proofs(agda): PERMANOVA's p-value floor and which terms are withheld by hyperpolymath · Pull Request #42 · JoshuaJewell/MetaManifold-WebUI

hyperpolymath · 2026-10-15T00:59:22Z

What this changes

A new Agda module, proofs/agda/MetaManifold/Permanova.agda (+473 lines), machine-checking the two things run_permanova in src/analysis/analysis.jl decides for itself rather than taking from vegan:

The reported min_p_value. vegan's p-value for B permutations is (k + 1)/(B + 1), so the smallest p-value B permutations can give is 1/(B + 1) -- and it is attained exactly when no permutation reaches the observed statistic. More permutations never raise that floor (minP-anti); a threshold below it is below every p-value, so no term can meet it (below-floor-unreachable). The concrete case the test exercises: with 63 permutations the floor is 1/64, and no p-value is at or below 0.01 (minP-63, no-p-at-1%-with-63).
Which terms have their p-value withheld. _varies_within_any_block returns false exactly when no block holds two different values (varies-false⇔Constant); that condition holds exactly when no within-block permutation exchanges the term's labels (withheld⇔never-exchanged, untestable⇔fixed); and a p-value is reported exactly when some within-block permutation does exchange them (tested⇔exchanged). So no testable term is withheld and no untestable one is tested -- the withholding rule is forced, not a policy.

Also included, so the module cannot rot silently:

its import in MetaManifold/All.agda, making the axiom audit reach it (an unimported module is never type-checked);
the README's PERMANOVA sections and the theorem-to-code map, row by row against test/unit/test_permanova.jl (which is already on main);
the Agda proofs job's comment in ci.yml names the third proof subject.

Every module is checked with --safe --without-K; no postulates, holes, or termination/positivity pragmas -- proofs/tests/axiom-audit.sh enforces this and fails if any module is unreachable from All.

What is modelled, and what is not

Permutation′ n from the standard library stands in for vegan's within-block permutations; a list of (value, block) pairs stands in for zip(values, blocks); an association list stands in for the first_seen dictionary, mirroring get!'s store-on-first-visit. The F distribution itself is deliberately NOT modelled: the theorems take B (what permute reports) and k as given. Six blocks of two samples admit 2^6 = 64 arrangements -- the identity and 63 others -- which is where the test's 63 comes from.

How to run its tests

bash proofs/tests/axiom-audit.sh                  # 5 modules reachable, clean
cd proofs/agda && agda MetaManifold/All.agda     # Agda 2.6.4.3 + agda-stdlib 2.1
julia --project=. test/unit/test_permanova.jl     # the mapped Julia behaviour

All verified locally on a branch cut from this repository's current main tip (52feb60): the audit reports 5 modules reachable and clean, All.agda type-checks without error, and the pin suite passes 208/208 with the ci.yml comment change.

What this leaves out

The branch history this PR previously carried (the fork's occupancy CI work, its CI account policy, its Dependabot configuration) is fork policy, not upstream changes; this PR is now the proofs alone, one logical change. The commit is unsigned (the contributor's signing key was unavailable to the session that produced it); happy to rebase and sign if required.

Versions tested

Agda 2.6.4.3 with agda-stdlib 2.1 (the pair the CI job pins); Julia 1.13.1 locally for the test suite (CI pins its own).

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe vibe@mistral.ai

…wo-thread disagreement test (#106) MMW-01, part 1 of 2: the probe and the test. This is the unit that would go upstream to JoshuaJewell once the fork is re-synced. Part 2, the dated typed reading, is stacked on this branch. ## Why The vsearch stage runs its ASV and OTU searches concurrently in a full run, and one after the other in a single-stage re-run. Nothing measures what either shape occupies. The searches are child processes, so `Sys.maxrss()` of the Julia process never sees them. The high-water-mark algebra (occupancy-types, choreographic-types A-2/A-3) makes a falsifiable prediction about this shape: - the cost is the same in every order; - the memory peak is not: the larger search's peak serially, up to the sum concurrently. ## What changes **`MemoryProbe`** (`src/core/memory_probe.jl`). Off unless a `pipeline.yml` sets `occupancy_probe.enabled: true`. For each attested stage it records under a new optional `occupancy` key: - `julia_allocated_bytes`: the `Base.gc_num()` delta over the stage; - per task: the largest sampled VmRSS of the children it started (`peak_rss_kib`) and their kernel VmHWM (`hwm_kib`); - `child_peak_rss_kib`: the largest sum of the stage's children's VmRSS at one sampling instant. It samples `/proc` every 10 ms (`interval_ms`) with preallocated buffers, so the sampling barely touches the allocation figure it reports. **Hooks.** - `Tools._run_killable` registers each child. - `_attest` wraps the stage and passes the record to `Provenance.record_stage!(...; occupancy)`. - Both vsearch call sites label their searches `vsearch:asv` and `vsearch:otu`. **With the flag off nothing changes.** `start` returns `nothing` and every hook passes straight through, so a stage record has exactly the keys it had before. The key is deliberately *not* added to `config/defaults/pipeline.yml`, only documented there as a comment: the run config is embedded in `attestation.yml`, so a default key would change every run's record even with the flag off. **Robustness.** The probe never throws into the stage it measures. `getpid` is read once, while the child is alive. ## The disagreement test `test/occupancy_disagreement_test.jl` runs with the full suite. It runs the two searches in three orders, ASV then OTU, OTU then ASV, and concurrent, on a generated fixture of 1000 reference sequences × 400 bp with 300 ASV and 150 OTU queries. **Why that fixture:** of a calibrated ladder (250, 500, 1000, 2000), it is the smallest that kept both searches resident together for at least 15 samples in all of five repeats. **Asserted:** - the cost agrees within 1%; - the hits are byte-identical in every order. **Recorded, not asserted:** each search's peak and the stage peak. Locally: | order | ASV peak | OTU peak | stage peak (KiB) | Julia allocation (bytes) | |---|---|---|---|---| | ASV then OTU | 9204 | 9180 | 9204 | 978432 | | OTU then ASV | 9152 | 9192 | 9192 | 978720 | | concurrent | 9176 | 9204 | **18380** | 978816 | The cost spread is 0.04%. The concurrent peak is twice the serial one. The prediction would have been falsified had the concurrent peak matched the serial one; it did not. **One finding, not changed here.** The test runs vsearch with `--threads 1`. With several threads, vsearch's output order varies from run to run, and `_sort_hits_by_query!` then does a different amount of work, because its `by=` key splits each line on every comparison. That moved the stage's allocation by up to 12% between repeats of the *same* order. Precomputing the sort key would make production cost order-independent too. The file also covers: - the flag off and on through the real `_attest`; - a failed stage, which keeps its occupancy and still rethrows; - old records, which still parse and merge; - a 64 MiB child against a `sleep` control; - chained commands and an instantly exiting child. ## Verification Run locally with Julia 1.12.5 `-t 2` and vsearch 2.30.5 (the pinned version): - `julia --project=. -t 2 test/occupancy_disagreement_test.jl`: 46/46. - `test/runtests.jl provenance tools routes jobs config_hashing`: 547 passed, 10 skipped (`@test_skip`). One error: the live R probe, which needs the dada2 R package that CI installs and this machine lacks. - Five planted mutants are each caught by a failing test: - children ignored; - flag ignored; - key written with the flag off; - stage peak computed as the sum of the task peaks; - extra work in one order (cost spread 0.249). ## What this leaves out - Typed peaks, Session IR and the dated table: part 2, stacked on this branch. - The open bridge that the typed peak bounds the measured peak: occupancy-types, OPEN. - Memory on the R side. - Stages offloaded with `remote:`, where the local child is an ssh client. - Non-Linux hosts. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_015pMjy981ie74uCttyYDanC --- _Generated by [Claude Code](https://claude.ai/code/session_015pMjy981ie74uCttyYDanC)_ Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

MMW-01, part 2 of 2. Stacked on #106 (the probe and the test). This part is fork-side, about the estate's proof siblings, and is not meant for the upstream PR. ## Summary **`docs/occupancy-2026-10.adoc`** is the dated table (2026-10-14). For each order it gives: - each search's peak; - the measured stage peak; - the Session IR counted bytes; - the HWM typed peak; - the Julia allocation. It also has a status ledger, the limits, and what the next proofs would change. | order | stage peak, measured | counted, Session IR | typed peak, HWM | |---|---|---|---| | ASV then OTU | 9204 | 9204 | 9204 | | OTU then ASV | 9192 | 9192 | 9192 | | concurrent | 18380 | 18380 | 18380 | (KiB.) **The pieces:** - **`docs/occupancy/vsearch-*.sir`:** the stage as occupancy-types Session IR, one buffer per search, in each order. - **`docs/occupancy/TypedPeak.agda`:** the typed peak, computed by `refl` with occupancy-types' `Timeline` over resource-algebra's HWM grade. - A search alone exits holding nothing (drift 0). - The first concurrent search is still resident when the second starts (drift = peak). - `docs/occupancy/reject/` holds two claims that must be refused: *concurrent = serial*, and *serial = sum*, which reads occupancy as cost (R-6). - **`scripts/fetch-siblings.sh`:** pins occupancy-types `af95728` and resource-algebra `cf9235c` (the CONTEXT pins) into `_build/dependencies`. Their definitions are consumed, never copied. occupancy-types type-checks against both resource-algebra `cf9235c` and its own pin `b2c9f1f`. - **`scripts/check-occupancy.sh`:** the gate. It runs, in order: - Session IR `check` and `run --trace`; - `TypedPeak.agda`; - the two rejections, each required to fail at its own declaration; - counted bytes against the typed peak, order by order. - **`.github/workflows/occupancy.yml`:** runs the gate when these files change, on any base branch, so this stacked PR is checked too. It uses the digest-pinned Debian trixie image with Agda 2.6.4.3 that upstream's proof job uses, plus `setup-julia` 1.12.5. - **`docs/occupancy/results-2026-10-14.yml`:** the raw probe records behind the table. - **`.gitignore`:** unignores exactly these docs (`docs/*` is otherwise kept local), and ignores `_build/` and `*.agdai`. ## Status rows | ID | Claim | Status | |---|---|---| | MMW-01.1 | flag off ⇒ record unchanged; on ⇒ `occupancy`; old records parse | TESTED (#106's test file) | | MMW-01.2 | cost commutes for this workload | TESTED (asserted ≤ 1%) | | MMW-01.3 | stage peak order-dependent, task peaks not (A-3) for this workload | TESTED (recorded) | | MMW-01.4 | counted bytes = typed peak for the three programs | TESTED (gate) | | bridge | counted bytes ≤ typed peak in general | OPEN (unchanged: three instances, not a proof) | ## Verification - `bash scripts/check-occupancy.sh` exits 0 locally. It ran with Agda from the PyPI 2.6.4.3 wheel (which reports itself as 2.6.4.1) and Julia 1.12.5. CI runs the Debian 2.6.4.3 package. - Negative controls, each failing the gate: - one byte changed in a Session IR text (`18381 != 18380`); - a true claim planted as a rejection ("invalid claim accepted"); - a rejection failing on a scope error ("failed for the wrong reason"). - `zizmor` finds nothing in the workflow. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_015pMjy981ie74uCttyYDanC --- _Generated by [Claude Code](https://claude.ai/code/session_015pMjy981ie74uCttyYDanC)_ Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

… test here (#108) Follow-up to #106 and #107. Both were merged before their checks ran, so this is the part that never ran. ## Summary **The problem.** The `Occupancy reading` workflow ends in `startup_failure`: on #107's PR run, and again on `main` at `4dc19c0`. This account's Actions policy allows only GitHub's own actions and hyperpolymath's own, pinned to a full commit SHA, and `julia-actions/setup-julia` is neither. The same policy is why `ci.yml` has not started on this fork since at least 2026-10-02: it uses `julia-actions/*`, `oven-sh/setup-bun` and `codecov/codecov-action`. So the three-order test that #106 added has never run here. **The fix.** The workflow now uses no third-party action. It installs: - **Julia 1.12.5** from julialang's tarball, checked against julialang's published SHA256 (`41b84d72…8bae7`, as docker-library/julia `a39df01` records it); - **vsearch** from its `config/defaults/tool_versions.yml` pin, checked against the pinned SHA256, exactly as `ci.yml` does. It has two jobs: - **Occupancy disagreement test:** Julia, R from apt (RCall builds against it), `Pkg.instantiate()`, the pinned vsearch, then `julia --project=. -t 2 test/occupancy_disagreement_test.jl`; - **Occupancy typed peak:** `scripts/check-occupancy.sh` in the digest-pinned Debian trixie image with Agda 2.6.4.3, as before. The path filters now also cover the probe's sources and the test. ## Verification - `zizmor` finds nothing. - The only `uses:` is `actions/checkout`, SHA-pinned. - The `eval` of the pin-reading Julia snippet was rehearsed locally: `2.30.5`, the pinned URL and the SHA256. - This PR's own run of the workflow is the real check. The fork's `ci.yml` will keep failing at startup whatever this PR does. The fix there is an account or repo setting (Settings → Actions → General) that allows those actions. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_015pMjy981ie74uCttyYDanC --- _Generated by [Claude Code](https://claude.ai/code/session_015pMjy981ie74uCttyYDanC)_ Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…o the fork (#109) ## Summary The fork's `main` is upstream `257bcde` plus the three MMW-01 PRs (#106, #107, #108). Upstream has 25 commits since, up to `bcf52af`. Among them: - the PERMANOVA per-term test (JoshuaJewell#35); - the Agda proofs job; - the stable check name; - the config write gates; - clr_welch. This merges them in. It does not rebase, so `main` keeps its history and nothing is force-pushed. It is the base for the upstream PR of the probe (branch `feat/occupancy-probe`), whose files are byte-identical to this branch's. **Conflicts.** There were two. Both were additions on each side, so both sides are kept, upstream first: - **`.gitignore`:** upstream's `proofs/agda/_build/`, then the fork's `/_build/` and `*.agdai` for the fetched proof siblings. - **`config/defaults/pipeline.yml`:** upstream's `differential.replacement_delta`, then the fork's commented-out `occupancy_probe` block at the end of the file. ## Verification The unit suite ran on this tree with Julia 1.12.5, vsearch 2.30.5 and `-t 2`. - **Totals:** 2408 passed, 0 failed, 20 broken (tests the suite marks as known-broken), 1 error. - **The error is environmental.** `live probes of what is actually installed` (test/unit/test_provenance.jl:478) reports `package 'dada2' is not installed in the R library in use`. That sandbox has no dada2; CI restores it from `renv.lock`. - **New upstream tests:** "Config write gate" passes 54/54 and "Pipeline tables cannot be deleted" 24/24. - **Occupancy probe:** 46/46, the test from #106. **Expected CI on this PR:** - **`CI`:** `startup_failure`. This branch still carries upstream's `ci.yml`, whose julia-actions, setup-bun and codecov steps this account's Actions policy refuses. The stacked PR `ci/no-third-party-actions` fixes that and is where `ci.yml` is actually tested, on this merge plus its own commit. - **`Occupancy reading`:** does not run. Its paths are untouched by the merge. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_015pMjy981ie74uCttyYDanC --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Joshua Jewell <developer@joshuajewell.dev> Co-authored-by: x <x@x> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

