[mvalancy]

The graph workspace needs readable content and clear visual controls as users zoom through large systems. This change measures card and label geometry, strengthens typography and wires, and replaces the desktop text tabs with recognizable icons and hover/focus labels.

Closes #222. Continues #193 and #220. Foundation #221 is merged and fully accepted on dev 058aaa7; its owned branch and worktree are removed.

Current source: 69d0493df1eb48e1190a46b8ea83e3f37f13b1ee.

• Full item/group titles are 18px, working titles and relationship labels have a 14px floor, and secondary app text uses a 14px floor. Body/control weights are 500/600. Overview cards reserve 240×96px; trace controls fit their content and clear the Connections button.
• Desktop view controls use 44px targets and 24px icons, with accessible names, hover/focus labels and Escape dismissal. Phone navigation remains accessible. Item wires retain a three-pixel screen weight across zoom; overview buses use 3.5px.
• Shared measured geometry drives cards, endpoints and labels. Newly revealed cards reconcile before appearing during a held pan. Label clearance uses oriented footprints, visible route spans, viewport/UI bounds and one bounded placement pass: 32 labels, 128 attempts and 200,000 collision checks, including failed attempts.
• Hidden overview routing is skipped. Original relationships remain available through searchable 250-row pages and exact editing, with keyboard focus restored after inspection.

Validation:

• Latest serial headed runs: three item-symbol/navigation cases passed in 36.2s; desktop 1440px and phone 360px journeys through all eight views passed in 24.6s; the 390px hierarchy/trace journey passed in 26.0s. The additional mixed hover/focus tooltip regression passed in 14.4s. Web TypeScript passed. Local checks reuse an owned dependency fixture.
• The geometry suite includes diagonal clear/crossing cases. Browser negatives deliberately overlap a label, clip a card, cross a label with a horizontal wire, shrink trace text to 8px, and delay visible content by 1.2 seconds. Independent review verified oriented runtime/oracle agreement on 1,000 deterministic cases.
• The headless gate loads 2,000 items and 5,000 edges through the API, verifies every ID, zooms out and back, checks overview clutter/accounting, visible readable content, bounded work, held-pan reveal, exact browsing and unchanged data. The actual aaa report passed with 20.403s load, browser zoom times 3.033/3.231/2.603s and wall times 4.303/4.503/3.724s. It retained 3 readable cards and 1 admitted label at each detail stage, with no data writes or page errors. Its overall CI failed the separate compact-card consumer tests described below. Final source and actual artifact acceptance remain required.
• The preceding aaa full run failed three compact-card journeys because they clicked a hidden header gear. The correction targets the original item and double-clicks its visible card, while retaining API persistence, 17-second idle sampling and the one-pixel stability bound. All three corrected phone journeys passed locally in 1.2 minutes; the full-card desktop lifecycle passed in 11.8 seconds. The failed run and skipped downstream stages are retained.
• Earlier scale failures are retained. Timing now measures request-to-visible readable content over two browser frames, while separately retaining runner wall time. This changes the measured boundary; it is not the old wall-time gate passing or a proven performance gain.

CI40731080444 on the preceding b33 source passed the actual smoke, item-wires, 2,000-node, new-user, semantic and nested stages, then failed five durable-layout cases: Browse intercepted Retry/Discard clicks. Four downstream browser stages were skipped. Comprehensive40731080454 passed. That failed run is retained, not accepted.

Current correction puts status, trace and connection controls into one responsive flow in both item and group views, reserving each actual footprint. Exact relationship-browser Edit also stops its click from triggering the document outside handler. Six focused headed cases passed (36.7s and 42.2s), including phone/desktop recovery and original-record editing; the phone hierarchy/trace journey passed in25.3s. Twenty scoped component tests and web types passed. An earlier dock-container/self-overlap failure is retained; the overlap oracle was unchanged. See .agents/inbox/2026-10-28-graph-controls-need-shared-flow.md.

Independent review also caught wheel events over the status area reaching graph zoom. The shared control boundary now preserves native scrolling; the390×500 regression requires actual overflow, native scroll and an unchanged camera and passed in15.7s. Final CI 40742791571 and Comprehensive 40742791524 passed. Independent final artifact review verified 108 strict passing cases across 11 reports, zero browser failures/warnings/skips/timeouts/evidence errors, all 72 attachments and 27 screenshots. Six archive digests and clean unchanged source fingerprints matched the reviewed composition. Post-integration dev acceptance is still required before closing #222.

Item paths can still cross; obstacle routing and buses remain #220. Minimap occlusion is a known limit, and these checks do not establish universal card/overlay clearance, 10k loading, hosted parity or release readiness. The owner's relationship-priority control with per-pair fallback is specified in docs/architecture/schematic-connections.md as the next #220 slice; it is not implemented here. CodeGraph techniques remain ideas only, with no shared library.

