# Independent Audit — Health-U1 (`4aec149`) **Protocol 8 stage-3 audit.** I planned the batch but did **not** build U1, so I'm independent of the implementer. I started from the diff and **ran every test myself** — I did not trust the implementer's report. All temporary breakages restored; nothing committed or pushed. Tree clean at `4aec149` before and after. --- ## Verdict: ✅ PASS U1 does exactly what the batch exists to do: it puts **real browser coverage at both gate boundaries**, and — critically — **the checks genuinely bite.** I reproduced red-then-green myself, with an *independent* break different from the implementer's, at both boundaries. Nothing was weakened, the count is synced, and the tree is coherent. --- ## The four headline answers ### 1. ⭐ Does the offline test actually bite? — YES, proven by my own red-then-green **It cuts the network for real.** `offline-first.mjs` uses `context.setOffline(true)` (Playwright's true network cut), then asserts `navigator.onLine === false` in the page — explicitly *not* a mocked flag. The offline reload can only come back if the service worker serves the shell from Cache Storage. **It asserts deeply, not "bootScreen hidden."** Seven checks, and the meaningful ones fire *after* the network is cut: - app boots to READY offline (SW served the shell), - a real core board rendered **and is visible** (`.panel[data-tab]`, `offsetParent !== null`), - a **native tool works end-to-end** — it drives the real CONSULT databank path (`databankSearch` → `input` event → `_consultSearch()`), reading only local registry/CSV data, and asserts a local "Stimpak" result actually rendered, - `navigator.onLine` stayed false the whole time. **My independent red-then-green (different break than the implementer's).** The implementer dropped `state.js` from the SW precache — which kills everything at once. To prove the test bites *with isolation and depth*, I instead dropped **`js/ui/ui-render-databank.js`** (the CONSULT renderer) from the SW precache. Result: - app still **booted to READY offline** ✓, a **board still rendered** ✓, - but the native CONSULT lookup returned **no local results** → **`[FAIL] … a native tool silently needs the network`**, exit 1. That is the strongest possible proof: the native-tool assertion is **not decorative** — it fails on its own, naming the real symptom, even when boot itself is fine. Restored `sw.js` → all 7 green again (exit 0). Green baseline ran in ~6.4s. ### 2. Is the commit boot-smoke real + fast + non-flaky? — YES, all three measured **Real functional paint, not "page loaded."** `boot-smoke.mjs --fast` asserts the **bezel nav is present** *and* a **core board actually rendered and is visible** (`.panel[data-tab]` with `offsetParent !== null`) *and* **zero uncaught pageerror**. It skips only the cosmetic boot-animation wait and the full console scan (those stay in FULL mode at push) — the functional signals stay. **Fast + bounded.** Standalone: **1.90s / 1.93s**. Full `gate:fast` end-to-end: **13.6s, exit 0** — the ~2.2s add the commit claims (11.45s → 13.6s) is accurate and bounded. The Chromium-availability preflight runs before it with a clear "run: npx playwright install chromium" message if missing. **Non-flaky.** Ran the fast smoke **3× back-to-back — green every time.** **It bites on a real boot break.** I injected `throw new Error("AUDIT_BOOT_BREAK")` at the top of `js/ui/ui-core.js`. Result: **both** assertions failed — no board painted **and** the uncaught `AUDIT_BOOT_BREAK` pageerror was caught — exit 1. Restored → green. ### 3. Nothing weakened, tree coherent? — YES - **Count synced (3276).** `CLAUDE.md` (all 6 spots), `README.md`, `ARCHITECTURE.md`, `RULES.md`, and `CHANGELOG.md [Unreleased]` all read **3276**. **No stray `3272` anywhere.** The full Node runner I ran reports **`ALL 3276 TESTS PASSED`**. - **Suite 50.3 was strengthened, not loosened.