… fork (#110) Stacked on #109 (the upstream sync); review that first. This PR's own diff is one commit. ## Summary This account's Actions policy allows only GitHub's own actions (`actions/*`) and its own, each pinned to a full commit SHA. `ci.yml` used five actions outside that, so every run on this fork ended in `startup_failure`, since at least 2026-10-02, and the suite never ran here. | Was | Now | |---|---| | `julia-actions/setup-julia` | Julia 1.12.5 from the `tool_versions.yml` archive, fetched with `fetch_pinned` and refused unless it hashes to the pinned SHA256 | | `julia-actions/cache` | `actions/cache/restore` and `actions/cache/save` over the depot's registries, packages, artifacts and compiled caches, keyed on `Manifest.toml`. It is saved only after `Pkg.instantiate()` succeeds. | | `oven-sh/setup-bun` | Bun 1.3.10 from the `tool_versions.yml` archive, checksummed the same way. The step then checks `bun --version` against the pin. | | `julia-actions/julia-processcoverage` | CoverageTools 1.4.2, the exact version, writes `lcov.info` from `src/` | | `codecov/codecov-action` | `actions/upload-artifact` keeps `lcov.info` for 14 days. The Codecov project, its slug and its token are upstream's. | **Other changes:** - `pull_request` runs for any base branch, so a stacked PR like this one is tested. - Both checkouts set `persist-credentials: false`. - `occupancy.yml`'s header no longer says `ci.yml` cannot start. The job names `Julia tests` and `Agda proofs` are unchanged, so the required-check name is stable. **`test/unit/test_install_pins.jl`:** - Julia's URL and checksum are read from the job env and must equal the pin file's `runtimes.julia.archives.linux-x86_64`. Its version must already equal `Manifest.toml`'s. - The Julia and Bun archives must go through `fetch_pinned` and `sha256sum -c`. - New: every `uses:` in `.github/workflows/*.yml` must be an `actions/*` or `hyperpolymath/*` action pinned to 40 hex characters. ## Verification - **`test_install_pins.jl`:** 222/222. - **Negative controls,** each failing it: 1. `setup-julia` restored as a step; 2. one character of `JULIA_SHA256` changed; 3. `actions/checkout` pinned by tag. - **Steps run locally** from this file's own YAML: - **Pin export:** writes `BUN_URL` and `BUN_SHA256`. - **Install Bun:** `bun.zip: OK`, then `bun --version` is 1.3.10. - **Process coverage:** on a covered toy `src/`, it writes `DA:1,1` / `DA:2,0`. - **Install Julia:** identical to `occupancy.yml`'s, which has passed in CI. - **`zizmor` 1.30.1:** no findings on `ci.yml` or `occupancy.yml`. Upstream's `ci.yml` has 2 medium findings ("artipacked": credentials left in the checkout), which `persist-credentials: false` removes. - **The real test is this PR's own `CI` run.** It is the first run of `ci.yml` on this fork, so it starts with an empty depot cache, and the renv restore builds R packages from source. ## Cost This diverges `ci.yml` from upstream's for as long as the account policy stands. A future sync will conflict wherever upstream edits the same lines. The alternative is a settings change: allow those five actions in Settings → Actions → General. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_015pMjy981ie74uCttyYDanC --- _Generated by [Claude Code](https://claude.ai/code/session_015pMjy981ie74uCttyYDanC)_ Co-authored-by: x <x@x> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…tested helper (#112) This is the fork's copy of the commit that answers Codecov's patch report on the upstream PR of the probe (branch `feat/occupancy-probe`, now `4b32184`). Both files end up byte-identical to that branch's, so the fork and upstream stay in step. ## Summary Codecov reported the upstream PR's patch coverage at 94.70%: - **`src/server/routes/pipeline.jl`:** 7 lines missed, 36.36% patch coverage. They are the vsearch searches wrapped in `MemoryProbe.task` in `_run_full_pipeline` and `_run_stage`. No test runs either function, so these lines, like the vsearch calls they replaced, had never been executed. - **`src/core/memory_probe.jl`:** 1 line missed, the `watch!(_)` fallback. **The change:** - **`_vsearch_searches(asv, otu; concurrent)`** holds the stage's two shapes. Concurrently, as the full pipeline runs them, both searches are waited for before a failure is rethrown. One after the other is how a single-stage re-run does it. - **`_vsearch_stage(search, project, asvs, otus, db; concurrent)`** builds the two calls, so each call site is now one line. - **`test/occupancy_disagreement_test.jl`** runs its ASV-then-OTU and concurrent orders through `_vsearch_searches`, so it measures the pipeline's own code rather than a copy. It also gains tests for: - both shapes' return values and task labels; - `_vsearch_stage` with a stub search; - the rethrow-after-both guarantee; - the `watch!` fallback. **One behaviour change.** A single-stage vsearch re-run used to return only the OTU search's result, or `nothing` when there was no OTU search. Its provenance record therefore left out the ASV taxonomy file. It now returns both results, as the full pipeline does. ## Verification - **Occupancy test:** 60/60, up from 46. - **Full unit suite** (Julia 1.12.5, vsearch 2.30.5, `-t 2`): 2422 passed, 0 failed, 20 broken (tests the suite marks as known-broken). The one error is environmental: `dada2` is not installed in that sandbox's R library. - **A first full run caught a bug the test file alone hides.** Other test files bind `SV` in `Main`, so a `const SV` failed to load. I reproduced it, then changed it to a plain binding like theirs. - **Patch coverage,** computed with CoverageTools 1.4.2 as CI processes it, is 156/159 (98.11%): - `memory_probe.jl`: 137/137; - `pipeline.jl`: 16/19. The 3 lines left are the two `_vsearch_stage` calls and the OTU read, inside `_run_full_pipeline` and `_run_stage`, which no test runs. This PR touches `src/server/routes/pipeline.jl` and the test, so the `Occupancy reading` workflow runs here. `CI` will run here only once #110 is in `main`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_015pMjy981ie74uCttyYDanC --- _Generated by [Claude Code](https://claude.ai/code/session_015pMjy981ie74uCttyYDanC)_ Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…e conflicts (#115) Resolves the conflicts that make the fork's `main` unmergeable with upstream — the ones behind the "Sync fork" screen and behind PR #114 showing `dirty`. ## Why they exist Upstream's `main` is 25 commits ahead, and the fork's history carries none of them: #109 synced that content with a **squash**, so upstream's work is in the fork's tree but not in its ancestry. `git merge-base` therefore sat at `257bcde`, and every later merge conflicted on regions where the two sides agree in substance and differ only in wording. ## What this merge does Merges `JoshuaJewell/main` @ `bcf52af` into the fork's `main` (from `a0880df`), resolving 8 conflicted files / 23 hunks. Every hunk was resolved on the fork's side, for a stated reason, and all of upstream's non-conflicting work was absorbed: | file | hunks | resolution | |---|---|---| | `.github/workflows/ci.yml` | 4 | This fork's workflow: Julia and Bun from the archives pinned in `tool_versions.yml`, coverage kept as a workflow artifact, actions pinned to SHAs this account allows. Upstream's side would reinstate `julia-actions/setup-julia` and `codecov/codecov-action`, which this account refuses — the failure that ends a run in `startup_failure` before any job starts. | | `test/unit/test_install_pins.jl` | 2 | Kept `allowed_action` and the `JULIA_URL`/`JULIA_SHA256` env assertions; dropped `ci_step_using`, whose single use asserted a step this fork does not have. | | `src/analysis/differential.jl` | 10 | The fork's docstrings, checked against the merged code (`clr_transform`'s refusal of non-finite values, `_check_compositions`' 1e-8 tolerance and `ErrorException`, `fit_welch`'s failed rows with a note, `volcano_chart`'s `floatmin(Float64)` y-values, `DifferentialConfig`'s strip/lowercase and range checks). | | `src/analysis/analysis.jl` | 3 | The fork's docstrings; the three non-`:computed` statuses, the sample-column exclusion and the length-checked `blocks` all exist in the merged code. | | `src/server/routes/config.jl` | 1 | The fork's docstring, which describes what `_config_value_error` actually checks (enums, `optional_args`, `remote.*`, file-name parts). | | `frontend/src/components/DifferentialPanel.tsx` | 1 | "Welch's t-test on CLR values" — what `clr_welch` does; upstream's line still said "CLR linear model" after the rename. | | `.gitignore` | 1 | `/_build/` and `*.agdai`; upstream's `proofs/agda/_build/` is already present and not duplicated. | | `config/defaults/pipeline.yml` | 1 | The commented `occupancy_probe` block, which upstream has nowhere. | ## Net effect - **Content**: one addition, upstream's `a required check name is a stable identifier` testset (+34 lines). Everything else upstream's 25 commits changed was already in the fork's tree — verified file by file: the other 34 files upstream touched are byte-identical to upstream's copy, or differ only by the fork's own text. - **Ancestry**: upstream's `main` becomes an ancestor, so the next sync merges without these conflicts, and `git merge-base`/the compare API stop reporting the fork 25 commits behind. ## Verification before pushing No Julia in this environment, so verification is what can be shown statically: - `ci.yml` and `pipeline.yml` parse as YAML; no conflict markers remain anywhere (`git grep '^<<<<<<<'`). - Every `uses:` in `.github/workflows/*` matches the fork's allow-list regex; no `CODECOV_TOKEN`, `julia-actions` or `codecov-action` step survives (only the explanatory comments name them). - All 137 mechanical assertions of `test/unit/test_install_pins.jl` emulated in Python against the merged tree: pass — including `JULIA_URL`/`JULIA_SHA256` equalling the pin file, `runs-on: ubuntu-24.04`, no version hard-coded in the workflow, and the new no-matrix/no-interpolation testset. CI on this PR is the real check; `test/unit/test_install_pins.jl` is precisely the guard that the resolved workflow and the pins still agree. Merging this (squash is fine — the content is what matters, the second parent only fixes ancestry) puts the fork's `main` level with upstream. PR #114 can then be rebuilt on top without the `dirty` state. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Joshua Jewell <developer@joshuajewell.dev> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