Recovery and retained failures: .agents/inbox/2026-10-28-readable-symbols-need-reserved-geometry.md.

Final active-chart audit: 69d0493 brings shared RadarChart axes and ticks to14px/500, with90% tick opacity. Measurement and paint use the same font. The owned normal-zoom Dashboard preview has29 rendered labels across three charts, all14px/500 and inside their SVG bounds. This is typography evidence, not a complete responsive chart-layout claim. Exact source review5687509234 is clear. Final CI40742791571 / Comprehensive40742791524 supersede the earlier38 run; its actual2k stage passed, but the full run was superseded and is not final acceptance.

Final 2,000-item/5,000-edge evidence: load 17.082s; browser zoom times 2.302/3.140/2.092s; runner wall times 3.138/4.212/2.972s. Detail retained 3 useful readable cards and 1 label, with no writes/errors. Node 22/24 each passed 807 unit cases plus 26 explicitly database-gated skips; harness 198, routing 9 and real-database 9 passed. All three runtime contracts passed. The self-host image still has 162 recorded OS findings; no clean-image claim.

Reviewed source 69d0493df1eb48e1190a46b8ea83e3f37f13b1ee, live dev base 058aaa70befa17a45b5a6b864c1c674ea8a173c1, and tested synthetic merge 6ccda3f1f7e9919090d806404659f92caf8b83f6 yield the same expected complete tree 6d7629392bb98a09e33e44232941a3933d0f231b. Integration will use the standing dev-only admin authorization, not a non-author GitHub approval.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Independent exact-source review of e4f654a against live dev 058aaa7. Four P2 findings below block integration of this checkpoint. The source composes cleanly with live dev; merge-tree and source tree both equal 6f9af5306c7a7f30a5e7cb8c263c85fb57ae1ce8.

Verification stayed light: read the full scoped implementation/test/workflow diff; inspected existing desktop 1.2 and phone 0.6 screenshots and all six small-fixture geometry JSONs (no recorded violations); executed the exact geometry helper and extracted admission body to verify failed-work growth and hidden-label counting; mounted the exact relationship browser with the current consumer callback in jsdom to verify Back/Escape focus loss. No local browser, database, build or full suite was started. Probe evidence is retained under /tmp/graphdone-resolution-20261027/pr223-independent-e4f654a.

The small fixture supports the reserved-geometry direction, but the new 2,000-item/5,000-edge gate has not established acceptance here and currently contains the unreachable target described below. Full item routing, larger loading and release readiness remain outside this review. This is independent agent review evidence, not a non-author GitHub approval.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Independent re-review of exact 6d81752. The four original findings are corrected for their reproduced paths: supported 0.1 zoom, invocation-wide failed-attempt/check limits, hidden-edge exclusion from placement/counting, and Browse focus return for Back/Escape. A new P2 finding in the visible-only presentation optimization still blocks this checkpoint (inline).

Light verification: exact-helper probe now stops 200 rejected candidates at 128 attempts/153,600 checks; 2,000 hidden candidates consume no slots and the visible candidate is admitted. Exact relationship component with the corrected callback returns focus to Browse for both close paths. Pagination preserves full-result filtering and bounds mounted rows; retained timing attachments and source/live-dev composition are correct. Merge-tree against dev058aaa70 and source tree both equal 98e7f611f4f35d464426f59efba85d2fe2a84ad5.

I also inspected the earlier e4 CI report and overview/failure PNGs: it failed its first detail zoom at 5,847ms against the unchanged 5,000ms budget and displayed zero labels. That remains a failed run, and no large-graph acceptance is claimed for this source until the new CI executes successfully. No browser, database, build or full suite was started locally. Scratch source probes: /tmp/graphdone-resolution-20261027/pr223-independent-6d81752. This is independent agent review evidence, not a non-author GitHub approval.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Independent re-review of exact 5d1aef8. The prior held-pan runtime finding is corrected: the same extracted D3-function probe now exposes the card with full width320 immediately, matching current route geometry; it no longer waits for pan end. The Browse scheduled-focus guard is present. One new P2 timing-oracle finding below still blocks acceptance of this checkpoint.

The switch from runner wall time to in-browser timing is explicitly a changed measurement boundary, not proof that the prior 5,000ms wall gate passed or that performance improved. The retained 6d report failed at6,807ms. Its trace confirms substantial time inside evaluateExpression/waitForSelector calls, but those intervals alone do not isolate protocol/snapshot overhead from waiting on application main-thread work; that causal attribution should remain qualified.

