CLI exit, its banner and absent known temporary directories do not independently prove all descendant termination. Characterized frozen cleanup defects remain unchanged and documented in the coverage audit. The last enumerated frozen-tool map gap is closed, not the broader release requirements or historical failures.

Browser-evaluator coverage follow-up: the maintained control gate now covers both the unchanged validator and its browser evaluator, reusing the original eleven-case real Windows browser matrix once. Four new native CLI cases cover build/startup/HTTP failures and require the owned application to be gone; separate browser/process boundary units cover deadlines, reporting and cleanup faults. A status-specific oracle prevents unrelated network failures from counting as the expected 404 rejection. Original command errors and owned evidence survive unexpected outcomes. See the coverage audit for exact scopes, measurements and platform limits; the subsequent Live HTML tool result is above. The combined run passed 44 tests in 67.556s with all-four 100% of the evaluator (237/57/41/174) and validator (24/14/4/19); it is not whole-release completion. Preparation (five tests), process/sealing (40 tests, one skip) and trial-runner (23 tests) regressions also pass with their original 100% map hashes unchanged.

Control-validator coverage follow-up: the unchanged eleven-case protocol matrix now runs through a maintained direct-coverage gate. Real Windows Chromium checks accept four working controls and reject seven broken variants; explicit unit faults cover report creation, immutable output, and failed result validation. Unsupported platforms must exit normally with the exact interface refusal, not a timeout or cleanup error containing the same text. Unexpected outcomes retain both the original command error and owned workspace. The validator's authored 24/14/4/19 scope is 100% (17 tests, 60.969s); this is not new Redweb release/agent acceptance or a resolution of historical Linux cleanup and throughput failures. See the coverage audit for measured evidence and remaining frozen-verifier gaps.

Trial-wrapper browser-profile follow-up: two additional filesystem regressions reproduced deletion of a leftover profile, with and without a saved report. The wrapper now preserves the evaluator's known profile directory as well as its execution directory; it does not infer cleanup from error-message text. The full trial gate passes 23 tests in 9.559s with the unchanged 100% runner map. This source-derived wrapper correction leaves the frozen evaluator untouched.

Trial-runner coverage follow-up: 21 tests pass in 10.367s at all-four 100% of the unchanged runner (66/14/6/53). Native checks cover archives, build failures, input/source tampering and the evaluator's actual browser protocol control; explicit dependency-boundary and fixture-retention units remain separate. The reviewer caught an outer-test cleanup path that could erase retained trial evidence; the wrapper now preserves it and the original error, with filesystem regressions. The process/sealing regression still passes 40 tests/one skip at 100%. These are synthetic checker fixtures, not new agent trials or a new Redweb release acceptance result. Remaining verifier scopes stay open.

Candidate-preparation coverage follow-up: five tests pass in 12.289s at all-four 100% of the unchanged preparation tool (25/8/3/21). Real plain/instrumented CLI runs produce identical archive/catalogue/commit identities; a real failed npm launch creates no success manifest. Three subprocess-boundary units remain explicitly separate from native checks. Shared test-only instrumentation also passes the existing 40-test process/sealing regression (one skip, 8.054s) with unchanged 100% maps. This is tool coverage, not a new agent trial; remaining frozen browser/trial verifiers and release requirements stay open.

Shutdown coverage follow-up: the b2ca53a PR Node 18 job passed 1,770 tests but failed the global coverage gate, missing the render-drain timeout path in PageManager. New zero-budget unit and real-HTTP cases assert that specific cause, alongside the unchanged 20ms scenario. No runtime or timer APIs changed. The complete focused selection passed 125 tests on actual Windows Node 18.20.8 and 22.21.0, with all-four 100% of PageManager (462/303/87/372). Exact evidence and the limits of the timing explanation are in COVERAGE_SCOPE_AUDIT.md.

Isolated-harness correction: both 665be56 CI workflows failed; Node 22/24 and lifecycle logs identified the missing finishVerificationSummary helper in the copied browser harness. The fix adds that unchanged helper, not a checkout fallback. A new literal-relative dependency regression failed before the fix; all 12 harness tests now pass (1.483s), with 53/11/9/49 at all-four 100%. The complete isolated-package gate also passed 71 tests in 266.225s, using registry client 0.2.0, real Chromium/HTTP/WebSockets and source-free generated applications. Its coordinator/report-helper maps remain all-four 100%; the browser report identifies 211 package files and 27 unchanged harness inputs. Exact identities and the prior failures are preserved in COVERAGE_SCOPE_AUDIT.md. These are local correction results, not certification of pending CI or broader release completion.

Frozen-tool coverage follow-up: the unchanged evaluation process and byte-sealing tools now have maintained all-four 100% direct coverage (52/25/12/36 and 23/7/7/20 respectively). Forty tests passed with one platform skip in 7.634 seconds, combining explicit OS-boundary units with actual process/filesystem/CLI/listener checks. Test-only in-memory instrumentation preserves original checker identity; neither frozen sources nor sealed evaluations changed. This is not a new agent trial or resolution of the original Linux cleanup failure. Exact source/map identities and remaining frozen-tool gaps are in COVERAGE_SCOPE_AUDIT.md.

Browser-coordinator follow-up: shared terminal-report handling corrects late publication failures and preserves retained-workspace identity; failed application shutdown releases its listener reference while retaining cleanup uncertainty. Ten reporting regressions failed before the fix. The final combined gate passed 109 unit/native tests in 81.961 seconds at all-four 100% across the coordinator and four runtime/refresh helpers; the coordinator alone is 187/69/35/143. Runtime and refresh browser maps remain complete. The installed-client-only diagnostic still fails its own incomplete coverage gate; its regression now requires a fresh report and no additional error. Linked-source CLI integration is explicit opt-in and passed locally; ordinary registry CI does not require unpublished checkout files. See COVERAGE_SCOPE_AUDIT.md for exact identities, scope distinctions and the earlier failed measurements. Remaining release requirements stay unchecked.

Package-coordinator follow-up: sixteen regressions reproduced swallowed rejection values, incomplete server cleanup and premature success output. The fixes reuse shared error handling and one small local server owner. The maintained package coverage gate passed 71 unit/filesystem/native tests in 265.812 seconds, with 100% authored coverage of the coordinator (173/69/12/162) and report helper (21/6/3/16). The native workflow uses the actual packed consumer, registry redweb-client 0.2.0, Chromium and source-free applications; separate real-listener tests assert cleanup before rescue. See COVERAGE_SCOPE_AUDIT.md for identities, platform bounds and the earlier failed coverage measurements. CI retains both maps and packed-browser evidence without a duplicate standalone invocation. This does not close remaining coverage, performance or release-alignment items.

Packaged-example verification now has bounded acquisition/action/cleanup and strict command output, with installed-transport isolation preserved. Its maintained three-script scope passes 40 unit/native tests at all-four 100%; the original production-only counter, explicitly installed chat validator, development resources and generated additions remain actual consumer checks. See PACKAGED_EXAMPLE_VERIFICATION.md for exact scope, failure history and identities.

Reproducible reconnect, disconnect, slow-client, memory, isolation, authentication, and compatibility evidence, with limits and environment recorded.
Fresh-agent tasks using only public documentation measure first-pass success and repair effort against objective application checks (one narrowly scoped counter/chat case; not an adoption success rate).
Full 100% statement/branch/function/line coverage of the maintained library and explicitly scoped authored verification modules, type gates, real-network/browser tests, load/recovery/memory gates, package checks, and audit; generated V8 decorator counters and diagnostic-only measurements remain labelled rather than presented as this authored-source gate.
README, changelog, examples, website, and evidence agree on shipped behavior; final requirement-by-requirement audit proves every checkbox.

Follow-on application ergonomics and adoption

Typed, validated action inputs eliminate repeated form parsing while preserving explicit exposure and safe failure boundaries.
Statically readable literal action references are checked for typos without executing application code; dynamic/unsupported references are reported honestly rather than guessed correct (supported syntax and limits in CLI.md).
Consistent action loading, success, and error states need no custom browser glue.
HTTP and socket identity share a clear request/session context, with explicit authorization hooks for pages, actions, and rooms.
Complete persistent cards and authenticated dashboard recipes demonstrate durable data and private updates without adding a database framework to Redweb.
Runtime diagnostics distinguish validation, authentication, authorization, and application failures without leaking secrets; retry guidance states actual guarantees.
Fresh-agent evaluations separately measure successful use when assigned Redweb and discovery/selection when not instructed to choose it; record first-pass success, repair attempts, time, and independent correctness checks. The assigned counter/chat pass is preserved in evaluations/2026-08-30-01; the category-first public-search trial in evaluations/2026-08-30-02 selected Socket.IO, with no implementation claim. Timing/search sequence are self-reported where not independently observed; host metadata prevents full blinding, and one sample is not a discovery rate.
Package provenance and release support/compatibility guidance are documented and verified where available; no claim of provenance as proof of security. Published 0.13.0 signatures were verified; no provenance attestation was returned, and future trusted-publishing/security-reporting policy remain maintainer actions rather than claimed capabilities.

Additional developer-experience follow-through

Safe incremental redweb add page, redweb add component, and redweb add socket-route workflows reuse canonical templates, respect existing projects, preview changes, reject overwrites, and include working tests.
Optional development inspection shows registered pages/components/actions/socket handlers, connection state, and reactive invalidation/flush causes without exposing a production debugging endpoint or adding observer branches/callbacks to disabled update paths; documented scope excludes initial SSR, nonreactive messages and delivery acknowledgement.
Development rebuilds refresh the browser with explicit, tested draft-preservation/reconnection behavior; no implied preservation across server restarts without evidence.
Searchable task-oriented landing guides demonstrate the published realtime dashboard, server-rendered JSX, chat, and shared validated socket contracts; runnable files/tests and honest fit/non-fit guidance stay generated from canonical sources.
Clean-package consumer commands use managed subprocess timeouts, terminate the running descendant tree where possible, retain/report uncertain cleanup, and preserve the primary failure if temporary-workspace cleanup also fails.

Client-owned frontend follow-through

Move reusable generated frontend behavior into redweb-client where it simplifies Redweb, with one maintained implementation and no duplicated transport/lifecycle logic (redweb-client@0.2.0 published and integrated; redweb@0.13.0 published from the verified merge commit).
Verify the hardened client and Redweb together from matching packed artifacts, including counter/chat rendering, cancellation, reconnect, and existing browser regressions; preserve unit and no-mock integration coverage requirements and honest publication boundaries (both local candidate and published-client pairs verified; the separate standalone V8 command remains unresolved).