) (#116) Closes #105. First item of the ordered issue programme (#105 → #1 phase 1 → #21 → …). #105 asks for the amplicon pipeline's stages to be *graded* — alloc/hold/release — and for the predicted peak to be compared with the measured one, with a disagreement meaning a bug in one of them. The probe recorded what a stage reached but nothing read an occupancy out of it, so a `peak_rss_kib` could only be compared against a cost. This reads the occupancy with the algebra the reading is stated in: `ResourceAlgebra.Instances.HWM`, whose reclamation laws `OccupancyTypes.Reclaim` proves (the sibling's PR #9 the issue cites). ## The grade, read from the samples - `watch!`/`unwatch!` now record each task's **sample window** (`first_sample`, `last_sample`) beside its peak; `finish!` attaches the grades read from those windows as the record's `grades` key. - `Grade(peak, drift)` with `drift ≤ peak` (an `ArgumentError` otherwise), `release = peak − drift`; `seq` is the algebra's sequencing `max (peak a) (drift a + peak b)` (`Reclaim.reclaim-law`), `alt` the componentwise join the pair of laws needs; `task_grades`, `stage_grade`, `predicted_peak_rss_kib`, `cost_bound_rss_kib`, `reclaimed_kib`, `graded`. - Tasks are read in **sampled order** (first sample, ties by record order — never the sort's). A task's drift is its peak when the next task started at or before its last sample; the last task keeps its peak only if it was still resident. - A record carrying no windows is left **ungraded** (`nothing`): skipped, never graded on an assumed order, and `disagreement` stays silent — not measured is not a disagreement. ## What it reads out of the recorded run `docs/occupancy/results-2026-10-14.yml`, windows from `docs/occupancy/schedules.yml` (the file the gate and the unit test both read; the raw record of that run predates the window fields, and the Session IR texts in `docs/occupancy/` state the same interleavings): | order | predicted | measured | cost bound | reclaimed | |---|---|---|---|---| | asv_then_otu | 9204 | 9204 | 18384 | 9180 | | otu_then_asv | 9192 | 9192 | 18344 | 9152 | | concurrent | 18380 | 18380 | 18380 | 0 | The prediction is an upper bound (at a handover the task still live holds at most its peak), so `disagreement` reports only what that bound forbids: a measured peak *above* the prediction. `scripts/check-occupancy-grades.jl` re-derives the table from the record and fails on an inequality; the numbers are emulated-checked here because this environment has no Julia. ## The same numbers, as theorems `docs/occupancy/GradedStages.agda` consumes the pinned siblings (occupancy-types `af95728`, resource-algebra `cf9235c` — nothing re-declared; the Timeline names are Reclaim's own instance) and instantiates three of `Reclaim`'s laws at the measured grades: - `no-reclaim` on the concurrent stage — drift = peak, so the peak is the sum (18380); - `reclaimed` on the serial one — drift < peak with a non-empty suffix, so strictly below cost (9204 < 18384); - `occupancy-at-cut` over the stage's timeline, and `protocol-occupancy≤cost` at every cut. `docs/occupancy/reject/ConcurrentDriftIsZero.agda` is the negative control: grading the concurrent stage's drift as 0 — reading the cost as the occupancy — is refused, and `scripts/check-occupancy.sh` now type-checks `GradedStages` beside `TypedPeak` and requires that refusal. ## No ungraded readings `scripts/lint-occupancy-readings.sh` fails if production code outside `src/core/memory_probe.jl` names the `peak_rss_kib` key: from here a stage's occupancy figure has to come from the grading helpers. It passes on this tree. ## Tests and CI - `test/unit/test_occupancy_grade.jl` (new, wired into `test/runtests.jl`): the grade invariant, the `seq`/`alt` laws, the two stage shapes (serial 100/160/60, together 160/160/0), the `graded` record, a measured-above-prediction disagreement, the ungraded no-window record, a `finish!`/`watch!` run on Linux, and the recorded-run replay. - `test/occupancy_disagreement_test.jl`: the two-thread testset now asserts, per order, that every task carries both window keys, that the record is graded, that the prediction reaches the measurement, that it stays at or below the cost bound (`occupancy≤cost`) and that the slack is never negative. The peaks themselves stay recorded, not asserted. - `.github/workflows/occupancy.yml`: two new steps (the graded reading, the lint) in the `disagreement` job, and the new files added to both `paths` filters. - `docs/occupancy-2026-10.adoc`: the window fields, a "Reading the numbers" section, status row MMW-01.5, the new commands. ## Verification limits No Julia and no Agda on this machine, so: the recorded arithmetic and every fixture number were emulated exactly; the Agda follows the import and proof style of `OccupancyTypes.Witness` (checked by the sibling's `scripts/check-agda.sh`, same flags); the workflow YAML and the new scripts were syntax-checked and the lint was run. CI is the verifier here — including whether `OccupancyTypes.Reclaim` type-checks under this repo's flags, which this change is the first to require. ## Not in this change The adoc's `bridge` row — counted bytes bounded by the typed peak in general (occupancy-types' v0 → typed bridge) — stays OPEN: this change gives the graded reading, its instances and its laws, not that proof. --------- Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>

) Two lines of `docs/occupancy/GradedStages.agda` on `main` (from the #116 squash) still carry a draft placeholder: `TH.[_]` where `TH.[]` belongs. Agda refuses it at the parse, before checking anything else: ``` docs/occupancy/GradedStages.agda:77,59-80 Could not parse the application gone 9180 TH.∷ TH.[_] Operators used in the grammar: TH.∷ (infixr operator, level 5) when scope checking gone 9180 TH.∷ TH.[_] ``` So `main`'s **Occupancy typed peak** job is red at `scripts/check-occupancy.sh`, and with it the graded reading the #116 squash landed. This PR is that fix and nothing else: `TH.[_]` → `TH.[]` in both places, 2 lines, no other change (`git diff origin/main..HEAD` = this file only). ## How the error became readable The job's log is served from storage this environment cannot reach, so #116 added `annotate` to `scripts/check-occupancy.sh`: every failure it diagnoses now emits a `::error` line (with the prover's own last lines, escaped as the workflow-command syntax requires), and check annotations — unlike logs — are available through the API. That is how the parse error above was read back from run [38628333902](https://github.com/hyperpolymath/MetaManifold-WebUI/actions/runs/38628333902). It stays silent outside Actions. ## Why the first push looked different The first run on #116 (d49c2e3) failed before the annotations existed, so its cause was never readable; the revision that added them (cf1b726) is what reported this parse error, and it is what the squash carried into `main`. Nothing else in the #116 change is affected: `OccupancyTypes.Reclaim` itself type-checks under this repo's flags — visible in the same job's log, which reaches my file only after checking Prelude, Core, HWM, Order, Reclaim and Timeline. CI on this PR is the check: the typed-peak job must go green, and the disagreement job re-runs the recorded study as usual. --------- Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: CodeRabbit <noreply@coderabbit.ai>

…he reviewer's example (stacked on #117) (#118) Stacked on #117 (base is that branch, so this diff is the delta only, not #117's work). #117 is the right fix; this is what its fix left behind. If you would rather have these three files folded into #117 itself, ask CodeRabbit to apply them there — this session can only push its own branch. ## The audit of CodeRabbit's guidance on #117 (all three findings) | # | Finding (🟠 Major) | Verdict | |---|---|---| | 1 | **Preserve the first child's start boundary** — `isempty(t.live) && (t.first_sample = …)` re-stamped the window on every later child that found `live` empty | **Fixed** by 05e56e7: `t.processes == 1 && (t.first_sample = p.samples + 1)`, set once per task | | 2 | **Do not use zero for a started task's boundary** — two workers registering before any `_sample!` both got `first_sample == 0`, which `_overlaps` reads as never started | **Fixed** by 05e56e7: boundary is `p.samples + 1` (≥ 1), and `_overlaps` now also requires `prev[1] != 0`. The pid push and the boundary are set under the same lock acquisition that precedes the first sample that can see the child, so `first_sample` is exactly the first sample that could count it — no off-by-one remains to chase | | 3 | **Expire earlier drift before grading a later handover** (the A/B/C `201` vs `101` example) | **Fixed** by 05e56e7: per-boundary live sets, per-task drift as the signed delta of the live sum. Verified independently below | **Verification of #3** — the branch head's `_grades_and_labels` emulated against an independent reading of the windows (a task is live at instant `t` when `t ∈ [first, last]`, or `t ≥ first` while `last = 0`): - the reviewer's own case, windows `[1,3] [2,10] [4,5]`, peaks `100, 1, 100`: drifts `[100, −99, −1]`, **predicted 101**, cost 201, reclaimed 100 — the `201` is gone; - exhaustive over n ≤ 3 tasks with peaks 0–3 (**219,660** cases) and 300,000 random records up to six tasks: the fold **equals** the largest simultaneous peak sum for every record the probe can write, and is **never below** it otherwise — so `disagreement` still means "measured above anything the windows allow"; - every task keeps `drift ≤ peak` (no `ArgumentError` path), the folded drift stays ≥ 0, and the recorded run's figures are unchanged: 9204 / 9192 / 18380 KiB, reclaimed 9180 / 9152 / 0 — so `scripts/check-occupancy-grades.jl` and the two-thread test's per-order assertions still hold. ## What is still wrong after that fix (this PR) - **`docs/occupancy-2026-10.adoc` documented the replaced rule**: "a task's drift is its peak when the next task still held it, and 0 when it had exited". It now states the boundary rule — each handover keeps only the tasks still live at it; `drift_kib` is the change in that live sum, negative when the boundary also releases an earlier task; `release_kib` is everything freed between its start and the next boundary and can exceed the task's own peak; the folded drift is the peaks still live at the stage's end. The signed per-task delta is named as the extension `ResourceAlgebra.Instances.HWM`'s header records as **H-2**; the instance's own `drift` is the non-negative live sum. The `first_sample`/`last_sample` bullet is pinned to the probe's own wording. - **The reviewer's example was not a test.** It is now, verbatim: drifts `[100, −99, −1]`, predicted 101, cost 201, reclaimed 100, and — the sharpened bound — 201 KiB resident at once is asserted to be the *disagreement*, where before the fix it was the prediction. - **`src/core/memory_probe.jl`'s own grading comment** said drift was "the net change …" and `release` was "what the frontier reclaims"; both now say precisely what the arithmetic does. Comment-and-docstring changes only in `src/`; no behaviour change. The occupancy workflow re-runs the recorded study on this branch anyway (the path filter matches). --------- Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: CodeRabbit <noreply@coderabbit.ai>

…nning 4, 5) (#119) ## What this changes Both open [code-scanning](https://github.com/hyperpolymath/MetaManifold-WebUI/security/code-scanning) alerts — [4](https://github.com/hyperpolymath/MetaManifold-WebUI/security/code-scanning/4) and [5](https://github.com/hyperpolymath/MetaManifold-WebUI/security/code-scanning/5) — are the same rule, `js/incomplete-multi-character-sanitization` (high, CWE-020/080/116), on the same shape: `text.replace(/<[^>]+>/g, '')` stripping the pseudo-HTML markup Plotly accepts in titles. A single pass is not a sanitizer: in `"<scr<script>ipt>"` the inner tag is removed and the halves join into a fresh `<script>`. The strip now lives in one shared helper, `stripHtmlTags` in `frontend/src/utils/text.ts`, which repeats the replacement until the text stops changing — CodeQL's documented remedy, and a fixpoint by construction. It is used at both flagged sites: - `frontend/src/figure/charts.ts` — the pane title width measurement (alert 5), - `frontend/src/components/AnalysisChart.tsx` — the report figure's default title (alert 4). ## Behaviour on ordinary titles is identical Titles like `CO<sub>2</sub>` or `<b>run</b>` come out exactly as before: the second pass finds nothing and changes nothing. Bare `>` in a title ("p > 0.05") is untouched, as it always was. ## Tests New `frontend/src/utils/text.test.ts` pins the split-tag case (`<scr<script>ipt>...` leaves no complete tag), normal markup, and unchanged plain text. Run them with, from `frontend/`: ``` bun run test bun run typecheck ``` Both pass locally, as does `bun run build` (`tsc && vite build`): 42/42 tests across 7 files. ## What this leaves out No other sanitization sites exist in the frontend (`grep '<\[^>]' frontend/src` finds only these two), no dependency is added (the alternative, `sanitize-html`, is not needed for stripping markup from plain title text), and nothing outside the frontend is touched. The branch is a single commit off the current `main` tip. ## Versions tested bun 1.4.3 (the local mise shim; CI installs the version pinned in `config/defaults/tool_versions.yml`). Julia and R are untouched by this change. Note: this commit is unsigned — the signing key's passphrase was not available in the session that produced it. Amend/rebase to sign if the fork's history requires it. --------- Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

## What this changes Brings the fork back in line with upstream: a true merge of `JoshuaJewell/MetaManifold-WebUI` `main` at `2775faf` into our `main`, continuing the syncs of #109 and #115. Since our last sync, upstream moved three commits past `bcf52af`: - `8dda16d` — harden server origin checks (`JULIA_METAMANIFOLD_ALLOWED_ORIGINS` allowlist), disable Oxygen docs, serve report uploads inert (CSP, nosniff) - `e877e13` — accept the SPA index for `/docs` paths when a frontend build is present - `2775faf` — docs: split deployments and the origins the server must be told about The net tree change against our `main` is 6 files, +226/-13: `src/server/server.jl`, `src/server/routes/report.jl`, `test/unit/test_server_security.jl` (new), `test/runtests.jl`, `README.md`, `frontend/src/components/DifferentialPanel.tsx`. Everything else upstream did since the last shared commit (`257bcde`) was already absorbed here by #115. ## Conflict resolutions (all deliberate fork policy) - `.github/workflows/ci.yml`, `test/unit/test_install_pins.jl` — keep the fork's versions. This account allows only `actions/*` and `hyperpolymath/*` pinned to full SHAs, so Julia and Bun install from the pinned archives and the tests assert that policy. Upstream's `.github/` is unchanged since `bcf52af`. - `src/analysis/analysis.jl`, `src/analysis/differential.jl`, `src/server/routes/config.jl` — keep the fork's docstrings; verified line by line against the merged code (isfinite checks, the 1e-8 composition tolerance, median/max imputed fractions, result sort order, p-underflow handling, the file-name and remote gates). - `frontend/src/components/DifferentialPanel.tsx` — take upstream's wording ("CLR linear model"). - `test/runtests.jl` — take upstream's `test_server_security.jl` entry, keep the fork's occupancy entries. - `.gitignore`, `config/defaults/pipeline.yml` — keep the fork's occupancy blocks; upstream's Agda ignore line was already present. The fork's occupancy work (memory probe, grades, disagreement test) is untouched. ## How to run the tests ``` julia --project=. test/runtests.jl # full unit suite cd frontend && bun run test && bun run typecheck ``` ## Versions tested against Julia 1.13.1 (local; CI installs the pinned 1.12.5), R 4.6.1 (conda-forge; lockfile pins 4.5.0), bun 1.4.3. Full unit suite locally: 2623 passed; the only failures are the "live probes" of pipeline tools this machine does not have installed (cutadapt, vsearch, dada2's R package, etc.), which CI installs by design. Frontend: typecheck clean, 38/38 tests pass. ## Notes - This is a **merge commit**, not a squash: merging it as a merge (not squash) advances the merge base with upstream to `2775faf`, so the next sync is a clean three-way merge from a current base. - The commit is unsigned — the signing key's passphrase was not available in the session that produced it. Amend/rebase to sign if the fork's history requires it. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Joshua Jewell <developer@joshuajewell.dev> Co-authored-by: Mistral Vibe <vibe@mistral.ai> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