Read the complete nine-path correction, verified clean composition with live dev058aaa70 (merge/source tree873cd580288a69d82abc476d4fa9879dd5452d40), and inspected the updated desktop1.2/phone0.6 images plus six local geometry JSONs. The scoped images support the typography improvement; JSONs record title/label floor>=14px at0.6 and no violations. Overview typography/layout has source/unit evidence but still needs actual final overview/phone CI artifacts. Exact helper probes retain the failed-work/hidden-edge limits. No browser, database, build or full suite was started locally. Probe evidence: /tmp/graphdone-resolution-20261027/pr223-independent-5d1aef8. Independent agent review only; full scale acceptance and issue closure remain pending.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Independent exact-source review of 5b16ce9. The prior timing-readiness finding is corrected: controlled DOM/frame-clock probes using the exact new helper keep both a delayed parent gate and a hidden node layer pending until1216ms, instead of the old callback's32ms false success. The new headed visibility mask is applied inside the timed miniMapZoom invocation, so visibleMs>=1200 is a relevant regression assertion. One newly confirmed P2 geometry finding below still blocks this checkpoint.

Viewport clipping itself is mathematically consistent with the full rotated footprint. Exact helper probes cover both directions of horizontal, vertical and diagonal long routes: the old revision admitted0/8 visible-slice placements; the new clipping admits8/8 before adding wire collision checks, and all footprints stay within the viewport. The remaining diagonal failure is in the existing axis-aligned wire collision predicate, not the clipping math. Hidden overview routing is gated on active with active included in dependencies; the live-update/return regression targets the right contract.

Read all eight changed paths, verified clean live-dev composition (merge/source tree e05af7959b7e22de3456eafae9b1a9b12d63f698), and checked the retained5d report: first detail still failed with0labels, browser3709ms/wall5011ms, clean unchanged source. It remains a failed scale run; the corrected timing boundary is not a performance-gain claim. Probe evidence: /tmp/graphdone-resolution-20261027/pr223-independent-5b16ce9. No local browser, database, build or full suite was started. Final scale/overview/browser acceptance remains pending; independent agent review is not a GitHub non-author approval.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Independent exact-source re-review of a378dced190a65f7f0e0414ef231e3263092b008 (runtime/test correction 9c564ac30d200f397fe5ae743b698771724f7ab7).

No new blocking source finding in this correction. The prior diagonal-label blocker is fixed: the exact old source rejected all four diagonal orientations when its own clear wire was included; the corrected source admits all eight cardinal/diagonal orientations. I also compared the exact independent convex-polygon visual oracle with the label-local runtime intersection function on 1,000 deterministic generated cases; all agreed at the oracle's documented 0.5px inset. The invocation-wide attempts/checks limits remain intact. The new horizontal crossing negative uses a stable path locator and restores the same path.

I inspected the retained headed diagonal screenshots/geometry and the 13.4s pass log, and the phone hierarchy/trace screenshots/geometry and 43.8s pass log. The diagonal labels are readable and clear of the wires; the phone trace fits above Connections. The delayed-visibility artifact records 1,230.3ms for the deliberate 1,200ms hidden-content period. These are retained focused runs, not fresh exact-tree CI or scale acceptance. One visible limitation: at diagonal scale1.2 the floating minimap covers a narrow strip of the full card/right action area. The item oracle checks labels against controls, not card parts against controls, so zero violations must not be described as universal card/control clearance.

Composition is clean: 9c564ac..a378dce changes exactly the two architecture documents, with every runtime/test blob identical. Merging current live dev 058aaa70befa17a45b5a6b864c1c674ea8a173c1 with this head produces tree 6245b448726eb46286194d3d6d53840459a9f5f6, identical to the candidate. The relationship-priority/per-pair fallback document is clearly a proposal with direction/count/unknown-type/live-update constraints, not an implemented or accepted feature. No authority change found.

Review evidence: /tmp/graphdone-resolution-20261027/pr223-independent-a378dce/geometry-probe.{cjs,log}, retained item-symbols-headed13 and clean-symbols-nested-phone1 artifacts. I ran only the small pure probe; no browser, database, service, build, or heavy local suite. Final integration remains pending current exact-head CI, the actual 2,000-item/5,000-edge visible-content result and artifact review, followed by the repository's dev integration/post-dev checks. This is independent agent evidence, not non-author GitHub approval.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Independent exact-source review of bcc0b91a3638a278f610c2785002a106b86d0eb9, including its 20-path continuation from reviewed a378dce.

No new blocking source finding in the wire/typography/navigation continuation. One minor tooltip-state issue is reproduced inline: hovering another view can erase the keyboard-focused view's label after the pointer leaves. The controls retain accessible names and view changes still use the existing context; this does not block navigation itself.

