case 4690 - record: final gate, release candidate build, Cypress 27/27, performance figures

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

devdocs/modernization/NET10-PORT.md

@@ -134,7 +134,7 @@ suite is waiting on (case 4653, case 4654, the contract issue).
 - [x] **Reports, all advanced reports**, compared with the baseline PDFs. Done: Windows (page counts = PuppeteerSharp 17), Ubuntu 24.04 and 26.04 droplets, 22/22 each; John checked the PDFs visually; `ldd` clean on both Ubuntu versions; no orphaned browser processes after a cancelled render. Was: On Windows and on Linux. On Linux also: `ldd` on the downloaded browser binary for missing libraries (install exactly what is reported; several Ubuntu 24.04+ names carry a `t64` suffix); the sandbox under the service account; no orphaned `chrome` processes after a cancelled render
 - [x] Integration suite: same result as the baseline. Locally on every step; on both droplets with `UserWithActivityShouldNotBeDeleteable` excluded (it deletes SuperUser when SuperUser has no related records, see Deferred)
 - [x] Licence verification gate: green. 730/730 on 2026-10-23 at `181b1e44` (`dotnet test ayanova.tests`); re-run in the final gate (section 5)
-- [ ] Cypress E2E (`raven-test\e2e`) against a devtest server running the .NET 10 build (`devtestn10` is kept for this until release, John). First set `"expectedServerVersion"` in `raven-test\e2e\cypress.json` to 8.3.0 (it says 8.2.4). Also covers the UI half of "exercise LINQ-based queries screen by screen" (section 1)
+- [x] Cypress E2E (`raven-test\e2e`) against a devtest server running the .NET 10 build (`devtestn10` is kept for this until release, John). First set `"expectedServerVersion"` in `raven-test\e2e\cypress.json` to 8.3.0 (it says 8.2.4). **Done 2026-10-26: 27/27** on `devtestn10` with the release candidate build (Electron, from the workstation). Getting there fixed the tests, not AyaNova (`raven-test` `e0b3641`, `ad8fbde`, `2ec1e03`): logins failed at random over the internet because the login page reloads once on a first visit (service worker taking control) and can move the focus back to the username field while it settles; 8.2.4 on devtest failed the same way. `0900` looked for its notification before the server's once-a-minute delivery; it now reloads until it arrives. Also covers the UI half of "exercise LINQ-based queries screen by screen" (section 1)
 - [x] `build-release.bat` produces all five packages; install and start each one: Windows standalone, Windows LAN, Linux server, Linux desktop, subscription Linux. All five built (2026-10-23, from `4a011f65`+). **Linux done** on droplet `devtestn10` (Ubuntu 24.04): subscription zip as an in-place upgrade of 8.2.4, perpetual server and desktop zips booted fresh (see log). **Windows standalone done** in Windows Sandbox (upgrade 8.2.4 → 8.3.0, uninstall, fresh install; see log); fresh install needed the `standalone.iss` PostgreSQL folder fix. **Windows LAN done** in Windows Sandbox (fresh install following the manual, see log). Re-check both Windows installers from the final release build (they carry the fixes made during this test)
 
 ## 5. Release
@@ -147,7 +147,7 @@ suite is waiting on (case 4653, case 4654, the contract issue).