…gin tests from the environment (#121) ## What this changes Both of CodeRabbit's functional-correctness findings from #120, accepted and fixed. **1. Wildcard-bind writes (Major).** On a wildcard bind (`start(host="0.0.0.0")`) the origin allow-list excludes the wildcard address and the Host check runs on loopback binds only, so a UI served at e.g. `http://192.168.1.10:8080` received `403` on every write: browsers send `Origin` on same-origin POSTs, and the served address was not in `_allowed_origins()`. The guard now admits, on a wildcard bind only, an origin that names the request's own IP: an `http://` origin whose host is an **IP literal** (IPv4 or bracketed IPv6, never a name), on the bound port, whose host-and-port equals the `Host` header. A browser sends such an `Origin` only for a page it loaded from exactly that address, so the request is same-origin by construction. A DNS-rebinding page arrives with the attacker's domain as both `Host` and `Origin`; a name is not an IP literal, so it is refused exactly as before. Hostnames (e.g. `http://lab-box:8080`) and proxied ports still have to be listed in `JULIA_METAMANIFOLD_ALLOWED_ORIGINS`. **2. Test isolation (Minor).** The baseline origin assertions in `test_server_security.jl` assumed `JULIA_METAMANIFOLD_ALLOWED_ORIGINS` was unset; the suite failed for a developer running it with the variable set (a supported deployment setting). It is now cleared before the testset and restored in the `finally`. ## Tests A new "Wildcard bind" testset covers: the served IP admitted (GET with CORS echo, preflight 204, a POST that reaches the route and fails there with 400, not 403), an IPv6 literal admitted, other addresses/ports/schemes refused, the DNS-rebinding shape (domain matching its own Host) refused, and a listed hostname working only with the variable set. Verified locally, both with `JULIA_METAMANIFOLD_ALLOWED_ORIGINS` unset (86/86 in this file; 2636 passed, 0 failed in the full unit suite) and set to `http://localhost:3000, http://192.168.1.10:8080` (still 86/86; the same run on `main` fails 4 tests). ## How to run the tests ``` julia --project=. test/runtests.jl test_server_security.jl ``` ## Versions tested against Julia 1.13.1 (local; CI installs the pinned 1.12.5), R 4.6.1 (conda-forge; lockfile pins 4.5.0). No frontend change. ## Notes - The commit is unsigned — the signing key's passphrase was not available in the session that produced it. - Rejected the alternative CodeRabbit suggested (admitting a matching request `Host` generally): a rebinding page matches its own Host too, so only the IP-literal form is safe without new configuration. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

…ns (#122) ## What this changes Adds `.github/dependabot.yml` — the repository never had one, which is why Dependabot produced no version updates. (The "Dependabot Updates" workflow runs that did exist were *security* updates, which need no config; they failed 2026-09-26..27 because the `npm_and_yarn` updater refuses a Bun-managed project — `bun.lock` with no npm/yarn/pnpm lockfile — while trying to fix alerts against the since-removed `test/doi` fixtures. Both alerts are already fixed.) ## Configuration | Ecosystem | Directory | Cadence | Notes | |---|---|---|---| | `bun` | `/frontend` | weekly | The ecosystem Dependabot requires for `bun.lock`; `npm_and_yarn` cannot update it | | `github-actions` | `/` | weekly | Advances the full-SHA action pins; the account's allowlist policy (only `actions/*` and `hyperpolymath/*`, asserted by `test/unit/test_install_pins.jl`) survives, since Dependabot updates the existing pinned refs | Both grouped and prefixed `chore(deps)`. ## What Dependabot cannot cover here Julia (`Project.toml`/`Manifest.toml`) and R (`renv.lock`) are not Dependabot ecosystems. Their pins are managed by `config/defaults/tool_versions.yml` and asserted by `test/unit/test_install_pins.jl` and the CI workflow — that stays the mechanism. ## Testing Config-only change; no code path is touched. Dependabot validates the file on merge and the first "Dependabot Updates" run will appear on the default branch within the hour. ## Notes The commit is unsigned — the signing key's passphrase was not available in the session that produced it. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

codecov · 2026-10-15T01:19:27Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

## What this changes The root currently holds 24 entries, several of which are loose scripts and config files. This applies the root-cleanup doctrine of the RSR template (`rsr-template-repo`, `docs/proposals/root-cleanup.adoc`): the root holds authority files, the entry points a newcomer runs, tool-mandated build metadata, and one directory per concern — nothing else. | Move | Why | |---|---| | `CONTRIBUTING.md` → `.github/` | RSR health-files doctrine; GitHub auto-discovers it there | | `codecov.yml` → `.github/codecov.yml` | Codecov's documented alternative location; inert on this fork (coverage is kept as a run artifact, the Codecov project is upstream's) | | `install.jl` → `scripts/` | 49 KB, invoked only by `install.sh` and the pin tests. `install.sh` stays at the root — the RSR rule that the one file a newcomer runs stays at the root | | `precompile_exec.jl` → `scripts/` | Referenced only by `install.jl` | Plus a new testset, **"the root keeps its shape"**: a *bidirectional* allowlist, per the doctrine that a one-directional allowlist only ever ratchets open. A tracked root entry not listed there fails the suite; a listed entry that goes missing fails it too. It reads the tracked tree (`git ls-tree HEAD`), so local untracked build output (`bin/`, `web/`) does not fail a developer's run. **Kept at the root because the tooling requires it** — not clutter: `Project.toml`/`Manifest.toml` (Julia Pkg), `renv.lock`, `renv/`, `.Rprofile`, `R/` (renv scans `R/` for dependency discovery), `CITATION.cff` (GitHub reads it from the default-branch root only — moving it breaks the citation metadata), and the two launchers `install.sh` / `start.sh`. Reference updates: `install.sh`'s handoff (`julia --project=. scripts/install.jl`), the pin tests' `INSTALL_JL`, `install.jl`'s usage lines and `PRECOMPILE_EXEC_PATH`, the sysimage failure hint, the README's mention of the installer path. `PROJECT_ROOT` in `install.jl` now resolves to the repo root from `scripts/`. ## How to run the tests ``` julia --project=. test/runtests.jl test_install_pins.jl ``` ## Versions tested against Julia 1.13.1 (local; CI installs the pinned 1.12.5). Full unit suite locally: 2658 passed, 0 failed (the one error is the live probe for the `vegan` R package, absent from the local conda R; CI installs it). The new root-shape testset: 23/23. Shell syntax of both launchers re-checked (`bash -n`). ## Notes - Divergence cost, stated plainly: upstream's root layout is the same as this one was, so the moved paths will conflict at the next upstream sync (rename/delete pairs on four files). The conflict set is small and mechanical; the absorption register should record the relocations so a future sync resolves them deliberately. - Renames to full RSR names (`test/`→`tests/`, `bench/`→`benches/`, `proofs/`→`verification/`) are deliberately NOT in this PR: cosmetic value, but they would put every test and proof file in permanent rename/delete conflict with upstream. Recommended only if the layout change is proposed upstream as a unit, not as a fork-side divergence. - The commit is unsigned — the signing key's passphrase was not available in the session that produced it. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

