# S00-002 rendering spike

One local React/TypeScript/Vite experiment for ADR 0001. The registry-access/
subdirectory belongs to the reviewed S00-011 probe and is retained unchanged.
No account, network messaging, crypto, media, service worker or application
scaffold is implemented here.

## Reproduce

Use Node **24.21.0** with bundled npm **11.19.0**. `.nvmrc` is a pin for an
existing version manager; installing the spike never changes system runtimes.
Official binaries: https://nodejs.org/dist/v24.21.0/ — verify the selected archive
against SHASUMS256.txt with normal TLS trust. On this executor, the verified
macOS ARM64 runtime was unpacked at
`/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64`.

From this directory with the pinned runtime's bin directory first on PATH:

```sh
node --version
npm --version
npm ci --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-stack-review-cache --fetch-retries=0 --fetch-timeout=15000
npm run build
npm run preview -- --port 4173 --strictPort
```

Use a new cache path for a network/clean-cache check. npm ci itself removes old
node_modules and fails on lock/manifest mismatch. Keep optional platform packages
enabled; TypeScript/Vite use platform binaries and build succeeds without
lifecycle scripts. TLS verification and exact engine checks remain enabled.
The private package is not published. npm install is only for explicitly reviewed
lockfile updates, not normal reproduction.

Open `http://127.0.0.1:4173` locally: expect “Luma rendering spike” and “Count: 0”.
Click Increment twice: expect Count: 2. This is the manual DOM/interaction check;
it was **not run** because this harness exposes no browsers. Build/typechecking
were run successfully. Stop the server with Ctrl-C. `npm run dev` is available
for source development; no React refresh plugin is installed.

Build output/node_modules are ignored. The browser bundle is static and requires
no Node server. Explicit compiler floors: Chrome/Edge 111, Firefox 114, Safari
16.4, with no API polyfills; the product browser matrix is a later decision.
Preserve THIRD_PARTY_NOTICES.md when distributing this bundle; full lock graph
licenses are in LICENSE_INVENTORY.md. CI, release notice automation, app tests
and cryptographic/protocol compatibility remain subsequent tasks.