[elemdos]

Frozen RC.13 qualification complete; distribution held

Qualified source: 10d6d648f228efeae406965f4729d16a0aeacd6f (v3.3.2-rc.13).

• Safari CI input waits for hydration and uses native pointer/key actions with exact credential assertions. Three independent actual Safari 26.6.1 sessions passed on this exact source.
• Fixed dashboard history restoration through delayed scroll resets and browser-restored focus; off-screen controls and actual pointer/wheel/keyboard takeover remain usable. Failed traces and deterministic red/green regressions are retained.
• Exact candidate CI passed all required checks. All five native targets match the frozen source/version and verified SHA-256 values. CLI 0.3.0-rc.3 and MCP 0.1.11-rc.3 remain pinned by archive checksum.
• Fresh ten-editor hosted soak: 3600.002 measured seconds, 17000 requests, 3400 cycles, 0 errors, no request retries; p95 public 274.9 ms and save roundtrip 425.2 ms. All ten scratch records restored.
• Hosted realtime, desktop/responsive browser, permissions, invitation/capture-reset, exact CLI handoff, cache, uploads, workflow, publication and restored pull checks passed. Native backup/restore preserved every table/file/settings and original logins; all eleven publications rendered. Managed purchaser bootstrap removal/restart and fail-closed startup passed.
• Disposable accounts, encrypted CI secret and temporary services were removed; owned temporary volumes were detached and scheduled for deletion under Railway retention. The original QA volume remains active. Original 14 users, 13 site roles, 11 sites and 605 content entries remain; original authentication hashes/token keys and content values were verified. Capture-only mail and absent bootstrap variables were rechecked.
• A checksum-indexed five-platform beta kit is prepared locally and held. Proposed scope: two supervised users first, at most ten total, manually provisioned new starter sites on qualified desktop browsers. No customer onboarding/distribution was performed.

Package/public-container/tag/release publication, real email, production/pilot deployment and customer invitations remain held. Live Fly/Cloudflare automatic purchase provisioning remains unqualified and is excluded from this manual beta. Historical Mac connection stalls are not claimed fixed by moving the workload to CI. This task did not publish npm packages or send real email.

Qualification IN PROGRESS at 3349a67a750f8351244f79e6a17102bc8a8c0f3c. Includes the dashboard initial-session remount scroll fix. Full new-head native, source/installed-browser, actual Safari, recovery, security and framing checks remain required.

The candidate native Safari failure reached the sign-in form but returned an authentication error. The native fixture now coordinates seeded authentication traffic against the actual unchanged rate-limit policy and records credential-free password/refresh status plus exact-input-match booleans. Its three native sessions, content edits, reorder/reload and publication assertions remain intact; the cause is not declared resolved until exact-head CI passes.

The prior stable Windows failure stopped during fresh npm installation. New diagnostics retain bounded sanitized npm timing, exit code/signal and termination evidence before fresh-HOME cleanup. The 180-second install deadline and all assertions remain unchanged; this diagnostic change is not a claim that the underlying stall is fixed. Local syntax checks and all three auth-window regressions pass.

CLI/MCP runtime bytes and candidate/stable archives are unchanged. The original Actions secret and ten approved accounts/roles are independently verified deleted. The separate hosted/native Safari closeout is recorded by its owner and does not attest these new source identities. This task has not published or deployed anything.

Prior qualification snapshots (historical)

Qualification hold: initial authentication scroll loss is being fixed. The original source-Firefox job at 9999ad6a failed before reload while establishing a 280px dashboard fixture position; a later external rerun does not explain that failure. The retained trace shows initial auth-refresh completing after the user scrolls, invalidating record caches and remounting the dashboard at zero. A new deterministic pending-authentication regression reproduces the loss on the old executable (expected280/actual0). The local product fix preserves the observed position across same-URL remounts and clears that fallback on navigation. Existing reload/history/preview assertions, timeouts and retries remain unchanged. Full local dashboard scenarios and subsequent new-head qualification are required before this hold is cleared. Original failed run.

