[mvalancy]

React Router6.30.6 remains in the advisory ranges for mixed-separator navigation and SSR error hydration. Upgrade the installed Router/DOM pair to7.18.4 while retaining GraphDone’s declarative BrowserRouter, existing imports and route structure. Related to #186; UUID/federation remains in #196 and CSS evidence is separate.

The lock removes the old @remix-run/router path and contains only Router/DOM7.18.4. Official fixed ranges and the versioned v6 migration guide were checked; the selected release supports React18 and the supported Node22/24 runtimes. Source inspection found no application-controlled external destination or SSR hydration sink; this PR does not claim a demonstrated live exploit.

Validation adds a guard for every locked Router path, actual installed-consumer navigation/history controls, and six required desktop/phone browser cases for public/authenticated deep links, reload, lazy navigation, history, role rejection and a fresh-context login callback. The callback uses an owned password-issued token, not a live OAuth provider.

The final mixed-separator control fails four cases on the original locked6.30.6 and passes all five cases on7.18.4; existing role guards bring the focused result to9/9. Earlier tests expected normalization from an older upstream test, but installed7.18.4 rejects these external-looking paths; that mistaken expectation and correction are retained. The first browser run passed both viewer/callback journeys and failed four cases because the test assumed Password and Admin Users were default tabs. Corrected steps select those actual controls explicitly; assertions and retry policy remain strict.

Frozen head 3e5a761dc0b067ed3827dd29fca50d45fb5d3952: independent review, corrected six-case browser run, full web suite, harness, fresh audit and exact-head CI are pending. Clean install and all builds/types/lint passed on the identical runtime/dependency tree before final test/document corrections. Draft until final gates and live-dev composition review pass. No deployment, shared library, audit-threshold relaxation or forced unrelated upgrade.

Dated evidence: .agents/inbox/2026-10-27-router-upgrades-need-current-consumer-contracts.md; inventory: docs/quality/SECURITY_SCOPE_2026-10-23.md.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Reviewed head is now 4e248287386ac3dbc6c1e6cf7ad458e8d60b3a0f. Independent review is clear after strengthening the dependency guard: both actual web consumers must satisfy the patched range and match their resolved lock entries, in addition to every locked path being checked.

On 3e5a761, the corrected actual-browser suite passed6/6 in1.4m with zero retries, full web tests passed340/340, and harness passed167/167. The final three-path test/documentation delta leaves runtime, manifest, lock and browser test bytes unchanged; the changed final harness passed167/167 again. Clean install/build/types/lint evidence applies to that same runtime/dependency composition. Earlier failed expectations and four browser fixture failures remain retained and explained in the lesson.

Fresh-cache production audit on this Router-only branch now has3 moderate UUID/federation entries,0 high/critical, and no Router/CSS entries. UUID is separately fixed in #196. Final exact-head CI and live-base integration checks remain pending; no deployment claim.

[mvalancy]

Composed the independently reviewed editor focus correction #201 and live dev UUID merge into this branch. Frozen head 14a4fcc1f54a6919e11eb8738fb77d5f56c817b3; temporarily stacked on #201 so this PR displays only Router changes. The only manual merge resolution retained both symptom-index rows. Router runtime/tests remain unchanged from reviewed 4e248287386ac3dbc6c1e6cf7ad458e8d60b3a0f. Fresh clean install/build/types/lint/harness/audit, exact-head review and CI are running.

Integration order is #201 → #198 → #199, with each retargeted to live dev only after its predecessor is verified. Actual base/tree composition will be rechecked before any merge. Old runs are retained as historical evidence, not substituted for these final gates.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Independent exact-head review cleared 14a4fcc1f54a6919e11eb8738fb77d5f56c817b3: lockfile is the combined UUID/Router result, each inherited implementation/test remains byte-identical to its reviewed source, and all shared documentation additions survive. Fresh Node 22.18.0 clean install, build, types, lint and 172 harness cases passed. Fresh-cache production audit reports zero vulnerabilities; full development-tool findings remain #185.

