archy/Release & Testing/Detailed Plans/08-UAT-Closure-Checklist.md

Sanitized detailed source transcription S08, captured 2026-10-24. Original planning steps, acceptance criteria and historical evidence are retained rather than condensed. Read current context and precedence first: dated holds, approvals, test counts and “latest” labels below belong to their original checkpoint and do not grant current execution/publication authority. Privacy replacements preserve roles and test semantics. See section coverage.

Full-plan UAT closure checklist — current execution control

2026-10-17. Scope derives from 03-Tasks-T00-T29.md T00–T29, ledger.json and 05-Guarded-Installed-UAT.md; this does NOT replace or narrow the approved plan. Latest instruction: do not stop for a year unless finished sooner, toward full-plan UAT within actual runtime limits and existing authority; uninterrupted/background execution is not guaranteed. Full-plan UAT NOT READY. No completion percentage/date is asserted.

Definition of done

Every mandatory scenario must have: requirement/task mapping; accepted exact component source; independent review where required; passing source/integration evidence; immutable compatible artifact manifest; rehearsed nonempty migration/rollback; authorized installed/served parity; applicable multi-node/physical/operator acceptance. Known failures stay open. Source builds, healthy services and synthetic browser fixtures cannot substitute for installed acceptance. A feature may be excluded only by an explicit scope decision, not by this checklist.

Latest qualification: backend 1394/1394, 92 suites, zero skips, complete compilation/full isolated media PASS. Internal actual RSS save state/receipt/immutable required-intent composition qualifies with explicit public server binding (57 DB/service, 48 binding cases). Receipt effects are NOT delivery acknowledgements; no profile loader/attempt ledger/dispatcher/HTTP save API/editor. Public labels/URI syntax do not prove provider/credential/DNS/entitlement authority. Missing binding and queue cleanup refuse. Migration 1791374414000 uninstalled. First full run caller timeout NOT passed; final completed run's labeled fixtures empty. Latest packet [private evidence label: project-save-effects-20261018.] Prior cleanup qualification: Real PostgreSQL/Redis stale-master-cleanup race corrected using original correlation/file/DRM filtering; actual-media focused 230/3. Not durable cancellation/generation CAS or generic/trailer cleanup coverage; packet [private evidence label: legacy-cleanup-race-20261018.] Two-token invalidation across 20 business tables plus internal authority signal, shared-manager preparation and conditional admission/snapshot primitives have 21 substrate, four owning-preparation and 16 observation cases. Reproduced identity lock inversion corrected. Legacy negative characterizations still demonstrate stale overwrite/root-timestamp gaps. No HTTP save-command/receipt/outbox/editor protocol or API nonce exposure yet. Frontend 729/729, 84 files, typecheck and explicit /api + /relay build PASS. Persisted backend namespace and mounted creation-command recovery are source-qualified; actual browser dropped HTTP reply/reload and two-tab flow PASS through production callers/Axios with synthetic API/auth/DB. Not authenticated-backend/installed acceptance. Core prior 1606 frontend and 2080 backend/5 explicit ignores is retained, not freshly rerun. These are source evidence, not task closure. Installed app predates extensive source changes; prior operator PASS was withdrawn. All task deployment_ready flags remain false.

Mandatory closure rows

Status: OPEN means no current full exit proof; it does not mean no implementation exists. Owner roles below are needed owners, not fabricated assignments or approval.

