[callumalpass]

Merge after #197

Supersedes #145.

Reader no longer imports or depends on the legacy Connect client. Repositories use native SDK RecordView/QueryResult, plain JSON, record witnesses, settlement and error descriptions. Web and extension source-note/annotation editors use native record leases through the real SDK Mdbase, without a lease RPC or compatibility client.

Merge composition

• Merged origin/feat/extension-shared-session (794d9b85) with merge commit 9e3c0db5. Replace extension RPC with the SDK shared session #197 removes the extension's application RPC bridge and gives each page its own createMdbase with session: { build, host: false }, sharing the offscreen SDK host. use-extension-capture.ts:633 now supplies that page's actual application to the native source-note editor. The previously intentional full-typecheck failure is resolved; no bridge or legacy client is restored.
• Merged origin/main (6b71623e) with merge commit a68d5fd4, accepting its automatic SDK beta.210 intake, original production archive/custody metadata and SDK publisher selection. The package conflict retains beta.210 and the legacy client deletion.
• Regenerated the pnpm lockfile and extracted/compiled all ten i18n catalogs rather than hand-merging generated outputs. Documentation retains the native-record architecture and Replace extension RPC with the SDK shared session #197's shared-session description, not its superseded legacy-adapter text.
• Added documentation-only follow-up 1a505626 to make the preview behavior precise. No Reader upkeep: browser audit drift, development guide and vendor pruning #196 upkeep/browser-audit/menu/layout fix is included; its files are left alone apart from already-existing lane changes and main's separate chore: vendor verified production SDK 0.1.0-beta.210 #198 repin.

Deletion evidence and retained invariants

• Every production web environment already enters SdkReaderRoot/NativeImportPage from apps/reader/src/main.tsx. The removed readerSession had only unused old-import consumers; ReaderPortableApplicationSession had no caller. Native records carry revision witnesses, so the revisionless annotation cache and feature-negotiation paths have no native consumer.
• Deletes legacy application/portable sessions, the old import/direct-access flow, Connect-shaped native client/mapping, generic legacy editor sessions and direct protocol dependency. Manifest validation uses @mdbase-dev/sdk/manifest. Together with Replace extension RPC with the SDK shared session #197 this also deletes the offscreen application RPC channel, host/client, serialization, callbacks/abort dispatch, lifetime lock, memory bus and bridge tests. The offscreen lifecycle message and existing content-capture messages remain; they carry no SDK record RPC.
• Keeps Reader domain mapping, complete-query requirements, deletion confirmation, naming/relink create journal, source checkpoints, older annotation draft recovery, original SDK recovery references and current-connection fencing. No new public/persisted state, fallback or trust policy.
• Keeps vendor archives/custody inputs needed by current production/LAB/staging pins and historical protocol metadata. The three lockfile legacy-protocol names are SDK transitive-peer labels, not a restored direct dependency. ESLint mentions the legacy client only to forbid importing it.
• Against fetched main: 203 files, 5,427 additions / 12,473 deletions, net 7,046 lines removed including catalogs.

Behaviour change for review

The no-collection interface preview previously let a user type and format source-note Markdown and autosave it into that tab's sample data. Annotation bodies with a path and revision were also editable: newly-created source comments and seeded anthology bookmarks qualified, and their editor offered deletion. The three seeded James annotations already lacked those identities, so their card Edit buttons were already disabled.

This was not a legacy in-memory Connect client. Both editors used the legacy callback-based MdbaseRecordSession around PreviewGateway.saveSourceBody / updateAnnotation, which mutate the preview's own arrays. There was no SDK application, collection or transport behind those saves. Saved sample changes reset on reload; source-note unsaved drafts separately had a browser-local checkpoint.

Now the preview still has no Mdbase, so source-note Markdown is read-only, its formatting/save/insertion toolbar is absent, and annotation-card Edit remains visible but disabled even for newly-created comments. Consequently the body editor and its Delete annotation action cannot be reached through those cards. The change follows requiring native SDK record leases, not removing a backing in-memory client. No sample runtime or preview gateway behavior is changed in this integration lane.