Work log

Published-release audit (redweb@0.13.0, published 2026-09-01 UTC): npm records gitHead 7196d504ee65dfaf5ac869ea4bda66d7cf86d015, the verified merge commit on main. All 215 registry files match that commit's content: two byte-for-byte and 213 after Windows CRLF normalization. The per-file hashes are retained in docs/releases/audit-0.13.0.json. A clean exact installation with lifecycle scripts disabled passed npm audit signatures with no invalid or missing signatures and npm audit --omit=dev with zero vulnerabilities; registry metadata contains no provenance attestation. The immutable tarball retains a documentation-only publication defect: its generated catalogue and changelog retain prerelease labels, while its setup guidance and README also describe the release as a development tarball/unreleased. Repository/site sources correct those labels, but a future patch release is required to correct bundled package documentation. Runtime code and public declarations are unaffected.
18b1dfd regression/performance checkpoint (Windows, Node22.21.0, 2026-08-31): with system certificate authorities and TLS verification retained, all178 suites passed:2,017 tests, five platform skips, every pretest/type gate and all-four100% maintained library coverage. An earlier run passed2,016 tests but its first clean-consumer npm install stalled without output at the unchanged 120-second deadline; the isolated failure reproduced while a direct registry query also stalled. The isolated and complete reruns passed once Node used the Windows trust store; no source, timeout or assertion changed. Both PR and push CI runs for 18b1dfd passed every Node18/20/22/24 and lifecycle job. Exactly two preregistered five-pair comparisons against one fresh exact0.12.0 baseline completed exact delivery: throughput/p99 regressions were-0.3677%/-5.3204% and-1.7901%/-8.2032%, within unchanged3%/5% limits. This is a bounded local pass, not a capacity guarantee or explanation of the retained historical 4.7850% failure; see BENCHMARK_VERIFICATION.md.
Corrected-hour heartbeat checkpoint (Windows, Node22.21.0, 2026-08-31): the immutable 11d1dcc candidate completed3,600 seconds with64 clients and720 samples. It delivered2,106,745 of2,106,821 replies (99.9963926693%), finished heap at97.6036274356% of warm, passed all eight trends, emptied every final registry and stayed within the one-handle allowance. The owned one-shot task exited0 without forced cleanup, all112 raw inputs and the independently recomputed582-file digest matched, stdout equalled the report bytes, and stderr was empty. The task was removed only after independent validation. The critic then required stronger second-ping, pending-at-shutdown and escaped-close diagnostics regressions;71 heartbeat tests and94 soak-tool tests pass their maintained all-four100% scopes. That later review increment changes a soak tool, so the hour is attributed only to 11d1dcc; see SOAK_ROTATION_OBSERVATION.md.
Development-verifier follow-through (2026-08-31): nine new fault units reproduced unguarded port errors, lost primary/cleanup failures and skipped releases. Page acquisition now uses the existing bounded owner through late settlement; both templates and controls share it. Final coverage gate combines 31 explicit boundary units and four real Chromium/HTTP/WebSocket/process tests: 35 passed in 71.327 seconds, 217 statements/39 branch outcomes/38 functions/ 170 lines at 100%. Native rebuild, input/draft and process-exit assertions remain intact. Independent review approved the corrections; exact scope and hashes are in COVERAGE_SCOPE_AUDIT.md. CI retains this coordinator map separately.
Previous-head ad1684f verification: the isolated package gate and production audit passed after canonical regeneration; see ignored receipt coverage/verification-ad1684f.json. Its PR Node 24 job passed 1,620 tests/five platform skips/151 suites in 683.299 seconds with all-four 100% library coverage. All four PR matrix jobs passed; the separate lifecycle job was still running at this observation. Downloaded Linux refresh-helper coverage coverage/ci-browser-ad1684f/refresh-verifier/coverage-final.json has SHA-256 b1c0984a7dd805f659323c8efbbe2169b005149accb879ee05722fcd71131f21 and retains 395/104/60/297 at 100%. Native Chrome 151 observed cache restoration in both modes. This does not relabel the failed 48 prepack/CI run, the original Linux cleanup failure, or the default throughput failure as passing. Current coordinator changes still require their own hosted checks; site catalogue synchronization and deployment remain separate.
Post-commit package check of 48b3f3f failed before packing: the final acceptance-log edit changed the canonical release-status topic after the preceding generator check. This was stale generated documentation, not a consumer/runtime failure. The catalogue is regenerated from canonical content; a new package run must pass before package verification is claimed for this increment. The preceding successful generated/type check is not relabelled as a post-edit check. Site content remains a separate local sync/deployment step.
Refresh verification follow-through (2026-08-31): corrected three reproduced failure-boundary defects using shared error handling: swallowed falsy errors, release errors replacing earlier failures, and upload errors lost when controls also fail. The maintained browser command now includes direct authored coverage of both refresh helpers, without duplicating its canonical refresh workload. Final gate: 27 collector, five runtime-helper and 52 refresh tests pass; both helpers cover 395 statements/104 branch outcomes/60 functions/297 lines at 100%. Native Chromium/HTTP tests remain separate from explicitly doubled unit boundaries. Independent review required and confirmed a bounded close in the new standalone test. All generated/type checks and eleven documentation/CI units pass. Exact maps, source identities and boundaries are retained in COVERAGE_SCOPE_AUDIT.md; frozen tooling/runtime/limits are unchanged.
Completed full verification of unchanged 4fe0145: Windows passed 1,577 tests, three platform skips and 150 suites in 868.646 seconds; the 91-file library scope covers 5,449 statements/4,046 branch outcomes/978 functions/ 4,468 lines at 100%. The command used the system CA trust store, without disabling TLS or changing global configuration. Retained JSON coverage/final-polish-4fe0145-full-results.json has SHA-256 742e88e003b65f76dc1c088b0c9da3aa5f97587df92eb03bd05c94caf2a08ad7; map coverage/final-polish-4fe0145-full/coverage-final.json has SHA-256 5e0ea2c59c941a63606623a0f5056fb526416fc6302ffcfadd05fc5221237e42. These full-suite counts precede the refresh increment above. Both workflows (PR 33406107275, push 33406101028) completed successfully, including all four Node versions and the Linux escaped-descendant negative control. The downloaded Linux dashboard map (coverage/ci-dashboard-4fe0145/coverage-final.json, SHA-256 ba2193d92f43562483ad2216c2ff5d7e7adc3ac104b064737c85b9942f6cc7c3) independently retains 101/14/14/82 at 100%. These passes do not prove the cause of the original 08348fb cleanup failure or waive failed throughput evidence.
Public release reconciliation (2026-08-31, 15:10 UTC): registry versions remain Redweb 0.12.0 and redweb-client 0.2.0. Actual certificate-verified HTTP requests to the configured public origin found /docs/ still titled “Redweb 0.9 API reference”; /llms.txt returned homepage HTML rather than agent-readable text. Local site/build success is not public alignment. Ignored observation receipt: coverage/public-release-4fe0145.json (decoded-body hashes, not raw response archives). No deployment, npm publication, merge or new hour soak was performed.
Public example correction: independent review and an actual-socket probe found that the older match example joined a room but then failed on its missing authenticated principal (sanitized error and close 1011); it also never issued a session for resume. The stable example URL now renders the canonical typed socket handlers. The socket guide links their contract/route and the separate working private-room example; the generated README uses its actual src/ paths. No duplicate handler implementation or runtime change was added. Deployment guidance distinguishes published client 0.2.0 from unreleased Redweb. Two new content regressions failed before correction; a third caught broken source-relative links in generated README output during review. All seven documentation units and two selected real source-free socket/room integration cases pass. The complete preceding 7a0297e regression passed 1,488 tests/142 suites with 91-file library coverage at all-four 100%; the three new units are additional, not included in that count. See FEEDBACK_COMMAND_VERIFICATION.md for the full-run identities. Hosted and final release acceptance remain separate.
Refresh command follow-up: the real disconnected-browser regression reproduced a command hang through the 60-second supervisory watchdog. Generated-app refresh and refresh controls now reuse the shared 15-second adapter, with weak identity tracking to prevent duplicate wrappers. All 17 maintained unit/native cases pass at all-four 100% for the adapter and feedback driver; unchanged runtime/refresh native coverage also passes. Actual peer cleanup is checked before rescue. Linked-client authored coverage, generated-app refresh and the complete isolated-package gate with registry client 0.2.0 pass. The critic approved all eleven actual remote implementation files at 82156ee. Raw acquisition and complete refresh-helper coverage remain separate. See FEEDBACK_COMMAND_VERIFICATION.md for hashes, scope and budgets.
Original-phase performance diagnostic: after the bf01c2a full regression passed 1,486 tests/142 suites with unchanged all-four 100% library coverage, one fixed ten-worker profiling series used the original 20,000-message phase. Every worker delivered all 2,000 warm-up and 20,000 measured replies; inputs stayed unchanged and cleanup passed. Coarse profiles show overlapping timings, not a demonstrated cause or a performance acceptance pass. The original 4.78495% throughput failure remains visible. See BENCHMARK_VERIFICATION.md.
Development-refresh ownership follow-up: guarded browser acquisition now retains uncertain launch cleanup, bounds shutdown to 15 seconds and independently preserves fallback failures. Seven initial explicit boundary units reproduced failures before correction; all 15 expanded units pass afterward, including the real shutdown watchdog. Native generated-app refresh remains a separate gate. No public API/frozen helper changed; full direct coordinator coverage and inner template/helper ownership remain open. See BROWSER_OWNER_VERIFICATION.md.
Full feedback-driver follow-up: two additional real Chromium cases verify successful acceptance and an exact cleanup-only rejection, including listener closure and pending-waiter resolution. The maintained scope now passes 15 tests across four suites, covering both the driver and adapter at all-four 100% (176 statements, nine branches, 14 functions, 162 lines). Watchdog-late failures remain visible; no runtime/browser/server API is replaced. The preceding full regression for 69dcbf8 passed 1,469 tests/140 suites with two POSIX-only skips and unchanged all-four 100% library coverage. These two later-added cases pass separately, not retroactively as part of that run. Acquisition ownership and other tooling scopes remain separate; see FEEDBACK_COMMAND_VERIFICATION.md.
Feedback-command follow-up: a real closed Chromium debugging connection left the verifier pending and its server listening after 20 seconds. A shared 15-second command adapter now allows server cleanup without mutating the raw tab or duplicating the coverage caller's adapter. Thirteen unit/native checks pass with 100% of the branch-free adapter; runtime/refresh browser gates pass. Linked-client authored coverage and the complete isolated-package gate also pass, including source-free consumers and all copied browser phases. The critic approved all 16 actual remote implementation blobs at e3b4902. Raw page acquisition remains a separate open boundary. See FEEDBACK_COMMAND_VERIFICATION.md; no application-socket defect is claimed.
Coverage-counter follow-up: independent review identified the validation gap; a local probe reproduced fractional counters manufacturing a complete browser report. Both collectors now share the authored validator, checking paths/maps/keys/branch arity and nonnegative safe-integer counts before any merge. The maintained three-file scope passes 27 unit/native checks at all-four 100%; real runtime/refresh and linked-client authored browser gates retain their unchanged 100% scopes. The isolated harness includes the same helper. The full isolated-package gate also passes with registry client 0.2.0, source-free consumers and all browser phases; the critic approved all 17 actual remote implementation blobs at 659f638. The subsequent full regression passed 1,459 tests/138 suites with two POSIX-only skips and unchanged 91-file library coverage. See COVERAGE_COUNTER_VALIDATION.md for the reproduced defect, exact evidence and remaining boundaries; no runtime change or performance waiver is implied.
Browser-owner follow-up: both browser coordinators share ownership of original page-opening promises and late tabs, retain uncertain cleanup and independently attempt every cleanup/fallback action. Falsy primary failures remain failures. The maintained two-file scope passes 42 tests/four suites at all-four 100% (131 statements, 26 branches, 20 functions, 103 lines), including actual Chromium counter/chat acceptance. Native runtime and refresh coverage gates also pass at unchanged all-four 100%. The critic approved the shared ownership design. The full isolated-package gate also passed with registry client 0.2.0 and matching bundle identities, including all source-free starters and executable docs. Checkout and installed-package evidence remain distinct. The completed root regression passes 1,456 tests/138 suites, with two POSIX-only skips and all-four 100% over the unchanged 91-file library scope. The linked-client gate passes 77 tests per mode plus native browser acceptance at authored all-four 100%. See BROWSER_OWNER_VERIFICATION.md for exact report identities. Preceding 377f029, 1697f33 and 726b9a3 hosted workflows passed; this head's hosted result remains separate. No runtime changes or performance waiver occurred.
Lifecycle-verifier follow-up: a real generated source-free run passed 13 tests while c8 produced an empty report. The gate now requires the exact deployed helper, nonempty metrics and all-four 100%. It measures emitted JavaScript by removing only the temporary trailing source-map comment, preserving original and measured bytes; authored-TypeScript coverage is unchanged. Twenty-six unit/native checks pass at all-four 100% of the coordinator, and the ordinary CLI passes all 13 lifecycle tests with complete nonempty emitted coverage. The critic approved the metadata-only correction. These cases follow the 1,388-test full inventory; see STARTER_LIFECYCLE_VERIFICATION.md for exact identities, failure history and Windows signal-test boundaries.
Starter-coordinator follow-up: measurement fingerprints inputs before execution and rejects mutations afterward; both runners share bounded best-effort terminal reporting that preserves failure and uncertain-cleanup metadata. The maintained direct scope passes 56 tests/three suites at all-four 100% over 180 statements, 34 branches, 25 functions and 148 lines. Explicit unit faults complement actual child/filesystem and generated-application mutation tests. The critic approved the final source and report identities. Both full six-application CLI workflows then completed: 104 actual tests per mode, authored all-four 100% over unchanged counts, 96 retained process maps, diagnostic V8 gaps still visible. Full regression then passed 1,388 tests/132 suites with two POSIX-only skips and all-four 100% over the unchanged 91-file library scope; subsequent lifecycle tests are not included. The critic approved all 13 actual remote blobs at 377f029; its hosted workflows remain separate. See STARTER_COORDINATOR_VERIFICATION.md. Both preceding 7a25d48 and 1eddee0 hosted workflows passed. No runtime change or benchmark waiver occurred.
Starter-report retention follow-up: both coverage runners preserve available raw reports before parsing/collection and temporary workspace removal. The authored runner retains all individual process maps. A shared helper reserves exclusive destinations and preserves command plus copy failures without certifying partial bytes as complete. Fifteen unit/native checks pass at all-four 100% of that helper; 31 collector-compatibility checks also pass. Both actual six-application runners complete: V8 measurement remains diagnostic, while authored-source coverage passes 104 tests per mode at unchanged all-four 100%, with all 96 process maps retained. See STARTER_REPORT_RETENTION.md. These ten added cases are separate from the preceding full regression count; whole-coordinator coverage and broader release gates remain open.
Action-input verifier follow-up: bounded listening/upgrade, immediate native socket ownership, disabled probe reconnect, preserved client errors and independent confirmed cleanup reuse existing helpers. Uncertain cleanup retains the owned workspace. Both source-free decorator modes and all twelve original action checks remain. Forty-two scoped unit/native tests pass at all-four 100%; the final maintained rerun includes corrected outer Jest budgets and the critic approved all eleven actual remote changed blobs at 1049ff8. The complete isolated package gate passes against published client 0.2.0. Full regression passes 1,322 tests/128 suites in 706.908 seconds, with two POSIX-only skips and unchanged all-four 100% across 91 library files. Hosted checks remain in progress. Exact scope and failure boundaries are recorded in ACTION_INPUT_VERIFICATION.md; no runtime/client API or acceptance limit changed.
Packaged-example checkpoint (449a369 / 551a905): 1,292 tests/126 suites passed in 690.807 seconds with two POSIX-only skips and unchanged all-four 100% across exactly 91 library files. The new 40-test private scope also passes all-four 100%; its VM map stays outside the library denominator. Full isolated package/browser/starters/docs, clean load/memory/HTML/JSX/server recovery, 30-second soak and production audit passed. The soak recorded five missing replies out of 4,368, within the existing allowance, not lossless. The critic approved all 18 actual remote blobs; both implementation-head workflows passed. Exact identities and limits are in PACKAGED_EXAMPLE_VERIFICATION.md. Neither this checkpoint nor the narrowly corrected room-phase mechanics test waives the historical throughput benchmark or closes the remaining release checklist.
Verified soak local checkpoint: full regression selected at 31fa9b2 passed 1,246 tests/119 suites in 653.569 seconds, with two POSIX-only skips and all-four 100% across the unchanged 91-file library scope. The five later recorder units passed separately, not retroactively included in that inventory. Pretest/types and generated documentation pass. The critic approved all 15 actual remote blobs; hosted checks remain pending. Exact map/inventory hashes and retained short-soak outcomes are in SOAK_VERIFICATION.md. Remaining private-tool coverage, performance acceptance and release alignment stay open.
Application-recorder coverage: the unchanged exit hook now has nonvacuous original-source coverage of all six statements/lines, two branches and its one function. Six selected tests pass (five new isolated recorder units plus an existing actual instrumented-pipeline integration); eight unrelated cases are filtered. Native process/file checks preserve absent-data behavior, exact reports, child identities and visible write/serialization failures. The initial native converter omitted the anonymous function from its denominator; raw V8 execution and the limitation were independently verified, and that map remains diagnostic only. The critic approved the maintained authored scope and restoration/CI budgets. These five new units are not retroactively included in the preceding full run. See APPLICATION_RECORDER_VERIFICATION.md.
Soak verifier correction: a native original run passed with only initial/final samples, using its final heap as its own warm baseline. The revised policy rejects vacuous sampling and unsafe derived timer/counter capacities. The owner validates each socket's pending ticks, rejects duplicate/malformed replies and unexpected closes, retains partial acquisition and closes every resource independently after guarded timer failures. Exact integer comparisons preserve the 99% delivery / 110% heap boundaries without floating-point false failures. Eighty unit/native tests pass at all-four 100% across three tool modules; final clean 30-second/16-client evidence records 4,368 sent, 4,365 received, three missing, seven samples, all eight trends stable, zero registries and handles 1→2. This is not lossless or a new one-hour result. Full/hosted verification of the increment remains pending; evidence is in SOAK_VERIFICATION.md.
The preceding 556160a JSX checkpoint passed both hosted workflows (PR33368832717 and push33368829409), including all Node 18/20/22/24 and lifecycle/package/browser checks. The critic approved all 12 remote blobs. These completed results remain separate from later soak changes.
HTML checkpoint full regression: 1,152 tests/113 suites passed in 631.578 seconds, with two POSIX-only skips and all-four 100% of the unchanged 91-file library scope. The run selected its inventory at d15b1a3; 14 later JSX-verifier tests passed separately and are not included in that count. Generated-content/types pass. A clean JSX command after test exit passed 10,000 rows in 48.8 ms / 0.6 MiB retained against unchanged limits; the validator allocation change is not a runtime improvement claim. Exact hashes are retained in the two verifier reports. Hosted checks and broader release requirements remain open.
JSX verifier correction: the original predicate accepted duplicated indexes and severely malformed markup. One short-lived independent oracle now validates every row outside the timed render; the 10,000-row workload, two GC calls, reference clearing and 5-second/32 MiB limits are unchanged. CI externally bounds synchronous work. Fourteen separate unit/native CLI tests pass at all-four 100% of the verifier; these tests were added after the preceding full suite selected its inventory. The critic approved the scope. Exact hashes and untimed-allocation caveat are in JSX_PERFORMANCE_VERIFICATION.md; broader release acceptance remains open.
Live HTML load-verifier correction: reproduced malformed bootstrap JSON escaping as an uncaught exception with an unsettled promise against a real HTTP peer. Bounded non-pooled HTTP ownership, actual socket retention/confirmed closure, strict bootstrap/patch checks, explicit GC, settled parallel acquisition and combined operation/client/cleanup failures now replace that path. Success follows shutdown.54 unit/native HTTP/WebSocket/process tests pass at all-four100% across three tool modules; a clean default200-render/110-client run passed6,824,576-byte heap growth. Workload/GC sampling/24MiB limit remain unchanged; non-pooled HTTP is explicitly a harness change. The critic approved after test-budget and hidden-concurrent-error findings were fixed. Exact boundaries are in LIVE_HTML_LOAD_VERIFICATION.md; full/hosted verification remains pending and the separate throughput discrepancy stays open. No deployment, npm publication or merge occurred.
Verified benchmark checkpoint 43c6d73: full pretest/types and1,098 tests/110 suites passed in614.552s with two POSIX-only skips and all-four100% library coverage. Both PR33365382012 and push33365378641 passed every Node18/20/22/24 and lifecycle/package/browser job. Sequential load, memory, server recovery, HTML/JSX,30ssoak and audit passed; three missing soak replies are explicitly retained, not called lossless. The critic approved all21 actual remote file blobs. Fixed diagnostic controls and one long CPU-profile pair did not establish the cause of the default throughput failures; no speculative runtime optimization or threshold relaxation followed. Exact evidence is in BENCHMARK_VERIFICATION.md. Sitecaa166f sync/build/HTTP/coverage passed locally. Performance acceptance, remaining private-tool coverage and publication alignment stay open; no deployment, npm publication or merge occurred.
Benchmark-hardening increment: exact warm-up/measured replies, stable entry/manifest identities, finite complete worker results, bounded execution and owned cleanup now fail closed. Six benchmark modules reach all-four100% through52 unit and real-network/process tests; the updated shared owner scope passes71 tests/two POSIX-only skips. Defaults and3%/5% limits remain unchanged, but ID allocation/accounting make this a new harness revision. First default registry comparison passed; the second failed throughput at4.7850% versus3%. Both are retained in BENCHMARK_VERIFICATION.md; the cause and final performance acceptance remain open. Documentation-only4267db1 passed all hosted jobs. No publication, deployment or merge occurred.
Completed d576278 checkpoint: full pretest/type/regression passed1,045tests/105suites in570.020s with two POSIX-only skips and all-four100% library coverage. Both PR33362263127 and push33362261457 passed every Node18/20/22/24 and lifecycle job. Sequential final load, memory, server recovery, HTML load, JSX and30ssoak gates passed; production audit found zero vulnerabilities with TLS verification enabled. The original shared-process diagnostic's failure remains visible, not waived or labelled resolved. Packed published-client/browser/source-free checks passed; exact archive-versus-documentation boundaries are recorded in COVERAGE_SCOPE_AUDIT.md. The critic approved the actual20-file PR increment. Site20f56dd updates canonical docs locally and passes98page/154asset HTTP/build/rollback checks and its seven-module coverage scope. Disabled-feature benchmark validation/ownership is the next independently audited correction; broader private-tool coverage and final release agreement remain open. No publication, deployment or merge occurred.