The 3px item strokes and 12px hit areas use non-scaling SVG strokes, including zoom/hover restoration, without changing canonical strengths, relationship records or geometry budgets. The overview stroke change and global typography changes are presentation-only. The existing eight-view journey now locates actual accessible button names rather than removed title attributes. Its assertions/fixture remain intact. The focused navigation test covers eight visible icons, 44px targets, hover labels, keyboard focus and Escape, but misses the interleaved pointer/focus case noted inline.

I inspected retained desktop/phone symbol screenshots and all nine stage JSONs from item-symbols-headed14: each records two wires at 3px and no reported geometry violations. The three cases passed36.2s; retained all-view journeys passed2/2 in24.6s, and phone hierarchy/trace passed1/1 in26.0s. These are focused retained runs, not acceptance of the new full exact-tree CI. At phone close zoom there are zero labels but complete relationship browsing remains available; the wider stages and desktop fixture supply the visible-label evidence. The previously recorded minimap/card occlusion limitation remains explicitly documented.

Against live dev 058aaa70befa17a45b5a6b864c1c674ea8a173c1, merge-tree equals candidate tree 1adb209c9cc5d778a02230d862ac1d06cba05e7a. No dependency, workflow-authority or canonical-data change was introduced by this continuation. The relationship-priority proposal remains unimplemented under #220.

I ran only a small exact-source component probe (under one second) and read existing artifacts; no local browser, service, database, build or heavy suite. Probe and log: /tmp/graphdone-resolution-20261027/pr223-independent-bcc0b91/tooltip-probe.{cjs,log}. Full current CI, actual scale/artifact review and post-dev validation remain required. The earlier a378 scale stage is not full-run acceptance. This review is independent agent evidence, not non-author GitHub approval.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Independent source re-review of final tooltip correction aaa2913fd9a113b0f35127953f2835d8eea9d740.

The P3 mixed-input tooltip finding is fixed. Re-running the exact-source component probe now yields Graph tooltip → Dashboard tooltip → Graph tooltip as focus remains on Graph; Escape then hides the tooltip without moving focus. The added actual browser sequence exercises precisely this interleaving, and the retained item-symbols-headed15 log records1/1 passed in14.4s. The three-path delta contains only the component correction, that browser regression and its lesson. No new source finding or authority change.

Live dev is 058aaa70befa17a45b5a6b864c1c674ea8a173c1. GitHub's test merge da15eb72e4285b8d9c61a08d3e540ee240d055d8 has that live base and this exact source as parents; its tree 2615eb82b8a15fb30a09192431ec323078913e59 equals both the candidate tree and local merge-tree result. The owned source checkout remains clean.

This closes the source finding, not final integration acceptance. CI40726146104 and Comprehensive40726146346 are still pending/running; I will audit the final actual reports/artifacts/provenance when available. Prior a378 scale-stage evidence is not final aaa2913 acceptance. Existing full-item routing/priority-policy and minimap occlusion limits remain unchanged.

Lightweight probe/log: /tmp/graphdone-resolution-20261027/pr223-independent-aaa2913/tooltip-probe.{cjs,log}. No local browser, service, database, build or heavy tests started; no source edits or merge. Independent agent evidence, not non-author GitHub approval.

[mvalancy]

Final artifact audit of aaa2913fd9a113b0f35127953f2835d8eea9d740: integration remains blocked by CI40726146104. Comprehensive40726146346 passed, but the new-user gate has39 passing cases and three actual failures, plus the runner's execution-failure record. Semantic/nested LOD, durability, route, mobile, living-effects and performance steps were subsequently skipped and are not acceptance evidence.

The exact traces identify a shared stale interaction:

• tests/e2e/quality/graph-motion.spec.ts:59: both390 and844 cases complete real dragging, API persistence and atRest/cameraReady checks, then spend approximately90 seconds trying to click hidden .node-edit-icon before their100s case deadline. Their final screenshots show compact title-only cards; trace logs repeatedly say “element is not visible.” The17-second drift sample was never reached, so this is not evidence of an idle-shaking or performance regression.
• tests/e2e/quality/persona-lifecycle.spec.ts:40: TEAM-01 likewise targets the full-card gear; it starts outside the viewport and becomes hidden when the card settles into compact presentation.

Use the supported visible card entry (canonical item target; pointer double-click, touch tap or compact keyboard entry as appropriate), verify the exact editor item, and retain the existing persistence, type,17-second/>100-frame/1px assertions and timeouts. The author is making that bounded test-only correction; this failed run must remain retained.

Independently downloaded all six artifacts and verified their GitHub SHA256 digests. The five actual unified reports have clean, unchanged tested merge da15eb72e4285b8d9c61a08d3e540ee240d055d8 and shared fingerprint 554a71e01836dc5c7378848a807bf1205f8844ae3a8df6d6bfad5e742eb2fde5; all65 referenced attachments exist. Static visuals4, smoke6, item consumers5 and large graph1 passed. I viewed actual current scale and failure screenshots. The2000-item/5000-edge case loaded in20.403s, showed8 overview groups and3 readable detail cards/1 label, retained no writes/errors, and measured browser zoom3.033/3.231/2.603s (wall4.303/4.503/3.724s). These are valid partial results, not a full gate pass.

