docs(web): record grouped private rollout

CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## Unreleased — 0.1.2
 
+- Completed the private grouped rollout of Web Sessions deletion and Program
+  V1 from desktop source `a0fc48f082b76dba2ae3a56fceb492169de89f89`.
+  Desktop migrated from schema v24 to v25 after backup, restoration, and
+  copy-migration verification. Android was updated in place to private
+  versionCode 15 with no uninstall or data clearing; the installed APK is
+  non-debuggable and retains the daily-installation certificate. Exact
+  pre/post-update logical comparison preserved all 46 Android tables and 1,023
+  rows. A preparation created explicitly as disposable was withdrawn through
+  the real 390×844 confirmation UI. Two full-generation exchanges around a
+  Trainlog-only restart retained exactly one Android withdrawal result, no
+  matching delivery or performed session, and no resurrection or duplication.
+
 - Completed Web Sessions deletion and Program V1 on desktop schema v25. Separate
   revision-guarded Core commands now withdraw manual preparations and AI
   proposals or causally delete inactive execution drafts and selected completed

README.md

@@ -17,13 +17,15 @@ over direct MTP; it never copies SQLite database files between devices.
 |---|---|
 | Android | Capture and quickly correct sets, repetitions, loads, durations, and continuous activities; reorder active and completed-session occurrences; capture feedback, J+1 follow-ups, body measurements, and AI proposals; trigger sync; show quick summaries. |
 | Desktop TUI | Administer, inspect, maintain, import/export, correct canonical history, and provide technical tools. |
-| Local Web (0.1.2 development) | Display the Dashboard and the implemented Sessions inventory, detail, manual preparation, and Android-delivery workflow through typed Trainlog Core/API boundaries. Analyse, Programmes, and Exercises remain placeholders. |
+| Local Web (0.1.2 development) | Display the Dashboard and the implemented Sessions inventory, deletion, manual preparation, Android-delivery, and embedded Programs workflow through typed Trainlog Core/API boundaries. Analyse, the standalone Programmes route, and Exercises remain placeholders. |
 
 No interface reconstructs business truth from SQLite tables. The local Web is
 a sibling adapter, not an extension of the TUI. On `main`, its loopback-only
 CLI/HTTP adapter, embedded frontend, read-only Dashboard API, factual tiles,
 visualizations, and private layout persistence are implemented. This does not
-make the other four Web routes functional or publish version 0.1.2.
+make the remaining placeholder routes functional or publish version 0.1.2.
+Programs is intentionally implemented as a Sessions subtab; the standalone
+top-level Programmes route remains a placeholder.
 
 ## Releases
 
@@ -318,7 +320,7 @@ not contain cloud credentials and does not run `rclone`.
 As of 2026-09-18:
 
 - `TRAINLOG_FORMAT_V1=PASS/FROZEN`;
-- desktop SQLite schema v24 and Android SQLite schema v23;
+- desktop SQLite schema v25 and Android SQLite schema v23;
 - Notcurses is the only active desktop terminal backend;
 - direct storage is `/storage/emulated/0/Documents/Trainlog` under Android's
   all-files access setting;
@@ -331,7 +333,8 @@ As of 2026-09-18:
   Android-triggered bidirectional smoke test.
 - `WEB_FRONTEND_SHELL_V1=PASS/FROZEN` and
   `WEB_DASHBOARD_V1=PASS/FROZEN` and `TRAINLOG_WEB_SESSIONS_V1=PASS/FROZEN`;
-  Analyse, Programmes, and Exercises remain placeholders;
+  Programs is implemented inside Sessions; Analyse, Exercises, and the
+  standalone top-level Programmes route remain placeholders;
 - `TRAINLOG_WEB_V1=CONTRACT_FROZEN / IMPLEMENTATION_STARTED`;
 - `TRAINLOG_SYNC_GENERATION_ACK_V1=PASS/FROZEN` through explicit staged
   services; automatic synchronization still selects V3. The trusted local

docs/current_state.md

@@ -4,12 +4,17 @@ The opt-in full-generation path is operational on the private daily
 installation. The loopback Web control and foreground Android coordinator use
 the production direct-libmtp adapter, correlated manifest/ACK V1 objects, and
 persistent peer identities. The latest controlled rollout verified real
-backups and restoration, desktop schema v23 to v24 and Android schema v22 to
-v23 migration, signing-preserving Android replacement, the requested durable
-preparation withdrawal, two complete post-withdrawal hardware conversations,
-restart, and idempotent replay. Drive was not configured and remains outside
-this local MTP result. This is a private 0.1.2 development deployment, not a
-public release; v0.1.1 is unchanged.
+desktop and Android backups, restoration and migration on copies, desktop
+schema v24 to v25, and an in-place private Android update from versionCode 14
+to 15. The installed APK remains `com.labfytools.trainlog` 0.1.2, is
+non-debuggable, and retains certificate SHA-256
+`aa56c97f2781a0d01f007f4444c3970deb58ad8327ca3da7b0b90f37dbe2ad25`.
+One preparation created explicitly as disposable was withdrawn through the Web
+confirmation flow. Two complete generation conversations around a Trainlog-only
+restart proved one durable Android `no_matching_delivery` result, no delivery
+or performed session, no resurrection, and no duplication. Drive was not
+configured and remains outside this local MTP result. This is a private 0.1.2
+development deployment, not a public release; v0.1.1 is unchanged.
 