Load/helper follow-up: fixed non-finite limit false passes, exact per-client reply accounting, partial-acquisition cleanup, premature forced-close completion, synchronous cleanup exceptions and error masking. Maintained unit/real-network coverage passes41tests/six suites at all-four100% across four modules; defaults and clean performance gates remain separate. The critic's three findings were corrected. The cross-platform memory fix passed both hosted coverage runs; a separate PR packaged-browser failure exposed unsafe heading-readiness expressions. Native-browser negative/positive controls now pass with unchanged generated-refresh100% coverage. Exact hashes, qualified diagnosis, interim resource results and the still-failed non-blocking shared-process diagnostic are retained in COVERAGE_SCOPE_AUDIT.md. Final regression/hosted verification remains pending; no publication, deployment or merge occurred.
Memory checkpoint 7e94e99: corrected the zero-client false pass with validated workloads/results, bounded strict-output worker commands, owned peer/server cleanup and visible nested failures. The default 500-client/three-trial gate passed 1,881.792 bytes/connection against the unchanged 2,048 limit. Full Windows regression passed 1,001 tests/98 suites in 506.606s with pretest/types and all-four100% library coverage. Node18/20/22/24 hosted jobs passed, but both lifecycle jobs exposed a Linux coverage gap masked by Windows-only file-lock tests. Portable failure units and actual POSIX permission cases correct the gap without weakening thresholds; the revised scoped Windows gate passes70 tests with two POSIX skips, all-four100% across four tool modules. Hosted follow-up is pending. Exact source/report identities, failed CI links and boundaries are in COVERAGE_SCOPE_AUDIT.md. The critic approved both increments. Load-verifier malformed-limit/reply accounting is next; no publication, deployment or merge occurred.
Generator checkpoint ba4a0bc: fixed ignored compiler options, Windows malformed-config diagnostics and successful example builds without emitted JavaScript. One shared ordinary/instrumented CLI runner now requires complete original-source coverage for example, documentation and protocol generators, with exact per-command reports and failure-evidence negative controls. The senior critic approved the actual PR. Full local regression passed 951 tests/95 suites in 517.317s with pretest/types and all-four 100% library coverage; the three scripts separately reach all-four 100%. Exact hashes and scoped counts are in COVERAGE_SCOPE_AUDIT.md. Hosted checks remain in progress. A zero-client memory-gate false pass was reproduced and is the next correction; prior valid 500-client evidence remains separate. No publication, deployment or merge occurred.
Checkpoint 6018807: closed all eight initially audited shipped-source coverage gaps using shared original-source instrumentation and unchanged real-network acceptance, with explicitly separate launcher/policy/failure unit tests. Fixed independently reviewed room-verifier cleanup and a terminal-interruption defect reproduced after Node24 CI failure. Full regression passed940tests/92suites with all-four100% library coverage; clean package/published-client/browser, sequential load/memory/rendering/server-recovery, audit and all Node18/20/22/24 hosted jobs passed. Exact scope, hashes and historical failure are retained in COVERAGE_SCOPE_AUDIT.md and ADMISSION_TIMEOUT_VERIFICATION.md. Private-tool coverage and release/site alignment remain open; no new60-minute soak, publication, deployment or merge is claimed.
Recovery adoption: after the reviewed server-steady-v1 candidate passed Windows and all four Ubuntu runtimes, the maintainer authorized continued implementation without routine approval pauses. CI now makes verify:recovery:server blocking, retains the unchanged original command as a named non-blocking diagnostic, and preserves raw outcomes/logs on success or failure. A failed server gate cannot launch the second measurement after uncertain cleanup. The reviewed workload, 110% server budget and report schema are unchanged. Full prior regression passed 918 tests/86 suites at all-four 100% library coverage; exact evidence and historical contrary CI failures remain in SERVER_RECOVERY_CANDIDATE.md. Final adopted-policy CI and explicit release/coverage-scope audit follow; no publication or deployment is claimed.
Full regression after diagnostic compatibility fix daacdac: npm test -- --runInBand --silent passed all 863 tests/83 suites and pretest/types in 419.852 seconds. Instrumented-library coverage remains 100% for all 5,445 statements, 4,044 branches, 978 functions and 4,464 lines. Diagnostic capture coverage is separately scoped; exact report hashes are in docs/DIAGNOSTIC_COMPATIBILITY.md. Final-head hosted CI and the recovery acceptance decision remain pending; no merge/publication or threshold change occurred.
Diagnostic compatibility follow-up: reproduced older-Node flag incompatibilities and the upstream heap-snapshot destroy-callback defect. Trace flags now match the runtime; Node 18 code logging fails closed before workers/output because it cannot suppress prohibited metadata. A read-only legacy snapshot adapter preserves modern pipeline behavior, and the output-limit regression snapshots a small owned child. Focused real-process/network tests pass across Node 18/20/22; final native legacy/modern capture tests reach all-four 100% for that capture module only. The senior critic approved the narrow change. Exact scope, hashes, rejected candidates and remaining CI/release boundaries are in docs/DIAGNOSTIC_COMPATIBILITY.md. Original recovery workloads/limits and the pending acceptance decision are unchanged.
Bounded Ubuntu comparison (2026-08-31 UTC): the declared original and split baseline ran once at 41915b0 on Ubuntu 24.04.4 / Node 22.23.2. Original peak was 109.741622% of warm; split server 108.495964%, load generator 113.110894%. Exact split delivery reconciled all 7,400 replies with empty registries and confirmed descendant cleanup. Input/output identities and preflight status propagation passed; the critic independently verified the downloaded evidence. Contrary ordinary Node 22 CI at 69ea1fb failed at 111.015778%; Node 20 also has an unexplained trace-worker EPIPE test failure. The temporary comparison trigger was removed, no workload repeated, and an explicit decision was requested before developing/replacing a server-focused release gate. Full results, receipts, environment differences and unchanged acceptance boundaries are in docs/RECOVERY_COMPARISON.md. Website sync a56112b separately passed its 98-page/154-asset HTTP/build and six scoped-coverage tests; deployment remains manual. None of this closes the final release checklist.
Published-client integration: registry redweb-client@0.2.0 is now available with both entry points, and all four runtime bundles match the tested build. Redweb f3c91e9 updates the dependency/lock and shares installed-client identity checks and full browser acceptance between registry and candidate package modes. The complete registry gate passed without an override or consumer link, including counter/chat, reconnect/disconnect, all-six-starter/source-free checks and all-four 100% runtime/refresh coverage. The subsequently simplified printed quickstart and optional contributor link workflow each passed real isolated installation plus 14 generated application tests. Documentation coverage is all-four 100%; generation and types pass. Exact archives, report hashes and sequencing boundaries are in docs/CLIENT_POLISH_VERIFICATION.md. Historical publication blockers below are superseded for the client only; final-head CI, website alignment, Redweb publication and the bounded Ubuntu recovery decision remain open.
Current package/performance checkpoint (2026-08-30): Redweb 28f9c62 and client a8b6a9f passed the complete isolated candidate package gate, including actual counter/chat/dashboard browser acceptance, runtime/refresh coverage, generated applications and source-free consumers. The full linked core regression passed 858 tests/83 suites with all-four 100% library coverage. After package cleanup, default load, three-trial memory overhead, Live HTML load and JSX performance gates all passed sequentially; production audit reported zero vulnerabilities. Exact archives, report hashes, limits and results are recorded in docs/CLIENT_POLISH_VERIFICATION.md. Neither these Windows results nor the candidate's unchanged 0.1.0 version identify a compatible published release. Client publication/dependency integration, latest-head CI, website alignment, and the bounded Ubuntu recovery decision remain outstanding; no recovery rerun, threshold waiver, deployment or merge occurred.
Default client test polish (2026-08-30): npm test now delegates to the existing complete npm run check (linkage, build, types, original-source Node/Chromium coverage); no second harness or recursion is introduced. The actual default command passes all 77 tests in both modes and all-four 100% authored coverage. The old Node-only V8 command remains unchanged as npm run test:v8, including its known failure and thresholds; changing the default is not a claim that V8 coverage was fixed. The README's stale test counts and obsolete source-coverage failure were corrected. Exact evidence is in docs/CLIENT_POLISH_VERIFICATION.md; the senior critic approved the command/measurement boundary. No runtime, dependency, lockfile, publication or recovery-gate changes occurred.
Starter coverage closure (2026-08-30): all six generated applications now pass the existing original-TypeScript gate on Windows/Node 22.21.0/TypeScript 5.9.3: 104 tests in each of plain and instrumented execution, with all 600 statements, 299 branches, 160 functions and 472 lines covered. The only new case is explicitly labelled unit fault injection: the dashboard genuinely closes its SQLite database, then an injected cleanup error verifies that its fire-and-forget listener-error observer prevents an unhandled rejection while retaining the same rejected shutdown promise for the application owner. Cleanup runs once and the database can reopen. The manual event and scoped mock are not presented as a real OS/SQLite failure or mock-free IT; existing actual HTTP/WebSocket/SQLite integration cases are unchanged. The senior critic approved the test and retained production observer. No runtime refactor, exclusions, threshold changes or new coverage framework were needed.
Starter verification evidence: coverage/starter-source/15f3404e-1f32-49da-a238-42fc91ff9d28/summary.json (SHA-256 bc6bc211ab24f5120fde37bb5df4bb9d914b813a66d35cce57604ef072295f1f), completed normally at 2026-08-30T22:54:04Z; the dashboard coverage report SHA-256 is ee08cf1e53581e847e9f472d3628df72d0d51b52c978e9bc22111a9e63179b28. The runner records identical original source/test inputs across both modes and retains the separate V8 reports; authored coverage is not a claim that compiler-generated V8 function counts reach 100%. Five collector tests also pass with all-four 100% helper coverage. This closes the known recipe gap, not every release requirement. A fresh read-only registry/PR check still finds client 0.1.0 without ./live-html, Redweb 0.12.0 depending on ^0.1.0, and draft PR #16 at older head f86f47e; publication, final-head CI and recovery disposition remain outstanding.
Client verification-command polish (2026-08-30): client ee74017 now makes npm run check verify matching linkage before building, then run build/types and the existing complete original-source Node/Chromium gate. Redweb 45a34d5 provides canonical-path preflight and explicit expected-checkout validation; a fresh linked checkout does not need dist to reach its first build. Twenty-one unit/actual-process tests pass with all-four 100% collector/report-helper coverage; the actual client command passes 77 tests in both execution modes, real browser checks and all 791/521/125/659 source counters. The senior critic approved after the unbuilt-checkout issue was corrected. No duplicated browser harness, runtime change, lowered threshold or excluded source was added. The old separate Node-only V8 npm test remains unchanged and is not retroactively claimed green. Full Redweb regression immediately before this command-only increment passed 853 tests/82 suites and all-four 100% library coverage; later focused verification and exact report hashes are recorded in docs/CLIENT_POLISH_VERIFICATION.md. Remaining release checks, publication and bounded recovery decision are still open.
Client lifecycle/package polish (2026-08-30): fixed a demonstrated disposed-client bug in redweb-client commit 859487b: sends/requests no longer enter a permanently unusable outbound queue after disposal. Unit and real-WebSocket regressions failed before correction and pass afterward; queued FIFO/cancellation/no-replay behavior is also verified. Removing the provably unreachable empty-entry branch simplifies the dense private queue. The final combined original-source Node/Chromium gate passes all 791 statements, 521 branches, 125 functions and 659 lines, with all 77 client tests passing in plain and instrumented execution. The complete isolated candidate package gate passed counter/chat/reconnect/disconnect, full browser acceptance, rendering/refresh coverage, all six generated applications, executable documentation, source-free execution and consumer checks. Client/server archives and reports are identified in docs/CLIENT_POLISH_VERIFICATION.md; the critic independently verified source coverage and packed-browser hashes. Production audit reports zero vulnerabilities with TLS verification retained. This closes the matching packed-pair verification item, not registry publication, the separate failing standalone Node-only V8 command, remaining application/tool coverage, memory acceptance or other open release requirements. No runtime research, recovery/CI threshold change, dependency/lockfile change, deployment or merge occurred.
Release-priority decision (2026-08-30): at the maintainer's request to get past open-ended recovery research, exact V8 invalidation/code-lifetime attribution is deferred to docs/RECOVERY_FOLLOWUP_SPIKE.md. No additional heap/tracing work is required merely to explain every runtime byte before completing implementation. The next recovery-specific release decision is bounded to one original and one split-process baseline run in the failing Ubuntu/Node 22.23.2 environment, followed by an explicit disposition; this is not a repeatability certificate or automatic replacement of the existing gate. Historical failures, the 110% limit, CI behavior, required coverage, delivery/cleanup/shutdown and package compatibility remain unchanged. Deferral is not a claim of stability, a passed memory gate, or authorization to ship a failed check.
Offline client function-attribution milestone (2026-08-30, Windows/Node 22.21.0): the independent research recommendation was completed against the existing private snapshot pair, without a new measured workload or changing the original failed capture report. All 261 final deoptimization-bearing Code objects are referenced by current code fields of preexisting functions/closures; the only double-version group is unchanged. Added Code objects group as 180 Node, 22 ws and two harness; their attached streams can include preexisting nodes, so associated byte totals are not exclusively new allocation. The three unchanged Socket identities are stderr cache and two prototypes, and an unchanged eight-node worker/module path reaches initAsClient. Current code-field attachment does not establish executable validity or exclusive ownership. Full results, limits and hashes: docs/RECOVERY_CODE_ATTRIBUTION.md. The senior critic approved tooling 8a15569, independently reproduced the report and approved its interpretation. Full regression passed 853 tests/82 suites in 434.002 seconds with pretest/types and all-four 100% instrumented-library coverage; 29 native unit/real-process/socket/snapshot tests cover all six snapshot-analysis modules at all-four 100%. Broader diagnostic-tool coverage, the original CI recovery failure and historical shutdown timeout remain open. No production runtime, dependency, frozen helper, npm link, workload, acceptance limit, publication, deployment or merge changed.
Client heap-survival milestone (2026-08-30, Windows/Node 22.21.0): one reviewed 7,400-connection run captured two private client snapshots, then failed its 1 MiB detailed-report limit. The failed original is preserved; reviewed offline reanalysis of the same snapshots succeeds without rerunning the workload. Net snapshot growth was 937,387 shallow bytes, including 801,792 in code-related categories, with concrete deoptimization/relocation/feedback data survival. No WebSocket/Sender/Receiver/Timeout instances remained; Socket and HTTPParser cohorts were unchanged. These snapshot-instrumented results do not resolve the original recovery gate or prove exclusive ownership; function/root attribution can continue offline. The critic independently reproduced the summary and approved docs/RECOVERY_CLIENT_HEAP.md. Full verification passed 841 tests/81 suites with pretest/types and all-four 100% instrumented-library coverage; 17 native unit/real-process/socket/snapshot tests cover all five snapshot modules at all-four 100%. Broader diagnostic-runner coverage gaps and the historical shutdown timeout remain open. Tooling commits: 4d036b4, bd68503. No production runtime, acceptance limits, dependencies, frozen helpers, npm links, publication, deployment or merge changed.
Client deoptimization milestone (2026-08-30, Windows/Node 22.21.0): one reviewed client-only --log-deopt run preserved the unchanged worker/workload and verified all 7,400 acknowledgements plus empty measured registries. Of 703 interval records, 698 were GC weak-object dependency invalidations, four eager wrong-map bailouts and one eager not-a-Smi bailout. All four ws.initAsClient optimized versions were matched to subsequent weak-object invalidations, explaining the observed replacement sequence in this run without identifying retained-memory ownership or resolving the original recovery gate. The critic independently verified hashes, code-address sequences and the report at docs/RECOVERY_DEOPTIMIZATION.md. Full verification passed 833 tests/79 suites and pretest/types at all-four 100% instrumented-library coverage. Seventy-nine focused unit/real-V8/process/network tests pass; both parser modules are all-four 100%, while combined diagnostic-tool coverage remains 83.01% statements/lines, 97.64% branches and 94.87% functions. The historical shutdown timeout remains unexplained despite passing this run. No acceptance limit, production/library or worker source, dependency, frozen helper, npm link, publication, deployment or merge changed.
Client compilation census (2026-08-30, Windows/Node 22.21.0): one predeclared client-only native code-log run acknowledged all 7,400 replies, emptied measured registries and preserved verified source/log hashes. Between native after-warm/after-final boundaries, 851 creation events were recorded (843 TurboFan and eight baseline-tier), principally Node networking, ws, and harness/worker helpers. ws.initAsClient produced four distinct optimized versions for one function identity. These are concrete compilation candidates, not retained-size accounting or a recovery fix; no speculative production optimization was made. All phase measurements, grouped events, observer effects, pinned source references and remaining causal questions are in docs/RECOVERY_CODE_CENSUS.md; the senior critic independently approved the evidence and report. Full verification passed 813 tests/77 suites and pretest/types with all-four 100% instrumented-library coverage. Fifty-nine focused unit/real-child/network tests pass; the new census parser is all-four 100% in Jest and native coverage, while combined diagnostic tooling remains 80% statements/lines, 97.02% branches and 93.54% functions. The earlier shutdown timeout remains unexplained even though that test passed in this run. No acceptance limit, runtime/library source, dependency, frozen helper, npm link, publication, deployment or merge changed.
Research-led runtime controls (2026-08-30, Windows/Node 22.21.0): one fresh baseline, one complete GC/bytecode trace and one client-only JIT-disabled control ran sequentially against identical source fingerprints. Each acknowledged all 7,400 exact replies and emptied measured registries. Baseline client heap grew 848,928 bytes after warm-up, versus 5,144 bytes with client JIT disabled, strongly supporting a JIT-dependent contribution without establishing exact retaining objects or resolving the original shared-process CI failure. The traced server finished at 110.08095117632178% of warm heap and reported zero bytecode-flushing events; this negative result is preserved. Full trace logs/hashes, native-output framing limits, all phase measurements and critic review are recorded in docs/RECOVERY_RUNTIME_CONTROLS.md. Twenty-four focused unit/real-process/network tests pass. Native diagnostic-tool coverage remains below its unchanged 100% gate (76.03% statements/lines, 95.57% branches, 91.66% functions). Full verification passed pretest/types and 777 tests but failed one live WebSocket shutdown timeout (75/76 suites passed); all-four 100% instrumented-library coverage does not waive that failure. No acceptance limit, runtime/library source, dependency, frozen helper, npm link, publication or deployment changed.
Split-process recovery milestone (2026-08-30, Windows/Node 22.21.0): a diagnostic-only server/client separation acknowledged all 7,400 exact replies using the fixed connection counts, batches, server policies and settling sequence, with empty measured registries throughout. The server peaked at 108.35068839111547% of warm heap and finished at 95.39871085688438%; the native load generator reached 113.29229497229116%. This identifies the sustained above-110% ratio in the split run as client-process behavior, not the cause of the original shared-process CI failure. Code/metadata growth and a late server bytecode reduction guide the next retaining-path investigation; no code bytes were subtracted or acceptance limits changed. Full verification passed 770 tests/76 suites plus pretest/types at all-four 100% instrumented-library coverage. Sixteen focused unit/real-process/network tests pass; separate native coverage of the diagnostic tooling is only 74.83% statements/lines, 95.12% branches and 80% functions, so its 100% gate remains unmet. Full measurements, methodological differences, source fingerprints, raw-report hash and remaining boundaries are recorded in docs/RECOVERY_INVESTIGATION.md. No production implementation, dependency, frozen helper, publication or deployment changed.
Resumed recovery investigation (2026-08-30, Windows/Node 22.21.0): a capacity-only synchronous upgrade experiment removed unnecessary admission allocations but failed the unchanged recovery gate at 110.33689250984354%. Additional regressions demonstrated an unprotected throwing authorization getter and bypass of a prototype-level authorization replacement. The experiment was fully discarded and its initial reviewer approval withdrawn; production runtime remains identical to 2410e60. Two retained compatibility regressions pass on the restored runtime. Final focused verification passes 143 tests/ten suites at all-four 100% coverage of BaseSocketServer.js; the earlier discarded candidate's 759-test/full-coverage pass is not a final-tree certificate. One native-ws-only diagnostic acknowledged all 7,400 messages and emptied its client registry but reached 113.16102565999951% of warm heap. It omits Redweb's features and supports a runtime contribution, not complete attribution or a waiver. Full measurements, trace limitations and local control source hash are recorded in docs/RECOVERY_INVESTIGATION.md. The critic approved only these retained regressions and the report. No threshold, workload, production implementation, dependency, frozen helper, publication or deployment changed; recovery remains unresolved.
Final linked-quickstart check: after the critic's two test-harness findings were fixed (explicit TAP selection and preserving primary failures alongside integrity-check errors), the reviewer approved this scoped increment. The corrected real-npm check passed again in 24.6 seconds with all 14 generated acceptance cases, no mocks or candidate overrides, unchanged developer inputs/link and completed owned-workspace cleanup. Six documentation unit/generator-process tests passed with all-four 100% coverage of Documentation.js; two unrelated documented-application tests were not selected in that focused run. Generated-artifact and all three TypeScript pretest configurations also passed. These are scoped results, not a new full-release certificate.
Linked quickstart correction (2026-08-30): the unreleased README/recipes previously installed only the Redweb tarball, which resolves the incompatible published client. They now explicitly prepare and link the matching client checkout after installation, explain rebuilding/relinking, and distinguish local development from deployable releases. An isolated real-npm check copies client inputs, uses its own global prefix, executes the printed commands without candidate overrides, compares all four rebuilt bundles and verifies resolution from installed Redweb. The realtime starter passed all 14 HTTP/WebSocket/process cases; the interactive watcher is deliberately left to its existing separate gate. Documentation generator units passed all-four 100% scoped coverage. Initial verifier drafts failed because Node's inherited test-worker context suppressed child results; removing that environment key restored independently observable acceptance output. No runtime code, dependency lockfiles or developer links changed.
