NewWorldVenture · Sep 27, 2026 · Sep 27, 2026 · Sep 27, 2026 · Sep 27, 2026 · Sep 27, 2026
diff --git a/audit/status.md b/audit/status.md
@@ -2,41 +2,47 @@
 
 ## Codex integration — 2026-09-27
 
-CURRENT: Integrated incoming main7563462e / PR591 into the worker audit. Source
-head e7988141 passed all four jobs in CI36329827922; those are parent gates.
-Combined tree65719886 passes UTC20,701/20,701 across1,621files, build247,
-full strict types and lint with15existingwarnings. Both parents also have their
-own three-zone unit passes; these are not combined-tree three-zone proof.
-CONTROLLED:85/85 in3.8s (72cache+13registration), workerdd571476, fixture9b12ce5a;
-Temp/bubaly-sw-combined-browser-65719886-20260927.log. Focused33/33 separately.
-HOSTED: Original59f03 CI36331147265 Web/DB/MobilePASS; E2E1369/1370, sole
-native-worker fixture failure at iframe after preceding nativev6controls passed.
-FIXTURE: Finalnative507a6cd uses top-level navigation with CDP scripts disabled,
-respecting real anti-framing headers. Supplemental exactv6 native-engine proof
-passes public install/icon and200/fromServiceWorker exact offline HTML. Corrected
-full hosted case remains pending; current source is not claimed deployed.
-DELTA:878a17b verifies5,191files/modes plus only507a6cd native fixture;
-full generated-route types/lint15PASS, discovery1/1 (not runtime).
-Receipt:linux-combined-65719886/final-native-fixture-receipt.json.
-GATES: Failed Windows environment attempt retained. Three preliminary fixture
-header-union type errors corrected; full strict types then PASS. Combined gate
-receipt: Temp/bubaly-sw-reconcile-20260927/linux-combined-65719886/final-gates-receipt.json.
-INVENTORY: All incoming/original IDs and Claude sections preserved. RegisterB
-14,183=13,877NOT STARTED+297IN PROGRESS+4FIXED+PASS+4BLOCKED+1FAIL.
-Worker SUPPORT-98FD1D4C44AD and fixtures SUPPORT-1A08672F87F3 /
-SUPPORT-827E4294FC10 remain IN PROGRESS. Fixture coverage is not another
-completed product workflow. Priorv5 optimizer/write proof remains intact.
-MEDIA: SEC-001FAIL. Q59 observer-gap follow-up is reproduced with actual React,
-SDK and shared peer cookies: readyB renders/fetches synthetic A capability without
-B signing; active-switch control purges. Synthetic provider/image transport only;
-no live private bytes or media-source repair. Independent from the SW repair.
-PRODUCTION: Latest health16:01:24UTC core checksOK, degraded; six missing settings:
-CRON_SECRET, CHILD_LOGIN_SECRET, MARKETING_UNSUB_SECRET, GUARDIAN_INTERNAL_SECRET,
-FCM_PRIVATE_KEY, APNS_PRIVATE_KEY. Older four-setting statements are historical.
-NEXT: Publish combined correction, execute corrected hosted case, then verify
-exact deployment before scoped signoff. No production SQL/provider change.
-OWNERSHIP: Root integrates/verifies; auth_current_boundary updates these owned
-checkpoint sections. All other Claude board content below remains unchanged.
+CURRENT: Worker PR592 published as main e14b12e899fe62cf5a3993cfbe92121aab0a41f9
