Isolate dev runtime and clean PR017 auth leftovers - PR_26157_018-dev-runtime-and-pr017-cleanup

Author: ToolboxAid

admin/db-viewer.js

@@ -1,10 +1,6 @@
-import { createProjectJourneyMockRepository } from "../toolbox/project-journey/project-journey-mock-repository.js";
-import { createAssetToolMockRepository } from "../toolbox/assets/assets-mock-repository.js";
-import { createProjectWorkspacePaletteRepository } from "../toolbox/colors/palette-workspace-repository.js";
 import {
   getAllPersistedMockDbSnapshot,
   clearMockDbTables,
-  getStandaloneMockDbTables,
   seedMockDbTables,
 } from "../src/engine/persistence/mock-db-store.js";
 
@@ -26,7 +22,6 @@ const IDENTITY_TABLE_GROUP = Object.freeze(["users", "user_roles", "roles"]);
 class AdminDbViewer {
   constructor(documentRef = document) {
     this.document = documentRef;
-    this.createRepositories();
     this.activeFilter = "all";
     this.clearButton = documentRef.querySelector("[data-admin-db-clear]");
     this.filterRoot = documentRef.querySelector("[data-admin-db-filters]");
@@ -36,14 +31,7 @@ class AdminDbViewer {
     this.tablesRoot = documentRef.querySelector("[data-admin-db-tables]");
   }
 
-  createRepositories() {
-    this.projectJourneyRepository = createProjectJourneyMockRepository();
-    this.paletteRepository = createProjectWorkspacePaletteRepository();
-    this.assetRepository = createAssetToolMockRepository();
-  }
-
   start() {
-    this.projectJourneyRepository.openProject("demo-project");
     this.render();
     this.filterRoot?.addEventListener("click", (event) => {
       const button = event.target.closest("[data-admin-db-filter]");
@@ -57,8 +45,6 @@ class AdminDbViewer {
       const snapshot = getAllPersistedMockDbSnapshot();
       if (snapshot.cleared) {
         seedMockDbTables();
-        this.createRepositories();
-        this.projectJourneyRepository.openProject("demo-project");
         this.activeFilter = "all";
         this.render();
         return;
@@ -67,8 +53,6 @@ class AdminDbViewer {
         return;
       }
       clearMockDbTables();
-      this.createRepositories();
-      this.projectJourneyRepository.openProject("demo-project");
       this.activeFilter = "all";
       this.render();
     });
@@ -132,10 +116,6 @@ class AdminDbViewer {
   }
 
   collectSnapshot() {
-    this.projectJourneyRepository.getTables();
-    this.paletteRepository.getTables();
-    this.assetRepository.getTables();
-    getStandaloneMockDbTables();
     const snapshot = getAllPersistedMockDbSnapshot();
     const tables = snapshot.tables;
     const owners = snapshot.owners || {};
@@ -227,7 +207,7 @@ class AdminDbViewer {
     if (!records.length) {
       const row = this.createElement("tr");
       const cell = this.createElement("td", {
-        text: "No records in this table. Add records from its tool or use Seed Mock DB to restore baseline mock records.",
+        text: "No records in this table. Add records from its tool or use Seed Mock DB to restore baseline user and role records.",
       });
       cell.colSpan = Math.max(1, fields.length + 1);
       row.append(cell);

assets/theme-v2/js/gamefoundry-partials.js

@@ -114,29 +114,6 @@
     const currentScript = document.currentScript || document.querySelector("script[src*='gamefoundry-partials.js']");
     const assetRoot = currentScript ? new URL("../", currentScript.src) : null;
 
-    function makeMockUlid(sequence) {
-        return "01K2GFSJ0Y" + String(sequence).padStart(16, "0");
-    }
-
-    const localSessionUsers = {
-        user1: {
-            displayName: "User 1",
-            userKey: makeMockUlid(51)
-        },
-        user2: {
-            displayName: "User 2",
-            userKey: makeMockUlid(52)
-        },
-        user3: {
-            displayName: "User 3",
-            userKey: makeMockUlid(53)
-        },
-        admin: {
-            displayName: "Admin",
-            userKey: makeMockUlid(54)
-        }
-    };
-
     function assetUrl(path) {
         if (!assetRoot) return rootPrefix() + path;
         return new URL(path.replace(/^assets\//, ""), assetRoot).href;
@@ -183,11 +160,11 @@
         }
     }
 
