Document Phase 1 verification and retained plain asset URLs

plans/phase1-report.md

@@ -0,0 +1,44 @@
+# Phase 1 report
+
+Shipped: `6cb00d5` adds asset groups/contracts, boot snapshots, per-file hashes,
+HTML stamping, `/api/manifest`, ETag/304, hash headers and `ASSET_HASHING=0`.
+`d18d17c` preserves the exact legacy index/binary cache rules and pins SW bytes.
+Plan: `ad85cb6`; `84546ee` groups Glass Stage dependencies together.
+Migration harness/results: `7c45d09`.
+
+Verification: 156 frontend and 178 server tests pass. Server tests used an
+isolated scratch Python environment with yt-dlp installed; none were skipped.
+Both service-worker sources, index source, playback and timers remain unchanged.
+Production fixture: `b77938a` → `1175f1a1d2c1`, reproduced without production calls.
+Chromium/WebKit migration passes through the lossy/stalling proxy: one banner,
+one update reload, all 87 shell entries verified, 21 legacy URL/body checks,
+and offline boot with Bun stopped. Migration took 19.4/15.3 s respectively.
+WebKit's known disconnected API transport errors are checked separately; script
+errors during installation/update fail the harness.
+
+Reduced Chromium LTE: three-run cold median before final regrouping 10,466 ms
+vs 10,480 ms. Final standalone single-run cold: 11,137 ms (+6.3%); FCP
+1,564 ms vs 1,572 ms; wire bytes 1,042,858 (+0.3%). Warm/offline boots:
+641/232 ms vs 692/259 ms. Overlapped-run timings are retained separately.
+
+JS-requested assets receiving hashed URLs: **none**. HTML CSS/JS references are
+hashed, including sha256-wasm.js/loudness-wasm.js (embedded WASM; no standalone
+.wasm fetch). Plain worker URLs: opfs-worker.js, hash-worker.js,
+direct-recv-worker.js, p2p-recv-worker.js. Plain worker imports: sha256.js,
+resume-core.js, sha256-wasm.js. Plain dynamic loads: piano-engine.mjs,
+vendor/framework7-swipe.min.js. Propagating URL maps safely needs caller/worker
+changes and a cached bootstrap; retain the unchanged client protocol this phase.
+All are manifested; piano-engine.mjs is historically absent from SHELL, an
+existing offline limitation deferred to the loader phase.
+
+Also plain: manifest.webmanifest; icons/icon-{192,512}.png;
+fonts/{BricolageGrotesque,HankenGrotesk,JetBrainsMono,PlusJakartaSans}-{latin,latin-ext}.woff2.
+Font preloads must match fonts.css URLs; manifest icon paths remain unchanged.
+
+Build identity hashes sorted canonical metadata with the index build-meta
+placeholder intact; published index/SW hashes describe final served bytes,
+avoiding self-reference. Restart after frontend edits; hashing mode ignores
+BUILD_TAG overrides. Incremental downloads/lazy parsing await later phases.
+
+Owner iPhone checks: install/update, offline launch, active layout, then 30-minute
+locked playback, dropouts, battery use and resume. No push, merge or deployment.