+at16:19:13UTC; tree52e0d1e equals candidate850cc4. Corrected CI36332783206 pending.
+PRODUCTION: Vercel dpl_57FH8FY8JZsuTFEo68uwkWJ7A34h SUCCESS16:22:37UTC;
+GitHub deployment6694707719 SUCCESS16:22:38UTC. Exact public acceptance PASS
+16:23:30–35UTC; full native production wrapper1/1PASS4.3s on final507a6cd.
+Real worker/install/icon and synthetic private-cache/offline/library controls,
+then scripts-disabled top-level navigation; before/after revision/hash guards.
+No auth/provider writes/private production bytes. Receipts:
+Temp/bubaly-sw-production-e14b12e8-20260927.json;
+Temp/bubaly-native-production-e14b12e8-retained-receipt-20260927.json.
+LOCAL WORKER: Combined657 UTC20,701/1,621, build247, types/lint15PASS;
+85/85controlled in3.8s (72cache+13registration), focused33 separate.
+Final fixture-only delta878a17b verifies5,191files/modes, types/lint15PASS,
+discovery1/1 (not runtime). Parents' three-zone gates remain parent-scoped.
+HISTORY: Original59 CI36331147265 E2E1369/1370 failed only native iframe;
+Web/DB/MobilePASS. Sandbox and anti-framing fixture failures preserved.
+Invalid Windows full run and repaired preliminary type failures retained.
+INVENTORY: All14,183 prior IDs retained, plus three media-test records:
+SUPPORT-302F04E15861, SUPPORT-BC0F2BFDBFD6 and SUPPORT-4CE6A54076E4,
+all IN PROGRESS.
+RegisterB14,186=13,877NOT STARTED+300IN PROGRESS+4FIXED+PASS+4BLOCKED+1FAIL.
+Three worker/support rows remain IN PROGRESS pending corrected hosted CI;
+fixture coverage does not count as additional completed product workflows.
+MEDIA: SEC-001FAIL. Local owner-scoped cache/inflight repair adopted aftere14,
+NOT DEPLOYED. Matching prototype33/33 and actual React/SDK browser2+2PASS;
+full integrated gates pending. Actual observer-gap RED preserved; only synthetic
+provider/image transport, no live bucket authorization/private bytes.
+HEALTH: e14 core checksOK, degraded with six missing settings:CRON_SECRET,
+CHILD_LOGIN_SECRET, MARKETING_UNSUB_SECRET, GUARDIAN_INTERNAL_SECRET,
+FCM_PRIVATE_KEY, APNS_PRIVATE_KEY. Earlier four-setting history retained.
+FOLLOW-UP: Permanent actual React/SDK suite7/7PASS2.6s, types/lintPASS;
+collector registration37/37PASS. e14mainCI36332799249 cancelled by docs-onlyf03;
+PR850CI36332783206 still pending. Initial media full run20,721PASS/1FAIL
+caught display importgraph; repaired display25/25PASS, corrected fullgatespending.
+HYDRATION: Actual FamilyMediaImg SSR→hydrate valid-cookie warning reproduced;
+hydration-aware hooka7822890 passes valid/absent/external controls and immediate
+cached SPA image. Retained fixturee169fe97 has4ownership+3hydration cases;
+final complete source fullgates/hosted/deployment pending.
+NEXT: Corrected hosted result for scoped worker closure; independently verify
+local media follow-up before its release. No production SQL/provider change.
+OWNERSHIP: Root integrates/verifies; auth_current_boundary owns this checkpoint.
 RECORD: docs/final-audit/service-worker-private-cache-cycle.md; finalaudit.md.
 