-    function selectedLocalSessionId() {
+    function selectedLocalSessionKey() {
         try {
-            return window.localStorage.getItem(mockDbSessionStorageKey) || "guest";
+            return window.localStorage.getItem(mockDbSessionStorageKey) || "";
         } catch {
-            return "guest";
+            return "";
         }
     }
 
@@ -218,16 +195,15 @@
         if (selectedSessionModeId() === "dev") {
             return {
                 authenticated: false,
-                diagnostic: "",
+                diagnostic: "DEV mode uses read-only/demo JSON access. Switch to Local to use persisted Memory DB sessions.",
                 displayName: "Login",
                 mode: "dev",
                 roleSlugs: []
             };
         }
 
-        const sessionId = selectedLocalSessionId();
-        const session = localSessionUsers[sessionId];
-        if (!session) {
+        const sessionUserKey = selectedLocalSessionKey();
+        if (!sessionUserKey) {
             return {
                 authenticated: false,
                 diagnostic: "",
@@ -241,33 +217,31 @@
         if (!state) {
             return {
                 authenticated: false,
-                diagnostic: sessionId === "guest"
-                    ? ""
-                    : "Persisted Memory DB users and roles are not seeded. Open Login and choose Local to seed local users.",
+                diagnostic: "Persisted Memory DB users and roles are not seeded. Open Login and choose Local to seed local users.",
                 displayName: "Login",
                 mode: "local",
                 roleSlugs: []
             };
         }
 
         const user = (state?.tables?.users || []).find(function (record) {
-            return record.key === session.userKey && record.isActive !== false;
+            return record.key === sessionUserKey && record.isActive !== false;
         });
         if (!user) {
             return {
                 authenticated: false,
-                diagnostic: `Selected Local user ${session.displayName} is missing from persisted Memory DB users.`,
+                diagnostic: `Selected Local user key ${sessionUserKey} is missing from persisted Memory DB users.`,
                 displayName: "Login",
                 mode: "local",
                 roleSlugs: []
             };
         }
 
-        const roleSlugs = rolesForUser(state, session.userKey);
+        const roleSlugs = rolesForUser(state, sessionUserKey);
         if (!roleSlugs.length) {
             return {
                 authenticated: false,
-                diagnostic: `Selected Local user ${session.displayName} has no persisted Memory DB roles.`,
+                diagnostic: `Selected Local user ${user.displayName || sessionUserKey} has no persisted Memory DB roles.`,
                 displayName: "Login",
                 mode: "local",
                 roleSlugs: []
@@ -277,7 +251,7 @@
         return {
             authenticated: true,
             diagnostic: "",
-            displayName: user?.displayName || session.displayName,
+            displayName: user.displayName || sessionUserKey,
             mode: "local",
             roleSlugs
         };

assets/theme-v2/js/login-session.js

@@ -73,8 +73,8 @@ function renderUserButtons(mode) {
     button.className = "btn btn--compact";
     button.type = "button";
     button.textContent = user.label;
-    button.dataset.loginUser = user.id;
-    setSelectedButton(button, button.dataset.loginUser === sessionUser.id);
+    button.dataset.loginUser = user.userKey || "";
+    setSelectedButton(button, (user.userKey || "") === (sessionUser.userKey || ""));
     userControls.append(button);
   });
   if (userStatus) {
@@ -117,7 +117,7 @@ userControls?.addEventListener("click", (event) => {
   }
   setMockDbSessionMode("local");
   getStandaloneMockDbTables();
-  setMockDbSessionUser(button.dataset.loginUser || "guest");
+  setMockDbSessionUser(button.dataset.loginUser || "");
   render();
 });
 

docs_build/dev/PROJECT_INSTRUCTIONS.md

@@ -213,6 +213,25 @@ The Mock DB viewer must render live adapter state and table schemas, including e
 
 Audit ownership is users-only: every shared table record uses `key`, `createdAt`, `updatedAt`, `createdBy`, and `updatedBy`; the ownership fields reference `users.key`. Roles are modeled with `roles` and `user_roles`.
 