Bumps the frontend group in /frontend with 10 updates: | Package | From | To | | --- | --- | --- | | [plotly.js-dist-min](https://github.com/plotly/plotly.js) | `2.35.3` | `4.1.2` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `18.3.1` | `19.3.0` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `18.3.28` | `19.3.0` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `18.3.1` | `19.3.0` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `18.3.7` | `19.3.0` | | [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `6.30.3` | `7.18.4` | | [@types/plotly.js](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/plotly.js) | `2.35.14` | `3.0.15` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `4.7.0` | `6.1.2` | | [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `6.4.1` | `8.3.4` | Updates `plotly.js-dist-min` from 2.35.3 to 4.1.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/plotly/plotly.js/releases">plotly.js-dist-min's releases</a>.</em></p> <blockquote> <h2>v4.1.2</h2> <h3>Changed</h3> <ul> <li>Use <code>ResizeObserver</code> for responsive chart resizing instead of listening for window resize events [<a href="https://redirect.github.com/plotly/plotly.js/pull/8017">#8017</a>], with thanks to <a href="https://github.com/Lexachoc"><code>@Lexachoc</code></a> for the contribution!</li> <li>Describe <code>config.toImageButtonOptions</code> in the plot schema [<a href="https://redirect.github.com/plotly/plotly.js/pull/8066">#8066</a>]</li> </ul> <h3>Fixed</h3> <ul> <li>Fix modebar hover colors not updating after <code>color</code> or <code>activecolor</code> changes [<a href="https://redirect.github.com/plotly/plotly.js/pull/8024">#8024</a>], with thanks to <a href="https://github.com/Lexachoc"><code>@Lexachoc</code></a> for the contribution!</li> <li>Correct the image export types: <code>format</code> now accepts <code>full-json</code>, <code>width</code> and <code>height</code> accept <code>null</code>, and <code>ToImgopts.format</code>, <code>ToImgopts.width</code>, <code>ToImgopts.height</code> and <code>DownloadImgopts.filename</code> are optional because <code>toImage</code> and <code>downloadImage</code> supply them [<a href="https://redirect.github.com/plotly/plotly.js/pull/8066">#8066</a>]</li> <li>Pick the trace drawn last on a hover tie in <code>scattergl</code> and <code>splom</code> (matching <code>scatter</code>) [<a href="https://redirect.github.com/plotly/plotly.js/pull/8079">#8079</a>]</li> <li>Allow typed arrays in the types for <code>arrayOk</code> number and color attributes [<a href="https://redirect.github.com/plotly/plotly.js/pull/8087">#8087</a>]</li> <li>Redraw plots when a font that they use finishes loading [<a href="https://redirect.github.com/plotly/plotly.js/pull/8094">#8094</a>]</li> </ul> <h2>v4.1.1</h2> <h3>Changed</h3> <ul> <li>Update <code>maplibre-gl</code> to v6 to address <a href="https://github.com/advisories/GHSA-jrc7-96c5-q579">CVE-2026-85061</a> [<a href="https://redirect.github.com/plotly/plotly.js/pull/8035">#8035</a>] <ul> <li><code>maplibre-gl</code> v6 dropped WebGL1 support, so some older browsers won't be able to use the map traces. Safari 15, Chrome 56, Firefox 51 and later are now required for the map traces.</li> </ul> </li> </ul> <h3>Fixed</h3> <ul> <li>Box and lasso selection of <code>scattermap</code> points are now supported on a rotated or pitched map [<a href="https://redirect.github.com/plotly/plotly.js/pull/8035">#8035</a>]</li> </ul> <h2>v4.1.0</h2> <h3>Added</h3> <ul> <li>Add an opt-in modebar button for downloading Plotly figures as JSON [<a href="https://redirect.github.com/plotly/plotly.js/pull/7990">#7990</a>, <a href="https://redirect.github.com/plotly/plotly.js/pull/8022">#8022</a>], with thanks to <a href="https://github.com/gokul-debugger"><code>@gokul-debugger</code></a> for the contribution!</li> <li>Add <code>legend.groupdoubleclick</code> to set the group behavior for a legend double-click [<a href="https://redirect.github.com/plotly/plotly.js/pull/7997">#7997</a>], with thanks to <a href="https://github.com/rascal-sl"><code>@rascal-sl</code></a> for the contribution!</li> </ul> <h3>Changed</h3> <ul> <li>Increase default double-click delay threshold to 500ms (from 300) [<a href="https://redirect.github.com/plotly/plotly.js/pull/8014">#8014</a>]</li> </ul> <h3>Fixed</h3> <ul> <li>Correct the <code>showspikes</code> axis attribute description to clarify that it applies for all <code>hovermode</code> values except when <code>hovermode</code> is <em>false</em> [<a href="https://redirect.github.com/plotly/plotly.js/pull/7981">#7981</a>], with thanks for <a href="https://github.com/CAOShurong"><code>@CAOShurong</code></a> for the contribution!</li> <li>Update country-iso-search to v0.1.2 to fix issue with UTF-8 characters being decoded incorrectly [<a href="https://redirect.github.com/plotly/plotly.js/pull/7994">#7994</a>]</li> <li>Compile TypeScript files under <code>src/</code> to JavaScript during packaging to fix Node resolution [<a href="https://redirect.github.com/plotly/plotly.js/pull/8000">#8000</a>]</li> <li>Include type defs in appropriate partial bundles [<a href="https://redirect.github.com/plotly/plotly.js/pull/8001">#8001</a>]</li> <li>Add TypeScript declarations for the modular <code>lib/</code> entry points [<a href="https://redirect.github.com/plotly/plotly.js/pull/8009">#8009</a>]</li> <li>Handle regex enum values when generating schema types [<a href="https://redirect.github.com/plotly/plotly.js/pull/8010">#8010</a>]</li> <li>Include trace-contributed layout attributes in generated types [<a href="https://redirect.github.com/plotly/plotly.js/pull/8020">#8020</a>]</li> <li>Resolve the per-point marker color for hover labels in <code>scattergl</code>, <code>quiver</code> traces [<a href="https://redirect.github.com/plotly/plotly.js/pull/8027">#8027</a>]</li> </ul> <h2>v4.0.0</h2> <h3>Added</h3> <ul> <li>Add <code>minscale</code>, <code>maxscale</code> geo plot attributes [<a href="https://redirect.github.com/plotly/plotly.js/pull/7371">#7371</a>], with thanks to <a href="https://github.com/mojoaxel"><code>@mojoaxel</code></a> for the contribution!</li> <li>Enable TypeScript compatibility within the library and start exporting types [<a href="https://redirect.github.com/plotly/plotly.js/pull/7680">#7680</a>]</li> <li>Add <code>quiver</code> trace type to visualize vector fields using arrows [<a href="https://redirect.github.com/plotly/plotly.js/pull/7710">#7710</a>, <a href="https://redirect.github.com/plotly/plotly.js/issues/7945">#7945</a>], with thanks to <a href="https://github.com/degzhaus"><code>@degzhaus</code></a> for the contribution!</li> <li>Use dashed markers in legend for shape traces with dash configured [<a href="https://redirect.github.com/plotly/plotly.js/pull/7845">#7845</a>]</li> <li>Add <code>direction</code> attribute to the Sankey trace, controlling the flow direction along the <code>orientation</code> axis [<a href="https://redirect.github.com/plotly/plotly.js/pull/7870">#7870</a>], with thanks to <a href="https://github.com/wf-r"><code>@wf-r</code></a> for the contribution! <ul> <li><code>forward</code> keeps sources on the left (horizontal) or top (vertical)</li> <li><code>reversed</code> moves them to the right or bottom</li> </ul> </li> <li>Add <code>sort</code> option to Sankey links and nodes [<a href="https://redirect.github.com/plotly/plotly.js/pull/7873">#7873</a>], with thanks to <a href="https://github.com/adamreeve"><code>@adamreeve</code></a> for the contribution!</li> <li>Add support for MathJax v4 [<a href="https://redirect.github.com/plotly/plotly.js/pull/7898">#7898</a>]</li> <li>Add top-level <code>xPixel</code> and <code>yPixel</code> keys to hover and click event data, corresponding to the pixel position of the cursor relative to the top-left corner of the graph div [<a href="https://redirect.github.com/plotly/plotly.js/pull/7966">#7966</a>]</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/plotly/plotly.js/blob/main/CHANGELOG.md">plotly.js-dist-min's changelog</a>.</em></p> <blockquote> <h2>[4.1.2] -- 2026-10-05</h2> <h3>Changed</h3> <ul> <li>Use <code>ResizeObserver</code> for responsive chart resizing instead of listening for window resize events [<a href="https://redirect.github.com/plotly/plotly.js/pull/8017">#8017</a>], with thanks to <a href="https://github.com/Lexachoc"><code>@Lexachoc</code></a> for the contribution!</li> <li>Describe <code>config.toImageButtonOptions</code> in the plot schema [<a href="https://redirect.github.com/plotly/plotly.js/pull/8066">#8066</a>]</li> </ul> <h3>Fixed</h3> <ul> <li>Fix modebar hover colors not updating after <code>color</code> or <code>activecolor</code> changes [<a href="https://redirect.github.com/plotly/plotly.js/pull/8024">#8024</a>], with thanks to <a href="https://github.com/Lexachoc"><code>@Lexachoc</code></a> for the contribution!</li> <li>Correct the image export types: <code>format</code> now accepts <code>full-json</code>, <code>width</code> and <code>height</code> accept <code>null</code>, and <code>ToImgopts.format</code>, <code>ToImgopts.width</code>, <code>ToImgopts.height</code> and <code>DownloadImgopts.filename</code> are optional because <code>toImage</code> and <code>downloadImage</code> supply them [<a href="https://redirect.github.com/plotly/plotly.js/pull/8066">#8066</a>]</li> <li>Pick the trace drawn last on a hover tie in <code>scattergl</code> and <code>splom</code> (matching <code>scatter</code>) [<a href="https://redirect.github.com/plotly/plotly.js/pull/8079">#8079</a>]</li> <li>Allow typed arrays in the types for <code>arrayOk</code> number and color attributes [<a href="https://redirect.github.com/plotly/plotly.js/pull/8087">#8087</a>]</li> <li>Redraw plots when a font that they use finishes loading [<a href="https://redirect.github.com/plotly/plotly.js/pull/8094">#8094</a>]</li> </ul> <h2>[4.1.1] -- 2026-09-14</h2> <h3>Changed</h3> <ul> <li>Update <code>maplibre-gl</code> to v6 to address <a href="https://github.com/advisories/GHSA-jrc7-96c5-q579">CVE-2026-85061</a> [<a href="https://redirect.github.com/plotly/plotly.js/pull/8035">#8035</a>] <ul> <li><code>maplibre-gl</code> v6 dropped WebGL1 support, so some older browsers won't be able to use the map traces. Safari 15, Chrome 56, Firefox 51 and later are now required for the map traces.</li> </ul> </li> </ul> <h3>Fixed</h3> <ul> <li>Box and lasso selection of <code>scattermap</code> points are now supported on a rotated or pitched map [<a href="https://redirect.github.com/plotly/plotly.js/pull/8035">#8035</a>]</li> </ul> <h2>[4.1.0] -- 2026-09-08</h2> <h3>Added</h3> <ul> <li>Add an opt-in modebar button for downloading Plotly figures as JSON [<a href="https://redirect.github.com/plotly/plotly.js/pull/7990">#7990</a>, <a href="https://redirect.github.com/plotly/plotly.js/pull/8022">#8022</a>], with thanks to <a href="https://github.com/gokul-debugger"><code>@gokul-debugger</code></a> for the contribution!</li> <li>Add <code>legend.groupdoubleclick</code> to set the group behavior for a legend double-click [<a href="https://redirect.github.com/plotly/plotly.js/pull/7997">#7997</a>], with thanks to <a href="https://github.com/rascal-sl"><code>@rascal-sl</code></a> for the contribution!</li> </ul> <h3>Changed</h3> <ul> <li>Increase default double-click delay threshold to 500ms (from 300) [<a href="https://redirect.github.com/plotly/plotly.js/pull/8014">#8014</a>]</li> </ul> <h3>Fixed</h3> <ul> <li>Correct the <code>showspikes</code> axis attribute description to clarify that it applies for all <code>hovermode</code> values except when <code>hovermode</code> is <em>false</em> [<a href="https://redirect.github.com/plotly/plotly.js/pull/7981">#7981</a>], with thanks for <a href="https://github.com/CAOShurong"><code>@CAOShurong</code></a> for the contribution!</li> <li>Update country-iso-search to v0.1.2 to fix issue with UTF-8 characters being decoded incorrectly [<a href="https://redirect.github.com/plotly/plotly.js/pull/7994">#7994</a>]</li> <li>Compile TypeScript files under <code>src/</code> to JavaScript during packaging to fix Node resolution [<a href="https://redirect.github.com/plotly/plotly.js/pull/8000">#8000</a>]</li> <li>Include type defs in appropriate partial bundles [<a href="https://redirect.github.com/plotly/plotly.js/pull/8001">#8001</a>]</li> <li>Add TypeScript declarations for the modular <code>lib/</code> entry points [<a href="https://redirect.github.com/plotly/plotly.js/pull/8009">#8009</a>]</li> <li>Handle regex enum values when generating schema types [<a href="https://redirect.github.com/plotly/plotly.js/pull/8010">#8010</a>]</li> <li>Include trace-contributed layout attributes in generated types [<a href="https://redirect.github.com/plotly/plotly.js/pull/8020">#8020</a>]</li> <li>Resolve the per-point marker color for hover labels in <code>scattergl</code>, <code>quiver</code> traces [<a href="https://redirect.github.com/plotly/plotly.js/pull/8027">#8027</a>]</li> </ul> <h2>[4.0.0] -- 2026-08-24</h2> <h3>Added</h3> <ul> <li>Add <code>minscale</code>, <code>maxscale</code> geo plot attributes [<a href="https://redirect.github.com/plotly/plotly.js/pull/7371">#7371</a>], with thanks to <a href="https://github.com/mojoaxel"><code>@mojoaxel</code></a> for the contribution!</li> <li>Enable TypeScript compatibility within the library and start exporting types [<a href="https://redirect.github.com/plotly/plotly.js/pull/7680">#7680</a>]</li> <li>Add <code>quiver</code> trace type to visualize vector fields using arrows [<a href="https://redirect.github.com/plotly/plotly.js/pull/7710">#7710</a>, <a href="https://redirect.github.com/plotly/plotly.js/issues/7945">#7945</a>], with thanks to <a href="https://github.com/degzhaus"><code>@degzhaus</code></a> for the contribution!</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/plotly/plotly.js/commit/bea2af3a45cc1b8753120b00f7f719f03e6ae528"><code>bea2af3</code></a> 4.1.2</li> <li><a href="https://github.com/plotly/plotly.js/commit/9a72399560bd32f2b797455100920f0664e880e7"><code>9a72399</code></a> chore: Updates for release v4.1.2</li> <li><a href="https://github.com/plotly/plotly.js/commit/dc94a203c0f8d7bded9a217d2602c4b5c3d2b68d"><code>dc94a20</code></a> chore: Update maplibre worker</li> <li><a href="https://github.com/plotly/plotly.js/commit/bf765785c386726ea242f68e3e24510787aeef52"><code>bf76578</code></a> chore: Update dependencies, drop extra-iterable</li> <li><a href="https://github.com/plotly/plotly.js/commit/67cc7fabdb6f974506863f70b08c7a688de3b26d"><code>67cc7fa</code></a> Merge pull request <a href="https://redirect.github.com/plotly/plotly.js/issues/8094">#8094</a> from plotly/cam/8089/replot-after-font-load</li> <li><a href="https://github.com/plotly/plotly.js/commit/c281d991f0e9922fc95363db4c030e8146ae0d0f"><code>c281d99</code></a> Be more general in font check</li> <li><a href="https://github.com/plotly/plotly.js/commit/b2aa6c22c8e08a0f9b62c23171b2bfa4ccf3b40f"><code>b2aa6c2</code></a> Use promises for tracking font loading because of Safari limitations</li> <li><a href="https://github.com/plotly/plotly.js/commit/aa448903b388008251e81181a16d4351d0a148d2"><code>aa44890</code></a> Add draftlog</li> <li><a href="https://github.com/plotly/plotly.js/commit/dd658b17c9375b77e4d77f4391b47366aa624c05"><code>dd658b1</code></a> Update internal GraphDiv type</li> <li><a href="https://github.com/plotly/plotly.js/commit/351fe896a54bdbbb8fa2a08519b257d9ddd7ec5f"><code>351fe89</code></a> Add tests</li> <li>Additional commits viewable in <a href="https://github.com/plotly/plotly.js/compare/v2.35.3...v4.1.2">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~camdecoster">camdecoster</a>, a new releaser for plotly.js-dist-min since your current version.