Establish hosted D1 mutation and sync-recovery acceptance with owned browser fixtures #182

Public acceptance follow-up to #156/#157 for graphdone.com. This is an acceptance-evidence gap, not a claim that the current hosted service is broken.

The Core validation ledger leaves hosted D1 mutation parity and persistence blocked. The read-only public check established sign-in controls and HTTP 200; its health response explicitly did not probe the database. Core's real-browser persistence evidence uses its owned localhost API/Neo4j stack. Neither proves hosted D1 writes or recovery.

The browser's sync engine uses /api/sync; project reads and queued replay depend on snapshots, request IDs, conflict responses, and retaining uncertain acknowledgements. These are the acceptance boundaries; no private Cloud implementation is described.

Completion criteria:

• Pin the browser artifact, Core/Cloud revisions, API origin, D1 schema/migration state and offline-sync mode for an explicitly owned test target. Mark staging evidence separately from any later production observation.
• In the actual browser, create an owned graph with two tasks and one edge; edit a task, change layout, navigate modes and reload. Independently read exact saved data from the real target API, then verify scoped deletion and edge integrity.
• Exercise actual project list/read/write sync operations. Drop one successful acknowledgement, retry the identical request ID, and prove no duplicate creation, lost newer edit or unintended extra version/application. A mocked successful response is insufficient.
• Interrupt connectivity for one owned pending change and recover through real D1. Record in-tab recovery and saved-position reload separately; link the layout-persistence issue instead of assuming unsent-work crash recovery.
• Use two owned accounts to verify foreign graph/snapshot reads and mutations fail without disclosure or changes. Switching accounts or receiving 401/403 must retain the correct owner's local work without cross-account replay.
• Cover a version conflict and bounded 429/5xx recovery: visible state, no silent overwrite/retry storm, and no “saved” claim before acknowledgement.
• Gate the owned journeys on complete evidence with exact source/target identity, zero skipped/flaky required cases, retained earlier failures and cleanup verification. Local D1 emulation, worker liveness and Core/Neo4j passes remain separate evidence rows.

Excluded: remote email/OAuth, complete accessibility, autonomous agents and comprehensive release-security approval.