+## DEV RUNTIME BOUNDARY
+
+All mock/dev-only runtime implementation must live under `src/dev-runtime/`.
+
+Required dev-runtime folders:
+- `src/dev-runtime/auth/`
+- `src/dev-runtime/persistence/`
+- `src/dev-runtime/admin/`
+- `src/dev-runtime/testing/`
+- `src/dev-runtime/guest-seeds/`
+
+Rules:
+- UAT/PROD must never import, bundle, or deploy `src/dev-runtime/`.
+- Active tools must use declared runtime contracts and must not import `src/dev-runtime/` directly.
+- Dev-only adapters may be exposed through existing dev/runtime contract shims only when the deployment boundary keeps `src/dev-runtime/` out of UAT/PROD bundles.
+- No fallback auth, session, user, admin, or system user data is allowed.
+- Local session state must resolve selected users and roles from persisted Memory DB `users`, `roles`, and `user_roles` records.
+- Missing users or roles must fail visibly with actionable diagnostics.
+
 ## ARCHIVED V1/V2 REFERENCE MATERIAL
 
 Deprecated V1/V2 reference material lives under:

docs_build/dev/reports/coverage_changed_js_guardrail.txt

@@ -8,8 +8,9 @@ Source: Playwright/Chromium built-in V8 coverage from the active Playwright run.
 Changed runtime JS files considered:
 (70%) toolbox/colors/palette-workspace-repository.js - executed lines 1316/1316; executed functions 89/127
 (81%) toolbox/assets/assets-mock-repository.js - executed lines 919/919; executed functions 61/75
-(93%) src/engine/persistence/mock-db-store.js - executed lines 666/666; executed functions 66/71
+(95%) src/dev-runtime/persistence/mock-db-store.js - executed lines 682/682; executed functions 77/81
 (98%) toolbox/project-journey/project-journey.js - executed lines 991/991; executed functions 105/107
+(100%) src/engine/persistence/mock-db-store.js - executed lines 1/1; executed functions 1/1
 
 Guardrail warnings:
 (100%) none - no changed runtime JS coverage warnings

docs_build/dev/reports/dependency_gating_report.md

@@ -1,6 +1,6 @@
 # Dependency Gating Report
 
-Generated: 2026-06-07T03:40:45.970Z
+Generated: 2026-06-07T04:35:29.033Z
 Status: PASS
 
 ## Gate Order

docs_build/dev/reports/dependency_hydration_reuse_report.md

@@ -1,6 +1,6 @@
 # Dependency Hydration Reuse Report
 
-Generated: 2026-06-07T03:40:45.970Z
+Generated: 2026-06-07T04:35:29.034Z
 Status: PASS
 