</p> </details> <br /> Updates `react` from 18.3.1 to 19.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/react/react/releases">react's releases</a>.</em></p> <blockquote> <h2>19.3.0 (September 9, 2026)</h2> <p>Below is a list of all new features, APIs, and bug fixes.</p> <p>Read the <a href="https://react.dev/blog/2026/09/09/react-19-3">React 19.3 release post</a> for more information.</p> <h2>New React Features</h2> <ul> <li><code><ViewTransition /></code>: Adds <code><ViewTransition /></code> and <code>addTransitionType</code> APIs to power View Transition animations in React (<a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a>, <a href="https://github.com/jackpope"><code>@jackpope</code></a>, <a href="https://github.com/gaearon"><code>@gaearon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/31975">#31975</a>, <a href="https://redirect.github.com/facebook/react/pull/31987">#31987</a>, <a href="https://redirect.github.com/facebook/react/pull/31996">#31996</a>, <a href="https://redirect.github.com/facebook/react/pull/31999">#31999</a>, <a href="https://redirect.github.com/facebook/react/pull/32001">#32001</a>, <a href="https://redirect.github.com/facebook/react/pull/32002">#32002</a>, <a href="https://redirect.github.com/facebook/react/pull/32028">#32028</a>, <a href="https://redirect.github.com/facebook/react/pull/32029">#32029</a>, <a href="https://redirect.github.com/facebook/react/pull/32031">#32031</a>, <a href="https://redirect.github.com/facebook/react/pull/32034">#32034</a>, <a href="https://redirect.github.com/facebook/react/pull/32038">#32038</a>, <a href="https://redirect.github.com/facebook/react/pull/32041">#32041</a>, <a href="https://redirect.github.com/facebook/react/pull/32050">#32050</a>, <a href="https://redirect.github.com/facebook/react/pull/32090">#32090</a>, <a href="https://redirect.github.com/facebook/react/pull/32105">#32105</a>, <a href="https://redirect.github.com/facebook/react/pull/32254">#32254</a>, <a href="https://redirect.github.com/facebook/react/pull/32379">#32379</a>, <a href="https://redirect.github.com/facebook/react/pull/32422">#32422</a>, <a href="https://redirect.github.com/facebook/react/pull/32462">#32462</a>, <a href="https://redirect.github.com/facebook/react/pull/32540">#32540</a>, <a href="https://redirect.github.com/facebook/react/pull/32545">#32545</a>, <a href="https://redirect.github.com/facebook/react/pull/32585">#32585</a>, <a href="https://redirect.github.com/facebook/react/pull/32599">#32599</a>, <a href="https://redirect.github.com/facebook/react/pull/32611">#32611</a>, <a href="https://redirect.github.com/facebook/react/pull/32612">#32612</a>, <a href="https://redirect.github.com/facebook/react/pull/32617">#32617</a>, <a href="https://redirect.github.com/facebook/react/pull/32651">#32651</a>, <a href="https://redirect.github.com/facebook/react/pull/32653">#32653</a>, <a href="https://redirect.github.com/facebook/react/pull/32656">#32656</a>, <a href="https://redirect.github.com/facebook/react/pull/32664">#32664</a>, <a href="https://redirect.github.com/facebook/react/pull/32699">#32699</a>, <a href="https://redirect.github.com/facebook/react/pull/32723">#32723</a>, <a href="https://redirect.github.com/facebook/react/pull/32734">#32734</a>, <a href="https://redirect.github.com/facebook/react/pull/32751">#32751</a>, <a href="https://redirect.github.com/facebook/react/pull/32752">#32752</a>, <a href="https://redirect.github.com/facebook/react/pull/32760">#32760</a>, <a href="https://redirect.github.com/facebook/react/pull/32761">#32761</a>, <a href="https://redirect.github.com/facebook/react/pull/32764">#32764</a>, <a href="https://redirect.github.com/facebook/react/pull/32772">#32772</a>, <a href="https://redirect.github.com/facebook/react/pull/32790">#32790</a>, <a href="https://redirect.github.com/facebook/react/pull/32819">#32819</a>, <a href="https://redirect.github.com/facebook/react/pull/32820">#32820</a>, <a href="https://redirect.github.com/facebook/react/pull/32822">#32822</a>, <a href="https://redirect.github.com/facebook/react/pull/32833">#32833</a>, <a href="https://redirect.github.com/facebook/react/pull/32849">#32849</a>, <a href="https://redirect.github.com/facebook/react/pull/33094">#33094</a>, <a href="https://redirect.github.com/facebook/react/pull/33191">#33191</a>, <a href="https://redirect.github.com/facebook/react/pull/33200">#33200</a>, <a href="https://redirect.github.com/facebook/react/pull/33206">#33206</a>, <a href="https://redirect.github.com/facebook/react/pull/33293">#33293</a>, <a href="https://redirect.github.com/facebook/react/pull/33330">#33330</a>, <a href="https://redirect.github.com/facebook/react/pull/33331">#33331</a>, <a href="https://redirect.github.com/facebook/react/pull/33332">#33332</a>, <a href="https://redirect.github.com/facebook/react/pull/33357">#33357</a>, <a href="https://redirect.github.com/facebook/react/pull/33362">#33362</a>, <a href="https://redirect.github.com/facebook/react/pull/33433">#33433</a>, <a href="https://redirect.github.com/facebook/react/pull/33576">#33576</a>, <a href="https://redirect.github.com/facebook/react/pull/34374">#34374</a>, <a href="https://redirect.github.com/facebook/react/pull/34450">#34450</a>, <a href="https://redirect.github.com/facebook/react/pull/34481">#34481</a>, <a href="https://redirect.github.com/facebook/react/pull/34500">#34500</a>, <a href="https://redirect.github.com/facebook/react/pull/34502">#34502</a>, <a href="https://redirect.github.com/facebook/react/pull/34510">#34510</a>, <a href="https://redirect.github.com/facebook/react/pull/34511">#34511</a>, <a href="https://redirect.github.com/facebook/react/pull/34539">#34539</a>, <a href="https://redirect.github.com/facebook/react/pull/35567">#35567</a>, <a href="https://redirect.github.com/facebook/react/pull/35564">#35564</a>, <a href="https://redirect.github.com/facebook/react/pull/35485">#35485</a>, <a href="https://redirect.github.com/facebook/react/pull/35380">#35380</a>, <a href="https://redirect.github.com/facebook/react/pull/35063">#35063</a>, <a href="https://redirect.github.com/facebook/react/pull/35060">#35060</a>, <a href="https://redirect.github.com/facebook/react/pull/34676">#34676</a>, <a href="https://redirect.github.com/facebook/react/pull/36917">#36917</a>, <a href="https://redirect.github.com/facebook/react/pull/35337">#35337</a>, <a href="https://redirect.github.com/facebook/react/pull/35520">#35520</a>)</li> <li>Fragment Refs: Add Refs to <code><Fragment /></code> to support composable platform behavior (<a href="https://github.com/jackpope"><code>@jackpope</code></a>, <a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>, <a href="https://github.com/Dhakshin2007"><code>@Dhakshin2007</code></a>, <a href="https://github.com/chirokas"><code>@chirokas</code></a>, <a href="https://github.com/teamleaderleo"><code>@teamleaderleo</code></a>, <a href="https://github.com/fallintoplace"><code>@fallintoplace</code></a>: <a href="https://redirect.github.com/facebook/react/pull/32465">#32465</a>, <a href="https://redirect.github.com/facebook/react/pull/32613">#32613</a>, <a href="https://redirect.github.com/facebook/react/pull/32619">#32619</a>, <a href="https://redirect.github.com/facebook/react/pull/32654">#32654</a>, <a href="https://redirect.github.com/facebook/react/pull/32660">#32660</a>, <a href="https://redirect.github.com/facebook/react/pull/32682">#32682</a>, <a href="https://redirect.github.com/facebook/react/pull/32722">#32722</a>, <a href="https://redirect.github.com/facebook/react/pull/32813">#32813</a>, <a href="https://redirect.github.com/facebook/react/pull/32814">#32814</a>, <a href="https://redirect.github.com/facebook/react/pull/33056">#33056</a>, <a href="https://redirect.github.com/facebook/react/pull/33058">#33058</a>, <a href="https://redirect.github.com/facebook/react/pull/33093">#33093</a>, <a href="https://redirect.github.com/facebook/react/pull/34069">#34069</a>, <a href="https://redirect.github.com/facebook/react/pull/34103">#34103</a>, <a href="https://redirect.github.com/facebook/react/pull/34544">#34544</a>, <a href="https://redirect.github.com/facebook/react/pull/34545">#34545</a>, <a href="https://redirect.github.com/facebook/react/pull/37062">#37062</a>, <a href="https://redirect.github.com/facebook/react/pull/37061">#37061</a>, <a href="https://redirect.github.com/facebook/react/pull/37060">#37060</a>, <a href="https://redirect.github.com/facebook/react/pull/36047">#36047</a>, <a href="https://redirect.github.com/facebook/react/pull/36010">#36010</a>, <a href="https://redirect.github.com/facebook/react/pull/35642">#35642</a>, <a href="https://redirect.github.com/facebook/react/pull/35641">#35641</a>, <a href="https://redirect.github.com/facebook/react/pull/35637">#35637</a>, <a href="https://redirect.github.com/facebook/react/pull/35630">#35630</a>, <a href="https://redirect.github.com/facebook/react/pull/34935">#34935</a>, <a href="https://redirect.github.com/facebook/react/pull/37457">#37457</a>, <a href="https://redirect.github.com/facebook/react/pull/37408">#37408</a>, <a href="https://redirect.github.com/facebook/react/pull/37326">#37326</a>, <a href="https://redirect.github.com/facebook/react/pull/37251">#37251</a>, <a href="https://redirect.github.com/facebook/react/pull/37171">#37171</a>, <a href="https://redirect.github.com/facebook/react/pull/37169">#37169</a>, <a href="https://redirect.github.com/facebook/react/pull/37168">#37168</a>, <a href="https://redirect.github.com/facebook/react/pull/37167">#37167</a>, <a href="https://redirect.github.com/facebook/react/pull/37166">#37166</a>, <a href="https://redirect.github.com/facebook/react/pull/37165">#37165</a>, <a href="https://redirect.github.com/facebook/react/pull/37164">#37164</a>, <a href="https://redirect.github.com/facebook/react/pull/37163">#37163</a>, <a href="https://redirect.github.com/facebook/react/pull/37162">#37162</a>, <a href="https://redirect.github.com/facebook/react/pull/37161">#37161</a>, <a href="https://redirect.github.com/facebook/react/pull/37160">#37160</a>, <a href="https://redirect.github.com/facebook/react/pull/37125">#37125</a>, <a href="https://redirect.github.com/facebook/react/pull/37063">#37063</a>)</li> </ul> <h2>New React DOM Features</h2> <ul> <li><code>browser()</code>: a new <code>react-dom</code> API that returns a usable which errors during server rendering and resolves in the browser. <code>use(browser())</code> inside a <code><Suspense></code> boundary marks a subtree as browser-only without reporting a recoverable error (<a href="https://github.com/gnoff"><code>@gnoff</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37143">#37143</a>, <a href="https://redirect.github.com/facebook/react/pull/37241">#37241</a>) <ul> <li>Added an <code>onBrowserBailout</code> option to the <code>react-dom/server</code> APIs to observe when a subtree defers to the browser (<a href="https://github.com/gnoff"><code>@gnoff</code></a> <a href="https://redirect.github.com/facebook/react/pull/37193">#37193</a>)</li> </ul> </li> </ul> <h2>Notable changes</h2> <ul> <li>Enable Trusted Types API integration (<a href="https://github.com/rickhanlonii"><code>@rickhanlonii</code></a> <a href="https://redirect.github.com/facebook/react/pull/35816">#35816</a>)</li> <li>Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/37290">#37290</a>)</li> <li>Added a DEV-only warning when a component appears to have been unblocked by calling <code>use()</code> conditionally (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37104">#37104</a>, <a href="https://redirect.github.com/facebook/react/pull/37203">#37203</a>, <a href="https://redirect.github.com/facebook/react/pull/37491">#37491</a>)</li> </ul> <h2>All Changes</h2> <h3>React</h3> <ul> <li>Fast Refresh Fixes <ul> <li>Fix Fast Refresh to find and remount edits to components wrapped behind <code>lazy()</code> (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36965">#36965</a>)</li> <li>Fix Fast Refresh so edits to a <code>memo()</code> comparison function take effect (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36964">#36964</a>)</li> <li>Fix Fast Refresh crash when an edit changes the kind of a component's type (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36963">#36963</a>)</li> <li>Unify hot reload type resolution for Fast Refresh (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36962">#36962</a>)</li> <li>Fix Fast Refresh to remount correctly when an edit changes the component kind (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36950">#36950</a>)</li> <li>Double invoke effects in StrictMode after Fast Refresh (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35962">#35962</a>)</li> </ul> </li> <li>Performance Track Fixes <ul> <li>Prevent crash when accessing <code>$$typeof</code> in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35679">#35679</a>)</li> <li>Handle non-string function names in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35659">#35659</a>)</li> <li>Use minus (<code>-</code>) instead of en dash for removed props in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35649">#35649</a>)</li> <li>Handle arrays with bigints in deep objects in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35648">#35648</a>)</li> <li>Don't enumerate typed array props in Performance Tracks in DEV (<a href="https://github.com/UditDewan"><code>@UditDewan</code></a> <a href="https://redirect.github.com/facebook/react/pull/36913">#36913</a>)</li> <li>Bail out of diffing wide objects and arrays in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/34742">#34742</a>)</li> <li>Clear potentially large performance measures in DEV (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a> <a href="https://redirect.github.com/facebook/react/pull/34803">#34803</a>)</li> <li>Fix missing else branch for renders with no props change in Performance Tracks (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a> <a href="https://redirect.github.com/facebook/react/pull/34837">#34837</a>)</li> </ul> </li> <li>Activity Fixes <ul> <li>Fix <code>useSyncExternalStore</code> missing store mutations that happened while an Activity tree was hidden (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36947">#36947</a>)</li> <li>Hide portal contents when an Activity is hidden (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/35091">#35091</a>)</li> <li>Prevent metadata hoisting in hidden <code><Activity></code> trees (<a href="https://github.com/ronnakamoto"><code>@ronnakamoto</code></a> <a href="https://redirect.github.com/facebook/react/pull/34983">#34983</a>)</li> <li>Prevent errors thrown inside a hidden Activity from escaping to the visible UI (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/35074">#35074</a>)</li> <li>Don't unhide a node if a direct parent Offscreen is still hidden (<a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a> <a href="https://redirect.github.com/facebook/react/pull/34821">#34821</a>)</li> <li>Don't show internal <code><Offscreen></code> component in error messages (<a href="https://github.com/rickhanlonii"><code>@rickhanlonii</code></a> <a href="https://redirect.github.com/facebook/react/pull/35763">#35763</a>)</li> </ul> </li> <li>Warn in DEV when a component appears to have been unblocked by a conditional <code>use()</code> (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37104">#37104</a>, <a href="https://redirect.github.com/facebook/react/pull/37203">#37203</a>, <a href="https://redirect.github.com/facebook/react/pull/37491">#37491</a>)</li> <li>Render transitions independently instead of entangling them into a single render (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/37290">#37290</a>)</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/react/react/blob/main/CHANGELOG.md">react's changelog</a>.