All three runtime images passed initial/replacement startup, API/CAPTCHA, compiled MCP, independent Neo4j readback and native SQLite checks; immutable image IDs match the scans. API/generic scans report0 findings; self-host retains162 OS findings (43 high,58 medium,60 low,1 unknown), with npm0. Node22/24 each passed807 units plus198 harness cases, with26 explicit DB-gated skips; separate real-Neo4j9 passed. Release/hosted/full item-routing clearance is not claimed.

Evidence: /tmp/graphdone-resolution-20261027/pr223-independent-aaa2913/ includes verified archives, extracted artifacts, raw job logs, runtime-proof.json, failed-smoke-proof.json and hidden-gear-failure-proof.json. No source edits, merge or heavy local runs by this reviewer. A corrected exact head needs fresh applicable CI and actual artifact review.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Independent exact-source review of correction b33febb8c80fe28ef2960d3b799b7c9a311b4c25 against failed aaa2913: no new source finding.

The complete delta is exactly three paths: the motion consumer test, persona consumer test and canonical failure lesson. Every runtime, dependency, workflow and other test blob is byte-identical to the previously reviewed source. Both consumers now identify the original item by its API-returned ID, wait for actual camera readiness, and use the supported visible-card double-click. This directly addresses the compact-card hidden-gear failures observed in the final aaa traces. The motion editor now asserts the exact item title and updated accessible type label; the existing API type/save checks, hidden DOM type check, resize-readiness controls,17-second idle sample, >100-frame requirement and1px drift limits remain. No case deadline, retry count or assertion was relaxed.

Retained local evidence confirms the three failed journeys passed in1.2m and the desktop SOLO lifecycle passed in11.8s, one headed worker and zero retries. Those are focused checks; they do not replace full exact-head CI. The failed aaa run and independent trace proof remain preserved under pr223-independent-aaa2913; its passing scale/image stages remain partial evidence only.

Current live dev remains 058aaa70befa17a45b5a6b864c1c674ea8a173c1. GitHub test merge 7eb3b6085282c53b5a48ce806bd1e35bf21424c8 has that base and exact b33 source as parents; tree 5b7b48cb67927a86be492246cdc75aedc3f61b06 equals the candidate and local merge-tree result. The checkout was clean.

Source correction is review-clear; integration acceptance is still pending CI40731080444, Comprehensive40731080454 and their actual report/image/provenance audit. Previously skipped downstream gates must execute. No source edits, merge or additional local browser/heavy tests by this reviewer. Independent agent evidence, not non-author GitHub approval.

[mvalancy]

Independent artifact review of b33febb8c80fe28ef2960d3b799b7c9a311b4c25, CI40731080444: integration blocked by a real control-layout regression, detailed inline.

The actual durable-layout report has4 passing cases and5 actual failing cases, plus the runner's execution-failure record. All five fail on normal pointer clicks because the new relationship Browse button intercepts the layout retry/discard controls. Screenshots show the overlap; the buttons themselves are visible, enabled and stable. This is not a reason to raise timeouts, force clicks or weaken storage assertions. A shared responsive bottom-control layout needs to reserve non-overlapping space, including the recovery/status footprint; overview Connections has the same bottom-left anchor and should be considered in the correction.

I downloaded the289MB artifact once and verified SHA256 c52d20e7068541ac97c6043632a9e914544a1e6a874982e1080d76be69af75dc. The eight actual reports identify clean, unchanged tested merge 7eb3b6085282c53b5a48ce806bd1e35bf21424c8, fingerprint 43c1ce5d3118751da82bf8c2d34854699fbf735aa3f8d7ebfa50967427a18c0c. Static4, smoke6, item consumers5, scale1, new-user42, semantic2 and nested2 pass. This confirms the prior hidden-gear consumer correction. Route/mobile/living-effects/performance stages were skipped after the durability failure and are not accepted.

Evidence root: /tmp/graphdone-resolution-20261027/pr223-independent-b33febb/. The verified archive is in archives/; extracted report is artifacts/smoke-results-7eb3b6085282c53b5a48ce806bd1e35bf21424c8/test-artifacts/ci-layout-recovery/report.json. Its assets/layout-recovery/{0,2,4,6,8}.png screenshots and {1,3,5,7,9}.zip traces preserve the five failures. durable-failure-proof.json records counts, provenance and errors; raw job log is retained. No local browser/matrix, source edits or merge by this reviewer. Fresh corrected-head source review and full applicable CI remain required.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Independent exact-source review of fe8497336fdf4a73875a3765d435dd8dad2ead70: the shared flow removes the observed Browse/Retry/Discard overlap and the relationship-panel click boundary addresses the Edit→Create event propagation. The retained focused tests cover the original pointer failures and exact editor identity without weakening their assertions. One additional P2 interaction-boundary finding is reproduced inline.

