archy/Release & Testing/Detailed Plans/14-Non-IndeeHub-Detailed-UAT.md

Sanitized detailed source transcription S14, captured 2026-10-24. Original planning steps, acceptance criteria and historical evidence are retained rather than condensed. Read current context and precedence first: dated holds, approvals, test counts and “latest” labels below belong to their original checkpoint and do not grant current execution/publication authority. Privacy replacements preserve roles and test semantics. See section coverage.

Non-IndeeHub UAT ticklist — 22 October 2026, 20:50 UTC

Scope: non-IndeeHub only, per the operator's explicit correction. This lane owns the35 retained platform requirements (B01–B10,C01–C10,D01–D11,E01–E04) and eight named apps. No IndeeHub implementation or acceptance is included below. Full non-IndeeHub guarded UAT is NOT READY. Checked entries are named qualified sub-exits, not whole-app completion.

18:13UTC23October D09 metadata-failure rollback qualification

• eb2958377/0361f58a/d5 exact cached fault+transport test PASS16.06s under e82e99+b4b3d7: actual persistence/successful-rollback context, only newly created session removed, old sentinel/record/session preserved, original native/browser1440/390 matrix retained. Screenshots inspected; new runtime/raw/outer0, fresh inventories equal, exact CID/parent/PIDs absent; release58c11f5a. CHECKPOINT-20261023-METADATA-ROLLBACK.md binds evidence.
• Compiler exit0 is separate from its FAILED outer inventory guard, actor unknown; no erasure/retry. Source default workspace/sandbox risk, actual disposable package readiness, installed behavior and independent acceptance remain open. This is not wholeD09/UAT completion.

16:05UTC23October D09 actual-handler disposable integration

• Exact7348b9b8d compiled and ONE real browser/production HTTP-WebSocket/private tmux test passed; native auth/origin/creation/input/resize/history/reconnect/dead-session refusal and browser existing-session fresh execution/reconnect/history.1440/390 scrolled history screenshots inspected; raw/outer0 and owned cleanup/fresh inventories verified. See CHECKPOINT-20261023-TRANSPORT.md; release06eb87c6. No Cargo/image/Cloud rerun.
• Installed login/browser-driven creation/tools/shell/keys/process ownership/reboot, Companion/device and independent acceptance remain. Not wholeD09/UAT. Earlier inventory failures remain retained separately; subsequent clean baseline does not erase them. Earlier dated pending statements below are historical.

11:50UTC23October D09 bounded-history correction

• Localbea78231c: real private-tmux red proves visible-only capture loses lines0–76 while tmux retains them; corrected bounded1000-line capture restores available history without blank padding and caps1200-line overflow. Owned server/child cleanup passes.
• Actual production xterm/browser100-line scrollback, replacement and same-session reconnect without duplicate history; visible scrolled renderer at1440/390 and prior lifecycle matrix pass. Exact inputs/failures/screenshots retained in [private evidence label: terminal-scrollback-20261023].
• Backend compilation/actual handler transport, installed/native auth/tmux/tools/process/reboot, Companion/device and independent acceptance remain. This is not wholeD09. Earlier full suite/build still qualifies parent60959931d, not a rebuilt backend atbea78231c. See CHECKPOINT-20261023-1150.md.

10:24UTC23October D09 terminal qualification sub-exits

• Candidate60959931d: late list/create cancellation, stale socket rejection, single-flight create, bounded same-session reconnect/policy refusal, real renderer reattachment after closing/reopening, and corrected390px panel bounds.
• Actual xterm buffer/keyboard input/resize + actual synthetic HTTP/WebSocket lifecycle at1440/390; delayed replies, created-session recovery without POST replay, visible reopened renderer and geometry pass. Real mobile-overflow and invisible-renderer failures retained.
• Ten terminal regressions, full1745frontend/215files+typecheck, matching production dashboard39b5d988… and three runner-contract checks. No installed shell/session changed. CHECKPOINT-20261023-1024.md preserves exact evidence.
• Full scrollback protocol, native authentication/installed tmux/tools/process ownership/reboot, Companion/device and independent review remain; not wholeD09 or full-UAT closure.