Read-only release audit (2026-08-30): npm still exposes only the root export for redweb-client@0.1.0, and redweb@0.12.0 still depends on ^0.1.0. PR #16 remains draft. At pushed head f86f47ede89520662cdf12a3404235baf9a29fb4, push workflow 33322376349, Node 22 job 99286494853 failed the unchanged steady-v2 recovery gate on Ubuntu 24.04.4/Node 22.23.2: cycle four retained 11,489,960 bytes against the 10,424,688-byte warm baseline (110.21874227794635%, above 110%). Final heap declined to 98.28000607787975% and registries were empty, but neither that decline nor the passing companion PR workflow waives the failure. Existing logs were read; no recovery rerun, threshold/protocol change or new memory diagnostic was performed. Publication, coverage gaps, website alignment and memory acceptance remain open.
Packed browser follow-through (2026-08-30, Windows/Node 22.21.0/Chrome 152.0.7977.64): the explicit candidate package gate now stages only 23 unchanged required browser drivers/fixtures beside extracted package code. It preflights destinations, never overwrites runtime files, links four allowlisted development tools individually, and requires client/WS/Express/Zod resolution inside the isolated consumer. Original package bytes and copied input ownership/hashes are rechecked even on failure, including same-bytes replacement through an outside directory link. Coverage copying and report writing are independent; either failure preserves the primary error and cannot print a passed result. Seventeen real-filesystem provenance/report units pass at all-four 100% coverage over the two new helpers; the senior critic independently reran them and approved after ownership/finalization findings were corrected. The combined package-tools gate passed 75 tests/nine suites in 206.996 seconds, with all-four 100% coverage over its eight helpers.
The final candidate run passed the complete package gate: independently installed examples/additions, unchanged full native-browser acceptance, frontend/refresh coverage, all six starters and executable documentation with source-free execution, consumer compilation and rendering/static export. Retained browser evidence: coverage/packed-browser/2d98e957-05c8-4218-bae2-e127432f805b, with Redweb archive SHA-256 76d80bf28ab12524bb2968ee7e3e3a0a6b6ca84954ab66f2ec481fd8d3fb0211 and client archive SHA-256 44eef644c484d12d07b8aea4ee9be8ecf44c6706a41e3e1455b129590799623f. All 182 original package files and 23 harness inputs passed verification. Runtime run 103944c1-2d8f-4b03-b150-94b4df66ab9f covers 426/426 statements, 262/262 branches, 64/64 functions and 351/351 lines; its measured bundle hash matches the client candidate. Plain/instrumented feedback/runtime/ownership/morph cases (18/13/7/46 assertions) and native keyboard/pointer selection passed. Refresh run f1381721-fe3f-45da-9ac8-c38ef420dcbe covers 82/82 statements, 44/44 branches, 12/12 functions and 71/71 lines, including actual back-forward-cache restoration. Retained source hashes/statuses were independently checked after writing. This completes the packed-browser behavior portion, not full original-client-source coverage or registry-release compatibility. External development tools are disclosed; the frozen driver's success is not proof of individual shutdown-error propagation. The 520/521 source-branch gap, memory acceptance and historical intermittent chat timeout remain open. No frozen file, production runtime, client source, lockfile, npm publication, deployment or merge changed; the development npm link is preserved.
Generated socket-test cleanup correction: an isolated unchanged chat run passed all 17 tests both before and after removing its source directory; this did not explain the preceding timeout. A new regression scaffolds and compiles the actual realtime starter, connects its generated helper to a real WebSocket server, and pauses the peer's reads. Before correction, cleanup completed only after forcibly releasing the peer and the regression failed; replacing the teardown's graceful close with termination passed. Explicit graceful chat/presence tests are unchanged. The fallback starts at cleanup entry, and the regression's new supervisory budget covers its own bounded commands and Windows cleanup. No existing chat command deadline, production runtime, coverage threshold, frozen verifier, dependency lockfile or publication state changed. The senior critic independently passed the real-network regression and approved this narrow fix; the historical timeout's cause remains unconfirmed.
Cleanup-increment verification (Windows, Node 22.21.0): verify:package:tools passed 58 tests/seven suites in 203.983 seconds, with all-four 100% coverage over its six verification helpers. The subsequent complete core run passed 735 tests/72 suites in 422.43 seconds, including the final strengthened assertion that cleanup actually leaves the client CLOSED; pretest/types/generated-doc checks and all-four instrumented-library coverage passed. These are scoped source-tree/linked-client results, not full client-source coverage, a fresh packed-release certificate, or evidence that the historical timeout's cause was fixed. The critic independently passed the final strengthened regression and approved the increment. The npm link remains intact; nothing was published, deployed, pushed or merged.
Earlier broader package-tools regression failed: 56/57 tests passed across seven suites, but the documented chat's source-free child timed out after printing its successful occupied-default-port test. The managed child command was terminated/cleaned by its owner; the subsequent generated-starter suite passed, and the separate candidate package gate passed. The cause is not established and passing neighboring runs do not waive it. Consequently that combined run reached 97.5% statements / 100% branches / 95.45% functions / 97.88% lines rather than passing its coverage threshold; ClientCandidate itself retained all-four 100%. All pretest/type/documentation-generation checks passed. No timeout, coverage or workload threshold was relaxed; diagnosing this chat verification hang remains required.
Explicit packed-client verification (2026-08-30): REDWEB_CLIENT_CANDIDATE selects a local tarball only for the isolated consumer, preserving the development npm link and both repository lockfiles. The verifier checks archive bytes/npm integrity, actual root/Live HTML export resolution from installed Redweb, canonical containment of every bundle, and unchanged fingerprints before/after dependency, browser and package phases. Extracted Redweb now uses isolated consumer runtime dependencies rather than the repository's linked dependency directory. Ten filesystem unit cases cover changed artifacts, missing/mismatched integrity, wrong identity, escaped paths and alternate unmeasured exports, with all-four 100% scoped ClientCandidate coverage. The critic independently reran these tests and approved the candidate-verification increment, not release approval.
The independently installed candidate package gate passed on Windows/Node 22.21.0, including all six generated starters and their source-free production checks, executable docs/action/room examples, consumer compilation, CLI additions, server rendering and static export. Its new native Chrome 152 phase loaded the installed tarball server/examples/client: server-timer counter updates, two-person chat, escaped text, draft preservation, public-client close/reconnect with presence recovery, and actual document departure all passed. Client archive coverage/client-pair-6c5fae8/redweb-client-0.1.0.tgz SHA-256 44eef644c484d12d07b8aea4ee9be8ecf44c6706a41e3e1455b129590799623f; Redweb tarball SHA-256 fd67a94a853fdcb972aece5636b1806488060a5dce45ce22e57cc3983934b6ce. All four installed ESM/CommonJS client bundles matched the locally tested build. This run preceded the last additional export-path assertions/documentation update; it is concrete candidate behavior evidence, not a final exact-release certificate.
Negative control with the same Redweb tarball and no candidate environment failed normally: published redweb-client@0.1.0 does not export ./live-html (ERR_PACKAGE_PATH_NOT_EXPORTED during installed counter startup). There was no fallback to the local link. Publication/version/lockfile integration therefore remains required; matching candidate behavior does not waive the unresolved 520/521 source-branch result, other coverage boundaries, memory acceptance, final cross-platform/PR checks or deployment alignment. No npm publication, deployment, merge or threshold change occurred.
Original client source coverage (2026-08-30): new verify:client:source-coverage instruments all executable TS/JS modules once with the existing ApplicationCoverage collector, feeds the same output to Vitest and esbuild/Chromium, retains separate Node/browser/worker reports, compares actual test inventories/results, and checks unchanged client inputs and loaded core tooling. Original AST forms are audited before classifying the two erased/static-linkage modules; unsupported runtime export-assignment/import-equals syntax fails closed. Vitest discovery is preserved rather than narrowed. Available command JSON reports survive failed child execution and cleanup; primary/report failures are combined and uncertain workspace ownership is recorded. Sixteen focused fixture/VM/real-subprocess tests pass with all-four 100% coverage over the new collector/report-preservation helpers. The senior critic independently reran them and approved this tooling increment, not release completion.
Final run a6304aba-29ef-4cab-b126-a286c183cf72 (Windows, Node 22.21.0, TypeScript 5.9.3, esbuild 0.28.2, Chrome 152.0.7977.64) executed the same 75 client tests plain/instrumented, collected all five expected test realms, and passed native browser feedback/runtime/lifecycle/morph (18/13/7/46 assertions), shared protocol/wire (58/43 assertions) and actual keyboard/pointer selection checks. Plain browser bytes matched linked production bundles: Live HTML SHA-256 517d4de56014efcbce0199407d8d60f9be3c9fba956ee96fc8c90cb7d28043c8, transport 0e2da28559018a8bf44f37a41e20e464a905c7e8f678cd59dd758b9a7135c866. Original-source totals are 790/790 statements, 125/125 functions, 658/658 lines and 520/521 branches (99.8%), so the gate correctly exits 1. Reports and instrumented/plain candidates are under coverage/client-source/<run-id>.
The remaining original-source branch is the defensive undefined-entry check after queue.length > 0 and synchronous shift(). The reviewer found no supported callback path that can empty the dense queue between those operations; no private-state corruption test or coverage exclusion was introduced. Three legitimate boundary units now cover factory cancellation followed by failure, transports omitting optional binaryType, and late duplicate open notification after cancellation. All 75 tests and client type checks pass; the separate whole-client V8 gate still fails (56.57% statements/lines, 98.3% branches, 93.22% functions), while transport/protocol V8 source metrics are all 100%. These metrics have different instrumentation semantics and are not substituted for each other. The emitted frontend and refresh regression gate remains all-four 100% (runs b4d967e8-ac73-4613-ba0b-c096f903bc06 and 25e6a5e5-45bc-4bbf-863b-c123f0a397fb). No production source, dependency lockfile, frozen verifier, historical evaluation, memory threshold, npm publication or deployment was changed by this increment.
Senior critic approved the linked local-development increment after independently rerunning both native-browser lifecycle reproductions: one owner/connection on reentrant mount, and draft preservation on reply-time disposal. The final focused core run passed 38 tests in four suites; both lockfiles and frozen verification/evaluation sources are unchanged. Approval does not cover the still-open packed-pair, publication, remaining coverage or memory acceptance gates.
Final frontend cleanup removed unused helper bindings without changing behavior. Native run b6fbe850-c95c-4148-a085-edfd0b1599d4 again passed all four frontend metrics (426 statements / 262 branches / 64 functions / 351 lines); covered source SHA-256 154dcab6e3765237d39eec031f12df073b80b01b6414fe3a5d0df467c8db1287, optional bundle 517d4de56014efcbce0199407d8d60f9be3c9fba956ee96fc8c90cb7d28043c8. The eight collector tests retained all-four 100% coverage. Separate refresh run 90f5870b-d2dd-4a53-a9e8-a3e1a837f84b passed 82 statements / 44 branches / 12 functions / 71 lines, with real history restoration and outage/draft controls. Generated documentation and all pretest/type gates were refreshed for the linked development guide; source and release coverage limits below remain unchanged.
Client-owned frontend (2026-08-30, Windows, Node 22.21.0, Chrome 152): migrated morph/state/action/form/feedback implementation to optional redweb-client/live-html; removed the three old core helper implementations and moved their request-state units to the client. The root client stays socket-only. Redweb emits a two-line import/mount bootstrap. Reviewer-reproduced reentrant mounting and reply-time disposal defects are fixed with native-browser regressions. Per user instruction, development now uses npm link to sibling redweb-client; both lockfiles remain unchanged. See CLIENT_DEVELOPMENT.md for reproducible setup and the explicit incompatible-published-0.1.0 boundary. Earlier draft tarballs were tested locally; the final linked revision is not claimed independently installed release-pair evidence.
Linked verification: 36 focused core tests, client build/types and 72 client tests passed; the frozen real-browser gate passed counter, chat, dashboard, CSS, JSX, collections, components, validated actions and docs composition. Native frontend run 453e21f8-5537-4e4a-950f-acbfc3ea57ae covered all 426 statements, 262 branches, 64 functions and 351 lines, with identical plain/instrumented cases (18 feedback / 13 runtime / 7 lifecycle / 46 morph assertions plus native selection). Covered source SHA-256 8c3170ea4524a0db8f326a5a9097c55f0f0b4cdda77366a01b6891aff4078cc5; full optional bundle 1ba437b5c4b00d10c74920e24039b542832c3f86dae6e57a7b4a036e7fa6cd74. Every bundled module is assigned to frontend or transport scope; only static export linkage lies outside executable frontend instrumentation.
Coverage boundaries remain open: source-level client transport/protocol now reach all four metrics at 100%, including an explicitly simulated stale-scheduler unit test. All client IT still use real connections/timers. Expanded whole-client Node coverage correctly fails (56.57% statements/lines, 98.27% branches, 93.22% functions) because the browser modules are not exercised in Node and an ActionFeedback V8 branch remains uncovered. Separate native-browser transport run c1580684-9da0-4a64-beb3-c061c06757bc, source SHA-256 0e2da28559018a8bf44f37a41e20e464a905c7e8f678cd59dd758b9a7135c866, passes the shared 58 protocol / 43 wire assertions but fails coverage at 346/368 statements, 232/259 branches, 61/61 functions, 315/328 lines. No thresholds or coverage scopes were narrowed to conceal these gaps. Client publication/versioning, ordinary clean-install/locked-package verification, whole-source coverage reconciliation and the unresolved memory gate remain prerequisites; nothing was published, deployed or merged.
Authorized client follow-through: user explicitly authorized changes to C:/Users/arkam/Documents/redweb-client and consolidation of generated frontend behavior into that client. Client branch codex/client-lifecycle now has critic-approved commit c1663ae: generation-aware cancellation, attempt retirement before terminal callbacks, reentrant connect identity, and jitter-callback cancellation. All 58 client tests pass, including 18 real-network integration tests; 100% statements/functions/lines and 99.63% branches leave the defensive stale-timer guard uncovered, so its coverage gate still fails. Existing client unit tests use transport fixtures; its new integration tests use real connections/timers. A local npm tarball from this commit was extracted and both ESM/CommonJS entrypoints passed the same 58 protocol assertions and 43 actual-network assertions. Artifact coverage/client-candidate-c1663ae-20260830T1624/redweb-client-0.1.0.tgz, SHA-256 c8f17a9ea3bd9ca37e7a10527478ad7343bd36663c71b43998d4c0dd085abb3c. Its metadata is still 0.1.0 and must not be confused with the published artifact; nothing was installed over Redweb's existing dependency or published. Core's six focused tests and all pretest/type gates passed. Native browser verification of the candidate, frontend consolidation, full coverage, and release integration remain open.
Imported-client behavioral tests (2026-08-30): added shared public protocol units (58 assertions) and real-wire client cases (43 assertions) covering correlation, error envelopes, queued cancellation/expiry, binary messages, malformed frames, callback isolation, graceful/policy/abrupt close, native constructor/upgrade failures, retry exhaustion and manual retry cancellation. Node integration uses actual ws connections; Chrome uses its native WebSocket/AbortController/timers. The same cases execute plain and instrumented without replacing dependency methods or browser APIs. Final installed-0.1.0 run 38aad9a8-72ba-4f9f-8669-9213ed2367e6 retains source hash e27ca1e3c5187e51e996b33bb92065959ac4e32eb3e6700751404e6443d2e8de and reaches 317/330 statements, 213/232 branches, 56/56 functions, 289/297 lines; it still correctly fails the 100% gate. Generated-runtime regression cd57befe-dcce-4184-8d42-84bc7e58bfe1 remains 100% in all four metrics. Test ownership uses internally bounded waits, client disposal, combined primary/cleanup failures, and outer ownership of uncertain peer shutdown. A separately reproduced 0.1.0 defect allows a state observer's close() during reconnecting to be followed by a second real admission and an open client; the critic independently reproduced it. The user authorized changes to sibling redweb-client, now version-controlled from baseline 3433cd7 on codex/client-lifecycle. A generation-aware fix and eleven real-network regressions are under review there. No installed dependency, lockfile, npm release or site deployment was changed; Redweb still needs a verified matching client artifact before that fix can be claimed integrated.
Final-head CI observation at f0bbb92: the PR Node 22 job 99282965186 passed 713 tests in 68 suites (five platform-specific skips), then load, but failed unchanged recovery at storm 3: warm 10,426,736 bytes, third 11,478,784 bytes (110.0899073305%), final 10,347,768 bytes (99.2426393073%), all registries zero. The PR Node 18/20/24 and lifecycle jobs completed successfully. This recurring failure remains a release blocker; neither later recovery nor passing jobs waive it. No failed job was retried to obtain a green result.
Site synchronization and imported-client coverage audit (2026-08-30): the critic approved site commit 57e7530 on codex/agent-ready-docs. Its only changed file exactly matches the parsed core catalogue at f0bbb92; development, operations, release-status and dashboard-recipe content were updated. The existing site passed its production build (98 pages / 154 assets), actual HTTP routes/downloads/links checks and all six documentation tests at 100% scoped line/branch/function coverage. No deployment or publication occurred. Separately, measure:browser:client now measures the exact installed redweb-client browser ESM, rather than implying it is included in the generated Live HTML runtime denominator. Initial real-Chromium run 7eb53831-057f-443d-8671-25b595cf7dc7 on Windows/Node 22.21.0 / Chrome 152 retained source SHA-256 e27ca1e3c5187e51e996b33bb92065959ac4e32eb3e6700751404e6443d2e8de: 208/330 statements, 129/232 branches, 36/56 functions and 196/297 lines. It correctly exited 1 for incomplete coverage; identical plain/instrumented cases passed 77 assertions per execution through native DOM and actual HTTP/WebSocket traffic. No dependency methods, sockets or browser APIs were replaced. Report/source are retained at coverage/browser-client. This establishes a concrete remaining test gap, not a new application defect or a waived requirement. The collector's eight unit/real-filesystem tests retained 100% of all four metrics; the generated-runtime regression also retained 100% (378 statements / 240 branches / 55 functions / 309 lines, run 36209e9d-31e7-4fde-a911-39a1c12b80f9). Memory acceptance remains unchanged and unresolved.
Exact-source diagnostic coverage (2026-08-30): npm run verify:recovery:diagnostics now runs the same graph unit assertions through Node's native test runner, plus real valid/malformed/oversized-file CLI subprocess cases. It enforces 100% statements/branches/functions/lines over exactly scripts/diagnostics/recovery-heap-graph.cjs and recovery-heap-summary.cjs, including their command-line paths and unloaded source. All nine tests passed natively (801.2648 ms), and the same nine passed under Jest (0.949 seconds). The native collector uses its own freshly cleared report directory; earlier C8-under-Jest measurements mixed transformed/wrapped and original source ranges and must not certify these modules. Raw reports are retained at coverage/recovery-native-exact/tmp/. Independently inspected all matching raw ranges: graph source 13,076 UTF-16 characters across six process reports, SHA-256 2b9e229e64f528a8c431955382533cc4e6f5526092a315f01eda811991fe1d72; summary source 3,854 characters across ten process reports, SHA-256 8c0787f8a9ffa97fb8936a51a06a9c3d66e616da7ad242870e6a98f54747b495. Every reported range matches that module's original Windows source length. Subprocess deadlines and runner-specific test timeouts are explicit. The already-present expect 29.7.0 assertion package is declared directly as development-only to reuse tests without duplication; no runtime dependency is added. The offline lockfile validation reported zero vulnerabilities. CI includes this scoped gate, but it does not cover verify-recovery.js, other verification tools, the dashboard callback, or imported browser-client code, and it does not waive the failed memory acceptance gate.
Single private graph investigation (2026-08-30), job 99281753851, source d18fc0265c7672833b253bb28f309dd107baeecd, PR merge afc1f2fab127259e312e266b5a6cdc35c1aa372b, Node 22.23.2 / V8 12.4.254.21-node.56: diagnostic failed, original status 1 preserved and both graph reports completed. Scalar warm 10,456,952 bytes; peak storm 3 11,799,872 bytes (112.8423655383%); final 11,104,704 bytes (106.1944627842%); all registries zero. Warm-to-third gross ordinary Object growth was 52 / 3,104 bytes: diagnostic-data-reachable growth 50 / 3,008 bytes, outside growth 2 / 96 bytes (one Promise candidate, one unresolved). All four net additional Arrays were diagnostic-data-reachable; outside Arrays had zero net growth. Third-to-final gross Objects grew 47 / 2,872 bytes: diagnostic reachable net 46 / 2,808 bytes, outside 1 / 64 bytes unresolved. Code grew 854,536 bytes then declined 685,408; hidden nodes grew 138,432 bytes then declined 1,768. Named transport/registry and closure net counts did not grow. These are data-reachability partitions, not exclusive ownership or a complete retained-size explanation. The explicit 400,000-edge traversal bound was reached in both comparisons: 594 / 289 candidates were truncated, with 608 / 297 total unresolved candidates. Ordinary application objects were prioritized; hidden-node searches account for most unresolved cases. No concrete application-owned retention fix is established, no code/diagnostic bytes are subtracted from acceptance, and no threshold or preconditioning change is justified by this report. Full normalized log: coverage/recovery-ownership-22-99281753851.log, SHA-256 ec3381b5b43105cd1c166b7d5856bd376e903c1933f8575a592413a4a22a51e0. Raw snapshots were not uploaded; the job removed exactly its three files, and the collected temporary workflow job is removed. The critic approved the actual PR increment before collection; release approval remains withheld.
Reviewed graph investigation (2026-08-30): diagnostic-only, nonenumerable PID/run and capture-phase markers identify existing tool-created records without adding a global root. The bounded native graph reader follows plain own data/backing arrays separately from prototypes/code, preserves gross deltas, and reconciles before/current/net counts and bytes, additions/removals and shared-node partition changes. Strong incoming paths yield fixed-label candidate retainers, never exclusive ownership. Work limits and unresolved/truncated counts are explicit; application objects are examined before hidden runtime nodes. Comparisons require matching run markers and adjacent warm / storm-3 / recovered phases. Input/output sizes are bounded; malformed/private input produces a constant error without echoing values. Markers and snapshot GC perturb the diagnostic and cannot change acceptance. All 24 focused unit/native-process tests passed in 31.106 seconds, including a real Redweb server holding a known unmarked object and then sharing it with a diagnostic record. The senior critic independently passed all seven graph units and approved the corrected analysis increment; coverage for the entire repository/tool CLI is not claimed complete. One private PR-16-only Node 22 graph investigation is prepared, retaining the original failure status and deleting exactly its three private snapshots after both reports.
Latest ordinary CI at 004a342: the PR Node 22 job failed recovery at storm 4: warm 10,419,896 bytes, fourth 11,490,936 bytes (110.2787974083%), final 10,199,904 bytes (97.8887313271%); all registries zero. The other ordinary jobs passed, including the same-head push Node 22 job and both lifecycle checks. Passing peers and the later decline do not replace this failed gate. Production-dependency audit on Windows with system certificate verification found zero vulnerabilities.