 `TRAINLOG_NATIVE_BUILD_AND_CANDIDATE_V1` closes the native warning gate. Strict
 GCC 16.2.1 and Clang 22.1.8 builds now pass the same 81-test inventory, and the
@@ -75,6 +80,7 @@ parallel implementation of its rules.
 | Web Dashboard visualizations | `WEB_DASHBOARD_VISUALIZATIONS_V1=PASS/FROZEN` |
 | Web Dashboard V1 | `WEB_DASHBOARD_V1=PASS/FROZEN` |
 | Web Sessions V1 | `TRAINLOG_WEB_SESSIONS_V1=PASS/FROZEN` (controlled desktop/Android deployment validated) |
+| Web Sessions deletion and Programs V1 | `TRAINLOG_WEB_SESSIONS_DELETE_AND_PROGRAMS_V1=PASS` (private grouped rollout validated) |
 | Sync orchestrator/report V1 | `TRAINLOG_SYNC_ORCHESTRATOR_REPORT_V1=PASS/FROZEN` |
 | Web sync API V1 | `TRAINLOG_WEB_SYNC_API_V1=PASS/FROZEN` |
 | Web sync button V1 | `TRAINLOG_WEB_SYNC_BUTTON_V1=PASS/FROZEN` |

docs/reviews/web_sessions_delete_programs_v1_evidence.md

@@ -2,9 +2,9 @@
 
 Date: 2026-09-18
 
-This pre-deployment record covers the completed development branch. It does not
-claim installation, migration of real data, service restart, phone validation,
-tagging or release publication.
+This record covers the completed development branch and its authorized private
+grouped rollout. It does not claim a tag, public release, key rotation, Android
+uninstall, or application-data clearing.
 
 ## Implemented boundaries
 
@@ -37,11 +37,34 @@ tagging or release publication.
   destructive confirmation and Programs empty state.
 - `tools/check_changed_c_format.sh main` and `git diff --check` passed.
 
-## Deployment gate
+## Controlled private rollout
 
-Desktop schema v25 and proposal synchronization V2 require the grouped gate:
-retain the installed package, create consistent desktop and Android backups,
-validate v24→v25 migration on a database copy, verify Android package signing
-and monotonic versioning, then install/restart/synchronize and inspect the real
-Web routes only after explicit authorization. No operation in this record
-crossed that gate.
+- Desktop source commit:
+  `a0fc48f082b76dba2ae3a56fceb492169de89f89`.
+- Coordinated desktop archive SHA-256:
+  `9f50757009fbdbe5145995daf4593caf658be695df62bd090cc91e29118202ed`.
+- Private Android APK SHA-256:
+  `905590f84faa69ab7d4eff959f6518164c8ed7bd99e135223242a7e214755074`.
+  The installed package is `com.labfytools.trainlog`, versionName 0.1.2,
+  versionCode 15, non-debuggable, and signed by certificate SHA-256
+  `aa56c97f2781a0d01f007f4444c3970deb58ad8327ca3da7b0b90f37dbe2ad25`.
+  The update used `adb install -r`; it did not uninstall or clear the app.
+- The desktop schema-v24 backup passed integrity and foreign-key checks. A
+  restored copy retained the same SHA-256, and the v24→v25 rehearsal preserved
+  all 40 pre-existing tables and 820 rows before the live migration did the
+  same. The five new v25 tables were initially empty.
+- The Android production `.tlbackup` archive passed manifest digest, SQLite
+  integrity, and foreign-key checks. Logical comparison before and after the
+  APK replacement preserved all 46 tables, 1,023 rows, and preferences.
+- Real Web smoke checks passed at 1440×1000 and exactly 390×844. Program import
+  reached the Core preview and was cancelled before commit. The only destructive
+  proof used the explicitly disposable preparation
+  `sp_4e662fe4-f5bc-47a8-b9cb-7ed75c0cec8a`; no program or performed session
+  was created.
+- Full-generation runs `sy_0623ed4c-eb69-40ab-ae68-bc5a57b5e3f5` and
+  `sy_3cf9e9bb-8631-4caa-9423-478467028ad8` completed around a restart of only
+  Trainlog components. Android retained exactly one correlated withdrawal with
+  result `no_matching_delivery`, zero corresponding deliveries, and zero
+  corresponding performed sessions. Desktop retained one acknowledged
+  withdrawal and excluded the preparation from active Web lists after replay.
+- No debug APK, public-lineage APK, tag, or public release was used or created.