[mvalancy]

Addresses the UUID/federation portion of #186. Core and Apollo federation currently resolve UUID 9.0.1, whose buffered v3/v5/v6 generators can silently write part of an undersized output buffer. Upgrade Core to ^11.1.1 and scope a UUID 11.1.1 override to federation-internals 2.14.4. The server deduplicates to that copy; Mermaid retains 14.0.3.

This preserves CommonJS and the installed Neo4j schema API. The attempted Apollo subgraph 2.15.1 update failed a real getSubgraphSchema() probe because it stopped accepting Neo4j's single-module input. Subgraph/federation therefore remain 2.14.4; no unrelated dependency versions change. The dated repository lesson and security inventory retain that compatibility evidence and the stale-lock failure found after initially adding the override.

Validation so far:

• Baseline UUID 9 v3/v5 negative controls: undersized buffer modified without throwing. Four new regressions pass for all lock paths, actual CJS/ESM consumers, generated IDs, v3/v5/v6 rejection without partial writes, and Neo4j federation schema generation.
• Clean Node 22.18.0/npm 10.8.2 install; all four builds, all types and lint passed before composing Patch dev SQLite build dependency to Undici 6.29.1 #194. Core 41, server 126 and MCP 110 unit cases passed; 26 database-gated MCP cases remain separate from the real-Neo4j CI contract.
• Concurrent local full-web run hit an existing 5-second save-test timeout under host load; unchanged timeout with one worker passed all 326 web cases. That failure is retained. The composition changed before the following harness completed, so that harness is not accepted as final evidence.
• Current frozen head includes merged dev Patch dev SQLite build dependency to Undici 6.29.1 #194. Clean composed install, bounded-concurrency full unit/harness tests, fresh audit, independent exact-head review and full remote CI are in progress. This remains a draft until those gates pass.

The pre-#194 fresh audit removed all UUID/federation findings, leaving two moderate router entries and high Undici; #194 supplies the separate Undici correction. Final composed counts will be posted after the fresh installed audit. This PR does not close the remaining router/CSS work or establish hosted/deployed exposure.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Final review correction head: f0e76e53ecd72c953697bb1a339807f74c486444; live dev composition is 32149ee61ea5436831d95d76e4c4b6dc2db619a3. Independent exact-head review cleared both findings: the UUID regression now rejects every affected advisory range (including 12.0.0 and 13.0.0), and the inventory clearly separates the historical pre-Undici audit from the composed result.

Composed clean Node 22.18.0/npm 10.8.2 install and all package builds passed. All 603 unit cases passed with one local task/worker at a time and original timeouts; 26 database-gated MCP skips remain explicitly separate from the real-Neo4j CI contract. Final 168/168 harness cases passed, including five UUID regressions and the inherited Undici controls. The final review correction changes only the dependency test and two documents; runtime/manifests/lock are byte-identical to the composed unit/build snapshot aba24a34d193b60e2318cd5b197f66e64f320215.

A fresh-cache installed production audit on the composed lock reports two moderate router entries, zero high/critical; UUID/federation findings are gone. No dependency was moved to hide a count. Earlier parallel web timeout, stale-override lock and incompatible subgraph experiment remain recorded. Exact-head remote CI (including real-Neo4j and browser gates) is still pending; no integration claim yet.

[mvalancy]

LOD PR #192 moved live dev to 8712389e24f567f5b3e6ed132c1ac5d4dafb21fa. I merged that base into this PR rather than treating the older green result as the final composition. Frozen head: 26ffc7492ba12ab67c9e74ea606a71e2116bfe82.

Independent review found no issues: the full diff from live dev is exactly the eight reviewed UUID paths, all LOD content is retained unchanged, both package-command sets are present, and UUID regression/lock/manifest content remains identical to reviewed f0e76e5. Fresh clean install, build, types, lint, harness, audit, and new exact-head CI are running. Prior final-head CI 40574295252 and 40574295274 passed; they are historical evidence, not a substitute for the new composition gates.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Integration preflight (2026-10-27): reviewed/tested head 26ffc7492ba12ab67c9e74ea606a71e2116bfe82, live dev 8712389e24f567f5b3e6ed132c1ac5d4dafb21fa, clean owned worktree. Independent exact-head composition review found no issues (recorded above); this is not a non-author GitHub approval.

Fresh Node 22.18.0/npm 10.8.2 clean install, build, types, lint and 171 harness cases passed. Final CI 40579473285 and Node 22/24 + installer checks 40579473104 passed on this head. Inspected the actual smoke log: smoke 6, new-user 44, mobile 27, effects 3, performance 3, all passed without failed/flaky/skipped required cases. Real-Neo4j contract passed. Production main/nightly job is inapplicable to dev. Production audit: two moderate Router entries, zero high/critical; broader #186 remains open.

Proceeding with the owner's standing exact-head admin merge into dev, without changing protection. Main, publication and deployment are outside this operation. Post-merge branch CI and merge parent/tree verification remain required for closeout. Owned browser cases cleaned their fixtures; isolated shared test services remain available for ongoing work.

[mvalancy]

Admin merge completed into dev at 97dc8849db8f257ffa88ab790c4452a8022eeaa6. Verified parents: live base 8712389e24f567f5b3e6ed132c1ac5d4dafb21fa and reviewed head 26ffc7492ba12ab67c9e74ea606a71e2116bfe82. Complete merge tree b1fdf1e8d46f16e6fea62bc50512ec2b5e440424 equals the reviewed head tree. Main remains 775362eace0723c57b7ba3c7936645c9d0d36cb4; no protections changed.

Post-merge CI 40584068599 and Comprehensive 40584068682 are running. Integration closeout remains pending their actual results.

[mvalancy]

UUID dev integration is verified complete at 97dc8849db8f257ffa88ab790c4452a8022eeaa6. The previously recorded merge parents/tree match the reviewed composition. Post-merge CI 40584068599 and Comprehensive 40584068682 passed on that exact branch commit. Inspected actual smoke log: 6 smoke, 44 new-user, 27 mobile, 3 effects, 3 performance, all non-flaky with no required skips. Real-Neo4j, Node 22/24 units, installer/config, builds/types/lint and security jobs passed. The push-only report comment and main/nightly production job were inapplicable.

This was the owner's authorized admin merge into dev, not a non-author approval or a release/deployment. #186 stays open for the separately reviewed Router/CSS work. Main and protections remain unchanged. Owned test services are retained for continuing backlog work; individual browser graph fixtures were cleaned.