Milestone 4 implementation and available local validation are complete. Historical milestone-4 workflows passed Chromium and Firefox; subsequent Settings, plain-English, profile and Contacts folder changes have their own current evidence in BUILD_STATUS. Older browser results are not validation of the current revision. External invitations are not ready: dependency-audit and operational prerequisites remain below. No authorization to deploy, enable a provider or invite testers is implied.
Verified capabilities
Real persistent contact creation/editing, private photos, original notes and history; deterministic alias, typo, negative, appearance and temporal search; unknown/pending safeguards and reversible recognition clues.
Import mapping and bounded CSV/vCard support; shared group/subgroup semantics; explicit duplicate approval and reconciliation-aware undo.
Durable account-isolated enrichment with explicit consent/budgets, stale-result rejection, recovery and unchanged-input reuse; fake test adapters remain labeled and production processing stays disabled.
Backend authorization uses real local Auth/PostgreSQL/private Storage. Direct cross-account and uninvited access, forged relations, imports, merge operations, notes, cues, jobs and cache separation are exercised by the backend and browser suites.
Source deletion now removes unedited/unpinned generated cues and photo-associated jobs/caches. Edited or pinned cues remain visibly outdated, with deleted-source links replaced by explanatory text. Original source corrections retain historical versions.
Historical milestone-4 evidence: 65/65 domain tests, 21/21 real backend regressions, 19/19 enrichment regressions, 1/1 pagination check, 18/18 Chromium (25.5 s) and 18/18 Firefox (34.3 s) workflows; type checks, lint, formatting and production build passed. A real 2,000-contact import/recognition run and clean disposable setup also passed. Final cleanup found zero temporary fixture accounts. Exact commands, fixtures, failures and measured performance are in BUILD_STATUS. Test counts support this bounded evidence; they do not prove every possible behavior.
Approved Contacts folder beta checklist
Current scope is documented in CONTACT_FOLDERS. Automated results are recorded in BUILD_STATUS; these checks do not authorize external invitations.
Three desktop sections, nested paths, explicit current selection and direct-membership markers; narrow and dark/compact layouts.
Three-level hierarchy and duplicate names in separate branches; same-location duplicates, self/indirect cycles and foreign parents rejected.
Shared people across branches and sibling subgroups deduplicate; parent/child checkboxes are independent.
Include subgroups, scoped search and People count leave overall totals and saved links unchanged; empty and descendant-only states are distinct.
Root/subgroup creation shows its location; bulk add preserves links, marks existing members and is idempotent.
Current-revision Firefox/WebKit, full assistive-technology audit and large/deep real-world library stress.
Migrations 016–017 are applied locally; other installations must apply them and rebuild without resetting saved libraries. Existing bounds remain 100 directly chosen groups per editable contact and 500 people per additive request. No external integration or billable provider was activated.
Known limitations and unexecuted checks
Live model accuracy, uncertainty preservation, refusal behavior, availability and actual billing remain unverified. No local vision adapter exists.
The application loads the full owned library. The 2,000-contact fictional test exercises this design; larger libraries, many large photos/notes, deep group hierarchies and concurrent multi-user stress remain unverified.
Keyboard/accessible-name/focus and selected contrast checks are bounded checks, not a complete accessibility or assistive-technology audit.
A clean install from the existing npm cache and a separate fresh Supabase stack passed on this machine; fresh OS, uncached network downloads and new Docker installation remain unverified. WebKit was attempted but page creation failed with Unknown setting: PushAPIEnabled (1 failed, 1 interrupted, 16 unexecuted). Its frozen macOS-14 engine cannot establish WebKit/current Safari compatibility.
Long idle expiry, exhaustive network races, hosted backups and retention, account-erasure operations, operational monitoring and external-beta support remain unverified or unimplemented.
Current dependency advisory data was unavailable through npm audit (registry error). Historical audit results are not a fresh security clearance.
Blocking issues and release prerequisites
The source-deletion retention defect is fixed with real-database regressions. No unresolved critical privacy, account-isolation, merge/undo or data-loss defect was found in the completed checks. The audit/engine gaps above remain open. External tester invitations require separate authorization and operational preparation:
Choose and authorize hosting, TLS/origin settings and a private production database/storage configuration; validate deployed RLS, caching and logging.
Obtain a successful current dependency audit and triage advisories; the existing development lint chain has historical advisories and a deprecation warning.
Define and test approved-account provisioning/revocation, account deletion, backups/restore and retention/erasure procedures. Contact deletion removes private objects before database rows; an interrupted deletion may need retry. Local Docker volumes persist until explicitly removed; no hosted retention promise exists.
Complete the desired accessibility/browser/device validation and agree on practical library-size expectations from measurements.
Keep provider processing disabled until the separately authorized fictional live test below succeeds.
Separately authorized live-provider test
Obtain explicit authorization before creating/reusing a server-only credential or sending data. Use a fictional account and synthetic notes/photos only; configure the model, remote enable flag, verified conservative token prices and image-token bound documented in README. Approve a small explicit scope and hard budget in Improve. Start the real worker intentionally, inspect pending photo review and source-linked Unreviewed summaries, verify no transmission on profile/search/quiz reads, and compare usage with actual provider billing. Preserve refusal, ambiguity, timeout, stale-source and cost evidence. No live test or credential setup was performed during milestone 4.
Owner profile / adaptive Find someone update
The local follow-on adds private owner profiles, saved invited-account onboarding and the approved common-first/balanced quiz. Migration 018 backfills blank nonblocking profiles for existing accounts and 019 makes basic setup atomic; no contacts are converted or removed. Current execution evidence is in BUILD_STATUS.md. Hosted migration rollout, backup/restore/monitoring, real-user testing and external provider readiness remain operational prerequisites; this task neither deploys nor opens public signup.