The previous six-case desktop/phone Router acceptance result remains scoped evidence. Final composed CI 40584829418 and Comprehensive 40584829408 are pending; older superseded CI is not a pass.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Current frozen head: 8c4a21bd8deb41e8dbeed6e944c3b34373495bcd. Independent review found no remaining issues; the empty-workspace authentication control now proves visible authenticated and login-form states independently.

Earlier CI 40584829418 retained two viewer failures because its authenticated account had no graphs; the helper incorrectly required graph content. The correction uses the authenticated workspace container and checks the real API role before/after OAuth callback navigation. The old helper fails the new negative control.

Required browser collection is unchanged at 51 cases, now split into new-user (42), semantic-lod (2), and router-navigation (7), with the same deadlines, one worker, zero retries, and failure-only traces. This follows the separate CSS run 40584887636 process timeout and the 892/900-second focus run; neither is claimed as a pass. Independent collection found no omissions or duplicates.

Final local named sequences passed: router-navigation 7/7 in 101.0s, semantic-lod 2/2 in 262.8s. Harness 174/174 passed; reviewer separately passed 28 CLI/dependency checks and all three authentication controls. Current-head CI is still required before integration. Base is now dev after focus PR #201.

[mvalancy]

Integration preflight: frozen reviewed head 8c4a21bd8deb41e8dbeed6e944c3b34373495bcd, live dev 9076d460c7ea8cdffba5af72f68449264c3035d3. git merge-tree --write-tree origin/dev HEAD is 169e61ccfacd523380a4ff5f06b68ab4552d529b, exactly the source head tree; worktree is clean. Independent review cleared the exact head and preserved test collection.

Final CI 40589115761 and Comprehensive 40589115727 passed all applicable jobs. Actual browser counts: 6 smoke, 42 new-user (704.6s), 2 semantic LOD (164.6s), 7 route compatibility (64.3s), 27 mobile, 3 effects, 3 performance; no required skips/flaky cases. Required DB contract and supported-Node unit/config checks passed. Earlier viewer-fixture failures and separate suite-budget failure are retained in the PR history with their corrections.

Proceeding with the standing dev-only administrative integration authorization. Agent review is not GitHub non-author approval. Main and protection remain unchanged; resulting parents/tree and post-merge checks will be verified before closeout.

[mvalancy]

Native administrative merge completed into dev. Verified remote merge 752efaee49303fa6310f3e4edd4785ffad1331fc, parents 9076d460c7ea8cdffba5af72f68449264c3035d3 and 8c4a21bd8deb41e8dbeed6e944c3b34373495bcd, full tree 169e61ccfacd523380a4ff5f06b68ab4552d529b, exactly the reviewed source tree. Main/protection unchanged.

Post-merge CI 40593468491 and Comprehensive 40593468455 are pending; integration closeout remains open until their actual results are inspected. Next stacked PR #204 is retargeted to dev; it will not overtake the required post-merge evidence.

[mvalancy]

Post-merge verification is complete for dev 752efaee49303fa6310f3e4edd4785ffad1331fc (parents 9076d460c7ea8cdffba5af72f68449264c3035d3 and reviewed source 8c4a21bd8deb41e8dbeed6e944c3b34373495bcd). Complete tree 169e61ccfacd523380a4ff5f06b68ab4552d529b exactly matches the reviewed source.

Post-merge CI and Comprehensive passed. Actual browser results: smoke6, new-user42, LOD2, routes7, mobile27, effects3, performance3, all with no required skips or retries. Unit/build/type/lint/real-Neo4j and supported-Node/installer jobs passed. This was the owner-authorized native admin merge into dev; independent agent review was not represented as a GitHub non-author approval. No main, release, protection or deployment mutation occurred.

The separately exposed LOD transition defect is tracked in #205 / #207; this green run does not erase that retained failure or claim it is fixed in dev yet. #186 remains open for the reviewed CSS follow-up.