LumaWeb/state/evidence/S00-005-review.md

S00-005 independent QA review

Reviewer: auto-qa-4078580caf39 (qa), 2026-10-15. Executor: auto-storage-0ce544ac4b40 (storage). Decision: approve bounded storage design; ADR 0004 accepted.

Input: startup/master/role/workflow instructions, required TESTING/storage/ADR registry, assigned card/packet, original handoff and executor evidence/message, exact STORE-001/STORE-004, accepted ADR 0001 and direct S00-002/S00-023 executor and review evidence/handoffs. Output: accepted ADR metadata and this review. Acceptance: storage policies plus rollback and quota/blocked-upgrade experiments, within the two allowed source paths, with reproducible evidence/handoff.

Findings against acceptance

1. ADR compares native IndexedDB, idb and Dexie, selecting idb 8.0.4 with a bounded ergonomics justification. It defines account-scoped keys, separate stores in one database, history/checkpoint atomicity and success after tx.done. Migration steps, rollback/forward retry, connection ownership and blocked/terminated behavior are explicit. Quota/eviction cannot report durable success; pending-memory and cache cleanup policies exclude automatic crypto/trust/unsynced-history removal. Storage owns opaque persistence; crypto owns serialization, keys and unlock. Passwords remain memory-only; persistent unlock requires a separate decision. No new schema/port or production implementation is claimed. STORE-001/004 policy requirements are covered at this card's ADR level.
2. Rollback executes the selected idb wrapper over fake-indexeddb. A real fixture unique-index violation produces ConstraintError and open AbortError. Assertions verify version, original exact row, absent new store/index, successful forward retry/query and same-process reopen. Promise catches observe rejection without preventing the native error event's transaction abort. This repairs the historical unfinished repeated-store and overwritten-handler probe.
3. Quota injection is explicitly synthetic, after both requests succeed. Actual fixture abort restores the checkpoint and removes pending history; account B's history/settings/opaque crypto fixture survives. Retry/reopen checks committed history and checkpoint. Held v1 connection observes versionchange and blocked before upgrade executes; closing it permits v2, preserves checkpoint and rejects stale v1 with VersionError. These satisfy the bounded scenario acceptance without claiming native quota generation or browser multi-tab execution.
4. Inspected implementation commit 0e2b3098df, its actual source diff/message and prior interrupted checkpoint 5f4d044. Implementation source paths are only docs/decisions/0004-storage-design.md and experiments/0004-storage-design; remaining paths are workflow/generated metadata. Historical RECOVERY.md and _probe.mjs were preserved. Executor commit message accurately describes the diff and limits. Initial and pre-report working trees were clean. No immutable specs, shared contracts, application source or system/Git configuration changed. No acceptance defect or independent review blocker found.

Actual independent commands/results

• python3 scripts/tasks.py resume --agent auto-qa-4078580caf39; show S00-005; packet S00-005 --agent auto-qa-4078580caf39: exit 0 each. Empty reviewer owned list is expected; distinct executor and done prerequisites; no claim.
• Read-only git log/show/status, assigned artifact reads and exact spec rg lookup: exit 0. Explicit ancestor AGENTS.md inspection found none.
• From experiments/0004-storage-design using PATH=/tmp/luma-approved-toolchain/node-v24.21.0-linux-x64/bin:$PATH: npm ci --ignore-scripts --no-audit --no-fund --cache /tmp/luma-storage-qa-4078580caf39 --fetch-retries=0 --fetch-timeout=15000: exit 0, 2 packages, fresh reviewer cache. Existing isolated runtime reused; no archive download/checksum verification claimed by this reviewer.
• Same pinned environment: npm run check: exit 0. Exact Node/npm guard passed, rollback PASS and injected quota-policy/blocked upgrade PASS followed assertions.
• Inline Python manifest/lock/installed package/license assertions: exit 0. Exact two pins agree, no runtime transitives, HTTPS/SHA512 entries and full retained installed LICENSE bytes match ISC/Apache-2.0. Lock SHA256 matches executor: c6c416a92b1a3d10e3fb83bcdbbc803114adbd1dd24e06f5dceebb4b59f9ea7b. Same wrapper runs pinned node src/check-runtime.mjs without npm user-agent: child exit 1 with AssertionError, expected refusal asserted; wrapper exit 0.
• make check > /tmp/luma-S00-005-qa-4078580caf39-check.log 2>&1: exit 0; 72 tests passed in 18.553s. Foundation integrity only, not app readiness.
• git diff --check and pre-report git status --short --untracked-files=all: exit 0, clean working tree. Final review scope/whitespace checked before approve.

Primary sources independently opened on 2026-10-15: idb upstream documentation, Dexie design, Storage standard. They support the documented promise/transaction lifecycle, candidate abstraction and browser-controlled storage policy. No measured superiority is inferred. Installed packages/lock supply exact selected version/license evidence.

Limits and handoff

No browser was invoked by this reviewer; executor reports empty browser inventory. Native quota/request/commit failure, physical disk durability, crash/process restart, eviction, real multi-tab, persistence grants, account deletion/suppression and real crypto-unlock behavior were not verified. In-memory reopen is not restart; injection is not native exhaustion. These are explicitly retained external or downstream integration checks, not blockers to this bounded ADR experiment. No vulnerability/provenance audit, production adapter or app/release readiness was verified or accepted. fake-indexeddb remains isolated test-only tooling. Reviewer edits only ADR acceptance, experiment README status, report/handoff and mandatory commit message plus CLI transition metadata. Coordinator owns commit and next process; reviewer exits immediately after approve.