Use runtime DB timestamps and verify guest/user seed integrity - PR_26158_037-db-seed-integrity

Author: ToolboxAid

docs_build/dev/reports/coverage_changed_js_guardrail.txt

@@ -6,7 +6,16 @@ Missing changed runtime JS files are WARN, not FAIL.
 Source: Playwright/Chromium built-in V8 coverage from the active Playwright run.
 
 Changed runtime JS files considered:
-(0%) src/dev-runtime/server/local-api-server.mjs - WARNING: changed runtime JS file was not collected by Playwright V8 coverage; advisory only
+(0%) src/dev-runtime/persistence/mock-db-store.js - WARNING: changed runtime JS file was not collected by Playwright V8 coverage; advisory only
+(0%) src/dev-runtime/server/mock-api-router.mjs - WARNING: changed runtime JS file was not collected by Playwright V8 coverage; advisory only
+(0%) toolbox/assets/assets-mock-repository.js - WARNING: changed runtime JS file was not collected by Playwright V8 coverage; advisory only
+(0%) toolbox/colors/palette-workspace-repository.js - WARNING: changed runtime JS file was not collected by Playwright V8 coverage; advisory only
+(0%) toolbox/project-journey/project-journey-mock-repository.js - WARNING: changed runtime JS file was not collected by Playwright V8 coverage; advisory only
+(87%) src/engine/api/mock-db-viewer-ui.js - executed lines 517/517; executed functions 85/98
 
 Guardrail warnings:
-(0%) src/dev-runtime/server/local-api-server.mjs - WARNING: changed runtime JS file missing from coverage; advisory only
+(0%) src/dev-runtime/persistence/mock-db-store.js - WARNING: changed runtime JS file missing from coverage; advisory only
+(0%) src/dev-runtime/server/mock-api-router.mjs - WARNING: changed runtime JS file missing from coverage; advisory only
+(0%) toolbox/assets/assets-mock-repository.js - WARNING: changed runtime JS file missing from coverage; advisory only
+(0%) toolbox/colors/palette-workspace-repository.js - WARNING: changed runtime JS file missing from coverage; advisory only
+(0%) toolbox/project-journey/project-journey-mock-repository.js - WARNING: changed runtime JS file missing from coverage; advisory only

