Integrate validated graph workflows, save recovery, and authentication fixes

.agents/inbox/2026-10-23-browser-startup-evidence.md

@@ -0,0 +1,74 @@
+# Distinguish the static loading shell from a mounted application and retain failure traces
+
+Date: 2026-10-23. Searched `tests/e2e/quality/button-content.spec.ts`, the unified
+manifest/adapter, Playwright configuration, prior responsive acceptance lessons,
+`packages/web/index.html`, and `App.tsx`. Public tracking: #156.
+
+The strict combined acceptance run on frozen
+`f8a11e16a593738d485547eb1dfe117438cc3ed6` reported this failure before button
+inspection on one route/viewport iteration:
+
+```text
+Locator: locator('main')
+Timeout: 5000ms
+Error: element(s) not found
+Snapshot: GraphDone Logo / GraphDone Loading...
+```
+
+The screenshot and DOM snapshot exactly match the static HTML shell in
+`packages/web/index.html`: Loading text and empty placeholder cards. React's
+authenticated initialization screen instead says Initializing and includes
+feature text; route Suspense appears inside Layout's main element. Thus this
+failure establishes that the mounted application was unavailable at the
+deadline, not that a button label was clipped. It does not by itself distinguish
+delayed module loading/execution from a startup error.
+
+The screenshot timestamp was 12:53:58 America/Los_Angeles. Docker build/export
+work overlapped the run and the generic image build log completed at 12:55:38.
+Resource contention is a hypothesis, not a proven cause. The original artifact
+did not identify the current route or exact viewport; its 375-by-1144 full-page
+PNG dimensions do not establish the viewport. No trace existed because the
+global setting was on-first-retry while the strict sequence used zero retries.
+Artifacts remain in the candidate worktree's ignored
+`test-artifacts/playwright-output/quality-button-content-*/` directory and must
+be preserved before another run.
+
+Corrective rule: keep zero retries and existing deadlines, but record
+retain-on-failure traces for required browser sequences. Label every route and
+viewport iteration and attach bounded browser errors when the sweep fails.
+Copy trace/diagnostic files into the retained unified report before another
+Playwright process can clear its shared output directory. Do not equate the
+absence of API errors with successful frontend startup.
+
+Evidence-only correction on public PR175 base `1a16d4e`: three new controlled
+child-process tests first failed because the actual Playwright command lacked
+failure-only tracing. A fourth failed because the adapter dropped trace and JSON
+attachments. After correction, Node 22.23.4 `npm run test:unified:lib` passed
+156/156 with zero skips, including bounded event capture, credential/URL
+sanitization, listener cleanup, and file retention after deleting the original
+Playwright output. Playwright `--list` still collected the single unchanged
+button sweep. Logs: `/tmp/core-browser-diagnostics-{red,retention-red,final}.log`.
+
+Independent review then reproduced a source-boundary defect inherited from the
+image/video materializer: an attachment could name an unrelated local file or
+follow a symlink, copying it into a downloadable report. Owned outside-root
+sentinels established the failure without reading real secrets. Four new CLI
+controls failed before correction (outside-root source, file symlink, parent
+directory symlink, and directory instead of a file). New downloadable files now
+require regular files under the canonical repository `test-artifacts` root with
+no symlink traversal; the adapter rejects unsafe evidence and the materializer
+rechecks immediately before copying. The legitimate copy/retention case still
+passes. Final stdlib validation: 160/160 passed, zero skips, recorded in
+`/tmp/core-browser-diagnostics-reviewed.log`.
+
+The custom JSON diagnostic capture applies bounded credential/URL redaction;
+Playwright trace ZIPs remain raw and can contain network headers and bodies.
+Retain those locally with the disposable test artifacts and share measured
+summaries, not raw authenticated traces. Standalone and dashboard report views
+both render these new files as escaped download links rather than images.
+
+Limits: these checks validate evidence collection and command forwarding, not
+the underlying startup failure or deployed health. No browser was launched and
+no application code, deadline, retry policy, or assertion threshold changed in
+this correction. A serialized complete acceptance rerun is still required;
+retain the earlier failed run and distinguish observations from causal claims.