Task	Required user-visible result / closure evidence	Current remaining work or gate	Responsible role
T00	Exact accepted app/core sources; all requirements accounted for	App accepted provenance, credential rotation/history remediation and remote authority unresolved. This task map is reconciliation, not acceptance.	Repository/security authority + coordinator
T01	Reviewed identity, payment, media and ownership contracts	Independent high-risk review; explicit feature-local policy decisions remain	Independent reviewers + policy owner
T02	Reproducible compatible artifact/backup/rollback path	Freeze accepted source, finish candidate-specific preflight and nonempty rehearsal; no dirty-source deployment	Coordinator, after provenance/review
T03	Original UI; native sign-in/swap/logout with matching identity	Source guards qualified; provider notification correlation and current installed/native/device acceptance open	Implementation + native contract owner + operator
T04	Backstage Cloud/computer selection, save/reopen, processing/retry; old media retained	Whole-save revision/CAS/outbox and mixed payloads remain open; narrow explicit Save Draft, atomic initial creation and two-worker/postcommit media schedules now qualified. Actual installed Cloud and complete computer transfer still required	Implementation + reviewer + operator
T05	Publish, late unrelated-node discovery, update/withdraw; no private access	Cooperating browser journals qualified narrowly; accepted artifacts and approved P/B/unrelated-C discovery remain	Implementation + reviewer; publication/peer authority
T06	Cross-node discussion/replies/counts, offline catch-up, legacy preservation	Source/loopback outbox evidence; actual B→C→P acceptance and approved public/private event scope absent	Implementation + operator/peer authority
T07	All offered native/external payment rails with consent and exact recovery	Remaining durable terminal operation IDs/instrument validation; complete isolated rail integration, independent review; funds only with fresh cap	Implementation + financial reviewer + spend authority
T08	Paid-ready/watch-later, once-only first play, expiry/renewal and original receipt recovery	Complete concurrent/terminal/restart policy qualification and installed protected-path acceptance	Implementation + policy/review owners
T09	Actual FIPS-only playback, seeking and recovery without repayment/fallback	Immutable legacy source evidence is not native FIPS acceptance; actual installed transport/decode and controlled load open	Implementation + FIPS reviewer + operator
T10	Creator-authorized replica failover and bounded resource use	Replica policy/retention/quota authority and complete acceptance unresolved	Policy owner + implementation
T11	Nonempty jobs/drafts/comments/financial state survive managed upgrade	Reviewed compatible migration/worker/frontend cohort; source migrations uninstalled; rollback and artifact parity required	Coordinator + migration/financial reviewers
T12	Cloud paid-file recovery, exact bytes, fees/reorg and no repayment	Reconcile historical evidence against candidate; fresh isolated + installed regressions and scoped physical checks	Implementation + financial/operator authority
T13	Independent Nextcloud/Immich browse/preview/download	Current candidate workflow evidence must be reconciled; do not infer from app frontend tests	Core implementation + operator
T14	Explicit public file/folder and private multi-file Mesh delivery	Source inventory/partial recovery/receiver exact-byte and permission evidence; public/hardware scope separate	Core implementation + publication/operator authority
T15	Shared media/background controls; actual-track artwork last	Physical Android/background/headset/PiP/recreation and artwork acceptance unresolved	Core/companion implementation + hardware operator
T16	Requests, Fleet, sync, final connection/map UX	Fresh candidate convergence/replay/outage/mobile scenario matrix not closed	Core implementation + peer operator
T17	Useful-data latency, HTTPS/session reliability, monitoring and AI setup	Candidate measurements, companion acceptance, provider/allowance tests; paid inference separate	Core implementation + operator
T18	Standard MeshCore two-way public-message interoperability	Captured-device [private evidence label: physical] RF acceptance and authorization; no hardware inference from fixtures	Core implementation + hardware/RF operator
T19	Safe firewall/tunnels/HTTPS/public routes with rollback	Effective candidate configuration/IPv4+IPv6/actual trust checks; network mutation/exposure gated	Core implementation + network authority
T20	Lifecycle/container/store and named-app regressions without data resurrection/loss	Reconcile and execute the itemized original master regression rows; no blanket pass from historical installs	Core implementation + coordinator
T21	Packaged terminal/tooling/starter app and truthful discovery UI	Actual package/companion input/generated app checks; no mock listings	Core implementation + operator
T22	Frozen integrated candidate, full matrix and soak	Depends on prior mandatory exits; no accepted frozen integrated candidate exists	Coordinator + independent reviewers
T23	Fresh x86 install, real upgrade/OTA/APK/reboot and final operator UAT	Current served artifact must match reviewed work; installed/physical/operator sign-offs missing	Authorized coordinator + operator
T24	Exact release-owner handoff/metadata/provenance	Follows T23 for release; read-only metadata diagnosis may proceed earlier. Merge/tag/sign/publish separate	Release owner
T25	Bounded chunked ecash streaming with honest spent/reserved/remaining	Chunk/rate/seek/session policy, atomic reservations and complete isolated Cashu/FIPS integration; no invented defaults	Implementation + policy/financial reviewers
T26	Original zap UI, supported rails, separate exact tip receipts/totals	Terminal recovery/instrument and anonymous attribution gaps; all-rail independent qualification	Implementation + financial reviewer
T27	Networking Profits reconciles unique confirmed/pending receipts	Source denomination separation exists; full native streaming/tip integration and installed ledger reconciliation open	Implementation + financial reviewer
T28	Correct Mesh sender/body/audio replay from actual reported frames	Minimal captured examples/meaning of replay and actual device acceptance unresolved	Core implementation + operator
T29	Public guest context isolated from owner credentials/bridges	Threat model and exact-artifact independent security/guest payment/media tests; exposure default OFF	Security reviewer + exposure authority