   - Windows standalone and the launcher are self-contained: no runtime needed on the customer's machine. **But they carry the .NET runtime of the build machine's SDK:** SDK 10.0.103 → runtime 10.0.3 (the Sandbox test logged `.Net Version - 10.0.3`; Linux hosts run 10.0.13). Before the final release build, update the workstation's .NET 10 SDK to the newest release so the standalone package ships the current runtime with its security fixes. 8.2.4 did the same with .NET 8.0.13. **Done 2026-10-23:** SDK 10.0.402 installed with winget (`winget upgrade` did not find the Visual Studio-installed 10.0.103); test publish of the standalone server and the launcher bundles runtime 10.0.13. Standing note added to `devdocs/build/BUILD.md`
 - [x] Customer manual (`docs/`): system requirements and upgrade instructions for self-hosted customers. Report browser move (section 3): manual already updated in the same commit (`ops-config-report-render-browser-path.md`, `ops-install-linux-server.md`, `ops-upgrade-linux-server.md`, `ops-upgrade-linux-desktop.md`). .NET 10 runtime install and upgrade steps (Windows LAN and IIS, Linux server and desktop), Ubuntu 24.04/26.04, backup password note and the 8.3.0 changelog draft: `111d7922` (2026-10-23). Changelog wording to be finalised by John before release. Possible extra line: John notices the UI is much faster than 8.2.4 in local debugging (2026-10-24); add a performance line only if confirmed on `devtestn10` against 8.2.4 on devtest (same droplet type and network distance, e.g. Cypress run times)
 - [ ] Build machines: the workstation has the .NET 10 SDK (10.0.402, plus 10.0.103 from Visual Studio). The backup laptop needs it before it can build 8.3.0 (`winget install --id Microsoft.DotNet.SDK.10 -e --source winget`; the .NET 8 SDK is no longer needed); tracked with the laptop's other catch-up items in `devdocs/build/BUILD.md`. `devdocs/build/DEV-VM-SETUP.md` and `devdocs/build/BUILD.md` updated (2026-10-23). The build VM is deprecated (John, 2026-10-23): n/a
-- [ ] Final gate runs on the finished code (after the "next release" cases, on the release build from `main`)
+- [x] Final gate runs on the finished code (after the "next release" cases, on the release build from `main`). **Done 2026-10-26 at `c19a3b04`** with SDK 10.0.403 (runtime 10.0.14): licence gate 730/730; integration suite on a fresh trial database 149 tests, 143 passed, 2 failed (the two known: `ContractCrud.CRUD`, `CustomerWithWorkOrders_CannotBeDeleted`; the only two errors in the server log are theirs), 4 skipped; no EF Core warning raised as an error. Release candidate build from the same commit: all five packages 8.3.0, Windows standalone and launcher bundle runtime 10.0.14, Linux zips `http://*:7575` as shipped; installed on `devtestn10` as a subscription upgrade, hardening intact. Final build follows John's changelog edit (docs only)
 - [x] Merge, per repo. **Done 2026-10-23, without a tag** (John): port merged before the "next release" cases so the port and each case stay separate in history. `raven` `36633011`, `raven-client` `44d91611`, `raven-launcher` `d296298`, `raven-test-integration` `0384bb8`; before each merge `main` had no commits outside `net10-port`, after it `git diff net10-port main` was empty; pushed. From here: cases as their own commits on `main` with their own case numbers; the tag lines below run at release. An urgent 8.2.x fix would branch from `net8-baseline` (= 8.2.4):
   ```powershell
   git switch net10-port; git status; git push; git fetch origin
@@ -277,6 +277,7 @@ Found during the port, out of scope. One line each.
 - **Done in case 4703.** **Improvement, own case after the port (John to create):** bring back logging of JavaScript error details from report page console errors, as Sockeye's port did. AyaNova logs only `ERROR: {message text}`; the per-argument detail (`arg instanceof Error ? arg.message : arg`) is commented out at `biz/ReportBiz.cs:873-876` since case 4586, because `IJSHandle.ExecutionContext` was removed. Sockeye 8.1.0 (`server/biz/ReportBiz.cs:575`) evaluates on the handle instead: `args.Message.Args.Select(arg => arg.EvaluateFunctionAsync("(arg) => arg instanceof Error ? arg.message : arg"))`, which also needs the console handler to be `async` again
 - Pre-existing, same in 8.2.4 (found in the 4579 sandbox test, John: Deferred): rendering a report for a record that does not exist (e.g. work order ids 1 and 2 in a trial without sample data) fails the job with a generic `ArgumentNullException` ("Value cannot be null. (Parameter 'o')") from `JObject.FromObject` in `WorkOrderBiz.GetReportData` (`WorkOrderBiz.cs:1030`), instead of skipping the missing record or saying it is not found. Other object types' `GetReportData` likely do the same
 - **Roles audit, case 4735 (John, 2026-10-25, this release; found in 4719):** check every object's rights as documented in the manual (each page's "Authorization Roles required" section and `ay-biz-admin-roles.md`) against `biz/BizRoles.cs`. Report templates were changeable by Business administration - restricted although the roles page uses exactly that case as its example of a view-only restricted role (fixed in 4719). If that slipped through there could be others; for each mismatch decide whether the code or the page is wrong