.agents/inbox/2026-10-23-core-startup-and-save-evidence.md

@@ -0,0 +1,17 @@
+# Builds and save acknowledgements need boundary-specific validation
+
+Date: 2026-10-23. Existing guidance searched: `docs/quality/TEST_STRATEGY.md`,
+the dated runtime/durability lessons, and `.agents/issues/INDEX.md`. This pointer
+keeps the detailed incident records canonical rather than duplicating them.
+
+| Symptom / cause | Canonical dated evidence, correction and limits |
+| --- | --- |
+| A successful build hid API peer-resolution and launcher failures | [Runtime validation](../../docs/quality/RUNTIME_VALIDATION_2026-10-23.md): use a pinned clean install, actual startup, supported runtimes and owned browser fixtures. Container/build success alone is not deployment evidence. |
+| Missing/default production secrets were accepted; `.env` loaded after key capture | [Production secrets](../../docs/quality/PRODUCTION_SECRETS_2026-10-23.md): validate configuration before authentication initializes; negative controls must stop before DB/listen, with configured positive controls. The later integrated lint check found an ambient type annotation missed by typecheck; the type-only follow-up preserves runtime behavior. |
+| A delayed save/refetch erased a newer date edit or repopulated cleared undo history | [Details-save completion](../../docs/quality/DETAILS_SAVE_COMPLETION_2026-10-23.md): preserve newer fields, scope completion to the current editor, require the expected acknowledgement, and retain the undo clear generation. Real Apollo regressions preserve failing-before evidence; they do not replace the combined browser gate. |
+
+Commands, observed outputs, source revisions and scope limits remain in those
+dated records and the [Core merge-validation ledger](../../docs/quality/CORE_VALIDATION_2026-10-23.md).
+Keep failed runs and synthetic execution failures distinguishable from product
+cases. Carry these pointers and their regressions through public review; neither
+an unpublished local note nor a pending ledger field is a release pass.

.agents/inbox/2026-10-23-dependency-audit-scope.md

@@ -0,0 +1,11 @@
+# Audit counts need source reachability and bounded regression evidence
+
+On 2026-10-23, the unchanged runtime lock at `6b2a007` produced 23 full-audit package entries and eight production-only entries. An isolated lint-tool correction reduced the full count to 17, while production remained eight. The canonical [security scope](../../docs/quality/SECURITY_SCOPE_2026-10-23.md) records families, priorities, authentication probes, and limits.
+
+Evidence: `npm audit --package-lock-only --json`, `npm audit --omit=dev --json`, a clean lockfile install, `npm run lint`, `npm run test:unified:lib` (106 passed), and `npm run test` (434 passed, 25 database-gated skips). The minimatch regression fails against 9.0.3 at its bounded two-second child deadline and passes against the scoped 9.0.7 override. A separate real in-memory SQLite probe returned two successful verifications of one magic-link token; a synthetic CAPTCHA code was also accepted. No deployed credentials or shared database were inspected.
+
+Cause: advisory severity and dependency classification do not describe the actual call site. Conversely, a browser-only lockout and a green production dependency gate do not establish backend abuse controls. Historical documentation had described UI attempt tracking as completed brute-force protection.
+
+Corrective rule: record the exact source/lock snapshot, distinguish package entries from distinct vulnerabilities, trace runtime inputs and deployment packaging, reproduce suspected application gaps in owned fixtures, and keep version updates narrow enough to validate. Preserve negative controls in the existing harness; do not suppress findings by relabeling dependency categories.
+
+Limits: reachability conclusions are bounded source observations, not proof of non-exploitability. Authentication follow-ups remain open. The security-scope document is the reviewable record; local log paths alone are not published validation.

