feat: harden support, localize knowledge and add operator availability [skip ci]

Source-only publication of reviewed commit 64e96a7f423673dc29ad56485be9fc79bce8af1c.

Passed in isolation: focused frontend/backend tests, race checks, TypeScript typecheck, lint, Go compilation, Flowgram build, and deterministic SDK build/tests.

Not accepted as a production release: Next.js export/native assembly remains blocked by environment memory limits; browser interaction and MySQL staging acceptance remain unverified. No production server, database/schema, runtime configuration, deployment, release tag, or workflow execution was performed.

Expected source tree: 0a4a7528e9.

docs/hardening/VALIDATION.md

@@ -0,0 +1,185 @@
+# Validation status: isolated checks, not a production release
+
+Validated on 2026-10-16 against the integrated public-source baseline: Gitea main
+`299ea50fb5bb6874c3fca96277fce187205ac20a` and hardening-review
+`63e045788623e88f7fd7b44102e649e08f4c1f1c`, merged as `3868181`, with the follow-up
+corrections listed below. This baseline does not include later knowledge-base
+localization or operator-availability feature work. Its historical results are
+retained below; the final combined-tree checks are recorded separately at the end
+of this document.
+
+## Isolation and toolchain
+
+- Go 1.26.9, Node 24.19.0, pnpm 10.30.2, locked TypeScript 6.0.3/Next 16.2.11.
+- Official Go archive checksum and downloaded Go module checksums verified.
+  Frontend dependencies installed with the frozen lockfile and lifecycle scripts
+  disabled. Dependency manifests/lockfiles were not changed.
+- Tests ran with a cleared application environment, dedicated temporary/cache
+  directories, temporary or in-memory SQLite fixtures, mocked frontend APIs and
+  loopback WebSocket fixtures. No production configuration, credentials,
+  databases, application server, or external support messages were used.
+- The service test harness rejects non-loopback HTTP requests before the
+  underlying transport/DNS, including redirects. Concrete Slack, Telegram,
+  Discord, Zalo and HTTP email clients were inspected to confirm their default
+  transport usage. The only test WebSocket dialer targets its own loopback server.
+- Service fixtures explicitly replace the transitive AI-runtime hook with a
+  test-only no-op. Dedicated hook tests still install their own spy; AI-runtime
+  behavior is not claimed as covered by the service suite.
+- `TestHandleRequest*` email/SMTP cases were excluded from the expanded service
+  run: raw SMTP does not use the HTTP guard. No unrestricted `go test ./...` was
+  run. This exclusion is an isolation limit, not a passing result.
+
+## Historical baseline completed checks
+
+- `gofmt` on all changed Go files and `git diff --check`.
+- `go test ./internal/pkg/openidentity`: passed, including scoped issuer/channel,
+  signed-policy and signature-boundary tests.
+- `GOMAXPROCS=2 go test -p 2 -race -tags dev ./internal/pkg/eventbus ./internal/pkg/openidentity`:
+  passed.
+- Focused service security/setup/realtime suite with `-race -tags dev`: 46
+  top-level tests, 102 successful test/subtest events, no failures or skips.
+  Covers identity collisions/concurrent claims, live session revocation,
+  permission boundaries, actual WebSocket pumps, channel CAS, preview/apply,
+  rollback and dispatch outcomes, plus the transport guard and redirect check.
+- `GOMAXPROCS=2 go test -p 2 -tags dev ./internal/services -skip '^TestHandleRequest' -count=1`:
+  passed, 217 top-level tests and 295 successful test/subtest events.
+- `GOMAXPROCS=2 go build -p 2 -tags dev -buildvcs=false ./...`: passed. The `dev`
+  embedding mode is the repository CI test mode. VCS stamping was unavailable in
+  the isolated worktree and was disabled only for this compile check.
+- `cd web && pnpm typecheck`: passed with declared locked dependencies before
+  the later six-file lint cleanup. The post-cleanup retry was killed with exit
+  137 without a TypeScript diagnostic; the final combined tree must rerun it.
+- All frontend Node test files under app/components/hooks/i18n/lib:
+  226 tests passed, no failures or skips. This includes the SDK, draft revisions,
+  account/customer-session isolation, setup contract, abortable realtime recovery,
+  hidden/unmounted lifecycle and navigation checks.