Targeted Node 22 peak diagnostic (2026-08-30), job 99279398846, source ed7d0d1, PR merge 5bed8291a1dd71aa7c591291bb73f3befbeb310f, Node 22.23.2 / V8 12.4.254.21-node.56: failed, explicitly diagnosticOnly: true. Warm heap 10,461,008 bytes; five cycle ratios 107.4704082054%, 111.4016546015%, 111.7148940140%, 107.4922034282%, 105.2011049031%; all registries zero. Warm-to-third snapshot growth includes code +744,104 bytes and hidden nodes +134,856 bytes; named transport/registry/Promise/closure groups did not grow. Generic Object (+51 / +3,072 bytes) and Array (+4 / +128 bytes) counts did grow; retained diagnostic samples are a plausible contributor, not verified complete attribution. Third-to-final code shrank 674,296 bytes while generic Objects increased another 47 / 2,872 bytes. Snapshot GC and native observation perturb this run; it neither replaces the original failed gate nor proves absence of application retention. Raw snapshots were never uploaded and the exact three files were removed by the job's cleanup trap. Complete normalized log: coverage/recovery-peak-22-99279398846.log, SHA-256 8db80d9731d9d86e088c7cadfabd1e5b71c6649142c0058cfb8ec326b3a8cfbb. The collected temporary job is removed; no automatic repeat or more Node 20 traces are scheduled.
Local ed7d0d1 resource verification (Windows, Node 22.21.0): framework metadata overhead 1,880.704 bytes/connection (2,048 limit); 3,200 messages / 32 clients at 6,521.846 messages/second, p99 6.9183 ms, slow consumer contained. Normal recovery failed, with warm 10,603,808 bytes, storm 4 11,699,144 bytes (110.3296476134%), final 10,506,872 bytes (99.0858378424%), every registry zero. Later recovery is not a waiver for the intermediate breach. Separately, live-HTML load passed 200 expired renders / 110 live clients / 8,059,712-byte heap delta; JSX passed 10,000 component rows in 52.6 ms with 1.3 MiB retained. These measurements are not an exclusive-host benchmark. Final focused recovery tests passed 15/15 in 28.049 seconds; documentation units passed 4/4. The senior critic verified the actual PR diff 3a9047a..ed7d0d1 and approved only this diagnostic/test increment, not release acceptance.
Original-TypeScript recipe coverage rerun 13b63aca-9a8a-4dd8-b46c-0d0f7b90d19e completed all six applications with identical plain/instrumented inputs. The new native-response test closes the dashboard branch gap: 166/166 branches, 290/290 statements, 223/223 lines. Dashboard functions remain 73/74 (98.64%), so the combined source-coverage gate correctly exits 1. The other five applications cover all four authored-source metrics at 100%. The remaining dashboard shutdown-rejection callback is not claimed covered or removed solely to improve a percentage.
Exact-head verification and new failure (2026-08-30): 3a9047abdfe439d46a8def8013d7a1ae1f4d706d passed all pretest/type checks and 705 tests in 67 suites (416.797 seconds), with 100% statements/branches/functions/lines over the library coverage scope. Its independent packed-package consumer gate also passed. These do not certify every tool/application. The PR check run passed all four runtime jobs and lifecycle checks, but the same-head push Node 22 job failed the unchanged recovery gate: warm 10,416,232 bytes; five storms 10,861,928 / 11,210,440 / 11,466,512 / 11,281,856 / 10,311,656 bytes. Storm 3 reached 110.08310874796183%, exceeding the 110% bound by 8,656.8 bytes; every phase registry was zero. The final 98.99602850627751% result and passing peer run do not erase that failure. No threshold, workload, or warm-up increase is authorized by this evidence. The senior critic requested one Node 22 intermediate-peak diagnostic: inspect warm, storm 3, and storm 5, rather than only warm/final heaps. Opt-in native statistics observe each storm; private snapshots capture only warm, storm 3, and final/recovered to avoid extra snapshot GC before the peak or duplicate final captures. They use the existing exclusive-create mechanism; snapshot-induced GC means these are never acceptance runs. Publish only fixed-label aggregates, not raw snapshots.
Added no-mock negative-path checks: recovery requires explicit GC; the heap-summary CLI rejects malformed/private input without echoing contents or paths; metadata validation covers invalid types, offsets, and aggregate overflow. The initial 15-test run passed in 27.058 seconds. Tool coverage remains explicitly incomplete (94.06% statements/lines, 90.59% branches, 100% functions in that scoped measurement); library coverage is not a substitute. Dashboard middleware coverage uses the original registered handler and genuine HTTP-created Express request/response objects after native response destruction; it is a defensive-state unit test, not evidence that an aborted upload naturally takes that branch. The unreachable-in-current-fixtures defensive shutdown-rejection callback remains unclaimed.
Recovery protocol review outcome (2026-08-30): the single predefined Node 22 five-storm extension job 99276100209, head 75b7872, passed with the same 10,431,536-byte warm baseline: 104.1409050403%, 107.3908962208%, 109.7890857109%, 108.4740732333%, 99.0396045223%. All phase registries were zero. The fourth/fifth-cycle decline resolves the specific concern that the earlier three-cycle cutoff hid continued boundary-crossing growth; it is not proof of an indefinite plateau. Complete normalized log: coverage/recovery-extension-22-99276100209.log, SHA-256 895389df0f69c450d69b9473fe458c4c4225514fa906f75548a1390dc737e64f. The temporary job was removed after collection in 484892d. The senior critic approved promoting fixed preconditioning with five measured storms as the stronger default/minimum, keeping the same baseline/110% bound and preserving explicit cold-v1 comparisons and historical failures. Final ordinary five-cycle cross-version checks remain required; the earlier four-runtime candidate evidence covered three storms, with this separate extension covering five only on Node 22.
One-hour raw-socket soak completed normally from 2026-08-30T14:05:51.033Z to approximately 15:05:53Z, Windows/Node 22.21.0, using code loaded at bfcad29: 64 clients, 3,600 seconds, 721 samples, 2,155,695 messages sent and 2,155,609 received (99.9960105674%). Final heap was 11,347,696 bytes versus 11,402,568 warmed bytes (99.5187750689%); all eight resource-trend gates passed, final clients/rooms/sessions/in-flight counts were zero, and native handles were 1 before/2 after. Report: coverage/final-soak-bfcad29-20260830T1406Z.json, SHA-256 5c760822eb1664d00b4823f970e7b19c501e697d28ad8dc0413bd683ddcc3055. The managed process and child both exited; no scheduled task was created. This is raw /soak transport evidence, not browser/authenticated-application certification. It overlapped other verification workloads, including the temporary heavy diagnostic-test assertion described below, so it is not an exclusive-host benchmark. The later inspector-only source correction is not exercised by this inspection-disabled soak.
Inspector correctness follow-through: PR run 33318223609 exposed a real closing/reconnect race in Node 22's inspection integration test. The inspector classified an attached non-open socket as retained, while admission correctly rejected reconnect until that socket and disconnect hook were cleared. It now reports such a transport as detaching; only detached sessions can be retained. A native WebSocket.close() regression checks synchronous CLOSING classification, actual cleanup and subsequent reconnect, without replacing browser/transport APIs. Fourteen unit/integration tests pass with 100% statements/branches/functions/lines over Inspection.js (2.165 seconds); the critic independently passed all nine inspection integration cases. This changes optional observation, not socket admission or disabled runtime paths. Final full-suite/package verification of the corrected observer remains required.
Verification status before that inspector correction: the local regression run completed 702 tests/67 suites in 427.011 seconds with 100% instrumented-library metrics, but started at e8af515 and overlapped recovery-tool/test edits, so it is not an exact-head final certificate. A fresh extracted/independently installed package gate at 75b7872 passed and production audit reported zero vulnerabilities with certificate verification retained. Those results precede the inspector correction. Current acceptance remains open rather than treating the scoped diagnostic/test results as a completed release.
Private object-retention diagnostic (2026-08-30): job 99274635931 at the PR merge of e8af515 captured warm/recovered native heaps on Node 20.20.2 with the same library/lockfile Git objects as bfcad29. The workload ran with only PATH and explicit diagnostic settings, and private snapshots were removed without uploading them. Logs contain fixed-label counts/self-sizes and numeric runtime statistics only; stdout/stderr were kept separate. Snapshot self-size grew 787,696 bytes, including 708,168 bytes classified as code (about 89.9%), 48,640 hidden bytes and 28,784 internal-array bytes. All reported transport/registry/Promise/Abort/closure/native counts and self-sizes stayed unchanged; WebSocket objects were absent in both samples. Fourteen plain objects and one array were added, but their ownership is not proven by aggregate counts. The scalar ratio was 109.2529123779%; snapshot-induced GC/work makes this diagnostic-only, not replacement acceptance. Complete normalized log SHA-256: dde0e58f5587066a404f281cbd7c362a2aaebac432b48dc38223edfddb267d79, local coverage/node20-recovery-objects-99274635931.log. The temporary job was removed after collection in 65b24ee.
Fixed recovery candidate steady-v2 (7f078fc) is an experiment, while cold-v1 remains the default acceptance selection. It performs one predetermined storm-sized preconditioning phase, the original warm phase, then three storms, with the existing 400 ms expiry wait/two collections and empty registries after every phase. Every storm compares against the same warm baseline at 110%; no adaptive warm-up, rolling baseline, code subtraction or best-run selection is used. Default traffic is 1,200 preconditioning, 200 warm and three 1,200-connection storms, batch size 50. The first Windows/Node 22.21.0 candidate run passed all three bounds at 104.3210981256%, 108.3906658119% and 109.4339394681% of the 10,594,344-byte baseline; all phase registries were zero. That increasing series is retained, not characterized as an established plateau. The predeclared Ubuntu candidate matrix in run 33318223609 passed once on each runtime: Node 18.20.8 (104.2104610568%, 102.4019590749%, 103.2427803674%); Node 20.20.2 (108.2880813492%, 108.5443856822%, 107.3774428581%); Node 22.23.2 (104.2508887370%, 108.0581383742%, 109.6167873404%); Node 24.19.0 (100.0454742472%, 100.2683641760%, 100.3819395979%). All phase registries were zero. Complete normalized logs are retained as coverage/recovery-steady-<node>-<job>.log; jobs are 99275451365, 99275451465, 99275451409, 99275451463 respectively. The one-shot matrix was removed in 37908c6. Acceptance promotion remains subject to review; historical cold-protocol failures stay explicit.
Diagnostic test follow-through: eleven focused real-process/native-snapshot and aggregate-unit cases passed (14.947 seconds before the explicit cold-protocol fixture setting). Invalid snapshot metadata/indexes fail closed, private data is not printed, existing snapshot files are not overwritten, and protocol phases use one baseline. A draft test's deep object comparison of two roughly 10 MB snapshot buffers caused excessive CPU/memory use; native byte comparison fixes the same assertion. Two runs containing the draft were stopped after verifying their exact Jest processes, and only their two known private snapshot directories were removed. They are not acceptance evidence. The hour-long soak was left running; its environment includes this temporary co-load and must not be described as an exclusive-host benchmark.
Recovery-verifier correctness and investigation (2026-08-30): commit a7644a8 rejects zero, empty, fractional, nonfinite and unsafe connection counts, plus overflow of derived capacity/count values, before opening a listener. The previous verifier could exit successfully with one warm connection and zero storm connections; that concrete false-pass is now rejected. Seven real-process tests pass on Windows/Node 22.21.0 (8.175 seconds), including actual socket traffic and opt-in native V8 diagnostics. This is not a claim of 100% coverage of the recovery script. The senior critic approved the input validation, tests and unchanged default workload, waits, collection calls and 110% retained-heap threshold.
Node 20 remains an open release gate, not a retry-to-green result. PR run 33316834970 at 9c2a35b passed Node 18/22/24 and the Linux browser/package/lifecycle job, but normal Node 20 recovery retained 9,383,592 bytes against an 8,519,480-byte baseline (110.1427786672%; all three registries zero). Its trace-only follow-up also failed (110.1523531234%). The same-head push run 33316833095 passed; that does not invalidate the failure. Earlier fixed-revision diagnostic job 99271719623 at bfcad29 passed at 109.9059980659% with trace flags, which alter measurement conditions; it is not replacement acceptance evidence.
A single native-statistics diagnostic job 99273406662, PR merge f58810d of a7644a8, ran the default 200 warm/1,200 storm/50 batch workload on Ubuntu 24.04, Node 20.20.2, V8 11.3.244.8-node.38. It independently asserted unchanged src, root entrypoint and lockfile Git objects versus bfcad29. The diagnostic failed at 110.1683068116% (8,561,032 to 9,431,544 bytes; registries zero). Native samples show code-space growth of 329,088 bytes and old-space growth of 552,072 bytes; external/ArrayBuffer readings stayed unchanged. Code-and-metadata grew 540,568 bytes, but this is an overlapping view and must not be added to the space totals or subtracted from the acceptance measurement. Samples allocate and can perturb the diagnostic. These results establish a compiled-code contribution, not a complete attribution or proof that application retention is absent. The complete ANSI-normalized log is retained locally at coverage/node20-recovery-spaces-99273406662.log, SHA-256 990bb192a5d8ad4e5b33d4a8a0d6b0c086e5bd293da7bd22496668f0ffd3a74d; the temporary job was removed after collection in e84aa1b. No release-completion box is changed by these diagnostics.
Site synchronization follow-through (2026-08-30): refreshed the existing codex/agent-ready-docs checkout from the canonical catalogue, updating Live HTML guidance, release-status evidence and all six complete recipe downloads while retaining 66 catalogue pages and all five task guides. The existing Redweb renderer, dependency/lockfile, layout, social metadata, Firebase/manual workflow and running preview are unchanged. Production export builds 98 HTML pages/154 assets; actual HTTP checks verify 11 examples, 29 API articles, every Markdown/source download, internal links and metadata. Six documentation tests retain 100% line/branch/function coverage over seven scoped documentation/import modules, including real multi-version import/build/HTTP checks and immutable archives. The senior critic confirmed exact normalized catalogue parity and honest unreleased/published-version boundaries. This is local site readiness only: no public deployment or npm publication occurred, so public release-alignment checkboxes remain open.
Authored-application coverage increment: verify:starters:source-coverage instruments the exact original TypeScript before compilation and seeds every generated module at zero. It validates source maps and counter shapes/values before merging actual process-exit reports, preserves compiler options/source/output/test hashes, and verifies unchanged application/test inputs across plain and instrumented runs. Plain execution uses the shipped test:coverage command; instrumented execution runs the same tests without rebuilding over instrumentation. V8 reports are retained separately with matching module membership. Received reports are not a census of spawned processes (hard termination can prevent reporting), and Istanbul does not independently count optional-chaining short circuits. No authored exclusions, lowered thresholds or production-code changes were used.
Final source run 5404b0a2-5bbc-452e-88f5-ac7defe4a40b (2026-08-30T13:27:32.826Z–2026-08-30T13:30:43.605Z, Windows/Node 22.21.0, TypeScript 5.9.3, Istanbul instrumenter 6.0.2) is correctly failed, not a completed all-application gate. Realtime/chat/site/socket/HTTP-WS reach 100% tracked authored statements/branches/functions/lines. Dashboard reaches 290/290 statements, 223/223 lines, 165/166 branches (99.39%) and 73/74 functions (98.64%). Remaining entries are the destroyed-response guard at recipes/dashboard/app.tsx:31 and rejected-shutdown callback at line 75; no genuine public recipe failure path to the latter was identified, and no behavior was replaced to manufacture coverage. All six retained V8 reports have 100% statements/lines/branches after closing the real chat standalone-startup and HTTP/WS default-port gaps; V8 functions remain 58.33% realtime, 59.09% chat and 88.7% dashboard, with site/socket/HTTP-WS at 100%. Report and plain/instrumented-output hashes were independently checked. These are different measurement definitions, not interchangeable exhaustive-branch claims.
Added real occupied-port/HTTP/WebSocket default checks, dashboard database-capacity 503 handling, abandoned plain/gzip uploads and graceful standalone startup with both default and production origins. Windows uses an actual IPC message to deliver Node's signal event instead of force-terminating the child before cleanup/reporting; Unix uses its OS signal. An intermediate package run caught expected ECONNRESET incorrectly rejecting a close wait; both waits now observe actual closure, and 12 planned real repetitions pass. The first ad-hoc repeat setup omitted copied CSS; using the recipe's actual build command corrected that setup. The final stable suite passes 684 tests/65 suites in 381.299 seconds with every pretest/type gate and 100% instrumented-library coverage. Five collector tests pass at 100% scoped collector coverage, including real process exits and denominator-negative fixtures; seven real MCP/package tests retain 100% adapter coverage. Final extracted/independently installed package consumers and all generated/Markdown applications with source removed pass; audit reports zero vulnerabilities with certificate verification retained. The senior critic approved the measurement boundaries and final cleanup correction. Frozen helpers/evidence are unchanged. Nothing was published/deployed, no new performance/platform/soak claim is made, and the full checklist remains open.
Final package-ownership verification (2026-08-30, Windows, Node 22.21.0, TypeScript 5.9.3): the stable full suite passed 679 tests/64 suites in 382.58 seconds, including pretest/type gates, with 100% instrumented-library statements/branches/functions/lines and a normal exit. The separate package-tool gate passed 34 tests/four suites in 207.218 seconds with all four metrics at 100% over exactly VerificationWorkspace.js, verificationError.js, verify-starter.js and verify-documentation.js. The final extracted/independently installed package gate passed after migrating top-level commands, including every generated/Markdown application with source removed. Real Chromium dashboard sign-in/private cards/draft preservation/HttpOnly cookies/logout/re-login/deletion and the complete counter/chat/action/rendering browser gate passed. The combined browser coverage gate passed collector tests and 100% morph/runtime/refresh thresholds in Chrome 152.0.7977.64: morph run 5e2851d0-cb6b-4d12-bbb4-54606597510d, runtime run b570e11f-fb53-4e36-9376-93a0b1cc53f6, and refresh run cf33da88-634f-48f4-b6d3-89a32c85c190; plain and instrumented acceptance both ran, including actual HTTP/WebSocket actions and observed back-forward-cache restoration. The senior critic approved after the non-stringifiable-error cleanup bypass was fixed and independently checked. Audit reported zero vulnerabilities with certificate verification retained. These are scoped verification improvements, not whole-tool/application coverage, additional platform certification, or a fresh load/soak claim. All remaining checklist gaps stay open; nothing was published or deployed, and frozen helpers/evidence were unchanged.
Package-verification ownership increment: starter and Markdown verifiers now require the caller's shared workspace owner and await the actual initializer, npm test and source-free process phases. Individual starter command deadlines remain 30 seconds; outer test supervision now accommodates the sequential phases and cleanup instead of abandoning asynchronous work early. Top-level npm packing, native archive extraction, CLI/type/consumer checks also use the managed owner with direct argument arrays and no shell. This supersedes the earlier note about the starter/documentation preparation path; unrelated compiler/browser/evaluation tooling still has its own audit requirements. Frozen evaluation/process/browser/network helpers were not edited.
Dashboard verification retains its existing public entrypoint while adopting the workspace owner. Listener readiness and browser operations are bounded; rejected versus still-pending page openings remain distinct, late pages are closed, page/app cleanup failures are retained, and uncertain cleanup prevents workspace deletion. Real npm/descendant tests verify timeout termination, nonzero diagnostics, phase ordering, malformed initializer output and unsupported engines. A real malformed DevTools HTTP peer proves setup failure and natural verifier exit; an actual Windows lock proves primary error plus retained-workspace reporting. A discovered falsy/non-stringifiable thrown-value bug is fixed by one coercion-free error normalizer shared by the owner, dashboard, action-feedback verifier and browser collector. Native cross-realm errors keep their identity; non-Error causes remain attached without invoking object hooks.
Final starter-increment verification (Windows, Node 22.21.0, TypeScript 5.9.3, c8 10.1.3): the stable full suite passed 663 tests/62 suites in 342.474 seconds, all pretest/type gates and 100% instrumented-library statements/branches/functions/lines. The extracted/independently installed package gate passed, including generated and documented applications with their source removed; audit reported zero vulnerabilities with certificate verification retained. The senior critic approved after the recorded fixture/process/evidence findings were fixed. Final measurement run 34010655-cb64-47a6-ab07-78e1858911e8 completed from 2026-08-30T12:35:19.418Z to 2026-08-30T12:37:06.260Z; saved report/output hashes were independently checked. Every application has 100% V8 source-mapped statements and lines. Site/socket also have 100% branches/functions; realtime has 100% branches/58.33% functions, chat 98.57% branches/59.09% functions, dashboard 100% branches/88.7% functions, and HTTP/WS 96.42% branches/100% functions. Uncalled TypeScript decorator accessors affect function counts; standalone canonical chat startup and an HTTP/WS factory fallback remain branch gaps. These percentages are application measurements, not whole-repository coverage or a new browser/platform/resource certification. Nothing was published or deployed, and frozen evidence/helpers were unchanged.
Starter application verification increment: all six initializers now include source maps, a development-only c8 dependency, npm run test:coverage, and ignored report output. The shared declaration avoids copying dashboard-specific setup into other recipes. A separate measurement runner uses managed initializer/npm subprocesses, one canonical dependency-link helper, exact expected TypeScript-module membership checks, unique run directories, source/report/input/output hashes and explicit running/failed/measured status. It records compiler/runtime versions and preserves cleanup uncertainty; a failed rerun cannot silently reuse an earlier successful summary. This is measurement, not a new 100% acceptance claim. The existing source-free package tests remain separate; their older synchronous preparation path is unchanged and remains a broader tool-ownership audit item.
Expanded canonical recipe tests use actual chat components for bounded history/presence and room isolation, and HTTP/WebSockets for normalized name conflicts, reconnect reservation and explicit leave. Socket tests exercise duplicate join/resume, unknown sessions, all 100 retained session slots, capacity rejection and successful resume afterwards. Shared process tests launch the actual application entrypoint against an occupied port; Windows needs both wildcard and loopback reservations. The first fixture incorrectly reserved only loopback and timed out; corrected fixtures pass. Review also caught a test-helper shadowing error and primary-error replacement during cleanup; both were corrected. An overlapping full-suite attempt observed the shadowing error and generated-doc drift during those corrections, so it is not stable-tree acceptance evidence.
Final refresh-increment verification: the stable-tree full suite passed all 663 tests/62 suites in 323.927 seconds, including pretest/type gates, with 100% instrumented-library statements/branches/functions/lines and a normal process exit. The combined native-browser coverage gate passed eight collector tests and all morph/runtime/refresh coverage thresholds; after the final pending-close ownership adjustment, refresh run 77966f51-23a1-4699-b3a0-fe108a1c8428 independently repeated all plain/instrumented acceptance cases at 100%. The complete development-browser gate passed generated watcher rebuilds, failed builds, draft/focus retention and actual BFCache restoration. Seventeen focused collector/documentation/real-network tests passed with open-handle detection, including the final fuzz cleanup implementation. The senior critic independently approved refresh ownership and fuzz harness hardening. Package dry-run/prepack checks and generated documentation checks passed; test bridges, reports and fixtures are not packaged. This closes this verification increment, not the broader release checklist, and does not establish the cause of the preceding timeout. No publication or deployment occurred.