docs_build/dev/reports/db-seed-integrity-report.md

@@ -0,0 +1,71 @@
+# PR_26158_037 DB Seed Integrity Report
+
+## Executive Summary
+
+Local DB and Local Mem seed creation now use runtime-generated timestamps for createdAt and updatedAt instead of hardcoded 2026 seed anchors.
+
+The server seed snapshot now includes a standalone `tool_state_samples` table. Guest rows are generated from the active toolbox registry so every available tool has a loadable starter toolState/sample row. User rows provide unique user-owned project/toolState seed records for User 1, User 2, User 3, and Admin without storing Guest as a DB user.
+
+## Implementation
+
+| Area | Change | Evidence |
+| --- | --- | --- |
+| Shared mock DB schema | Added `tool_state_samples` schema and standalone ownership. | `src/dev-runtime/persistence/mock-db-store.js` |
+| Runtime timestamps | Replaced fixed 2026 seed timestamp helpers with runtime timestamp generation in shared DB, Palette, Asset, and Project Journey seed helpers. | `src/dev-runtime/persistence/mock-db-store.js`; `toolbox/colors/palette-workspace-repository.js`; `toolbox/assets/assets-mock-repository.js`; `toolbox/project-journey/project-journey-mock-repository.js` |
+| Server seed table | Added server-side `tool_state_samples` rows for guest active-tool starters and unique human-user seed rows. | `src/dev-runtime/server/mock-api-router.mjs` |
+| DB Viewer visibility | Added a standalone `Tool State Samples` filter label and userKey relationship diagnostics. | `src/engine/api/mock-db-viewer-ui.js` |
+| Validation | Added targeted Node seed integrity test and extended Admin DB Viewer Playwright. | `tests/dev-runtime/DbSeedIntegrity.test.mjs`; `tests/playwright/tools/AdminDbViewer.spec.mjs` |
+
+## Requirement Checklist
+
+| Requirement | Evidence | Status |
+| --- | --- | --- |
+| Read `docs_build/dev/PROJECT_INSTRUCTIONS.md` first. | Read before implementation and validation. | PASS |
+| When creating/initializing the Local DB, use real runtime timestamps for `createdAt` and `updatedAt`. | Shared DB, server seed, Palette, Asset, and Project Journey seed helpers use `Date.now()` / `new Date()` runtime timestamps. Node and Playwright validate runtime parseable timestamps. | PASS |
+| Remove hardcoded seed timestamps from DB creation paths. | Targeted `rg` search found no active hardcoded `Date.UTC(2026)`, fixed `const now = "2026..."`, or old hardcoded seed timestamp in touched seed paths. | PASS |
+| Verify guest seed data includes at least one loadable sample/toolState for every available tool. | `tool_state_samples` guest rows are built from `getActiveToolRegistry()` and validated against `/api/toolbox/registry/snapshot`. | PASS |
+| Verify each seeded user has unique projects, tool states, manifests, or sample data where user-owned data exists. | User 1, User 2, User 3, and Admin have unique `projectKey`, `toolStateKey`, `manifestPath`, and `sampleLabel` rows. | PASS |
+| Do not share mutable seeded records across users. | Validation verifies separate user-owned seed rows with unique project/toolState keys. | PASS |
+| Preserve audit fields: `key`, `createdAt`, `updatedAt`, `createdBy`, `updatedBy`. | Table schemas include audit fields; AdminDbViewer audit diagnostics and Node test validate fields and user references. | PASS |
+| Preserve SQLite-backed Local DB behind API boundary. | Local DB mode is selected through `/api/session/mode`; AdminDbViewer reads through `/api/mock-db/snapshot`; no browser DB imports were added. | PASS |
+| Do not add UAT/Prod behavior. | No UAT/Prod adapter or login behavior changed. | PASS |
+| Run changed-file syntax checks. | All changed JS/MJS/spec files passed `node --check`. | PASS |
+| Run targeted DB seed integrity validation. | `node --test tests/dev-runtime/DbSeedIntegrity.test.mjs` passed 1/1. | PASS |
+| Run AdminDbViewer Playwright to verify timestamps, guest samples, and user-unique records are visible. | `npx playwright test tests/playwright/tools/AdminDbViewer.spec.mjs` passed 7/7 with new visible `tool_state_samples` checks. | PASS |
+| Run LoginSessionMode Playwright if login/session seed behavior is touched. | `npx playwright test tests/playwright/tools/LoginSessionMode.spec.mjs` passed 5/5. | PASS |
+| Do not run full samples smoke unless directly impacted. | Full samples smoke skipped because sample runtime/loader files were not changed. | PASS |
+| Required reports and review artifacts generated. | This report, `testing_lane_execution_report.md`, V8 coverage, review diff, changed files, and ZIP artifact generated. | PASS |
+
+## Validation Commands
+
+| Command | Result |
+| --- | --- |
+| `node --check src/dev-runtime/persistence/mock-db-store.js` | PASS |
+| `node --check src/dev-runtime/server/mock-api-router.mjs` | PASS |
+| `node --check src/engine/api/mock-db-viewer-ui.js` | PASS |
+| `node --check toolbox/colors/palette-workspace-repository.js` | PASS |
+| `node --check toolbox/assets/assets-mock-repository.js` | PASS |
+| `node --check toolbox/project-journey/project-journey-mock-repository.js` | PASS |
+| `node --check tests/playwright/tools/AdminDbViewer.spec.mjs` | PASS |
+| `node --check tests/dev-runtime/DbSeedIntegrity.test.mjs` | PASS |
+| `rg -n 'Date\.UTC\(2026\|const now = "2026\|2026-06-06T09:00:00\.000Z' src/dev-runtime toolbox tests/dev-runtime tests/playwright/tools/AdminDbViewer.spec.mjs` | PASS, no matches |
+| `node --test tests/dev-runtime/DbSeedIntegrity.test.mjs` | PASS, 1/1 |
+| `npx playwright test tests/playwright/tools/AdminDbViewer.spec.mjs` | PASS, 7/7 |
+| `npx playwright test tests/playwright/tools/LoginSessionMode.spec.mjs` | PASS, 5/5 |
+| `git diff --check` | PASS, with Git line-ending warnings only |
+
+## Skipped Lanes
+
+| Lane | Decision | Reason |
+| --- | --- | --- |
+| Full samples smoke | SKIP | No sample loader/framework or sample runtime files changed. |
+| Full Playwright suite | SKIP | Targeted AdminDbViewer, LoginSessionMode, and Node seed integrity validations cover the changed DB seed paths. |
+| ToolboxRoutePages Playwright | SKIP | Tool page routing was not changed. |
+| ProjectJourneyTool Playwright | SKIP | Project Journey UI behavior was not changed; seed timestamp behavior is validated through DB seed/API and Admin DB Viewer. |
+
+## Notes
+
+- No CSS was added.
+- Guest remains unauthenticated and is not stored in the `users` table.
+- Existing SQLite experimental warnings and seed-only audit fallback diagnostics appeared during validation; they are existing runtime diagnostics and did not affect the PR requirement results.
+- V8 coverage warnings for dev-runtime/server and repository files are advisory only; the affected server seed behavior is covered by Node and API-backed Playwright validation.

docs_build/dev/reports/playwright_v8_coverage_report.txt

@@ -12,26 +12,47 @@ Note: entry percentages use function coverage when available, otherwise line cov
 Note: coverage entries are aggregated across every page/tool where coverageReporter.start(page) and coverageReporter.stop(page) ran.
 