+- Four additional offline component-lifecycle regressions passed after the
+  six-file lint cleanup (bulk-move selection/stale responses, palette snapshots,
+  notification cleanup, editor/origin initialization). The earlier 226-test full
+  run predates these four additions.
+- Full `pnpm lint`: exit 0 after localized lifecycle corrections, with zero
+  errors and 45 existing warnings. No lint rules were disabled.
+
+## Corrections found by execution
+
+- The old realtime test fixture lacked required conversation counters. It now
+  matches the DTO; the history/realtime merge assertion was retained unchanged.
+- Async assignment notifications could outlive their test database. The eventbus
+  now exposes a drain for already-published handlers, and the fixture waits before
+  restoring global state. Nested publishes/error callbacks have a regression
+  test. No sleep or disabled race check is used.
+- Setup background responses are fenced by effect lifetime/request generation.
+  The staff realtime hook captures its user ID in the effect rather than writing
+  a ref during render. VM test harness variable names satisfy Next ESLint rules.
+- Four missing generic setup locale keys were supplied in English, Russian and
+  Chinese. Existing locale-integrity assertions are unchanged.
+- Three stale source-test harnesses were aligned to current route groups and
+  component ownership while retaining realtime placement, accessible label,
+  trigger-style and collapsed-navigation checks.
+- Seven existing lint errors across six components were corrected without rule
+  suppressions: browser-origin/palette hydration now uses external snapshots;
+  bulk-move targets reset on dialog/base changes and obsolete directory results
+  are ignored; initial notification requests cannot update after cleanup;
+  fullscreen initialization and toolbar construction no longer need the flagged
+  mount-state effect or mutable ref-bearing action list.
+
+## Historical baseline remaining release gates
+
+- Full-project lint has 45 existing warnings. The final feature integration must
+  rerun lint, typecheck and the complete Node suite after all source changes.
+- The canonical frontend export (`pnpm build`) did not complete. An initial
+  cross-worktree node_modules symlink was replaced by a local offline frozen-lock
+  installation. The subsequent default Turbopack build reached optimized
+  compilation, then was killed with exit 137 and no source diagnostic while the
+  shared environment had little free memory. This is not a successful build; a
+  low-concurrency build on the final combined tree remains required. No build,
+  typecheck or security checks were disabled to bypass this result.
+- Actual MySQL CAS/nullable-unique-index behavior and additive schema upgrade/
+  identity reconciliation on an approved staging backup have not been run.
+- Browser acceptance at desktop/narrow widths in Russian, English and Chinese
+  has not been performed for this integrated baseline.
+- Production migration, service startup and deployment have not been performed.
+
+SQLite results do not establish MySQL behavior. Automated tests do not establish
+visual acceptance or a safe production upgrade. Preserve the identity/token
+upgrade precautions in `CUSTOMER_IDENTITY_UPGRADE.md` and preview/apply contract
+in `SETUP_PREVIEW.md` before any rollout.
+
+## Final combined source validation (2026-10-16)
+
+The combined canonical checkout at `1ec72508cdda2dfe3b3eed3158f8ba930d76d260`
+includes security/realtime integration, knowledge localization, operator
+availability/calendar/presence, final locale changes and the two fixture-only
+corrections described below. These results are distinct from the historical
+baseline above and from the separately integrated CoverIt vendor tree.
+
+The same sanitized toolchain, temporary SQLite fixtures and loopback-only test
+transport were used. No application server, production database, credentials,
+migration or external support message was used. Raw SMTP `TestHandleRequest*`
+cases remain excluded, and the service-suite AI hook remains a test-only no-op;
+neither scope is claimed as covered. No unrestricted `go test ./...` was run.
+
+### Completed combined checks
+
+- All changed Go files are `gofmt`-clean; `git diff --check` passed.