.agents/inbox/2026-10-23-folder-delete-legacy-hierarchy.md

@@ -0,0 +1,21 @@
+# Deletion authority includes pre-existing descendant folders
+
+On 2026-10-23, review of SEC-FOLDER-1 found that validating a folder's owner was insufficient when older records could place another user's folder below it. The new creation/reparenting checks prevent new cross-domain trees, but do not repair existing records.
+
+## Evidence
+
+The real in-memory SQLite fixture initializes with `PRAGMA foreign_keys=0`, matching the store's current connection defaults. Deleting an owned parent succeeds and leaves a foreign descendant with a missing ancestor. With `PRAGMA foreign_keys=1`, the declared `ON DELETE CASCADE` removes the foreign descendant. Both the standalone and Neo4j-generated GraphQL schemas reached this SQLite behavior. No shared or production database was used.
+
+Command: `npm run test --workspace @graphdone/server -- tests/folder-authorization.test.ts` with the new tests copied onto commit `0c2322cdfb2669c7fb2c057ea62df583736aba62`.
+
+Observed on 2026-10-23: **10 failed, 32 passed**. The failures cover nested foreign descendants with foreign keys off/on, another writable ownership domain, and destinations inside the deleted subtree. With foreign keys on, the foreign descendant query returns an empty array after deletion. A legitimate same-domain cascading deletion remains a passing control.
+
+After correction, `npm run test --workspace @graphdone/server` reports **70 passed**, including all 42 folder cases; server typechecking passes. Local evidence: `/tmp/graphdone-folder-subtree-baseline-final.log` and `/tmp/graphdone-folder-subtree-full-green.log`. These local paths are evidence pointers, not published validation artifacts.
+
+## Cause and corrective rule
+
+Authorization must cover every record a destructive operation can affect, including records connected through database cascades. Before moving any graph references or deleting a folder, recursively enumerate existing descendants, require write access to each, and require the same ownership domain. Reject a graph destination that is the deleted folder or one of its descendants. Use a cycle-safe recursive query so malformed legacy trees cannot loop indefinitely.
+
+## Limits
+
+This change does not migrate malformed hierarchies, enable foreign-key enforcement, or redefine valid same-domain folder deletion. It tests actual SQLite and both GraphQL schemas; graph metadata and the Neo4j version probe are simulated. Live backend and browser validation remain separate release gates. The repository had no `.agents/WRITING-IT-DOWN.md` or existing lesson index when this incident was recorded; the related API guidance and regression suite carry the rule with the fix.

.agents/inbox/2026-10-23-magic-link-consumption.md

@@ -0,0 +1,9 @@
+# Consume single-use identity tokens with a guarded database update
+
+On 2026-10-23, real in-memory SQLite regressions on runtime base `5f0f454` reproduced concurrent magic-link replay and inactive-account acceptance. The selected before-fix run failed two cases and passed one. A further controlled delayed-write regression failed against the first fix `4f4b782` because its expiry timestamp was captured before the statement executed. The final full server run passed 39 cases, including all eleven new magic-link cases. Commands and evidence are recorded in the [review note](../../docs/quality/MAGIC_LINK_REPLAY_2026-10-23.md).
+
+Cause: selecting an unused token does not reserve it. The previous update neither checked unused/expiry state again nor waited for its outcome before returning identity.
+
+Corrective rule: atomically transition unused state using the database's execution-time expiry predicate, await completion, and require exactly one affected row before returning or creating identity. Check current account activity. Exercise real concurrent requests, expiry boundaries, and actual database failures; mock success callbacks alone cannot establish single-use behavior.
+
+Limits: this shared verifier still serves both login and reset flows. Purpose separation, other authentication controls, and deployed HTTP/email behavior remain separate work. A failure after successful consumption deliberately requires a fresh link. No shared database or deployed secrets were used.

.agents/inbox/2026-10-23-mcp-stdio-diagnostics.md

@@ -0,0 +1,59 @@
+# Successful MCP calls do not prove a clean stdio protocol
+
+Date: 2026-10-23. Searched the Core testing guide, MCP contract suite,
+`.agents/inbox/`, and symptom index before adding this incident. The writing
+procedure was read from Graphlings' `.agents/WRITING-IT-DOWN.md`; Core does not
+currently carry that file.
+
+A compiled-server probe on `b843a1b` (SDK 1.32.2, Zod 4.6.7) initialized,
+listed 31 actual tools, read an owned graph, rejected malformed and unknown
+calls, and successfully read again. It nevertheless failed the protocol check:
+`Memory monitoring started` was written to stdout and produced a client
+`SyntaxError`. The SDK reports parse errors through `client.onerror` and keeps
+processing later messages, so successful tool results alone hid the defect.
+The owned subprocess exited and the probe verified deletion of its one edge,
+two work items and graph, in that order. No shared database was used.
+
+The committed regression extends the existing disposable Neo4j contract. From
+`packages/mcp-server`, with explicit owned loopback credentials loaded privately:
+
+```sh
+RUN_DB_CONTRACT=1 GRAPHDONE_DISPOSABLE_NEO4J=1 CI=true \
+  npx vitest --run tests/neo4j-contract.test.ts -t 'actual MCP stdio'
+# Before the source fix: 1 failed, 8 filtered-out cases skipped (6.67 s).
+# Only valid JSON-RPC messages may appear on stdout:
+#   "Memory", "CPU Monitor", "Recorded write", "Waiting for" are not valid JSON.
+
+RUN_DB_CONTRACT=1 GRAPHDONE_DISPOSABLE_NEO4J=1 CI=true \
+  npx vitest --run tests/neo4j-contract.test.ts
+# After the source fix: 9 passed, 0 skipped (8.82 s).
+```
+
+The test launches the actual entry point with `node --import tsx src/index.ts`
+so the existing CI contract job does not require a compiled build. It checks
+initialization, real tool definitions, an owned node creation/read, independent
+Neo4j readback, invalid-call rejection, continued valid use, zero stdout parse
+errors through child shutdown, retained stderr diagnostics and owned-child
+termination. It shares the suite's explicit disposable-DB guard. Independent
+review caught that inherited cleanup swallowed failures; this fixture now uses
+its own verified edge → node → graph cleanup, fails on an unconfirmed stage,
+and retains the remaining ownership links. The new case creates no edges. Both
+the final negative control and passing run confirmed cleanup before checking
+the protocol-error channel. The implementation changes only eight operational `console.log`
+calls to `console.error` in the memory, CPU and consistency utilities.
+
+Keep stdout exclusively for MCP protocol messages. Verify both real results
+and the client's protocol-error channel at this boundary. Do not silence the
+errors or remove diagnostics to make the check pass.
+
+Limits: this does not test authentication, authorization, every tool, sustained
+load, forced garbage collection, or all CPU modes. The CI fixture uses the
+existing CI CPU policy; production thresholds are unchanged. The installed
+SDK currently maps a malformed request's schema error to `-32603` before the
+more specific tools wrapper runs; this patch does not change that behavior.
+Two initial standalone probe mistakes (assuming `-32602`, and comparing an
+unordered Neo4j status collection without normalization) were corrected after
+source inspection and retained separately from the stdout failure. The package unit run passed 97 cases with 26 explicitly DB-gated skips;
+package build and typecheck passed, and lint passed with zero errors and 31
+existing warnings. The full combined dependency/stdio candidate still needs
+its own merged-head validation.

