docs(editor Chromium 156): BUILD-LOG and SESSIONS lines (Vikunja #784)

BUILD-LOG.md

@@ -5961,3 +5961,5 @@ Owner directed static-only fallback after actual nativepriority drift: no new pr
 2026-11-03T00:12:08Z | Claude Opus 5.5 implementation sub-agent (lead T3 c5c1e8ba) | row 333 (#1831) R3 rotation fix on t3/row333-r3-fix, product commit 3692fca52 on b37cc5087 | Ruling 1: a daily key quota follows the agent's key lineage (current, retiring, then up to 64 earlier ids kept in a new optional `previous` field on the model record), so rotation and re-issue keep the quota and its count; an id in two lineages refuses proxy-key-refused; a fired agent's leaf is orphaned, limits nothing, logs limit-key-orphaned once and is listed in the Console usage view. Ruling 2: key-quota-no-model-key for an agent with no model key under a key quota, passed through by name. Ruling 3: covered by the lineage, no mayLaunch change. Ruling 4: the usage module gets one frozen object holding readUsageQueue only. Ruling 5: every telemetry fixture wait rejects by name at a real-timer deadline. Runs: bus 1393/1393, plugins 132/132, business 293/293, webui 499/499, cli stack-release 225/225, stack-release-external 25/25, stack-upgrade 25/25 and launch-limit-checks 5/5; no skips, the model-final-completion flake did not appear; mutants M1 to M4 and M4b each killed. Departure: the human settings writer still stamps a new since on a renamed leaf, so a moved leaf restarts its count; follow-up recommended, not built. No migration, push, queue or PR action.
 
 2026-11-03T01:27:26Z | Claude Opus 5.5 implementation sub-agent (lead T3 c5c1e8ba) | row 333 (#1831) R4 since carry fix on t3/row333-r4-fix, product commit f65faf9df on fe3ef5128, BUILD.md R4 section a13050012 | Ruling 1: the bus runtime passes launchSettings a key lineage lookup read from its own credential records (ids only); a new daily key quota takes the earliest stored since among the old document's daily key quotas in its key's lineage, now only when there is none, so a quota moved from a rotated or re-issued key keeps its count; a reset still sets now, a caller since still refuses, a quota removed and added back later is new, and a failed or malformed lookup refuses proxy-key-refused. Ruling 2: every limits refresh updates the remembered orphan set, empty when no daily key quota is left, so remove then re-add logs again; in memory only, a restart observes afresh. Ruling 3: the poll barrier's last yield is on the captured real setImmediate inside the deadline. Ruling 4: BUILD.md records the 64-id bound as a limit and corrects R3 departure 4 (a late queued event loses telemetry attribution to the reconcile log; not a quota bypass). Runs: bus 1397/1397, plugins 132/132, business 295/295, webui 499/499 (run 1 498/499 with editor-browser.test.mjs:93 timed out under load, the file 16/16 alone, then 499/499 twice), cli stack-release 225/225, stack-release-external 25/25, stack-upgrade 25/25, launch-limit-checks 5/5, harness tools 23/23; no skips, the model-final-completion flake did not appear; mutants M1 to M4, M4b and M5 each killed. Not run: 19 cli files that import bus runtime.mjs without pinning it. No migration, push, queue or PR action.
+
+2026-11-03T04:07:40Z | Claude Opus 5.5 implementation sub-agent (lead T3 c5c1e8ba) | editor-browser.test.mjs:154 under Chromium 156 (Vikunja #784) on t3/editor-chromium-156, test commit 0c6aa1a1e on 1ff45c4ad | Case 2, no product defect: Chromium 156 checks script-src-attr when an inline handler attribute is created, also in a document with no window (WPT PR 62762; PR 64290 later skips such documents and 156 lacks it). All four reports come from prosemirror-view readHTML's innerHTML parse into a new createHTMLDocument (editor.js:8212:19, target the page document, one per pasted handler: img onerror, a onclick, a onmouseover, svg onload); no on* attribute reaches the live page and injected stays null; Chromium 153, 151 and Brave 154 report none for the same paste. Fix is test-only: the page's CSP record sets aside a script-src-attr report whose sourceFile is /editor.js, whose line is readHTML's parse (computed from the bundle, with a guard pinning those lines and detachedDoc) and whose target is the document; quiet(), inert(), injected, errors, rejections and the Console CSP are unchanged. New test: after a hostile paste, a handler set on a live editor paragraph, one parsed into a page-owned element never attached, and one set through prosemirror-view's attributes prop each still fail quiet(). editor-browser 17/17, editor plus editor-provenance 11/11, no skips; 4 mutants killed (all script-src-attr, target only, target only without the paragraph case, editor.js at any line). Residual: an element from that parse attached to the page after its report was sent would not be caught by the CSP record; on 156 its listener is never set. Full webui suite not run (bundle not rebuilt); Chromium 152 not on the host. No push, queue or PR action.

docs/SESSIONS.md

@@ -1971,3 +1971,4 @@ are never rewritten or removed; corrections are new entries.
 2026-11-02 | Claude (sub-agent of Mosaic Stack lead c5c1e8ba) | row333 join onto landed row332 (#1831) | Merge c0c291cda joins 0ef269da9 onto 5df0e9d6f on t3/row-333-join-replay; two conflicts (launch.mjs imports, plugins README sections) resolved by keeping both, identical to the earlier join resolution; 9/9 suites green (business 293, plugins 129, bus 1382, model-proxy 108, harness 205, seat 223, webui 498, cli 1101 and 1 skip, federation 1); no push, queue or PR action.
 2026-11-03 | Claude (sub-agent of Mosaic Stack lead c5c1e8ba) | row333 R3 rotation fix (#1831) | 3692fca52 on t3/row333-r3-fix (base b37cc5087): key quota follows the agent's key lineage across rotation and re-issue, orphaned leaves listed and logged, key-quota-no-model-key, usage module gets readUsageQueue only, fixture deadlines; bus 1393, plugins 132, business 293, webui 499, cli stack-release 225, stack-release-external 25, stack-upgrade 25, launch-limit-checks 5, no skips; 5 mutants killed; no push, queue or PR action.
 2026-11-03 | Claude (sub-agent of Mosaic Stack lead c5c1e8ba) | row 333 R4 since carry fix (#1831) | f65faf9df on t3/row333-r4-fix (on R3 tip fe3ef5128): a moved key quota keeps its count through the bus's lineage lookup, orphan set updated on every refresh, real-timer barrier yield, BUILD.md R4 section a13050012; bus 1397, plugins 132, business 295, webui 499, cli stack-release 225, stack-release-external 25, stack-upgrade 25, launch-limit-checks 5, harness tools 23, no skips; 6 mutants killed; no push, queue or PR action.
+2026-11-03 | Claude (sub-agent of Mosaic Stack lead c5c1e8ba) | editor-browser :154 under Chromium 156 (Vikunja #784) | 0c6aa1a1e on t3/editor-chromium-156 (base 1ff45c4ad): test-only; the page's CSP record sets aside the paste's inert-parse script-src-attr reports, keyed on editor.js readHTML's parse line and target document; a new test shows live inline handlers still fail quiet(); editor-browser 17/17, editor plus editor-provenance 11/11, no skips; 4 mutants killed; no push, queue or PR action.