+- `GOMAXPROCS=2 go test -p 2 -tags dev ./internal/services -skip '^TestHandleRequest' -count=1 -timeout=5m -json`:
+  passed, 240 top-level tests / 333 test-and-subtest events, no failures or skips.
+  The same audited scope with `-race` passed with identical counts and no race
+  report (181.272 seconds).
+- Full race suites for `internal/pkg/eventbus`, `internal/pkg/openidentity` and
+  `internal/pkg/i18nx`: 48 top-level tests / 78 successful events.
+- Focused dashboard availability permission/ACL race tests: 4 tests passed.
+- Focused knowledge handler, builder and RAG localization race tests: 12
+  top-level tests / 18 successful events, with mocked provider callbacks and no
+  external application calls.
+- `GOMAXPROCS=2 go build -p 2 -tags dev -buildvcs=false ./...`: passed. This is a
+  complete source compile in the repository's test embedding mode, not a binary
+  containing the production web export. VCS stamping was disabled only for the
+  local compile environment.
+- `NODE_OPTIONS=--max-old-space-size=1024 pnpm typecheck`: passed.
+- Every frontend `*.test.mjs` under app/components/hooks/i18n/lib, run with
+  `node --test --test-concurrency=1`: 262 tests in 14 suites passed; zero failures,
+  cancellations or skips.
+- Full `pnpm lint`: exit 0, zero errors and 42 warnings. No rules were disabled.
+
+The first combined service run identified two obsolete fixture assumptions,
+not production-code failures. The realtime operator fixture now reuses the
+existing `conversation.view` permission without changing its state. Only the
+readiness success scenario that expects an eligible human now seeds an employee,
+current permission, login session and bounded live-presence lease. Negative
+permission scenarios and all original behavior assertions were retained. The
+full normal and race results above were obtained after these fixture repairs.
+
+### Asset assembly and packaging limit
+
+- Both frontend projects used unchanged frozen lockfiles with dependency
+  lifecycle scripts disabled. Web dependencies totalled 978 locked packages;
+  Flowgram dependencies totalled 953. Official Go/module integrity checks passed.
+- Flowgram's production `pnpm build` passed and generated its complete public
+  assets. Third-party parser warnings were reported, without build errors.
+- The SDK's official `pnpm build:sdk` ran twice; both outputs were deterministic
+  and byte-identical to the tracked bundle. No generated SDK change is required.
+- The default Next 16.2.11 Turbopack production build did not complete: optimized
+  compilation ended with exit 137 (`Killed`), without a source diagnostic.
+- A sequential supported `next build --webpack` attempt, with a 1 GiB Node heap
+  and bounded workers, ended with a build-worker `SIGKILL`, also without a source
+  diagnostic. This was not a successful alternate export.
+- One distinct experiment used the [documented memory optimization](https://nextjs.org/docs/app/guides/memory-usage)
+  `experimental.webpackMemoryOptimizations` option and a 640 MiB Node heap. It
+  ended with an explicit JavaScript heap-out-of-memory error and worker
+  `SIGABRT`. The temporary config was restored byte-for-byte afterward. No build
+  check, typecheck, security setting, font or application asset was bypassed or
+  mocked. Official Google font CSS and a real font asset were reachable through
+  the existing trusted proxy configuration.
+- Dependency manifest and lockfile hashes, and the tracked SDK hash, remained
+  unchanged by assembly; no production source/config edit was retained. No native production-embedded binary was
+  assembled because a complete Next export was not available. Flowgram/SDK
+  success and the `-tags dev` Go compile do not satisfy that packaging gate.
+
+The default frontend export and complete native assembly therefore still need
+a suitably provisioned isolated build environment. These failures do not prove
+a source defect, and the passed tests do not establish a deployable release.
+Actual MySQL behavior, approved staging upgrade/identity reconciliation, real
+browser desktop/narrow-width acceptance in Russian/English/Chinese and production
+migration/startup/deployment remain unverified. Preserve all upgrade precautions
+above. No cross-platform or LanceDB release assembly was attempted.