+- Found in the 8.3.0 Cypress runs (2026-10-26; pre-existing, 8.2.4 too): on a first visit over a slow connection the login page can move the keyboard focus back to the username field while it settles (the field has `v-focus` and is re-inserted when the page redraws), so part of a password typed early lands in the username field in plain view; and the service worker reloads the page once when it takes control (`App.vue`, `controllerchange`), clearing both fields. Both within the first seconds of a first visit
 - From case 4697 (John: Deferred): (1) a relative date range that crosses a daylight saving change can be an hour off at its far end, because the client sends only its current offset with list requests; exact would need the client to send its IANA time zone name too (front-end change). (2) Dashboard widgets group by day, week or month with `date_trunc` on the stored UTC times, so for a user far from UTC an item near midnight lands in the neighbouring bar; same need for the time zone name
 - From case 4727 (John: later hardening case, 2026-10-26): AyaNova runs as `www-data` on droplets and in the Linux manual (as in Microsoft's ASP.NET Core with NGINX guide), the same account as NGINX's workers, so NGINX can read `config.json` (database password) and write `data`. A dedicated `ayanova` system account isolates them: service `User=`, ownership, the setup script and the manual, plus a migration for existing droplets and self-hosted installs
 - Found in the case 4727 droplet test (2026-10-26; John: later case, early in a future release so every other test exercises it): stopping the service sometimes logs `ObjectDisposedException` from `JobsBiz.ProcessJobsAsync`, and the server-problem notification it tries to raise fails the same way, so nothing is sent. Pre-existing: 8.2.4 on devtest logged it at 2 of its last 40 stops (2026-09-10, 2026-10-01). Cause: `GeneratorService.StopAsync` (`generator/Generate.cs`) is overridden to return at once without calling `base.StopAsync`, so the host neither signals the job loop nor waits for it, and disposes its services while a pass may still be running; `Task.Delay(1000)` also ignores the stopping token. Fix: remove the override (or call the base) and pass the token to `Task.Delay`; test stopping during a report render and a backup, since shutdown would then wait for the running pass
@@ -323,3 +324,4 @@ Found during the port, out of scope. One line each.
 | 2026-10-23 | Windows LAN installer in a fresh Windows Sandbox, following `ops-install-windows-lan.md`; installer from this branch with the PostgreSQL link fix (`ayanova-windows-x64-lan-setup-pglink.exe`) | Hosting Bundle prompt opened the .NET 10 page; .NET 10.0.13 Hosting Bundle installed (very slow in the Sandbox, normal there). PostgreSQL prompt opened `postgresql.org/download/windows/`, which links to EDB; PostgreSQL 18.6-5 installed (it installs the Visual C++ runtime itself, no Sandbox crash with vGPU off). `config.json` edited (password, own JWT secret; the Sandbox has no Notepad, edited with PowerShell). AyaNova 8.3.0 boots on .NET 10.0.13, database created at schema 20, no JWT warning, no `Chrome` folders. After licensing (John), an on-demand backup succeeded with the template's `PostgreSQL\18\bin` pg_dump path. Windows Firewall prompt on every start in the Sandbox (fresh Windows each session), expected |
 | 2026-10-23 | Checklist tidy-up: older unticked items in sections 0–5 checked against current evidence | `main` = `origin/main` = `net8-baseline` in `raven` and `raven-client`; tag on both remotes. Licence gate 730/730 at `181b1e44`. No EF Core warning raised as an error in any log (local dev server, Sandbox, `devtestn10`). `System.Text.Json` 5.0.2 gone from the graph. JwtBearer 10.0.13 done. Report and E2E baselines marked waived (John); Cypress stays open in section 4 and now also covers the UI side of the EF Core screen-by-screen item. Restore manual compared: fine for the default `postgres` setup; dedicated-role note added to Deferred. Stale "still to do" remarks removed. Still open: relative date tokens (section 3, decision needed), Cypress, and the section 5 release steps |
 | 2026-10-23 | `net10-port` merged into `main` (`--no-ff`, no tag) in `raven`, `raven-client`, `raven-launcher`, `raven-test-integration` (John) | Pre-checks: all clean and pushed; `main` = `origin/main` with no commits outside `net10-port`. Post-checks: `git diff net10-port main` empty in all four; pushed. `CLAUDE.md` "Current work" now describes the 8.3.0 release on `main`; stack table updated to .NET 10; dependency rule no longer refers to the port branch. `net10-port` branches kept until after release (section 5) |
+| 2026-10-26 | Final gate, release candidate build, Cypress | See section 5. Performance, same suite and browser, devtest (8.2.4) and `devtestn10` (8.3.0), same droplet size and region (San Francisco): generating the test data 1:43 on 8.2.4, 0:42 and 0:45 on 8.3.0 (about 2.4 times faster; mostly server work); the 21 UI specs that passed in both, 224 s and 200 s (about 10% faster; much of a UI test is Cypress itself). `build-release.bat` failed twice at the subscription zip while an Explorer or PowerShell window was open on `dist\installers` (folder in use); clean once closed |