RC.13 consolidates the current editor fixes and feature PRs, including browser-approved CLI access and Develop locally's agent setup flow. Users can choose a folder, approve installation and browser access, then let a command-capable local agent prepare and verify the workspace.

• Editor, page, repeater and dashboard fixes preserve content identities, drafts, selection and navigation position. — Make everyday editing and client handoff more reliable.
• Batched imports, site-field resolution and matching CLI/CMS rich-text and image publication are included. — Move larger sites and publish authored content without losing structure or formatting.
• Incremental publication and faster starter cloning retain validation. — Reduce repeated work while building and publishing.
• Release safeguards copy the exact tested native executables and restrict prerelease images to their exact version tag. — Make the released bytes traceable while preserving stable channels.

Published: CMS 3.3.2-rc.13 from 9999ad6a18b941eb736ac668573c8b993bd7427f; MCP 0.1.11-rc.3 is available on npm's rc channel. CLI 0.3.0-rc.3 is also published on npm’s rc channel. Both npm archives and the public CMS download match the exact qualified bytes. Fresh public-install onboarding passes on macOS ARM64 with official Node 22.17 and Node 24.0: browser decline/approval, scoped pull, MCP docs/status/logs, local preview, reconnect and shutdown; the visual choice writes edits back to local files. Both runs require zero user terminal steps, with installation and browser-access approvals retained.

Validation: five native platforms, all three installed-package browser engines, actual Safari, framing and copied recovery; source browsers; E2E; staging; release safeguards; draft asset assembly; exact-version container publication. The first source-Firefox failure remains retained; an unchanged-source rerun passed. Detailed private hosted qualification and cleanup evidence stays local.

The release contains MCP #33/#34, CMS #1364/#1366 and the earlier reconciled feature PRs. Canonical release checkouts are clean and pushed. Stable promotion, independent hosting readiness, physical-phone/customer-domain rollout and legacy migrations retain their separate scope. This PR remains the integration target for a later default-branch merge.

Scoped hosted QA and native Safari closeout — historical hour and current deployment recorded separately

The isolated ten-editor hour tested fed368b4e08492190ff037d5309aec80a2a01146: 3,600.75 measured seconds, 17,080 requests, 3,416 cycles, zero errors, public p95 124.16 ms, save/read-back p95 554.20 ms, all ten scratch baselines restored. Duration, deadlines, latency limits and zero-retry workload were unchanged. Upgrade preservation, separate native backup/restore, managed-purchaser bootstrap-secret removal/restart/fail-closed startup, browser/realtime/tenant/captured-mail checks and the five post-hour handoff/pull/cache/upload/workflow checks passed. Failed earlier attempts remain retained; the separate Mac connection-timeout trigger is unresolved.

Native Safari follow-up PASS (October 29, America/Chicago): current QA deployment aad9f7f1-0422-4530-bc25-02ee4f95e5fe, image sha256:c78a3d923ad7c6f23b21d6e305d870abe674fabeed7aacd5e4ec090ccf9f734d. Public interaction, native sign-in/keyboard heading edit, root/nested reorder, Save/reload, browser publication, public counter interaction and three independent fresh editor loads pass. Saved values/order and the original publication were restored. The private harness uses the current Outline control, trusted W3C pointer input, normal scrolling and explicit module readiness; application code and pass/fail assertions were unchanged. This newer deployment is recorded separately from the historical hour's artifact.

Cleanup verified: the ten exact soak accounts/roles, two local Safari accounts, six older run-owned accounts and the owned workflow site are absent. Original 14 users, 13 roles and 11 sites, original password hashes/token keys and all 605 original content IDs/bindings/current values are preserved; newer legitimate QA content was not reset to an older snapshot. The original Actions secret is absent. All Safari sessions and the owned driver closed. Allow remote automation OFF and Show features for web developers OFF were visibly verified in Safari Settings. A final protected native recovery backup is retained locally.

This closes this run's native-Safari and owned-cleanup work; it does not claim exact-artifact qualification for newer release heads. No npm publication, real email or production/pilot deployment was performed. External purchaser-provider and authorized public-registry handoff gates remain separate.