Fuzz regression observation during refresh verification: one full run reported 662 passing tests and a 5-second timeout in the existing malformed-text/binary-frame test, followed by a 5-second teardown timeout. The completed test runner retained its fuzz listener and had to be stopped after its process lineage and socket ownership were checked. An isolated original test then passed with open-handle detection; the original timeout cause remains unconfirmed. The test now gives each frame exchange a named two-second deadline, registers listeners before sending, rejects unexpected closure, and always removes its listeners. Its multi-exchange test budget is 30 seconds; teardown terminates its own adversarial clients and independently attempts server shutdown within bounded deadlines. The senior critic approved this as harness hardening, not a production socket fix. Ten planned consecutive focused runs passed after hardening. The failed run is not treated as a passing release gate.
Development-refresh coverage increment (Windows, Node 22.21.0, Chrome 152.0.7977.64, 2026-08-30): the combined browser gate now instruments the exact refreshBrowser() output under its existing self-only script policy. The collector uses the actual global directly instead of dynamic code evaluation; a VM regression with string code generation disabled proves this independently. Plain/instrumented browser runs use real HTTP outages, redirects, malformed/partial/non-JSON responses, history navigation with observed BFCache restoration, delayed script loading, real file input, and native typing/clicks. They verify retained drafts, clean automatic reload, explicit discard, invalid host/revision configuration and a native-function unit call to a stopped poll. The stopped-poll call is unit robustness, not a claim of an organically scheduled callback. All 82 statements, 44 branches, 12 functions and 71 lines are covered without exclusions; source SHA-256 is d8a14c1b44dab03f1fd6a62ef4b6721bb5e4baa9348b5f2e93a7fa2316bf8cd0. The only production simplification removes a redundant inner stopped check: cleanup always changes generation before any current-generation finally can schedule another poll. The senior critic independently confirmed that invariant.
Refresh verification ownership: source-map/counter snapshots before navigation and real pagehide beacon uploads retain coverage across actual reloads; snapshots contain coverage metadata, not draft values. Explicit delivery waits precede peer shutdown. Snapshot failure cannot skip page closure, multiple failures remain aggregated, and uncertain peer cleanup is propagated to the workspace. Native close promises remain awaited even after the listener stops accepting connections. Three real HTTP/TCP regressions cover malformed/wrong-map/oversized/aborted uploads, port conflict and an upgraded connection that keeps a close pending through two timeouts before actual release/reopen. Test bridges/report endpoints remain confined to verification fixtures, not shipped runtime code. Imported-client coverage, full tool/application coverage, broader platform/resource evidence and publication alignment remain open.
Complete-runtime verification: the main suite passed 659 tests/61 suites in 350.641 seconds with all pretest/type checks and 100% instrumented-library statements/branches/functions/lines. The final combined browser-coverage gate passed the seven collector tests, standalone morph/selection checks and complete-runtime checks; run 30bcacb1-711a-40f6-b984-e7697f9d1da1 records the latter's plain/instrumented results. The full existing live-browser gate passed counter/chat/cards/components/JSX/dashboard/actions, and the separate development-browser gate passed real generated watcher reloads, failed-build handling, draft/focus guards, adverse HTTP peers and actual BFCache restoration. The senior critic approved the implementation, including the exact malformed-patch diagnostic and ordered post-reconnect action barrier. Documentation/unit checks and package dry-run/prepack checks passed; verification scripts, fixtures and coverage files remain outside the package. No npm publication, site deployment, remote CI, full imported-client coverage, or broader release completion is claimed.
Complete emitted-runtime coverage increment (Windows, Node 22.21.0, Chrome 152.0.7977.64, 2026-08-30): npm run verify:browser:coverage now measures the entire canonical browserRuntime('/__redweb/client.js') output, including embedded morph/feedback code and surrounding state/form/event wiring. All 378 statements, 240 branches, 55 functions and 309 lines are covered with no exclusions. The unchanged emitted-source SHA-256 is 5d156d2ac079ced2bb44de2c20aa92b39f4949516749f6dcd80d0fc9ae8bb399; run-specific reports/source are under ignored coverage/browser-runtime/. Identical plain/instrumented runs reuse 46 morph and 18 feedback unit-style assertions, the real action acceptance driver, and 13 additional protocol/input assertions. Those exercise duplicate/scoped text targets, HTML target reindexing, boolean checkbox states, repeated/prototype-named form fields, ordinary unbound events, and an intentionally malformed component patch with its exact diagnostic. Native keyboard events update actual writable server state; closing the real client surfaces a failed state send, and a real ordered action/result round trip after reconnect verifies that the offline value was not replayed. The public runtime is not modified and no test bridge is shipped. The standalone feedback measurement remains available as node scripts/verify-browser-coverage.js feedback; the combined gate avoids repeating that acceptance run separately because the complete runtime includes it. Imported redweb-client code, development refresh, full application/tool coverage, broader platform/resource evidence and publication alignment remain distinct unfinished gates.
Action-feedback verification: npm test -- --runInBand --silent passed 657 tests/60 suites in 324.636 seconds, including all pretest/type checks and 100% instrumented-library statements/branches/functions/lines. The two new verifier cleanup regressions were added after that run's test discovery and passed separately against actual servers: a rejecting decorated-page disposal preserves both the original setup error and cleanup error, while a thrown non-Error value still fails after listener closure. The existing complete live-browser gate passed; the final combined generated-browser gate passed its seven collector tests, 46 plain/instrumented morph assertions, live selection actions, and plain/instrumented feedback acceptance with 18 ownership assertions. The senior critic approved after primary-error preservation, timeout supervision and unnecessary fixture-listener findings were addressed. Package dry-run/prepack checks exclude test scripts, fixtures and coverage artifacts; generated documentation checks pass. This verification increment does not certify a new npm release, deployment, all browser modules, or the full repository/application coverage requirement.
Action-feedback browser-coverage increment (Windows, Node 22.21.0, Chrome 152.0.7977.64, 2026-08-30): the shared browser coverage command now also instruments the exact emitted browserFeedback() source, including its embedded canonical ActionFeedback state machine. A test-only Express route delivers the canonical complete browser runtime with only this source segment instrumented; the actual client, HTTP/WebSocket server, DOM, timers and event APIs are not replaced. The existing action-feedback acceptance driver runs once plain and once instrumented, covering real validation/authorization/application errors, pending/completion, duplicate suppression, capacity drain, reconnect and draft preservation. Eighteen additional native-DOM unit assertions cover shared slot ordering, rebound/detached sources, retargeted/component-moved slots, authored attributes, fallback reuse and input/change revision tracking. Direct state-machine failure calls are explicitly unit-style checks, not simulated network integration evidence. All 123 statements, 56 branches, 15 functions and 109 lines are covered, without exclusions; emitted-source SHA-256 is 92a7468278dcd58b80448c9f90273a42b6a16de6386135afa0498c98e408c075. Run-specific maps/source/status are retained under ignored coverage/browser-feedback/. No production behavior changes or runtime test bridge are shipped. Surrounding browser transport/form wiring, development refresh, broader application/platform coverage and final release gates remain open.
Native-browser coverage increment (Windows, Node 22.21.0, Chrome 152.0.7977.64, 2026-08-30): added npm run verify:browser:coverage and its bounded Node 22 CI step. The test instruments the exact emitted browserMorph() source, excluding the appended test bridge; identical 46 native-DOM assertions run in separate plain and instrumented documents. Keyed moves/removal, invalid boundaries, text/attributes, client-owned nodes, table/select parsing, SVG, form defaults/drafts and focus are exercised without replacing browser APIs. Direct helper robustness cases are unit-style browser tests, not claims that malformed helper arguments occur through production entrypoints. A separate uninstrumented Redweb page uses native keyboard/pointer events and two actual server actions over HTTP/WebSockets to verify selection preservation and server-default updates. All 170 generated statements, 140 branches, 18 functions and 128 lines are covered, with no exclusions. Emitted-source SHA-256: 7103a57f7ff0e9c330cbfdd2527651b0c765525ae362214ef4fb312cd5a3d066; run-specific source, maps, browser version and status are written under coverage/browser-morph/.
The tests exposed and fixed duplicate-valued option selection: retained option identities now take priority, replacement fallback consumes each missing value once, and server-default comparison handles keyed duplicate moves without discarding unrelated drafts. Restoration and default matching use linear scans/maps. The redundant cursor/end fallback was removed only after verifying the bounded-range invariant. Seven collector tests enforce 100% scoped coverage and exercise absent/altered maps, empty source, incomplete execution, non-Error failures, and a real Windows file lock during final cleanup. Final reports are created only after workspace cleanup settles; failure/retained-workspace information cannot become a passing cleanup result. The senior critic approved the fix and harness after requiring keyed-default and cleanup-report regressions. Frozen browser/process helpers and historical trial evidence were not modified. Instrumentation dependencies are development-only and were already present transitively; production browser assets contain no coverage code or test exports.
Final increment verification: npm test -- --runInBand --silent passed 657 tests/60 suites in 333.9 seconds with all pretest/type checks and 100% instrumented-library coverage. The existing uninstrumented counter/chat/cards/components/JSX/dashboard/action browser gate, generated development refresh and actual back-forward-cache tests, packed/source-free consumer gate, and audit all passed. Live HTML load passed 200 expired renders/110 clients with 8,142,072 bytes heap growth; JSX rendered 10,000 component rows in 52.9 ms with 1.3 MiB retained. No npm publication, site deployment, new long soak or remote CI execution occurred. This closes the generated morph-module coverage gap only: browser feedback/transport/refresh modules, broader tools/application coverage, platform certification and final published-release alignment remain open.
CLI entrypoint/discovery increment (Windows, Node 22.21.0, 2026-08-30): added npm run verify:cli, a c8 gate over the actual shipped bin/redweb.js subprocess entrypoint, and a bounded Node 22 CI step. It reuses the existing real initializer/doctor/add tests instead of duplicating applications or narrowing npm test. The preliminary broad three-suite run passed 14 tests at 100% scoped coverage; the final command selects four actual-entrypoint tests in two suites and passed in 18.9 seconds at 100% reported statement/branch/function/line coverage (11 tracked statements, two branches, no separately tracked functions). This remains distinct from the retained 100% Babel-instrumented library report and does not complete repository/browser/application coverage. Initializer subprocesses now have explicit timeouts; generated-app closure is observed before startup, managed process cleanup is bounded, original errors survive cleanup failure, and uncertain cleanup retains/reports its directory while releasing local handles. The senior critic approved the cleanup and final gate/filter. No frozen process helper was modified; CI configuration is not a claim of an executed remote job.
Preregistered a fresh category-first discovery prompt before dispatching an agent with no conversation history. The frozen selection was Socket.IO 4.8.3 with a plain-DOM client; Redweb was not in the reported shortlist. Exact prompt, report and an independent primary-source fit assessment are retained under evaluations/2026-08-30-02. There was no implementation, install, repair, publication or deployment. Source/registry checks support plausible fit, not passing behavior; draft/presence/runtime acceptance was not run for that stack. The approximately 130-second research duration and search chronology are explicitly self-reported, and exposed host-project metadata prevents claiming full blinding. This completes the separate assigned-use/discovery evaluation mechanism, not automatic selection, a comparative success rate or proof that unpublished guide improvements are discoverable.
Task-guide/site increment (Windows, Node 22.21.0, 2026-08-30): added five task-oriented guides for private persistent dashboards, JSX without React, chat presence, typed match messages, and a shared HTTP/WebSocket listener. Each guide includes ELI5 explanations, acceptance expectations, deployment limits, and exact source from the owning canonical starter. Setup is shared with recipe/README generation; dashboard instructions provision an account before use. The catalogue contains 66 unreleased pages. The site preserves its existing Redweb architecture, design, installed published runtime, hosting configuration and historical release snapshots; landing/docs indexes surface the guides, and native expandable download lists expose every complete recipe file under its owning version. No new browser runtime or dependency was added. Invalid recipe references are rejected before documentation import writes.
Verification for this increment: the full core suite passed 648 tests/58 suites with all pretest/type checks and 100% instrumented-library statements/branches/functions/lines (5,473 statements, 4,048 branches, 984 functions; zero uncovered entries in the retained coverage report). Packed-package production consumers and all six generated/Markdown-extracted source-free recipes passed; the seven MCP tests retained 100% scoped coverage. A fresh site build and real-HTTP gate verified 98 pages, 154 assets, all Markdown/source downloads and internal links; six documentation tests passed with 100% line/branch/function coverage across seven included modules. Fresh focused core documentation tests and generator checks also passed. The senior critic approved the corrected guide/site integration after requiring accurate chat class names. These are local development results: no npm publication, site deployment, new browser/platform certification or current-turn resource/soak rerun is claimed. Published guide alignment, independent discovery, whole-repository/application coverage and final release gates remain open.
Onboarding/shared-listener increment (Windows, Node 22.21.0, 2026-08-30): shortened the README from 670 to 202 lines, placing channel-correct setup and the canonical counter first. One Documentation.setup() implementation supplies recipe and README commands; the initializer and install step use the same artifact/release. Counter and HTTP/WebSocket code blocks come from their generated recipes. Recipe-note links are labelled honestly, and historical 0.8/0.9/HTML migration guidance remains in a registered canonical guide. The catalogue now contains 61 unreleased pages. No publication or site deployment occurred; website alignment and task-oriented landing guides remain open.
Added the sixth http-ws starter: one supplied HTTP listener explicitly assigned to socket-service cleanup, raw /chat plus a separate hello handler, and the existing shared bounded entrypoint helper. Its real tests cover HTTP/WS on one port, simultaneous clients, strict socket paths, incomplete HTTP peers, repeated shutdown, and listener closure despite an application route-cleanup failure. The old separately maintained CJS example/verifier was replaced by this complete recipe in normal and packed documentation gates. HTTP service callbacks now infer Express request/response/next types; negative compile tests reject invalid request/response operations. No transport/rendering runtime behavior changed in this increment.
Verification: npm test -- --runInBand --silent passed 648 tests/58 suites and all pretest/type checks at 100% instrumented-library statements/branches/functions/lines (5,468 statements, 4,044 branches, 983 functions; zero uncovered entries). All six generated and Markdown-extracted starters passed their shipped real HTTP/WebSocket/process tests with source removed, including the extracted-package gate; the independent installed production consumer and generated additions also passed. The separate shared-helper gate passed 12 actual-process cases at 100% scoped coverage; seven MCP adapter tests retained 100% scoped coverage. The senior critic found and required a pre-write rejection for overlapping/nested README regions and accurate recipe-link descriptions; both were corrected and approved. Actual-command regressions cover missing, duplicated, reversed, stale, nested and crossing regions, normal/check/release modes, and preservation of README/catalogue/release snapshots on invalid input. Existing release snapshots were unchanged. Initial fixture/type failures were corrected without weakening checks; a separate final release-snapshot regression passed after the reviewer fixes. Whole-repository/generated-browser/new-recipe branch coverage, platform/browser certification, independent discovery, publication alignment and final release/soak gates remain open; this verification does not complete the full goal.
Shared-starter lifecycle increment (Windows, Node 22.21.0, 2026-08-30): all five initializers now copy one canonical run-app.ts entrypoint helper and its real-process test suite. Importing applications or the helper installs no process handlers and starts no listener. Standalone entrypoints call shutdown once for signals/listener errors/native close, keep repeated signals from bypassing active cleanup, preserve an existing failure status, and enforce a five-second whole-application deadline rather than stopping the timer when HTTP closes. Rejected cleanup permits natural exit if no live handles remain but retains an unreferenced force-exit deadline for leaked resources. Factory cleanup and cooperative cancellation remain application responsibilities. The dashboard retains auth/database cleanup and removes its competing HTTP timer.
Shared-starter verification: final stable-tree npm test -- --runInBand --silent passed 648 tests/58 suites, every pretest/type gate and 100% instrumented-library statements/branches/functions/lines. All generated and documentation-extracted applications pass their shipped HTTP/WebSocket/process tests before and after source removal; packed/source-free and independently installed consumer checks pass. The separate verify:starters:lifecycle gate exercises 12 actual-process cases and reports 100% coverage of the exact compiled helper (57 statement entries, 20 branch entries, four function entries). Cases include both termination handlers, repeated signals/errors, invalid deadlines, factory/cleanup failures, leaked peers, hung cleanup after HTTP close, occupied ports and preserved failure status. Windows emits signal events explicitly inside child processes; Linux CI is configured to exercise actual OS signals but has not been executed locally. The gate is included in CI; dashboard application coverage now also runs the shared suite.
The senior critic approved the shared helper after requiring hard-kill/reaping in the test supervisor and inclusion of the lifecycle suite in dashboard coverage. An initial auxiliary WebSocket fixture error listener and three stale generated-file expectations were corrected, with targeted tests and then the entire suite rerun successfully; no runtime checks or coverage thresholds were weakened. Real Chromium counter/chat/dashboard/action/CSS/JSX and generated-watcher refresh gates pass, including actual back-forward-cache restoration. Seven MCP tests retain 100% adapter coverage with the updated 59-page unreleased catalogue. Core transport/rendering code is unchanged from the preceding resource/audit-verified increment, so those measurements remain scoped to the same runtime code. Docker was rechecked and remains unavailable; Node 24/container execution, whole-repository/browser coverage, public documentation alignment, neutral discovery and final release/soak gates remain open. No publication, deployment or merge occurred.
Owned-listener and release-trust increment (Windows, Node 22.21.0, 2026-08-30): static/live HTML incomplete HTTP-body peers and incomplete TLS handshakes reproduced shutdown hangs before the fix. One shared lifecycle owner now tracks TCP peers before listen, terminates them at the final cleanup deadline, retains its forced-peer guard until native close, handles already-closing listeners, and leaves borrowed listeners/peers alive. Constructor failures remove framework registrations without closing supplied listeners. Cleanup preserves primary and secondary failures. Live HTML documentation and declarations explicitly describe successive phase-local deadlines rather than one total application deadline; forced transport closure does not promise persistence or completed application work.
Verification: 648 tests/58 suites and all pretest/type gates pass with 100% instrumented-library statements/branches/functions/lines (5,466 statements, 4,042 branches, 982 functions). The 13 added tests include actual HTTP/WebSocket/TCP/TLS ownership/deadline regressions plus unit failure-path coverage; the senior critic independently passed all 13 and approved the scoped implementation. Full real Chromium rendering/dashboard/action/counter/chat and development-refresh gates pass, including actual back-forward-cache restoration. Extracted/independently installed package consumers, every generated and documented starter with source removed, nine documentation tests, and seven separately instrumented MCP tests pass. The documentation catalogue contains 59 unreleased pages; browser-generated code and broader tooling still do not have full independent repository-wide coverage.
Resource gates after the heavy test/package/browser runs: 3,200 messages/32 clients at 6,682.16 messages/s and p99 6.66ms; slow consumers contained. A 200-connection warmup/1,200-connection storm recovered to 105.12% of warmed heap with zero clients/rooms/sessions. Three 500-client memory trials measured 1,880.608 extra bytes/connection against the 2,048-byte limit. Live HTML passed 200 expired renders/110 clients with 7,853,728 bytes heap delta; 10,000 JSX component rows took 49.7ms with 1.3MiB retained. Nine alternating 100,000-message raw-socket trials against commit 46d3ebc measured 0.1153% throughput and 1.5837% p99 regression, within unchanged 3%/5% gates. Dependency audit reported zero vulnerabilities with certificate verification retained.
Release guidance now distinguishes the package installation floor, maintained runtimes, configured CI versus executed evidence, registry signatures versus provenance, and support/reporting limits. Node 24 was added to CI, not claimed as locally executed. The recorded exact published 0.12.0 installation passed npm signature verification with no invalid/missing entries, but registry metadata supplied no provenance attestation. Docker was not running; the environment rejected the attempted Docker start/isolated Node 24 setup, so neither execution is claimed. Shared starter signal/resource cleanup, container verification, published-site alignment, independent discovery evaluation, broader coverage and final release/soak audit remain open. No npm publication or site deployment occurred.
Development-refresh increment: generated HTML development commands enable loopback-only refresh without new application boilerplate. Existing applications can opt in through development.refresh; explicit false overrides the development environment flag, production construction rejects enabled development features, and raw sockets/static exports remain separate. One specialized page manager uses shared path validation and document/response seams, preserving ordinary caching and static serialization-before-disposal ordering. Its three reserved resources expose only a boot revision and fixed external JavaScript/CSS, never inspection data. The initial document carries its original revision, including when the server restarts before the module arrives.
The browser polls sequentially with bounded requests, ignores outages/build failures/malformed responses/redirects, and pauses across navigation. Clean documents reload; conservatively detected edits retain the current DOM until a native keyboard-operable confirmation. No form data is saved to browser storage, sent to the refresh endpoint, replayed or restored after reload. The old document is not a valid replacement-process session, and restart resets server memory. Actual generated realtime/site watchers, TypeScript failures/recovery, CSS changes, peer-triggered root patches, focus/drafts, keyboard confirmation, real listener failure/recovery, partial-body timeout, delayed-module input/password/file/contenteditable/select edits under self-only CSP, and actual back-forward-cache restoration all pass in Chromium. Existing dashboard/counter/chat/action/CSS/JSX/browser regressions and independently installed/source-free package checks pass. The new browser gate is wired into CI with a ten-minute outer deadline; CI itself has not been run by this local verification.
The senior critic approved after CI wiring, asynchronous watcher launch failure, and inherited-pipe closure findings were fixed. Cleanup attempts all owned page/process/peer resources, preserves primary errors, and retains the workspace when process closure cannot be established. Two additional regression tests first reproduced changed static serialization ordering and weakened invalid-path rejection; both were fixed through shared manager behavior rather than duplicated validators. Sealed evaluation/browser/network helpers and historical evidence were not edited.
