Programs presentation, Android projection, and delete V1 evidence

Scope and lifecycle

This record captures the implementation and validation evidence presently available for TRAINLOG_PROGRAMS_PRESENTATION_ANDROID_DELETE_V1.

The feature is implemented and validated in the recorded automated and real Firefox Programs presentation checks. It is not deployed. This record does not assign PASS or FROZEN status.

Implemented contract

Desktop schema v26 adds programs.deleted_at and the terminal program_deletions logical-deletion ledger. The ledger retains request and deleted revisions, response replay, generation_id, and acknowledged_at. Active and archived programs may be deleted. Source definitions and derived preparations remain; deleted programs cannot resurrect or reprepare, and archived programs cannot prepare.
The Web Sessions Programs subtab renders responsive cards and timeline detail from real imported, session, usage, and provenance data. Its discrete trash action has destructive confirmation, focus management/restoration, and Escape/Cancel paths that make no mutation.
Android schema v24 adds the read-only synced_programs, synced_program_sessions, synced_program_entries, and synced_program_deletions projection. Android provides Sessions list/detail consultation only; it exposes no Program mutation actions.
trainlog-programs V1 is an optional staged controlled-generation companion named programs-v1.json. With the programs-v1 capability, desktop sends a full snapshot of nondeleted programs and unacknowledged tombstones; Android durably acknowledges correlated consumption. The companion does not change TRAINLOG_FORMAT_V1, mobile export V3, catalog exchange, or preparations.

Validation recorded

Full Meson suite: 89/89.
Focused ASan/UBSan suite: 3/3.
Web Vitest: 94 tests.
Web production build completed.
Android unit suite: 230 tests, 5 skipped; assembleDebug completed.
Python Programs and synchronization suites completed.
Format and diff validators completed, including git diff --check.
Real Firefox Programs screenshots passed and are retained as desktop cards, 1440x1000 and mobile deletion dialog, exact 390x844.

Pre-switch migration and exchange gates

schema_v26_migration deterministically migrates a populated v25 fixture with 24 sessions, 48 entries, preparation provenance, and historical evidence. It asserts the exact typed post-migration projections rather than only table or column presence.

The integrated Android SyncGenerationServiceTest executes the real production chain from a live Program through capture and publication, Android consumption, Program deletion and tombstone publication, the real correlated ACK, desktop acceptance and reopen. An exact old generation is idempotently recognized and ACKed while the durable tombstone prevents Program resurrection; a second exchange adds no duplicate data.

Private real-copy v25 to v26 migration evidence

A private real-copy migration gate preserved user-data confidentiality while validating the source backup at v25 and its post-migration v26 result. The post-migration integrity check passed, foreign-key violations numbered 0, and the business-data SHA-256 was identical before and after migration: b264dd1b5fd7cdc599b2f6e2a20c01af794949e7871b8e3107ff3b29a06c6e11.

The program identity hash was 1b14...; the 24 sessions hash was 593f...; the 164 entries hash was b991...; and the two preparations hash was 2e273.... The copy contained no deleted_at values and no program_deletions rows. All 45 unchanged business tables matched their canonical field-level hashes.

These results are implementation and presentation-validation evidence. They do not substitute for separate deployment validation.

Remaining validation

Validate deployment separately before representing the feature as deployed.

4 KiB Raw Blame History