The exact GraphStatusDock and LayoutSaveStatus components, combined with the production D3 zoom filter and real D3 wheel handling in a small DOM probe, cancel a wheel over recovery status and change graph scale1→0.8705505633. The dock is now scrollable, but its status/gaps do not match the SVG zoom filter's control exclusion. Adding only the existing control marker in the scratch DOM leaves default scrolling uncancelled and scale at1. This needs an explicit dock interaction boundary and an actual overflowing short-viewport scroll/camera regression.

Evidence: /tmp/graphdone-resolution-20261027/pr223-independent-fe84973/dock-wheel-probe.{cjs,log}; approximately1.2s, no browser/service. Retained local3/3/1 runs36.7/42.2/25.3s and source tests were inspected, but do not establish final integration acceptance. The author has prepared a follow-up; I will review its exact source separately. No source edits or merge by this reviewer.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Independent exact-source correction review under the cad-pr-reviewer skill: source 38a5e02d38642aaa122effe504e2f3c4c4113aad, live dev 058aaa70befa17a45b5a6b864c1c674ea8a173c1.

The wheel-event finding in review 5687245248 is corrected. My lightweight probe renders the actual GraphStatusDock and LayoutSaveStatus from this commit, uses the actual production filter and real D3 zoom, and dispatches a wheel event over the status paragraph. On fe84973 it prevented the default and changed scale 1 → 0.8705505633. On this head it leaves defaultPrevented=false and scale=1. Evidence: /tmp/graphdone-resolution-20261027/pr223-independent-38a5e02/dock-wheel-probe.{cjs,log}. No browser or database was started by this review.

I inspected the complete ten-path b33febb→38a5e02 correction and the three-path fe84973→38a5e02 follow-up. Shared flow removes the competing status/trace/connection anchors; actual children retain obstacle markers; the relationship browser owns its click boundary, preserving the selected edge when opening Edit. The short-viewport regression requires overflow, uses an ordinary wheel event, checks scrolling and an unchanged camera, then normally discards and verifies receipt removal. Existing recovery/camera/API assertions, timeouts and retries remain. The retained local log records the amended case passing in 15.7s; this is scoped evidence, not a full CI result. Guidance records the prior failures and does not change integration authority.

No additional blocking source finding in this bounded correction review. Provenance is consistent: GitHub test merge e2acb536db27f94cad569652b0cdceea73679f3e has the live dev and exact source as parents. Its full tree cde930ddfbd0a32e9bc351d85e6e45cf8445e378 equals both the source tree and my local merge-tree result. All other tracked content is unchanged from the preceding reviewed composition.

Integration remains pending, not cleared by this comment. CI 40739506062 is still running; Comprehensive 40739506204 is successful. Final actual reports, image/runtime and browser artifacts and source fingerprints still need inspection, followed by post-dev validation after any authorized merge. The failed aaa/b33 runs remain rejected evidence. This does not establish universal card/overlay clearance or finish item routing/priority work tracked separately in #220. This is independent agent evidence, not a non-author GitHub approval.

[mvalancy]

Independent bounded follow-up review under cad-pr-reviewer: exact source 69d0493df1eb48e1190a46b8ea83e3f37f13b1ee.

No blocking finding in the two-path delta from 38a5e02. RadarChart's temporary measurement text and painted axis text now both use 14px/500; numeric ticks use 14px/500/0.9 opacity. This preserves the existing background sizing calculation and does not change data, chart geometry, or event behavior. I inspected the complete component and the lesson, proved the preview component byte-identical to this commit, and viewed the retained Dashboard screenshot. The lesson correctly limits the reported 29-label observation to the owned 64-item preview at normal chart zoom; I am not extending that to responsive layout or manual zoom acceptance. Every other tracked path is unchanged from the preceding reviewed composition.

Live dev remains 058aaa70befa17a45b5a6b864c1c674ea8a173c1. GitHub test merge 6ccda3f1f7e9919090d806404659f92caf8b83f6 has that base and this exact source as parents. Its tree, the source tree and independently computed merge-tree all equal 6d7629392bb98a09e33e44232941a3933d0f231b.

This is source-review clearance for the bounded correction, not final integration clearance. The earlier 38a5e02 runtime/static evidence is retained but is not acceptance of this runtime change. CI40742791571 and Comprehensive40742791524 must finish, with actual final artifact/provenance inspection, before integration; post-dev validation remains required afterward. No local browser/database or heavy suite was started by this review. Independent agent evidence is not a non-author GitHub approval.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Independent final evidence review under cad-pr-reviewer: no remaining blocker to dev integration of exact source 69d0493df1eb48e1190a46b8ea83e3f37f13b1ee onto live dev 058aaa70befa17a45b5a6b864c1c674ea8a173c1, within this PR's stated scope.