Executable critical path (not an endless audit queue)

1. T04/T09 media schedule exit DONE at source level. Both concurrent same-source/DRM completion orders and postcommit/preACK SIGKILL/natural BullMQ recovery pass with real PostgreSQL/MinIO/Redis/FFmpeg. Original and committed render hashes/keys/decode/rental references survive. Not exactly-once, mixed-version safety, native FIPS or installed acceptance. Evidence: [private evidence label: RUNTIME-AND-REVIEW.md.]
2. Current source target — T04 save/reopen consistency: complete whole-save writer inventory and the exact revision/transaction/durable-effect contract. Explicit Save Draft is now enrolled for the narrow root/existing-film/existing-episode metadata subset without stripping status; five baseline failures fixed, rollback/revocation/RSS compatibility qualified. Atomic initial creation is qualified (18 cases, ten baseline failures corrected); persisted original creation identity and recovery are now implemented at source level. PROJECT-WRITER-INVENTORY.md records 130 static candidate mutations in 16 files plus manual lifecycle/cascade boundaries. Backend creation-command/immutable receipt recovery is now qualified, including real dropped HTTP reply and reconstruction. New route is default-off and migration 1791374411000 uninstalled. Self-hosted UI now uses journaled command recovery without legacy fallback. DB namespace/actor binding, pre-dispatch persistence, mounted recovery and enabled-mode old-route refusal are qualified narrowly. Source-only migration 1791374412000 now adds the UUID invalidation substrate, including identity/member relationships and explicit counter exclusions; no API exposes/accepts it yet. Internal two-token admission and preparation now compose state/receipt/required RSS intent with an explicit public server binding; migration 1791374414000 adds immutable slots/intents and deferred completeness. Missing binding and queue cleanup still roll the whole save back. No delivery/provider authority, HTTP or editor offer exists. Next: durable attempt/ambiguous-outcome recovery, verified default-off profile/credential transport, exact cleanup identity, API/client recovery, writer/reference/entitlement/lock reconciliation and reviewed coherent cutover. Latest packet: [private evidence label: project-save-effects-20261018.] See PROJECT-REVISION-CONTRACT-PROPOSAL.md and [private evidence label: edit-revision-substrate-20261017.] See [private evidence label: RUNTIME-AND-REVIEW.md]; no installed/authenticated-backend end-to-end acceptance claim. Other statuses, media/nonempty permissions and durable delivery remain open. Do not expand optional episode UI while core save guarantees remain open.
3. T07/T08/T26 terminal recovery: finish durable original operation identities and instrument/proof validation under isolated synthetic/provider fixtures. Do not enable unreviewed payment choices or use real funds to debug.
4. In parallel, release-gate preparation T00/T01/T02: prepare a bounded source/review/remediation manifest and nonempty package rehearsal inputs. Owner/reviewer decisions below block acceptance/delivery, not the above source work.
5. Reconcile core lanes T12–T21/T25/T27/T28/T29 against their exact existing evidence. Mark missing current qualification explicitly. Do not let recent app hardening stand in for these requirements.
6. Freeze only after the requisite exits/reviews; then authorized installation and T22/T23 scenarios. Never deploy unfinished dirty source to make the UI appear current.

Decisions requiring real authority (prepare concurrently; do not self-clear)

• Repository/security owner: accepted IndeeHub proposal/ref and review disposition; credential revocation/rotation and approved historical-source remediation; authorized private integration destination/access. These block accepted source and publication, not local tests.
• Independent review owner: actual reviewers/dispositions for identity/permission, payment, FIPS, worker/migration/retention changes. Coordinator packets are preparation only.
• Feature policy owners: chunk/rate/seek/session ceilings; confirmation/reorg/fee rules; replica retention/quota; public guest threat model; permission/ownership mutation. Each blocks its dependent behavior, not all development.
• Installed/physical operator: approve the exact frozen candidate, writer drain/restart/backup/rollback scope and named node/device scenarios when ready. Funds, public events, second-node/RF/network changes need their own scope/caps.

Execution rule

New hardening work must cite a closure row and a concrete failure/mandatory negative case. Unrelated opportunistic audits go into follow-up inventory rather than indefinitely displacing delivery-critical gaps. A passing slice does not end execution. At a real context/execution limit, preserve exact failures/results and the next executable command; do not claim background work or UAT completion. This checklist itself clears no gate and narrows no requirement.