 > Two sessions ran this board. Both sections are kept.

diff --git a/docs/final-audit/auth-phone-ownership-cycle.md b/docs/final-audit/auth-phone-ownership-cycle.md
@@ -2,13 +2,19 @@
 
 ## Status reconciliation — 2026-09-27
 
+Current follow-up checkpoint: main e14 CI `36332799249` was automatically cancelled after another session merged documentation-only f03a5457; it is not full acceptance. Corrected PR candidate CI `36332783206` remains pending. The first local four-file media integration ran20,721 passing tests and one failure: the existing fixture-graph guard detected the new browser-storage import missing from the manual display fixture. That failed run is preserved. The repaired display fixture passes25/25 browser cases; corrected full integrated gates remain pending. A permanent serverless suite, `tests/e2e/family-media-session-ownership.spec.ts` (`SUPPORT-4CE6A54076E4`), now retains four actual React/SDK two-tab cases plus three actual component SSR/hydration controls and passes7/7 in2.6s, with strict fixture types and lint passing. Its required collector registration also passes the37/37 fixture-graph guard. Logs: `Temp/bubaly-media-browser-retained-20260927/{browser,types,lint,guard}.log`. This is targeted local repair evidence, not a deployed media fix or a new product finding.
+
+The local owner-cache change also exposed an actual SSR/hydration mismatch: FamilyMediaImg rendered a non-busy placeholder in Node, then added aria-busy during initial browser hydration with a valid cookie; actual React emitted one mismatch warning. The hydration-aware repair preserves a busy placeholder through hydration, settles to denial without an owner, preserves external images immediately and still renders an owned cached image immediately on a later SPA mount. Actual renderToString/hydrateRoot RED→GREEN receipts: `Temp/bubaly-media-hydration-{current,candidate}-20260927.{log,json}`. The adopted hook is bloba782289083275d8d10f1b3dc90353b7e1fa82a94; retained fixturee169fe97a845cb2ba1fa4d0117a94d3b2ce6dfa2 passes all7 cases (four ownership plus three hydration controls), scoped strict types/lint and the37-case fixture graph guard. The prior four-case passing receipt remains dated history. The new complete source still awaits final full gates, hosted execution and deployment; neither this local repair nor its proof is attributed to e14 production.
+
+**Worker release verified in production; corrected hosted CI pending.** PR592 merged at 16:19:13 UTC as `e14b12e899fe62cf5a3993cfbe92121aab0a41f9`, tree `52e0d1e72ee23f67369d68e255c42958926252b7` identical to candidate850cc4. Vercel `dpl_57FH8FY8JZsuTFEo68uwkWJ7A34h` succeeded at16:22:37UTC; GitHub Production6694707719 succeeded at16:22:38UTC, immutable URL [bubaly-iu3lsdhzd](https://bubaly-iu3lsdhzd-newworldventure.vercel.app). At16:23:30–35UTC, the public probe passed exact revision/worker-hash checks, protected-meals→login, hydrated login/phone readiness without submission and actual publishedv6 installation. The production-only native wrapper then passed **1/1 in4.3s** with the final507a6cd assertions unchanged except origin admission and before/after revision/worker-hash guards: real public install/icon, synthetic private-cache image rejection, public image/publisher-fetch preservation and scripts-disabled top-level navigation returning the exact public offline shell. Receipts: `Temp/bubaly-sw-production-e14b12e8-20260927.json`, `Temp/bubaly-native-production-e14b12e8-20260927.log`, and `Temp/bubaly-native-production-e14b12e8-retained-receipt-20260927.json`. The retained native receipt is derived from the passing log and validated wrapper source; the line reporter did not persist the inline attachment. No authentication/provider writes or private production content were involved. Corrected candidate CI [36332783206](https://github.com/NewWorldVenture/Bubaly/actions/runs/36332783206) remains pending at this checkpoint. These results certify the worker scope, not the local media change below.
+
 This is retained September19 history. Run35471471192 for75a1f3c6 ended in E2E FAILURE with the other three jobs successful; later Claude fixes repaired the synthetic clipboard event and pre-hydration phone-entry controls. Incoming06dd CI36320217255 passed all four jobs and its exact deployed build was checked at15:39:23UTC. Latest incoming main7563462e merged PR591 at16:01:34UTC; sourcee7988141 passed all four jobs in CI36329827922. These parent results are separate from the new combined worker source and do not prove production SMS delivery or physical-device persistence.
 
-Current combined tree65719886c4cc6483a0be7d1b5f32f292119570e3 passes UTC20,701/20,701 across1,621files, build247, strict types and lint with15existingwarnings; its controlled worker matrix passes85/85 in3.8s. Both parent three-zone unit passes remain parent-scoped. Full combined gates precede the latest native-test-only correction. Final fixture-only delta tree `878a17b644c5b1b6106de465841d413a4d4f2a86` verifies all 5,191 files/modes against combined65719886 plus only native fixture507a6cd. Full generated-route strict types and lint with 15 existing warnings pass; discovery is 1/1, not runtime. Receipt: `Temp/bubaly-sw-reconcile-20260927/linux-combined-65719886/final-native-fixture-receipt.json`. Original59f03 CI36331147265 has Web/Database/MobilePASS and E2E1,369/1,370: the new native-worker test failed at iframe navigation. Corrected native fixture507a6cd109def62f6053ff1ebd82f8a701b9ca7d uses top-level navigation after CDP disables scripts; supplemental actual-engine v6 install/icon/offline-navigation proof passes, but the corrected complete hosted case and deployment remain pending. No current v6 release is claimed. Details and retained failed Windows/type checkpoints are in [the worker cycle](service-worker-private-cache-cycle.md).
+Current combined tree65719886c4cc6483a0be7d1b5f32f292119570e3 passes UTC20,701/20,701 across1,621files, build247, strict types and lint with15existingwarnings; its controlled worker matrix passes85/85 in3.8s. Both parent three-zone unit passes remain parent-scoped. Full combined gates precede the latest native-test-only correction. Final fixture-only delta tree `878a17b644c5b1b6106de465841d413a4d4f2a86` verifies all 5,191 files/modes against combined65719886 plus only native fixture507a6cd. Full generated-route strict types and lint with 15 existing warnings pass; discovery is 1/1, not runtime. Receipt: `Temp/bubaly-sw-reconcile-20260927/linux-combined-65719886/final-native-fixture-receipt.json`. Original59f03 CI36331147265 has Web/Database/MobilePASS and E2E1,369/1,370: the new native-worker test failed at iframe navigation. Corrected native fixture507a6cd109def62f6053ff1ebd82f8a701b9ca7d uses top-level navigation after CDP disables scripts; supplemental actual-engine v6 install/icon/offline-navigation proof passes, but corrected hosted CI remains pending. The later actual e14 production acceptance is recorded above; it does not cover the local media follow-up. Details and retained failed Windows/type checkpoints are in [the worker cycle](service-worker-private-cache-cycle.md).
 