** It used to check `boot-smoke.mjs` for `http.createServer` + `BASE_URL`. It now verifies `http.createServer` lives in the shared `static-server.mjs`, that `startStaticServer` is exported there, **and** that `boot-smoke.mjs` imports and calls it — *more* verification than before, correctly following the Protocol 22 extraction. - **50.9–50.12 genuinely guard the wiring.** They statically assert `gate.js` runs `boot-smoke.mjs --fast` in the `if (fast)` path, runs `offline-first.mjs` in the full path, that `offline-first.mjs` contains the real `setOffline(true)` + `bootScreen` + `databankSearch` drive, and that `boot-smoke.mjs` has the `--fast` mode. Remove any of the new checks and these fail — the escape-ratchet (Protocol 20/36b) is real. - **Tree coherent.** `git show --stat` = exactly **11 files, all intended** (2 new test mjs, gate.js, boot-smoke.mjs, robco-diagnostics.js, eslint.config.mjs, 5 docs). Working tree clean, **no untracked artifacts, no half-written files** from the duplicate session that briefly touched this unit. ### 4. Protocols 1 / 22 / 41 — all correct - **Protocol 1 (cache bump):** correctly **not** bumped. `CACHE_NAME` stays `robco-terminal-v2.8.0-r41`. Nothing served/precached changed — only `tests/`, `scripts/gate.js`, `eslint.config.mjs`, and docs. Correct. - **Protocol 22 (extend, don't duplicate):** the static HTTP server was **extracted** to `tests/static-server.mjs` and is shared by both `boot-smoke.mjs` and `offline-first.mjs` — no copied server. `ensureChromium()` was likewise extracted in `gate.js` and reused by both boundaries. Clean. - **Protocol 41 (junk sweep):** clean — no `*.bak/*.tmp/*.old/*.log`, no stray dirs, no untracked files. --- ## Robustness notes (non-blocking — recorded, nothing to fix) - **Shared-browser close is safe.** `offline-first.mjs` calls `browser.close()`, but `acquireBrowser()` connects to the gate's shared Chromium via `PW_WS_ENDPOINT`, where `close()` only *disconnects the client* (Playwright semantics) — the shared server stays alive. It's also step 11 (last) before `stopSharedBrowser()`, so even a full close would be harmless. Verified in `browser-shared.mjs`. - **Consistent "core board" signal.** Both the fast smoke and the offline test use the same `.panel[data-tab]` + `offsetParent !== null` visibility signal — one honest definition of "a board actually rendered," reused in both places. - **Offline SW-precache wait** polls Cache Storage 80×100ms (8s) for `index.html` + `state.js` before cutting the network — it doesn't just trust `serviceWorker.ready`, it confirms the shell is actually cached. Good defensive design. --- ## What I ran (evidence trail) | Step | Result | | --- | --- | | `git show --stat 4aec149` | 11 files, coherent, clean tree | | `node tests/boot-smoke.mjs --fast` × 3 | green ×3 (non-flaky), ~1.9s each | | `npm run gate:fast` | exit 0, 13.6s, fast smoke wired + ran | | `node tests/offline-first.mjs` (baseline) | 7/7 green, 6.4s | | **Break A:** drop `ui-render-databank.js` from SW precache → offline test | **RED** — native-tool assertion failed with real symptom, exit 1 | | Restore `sw.js` → offline test | green (exit 0) | | **Break B:** inject boot throw into `ui-core.js` → fast smoke | **RED** — no board + pageerror caught, exit 1 | | Restore `ui-core.js` → fast smoke | green (exit 0) | | Full Node runner | `ALL 3276 TESTS PASSED` | | Count-sync scan | 3276 everywhere, no stray 3272 | **Final tree state:** clean at `4aec149`, all temporary breakages restored. --- ## Bottom line This is the opposite of a false-green check. Both new browser checks **fail loudly on a real defect** (I proved it twice, independently), they're fast and non-flaky at the commit boundary, the count and docs are synced, the wiring is guarded so it can't be silently dropped, and the tree is coherent. **PASS — U1 is done.**