S00-005: Approve storage design after independent transaction checks

Changes: Accept ADR 0004 and record independent S00-005 review, experiment status and handoff; preserve explicit native browser and durability limitations.
Validation: Fresh-cache npm ci and npm run check passed on Node 24.21.0/npm 11.19.0; exact lock pins, HTTPS/SHA512, installed license texts and runtime refusal checks passed. make check passed 72 tooling tests. Scoped diff and whitespace reviewed; native browser quota and process restart were not tested.

Task: S00-005
Agent: auto-qa-4078580caf39
Role: qa
Action: review
Status: done

Task title: Выбрать IndexedDB wrapper и migration policy

docs/decisions/0004-storage-design.md

@@ -1,10 +1,10 @@
 # ADR 0004: IndexedDB wrapper and migration policy
 
-- Status: proposed; independent QA acceptance pending.
+- Status: accepted; bounded storage design independently reviewed on 2026-10-15.
 - Task / requirements: S00-005 / STORE-001, STORE-004.
 - Date: 2026-10-15.
 - Decision owner: auto-storage-0ce544ac4b40 (storage).
-- Reviewer: assigned qa, not yet reviewed.
+- Reviewer: auto-qa-4078580caf39 (qa); evidence: `state/evidence/S00-005-review.md`.
 
 ## Context and required capabilities
 
@@ -164,3 +164,16 @@ every supported migration and native browser quota/restart coverage. New query
 requirements, browser incompatibility, unacceptable migration cost or changed
 crypto atomicity requirements trigger a bounded ADR revision, never an implicit
 wrapper/stack replacement.
+
+## Independent acceptance
+
+QA reviewer auto-qa-4078580caf39 independently repeated fresh-cache npm ci and
+all rollback, injected quota-policy and blocked-upgrade assertions on Linux,
+Node 24.21.0/npm 11.19.0. Exact lock pins, integrity metadata, installed license
+texts and runtime refusal were checked; make check passed 72 tooling tests.
+Accepted only the wrapper decision and documented storage policies/fixture
+experiments. Native browser quota, disk/crash durability, process restart,
+multi-tab behavior, eviction, persistence grants and crypto unlock remain
+unverified. S01 contracts and production adapters still require their own work.
+See the independent review report for commands, source inspection and limits.
+Coordinator owns the review commit.

experiments/0004-storage-design/README.md

@@ -1,7 +1,7 @@
 # Storage design experiment (S00-005)
 
 Synthetic fixtures only. No app adapter, shared contract, secrets or real messages.
-ADR: `docs/decisions/0004-storage-design.md` (proposed pending independent QA).
+ADR: `docs/decisions/0004-storage-design.md` (accepted bounded design; see independent QA evidence).
 `RECOVERY.md` preserves the earlier interruption inventory; its missing-output
 notes are historical, superseded by this task's code and evidence.
 

planning/TASK_MATRIX.md

@@ -1,6 +1,6 @@
 # Матрица задач
 
-Generated; state revision **117**. Canonical status: state/tasks.json.
+Generated; state revision **118**. Canonical status: state/tasks.json.
 
 | ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача |
 | --- | --- | --- | --- | --- | --- | --- | --- |
@@ -8,7 +8,7 @@ Generated; state revision **117**. Canonical status: state/tasks.json.
 | [S00-002](tasks/S00-002.md) | S00 | orchestrator | security | done | auto-orchestrator-68a05c587e33 | S00-001, S00-011, S00-012 | Выбрать framework и build runtime |
 | [S00-003](tasks/S00-003.md) | S00 | protocol | qa | done | auto-protocol-f474114f0168 | S00-001, S00-002, S00-017, S00-018, S00-019, S00-020 | Проверить XMPP WSS/auth библиотеку |
 | [S00-004](tasks/S00-004.md) | S00 | crypto | security | blocked | auto-crypto-fe1c81c17ded | S00-001, S00-002, S00-021, S00-022 | Проверить browser OMEMO backend |
-| [S00-005](tasks/S00-005.md) | S00 | storage | qa | review | auto-storage-0ce544ac4b40 | S00-002, S00-023 | Выбрать IndexedDB wrapper и migration policy |
+| [S00-005](tasks/S00-005.md) | S00 | storage | qa | done | auto-storage-0ce544ac4b40 | S00-002, S00-023 | Выбрать IndexedDB wrapper и migration policy |
 | [S00-006](tasks/S00-006.md) | S00 | orchestrator | security | todo |  | S00-002 | Зафиксировать browser/reference matrix |
 | [S00-007](tasks/S00-007.md) | S00 | security | orchestrator | todo |  | S00-004, S00-005 | Утвердить password и crypto unlock модель |
 | [S00-008](tasks/S00-008.md) | S00 | ci-cd | qa | todo |  | S00-003, S00-004 | Описать WSS/upload/TURN/push topology |