-SEC-001 stays FAIL for the public bucket and the separately reproduced Q59 media-cache observer gap. Real mounted React/SDK with synthetic intercepted provider/image transport confirms B's ready session can render/request A's cached signed capability after all observers unmount, without asking Storage asB. Active observed switching correctly purges. No private production data or live authorization was tested, and this release includes no media-cache repair. The three worker/support rows stay IN PROGRESS; AUTH-001/002/003 and broader production readiness remain open.
+SEC-001 stays FAIL for the public bucket and the separately reproduced Q59 media-cache observer gap. Real mounted React/SDK with synthetic intercepted provider/image transport confirms B's ready session can render/request A's cached signed capability after all observers unmount, without asking Storage asB. Active observed switching correctly purges. No private production data or live authorization was tested. A bounded local media repair has now been adopted after e14: `lib/storage/use-family-media.ts` binds cached capabilities and pending signing work to the readable browser user/session/logout generation, so B cannot reuse or join A's signing work while ordinary same-session rotation retains reuse. **It is not deployed in e14.** Existing helper IDs `LIBRARY-8223CBE7FA46` / `LIBRARY-99CA5C569F65` and SEC-001 retain the finding; new test records `SUPPORT-302F04E15861` (`tests/family-media-owner-boundary.test.ts`) and `SUPPORT-BC0F2BFDBFD6` (`tests/media-session-gap.test.ts`) are IN PROGRESS. The matching isolated prototype passes33/33 across three files (12 existing,19 owner/inflight and2 session-gap cases), scoped types/lint; baseline control fails17/passes16. Actual React/installed-SDK browser proofs pass2/2 for active-switch/observer-gap plus2/2 held-signing settlement orders, using only the one-module overlay. B requests its own signing before A settles; neither completion order returns A's image or erases B's pending slot. Evidence: `Temp/bubaly-sw-reconcile-20260927/q59-owner-prototype/receipt.json`, `Temp/bubaly-media-react-session-gap-prototype-20260927.json`, `Temp/bubaly-media-react-pending-prototype-20260927.json`. Full integrated gates and deployment of this local follow-up remain pending; synthetic provider/image transport is not live bucket authorization. SEC-001 remains FAIL. The three worker/support rows stay IN PROGRESS; AUTH-001/002/003 and broader production readiness remain open.
 
-The anonymous production health read at 16:01:24 UTC returned HTTP 200 with env, database, auth and serviceRole checks OK, but overall degraded and six missing feature settings: `CRON_SECRET`, `CHILD_LOGIN_SECRET`, `MARKETING_UNSUB_SECRET`, `GUARDIAN_INTERNAL_SECRET`, `FCM_PRIVATE_KEY` and `APNS_PRIVATE_KEY`. Earlier four-setting statements remain dated history. No settings or secrets were read or changed.
+The latest e14 public acceptance at16:23:30–35UTC confirms HTTP200 health with env/database/auth/serviceRole OK, overall degraded and six missing feature settings: `CRON_SECRET`, `CHILD_LOGIN_SECRET`, `MARKETING_UNSUB_SECRET`, `GUARDIAN_INTERNAL_SECRET`, `FCM_PRIVATE_KEY` and `APNS_PRIVATE_KEY`. It agrees with the16:01:24UTC baseline. Earlier four-setting observations remain dated history; no secret values or provider settings were changed.
 
 All pending/running statements below describe their original dated checkpoint, not current release status. Current evidence is not retroactively attributed to those old revisions.