Complete Destroyer scenario and visual coverage

[smiggleworth]

Summary

Closes #16.

Turns Destroyer into the complete production integration harness for the coordinated Askr patch releases while keeping routes, state, fixtures, component composition, and failure controls explicit. The application now exercises all 32 product scenarios plus core router/data/SSR/cancellation cases through natural workspace, incident, logs, metrics, settings, authentication, docs, and lifecycle flows.

The implementation includes query-aware live-log history, deterministic failure controls, normalized destructive-account confirmation, final-intent notification persistence, dense incident and operations surfaces, truthful 404/metrics/about behavior, route and teardown regressions, a pinned Linux visual census, and CI evidence retention.

Published dependencies

Destroyer installs only registry packages; there are no aliases, sibling-source links, packed tarballs, or compatibility workarounds.

Package	Installed version
@askrjs/askr	0.2.4
@askrjs/ui	0.2.4
@askrjs/themes	0.2.5
@askrjs/server	0.2.2
@askrjs/node	0.2.2
@askrjs/charts	0.2.2
@askrjs/vite	0.2.2

Unchanged first-party packages remain on @askrjs/auth, @askrjs/lucide, and @askrjs/schema 0.2.1. The coordinated CLI release is @askrjs/cli@0.2.3, but Destroyer does not depend on the CLI at runtime or build time.

All Askr dependency ranges retain the <0.3.0 ceiling. vite-plus remains 0.2.9 (^0.2.8) and @types/node remains 26.3.0 (~26.3.0) under the patch-only policy. This resolves #16 through the published @askrjs/vite@0.2.2 peer range (^0.2.8 || ^0.3.0) without taking Vite Plus 0.3.0.

Compatibility and API notes

• No Destroyer library API is exported or changed.
• Application contracts remain explicit TypeScript/HTTP/SQLite boundaries; the new scenario controller is test-only and disabled outside NODE_ENV=test.
• The released @askrjs/ui@0.2.4 variable-height virtualization behavior is exercised by S19. Its remaining standard-suite quarantine is the separate Checkbox CSP compatibility issue below.
• No security work, peer-range widening, major/minor dependency change, or unpublished dependency is included.

Validation

Local final-head validation:

• clean npm ci: 0 vulnerabilities
• npm run check: lint, typecheck, production build, 6 test files / 34 tests passed
• npm run test:production: 4 passed
• npm run test:browser: 46 passed / 6 intentional skips
• npm run test:findings: three repetitions, 24 passed / 9 linked or intentional skips; the development finding ran three times and remained linked/skipped
• focused responsiveness gate: 3/3 local and 3/3 in a two-CPU pinned Linux container
• canonical Linux visual census: 336 canonical screenshots, 337/337 Playwright cases including authenticated setup; all 28 contact sheets and targeted full-resolution states manually reviewed across desktop/mobile, light/dark/system, forced colors, reduced motion, and 200% zoom
• npm outdated --json: only the intentional @types/node 26.4.0 and Vite Plus 0.3.0 holds remain

Hosted final-head validation (run 33221067230):

• Ubuntu, macOS, and Windows static/build/production gates: passed
• Browser product flows: passed (46 passed / 6 intentional skips)
• Canonical visual census: passed (337/337 including authenticated setup)
• Published-package findings is intentionally scheduled/manual and therefore skipped on pull requests; the three-run local findings command above covers this head

Responsiveness evidence

Causal path: each navigation disposes the active Logs or Metrics route, mounts its virtualized operations views or four chart surfaces, and reaches two browser paints.

The old maximum-only 100 ms assertion failed both origin/main and this branch under a one-CPU constraint and conflated shared-runner frame scheduling with application work. The final gate retains every labeled two-paint sample, bounds interactions below 200 ms, bounds a single page long task below 150 ms, and requires average total blocking time below 50 ms per action. Hosted diagnostic evidence measured 77-143 ms interactions, a 103 ms maximum long task, and 286 ms total blocking across ten actions.

No production optimization, fast path, cache, scheduler state, or fallback path was introduced. Fallback trigger and behavior-parity proof are therefore not applicable; observable application behavior is unchanged. Legibility cost: none—the focused command now actually selects the test, evidence is persisted as labeled JSON, and an opt-in CPU profile is available through DESTROYER_CPU_PROFILE=1.

Intentional non-security exclusions

• CA01: rapid-navigation preload abort console behavior, Rapid navigation reports an expected superseded preload abort as a console error askr#373.
• Heap plateau: forced-GC route retention, Forced-GC route cycles retain roughly 0.82 MB per cycle with a flat component-host ledger askr#374.
• Development SSR styles: Dev SSR drops generated theme styles and renders Block layouts as rows askr-vite#39.
• S17 and S19: same-origin CSP blocks the default Checkbox indicator data URI, a non-security compatibility finding tracked by Default Checkbox indicators violate same-origin CSP through data-URI backgrounds askr-themes#141.
• CC04 nonce propagation remains an explicit security-scope exclusion and is not claimed as investigated here.

Review closure

The complete origin/main...head diff received two full review passes, followed by a focused pass over the final hydration and responsiveness remediation. The two legitimate inline findings—stale live-log cursors and mixed-case stored email deletion—were fixed through production paths with regressions, answered with evidence, and resolved. Final GitHub thread/comment/check readback is performed immediately before readiness and merge.

[smiggleworth]

Additional wobble triage: S19 is now linked to askrjs/askr-ui#119. Public VirtualList types and implementation enforce a single fixed row height and overflow clipping, so the natural inline incident timeline cannot be represented honestly. The scenario remains an explicit finding; no overlay substitution, non-virtual fallback claim, or compatibility shim was added. Evidence link commit: 2724679.

[smiggleworth]

Completed S19 in 385567e against locally packed fix branches: 39-row incident virtualization, inline variable-height timeline detail, nested focus, deterministic selected-row CSV export, and object URL teardown. Also corrected S23 to run in the findings lane as its ledger already requires; it still reproduces askr #364 and no application workaround was added. Full local gates: check and production tests passed; standard Playwright 48 passed / 3 intentionally skipped.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.