.agents/inbox/2026-10-23-mobile-audit-fixtures.md

@@ -0,0 +1,45 @@
+# Mobile audit controls must target owned content and observable dismissal
+
+Date: 2026-10-23. Existing guidance searched: the responsive acceptance lesson,
+`docs/quality/TEST_STRATEGY.md`, and `tests/lib/mobileAudit.ts`. Tracks #156.
+
+The existing CI mobile selection ran on combined source `aece679` with one headed
+Chromium worker, zero retries, and a diagnostic stop after three failures:
+
+```text
+npx playwright test --grep='@mobile|@audit' --project=GraphDone-Core/dev-neo4j/chromium --headed --workers=1 --retries=0 --max-failures=3
+15 passed, 3 failed, 9 did not run (3.4m), exit 1
+```
+
+The edit-dialog test selected an obsolete grid wrapper in an arbitrary default
+graph. The create-dialog selector matched both a hidden desktop button and the
+visible mobile button; its expected heading was also obsolete. The navigation
+test pressed Escape (which closed More), then blindly clicked the underlying
+page at fixed coordinates, opening a work item and blocking the next nav click.
+
+The two dialog cases now create their own graph and named task, select actual
+visible controls/current headings, retain every viewport/paint-order assertion,
+and clean up only that graph's fixture, deleting edges before work items and
+the graph so failed cleanup preserves ownership links. The navigation case asserts that Escape
+hides More, removing the blind follow-up click and swallowed keyboard failure.
+
+The final functional patch ran against the unchanged application on
+2026-10-23, Node22.23.4, bundled Chromium, localhost API/owned Neo4j:
+
+```text
+TEST_URL=http://127.0.0.1:13127 QC_API_URL=http://127.0.0.1:14127/graphql xvfb-run --auto-servernum npx playwright test tests/e2e/mobile/dialog-positioning.spec.ts tests/e2e/mobile/experience.spec.ts --project=GraphDone-Core/dev-neo4j/chromium --headed --workers=1 --retries=0
+4 passed (35.5s), exit 0
+```
+
+Corrective rule: own mutable fixtures, observe the visible control, and assert
+dismissal before the next action. Coordinates without a current target can
+activate newly exposed content. Keep failed evidence; a focused pass does not
+count the nine unexecuted mobile cases as passing. Final combined mobile CI is
+still required. This emulated browser evidence does not establish native mobile
+keyboard or screen-reader behavior. Logs/screenshots are retained in the owned
+worktrees' ignored `test-artifacts/audit-20261023/` directories and summarized in
+public review comments.
+
+Independent review required the repository's edge-first cleanup rule. After
+adding graph-scoped edge deletion before tasks/graph, the same four headed
+cases passed again in 35.6 seconds on the unchanged application (exit 0).