 ## Summary

docs_build/dev/reports/dev-runtime-and-pr017-cleanup-report.md

@@ -0,0 +1,101 @@
+# PR_26157_018 Dev Runtime And PR017 Cleanup Report
+
+## Executive Summary
+
+Status: PASS
+
+PR_26157_018 creates the `src/dev-runtime/` boundary, moves the mock DB implementation under that boundary behind the existing engine persistence contract, removes PR017 fallback/session issues, and locks DB Viewer to Local admin-only shared Memory DB state without repository side-effect population.
+
+## Source Of Truth Re-Read
+
+- Re-read `docs_build/dev/PROJECT_INSTRUCTIONS.md` before implementation.
+- Re-read the original PR_26157_018 request before packaging.
+- Used PR_26157_017 delta as context.
+- Applied the PR Completion Rule: every requested item below has explicit PASS evidence.
+
+## Requirement Checklist
+
+| Requirement | Status | Evidence |
+| --- | --- | --- |
+| Fix all identified PR_26157_017 issues | PASS | Removed local session identity map, old alias session storage, DB Viewer repository side effects, legacy audit key scrubber, and active `?role=` tests. |
+| Create/enforce `src/dev-runtime/` structure | PASS | Added `src/dev-runtime/auth/`, `src/dev-runtime/persistence/`, `src/dev-runtime/admin/`, `src/dev-runtime/testing/`, and `src/dev-runtime/guest-seeds/`. |
+| Add PROJECT_INSTRUCTIONS dev-runtime rule | PASS | Added `DEV RUNTIME BOUNDARY` section to `docs_build/dev/PROJECT_INSTRUCTIONS.md`. |
+| All mock/dev-only runtime lives under `src/dev-runtime/` | PASS | Moved mock DB implementation to `src/dev-runtime/persistence/mock-db-store.js`; `src/engine/persistence/mock-db-store.js` is now a one-line contract shim. |
+| UAT/PROD must never import, bundle, or deploy `src/dev-runtime/` | PASS | Governance rule added; active tools do not import `src/dev-runtime/` directly. |
+| No fallback auth/session/user data | PASS | `assets/theme-v2/js/gamefoundry-partials.js` resolves selected user and roles only from persisted Memory DB rows; `src/dev-runtime/persistence/mock-db-store.js` removed static session users. |
+| Missing users/roles fail visibly | PASS | Login/access guard shows visible diagnostics for missing seeded DB, missing selected user key, and missing roles. |
+| Remove active Playwright `?role=user/admin/guest` usage | PASS | `rg -n "\?role=|role=user|role=admin|role=guest" tests/playwright/tools toolbox assets src admin -g "*.mjs" -g "*.js" -g "*.html"` returned no matches. |
+| Remove hardcoded `localSessionUsers` from shared header | PASS | `assets/theme-v2/js/gamefoundry-partials.js` no longer contains `localSessionUsers`; scan returned no matches. |
+| Session stores selected user key only | PASS | Login buttons store `users.key` values; Logout/Guest remove the session key; tests seed `gamefoundry.mockDb.sessionUser.v1` with `MOCK_DB_KEYS.users.*`. |
+| User display/roles resolve from persisted DB | PASS | Header and dev runtime read `users`, `roles`, and `user_roles`; Login/Auth lane verifies User 1/Admin header display and role gates. |
+| Remove `LEGACY_AUDIT_KEY_TO_USER_KEY` and obsolete compatibility scrubber logic | PASS | Legacy constant and remap removed; scan returned no legacy symbols. |
+| DB Viewer reads shared DB state only | PASS | `admin/db-viewer.js` removed Project Journey/Palette/Asset repository imports and `getTables()` side-effect calls. |
+| DB Viewer must not populate data by repository side effects | PASS | `AdminDbViewer.spec.mjs` first-open assertions show tool-owned tables as empty until tools write shared DB records. |
+| DB Viewer read-only except Local-only clear/seed controls | PASS | DB table surface has no inputs/selects/edit buttons; clear/seed remains outside table viewer and is available only after Local admin access. |
+| DB Viewer admin-only | PASS | Shared page guard protects `admin/**`; Login lane verifies Guest/User blocks and Admin unlock. |
+| DB Viewer Local-only, not DEV | PASS | `LoginSessionMode.spec.mjs` verifies DEV mode blocks `/admin/db-viewer.html` and the DB Viewer UI does not render. |
+| DEV mode has no DB Viewer | PASS | DEV DB Viewer direct URL is blocked with visible read-only/demo diagnostic. |
+| DEV mode has no local user switching | PASS | Login lane verifies DEV mode hides local user controls and shows no users. |
+| DEV mode is JSON/demo read-only only | PASS | Login lane verifies DEV mode disables persistence and no user selector is shown. |
+| Local mode has persisted Memory DB, login user selection, DB Viewer, clear/seed | PASS | Login lane verifies Local users; DB Viewer lane verifies persisted records, filters, clear/seed. |
+| Verify no active tool imports `src/dev-runtime` directly | PASS | `rg -n "src/dev-runtime|\.\./.*dev-runtime|dev-runtime" admin toolbox assets tests/playwright/tools -g "*.js" -g "*.mjs" -g "*.html"` returned no matches. |
+| Verify DB Viewer reads shared DB without repository side-effect population | PASS | DB Viewer lane first test and live persisted records test passed. |