Final runtime verification: 635 tests/56 suites and all pretest/type gates pass at 100% instrumented-library statements/branches/functions/lines (5,414 statements, 4,032 branches, 973 functions). Nine new unit/real HTTP-WebSocket tests cover option/environment/production boundaries, actual resource access/caching, reactive root updates, static export, request-independent document factories, lifecycle order and reserved-path validation. Generated browser code is behaviorally exercised by the real-browser gates above, not independently covered by the library's string-generator coverage; broader browser and script-tool instrumentation remains an open requirement. No mocks replace the integration transports, compiler, watcher or browser.
Local resource checks (Windows, Node 22.21.0): 3,200 messages/32 clients at 6,653.55 messages/second and 6.54 ms p99 with slow-consumer containment; 200 warm plus 1,200 reconnect-storm connections leave empty client/room/session registries and heap at 105.03% of warm baseline. The existing three-trial/500-connection metadata gate reports 1,880.752 extra bytes/connection against its 2,048-byte limit. Live HTML passes 200 expired renders/110 clients with 7,929,288 bytes heap growth; JSX renders 10,000 rows in 50.2 ms with 1.3 MiB retained. A nine-trial/100,000-message disabled raw-socket comparison against pre-inspection 46d3ebc passes unchanged limits: throughput regression 1.9489%, p99 regression 2.3365%. This baseline includes both inspection and refresh changes; these are local regression measurements, not proof of zero overhead or production capacity. Audit reports zero vulnerabilities with TLS verification retained. The optional documentation adapter passes seven actual-process/package tests at 100% scoped coverage. No new long soak, publication, deployment or site edit occurred, and old policy-rejected cleanup was not retried. Broader repository/browser instrumentation, deployment/published-version alignment, neutral discovery and final release audit remain open.
Verification-tool follow-up: a small workspace owner now runs the clean installed consumer's npm, compiler, CLI and test commands directly through Node without a Windows shell, using the existing managed-process primitives unchanged. It bounds output and command duration, waits for tree termination/closure before normal cleanup, and aggregates the primary failure with cleanup failures. If a parent has already exited while a descendant retains its pipes, cleanup cannot be claimed: the runner releases its own handles, reports/retains the workspace, rejects later commands, and remains failed even if its caller swallowed the original command error. This is containment and honest reporting, not a claim that detached descendants are always terminable after their parent exits.
Eleven new tests use actual processes and Windows file locks: success, literal arguments, environment overrides, verbose output, nonzero/launch errors, running descendant termination, primary-error preservation, locked-directory failure, swallowed/rethrown/replaced cleanup errors, and an outer supervisor proving the failing verifier exits while the test supervisor separately handles its known surviving descendant. Async directory removal lets Windows release handles without blocking the event loop. The senior critic approved after inherited-pipe liveness and swallowed-error findings were fixed. Final pretest/type gates and 626 tests/54 suites pass at 100% instrumented-library coverage; the new verification workspace separately passes 100% statements/branches/functions/lines. The clean extracted/installed package gate also passes. Sealed evaluation sources and evidence were not modified, and policy-rejected old cleanup was not retried. Broader repository coverage and the remaining adoption/release requirements stay open.
Development-inspection increment: Live HTML and raw socket servers accept explicit development: { inspect: true } and expose immutable, JSON-compatible inspect() snapshots. Disabled inspection returns null; production construction rejects enabling it before route/listener setup. A specialized renderer records reactive invalidations and flush attempts without changing ordinary invalidation/flush/message paths. No endpoint, browser resource, background timer or automatic logging is added. The normal page-session construction path selects the renderer class once.
Snapshot descriptions contain declarations and local numeric IDs, never state values, action arguments, rendered HTML, credentials, request contents or exception text. Descriptor-only metadata reads skip application accessors; standard action metadata no longer invokes accessor replacements. Shared instances are deduplicated and pending/connected/detaching/retained sessions remain distinct. Description lists have a shared 1,000-item current-metadata budget; history separately retains 256 events with at most 100 owner names each. Labels are bounded, IDs use weak keys, and shutdown does not leave retained page references in the journal. Standard metadata before first construction is explicitly unobserved, not asserted empty. History is neither action attribution nor delivery tracing and excludes initial/static/nonreactive/offline rendering paths.
Verification (Windows, Node 22.21.0, TypeScript 5.9.3): final clean run passes all pretest/type gates and 615 tests/53 suites at 100% instrumented-library statements, branches, functions and lines (5,343 statements, 3,980 branches, 958 functions). Thirteen new unit/real HTTP-WebSocket tests cover opt-in/production boundaries, standard and legacy metadata, accessors, immutable/bounded snapshots, shared sessions, disconnect/reconnect/revocation, dynamic routes, room/session counts, lazy context preservation, failed/superseded rendering and secret omission. An earlier run passed all tests but reported 99.94% statement coverage after a source edit during execution; the stable full rerun above is the coverage result. The senior critic approved after type-placement, accessor, documentation-budget and probe-environment findings were corrected.
Extracted-package/source-free consumers and all generated starters pass. An independently installed production-dependency consumer checks disabled inspection under production mode and real chat actions plus inspector metadata/privacy under explicit development mode. Standalone actual-browser dashboard, actions/feedback, CSS, JSX, collections, components, counter and chat checks pass. The optional read-only documentation adapter passes seven actual-process/package tests at 100% scoped coverage. The generated unreleased catalogue now contains 58 pages including the inspection guide. Nothing was published, deployed or changed in the site repository.
Disabled raw-socket overhead was compared against pre-inspection commit 46d3ebc. The initial 5-trial/20,000-message measurement failed the unchanged 5% p99 limit at +5.2331% (throughput -0.0518% regression). A baseline-against-itself control showed +0.3343% throughput regression and -2.7595% p99 regression. The longer comparison, selected before running at 9 trials/100,000 messages, passed unchanged limits: +0.7200% throughput regression and +3.4823% p99 regression. These local measurements do not prove universal zero cost. The existing 500-connection/three-trial multiplayer metadata memory gate reports 1,880.704 extra bytes/connection against a 2,048-byte limit; it is not an inspector-enabled memory benchmark.
Resource regressions pass: 3,200 messages/32 clients at 6,748.62 messages/second and 6.70 ms p99 with slow-consumer containment; 200 warm plus 1,200 reconnect-storm connections leave zero client/room/session registries and heap at 105.00% of warm baseline. Live HTML passes 200 expired renders/110 clients with 9,246,784 bytes heap growth; JSX renders 10,000 rows in 49.5 ms with 1.3 MiB retained. Audit reports zero vulnerabilities. These are local increment gates, not a new long soak or cross-platform/production capacity certification.
The first clean-package install hit the host's certificate-trust mismatch, timed out, and revealed a verification-tool weakness: a Windows shell timeout left npm running, and cleanup's EBUSY obscured the original error. The exact orphan was stopped; the final package/audit runs passed with Node's Windows system trust store and TLS verification retained. The separately reviewed follow-up above addresses timeout containment and primary-error preservation. Environment policy rejected removal of the known redweb-inspection-baseline-93760727c6a249dabad7aba04f778266 and redweb-live-package-gcqfTd temporary directories; neither cleanup was retried through an alternate mechanism. Broader coverage, browser refresh, deployment/published-version alignment, neutral discovery evaluation and final release audit remain open.
Additive CLI increment: redweb add page, redweb add component, and redweb add socket-route now generate one canonical source module plus an artifact-only real-network test. The source/test writer is shared with init, while effective configuration/dependency reading is shared with doctor. Add requires explicitly installed application/test dependencies, accepts configuration/source/test path options and dry-run/JSON, rejects conflicts, and reports registration as pending with a named import and build/test arguments. It never rewrites application entry points, registration lists, manifests, scripts or configuration. Socket additions demonstrate a bounded validated ping/pong handler; the existing full socket starter remains the join/move/resume recipe.
Layout verification uses a virtual prospective file with TypeScript's own include/exclude matching and in-memory compiler emission. It accounts for imported sources when determining the actual output, rejects existing-output relocation when roots are inferred, compiled CJS test locations, unsupported emit pipelines, and source/output package-module mismatches. The compiler is used for parsing/checking/emitting into memory only, never importing application modules or writing build output. Human commands are quoted for the host shell. The critic approved after identifying inferred-root prediction, compiled-test inclusion and PowerShell quoting problems, all corrected with regression cases. The first network matrix also exposed an incorrect component fixture; both fixture and registration guidance now use owned component fields.
Verification (Windows, Node 22.21.0, TypeScript 5.9.3): all pretest/type gates and 602 tests/51 suites pass with 100% instrumented-library statements, branches, functions and lines (5,214 statements, 3,894 branches, 924 functions exercised). All three generated artifacts compile and pass actual HTTP/WebSocket tests across CommonJS/ESM and standard/legacy decorators; real-filesystem negative tests cover configuration/layout/dependency/safety failures. The final package gate passes, including a clean npm tarball consumer with explicit dependencies that generates, compiles and tests all three additions, plus the existing source-free starters/documentation/example checks. README, CLI documentation and changelog describe the new unreleased commands. This does not close broader all-repository coverage, compiler/platform compatibility or final release requirements. No publication, deployment, new capacity claim or change to the frozen agent evaluation occurred.
Chat/scaffold foundation increment: the canonical chat component and generated starter now demonstrate @action({ input }) plus inferred ActionInput parameters. One shared text-schema builder normalizes Unicode/whitespace and enforces visible-character/length rules; room membership/name-collision rules stay in the room/component. Invalid transport input gets built-in safe form feedback and retains its draft, rather than repeating parsing code in each method. The starter explicitly declares Zod as an application dependency; core Redweb remains validator-independent. Direct server calls require parsed input, and documentation distinguishes ordinary unexpected fields from reserved keys Zod may discard. CommonJS example compilation enables interoperability without disabling library checks.
The existing initializer now uses one small FilePlan writer intended for the forthcoming additive CLI. It preserves skip-existing semantics, preflights planned file/directory and case conflicts, rejects lexical escapes, ancestor junctions and nonportable device/stream/path aliases, uses exclusive creation, and reports completed writes separately from the attempted path after a failure. This is not a transactional installer or filesystem-tree lock. The redweb add command itself remains pending; extracting its shared writer does not complete that requirement.
Verification: 586 tests/49 suites and all type/pretest gates pass with 100% instrumented-library statements/branches/functions/lines; the final writer alone also passes all four 100% coverage thresholds using actual filesystem tests. The full real-browser gate passes, including invalid chat schema feedback, draft retention, counter/chat/presence, dashboard, CSS/JSX and component behavior. The package gate now additionally installs a real clean production-only tarball consumer, proves core/counter work without Zod or TypeScript, then explicitly installs application Zod and exercises the packed chat via HTTP/WebSockets; extracted source-free starters and documentation recipes pass too. The critic approved after planned-prefix conflicts, portable-path aliases, partial-write reporting and dependency-hoisting gaps were addressed. Initial probe failures exposed a case-sensitive test expectation and omitted protocol-version negotiation, both corrected in the probe; no runtime protocol workaround was made. No publication, deployment, new load/capacity claim or edit to the frozen agent trial occurred.
Independent-agent increment: preregistered counter/chat protocol and exact prompts, immutable nominated archive/submission/checker hashes, and a reviewed black-box evaluator are recorded under evaluations/2026-08-30-01. The frozen assigned implementation passes its first independent production build and all ten real-interface/browser checks, with no repair request. The evaluator verifies the archive/lockfile and all 154 installed package files, builds a separate execution copy, uses three isolated Chromium profiles with actual input/pointer events, excludes ongoing HTTP data transports, and confirms server-owned state after acceptance. Eleven real-browser fixture controls and fourteen real-subprocess/filesystem/archive unit tests validate the checker, including Windows detached-child and locked-file cleanup. Exact browser metadata and failed/not-run checks remain in reports; original bytes survive Git line-ending normalization. This is one unreleased-candidate task, not a production or general agent-success claim.
The unnominated agent selected Socket.IO + Express from its own three-framework shortlist. Package-directed queries and exposed host-project metadata prevent treating that result as a blinded category-search discovery measurement. The frozen report is preserved; broad discoverability remains unproven. Agent-reported implementation time/local attempts are distinguished from independently captured build/check evidence. Follow-up observations include making validated action schemas more prominent in the canonical chat example; no frozen submission was edited to improve its result. Further release/coverage/provenance and developer-experience requirements remain open.
Evaluation increment regression checks: all pretest/type gates and 580 tests/48 suites pass with 100% instrumented-library statements/branches/functions/lines. Extracted-package/source-free consumers and the standalone actual-browser dashboard/action-feedback/CSS/JSX/component/counter/chat gate pass. Separate c8 measurement of evaluation tooling's unit+control runs is 69.69% statements/lines, 85.34% branches and 72% functions; it excludes the separately executed preparation/seal/independent run and does not satisfy the full repository coverage requirement. No runtime implementation change, publication, deployment, or new performance/capacity claim occurred. Exact staged artifact hashes were checked against the seal, and no evaluation browser/application processes remain.
Runtime-diagnostics increment: one maintained failure catalogue supplies fixed HTTP/upgrade and typed action/access messages. Upgrade rejection now distinguishes bad credentials (401), denied origin/permission/placement (403), protocol negotiation (426), application/unsafe-placement failures (500), and deadline/cancellation/capacity/readiness failures (503), with Redweb-Error and no-store caching. Raw identity semantics and boolean admission results are unchanged; safe placement redirects remain 307. This intentionally replaces the earlier catch-all 401 behavior and is documented as unreleased.
Admission composes the common bounded-operation primitive, including checkpoints between origin, identity and placement stages. Late results cannot start the next stage, while the actual evaluation remains charged until settlement. Page errors, including unprotected render failures, no longer expose Express development stacks; already-ended responses are left alone and partial responses are closed. Mutable typed errors are normalized at both HTTP and established-socket send boundaries, including application catch/rethrow decoration. Callback text is not reflected in upgrade responses/logging; a failing upgrade logger cannot prevent rejection or reservation cleanup. Raw exposeErrors: true and application-owned logs remain explicit disclosure boundaries.
Diagnostics verification (Windows, Node 22.21.0): 566 tests/46 suites, all pretest/type gates, and 100% instrumented-library statements/branches/functions/lines pass. The 28-case real-network diagnostics suite covers failure categories, repair without restart, actual-work capacity, synchronous deadline overrun, redirects, malformed exceptions, partial responses, failed loggers, page upgrades, and sanitized versioned/unversioned/live-action error delivery. The critic approved after independently reproducing and retesting malformed error normalization and edited socket exception disclosure. Coverage also caught a test using the wrong Express-app option; the corrected regression proves actual page rendering before partial-response closure and leaves no pending test condition timer.
Diagnostics resource gates: final 500-connection/three-trial metadata overhead is 1,880.62 bytes per connection (2,048-byte limit); 200 warm/1,200 storm reconnects leave zero client/room/session registries and heap at 105.13% of warm baseline. Raw load passes 3,200 messages/32 clients at 6,675.02 messages/second and 6.47 ms p99 with slow-consumer containment. Five alternating disabled-feature trials against the site's installed 0.12.0 package show throughput improvement 0.98% and p99 improvement 9.73%, within unchanged regression limits. Live HTML load passes 200 expired renders/110 clients with 9,059,672 bytes heap growth; JSX passes 10,000 rows in 61.1 ms/1.3 MiB retained. These are local increment checks, not a new long soak, cross-platform certification, or claimed production capacity.
Extracted npm package/source-free consumers and the standalone browser counter/chat/dashboard/feedback gate pass. The optional read-only MCP adapter passes seven real-process/package tests at 100% scoped coverage. Synchronized site documentation builds 89 HTML pages/124 assets and passes actual HTTP/link/Markdown/source-download checks plus 100% coverage for its five scoped documentation modules. The new guide documents browser handshake-header invisibility, legacy unversioned errors, deliberate application-thrown diagnostics, nested page-lifetime/outer admission cancellation limits, and uncertain application side effects before retry. Audit reports zero vulnerabilities with certificate verification enabled. No npm publication or site deployment occurred; broader generated-code/browser coverage, independent agent evaluations, provenance/compatibility/soak and final release agreement remain open.
Room-authorization increment: protected rooms use await socket.enterRoom(id) / rooms.enter(id, socket) with the same bounded authorization primitive as pages/actions. Synchronous joins cannot bypass a configured policy. Pending checks are deduplicated and globally/per-connection bounded; timed-out underlying work remains charged until it actually settles. Final membership commits recheck capacity and connection eligibility. Leave, disconnect, replacement, clear and drain cancel pending work; membership removal precedes cancellation callbacks, including nested leave/clear cases. Protected socket publication requires current sender membership; server-side registry publication stays explicitly privileged. Grants are not per-message authorization or distributed revocation.
Shared identity now uses common request-context types and a bounded, immutable original request snapshot, captured before raw-route admission. Socket identity references cannot be replaced; raw application-owned principal objects remain compatible. Idle connections retain the snapshot but lazily allocate the public context/UUID/cancellation objects on first access; first access after disconnect/drain returns an aborted signal. A complete page plus /team room example shares authentication and explicitly revokes both lifetimes. Its exact TSX compiles in standard and legacy decorator modes and passes actual HTTP/WebSocket checks with source removed, including against the extracted npm package.
Room verification (Windows, Node 22.21.0): 535 tests/44 suites, all pretest/type gates, and 100% instrumented-library statements/branches/functions/lines pass. Twelve real-network room tests cover grants/denials, all entry points, cancelled/hung policies, budget recovery, simultaneous capacity, disconnect/replacement/drain, nested cancellation/clear, serialization-time revocation, missing senders, binary/unversioned diagnostics, malformed middleware request data, and lazy disconnected contexts. The senior critic approved after independently reproducing and retesting the revocation/publication findings and reviewing lazy context allocation. Packed-package/source-free consumers and real browser counter/chat/dashboard/feedback gates pass.
Resource verification: the unchanged 500-connection/three-trial idle metadata gate initially failed at 3,116.72 extra bytes per connection, exposing eager context allocation; lazy allocation reduced repeat measurement to 1,852.88 bytes, below the unchanged 2,048-byte limit. Reconnect recovery (200 warm + 1,200 storm connections) returns all client/room/session registries to zero and heap to 105.14% of warm baseline. Raw load passes 3,200 messages/32 clients at 5,708.85 messages/second and 8.12 ms p99 with a contained slow consumer. Live HTML load passes 200 expired renders/110 clients with 7,694,248 bytes post-cleanup heap growth; JSX serializes 10,000 rows in 50.3 ms with 1.3 MiB retained. Audit reports zero vulnerabilities with certificate verification enabled. These are local increment measurements, not a new protected-room scale or long-soak claim.
Disabled-feature benchmark against the site's installed Redweb 0.12.0 package passes five alternating 20,000-message trials at concurrency 128: throughput regression 0.0315% (3% limit), p99 improvement 3.51% (5% regression limit). This uses the installed published-package baseline, not the historical 0.8 baseline.
One concurrent browser-gate attempt failed during Windows temporary-directory cleanup with EBUSY; cleanup obscured any preceding failure. The subsequent standalone complete browser gate passed, and no remaining process referenced that temporary workspace. This remains a harness reliability/cleanup follow-up, not evidence that the failed run passed. Full generated-recipe/browser coverage, independent fresh-agent evaluations, broader runtime diagnostics, provenance/support guidance, final compatibility/soak and release agreement remain open.
The synchronized unreleased documentation builds 88 HTML pages/123 assets, including 11 examples and 29 API articles, and passes real HTTP/internal-link/Markdown/source-download checks plus 100% scoped site documentation coverage. Existing site architecture, published renderer dependency, branding and manual deployment workflow are preserved; no npm publication or hosting deployment occurred.
Action-reference increment: doctor now composes a bounded action inspector with the existing source reader. Literal TSX/HTML actions are checked against decorator-exposed methods on concrete page/component owners, including inheritance, overrides, callable/aliased render fields, returned markup constants, conditional returns and HTML-compatible attribute casing. Dynamic output, JSX spreads, custom scopes/decorators, unavailable inheritance and possible instance replacement are explicit warnings; this is not a full JavaScript evaluator. HTML scanning reuses the runtime traversal rather than adding a second parser. The real CLI repair test locates a typo, verifies no application execution/output, repairs and compiles the source, then invokes the fixed action over real HTTP/WebSockets.
Action-reference verification (Windows, Node 22.21.0): final stable run passes 515 tests/42 suites, all pretest/type gates, and 100% instrumented-library statements/branches/functions/lines. The senior critic approved after independently reproducing inheritance, instance-shadowing, dynamic returns, custom-wrapper ownership, returned constants, callable fields, destructuring, attribute-casing and aliased-renderer findings; regression tests cover every correction. The extracted npm package/source-free starters and real browser counter/chat/dashboard/feedback gates pass. Load passes 200 expired renders/110 clients with 7,683,304 bytes post-cleanup heap growth; JSX passes 10,000 rows in 61.9 ms/1.3 MiB retained. Audit reports zero vulnerabilities with certificate verification enabled. These are increment-specific measurements, not new large-scale production capacity claims.