09:36UTC23October D11 implementation/qualification sub-exits

• Candidate29720c13e: signed hardware event/hash/Schnorr validation, deterministic replacement, author-bound event/address withdrawals, expiry/nonmatching suppression and real source details/Nostr links. No checkout or seller/hardware endorsement.
• Stale request/category/deactivation cancellation; truthful config/relay/empty states; named shared modal/Escape/focus restoration/44px controls/wrapped source identities.
• Final1735frontend tests/214files and typecheck; matching production/PWA dashboard803f271a…; no production demo-listing IDs/sellers. Earlier failed full-suite/mock/timeout preserved.
• Actual production component + real WebSocket to synthetic signed relay at390/1440: signatures/tampering/subscription/deletion author binding, details/link, accessibility controls and fault/recovery checks. Exact evidence CHECKPOINT-20261023-0936.md.
• Independent review (new narrow dispatch noACK, not active/passed), actual configured public relay/external handler, installed/native/device and independent visual acceptance. Bounded snapshots do not prove complete public-relay history or availability. WholeD11 and whole-UAT remain open.

01:00UTC23October D10 additional sub-exits

Clean4f7314bb7: real standalone generator6tests/no-overwrite receipts; generated manifest passes;5browser-local persistence/error tests; Chromium create/reload/corrupt-data preservation+320/390/1440/44px checks PASS (reproduced/fixed320px long-name overflow). Exact locked clean offline install/build byte parity; actual final-stage packagedUID101/readonly-root/16MiBtmpfs/own entrypoint/config/assets/recreation PASS. No frontend rebuild for packaging. Full D10 design/accessibility, managed/physical/embedded and any approved server-persistence requirements remain OPEN; no whole-row/eight-app closure. See CHECKPOINT-20261023-0100.md. Specific manager4faa99 maintenance-idle request now applies for supported same-session wrap; not a product-wide hold. Total remaining execution/calendar unestablished23Oct; no numerical forecast change.

23:59UTC additional completed sub-exits

• Cloud list/grid document click and menus now use guarded authenticated/cancellable download. Actual source Vue/Pinia/Chromium exact-byte saves, server-observed cancellation, redirect refusal and viewer save pass. Coherent frontend integration1714tests/212files+production dashboard build PASS atd53eb2c35; artifact retained, not deployed.
• Qortal fresh-start failure isolated to empty executeBatch; original pinned-library red and candidate empty/idempotent/nonempty green probes pass. One-class test-only overlay passes actual fresh Core/nginx startup/recreation/auth/key/settings preservation without initialized/preseed fixture. Source222c8f4f7, not approved upstream replacement or released package.
• Qortal candidate source/provenance/independent review, clean compatible packaging, nonempty upgrade/rollback, network bootstrap/gateway and installed lifecycle remain. Original official JAR is unchanged and still has the defect. See CHECKPOINT-20261022-2359.md for exact artifacts/failures/timing. No whole-app or B05 closure, no aggregate ETA/date inferred.

22:33UTC additional completed sub-exits

• Actual signed2GiB Blossom upload/recreation/exact bytes and default16MiB/auth boundaries pass. Same package then passes actual Podsteadr wizard17MiB→free episode→reload→exact bytes; synthetic signer, not playable-media/native/manager acceptance. Receipts [private evidence label: blossom-upload-20261022] and [private evidence label: podsteadr-wizard-20261022].
• B05 raw-file login-redirect download defect fixed;43focused tests/typecheck and actual Chromium refusal+genuineHTML exact-byte preservation pass ([private evidence label: filebrowser-download-20261022]). NonredirectingSPA fallback, save/cancel, menus and installed/native boundary remain open.
• Podsteadr managed key provisioning/rotation/start order/migration/lifecycle and independent review remain. Upload-size isolated protocol/wizard work is no longer outstanding; no catalog activation. Current compact handoff CHECKPOINT-20261022-2233.md; no whole-app/platform-row completion claimed. Blanket audit hold lifted. Timing basis unchanged: total/date unestablished, no human-hour estimates.