planning/stages/S00.md

@@ -10,7 +10,7 @@
 - [S00-002](../tasks/S00-002.md): Выбрать framework и build runtime — orchestrator; done.
 - [S00-003](../tasks/S00-003.md): Проверить XMPP WSS/auth библиотеку — protocol; done.
 - [S00-004](../tasks/S00-004.md): Проверить browser OMEMO backend — crypto; blocked.
-- [S00-005](../tasks/S00-005.md): Выбрать IndexedDB wrapper и migration policy — storage; review.
+- [S00-005](../tasks/S00-005.md): Выбрать IndexedDB wrapper и migration policy — storage; done.
 - [S00-006](../tasks/S00-006.md): Зафиксировать browser/reference matrix — orchestrator; todo.
 - [S00-007](../tasks/S00-007.md): Утвердить password и crypto unlock модель — security; todo.
 - [S00-008](../tasks/S00-008.md): Описать WSS/upload/TURN/push topology — ci-cd; todo.

planning/task_matrix.csv

@@ -3,7 +3,7 @@ S00-001,S00,orchestrator,security,done,auto-orchestrator-48aab142ecde,,Утве
 S00-002,S00,orchestrator,security,done,auto-orchestrator-68a05c587e33,"S00-001, S00-011, S00-012",Выбрать framework и build runtime
 S00-003,S00,protocol,qa,done,auto-protocol-f474114f0168,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-020",Проверить XMPP WSS/auth библиотеку
 S00-004,S00,crypto,security,blocked,auto-crypto-fe1c81c17ded,"S00-001, S00-002, S00-021, S00-022",Проверить browser OMEMO backend
-S00-005,S00,storage,qa,review,auto-storage-0ce544ac4b40,"S00-002, S00-023",Выбрать IndexedDB wrapper и migration policy
+S00-005,S00,storage,qa,done,auto-storage-0ce544ac4b40,"S00-002, S00-023",Выбрать IndexedDB wrapper и migration policy
 S00-006,S00,orchestrator,security,todo,,S00-002,Зафиксировать browser/reference matrix
 S00-007,S00,security,orchestrator,todo,,"S00-004, S00-005",Утвердить password и crypto unlock модель
 S00-008,S00,ci-cd,qa,todo,,"S00-003, S00-004",Описать WSS/upload/TURN/push topology

state/commit_messages/auto-qa-4078580caf39.txt

@@ -0,0 +1,4 @@
+Approve storage design after independent transaction checks
+
+Changes: Accept ADR 0004 and record independent S00-005 review, experiment status and handoff; preserve explicit native browser and durability limitations.
+Validation: Fresh-cache npm ci and npm run check passed on Node 24.21.0/npm 11.19.0; exact lock pins, HTTPS/SHA512, installed license texts and runtime refusal checks passed. make check passed 72 tooling tests. Scoped diff and whitespace reviewed; native browser quota and process restart were not tested.