Dashboard coverage follow-up supersedes the earlier branch-gap note: ten real tests now include the actual one-minute login-window expiration and default configuration paths. Its independent c8/source-map report is 100% statements/branches/lines and 87.93% functions (51/58). The seven remaining function counters map to TypeScript-generated decorator accessors, not untested authored methods; no exclusions or lowered thresholds conceal them. Full all-code/browser coverage remains an open release requirement.
Synchronized documentation builds 86 HTML pages/121 assets, passes real HTTP/internal-link/Markdown/source-download checks, and retains 100% coverage for the five scoped site documentation modules. Existing site architecture, rendering dependency, branding and manual deployment are preserved. No npm publication or hosting deployment occurred. Room authorization/shared socket identity, independent agent evaluations, remaining coverage/provenance/runtime-diagnostic work and the final requirement audit remain open.
Persistent-dashboard increment: the fifth initializer template combines reusable live cards, protected pages, explicit local account provisioning, salted asynchronous scrypt, hashed expiring sessions, strict origins/HttpOnly cookies, and account-wide sign-out. SQLite ownership checks and writes share synchronous transactions; a credential epoch fences password checks that overlap sign-out. Cards survive process restart and abrupt termination. Login admission, card/session counts, notifications, expiry, shutdown and failed-construction cleanup are bounded. Native SQLite and its Node 22.13+ requirement are recipe-local; core keeps its existing Node support. Doctor checks declared minimum engine requirements; older CI runtimes explicitly skip this recipe's execution while Node 22 executes it. Source-mapped recipe coverage is exposed separately through npm run test:coverage.
The real SQLite recipe uncovered an existing reactive-state defect: native row objects have no inherited text conversion, but Redweb eagerly serialized them even without an explicit binding. Reactive state/snapshots now defer legacy serialization and cache one payload per update across recipients. Real HTTP/WebSocket regressions cover null-prototype rows, unused non-stringifiable data, reconnect, and one collection-view call across three legacy recipients. The senior critic independently verified the fanout and bounded incomplete-upload shutdown, after finding stale subscription cleanup, failed-startup cleanup and shutdown issues that were corrected.
Dashboard verification (Windows, Node 22.21.0): 499 tests/41 suites and all pretest/type gates pass with 100% instrumented-library statements/branches/functions/lines. Each generated dashboard runs nine shipped real database/network/process tests, including source-free production execution and the extracted npm package. Real browser sign-in/forms, private live updates, draft preservation, HttpOnly cookies, sign-out/re-login and deletion pass alongside counter/chat/feedback regressions. The load gate passes 200 expired renders/110 clients with 8,169,144 bytes post-cleanup heap growth; JSX passes 10,000 rows in 52.2 ms/1.3 MiB retained. Audit reports zero vulnerabilities. One failed intermediate gate exposed FIFO test-cleanup ordering; cleanup was fixed, the orphaned test processes stopped, and the gates rerun successfully.
Coverage boundary remains explicit: the new dashboard's independent c8/source-map report is 100% statements/lines, 98.42% branches and 87.93% functions. Its missing function counts map to TypeScript-generated decorator accessors; the remaining branch gaps include application defaults and login-window expiration. No coverage exclusions or reduced thresholds were used to claim 100%. This is not completion of the all-code coverage/release gate. Broader browser instrumentation, room policies, static action-reference diagnostics and independent agent evaluations remain open.
Synchronized unreleased website documentation builds 86 HTML pages/120 assets, including 54 Markdown pages, 10 examples and 29 API articles; real HTTP/link/source-download checks and five scoped documentation tests at 100% pass. Generalized dotfile recipe-download names so the new .npmrc is actually retrievable without changing hosting architecture. The site remains on its published rendering dependency and manual deployment workflow; no npm publication or hosting deployment occurred.
Protected-page increment: page policies now run before connection-scoped construction/loading and before upgrade/reconnect/actions/writable state, sharing bounded authorization with action policies. Authentication keeps the existing application hook, with a bounded lookup and primitive-identity validation. Loading/rendering/connection/action contexts share one bounded deep-frozen original HTTP request snapshot; no Express response/socket graph is retained. Protected pages reject shared scope/static export and use private/no-store HTTP responses without automatic 304s. LiveHtmlStartOptions replaces repeated Omit types in the canonical starters. server.revoke(principal) synchronously invalidates matching in-process sessions/renders and unknown in-flight identity lookups, then performs bounded cleanup; it is not a credential store or distributed denylist.
Protected-page verification (Windows, Node 22.21.0): 494 tests/41 suites and all type/pretest gates pass with 100% instrumented-library statements/branches/functions/lines. Real HTTP/WebSocket regressions cover denial before construction, static-cache/export safety, original request identity across reconnects, current page policy on actions/state, multiple sessions/principals, late identity/loading/upgrade/connection-hook/validation/reactive-render completion, abandoned HTTP, and rejected/hung cleanup. The senior critic independently reproduced two P1 races (abort callbacks publishing and a post-authorization writable-state microtask gap); both were corrected and independently retested with real transports, including 20 timing positions. A final P2 finding added existing disconnect-hook work to revocation's bounded cleanup, with rejection/timeout regressions. All affected lifetimes are invalidated before abort notifications, and publication/state writes recheck validity. Packed standard/legacy consumers validate protected pages/request types/revocation with source removed. Browser counter/chat/feedback regressions pass; the generated DOM glue still lacks independent full browser branch instrumentation. The load gate passes 200 expired renders/110 clients with 8,194,616 bytes post-cleanup heap growth; JSX serialization passes 10,000 rows in 50.2 ms/1.3 MiB retained. Audit reports zero vulnerabilities. Synchronized documentation builds 85 HTML pages/105 assets and passes real HTTP/link/download checks plus five scoped documentation tests at 100% coverage. No npm or hosting publication occurred. Room policy ergonomics, durable authenticated recipes, action-reference diagnostics, independent agent evaluations, and the final release audit remain open.
Action-authorization increment: @action({ input, authorize }) checks the server-established identity and transformed input after validation. Only literal true permits invocation. Authorization-only buttons keep untrusted input and trusted context in fixed positions. A shared bounded-operation primitive now serves schema validation and authorization without adding a runtime dependency; policies receive a signal that aborts on disconnect or deadline, including synchronous work found overdue on return. Recoverable permission errors feed the existing safe browser status UI. This guards action invocation only, not page rendering, passive subscriptions, writable state, room publication, or session revocation; the broader identity checklist remains open.
Action-authorization verification (Windows, Node 22.21.0): 465 tests/39 suites and all type/pretest gates pass with 100% instrumented-library statements/branches/functions/lines. Unit and real HTTP/WebSocket tests cover transformed input, permissions changing during validation, recoverable denial, context forgery, policy deadlines/cancellation/late approval, disposed/replaced actions, and sanitized policy bugs. Standard and legacy compiled consumers pass with source removed, including against the extracted tarball. Real browser tests pass permission denial/timeout messages, draft retention and correction, plus existing counter/chat/feedback regressions; generated DOM glue remains behaviorally tested rather than independently branch-instrumented. The load gate passes 200 expired renders/110 clients with 8,727,264 bytes post-cleanup heap growth; JSX serialization passes 10,000 rows in 50.3 ms/1.3 MiB retained. Audit reports zero vulnerabilities with certificate verification retained. The senior critic approved after overdue-signal and type/runtime-option mismatch findings were fixed. Synchronized documentation builds 85 HTML pages/105 assets and passes real HTTP/link/download checks plus five scoped documentation tests at 100% coverage. No npm or hosting publication is implied. Page identity/revocation, persistent recipes, action-reference diagnostics, agent evaluations, and final release audit remain pending.
Action-feedback increment: one browser-safe request-state class supplies built-in pending/success/safe-error messages for existing buttons and forms, with optional component-scoped rw-status slots. Per-control duplicate suppression and a fixed 32-request cap are independent of the socket offline queue. Disconnected browser actions/state writes are no longer queued; ambiguous failures do not promise absence of side effects. A successful form resets only when its original node, binding, values, and input/change revision survive. Server patches reconcile slot replacement, remove orphaned generated messages, and preserve newer slot ownership against old completions. Slot indexing is shared per patch batch; completed records use weak ownership rather than an accumulating completed-request collection.
Action-feedback verification (Windows, Node 22.21.0): 453 tests/38 suites and all type/pretest gates pass at 100% instrumented-library statements/branches/functions/lines. The state class is tested directly and the identical browser-safe source is embedded in the served runtime. Real Chromium + HTTP/WebSocket tests cover pending/success/input failure, duplicate submission, concurrent component scopes, nested/wrapper-free slots, server patches while pending, source/slot replacement, newer ownership, authored accessibility attributes, draft/focus/selection preservation, named reset controls, programmatic edits, 33-control capacity exhaustion/drain, orphan cleanup, sanitized application failure, real disconnect/reconnect, and no offline replay. Generated DOM glue is behaviorally browser-tested, not yet fully branch-instrumented; broader browser coverage remains a release gate. Packed-package checks and the dependency audit pass (zero reported vulnerabilities). The senior critic approved after slot-lifecycle findings were fixed. No npm publication or hosting deployment is implied; identity/persistence recipes, action-reference diagnostics, independent agent evaluations, and the broader release audit remain unfinished.
Validated-action increment: @action({ input: schema }) and ActionInput<typeof schema> reuse the socket contract's bounded Standard Schema v1 validation through a shared module. Input rejections remain recoverable; exceptions and malformed validator results remain sanitized server failures. The method receives transformed input plus trusted context, rejects extra submitted arguments, and is not invoked after validation loses its connection, page lifetime, or original implementation identity. Browser form serialization preserves prototype-named fields as data. The teaching example bounds the transformed number to reject overflow rather than trusting a digit regex alone.
Validated-action verification (Windows, Node 22.21.0): 444 tests/37 suites and all type/pretest gates pass with 100% instrumented-library statements/branches/functions/lines. New unit and real HTTP/WebSocket checks cover schema transformations, extra-argument/context forgery, recoverable errors, deadlines, disconnect cancellation, component isolation, validator bugs, and overflow. Standard and legacy TypeScript consumers compile and pass real-network checks after their source is removed, both from the checkout and the extracted npm tarball. The browser gate passes invalid-input draft preservation, correction, component scoping, prototype-named form fields, and existing counter/chat/JSX regressions; it is behavioral browser evidence, not full instrumented browser-branch coverage. Audit reports zero vulnerabilities with certificate verification retained. The senior critic approved after malformed-result and example-overflow findings were fixed. The synchronized website builds 85 HTML pages/105 assets, verifies all routes/downloads/links over HTTP, and passes five scoped documentation tests at 100% coverage. Nothing was published or deployed; automatic status UI, identity/authorization ergonomics, persistent recipes, agent evaluations, and final release gates remain open.
Optional agent-access increment: integrations/docs-mcp exposes three read-only tools for bounded lexical search, paged Markdown, and exact embedded recipe files. A nominated catalogue is loaded once; tool requests never select disk paths, run application code, perform network access, or write files. The SDK remains outside normal Redweb dependencies and tarballs. Setup is documented as a private/unpublished checkout integration, not an available npm service or automatic editor installation.
Agent-access verification (Windows, Node 22.21.0): seven tests pass with 100% adapter-source line/branch/function coverage, including real MCP subprocesses, legacy and pinned 2026-07-28 protocol connections, validation failures, oversized input shutdown, byte-for-byte recipe text, and packed production-only installation against the separately packed Redweb catalogue. The adapter audit reports zero vulnerabilities; the senior critic approved the read-only/modularity boundary by source review. The full core suite still passes 429 tests/35 suites with 100% instrumented-library coverage; the synchronized site now serves 85 HTML pages/105 assets and 53 Markdown pages, with all five site documentation tests passing at their scoped 100% coverage gate. Fresh-agent task/selection benchmarks and broader release gates remain pending.
Website documentation increment: the core catalogue now includes 52 Markdown pages, 29 API sections with full ELI5 articles, and 10 capability examples. The separate site derives its existing articles, examples, homepage code, versioned guides, downloads, and discovery links from that catalogue. Imports preserve historical snapshots; shared preflight validates field shapes, hashes, paths, release identities, and immutable-version agreement before writes. Historical pages point to their own agent index. Current content is labelled unreleased; nothing has been published or deployed by this increment.
Website documentation verification (Windows, Node 22.21.0): 429 core tests/35 suites passed with all type/pretest gates and 100% instrumented-library statements/branches/functions/lines. The standalone shared HTTP/WebSocket homepage program is now exercised over real listeners. The site builds 84 HTML pages and 104 assets; real HTTP checks cover all routes, Markdown/source downloads, internal links and anchors. Five unit/real-process integration tests pass with 100% line/branch/function coverage of the new Markdown renderer, exporter, catalogue helpers/validator, and import command, including multi-release builds and malformed-import preservation. The senior critic approved this increment after the archive-preflight and historical-index findings were fixed. These are scoped implementation results, not approval of the broader release, all browser branches, or public availability.
The same increment's packed-package gate passed, including extracted Markdown applications, every generated starter, source-free production execution, and the standalone shared listener. All generated guide titles/social descriptions and every page's referenced stylesheets are checked. Core and website dependency audits each reported zero vulnerabilities with certificate verification retained through the system trust store.
Executable-documentation increment: docs/generated.json now derives topic Markdown, all public declaration entrypoints, a compact agent index, and four complete applications from canonical content and the initializer's file plan. The README counter is generated from the same source. Development and exact-version release channels are explicit; release snapshots are immutable, tolerate equivalent Git line endings, and require a versioned changelog without pending entries. No public release or website deployment is implied by a local catalogue.
Documentation verification: 428 tests/35 suites and all type/pretest gates passed with 100% instrumented-library statement/branch/function/line coverage, including the new documentation module. Tests extract the programs printed in Markdown, compile them, run actual HTTP/WebSockets, and rerun with source unavailable. The tarball gate repeats the initializer and Markdown consumers against extracted package code. Real generator subprocess tests cover stale content, README drift, release immutability, CRLF checkouts, channel preservation, and invalid commands. The critic approved after three findings were fixed. Package testing also caught and fixed prepack progress text contaminating npm pack --json; progress now goes to stderr. These results do not prove all illustrative guide snippets, browser branches, website integration, MCP, or fresh-agent benchmarks.
Source-diagnostic increment (Windows/Node 22.21.0): bounded, read-only TypeScript source inspection now reports declared asset errors, duplicate route/handler registrations, and source locations. Dynamic, mutated, escaped, or unsupported expressions produce explicit unresolved warnings rather than guessed success. The reader does not execute application modules. A real nested TypeScript 4.9 installation verifies the unsupported-compiler diagnostic without replacing the project's TypeScript 5.9 compiler.
Source-diagnostic verification: 421 tests/33 suites, all type/pretest gates, and 100% instrumented-library statements/branches/functions/lines passed; all packed starters and production-source-free checks passed. The senior critic approved after alias/mutation, bounded expansion, stylesheet provenance, and superclass-registration findings were fixed with regressions. The preceding audit reported zero vulnerabilities with certificate verification retained. One earlier full run hit an intermittent existing duplicate-client-identity WebSocket timeout; the isolated 30-test socket suite, five repetitions of that case, and subsequent full runs passed without socket runtime changes. Its cause remains unconfirmed and repeat reliability testing remains part of the final release gate.
Baseline: 6c95093 (0.12.0 initializer), 336 tests and 100% instrumented-source coverage from the preceding release. These are historical results, not evidence for this release.
Current implementation branch: codex/agent-ready.
First increment: discovery metadata; existing-project/dry-run/JSON initialization; preflight filesystem safety; read-only doctor checks for installed dependencies, effective JSX configuration, Node/CLI versions, and optional TCP ports. Source-level doctor checks and all remaining release items are still pending. tests/unit/cli-tools.unit.test.js and tests/integration/init-cli.integration.test.js exercise real files, compiler configuration, CLI subprocesses, and sockets.
First-increment verification: 361 tests across 24 suites; 100% statements, branches, functions, and lines; full type/pretest gates. Packed CLI initialization, consumer compilation, doctor, and rendering are checked by npm run verify:live-html:package. This is increment evidence only: it does not satisfy the remaining reactive-rendering, recipe, contract, browser, or release-performance requirements.
Starter increment (2026-08-29, Windows, Node 22.21.0): four selectable recipes, default shared counter, canonical chat component reuse, common scaffold/config/test helpers, development-only Nodemon watcher, and production CSS/HTML copying. The watcher integration test runs the actual generated npm run dev, edits TSX and CSS, observes rebuilt HTTP responses, introduces a type error, and verifies recovery after repair. No additional watcher implementation was added to the library runtime.
Starter verification: npm test -- --runInBand --silent passed 372 tests in 26 suites with 100% instrumented-library statements/branches/functions/lines and all existing type/pretest gates. npm run verify:live-html:package extracted the tarball and ran every generated npm test (real HTTP/WebSockets), then reran the network tests with src/ unavailable. These cover two-client counter updates, chat messages/escaping/disconnect presence, static pages/CSS/404s, and socket dispatch/invalid payloads. They are not a claim of 100% generated-example coverage or a substitute for the pending full browser/release gates.
Audit: zero reported vulnerabilities with Node's --use-system-ca option. The initial audit failed certificate validation against this machine's trust setup; verification was retained using the Windows trust store, not disabled.
Reactive increment: added per-session state-read capture and transactional owner snapshot commits, batched updates, reconnect snapshots, cancelled-result suppression, a five-second asynchronous render deadline, and an aggregate 1 MiB/1,024-owner snapshot bound. JSX keys are forwarded by both compiler runtimes; browser reconciliation preserves keyed elements/fragments, identified siblings, focus/selection, and unchanged local form values. Explicit bindings travel in the same frame. The plain-expression TSX counter and realtime starter use this path; the canonical chatroom's migration to the simpler TSX model is still pending.
Reactive verification (Windows/Node 22.21.0): 385 tests/28 suites and all type/pretest gates passed with 100% instrumented-library statement/branch/function/line coverage. New pure capture/lifecycle units use real timers; new integration tests use real HTTP/WebSockets for owner scoping, shared request isolation, connection isolation, hidden/reintroduced components, reconnect during unfinished async rendering, error containment (including a failing logger), and unused/unchanged output suppression. The real-browser gate additionally covers derived expressions, keyed fragment reordering, node identity/drafts/focus/selection, server-controlled text/textarea/checkbox/select updates, and reactive table/select boundaries under CSP. Generated browser source is exercised by that gate, not included as independently instrumented browser branch coverage; broader browser coverage/performance auditing remains a release item.
Packed-package verification passed with all four generated starters. The existing Live HTML load gate passed (200 expired renders, 110 live clients; about 12.4 MB heap delta); this is legacy chat-path evidence, not yet the new reactive fan-out load profile. The JSX serialization gate passed 10,000 component rows in about 49 ms and 1.3 MiB retained; it does not measure live DOM patch performance.
Follow-up bug found by repeat testing: Nodemon treats compiler exit code 2 as fatal. Normalized failed development commands to exit 1 and made the real-process test wait for the watcher to remain active before repairing the source. Repeated full-suite runs then passed.
Chat simplification increment: replaced cached HTML screen/message/presence state with ordinary data and keyed TSX in the canonical chatroom.tsx; retained independent room instances, reserved reconnect identities, disconnect presence, validation, and the 100-message/100-visible-member bounds. Added owned synchronous class-component child typings and negative async-component type coverage. The initializer still copies the single canonical implementation. Verification: 387 tests/29 suites with 100% instrumented-library coverage and type gates; real-browser counter/chat/draft-preservation checks; all packed starters; reactive chat load with 200 expired renders and 110 live clients (about 8.8 MB post-cleanup heap growth). This supersedes the earlier note that chat migration was pending, but does not close the remaining broader release/audit requirements.
Socket contract increment: added schema-inferred client/server contracts using Standard Schema v1, without a runtime validator dependency in Redweb. The socket starter now supplies a shared Zod schema and independent join/move/resume handlers on /match, with ordered messages and bounded in-memory bearer sessions. Client and server sends share immutable JSON snapshot validation; inbound failures are distinguished from application/output bugs. Promise-like outputs stay within the validation deadline and sanitizing error boundary. Completed overdue work is rejected, but synchronous JavaScript cannot be preempted and external validator work is not cancelled; these limits are documented.
Contract verification (Windows/Node 22.21.0): 400 tests/31 suites and all type gates passed with 100% instrumented-library statements/branches/functions/lines. Real-socket tests cover schema transformations, mutating validators, malformed inputs and server outputs, negotiated versions, metadata, deadline/error containment, and unchanged uncontracted behavior. All four packed starters passed their shipped real-network tests and source-free production checks; the browser regression gate passed; dependency audit reported zero vulnerabilities with certificate verification retained. The senior critic independently rechecked contract tests, generated starters, and types and approved this increment after four findings were fixed with regressions. These results do not close the pending diagnostics, unified documentation, fresh-agent benchmarks, or broader release-performance audit.