Latest completed sub-exits — albums and Podsteadr manifest preparation

• Implemented read-only account-authorized Immich album inventory/filter and production selector. Existing asset-only keys still work; removed/foreign/unpermitted album IDs fail rather than silently browsing all assets. Selection/page/account changes cancel stale work.
• Actual Immich API AND production UI→Rust/RPC album workflow pass on7b73f9291: private/empty selection, membership/permission refusal, album removal with original asset preserved, original/range/preview/reload/revocation. Focused Cloud source31PASS/1ignored; actual browser48.51s. Matching Nextcloud24.99s with SAME new binary passes. Not installed/native/full B03.
• Album frontend1704tests/212files and typecheck PASS; production dashboard artifact built. Earlier ES-target test error and sandbox output-path build failure retained. No full-suite repeat after successful tests. Refreshed browser image837558b5… built offline from exact dependency-matching base after initial offline apt rebuild failed.
• Corrected fixture-only Podsteadr three-manifest generator, explicit public service-key input, safe config/bridge/data paths and no root copy/chown hook. Immutable nonroot MediaMTX wrapper7d612f2b… actual media/recreation PASS. Canonical parser and88 container tests PASS atbd143f197; contributor preflight PASS after output-layout correction. Generated files remain OUTSIDE catalog and are not installed.
• Podsteadr first-start/service-public-key provisioning/rotation, data ownership/migration/manager VM and16MiB-vs2GiB upload contract remain open. Explicit fixture binding is not an approved automatic provisioning design.

Exact new receipts: [private evidence label: immich-albums-20261022] and [private evidence label: podsteadr-manifests-20261022]. Remaining aggregate AI execution estimate/date still source-unvalidated22October; B1 is model allowance, not countdown. External review/provenance/trust/device/operator/deployment waits unknown. New real sub-exits do not imply whole-scenario or numeric-ETA credit.

Earlier resumed checkpoint — Immich standalone exit and paired preparation

• Portable immutable-image Immich2.7.4 composition: accounts/API permissions/upload/private ownership/exact original/range/generated preview/upstream revocation and other-account survival. Strict actual three-service mount/network/resource/capability inspection passes at source2bec541fc, r9 18:13:48–18:15:59Z exit0.
• Prepared source/compiler/runtime/binary-bound compile-first harness; fake-engine15+8+7 tests pass. This is NOT a Rust/browser or independent-review exit.
• Actual production Cloud component→Rust/RPC→Immich passes oned21d4da9: account isolation, exact original/range, generated preview, view-only permission transitions, same-account credential replacement, reload, session/origin/CSRF refusal, upstream-key and local-disconnect revocation. Compile18:27:37–18:52:25Z exit0, peak7302017024bytes/8GiB,no compiler swap; actual browser18:53:10–18:55:12Z exit0,22.30s test. Bound artifactb828c1d9… retained. Synthetic initial session/runtime binding, not installed/native/album acceptance.
• Matching Nextcloud production browser/RPC regression with SAME binary/source, no recompile:18:56:36–18:58:02Z exit0,24.39s test; upstream disabled-account refusal/other-account survival pass. Receipts [private evidence label: immich-paired-20261022].
• Nine temporally correlated prior anonymous-volume candidates retained pending exact ownership; old image VOLUME /data caused implicit mounts. New runner forbids implicit image volumes. No owned fixture containers/jobs remain; do not claim all prior volumes cleaned.
• Fixture-only corrected manifests and nonroot image wrapper now prepared/parser-qualified as above; production activation/first-start and16MiB-vs2GiB contract remain open. No catalog/live activation.

Exact next commands, failures, images and preservation notes: IMMICH-PAIRED-NEXT-20261022.md. No B03/whole-app/full-UAT closure. Remaining AI estimate/calendar still unvalidated22October; B1 model allowance only, external review/provenance/trust/device/operator/deployment waits unknown. No numeric estimate/date change justified by these bounded exits.

Previous completed checkpoint

• Real Podsteadr→MediaMTX→Blossom composition: rotated-key RTMP refusal, actual ingest, live/ended polling, HLS decode, MP4 recording/remux, signed upload, exact-byte download/decode/RSS, owner/path refusals and original preservation.

• Actual packaged Podsteadr dashboard: synthetic-signer NIP-98 login, recording selection and free-episode publication through real UI/API, mobile/desktop reload and real cookie persistence.

