[mvalancy]

Production API images carried development toolchains and depended on imports supplied by excluded workspaces. The API, generic and self-host images now install selected locked production consumers, retain workspace-local dependencies and the matching native SQLite binding, and ship compiled application output without source tests or package managers.

Part of #185; stacked on toolchain PR #206. Exact source f95397c3c89d3bbd1dabc2483607b28b2ae2c39c.

The reduced build exposed an undeclared server graphql-tag import, now declared at its existing locked version. Startup uses the existing awaited SQLite administrator initialization. Existing runtime UIDs are preserved. Production HTTP/HTTPS Compose volumes now target the actual auth store; no historical volumes are migrated or deleted.

Validation:

• Three actual images pass compiled API and MCP stdio contracts, real CAPTCHA proof/replay rejection, GraphQL plus independent Neo4j readback, and account-ID recovery after container replacement. All owned containers, graphs and named volumes are cleaned up.
• Negative controls retain the old image's installed-tool failure and the first pruned image's real ESM missing-import failure.
• Clean host install; server 211/211; harness 192/192; all-package types/lint; all three Docker builds pass.
• New required CI image matrix repeats these contracts and retains complete installed inventories, image identity, Trivy JSON and dated DB metadata. Independent exact-head review and final CI are pending.

Dated Trivy inventories show zero npm findings in all three images and zero OS findings in the two Alpine images. Self-host Bookworm retains 228 raw OS entries after the available tzdata update; these remain open under #209. The scan is inventory evidence, not a zero-vulnerability gate or full-image clearance. The specific critical MiniZip entry has Debian applicability evidence in the canonical packaging record; it does not dismiss other findings.

No publishing, deployment, main promotion, historical-volume recovery or hosted acceptance is included. Full commands, image digests, negative evidence and limits: docs/quality/RUNTIME_IMAGE_PACKAGING_2026-10-27.md.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Final correction composition is now 7d327c141f0474064fa1048fa0dcb17f2f88cb53. Independent review verified the complete six-path import from reviewed LOD/camera-readiness head 7cbf292: source renderer, both browser regressions and lessons match byte-for-byte; feature-specific code and dependencies remain unchanged. The symptom index retains every previous row and adds the motion lesson. No instruction or authority changes.

The combined local motion suite passes 3/3 in 2.1 minutes with zero retries; combined LOD validation and fresh exact-head CI remain pending. Previous green heads do not establish this composition's final acceptance. Earlier LOD/rotation failures and insufficient title-geometry evidence remain retained. Integration follows #207 → #210 → #199 → #195 → #197 → #202 → #206 → #211, with native dev merge verification and post-merge CI before issue closeout. Independent agent review is not a GitHub non-author approval.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Final native dev-only integration evidence for 7d327c141f0474064fa1048fa0dcb17f2f88cb53: production image packaging with actual API/MCP/native SQLite and replacement-container contracts. Independent exact-head implementation/composition reviews found no remaining findings. The reviewed camera corrections are included; feature-specific code is unchanged from its reviewed source.

CI40602602211 and Comprehensive40602602232 passed every applicable job. Downloaded strict artifacts verify smoke6, new-user42, LOD2, routes7, mobile27 and performance3, all with zero failed/warned/skipped cases, evidence errors, timeouts or nonzero executions. Effects, showcase, supported-Node coverage, installer and real-Neo4j gates also passed. The main/nightly-only production job is inapplicable to this dev PR.

The live base and complete merge result will be checked against the preceding reviewed stack tree immediately around the native operation. Expected resulting tree: 74c56025933a6e070f0ff2bfed7da43bb91f1b08. Retargeting a stacked PR to an equivalent dev tree changes no feature content. Earlier failures remain retained; no retry is substituted for a fix.

This uses the owner's standing dev administrator authority and does not claim a GitHub non-author approval. Issue closeout waits for successful validation of the integrated dev head; intermediate post-merge runs may be superseded by later reviewed stack integration and are not counted as passes. Main, release, deployment and protection remain unchanged.