state/evidence/S00-005-review.md

@@ -0,0 +1,94 @@
+# S00-005 independent QA review
+
+Reviewer: auto-qa-4078580caf39 (qa), 2026-10-15.
+Executor: auto-storage-0ce544ac4b40 (storage).
+Decision: approve bounded storage design; ADR 0004 accepted.
+
+Input: startup/master/role/workflow instructions, required TESTING/storage/ADR
+registry, assigned card/packet, original handoff and executor evidence/message,
+exact STORE-001/STORE-004, accepted ADR 0001 and direct S00-002/S00-023 executor
+and review evidence/handoffs. Output: accepted ADR metadata and this review.
+Acceptance: storage policies plus rollback and quota/blocked-upgrade experiments,
+within the two allowed source paths, with reproducible evidence/handoff.
+
+## Findings against acceptance
+
+1. ADR compares native IndexedDB, idb and Dexie, selecting idb 8.0.4 with a
+bounded ergonomics justification. It defines account-scoped keys, separate stores
+in one database, history/checkpoint atomicity and success after tx.done. Migration
+steps, rollback/forward retry, connection ownership and blocked/terminated behavior
+are explicit. Quota/eviction cannot report durable success; pending-memory and
+cache cleanup policies exclude automatic crypto/trust/unsynced-history removal.
+Storage owns opaque persistence; crypto owns serialization, keys and unlock.
+Passwords remain memory-only; persistent unlock requires a separate decision.
+No new schema/port or production implementation is claimed. STORE-001/004 policy
+requirements are covered at this card's ADR level.
+2. Rollback executes the selected idb wrapper over fake-indexeddb. A real fixture
+unique-index violation produces ConstraintError and open AbortError. Assertions
+verify version, original exact row, absent new store/index, successful forward
+retry/query and same-process reopen. Promise catches observe rejection without
+preventing the native error event's transaction abort. This repairs the historical
+unfinished repeated-store and overwritten-handler probe.
+3. Quota injection is explicitly synthetic, after both requests succeed. Actual
+fixture abort restores the checkpoint and removes pending history; account B's
+history/settings/opaque crypto fixture survives. Retry/reopen checks committed
+history and checkpoint. Held v1 connection observes versionchange and blocked
+before upgrade executes; closing it permits v2, preserves checkpoint and rejects
+stale v1 with VersionError. These satisfy the bounded scenario acceptance without
+claiming native quota generation or browser multi-tab execution.
+4. Inspected implementation commit 0e2b3098dfe70e74ee908f060d1b7b56547ef703,
+its actual source diff/message and prior interrupted checkpoint 5f4d044.
+Implementation source paths are only docs/decisions/0004-storage-design.md and
+experiments/0004-storage-design; remaining paths are workflow/generated metadata.
+Historical RECOVERY.md and _probe.mjs were preserved. Executor commit message
+accurately describes the diff and limits. Initial and pre-report working trees
+were clean. No immutable specs, shared contracts, application source or system/Git
+configuration changed. No acceptance defect or independent review blocker found.
+
+## Actual independent commands/results
+
+- python3 scripts/tasks.py resume --agent auto-qa-4078580caf39; show S00-005;
+  packet S00-005 --agent auto-qa-4078580caf39: exit 0 each. Empty reviewer owned
+  list is expected; distinct executor and done prerequisites; no claim.
+- Read-only git log/show/status, assigned artifact reads and exact spec rg lookup:
+  exit 0. Explicit ancestor AGENTS.md inspection found none.
+- From experiments/0004-storage-design using
+  PATH=/tmp/luma-approved-toolchain/node-v24.21.0-linux-x64/bin:$PATH:
+  npm ci --ignore-scripts --no-audit --no-fund --cache
+  /tmp/luma-storage-qa-4078580caf39 --fetch-retries=0 --fetch-timeout=15000:
+  exit 0, 2 packages, fresh reviewer cache. Existing isolated runtime reused;
+  no archive download/checksum verification claimed by this reviewer.
+- Same pinned environment: npm run check: exit 0. Exact Node/npm guard passed,
+  rollback PASS and injected quota-policy/blocked upgrade PASS followed assertions.
+- Inline Python manifest/lock/installed package/license assertions: exit 0.
+  Exact two pins agree, no runtime transitives, HTTPS/SHA512 entries and full
+  retained installed LICENSE bytes match ISC/Apache-2.0. Lock SHA256 matches
+  executor: c6c416a92b1a3d10e3fb83bcdbbc803114adbd1dd24e06f5dceebb4b59f9ea7b.
+  Same wrapper runs pinned node src/check-runtime.mjs without npm user-agent:
+  child exit 1 with AssertionError, expected refusal asserted; wrapper exit 0.
+- make check > /tmp/luma-S00-005-qa-4078580caf39-check.log 2>&1: exit 0;
+  72 tests passed in 18.553s. Foundation integrity only, not app readiness.
+- git diff --check and pre-report git status --short --untracked-files=all:
+  exit 0, clean working tree. Final review scope/whitespace checked before approve.
+
+Primary sources independently opened on 2026-10-15:
+[idb upstream documentation](https://github.com/jakearchibald/idb),
+[Dexie design](https://dexie.org/docs/Tutorial/Design),
+[Storage standard](https://storage.spec.whatwg.org/).
+They support the documented promise/transaction lifecycle, candidate abstraction
+and browser-controlled storage policy. No measured superiority is inferred.
+Installed packages/lock supply exact selected version/license evidence.
+
+## Limits and handoff
+
+No browser was invoked by this reviewer; executor reports empty browser inventory.
+Native quota/request/commit failure, physical disk durability, crash/process
+restart, eviction, real multi-tab, persistence grants, account deletion/suppression
+and real crypto-unlock behavior were not verified. In-memory reopen is not restart;
+injection is not native exhaustion. These are explicitly retained external or
+downstream integration checks, not blockers to this bounded ADR experiment.
+No vulnerability/provenance audit, production adapter or app/release readiness
+was verified or accepted. fake-indexeddb remains isolated test-only tooling.
+Reviewer edits only ADR acceptance, experiment README status, report/handoff and
+mandatory commit message plus CLI transition metadata. Coordinator owns commit
+and next process; reviewer exits immediately after approve.