• Found/fixed real mobile navigation overflow:493px content at390px. Wrapping fix passes packaged static red/green and real full-stack browser regression at390/1440px; no clipped overflow or forced clicks.

• Recreated all three media services: original recording/key/episode/Blossom bytes retained; foreign account refused. App recording mount is read-only.

• Corrected package passes existing graceful/crash/admin/session/settings and synthetic no-remint financial-preservation HTTP tests again.

• Fixed missing native signer bridge package input. Exact canonical JavaScript is served with a hash receipt, explicit podsteadr app id and unrelated automatic-NIP98 bootstrap disabled. Synthetic-signer browser tests do NOT certify actual native identity/consent.

Current package 91b0304e86adf3486389612ccd8937e6e9a453aedbb5144e389a4498c3e06859; patched upstream tree 05084117f72a61c8dd3dbd96ccc81b60f73e1e79; qualification source 8555d1ee1. Bridge build16:31:06–16:31:58Z. Full compositionr6:16:32:25–16:33:51Z exit0; preservation/bridge HTTP16:33:51–16:34:07Z exit0. Earlier responsive-only imageff38971… and r5 retained separately. Evidence: [private evidence label: podsteadr-media-20261022]. All owned containers/volumes absent. Real keys/funds/relays/devices and managed installation were not used.

Previously completed and retained

• Original dirty parent preserved;52 pending files matched snapshot exactly.
• Cloud production Vue→HTTP/RPC→real disposable Nextcloud without File Browser: two accounts, exact download/range, reload, session/origin/CSRF refusals, disconnect revocation and other-account survival.
• Direct Nextcloud connector and upstream disabled-account checks.
• Bounded package/runtime evidence for KithMoot, initialized Qortal, Just Works, DATUM, Blossom and Public Web Router; source/mounted-provider evidence for Gashboard. No whole-app closure inferred.

Remaining35 platform requirements

ID	Mandatory remaining/current acceptance work
B01	Original paid-file attempt recovery/exact bytes without repayment; retain earlier incident evidence
B02	Fast/custom fees, shortfall/budget/restart/RBF/CPFP/reorg and unknown-not-zero matrix
B03	Paired Immich including album selection and matching Nextcloud Rust/browser sub-exits pass; installed Nextcloud/Immich/absent-stopped File Browser/lifecycle/proxy/native-identity matrix remains
B04	File Browser credentials/custom users, removal warnings, exact-byte resumable/cancellable upload and phone progress
B05	Current viewer/download menus, safe areas/fullscreen, authenticated save/cancel and no login-HTML downloads
B06	Explicit public file/folder/pricing/discovery/withdrawal after connection UX; no unauthorized publication
B07	Private multi-file Mesh picker/staging/recipient binding/retry/cancel/partial recovery/exact receiver bytes after connection UX
B08	Shared non-film native media session/queue/position/reopen and permission transitions
B09	Physical background/lock/headset/PiP/logout/reconnect/process recreation
B10	Actual-track native notification artwork physical acceptance — LAST
C01	Reciprocal request/approval/removal, replay/auth/late-reply/reconnect state
C02	Fleet actions/provenance/authenticated metrics/mixed-version/dedup/partial sync
C03	Final connection/map/mobile/accessibility and operator-reviewed UX — before B06/B07
C04	Measured useful-data cold/warm p50/p95, cancellation/background/resume
C05	Current affected-node Monitoring/disk/null/threshold/footer/filter regression; retain historical repairs
C06	Trusted HTTPS/origin/session/iframe/gate and actual affected Alby Copy; physical trust remains separate
C07	Current AI provider/auth/error/unfunded/outage/prompt/funding-refresh behavior, without unapproved paid inference
C08	Actual standard MeshCore two-way/device/serial/reconnect interoperability
C09	Effective firewall/tunnel/NPM/IPv4+IPv6/routes/TLS/ACME/reboot/rollback
C10	Reported actual-frame sender/body/replay UX; missing physical input/semantics not invented
D01	Managed lifecycle install/start/stop/restart/upgrade/interruption/preserve/uninstall/reinstall
D02	Store/update/legacy/alias/tombstone/ownership behavior and truthful outcomes
D03	Public Web Router/NPM managed route/config/data/security preservation
D04	Gitea/Portainer/GitWorkshop install orders, Git/SSH/LFS/registry/Compose/workspace persistence
D05	Named Bitcoin/Lightning/ecash current package/readiness/backup/no-resurrection regressions; prior LND incident not reopened
D06	Angor current client/explorer/TLS/WebSocket/full-chain checks; retained historical missing-announcement limitation
D07	Cloud websites/generic public routes, effective access controls and rollback
D08	Actual Just Works/Gashboard/DATUM identity/business/miner/admin/reboot workflows
D09	Actual production HTTP/WebSocket→private tmux + real xterm browser existing-session input/reconnect/bounded-history sub-exit PASS7348b9b8d;1440/390 history inspected. Native HTTP creation passes, not browser-driven installed creation/login. Installed terminal/tools/shell/keys/process ownership/reboot, physical Companion input and independent acceptance remain; not fullD09
D10	Real generated starter app using maintained design contract, responsive/error/accessibility/package checks
D11	Signed source/replacement/withdrawal/details/link implementation, full frontend/build and actual-WebSocket synthetic-browser sub-exits pass at29720c13e; independent review, actual configured relay/external handler, installed/device/visual acceptance remain
E01	Exact accepted source/proposal/mirror/history/provenance reconciliation
E02	Compatible immutable artifacts, independent required review, nonempty backup/migration/rollback and integrated freeze
E03	Exact x86 fresh install/upgrade/OTA/reboot/rollback and applicable APK/device qualification
E04	Integrated regression/soak, authorized installed parity and final operator UAT/release-owner handoff

