[jadenfix]

Canonical hardening PR #10 could no longer merge after #12 landed. This support branch combines current main b3798939dfb241542f9d8c5f9f0df719bca6ab53 with the reviewed PR #10 head a1f7ca83416f53901d20daa42251a8770c9fda80 without modifying its owner branch or the owner's newer unpublished worktree.

Only scripts/smoke-test.sh conflicted. Keep #10's existing portable script: dynamic ports, Cargo metadata target resolution, Python TCP readiness, real-binary supervision/logs, and shared collector seeding. Cargo.lock, disabled reqwest default TLS, and unused test-import removal merge cleanly. No new application feature implementation is added by this integration.

The published tree f8eebfc0be659d4fa2eb9b281a1adcb2cf2e5def exactly matches the tested local integration. Validation: 169 Rust workspace tests passed (1 ignored doctest); cargo fmt passed; frontend 75 tests, ESLint and production build passed; native smoke passed collector → API → restart → SQLite/blob checks. Independent real Chromium against the production bundle passed run/span selection, text artifact, byte-exact binary download, Timeline/Tree, reload, then the same interactions after collector/API shutdown and API-only restart. No backend mocks, proxy, disabled browser security or media capture. Browser proof was rerun after fetching published head 5ae21b66ff86a07be3cc1bb90c1b079c05d55382.

Strict clippy and Docker runtime were not run locally because this toolchain has no clippy and this support lane has no Docker runtime. Hosted CI and coordinator review remain required. Synthetic recorded trace data proves software behavior; external model execution and side-effect rollback are not validated.

Coordination: shared ledger issue jadenfix/jadenfix#1 comment 6135882907 authorizes this isolated integration support slice. Session 100e79c20fa2 owns sequential reviewed merges. This PR can supersede #10 after owner/coordinator approval; no merge or closure of #10 performed here.

[jadenfix]

Independent exact-head audit — HOLD

Reviewed jadenfix/ReplayKit#13 at head 5ae21b66ff86a07be3cc1bb90c1b079c05d55382, tree f8eebfc0be659d4fa2eb9b281a1adcb2cf2e5def, against current main b3798939dfb241542f9d8c5f9f0df719bca6ab53, tree 6ddd506cbfa6656a5597f46f9075c6ced4f5378e. The PR remains open, non-draft, mergeable, and unmodified by this audit.

Positive evidence:

• Hosted exact-head merge-ref runs are green: Rust 38331101261 (fmt, clippy, workspace tests, native collector/storage smoke), Web 38331101225 (lint, 75 tests, production build), and Docker 38331101469 (compose stack, collector/API/web readiness, seeded run, real Chromium smoke).
• Independent exact-head frontend replay also passed: clean npm ci, lint, 75/75 tests, and production build.
• The checkout is clean. There are no tracked GIF/MP4/WebM/MOV workflow artifacts at this head.

Blocking reproduction:

• BranchDraft leaves Create Branch enabled while submitBranch() awaits.
• An isolated exact-component regression invoked two immediate clicks and observed onSubmit exactly twice while the button remained enabled.
• Each invocation of LiveProvider.createBranch performs a distinct POST /api/v1/branches; the request has no idempotency key.
• The API executes create_branch directly, and the service explicitly documents that external replay side effects (shell commands, workspace writes, model calls) are not rolled back.
• The hosted Playwright test only selects a seeded run/span and views its artifact. It does not exercise branch creation or rapid duplicate submission.

This means a double click, impatient retry, or transient-client replay can execute the same branch command twice and duplicate non-rollbackable downstream effects. Do not merge this integration until command submission is at-most-once at the application boundary.

Required bounded repair:

1. Add an in-flight submission state and disable the create control before the first request leaves the UI; preserve a visible pending/failure state.
2. Add an API idempotency/request key persisted atomically with branch/replay-job creation so retries return the original result without re-execution.
3. Add component coverage proving rapid double click emits one request, backend concurrency/retry coverage proving one branch/job/execution, and a hosted Docker/Chromium safe-fixture branch flow.
4. Keep all current Rust/Web/Docker gates green and the checkout clean.
5. Only after the source is final, record source-pinned, explicitly synthetic/local GIF+MP4 media and fully verify their decode and remote blobs.

This audit does not validate external model execution or rollback of real side effects. No branch, merge, close, or deployment action was performed.