CI 40742791571 and Comprehensive 40742791524 completed successfully. I inspected actual jobs, logs and artifacts, not just their badges:

• Eleven strict reports contain 108 passed cases: static visual 4, smoke 6, item consumers 5, 2,000-item zoom 1, new-user 42, semantic LOD 2, nested LOD 2, durable layout 9, routes 7, mobile 27, performance 3. Every sequence is blocking, exits 0, has no timeout/evidence error, and reports zero failed/warned/skipped cases. All 72 referenced attachments exist and are nonempty. The separate living-effects step records 3 passed in 50.3s.
• Every strict report records the same clean, unchanged tested merge 6ccda3f1f7e9919090d806404659f92caf8b83f6 and fingerprint 192a1b893e3daa438d544f5016e7a8c231cf9bf4c49eb4b34107014df12451f3. The complete smoke ZIP SHA-256 is 5e763a2644e0dc48667e7e7419122a9045fb6e8c976cc6f98141057dc8e5b73b; all six downloaded archives match their API digests and sizes.
• The actual 2,000-item/5,000-edge report records 17.082s load and browser zoom times 2.302/3.140/2.092s, with runner wall times 3.138/4.212/2.972s retained separately. Both detail stages have 3 painted cards and 1 admitted label; there are no attempted writes or page errors. The held-pan reveal geometry fits. This validates the revised browser-content timing contract, not a claim that the earlier failed wall-time runs passed.
• I viewed 27 screenshots, including all four static fixtures, all six nested overview/outgoing/incoming captures, all five large-graph captures, and selected desktop/phone item, 301-node LOD and mobile UI captures. The six nested geometry records have painted paths, no small-text violations, zero crossing/overlap/card-intersection/diagonal metrics, and truthful 51/50/1 drawn counts out of 183. Seventy-one measured item-text samples meet the 14px screen floor. The delayed-visibility negative evidence retains the 1.2s delay.
• Node 22.18 and 24 each pass 807 unit cases with 26 explicit database-gated unit skips; the separate real-Neo4j contract passes 9. Harness 198, routing geometry 9, executed toolchain contracts 3, types, lint, build/bundle and production dependency audit pass.
• All three actual final-image initial/replacement contracts pass API, CAPTCHA, compiled MCP, independent Neo4j readback, native SQLite and volume recovery checks. Contract, inventory and Trivy image IDs match. API/generic scans have zero findings; self-host retains the documented 162 OS findings (43 high/58 medium/60 low/1 unknown), zero critical and zero npm findings. This is not release/security clearance.

I re-read the live base and remote PR head and verified the test merge's two parents. The source, tested merge and independently computed composition tree all equal 6d7629392bb98a09e33e44232941a3933d0f231b. All 10 review threads are resolved. Earlier failed and superseded runs remain rejected evidence; the final nine recovery cases now pass after the shared-dock and wheel-boundary corrections.

Evidence is retained at /tmp/graphdone-resolution-20261027/pr223-independent-69d0493/: smoke-proof.json, runtime-proof.json, static-proof.json, visual-proof.json, archive-proof-final.json, final-provenance.json, raw logs and downloaded artifacts. No local browser/database or heavy suite was started by this audit.

Limits remain explicit: straight item wires can cross, minimap occlusion remains visible in the diagonal full-card capture, and this does not establish universal overlay clearance, responsive/manual radar zoom, 10k loading, hosted parity or release readiness. Item routing/priority work remains separate under #220. The main/nightly production-stack job is outside this dev-PR gate. Any base/head movement requires composition recheck. After an authorized dev merge, verify its parents/tree and pass actual post-dev CI before closing #222. This is independent agent evidence, not a GitHub non-author approval or a merge.

[mvalancy]

Independent styling follow-up for exact source 69d0493df1eb48e1190a46b8ea83e3f37f13b1ee: no new source blocker.

The retained CI build logs identify generated production CSS (index-1793211162723.css, 214.66 kB), but none of the six uploaded artifacts contains the production CSS bytes or a network trace with those bytes. The existing explicit SVG font checks do not establish every Tailwind utility. I therefore do not claim retrospective byte-level verification of CI-produced CSS.