 Exercised tool entry points detected:
-(0%) Toolbox Index - not exercised by this Playwright run
+(61%) Toolbox Index - exercised 3 runtime JS files
 (0%) Tool Template V2 - not exercised by this Playwright run
-(71%) Theme V2 Shared JS - exercised 2 runtime JS files
+(81%) Theme V2 Shared JS - exercised 3 runtime JS files
 
 Changed runtime JS files covered:
-(0%) src/dev-runtime/server/local-api-server.mjs - WARNING: changed runtime JS file was not collected by Playwright V8 coverage; advisory only
+(0%) src/dev-runtime/persistence/mock-db-store.js - WARNING: changed runtime JS file was not collected by Playwright V8 coverage; advisory only
+(0%) src/dev-runtime/server/mock-api-router.mjs - WARNING: changed runtime JS file was not collected by Playwright V8 coverage; advisory only
+(0%) toolbox/assets/assets-mock-repository.js - WARNING: changed runtime JS file was not collected by Playwright V8 coverage; advisory only
+(0%) toolbox/colors/palette-workspace-repository.js - WARNING: changed runtime JS file was not collected by Playwright V8 coverage; advisory only
+(0%) toolbox/project-journey/project-journey-mock-repository.js - WARNING: changed runtime JS file was not collected by Playwright V8 coverage; advisory only
+(87%) src/engine/api/mock-db-viewer-ui.js - executed lines 517/517; executed functions 85/98
 
 Files with executed line/function counts where available:
-(7%) src/engine/api/server-api-client.js - executed lines 159/159; executed functions 1/14
-(13%) src/engine/api/session-api-client.js - executed lines 34/34; executed functions 1/8
-(61%) assets/theme-v2/js/login-session.js - executed lines 243/243; executed functions 11/18
-(75%) assets/theme-v2/js/gamefoundry-partials.js - executed lines 442/442; executed functions 30/40
+(53%) src/engine/api/server-api-client.js - executed lines 159/159; executed functions 10/19
+(55%) toolbox/project-journey/project-journey.js - executed lines 1003/1003; executed functions 54/99
+(60%) src/engine/api/mock-db-api-client.js - executed lines 19/19; executed functions 3/5
+(64%) assets/theme-v2/js/tool-display-mode.js - executed lines 201/201; executed functions 9/14
+(67%) admin/db-viewer.js - executed lines 53/53; executed functions 4/6
+(81%) toolbox/tool-registry-api-client.js - executed lines 148/148; executed functions 22/27
+(83%) assets/theme-v2/js/gamefoundry-partials.js - executed lines 442/442; executed functions 33/40
+(87%) src/engine/api/mock-db-viewer-ui.js - executed lines 517/517; executed functions 85/98
+(88%) src/engine/api/session-api-client.js - executed lines 34/34; executed functions 7/8
+(89%) assets/theme-v2/js/login-session.js - executed lines 243/243; executed functions 17/19
+(100%) toolbox/project-journey/project-journey-api-client.js - executed lines 12/12; executed functions 2/2
 
 Uncovered or low-coverage changed JS files:
-(0%) src/dev-runtime/server/local-api-server.mjs - WARNING: uncovered changed runtime JS file; advisory only
+(0%) src/dev-runtime/persistence/mock-db-store.js - WARNING: uncovered changed runtime JS file; advisory only
+(0%) src/dev-runtime/server/mock-api-router.mjs - WARNING: uncovered changed runtime JS file; advisory only
+(0%) toolbox/assets/assets-mock-repository.js - WARNING: uncovered changed runtime JS file; advisory only
+(0%) toolbox/colors/palette-workspace-repository.js - WARNING: uncovered changed runtime JS file; advisory only
+(0%) toolbox/project-journey/project-journey-mock-repository.js - WARNING: uncovered changed runtime JS file; advisory only
 
 Changed JS files considered:
-(0%) scripts/start-local-api-server.mjs - changed JS file not collected as browser runtime coverage
-(0%) src/dev-runtime/server/local-api-server.mjs - changed JS file not collected as browser runtime coverage
+(0%) src/dev-runtime/persistence/mock-db-store.js - changed JS file not collected as browser runtime coverage
+(0%) src/dev-runtime/server/mock-api-router.mjs - changed JS file not collected as browser runtime coverage
+(0%) tests/dev-runtime/DbSeedIntegrity.test.mjs - changed JS file not collected as browser runtime coverage
+(0%) tests/playwright/tools/AdminDbViewer.spec.mjs - changed JS file not collected as browser runtime coverage
 (0%) tests/playwright/tools/LoginSessionMode.spec.mjs - changed JS file not collected as browser runtime coverage
 (0%) tests/playwright/tools/StaticOnlyLoginApiRequired.spec.mjs - changed JS file not collected as browser runtime coverage
-(61%) assets/theme-v2/js/login-session.js - changed JS file with browser V8 coverage
-(75%) assets/theme-v2/js/gamefoundry-partials.js - changed JS file with browser V8 coverage
+(0%) toolbox/assets/assets-mock-repository.js - changed JS file not collected as browser runtime coverage
+(0%) toolbox/colors/palette-workspace-repository.js - changed JS file not collected as browser runtime coverage
+(0%) toolbox/project-journey/project-journey-mock-repository.js - changed JS file not collected as browser runtime coverage
+(87%) src/engine/api/mock-db-viewer-ui.js - changed JS file with browser V8 coverage
+(89%) assets/theme-v2/js/login-session.js - changed JS file with browser V8 coverage