+| Run changed-file/static validation and targeted Playwright | PASS | Static validation passed; targeted runtime passed 21/21. |
+| Do not run full samples smoke | PASS | Full samples smoke skipped per request. |
+| Required reports exist | PASS | This report, testing lane report, V8 coverage report, review diff, and changed files report were produced. |
+
+## Validation Evidence
+
+| Lane | Command | Result |
+| --- | --- | --- |
+| Runtime syntax | `node --check src/dev-runtime/persistence/mock-db-store.js; node --check src/engine/persistence/mock-db-store.js; node --check assets/theme-v2/js/gamefoundry-partials.js; node --check assets/theme-v2/js/login-session.js; node --check admin/db-viewer.js` | PASS |
+| Focused test syntax | `node --check tests/playwright/tools/LoginSessionMode.spec.mjs; node --check tests/playwright/tools/AdminDbViewer.spec.mjs; node --check tests/playwright/tools/ProjectJourneyTool.spec.mjs; node --check tests/playwright/tools/RootToolsFutureState.spec.mjs; node --check tests/playwright/tools/ToolNavigationPrevNext.spec.mjs; node --check tests/playwright/tools/ToolDisplayModeNavigation.spec.mjs` | PASS |
+| Role-query cleanup test syntax | `node --check` across all Playwright files touched by `?role=` cleanup | PASS |
+| Auth/header/login/account | `npx playwright test tests/playwright/tools/LoginSessionMode.spec.mjs --project=playwright --reporter=list --workers=1` | PASS, 5/5 |
+| Admin DB Viewer | `npx playwright test tests/playwright/tools/AdminDbViewer.spec.mjs --project=playwright --reporter=list --workers=1` | PASS, 3/3 |
+| Project Journey | `npx playwright test tests/playwright/tools/ProjectJourneyTool.spec.mjs --project=playwright --reporter=list --workers=1` | PASS, 13/13 |
+| Combined targeted runtime and coverage | `npx playwright test tests/playwright/tools/LoginSessionMode.spec.mjs tests/playwright/tools/AdminDbViewer.spec.mjs tests/playwright/tools/ProjectJourneyTool.spec.mjs --project=playwright --reporter=list --workers=1` | PASS, 21/21 |
+| Changed-file/static validation | `npm run test:playwright:static` | PASS |
+| Whitespace | `git diff --check` | PASS, line-ending warnings only |
+| Required folder check | `Test-Path src/dev-runtime/auth`, `persistence`, `admin`, `testing`, `guest-seeds` | PASS |
+| Removed field scan | `rg -n "createdByType|updatedByType|accountType|isSystemUser|actors" src admin toolbox assets/theme-v2 tests/playwright/tools -g "*.js" -g "*.mjs" -g "*.html"` | PASS, no matches |
+| Role query scan | `rg -n "\?role=|role=user|role=admin|role=guest" tests/playwright/tools toolbox assets src admin -g "*.mjs" -g "*.js" -g "*.html"` | PASS, no matches |
+| Legacy session scan | `rg -n "localSessionUsers|LEGACY_AUDIT_KEY_TO_USER_KEY|MOCK_DB_SESSION_USERS|sessionUserFromId|selectedSessionUserId" src assets admin toolbox tests/playwright/tools -g "*.js" -g "*.mjs" -g "*.html"` | PASS, no matches |
+| Direct dev-runtime import scan | `rg -n "src/dev-runtime|\.\./.*dev-runtime|dev-runtime" admin toolbox assets tests/playwright/tools -g "*.js" -g "*.mjs" -g "*.html"` | PASS, no matches |
+
+## Files Changed
+
+- `docs_build/dev/PROJECT_INSTRUCTIONS.md`
+- `src/engine/persistence/mock-db-store.js`
+- `src/dev-runtime/persistence/mock-db-store.js`
+- `src/dev-runtime/auth/.gitkeep`
+- `src/dev-runtime/admin/.gitkeep`
+- `src/dev-runtime/testing/.gitkeep`
+- `src/dev-runtime/guest-seeds/.gitkeep`
+- `assets/theme-v2/js/gamefoundry-partials.js`
+- `assets/theme-v2/js/login-session.js`
+- `admin/db-viewer.js`
+- `tests/playwright/tools/AdminDbViewer.spec.mjs`
+- `tests/playwright/tools/LoginSessionMode.spec.mjs`
+- `tests/playwright/tools/ProjectJourneyTool.spec.mjs`
+- `tests/playwright/tools/AssetToolMockRepository.spec.mjs`
+- `tests/playwright/tools/BuildPathProgressSimplification.spec.mjs`
+- `tests/playwright/tools/GameConfigurationMockRepository.spec.mjs`
+- `tests/playwright/tools/GameDesignMockRepository.spec.mjs`
+- `tests/playwright/tools/ProjectWorkspaceMockRepository.spec.mjs`
+- `tests/playwright/tools/RootToolsFutureState.spec.mjs`
+- `tests/playwright/tools/ToolCenterFullscreenAccordion.spec.mjs`
+- `tests/playwright/tools/ToolDisplayModeNavigation.spec.mjs`
+- `tests/playwright/tools/ToolImageRegistry.spec.mjs`
+- `tests/playwright/tools/ToolNavigationPrevNext.spec.mjs`
+- `tests/playwright/tools/ToolsProgressHydration.spec.mjs`
+- Required report artifacts under `docs_build/dev/reports/`
+
+## Manual Validation Notes
+
+1. Open `login.html`, switch to DEV, confirm no local users appear.
+2. In DEV, open `admin/db-viewer.html` directly and confirm it is blocked.
+3. Switch Login to Local, choose Admin, open `admin/db-viewer.html`, and confirm Mock DB renders.
+4. Open Project Journey as a Local user, add an item, refresh, then open DB Viewer and confirm the record appears.
+
+Full samples smoke: SKIP per request.

docs_build/dev/reports/execution_graph_reuse_report.md

@@ -1,6 +1,6 @@
 # Execution Graph Reuse Report
 
-Generated: 2026-06-07T03:40:45.970Z
+Generated: 2026-06-07T04:35:29.034Z
 Status: PASS
 
 ## Summary