I executed a lightweight fresh PostCSS/Tailwind compile of the exact committed config and input CSS, with a clean unchanged source checkout and tool versions verified against this commit's lockfile: Tailwind 3.4.19, PostCSS 8.5.28, autoprefixer 10.4.21. It completed in 1.37s and emitted:

• .text-xs { font-size: 0.875rem; line-height: 1.25rem }
• .font-normal { font-weight: 500 }
• .font-medium { font-weight: 600 }

Evidence: /tmp/graphdone-resolution-20261027/pr223-independent-69d0493/fresh-postcss-proof.json, fresh-postcss.css, fresh-postcss.log, and the reproducible compile-tailwind-proof.cjs. No source edit, Vite build, browser, database or service was started by this check.

This supports the intended source/generation baseline alongside the fresh CI build/startup and actual artifact review. The long-running preview's stale configuration, corrected by its owner through restart without source changes, is separate evidence and must not be counted as earlier all-app computed-style validation. Final review5687953453 remains clear for the bounded dev integration; its explicit remaining limits and post-dev validation requirement are unchanged.

[mvalancy]

Independent post-dev closeout audit under cad-pr-reviewer: no remaining blocker to closing #222 for the scoped work delivered by #223.

I verified actual dev merge 4a6d75d24ee664a0357aa124168f39c410625902: parents 058aaa70befa17a45b5a6b864c1c674ea8a173c1 and reviewed source 69d0493df1eb48e1190a46b8ea83e3f37f13b1ee; complete tree 6d7629392bb98a09e33e44232941a3933d0f231b equals the reviewed/tested composition. Remote PR metadata confirms the merge into dev; live dev still points to that commit. This verifies the resulting administrative integration, not a non-author approval.

Post-dev CI 40749343162 and Comprehensive 40749343433 both completed successfully. Actual retained evidence:

• Eleven strict reports: 108 passed, zero failed/warned/skipped cases, timeouts or evidence errors. Counts are static visual 4, smoke 6, item 5, large-graph 1, new-user 42, semantic 2, nested 2, recovery 9, routes 7, mobile 27 and performance 3. Every sequence is blocking and exits 0. All 72 referenced attachments exist and are nonempty.
• Every strict report starts and finishes clean on 4a6d75d, unchanged, with fingerprint 204d3acf58d149b9fb357c90d9e5c1e077e39861fa3823d0a80183c42ab0d4b7. All six archives match GitHub's digests/sizes. Smoke archive SHA-256: cdbd099597fd3b074df928623468184c3004683e4ccb38ed48d20572a6a81cfd.
• Actual 2,000-item/5,000-edge case: load 27.996s; browser zooms 3.081/4.107/3.089s; wall times 4.355/5.665/4.662s. Both detail stages contain 3 painted cards and 1 admitted label; attempted writes and errors are empty. The wall result above 5s is retained explicitly: this passes the established browser-content timing contract, not the superseded wall-time boundary.
• Checked the 27-key-image set through direct inspection or exact byte identity with previously inspected captures; 16 post-dev images were viewed directly, including every differing image and all five large-graph captures. Six nested geometry records again show zero clutter violations, painted paths and truthful 51/50/1 drawn counts out of 183. Sixty-nine measured item-text samples meet 14px. No new visual blocker; known minimap occlusion and straight-wire crossings remain.
• Node 22 and 24 each pass 807 units with 26 explicit database-gated unit skips. Separate real-Neo4j 9, harness 198, routing geometry 9, build/types/lint/production audit and required toolchain checks pass. The raw living-effects step records 3 passed in 53.1s.
• All three post-dev final-image initial/replacement contracts pass startup/API/CAPTCHA/MCP/independent DB readback/native SQLite/volume recovery, with matching contract and scan image IDs. API/generic scans have zero findings. Self-host retains 162 documented OS findings (43 high/58 medium/60 low/1 unknown), zero critical and zero npm findings.

Full evidence: /tmp/graphdone-resolution-20261027/pr223-postdev-4a6d75d/, including strict/geometry/visual/runtime/static proofs, archive digests, raw logs and downloaded artifacts. Earlier failures and superseded runs remain separate, rejected evidence. No local browser, database, full matrix, source edit or merge was performed by this audit.

Two evidence boundaries remain explicit. CI did not retain production CSS bytes; the exact-source locked-tool compile separately verified the intended Tailwind utilities, as recorded in review 5688035698. Also, source history confirms the saved-card collision repair and settle/pagehide persistence policy predates this PR (4bff35c2); this PR's measured card geometry can change repair eligibility. The owner's copied localhost fixture therefore is not unchanged-position display evidence, and its 164 repaired copy positions must not be generalized to the original graph or claimed to occur identically under old dimensions. Fresh IDs also affect the repair's stable sorting. This is a documented existing-policy limit, not a newly demonstrated #222 blocker.

Item routing/priority and broader graph work remain under #220 and their own reviews. This closeout does not establish universal overlay clearance, unchanged coordinates for arbitrary colliding saved layouts, 10k loading, manual radar-zoom coverage, hosted parity or release readiness.