Eight apps — whole-app acceptance still open

App	Remaining whole-app acceptance
KithMoot	Actual signer/private-room/media/Companion, signed matching policy and managed lifecycle
Qortal	One-class candidate fresh boot/recreation now passes; official JAR unchanged. Candidate provenance/review/clean packaging, nonempty migration/rollback, gateway/network bootstrap and installed lifecycle remain
Podsteadr	Production manifests/identity/origin/bridge, managed lifecycle, WHIP/device/NAT, financial reconciliation and accepted provenance
Just Works	Actual identity/business/import/LNURL and managed lifecycle
DATUM	Actual miner/admin/service/reboot/configuration preservation
Gashboard	Matching package, real extension/mobile signing/device regression
Blossom	Existing-data ownership migration/rollback and managed lifecycle
Public Web Router	Existing config/data preservation, managed lifecycle and authorized route/TLS acceptance

Next executable work and gates

Review exact proposed Podsteadr app/sidecar manifests against the now-qualified package. The current native candidate has no Podsteadr manifests; inspected PR163 manifest lacks required administrator binding and selects an older local image. Do not activate that as working UAT. Prepare corrected private candidate rendering/integration without importing rejected recursive ownership logic. Exact gaps and reviewed service-public-key/start-order question are in PODSTEADR-MANAGED-INTEGRATION-GAPS-20261022.md. Independent security/provenance and installed-manager acceptance remain required. Read-only preflight found QEMU installed but no usable KVM or disposable manager image in the scoped candidate/evidence inventory; this is not an installed-test pass. Continue actual Immich Rust/browser pairing and connection/platform requirements as independent work permits.

Latest failures retained: media r1's one-second sender ended before publish authentication; corrected track-discovery interval and cleanup dependency order, media r2PASS. Browser r3 lacked signer library; pinned dependency reuse preflight added. Browser r4 exposed real390px overflow; stopped full retries, isolated layout red reproducer, corrected source and packaged green, then fullr5PASS. Initial namespace-owner cleanup was explicitly repaired; no residual owned fixtures. No failure reclassified as a pass.

As of22October remaining aggregate AI execution time remains source-unvalidated. Existing B1 is a coordinator/model-derived allowance, not a countdown or delivery promise; no numerical decrement justified by these sub-exits. Non-IndeeHub UAT date remains conditional/unassigned. Review, accepted provenance, trusted origin, physical/operator and deployment/signing authority have unknown external waits. Change since prior checkpoint: actual media/browser/preservation sub-exits and one real UI defect fixed; scope reporting corrected to non-IndeeHub only. No deployment, publication, signing or payment authority inferred.