state/handoffs/S00-005.md

@@ -30,3 +30,10 @@ port/adapter was introduced. ADR remains proposed until independent acceptance.
 If QA accepts, record ADR acceptance metadata within its allowed scope and
 separate review evidence, then approve via CLI. Coordinator alone commits and
 launches another fresh session. Executor exits immediately after submit.
+
+Independent QA: auto-qa-4078580caf39, 2026-10-15. Accepted ADR 0004 and bounded
+S00-005 after scoped patch/message review, fresh-cache npm ci, npm run check,
+lock/license/runtime checks and make check (72 tests), all exit 0.
+Evidence: state/evidence/S00-005-review.md. Native browser and durability limits
+above remain unverified; no app implementation or release readiness accepted.
+Coordinator must commit this review transition before the next fresh session.

state/tasks.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "revision": 117,
+  "revision": 118,
   "tasks": {
     "S00-001": {
       "status": "done",
@@ -64,18 +64,21 @@
       "resumed_after_blocker": true
     },
     "S00-005": {
-      "status": "review",
+      "status": "done",
       "owner": "auto-storage-0ce544ac4b40",
       "started_at": "2026-10-15T11:26:11+00:00",
       "reason": null,
-      "updated_at": "2026-10-15T11:33:09+00:00",
+      "updated_at": "2026-10-15T11:37:56+00:00",
       "blocked_by": [],
       "resume_status": "in_progress",
       "blocker_report": "state/blockers/S00-023.md",
       "handoff": "state/handoffs/S00-005.md",
       "previous_owner": "auto-storage-88c3286c6641",
       "resumed_after_blocker": true,
-      "evidence": "state/evidence/S00-005-auto-storage-0ce544ac4b40.md"
+      "evidence": "state/evidence/S00-005-auto-storage-0ce544ac4b40.md",
+      "reviewer": "auto-qa-4078580caf39",
+      "review_evidence": "state/evidence/S00-005-review.md",
+      "completed_at": "2026-10-15T11:37:56+00:00"
     },
     "S00-006": {
       "status": "todo",
@@ -2964,6 +2967,18 @@
       "to": "review",
       "reason": null,
       "evidence": "state/evidence/S00-005-auto-storage-0ce544ac4b40.md"
+    },
+    {
+      "revision": 118,
+      "at": "2026-10-15T11:37:56+00:00",
+      "action": "approve",
+      "task": "S00-005",
+      "agent": "auto-qa-4078580caf39",
+      "role": "qa",
+      "from": "review",
+      "to": "done",
+      "reason": null,
+      "evidence": "state/evidence/S00-005-review.md"
     }
   ],
   "retired_agents": [