The demo is not wholly read-only: a user can still create a source comment with an initial body, but cannot re-edit it through its card. The existing sample gateway still handles annotation creation, colour/ownership, source creation/removal and source/citation details, reading state, saved views and transclusion. Insert into source note still changes the sample source-note body despite direct Markdown editing being read-only; highlight release/undo has a separate deletion path. These remain tab-local sample operations, not connected or durable collection writes.

An isolated Chromium comparison against unmodified main 6b71623e and final head verifies: before, source-note edit/autosave and new-comment edit work; after, note and annotation-card body editing are disabled. In both versions the James seed cards are already disabled, source-comment creation succeeds, annotation transclusion changes the body, and reload restores the original sample note. Source traces separately establish the other retained gateway operations; they are not claimed as individually browser-tested.

Validation

Final head: 1a50562667a4e0a674765df10c42cb96a93da3a5; Node 22.22.0, pnpm 10.7.0. Finite checks/builds use rpnpm; Chromium and owned loopback services stay local.

Command	Result
pnpm install --lockfile-only --offline; pnpm install --offline --frozen-lockfile	PASS; generated combined beta.210 lockfile
pnpm i18n:extract; pnpm i18n:compile	PASS; all ten locales complete
rpnpm check	PASS: lint/format/architecture, every workspace typecheck, 11 architecture tests, 175 publisher tests, 3,435 Vitest tests plus workspace script tests, and i18n/source contracts
rpnpm --pull apps/reader/dist build:production	PASS; 161-asset offline shell verified
rpnpm --pull apps/extension/dist --filter @mdbase-reader/extension package	PASS; production ZIP
MDBASE_ENV=production pnpm --filter @mdbase-reader/app manifest; MDBASE_ENV=production pnpm --filter @mdbase-reader/extension manifest:mdbase; test -z "$(git status --porcelain)"	PASS; generated manifests and source clean
pnpm --filter @mdbase-reader/extension test:browser	PASS; two independent bundles, one original beta.210 SDK Worker/replica, bidirectional writes, host survives follower close
pnpm --filter @mdbase-reader/app test:browser	FAIL, pre-existing baseline finding described below
pnpm --filter @mdbase-reader/app test:html-svg	PASS
pnpm --filter @mdbase-reader/app test:pdf-touch	PASS; touch/mobile persisted highlights
rpnpm --pull apps/reader/dist --filter @mdbase-reader/app build:feedback-test; pnpm --filter @mdbase-reader/app test:feedback	PASS against owned loopback preview; all delivery intercepted
rpnpm test:publisher	PASS separately, 175 tests
rpnpm check:release-downloads; rpnpm test:release-downloads	PASS, all eight tests
Owned Chromium before/after sample behavior probes	PASS; exact behavior above, no account/collection or external delivery

The full Reader browser audit is not green: unchanged apps/reader/scripts/audit-reader.mjs:310 uses getByLabel("Library actions", { exact: true }), matching both the toolbar and summary. The final head and a clean exported main 6b71623e fail identically after the successful 5,000-source virtualization/keyboard/range-selection scenario. #196 already contains the summary-specific locator correction; it was deliberately not taken into this lane. Later portions of the full audit were not reached and are unverified, not PASS. This remains an exception to the requested all-checks-green acceptance.

An earlier full check hit a Vitest-cache ENOTEMPTY startup race; the unchanged rerun and final-head full check pass. One release-download run scanned the temporary exported baseline under its new prefix; removing only that run-owned snapshot and rerunning passes. No registered assertion, timeout, allowlist or trust policy was relaxed. Production output was rebuilt after the feedback build. Owned browsers/servers were closed and the exported baseline removed.

No authenticated extension sign-in/editor-save, production registration binding, LAB/native-runtime, log-durability, deployment or store-release qualification is claimed. The local replica test and editor unit/type coverage are separate evidence. No review was requested, no PR was merged and CI is not watched.