Close Milestone 3 with measured projection evidence

DEVELOPMENT_NOTES.md

@@ -345,7 +345,7 @@ These are notes, not commitments:
   than bounded positions, they will need a different versioned security contract and persisted key
   lifecycle.
 
-## Milestone 2 — active: agent retrieval and MCP experience
+## Milestone 2 — complete: agent retrieval and MCP experience
 
 ### Audit reconciliation
 
@@ -611,10 +611,10 @@ task-shaped capsule for every continuation page, add authenticated continuation
 model requires it, verify a native Claude timeout representation, and introduce adapter-owned
 launcher metadata before generating configurations for custom adapters.
 
-## Milestone 3 — active: independent projections
+## Milestone 3 — complete: independent projections
 
 Milestone 3 began only after `main` and `dev` were aligned at the verified Milestone 2 closeout.
-Three read-only audits are running before source changes:
+Three read-only audits ran before source changes:
 
 - Manual planning, immutable packages, renderer isolation, receipts, preview/application
   integration, and full/incremental equivalence.
@@ -692,8 +692,95 @@ The first slice now implements:
 - A live-viewer correction: source evidence now comes from the pinned index generation. The
   viewer no longer reopens mutable canonical files behind an older graph snapshot.
 
-The new repository-native contract target passes 91 tests and 120 subtests. The combined
-projection, rendering, and live-viewer focus passes with byte-exact compatibility and no hidden
-source/path authority. This is not Milestone 3 closeout: durable multi-artifact publication,
-portable graph rendering, detached workers, fragment reuse/equivalence, policy version 2,
-accessibility, and maintained scale evidence remain active work.
+The new repository-native contract target passed 91 tests and 120 subtests at the slice boundary.
+The combined projection, rendering, and live-viewer focus passed with byte-exact compatibility and
+no hidden source/path authority.
+
+### Durable portable graph publication
+
+The portable graph path now has its own declared `graph_render` views, pure plans, fixed
+`portable_graph_html` renderer, content-addressed artifact store, renderer receipts, and one bounded
+generation/view manifest as the publication commit. It supports Nodes, Flow, and Web without
+including Logic. Static HTML contains the complete pre-rendered graph and treats JavaScript as
+progressive enhancement.
+
+Publication revalidates source, view, artifact, receipt, and output identities across replacement.
+Status reads only bounded manifest and receipt evidence. It never plans or renders. Repair may
+restore a declared output from its content-addressed artifact. A post-artifact failure that cannot
+be rolled back returns explicit degraded committed evidence rather than reporting an ordinary
+failed mutation.
+
+### Detached workers and incremental fragments
+
+Manual and portable graph packages execute through one fixed one-request child protocol. The
+parent launches isolated Python from a trusted working directory with a sanitized environment,
+spools stdout to disk, reads one bounded canonical response, and validates the complete artifact
+and receipt identity. The worker accepts only the two built-in renderer identities. Requests are
+bounded by the 24,000,000-byte package contract, actual artifact transfer by 20,000,000 bytes, and
+execution by a 30-second timeout.
+
+Manual fragment records are semantic, versioned, canonical, hash-bound, and stored below a
+dedicated confined cache. The worker independently recomputes the expected page fragment before
+using a record. Corrupt, forged, oversized, stale, or aggregate-oversized records fall back to the
+full detached render. Cold fragment creation is compared byte-for-byte with that full oracle before
+cache publication. The cache retains only the current inventory and is capped at 10,000 entries
+and 64,000,000 bytes.
+
+### Independent policies and accessibility
+
+Projection policy version 2 independently composes manual `auto|explicit|disabled`, portable graph
+`explicit|disabled`, and live viewer `on-demand|disabled`. CLI, MCP, generated client
+configuration, doctor, render services, canonical application, onboarding, and viewer-manager
+entry points enforce their relevant policy. Status remains available when an active operation is
+disabled.
+
+Generated client evidence binds the projection policy, its hash, projection availability, and the
+current descriptor hash into the configuration hash. Validation cross-checks omitted default
+selectors against the bound descriptor so coordinated policy and availability drift fails closed.
+The version-1 effective-policy payload remains unchanged for existing clients.
+
+Pinned Playwright 1.62.0 and axe-core 4.12.1 gates exercise the frozen manual, portable graph, and
+live viewer with selected WCAG A/AA axe tags and keyboard interaction flows. Portable and live
+graph presentation received only the minimal contrast and nested-role corrections needed by those
+gates.
+
+### Scale and runtime hardening
+
+The first 1,000-node full benchmark exposed recursive strongly connected-component traversal in
+manual planning. Cycle detection now uses an iterative two-pass traversal. A regression covers the
+descriptor maximum of 10,000 nodes as both a deep acyclic chain and one strongly connected
+component.
+
+The isolated wheel proof also exposed a Python `runpy` warning when the worker module was imported
+during package initialization before `-m` execution. A private fixed module entrypoint now owns
+child startup. Malformed child input returns code 2 with empty stdout and stderr.
+
+Configured render ceilings above 20,000,000 bytes remain accepted for compatibility, and small
+actual artifacts render normally. The detached protocol still rejects an actual transfer beyond
+its fixed 20,000,000-byte boundary.
+
+### Milestone 3 closeout
+
+Candidate `f5dccb5e1c312121f1af63780162f593d9363b98` passed the complete repository gate: formatting,
+Python and web lint, strict types, compilation, 281 tests and 272 subtests, three accessibility
+flows, lock and dependency checks, package builds, and all milestone smoke benchmarks. The
+maintained projection contract subset passed 142 tests and 236 subtests.
+
+The clean ten-sample 1,000-node benchmark passed every latency, memory, response-size, no-work, and
+equivalence gate. Manual full rendering measured 810.490 ms p95, portable graph full rendering
+323.690 ms p95, and receipt-only status 111.381 ms and 59.331 ms p95 respectively. Direct detached
+worker peaks were 88,580,096 and 89,583,616 bytes. The separately gated production manual worker
+peak was 104,771,584 bytes. Production cold, warm, forced-full, add, change, delete, and reorder
+outputs were byte-identical.
+
+Production warm fragment rendering measured 2,206.540 ms p95 versus 978.870 ms for forced full.
+Milestone 3 therefore closes the fragment isolation, invalidation, equivalence, and recovery
+contract without claiming a throughput win. Later optimization must begin from that evidence.
+
+The exact method and measurements are recorded in `docs/MILESTONE_3_BASELINE.md` and
+`benchmarks/milestone3-2026-07-29.json`. The candidate passed an isolated wheel CLI/MCP/worker
+proof. Gitleaks 8.30.1 found no findings across the six Milestone 3 commits or candidate tree.
+
+Milestone 3 is complete. No tag, release, production integration repointing, WorldForge change,
+ScrapeStation change, storage rewrite, or self-hosting dependency was introduced. Milestone 4
+remains directional and has not started.