</em></p> <blockquote> <h2>19.3.0 (September 9, 2026)</h2> <h3>New React Features</h3> <ul> <li><code><ViewTransition /></code>: Adds <code><ViewTransition /></code> and <code>addTransitionType</code> APIs to power View Transition animations in React (<a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a>, <a href="https://github.com/jackpope"><code>@jackpope</code></a>, <a href="https://github.com/gaearon"><code>@gaearon</code></a>: <a href="https://redirect.github.com/react/react/pull/31975">#31975</a>, <a href="https://redirect.github.com/react/react/pull/31987">#31987</a>, <a href="https://redirect.github.com/react/react/pull/31996">#31996</a>, <a href="https://redirect.github.com/react/react/pull/31999">#31999</a>, <a href="https://redirect.github.com/react/react/pull/32001">#32001</a>, <a href="https://redirect.github.com/react/react/pull/32002">#32002</a>, <a href="https://redirect.github.com/react/react/pull/32028">#32028</a>, <a href="https://redirect.github.com/react/react/pull/32029">#32029</a>, <a href="https://redirect.github.com/react/react/pull/32031">#32031</a>, <a href="https://redirect.github.com/react/react/pull/32034">#32034</a>, <a href="https://redirect.github.com/react/react/pull/32038">#32038</a>, <a href="https://redirect.github.com/react/react/pull/32041">#32041</a>, <a href="https://redirect.github.com/react/react/pull/32050">#32050</a>, <a href="https://redirect.github.com/react/react/pull/32090">#32090</a>, <a href="https://redirect.github.com/react/react/pull/32105">#32105</a>, <a href="https://redirect.github.com/react/react/pull/32254">#32254</a>, <a href="https://redirect.github.com/react/react/pull/32379">#32379</a>, <a href="https://redirect.github.com/react/react/pull/32422">#32422</a>, <a href="https://redirect.github.com/react/react/pull/32462">#32462</a>, <a href="https://redirect.github.com/react/react/pull/32540">#32540</a>, <a href="https://redirect.github.com/react/react/pull/32545">#32545</a>, <a href="https://redirect.github.com/react/react/pull/32585">#32585</a>, <a href="https://redirect.github.com/react/react/pull/32599">#32599</a>, <a href="https://redirect.github.com/react/react/pull/32611">#32611</a>, <a href="https://redirect.github.com/react/react/pull/32612">#32612</a>, <a href="https://redirect.github.com/react/react/pull/32617">#32617</a>, <a href="https://redirect.github.com/react/react/pull/32651">#32651</a>, <a href="https://redirect.github.com/react/react/pull/32653">#32653</a>, <a href="https://redirect.github.com/react/react/pull/32656">#32656</a>, <a href="https://redirect.github.com/react/react/pull/32664">#32664</a>, <a href="https://redirect.github.com/react/react/pull/32699">#32699</a>, <a href="https://redirect.github.com/react/react/pull/32723">#32723</a>, <a href="https://redirect.github.com/react/react/pull/32734">#32734</a>, <a href="https://redirect.github.com/react/react/pull/32751">#32751</a>, <a href="https://redirect.github.com/react/react/pull/32752">#32752</a>, <a href="https://redirect.github.com/react/react/pull/32760">#32760</a>, <a href="https://redirect.github.com/react/react/pull/32761">#32761</a>, <a href="https://redirect.github.com/react/react/pull/32764">#32764</a>, <a href="https://redirect.github.com/react/react/pull/32772">#32772</a>, <a href="https://redirect.github.com/react/react/pull/32790">#32790</a>, <a href="https://redirect.github.com/react/react/pull/32819">#32819</a>, <a href="https://redirect.github.com/react/react/pull/32820">#32820</a>, <a href="https://redirect.github.com/react/react/pull/32822">#32822</a>, <a href="https://redirect.github.com/react/react/pull/32833">#32833</a>, <a href="https://redirect.github.com/react/react/pull/32849">#32849</a>, <a href="https://redirect.github.com/react/react/pull/33094">#33094</a>, <a href="https://redirect.github.com/react/react/pull/33191">#33191</a>, <a href="https://redirect.github.com/react/react/pull/33200">#33200</a>, <a href="https://redirect.github.com/react/react/pull/33206">#33206</a>, <a href="https://redirect.github.com/react/react/pull/33293">#33293</a>, <a href="https://redirect.github.com/react/react/pull/33330">#33330</a>, <a href="https://redirect.github.com/react/react/pull/33331">#33331</a>, <a href="https://redirect.github.com/react/react/pull/33332">#33332</a>, <a href="https://redirect.github.com/react/react/pull/33357">#33357</a>, <a href="https://redirect.github.com/react/react/pull/33362">#33362</a>, <a href="https://redirect.github.com/react/react/pull/33433">#33433</a>, <a href="https://redirect.github.com/react/react/pull/33576">#33576</a>, <a href="https://redirect.github.com/react/react/pull/34374">#34374</a>, <a href="https://redirect.github.com/react/react/pull/34450">#34450</a>, <a href="https://redirect.github.com/react/react/pull/34481">#34481</a>, <a href="https://redirect.github.com/react/react/pull/34500">#34500</a>, <a href="https://redirect.github.com/react/react/pull/34502">#34502</a>, <a href="https://redirect.github.com/react/react/pull/34510">#34510</a>, <a href="https://redirect.github.com/react/react/pull/34511">#34511</a>, <a href="https://redirect.github.com/react/react/pull/34539">#34539</a>, <a href="https://redirect.github.com/react/react/pull/35567">#35567</a>, <a href="https://redirect.github.com/react/react/pull/35564">#35564</a>, <a href="https://redirect.github.com/react/react/pull/35485">#35485</a>, <a href="https://redirect.github.com/react/react/pull/35380">#35380</a>, <a href="https://redirect.github.com/react/react/pull/35063">#35063</a>, <a href="https://redirect.github.com/react/react/pull/35060">#35060</a>, <a href="https://redirect.github.com/react/react/pull/34676">#34676</a>, <a href="https://redirect.github.com/react/react/pull/36917">#36917</a>, <a href="https://redirect.github.com/react/react/pull/35337">#35337</a>, <a href="https://redirect.github.com/react/react/pull/35520">#35520</a>)</li> <li>Fragment Refs: Add Refs to <code><Fragment /></code> to support composable platform behavior (<a href="https://github.com/jackpope"><code>@jackpope</code></a>, <a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>, <a href="https://github.com/Dhakshin2007"><code>@Dhakshin2007</code></a>, <a href="https://github.com/chirokas"><code>@chirokas</code></a>, <a href="https://github.com/teamleaderleo"><code>@teamleaderleo</code></a>, <a href="https://github.com/fallintoplace"><code>@fallintoplace</code></a>: <a href="https://redirect.github.com/react/react/pull/32465">#32465</a>, <a href="https://redirect.github.com/react/react/pull/32613">#32613</a>, <a href="https://redirect.github.com/react/react/pull/32619">#32619</a>, <a href="https://redirect.github.com/react/react/pull/32654">#32654</a>, <a href="https://redirect.github.com/react/react/pull/32660">#32660</a>, <a href="https://redirect.github.com/react/react/pull/32682">#32682</a>, <a href="https://redirect.github.com/react/react/pull/32722">#32722</a>, <a href="https://redirect.github.com/react/react/pull/32813">#32813</a>, <a href="https://redirect.github.com/react/react/pull/32814">#32814</a>, <a href="https://redirect.github.com/react/react/pull/33056">#33056</a>, <a href="https://redirect.github.com/react/react/pull/33058">#33058</a>, <a href="https://redirect.github.com/react/react/pull/33093">#33093</a>, <a href="https://redirect.github.com/react/react/pull/34069">#34069</a>, <a href="https://redirect.github.com/react/react/pull/34103">#34103</a>, <a href="https://redirect.github.com/react/react/pull/34544">#34544</a>, <a href="https://redirect.github.com/react/react/pull/34545">#34545</a>, <a href="https://redirect.github.com/react/react/pull/37062">#37062</a>, <a href="https://redirect.github.com/react/react/pull/37061">#37061</a>, <a href="https://redirect.github.com/react/react/pull/37060">#37060</a>, <a href="https://redirect.github.com/react/react/pull/36047">#36047</a>, <a href="https://redirect.github.com/react/react/pull/36010">#36010</a>, <a href="https://redirect.github.com/react/react/pull/35642">#35642</a>, <a href="https://redirect.github.com/react/react/pull/35641">#35641</a>, <a href="https://redirect.github.com/react/react/pull/35637">#35637</a>, <a href="https://redirect.github.com/react/react/pull/35630">#35630</a>, <a href="https://redirect.github.com/react/react/pull/34935">#34935</a>, <a href="https://redirect.github.com/react/react/pull/37457">#37457</a>, <a href="https://redirect.github.com/react/react/pull/37408">#37408</a>, <a href="https://redirect.github.com/react/react/pull/37326">#37326</a>, <a href="https://redirect.github.com/react/react/pull/37251">#37251</a>, <a href="https://redirect.github.com/react/react/pull/37171">#37171</a>, <a href="https://redirect.github.com/react/react/pull/37169">#37169</a>, <a href="https://redirect.github.com/react/react/pull/37168">#37168</a>, <a href="https://redirect.github.com/react/react/pull/37167">#37167</a>, <a href="https://redirect.github.com/react/react/pull/37166">#37166</a>, <a href="https://redirect.github.com/react/react/pull/37165">#37165</a>, <a href="https://redirect.github.com/react/react/pull/37164">#37164</a>, <a href="https://redirect.github.com/react/react/pull/37163">#37163</a>, <a href="https://redirect.github.com/react/react/pull/37162">#37162</a>, <a href="https://redirect.github.com/react/react/pull/37161">#37161</a>, <a href="https://redirect.github.com/react/react/pull/37160">#37160</a>, <a href="https://redirect.github.com/react/react/pull/37125">#37125</a>, <a href="https://redirect.github.com/react/react/pull/37063">#37063</a>)</li> </ul> <h3>New React DOM Features</h3> <ul> <li><code>browser()</code>: a new <code>react-dom</code> API that returns a usable which errors during server rendering and resolves in the browser. <code>use(browser())</code> inside a <code><Suspense></code> boundary marks a subtree as browser-only without reporting a recoverable error (<a href="https://github.com/gnoff"><code>@gnoff</code></a>: <a href="https://redirect.github.com/react/react/pull/37143">#37143</a>, <a href="https://redirect.github.com/react/react/pull/37241">#37241</a>) <ul> <li>Added an <code>onBrowserBailout</code> option to the <code>react-dom/server</code> APIs to observe when a subtree defers to the browser (<a href="https://github.com/gnoff"><code>@gnoff</code></a> <a href="https://redirect.github.com/react/react/pull/37193">#37193</a>)</li> </ul> </li> </ul> <h3>Notable changes</h3> <ul> <li>Enable Trusted Types API integration (<a href="https://github.com/rickhanlonii"><code>@rickhanlonii</code></a> <a href="https://redirect.github.com/react/react/pull/35816">#35816</a>)</li> <li>Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/react/react/pull/37290">#37290</a>)</li> <li>Added a DEV-only warning when a component appears to have been unblocked by calling <code>use()</code> conditionally (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>: <a href="https://redirect.github.com/react/react/pull/37104">#37104</a>, <a href="https://redirect.github.com/react/react/pull/37203">#37203</a>, <a href="https://redirect.github.com/react/react/pull/37491">#37491</a>)</li> </ul> <h3>All Changes</h3> <h4>React</h4> <ul> <li>Fast Refresh Fixes <ul> <li>Fix Fast Refresh to find and remount edits to components wrapped behind <code>lazy()</code> (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/react/react/pull/36965">#36965</a>)</li> <li>Fix Fast Refresh so edits to a <code>memo()</code> comparison function take effect (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/react/react/pull/36964">#36964</a>)</li> <li>Fix Fast Refresh crash when an edit changes the kind of a component's type (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/react/react/pull/36963">#36963</a>)</li> <li>Unify hot reload type resolution for Fast Refresh (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/react/react/pull/36962">#36962</a>)</li> <li>Fix Fast Refresh to remount correctly when an edit changes the component kind (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/react/react/pull/36950">#36950</a>)</li> <li>Double invoke effects in StrictMode after Fast Refresh (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/react/react/pull/35962">#35962</a>)</li> </ul> </li> <li>Performance Track Fixes <ul> <li>Prevent crash when accessing <code>$$typeof</code> in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/react/react/pull/35679">#35679</a>)</li> <li>Handle non-string function names in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/react/react/pull/35659">#35659</a>)</li> <li>Use minus (<code>-</code>) instead of en dash for removed props in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/react/react/pull/35649">#35649</a>)</li> <li>Handle arrays with bigints in deep objects in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/react/react/pull/35648">#35648</a>)</li> <li>Don't enumerate typed array props in Performance Tracks in DEV (<a href="https://github.com/UditDewan"><code>@UditDewan</code></a> <a href="https://redirect.github.com/react/react/pull/36913">#36913</a>)</li> <li>Bail out of diffing wide objects and arrays in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/react/react/pull/34742">#34742</a>)</li> <li>Clear potentially large performance measures in DEV (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a> <a href="https://redirect.github.com/react/react/pull/34803">#34803</a>)</li> <li>Fix missing else branch for renders with no props change in Performance Tracks (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a> <a href="https://redirect.github.com/react/react/pull/34837">#34837</a>)</li> </ul> </li> <li>Activity Fixes <ul> <li>Fix <code>useSyncExternalStore</code> missing store mutations that happened while an Activity tree was hidden (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/react/react/pull/36947">#36947</a>)</li> <li>Hide portal contents when an Activity is hidden (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/react/react/pull/35091">#35091</a>)</li> <li>Prevent metadata hoisting in hidden <code><Activity></code> trees (<a href="https://github.com/ronnakamoto"><code>@ronnakamoto</code></a> <a href="https://redirect.github.com/react/react/pull/34983">#34983</a>)</li> <li>Prevent errors thrown inside a hidden Activity from escaping to the visible UI (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/react/react/pull/35074">#35074</a>)</li> <li>Don't unhide a node if a direct parent Offscreen is still hidden (<a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a> <a href="https://redirect.github.com/react/react/pull/34821">#34821</a>)</li> <li>Don't show internal <code><Offscreen></code> component in error messages (<a href="https://github.com/rickhanlonii"><code>@rickhanlonii</code></a> <a href="https://redirect.github.com/react/react/pull/35763">#35763</a>)</li> </ul> </li> <li>Warn in DEV when a component appears to have been unblocked by a conditional <code>use()</code> (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>: <a href="https://redirect.github.com/react/react/pull/37104">#37104</a>, <a href="https://redirect.github.com/react/react/pull/37203">#37203</a>, <a href="https://redirect.github.com/react/react/pull/37491">#37491</a>)</li> <li>Render transitions independently instead of entangling them into a single render (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/react/react/pull/37290">#37290</a>)</li> <li>Fix hang when updating a dehydrated boundary inside a hidden tree (<a href="https://github.com/gaearon"><code>@gaearon</code></a> <a href="https://redirect.github.com/react/react/pull/37135">#37135</a>)</li> <li>Don't reacquire Host Singletons during dev effect validation (<a href="https://github.com/gnoff"><code>@gnoff</code></a> <a href="https://redirect.github.com/react/react/pull/37113">#37113</a>)</li> <li>Only remove properties from Host Singletons on release (<a href="https://github.com/gnoff"><code>@gnoff</code></a> <a href="https://redirect.github.com/react/react/pull/37112">#37112</a>)</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/react/react/commit/2dc7da790d6388b95b83198ca9b588b2ad5f5c0b"><code>2dc7da7</code></a> [test] Bump Jest to 30.4 (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/37382">#37382</a>)</li> <li><a href="https://github.com/react/react/commit/4f9389423b7319e1f7acc3d158c84a8365462748"><code>4f93894</code></a> docs: remove stale parentType param from validateChildKeys JSDoc (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36928">#36928</a>)</li> <li><a href="https://github.com/react/react/commit/dbc37501ffeaf8fec45af5898caf1c3d64ad10bf"><code>dbc3750</code></a> Update required references to GitHub repo (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36752">#36752</a>)</li> <li><a href="https://github.com/react/react/commit/900ae094d85b11c67d53dd14af50a2bda5db4495"><code>900ae09</code></a> [flow] Bump flow to v0.317.0 (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36701">#36701</a>)</li> <li><a href="https://github.com/react/react/commit/fbb137059e4aacfaab1d36516e9b55050b4a0454"><code>fbb1370</code></a> [flow] Bump flow to v0.307.1 (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36199">#36199</a>)</li> <li><a href="https://github.com/react/react/commit/56922cf751fab6c7ab4c12ddbbd15839959fa255"><code>56922cf</code></a> [react-native-renderer] Delete Paper (legacy) renderer (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36285">#36285</a>)</li> <li><a href="https://github.com/react/react/commit/74568e8627aa43469b74f2972f427a209639d0b6"><code>74568e8</code></a> [Flight] Transport <code>AggregateErrors.errors</code> (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36156">#36156</a>)</li> <li><a href="https://github.com/react/react/commit/e66ef6480ecd19c6885f2c06dec34fec1fdc0a98"><code>e66ef64</code></a> [tests] remove withoutStack from assertConsole helpers (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/35498">#35498</a>)</li> <li><a href="https://github.com/react/react/commit/db71391c5c70dc113560d1c23d0b6548604d827f"><code>db71391</code></a> [Fiber] Instrument the lazy initializer thenable in all cases (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/35521">#35521</a>)</li> <li><a href="https://github.com/react/react/commit/3e1abcc8d7083a13adf4774feb0d67ecbe4a2bc4"><code>3e1abcc</code></a> [tests] Require exact error messages in assertConsole helpers (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/35497">#35497</a>)</li> <li>Additional commits viewable in <a href="https://github.com/react/react/commits/v19.3.0/packages/react">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for react since your current version.</p> </details> <br /> Updates `@types/react` from 18.3.28 to 19.3.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react">compare view</a></li> </ul> </details> <br /> Updates `react-dom` from 18.3.1 to 19.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/react/react/releases">react-dom's releases</a>.</em></p> <blockquote> <h2>19.3.0 (September 9, 2026)</h2> <p>Below is a list of all new features, APIs, and bug fixes.</p> <p>Read the <a href="https://react.dev/blog/2026/09/09/react-19-3">React 19.3 release post</a> for more information.</p> <h2>New React Features</h2> <ul> <li><code><ViewTransition /></code>: Adds <code><ViewTransition /></code> and <code>addTransitionType</code> APIs to power View Transition animations in React (<a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a>, <a href="https://github.com/jackpope"><code>@jackpope</code></a>, <a href="https://github.com/gaearon"><code>@gaearon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/31975">#31975</a>, <a href="https://redirect.github.com/facebook/react/pull/31987">#31987</a>, <a href="https://redirect.github.com/facebook/react/pull/31996">#31996</a>, <a href="https://redirect.github.com/facebook/react/pull/31999">#31999</a>, <a href="https://redirect.github.com/facebook/react/pull/32001">#32001</a>, <a href="https://redirect.github.com/facebook/react/pull/32002">#32002</a>, <a href="https://redirect.github.com/facebook/react/pull/32028">#32028</a>, <a href="https://redirect.github.com/facebook/react/pull/32029">#32029</a>, <a href="https://redirect.github.com/facebook/react/pull/32031">#32031</a>, <a href="https://redirect.github.com/facebook/react/pull/32034">#32034</a>, <a href="https://redirect.github.com/facebook/react/pull/32038">#32038</a>, <a href="https://redirect.github.com/facebook/react/pull/32041">#32041</a>, <a href="https://redirect.github.com/facebook/react/pull/32050">#32050</a>, <a href="https://redirect.github.com/facebook/react/pull/32090">#32090</a>, <a href="https://redirect.github.com/facebook/react/pull/32105">#32105</a>, <a href="https://redirect.github.com/facebook/react/pull/32254">#32254</a>, <a href="https://redirect.github.com/facebook/react/pull/32379">#32379</a>, <a href="https://redirect.github.com/facebook/react/pull/32422">#32422</a>, <a href="https://redirect.github.com/facebook/react/pull/32462">#32462</a>, <a href="https://redirect.github.com/facebook/react/pull/32540">#32540</a>, <a href="https://redirect.github.com/facebook/react/pull/32545">#32545</a>, <a href="https://redirect.github.com/facebook/react/pull/32585">#32585</a>, <a href="https://redirect.github.com/facebook/react/pull/32599">#32599</a>, <a href="https://redirect.github.com/facebook/react/pull/32611">#32611</a>, <a href="https://redirect.github.com/facebook/react/pull/32612">#32612</a>, <a href="https://redirect.github.com/facebook/react/pull/32617">#32617</a>, <a href="https://redirect.github.com/facebook/react/pull/32651">#32651</a>, <a href="https://redirect.github.com/facebook/react/pull/32653">#32653</a>, <a href="https://redirect.github.com/facebook/react/pull/32656">#32656</a>, <a href="https://redirect.github.com/facebook/react/pull/32664">#32664</a>, <a href="https://redirect.github.com/facebook/react/pull/32699">#32699</a>, <a href="https://redirect.github.com/facebook/react/pull/32723">#32723</a>, <a href="https://redirect.github.com/facebook/react/pull/32734">#32734</a>, <a href="https://redirect.github.com/facebook/react/pull/32751">#32751</a>, <a href="https://redirect.github.com/facebook/react/pull/32752">#32752</a>, <a href="https://redirect.github.com/facebook/react/pull/32760">#32760</a>, <a href="https://redirect.github.com/facebook/react/pull/32761">#32761</a>, <a href="https://redirect.github.com/facebook/react/pull/32764">#32764</a>, <a href="https://redirect.github.com/facebook/react/pull/32772">#32772</a>, <a href="https://redirect.github.com/facebook/react/pull/32790">#32790</a>, <a href="https://redirect.github.com/facebook/react/pull/32819">#32819</a>, <a href="https://redirect.github.com/facebook/react/pull/32820">#32820</a>, <a href="https://redirect.github.com/facebook/react/pull/32822">#32822</a>, <a href="https://redirect.github.com/facebook/react/pull/32833">#32833</a>, <a href="https://redirect.github.com/facebook/react/pull/32849">#32849</a>, <a href="https://redirect.github.com/facebook/react/pull/33094">#33094</a>, <a href="https://redirect.github.com/facebook/react/pull/33191">#33191</a>, <a href="https://redirect.github.com/facebook/react/pull/33200">#33200</a>, <a href="https://redirect.github.com/facebook/react/pull/33206">#33206</a>, <a href="https://redirect.github.com/facebook/react/pull/33293">#33293</a>, <a href="https://redirect.github.com/facebook/react/pull/33330">#33330</a>, <a href="https://redirect.github.com/facebook/react/pull/33331">#33331</a>, <a href="https://redirect.github.com/facebook/react/pull/33332">#33332</a>, <a href="https://redirect.github.com/facebook/react/pull/33357">#33357</a>, <a href="https://redirect.github.com/facebook/react/pull/33362">#33362</a>, <a href="https://redirect.github.com/facebook/react/pull/33433">#33433</a>, <a href="https://redirect.github.com/facebook/react/pull/33576">#33576</a>, <a href="https://redirect.github.com/facebook/react/pull/34374">#34374</a>, <a href="https://redirect.github.com/facebook/react/pull/34450">#34450</a>, <a href="https://redirect.github.com/facebook/react/pull/34481">#34481</a>, <a href="https://redirect.github.com/facebook/react/pull/34500">#34500</a>, <a href="https://redirect.github.com/facebook/react/pull/34502">#34502</a>, <a href="https://redirect.github.com/facebook/react/pull/34510">#34510</a>, <a href="https://redirect.github.com/facebook/react/pull/34511">#34511</a>, <a href="https://redirect.github.com/facebook/react/pull/34539">#34539</a>, <a href="https://redirect.github.com/facebook/react/pull/35567">#35567</a>, <a href="https://redirect.github.com/facebook/react/pull/35564">#35564</a>, <a href="https://redirect.github.com/facebook/react/pull/35485">#35485</a>, <a href="https://redirect.github.com/facebook/react/pull/35380">#35380</a>, <a href="https://redirect.github.com/facebook/react/pull/35063">#35063</a>, <a href="https://redirect.github.com/facebook/react/pull/35060">#35060</a>, <a href="https://redirect.github.com/facebook/react/pull/34676">#34676</a>, <a href="https://redirect.github.com/facebook/react/pull/36917">#36917</a>, <a href="https://redirect.github.com/facebook/react/pull/35337">#35337</a>, <a href="https://redirect.github.com/facebook/react/pull/35520">#35520</a>)</li> <li>Fragment Refs: Add Refs to <code><Fragment /></code> to support composable platform behavior (<a href="https://github.com/jackpope"><code>@jackpope</code></a>, <a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>, <a href="https://github.com/Dhakshin2007"><code>@Dhakshin2007</code></a>, <a href="https://github.com/chirokas"><code>@chirokas</code></a>, <a href="https://github.com/teamleaderleo"><code>@teamleaderleo</code></a>, <a href="https://github.com/fallintoplace"><code>@fallintoplace</code></a>: <a href="https://redirect.github.com/facebook/react/pull/32465">#32465</a>, <a href="https://redirect.github.com/facebook/react/pull/32613">#32613</a>, <a href="https://redirect.github.com/facebook/react/pull/32619">#32619</a>, <a href="https://redirect.github.com/facebook/react/pull/32654">#32654</a>, <a href="https://redirect.github.com/facebook/react/pull/32660">#32660</a>, <a href="https://redirect.github.com/facebook/react/pull/32682">#32682</a>, <a href="https://redirect.github.com/facebook/react/pull/32722">#32722</a>, <a href="https://redirect.github.com/facebook/react/pull/32813">#32813</a>, <a href="https://redirect.github.com/facebook/react/pull/32814">#32814</a>, <a href="https://redirect.github.com/facebook/react/pull/33056">#33056</a>, <a href="https://redirect.github.com/facebook/react/pull/33058">#33058</a>, <a href="https://redirect.github.com/facebook/react/pull/33093">#33093</a>, <a href="https://redirect.github.com/facebook/react/pull/34069">#34069</a>, <a href="https://redirect.github.com/facebook/react/pull/34103">#34103</a>, <a href="https://redirect.github.com/facebook/react/pull/34544">#34544</a>, <a href="https://redirect.github.com/facebook/react/pull/34545">#34545</a>, <a href="https://redirect.github.com/facebook/react/pull/37062">#37062</a>, <a href="https://redirect.github.com/facebook/react/pull/37061">#37061</a>, <a href="https://redirect.github.com/facebook/react/pull/37060">#37060</a>, <a href="https://redirect.github.com/facebook/react/pull/36047">#36047</a>, <a href="https://redirect.github.com/facebook/react/pull/36010">#36010</a>, <a href="https://redirect.github.com/facebook/react/pull/35642">#35642</a>, <a href="https://redirect.github.com/facebook/react/pull/35641">#35641</a>, <a href="https://redirect.github.com/facebook/react/pull/35637">#35637</a>, <a href="https://redirect.github.com/facebook/react/pull/35630">#35630</a>, <a href="https://redirect.github.com/facebook/react/pull/34935">#34935</a>, <a href="https://redirect.github.com/facebook/react/pull/37457">#37457</a>, <a href="https://redirect.github.com/facebook/react/pull/37408">#37408</a>, <a href="https://redirect.github.com/facebook/react/pull/37326">#37326</a>, <a href="https://redirect.github.com/facebook/react/pull/37251">#37251</a>, <a href="https://redirect.github.com/facebook/react/pull/37171">#37171</a>, <a href="https://redirect.github.com/facebook/react/pull/37169">#37169</a>, <a href="https://redirect.github.com/facebook/react/pull/37168">#37168</a>, <a href="https://redirect.github.com/facebook/react/pull/37167">#37167</a>, <a href="https://redirect.github.com/facebook/react/pull/37166">#37166</a>, <a href="https://redirect.github.com/facebook/react/pull/37165">#37165</a>, <a href="https://redirect.github.com/facebook/react/pull/37164">#37164</a>, <a href="https://redirect.github.com/facebook/react/pull/37163">#37163</a>, <a href="https://redirect.github.com/facebook/react/pul…

…9 types, manualChunks under vite 8 (#140) ## What this changes #124 (Dependabot's frontend group) bumped React 18 -> 19.3, vite 6 -> 8.3, TypeScript 5.7 -> 7, react-router-dom 6 -> 7 and plotly 2 -> 4 in one merge, and -- with no required checks yet -- it landed with `tsc` already failing. Main cannot build its frontend right now; this PR is that repair, two real breaks: 1. **React 19's types dropped the zero-argument `useRef` overload.** `TreeView.tsx`'s two timer refs (`saveTimer`, `scrollTimer`) failed `tsc` with TS2554 twice. They now pass the explicit `undefined` they always had at runtime: `useRef<number | undefined>(undefined)`. 2. **vite 8's rolldown core accepts only the function form of `manualChunks`.** The object form in `vite.config.ts` died at `manualChunks is not a function`. The function keeps the same chunking -- plotly still lands in its own 4.6 MB chunk. ## How to run its tests From `frontend/`: ``` bun install --frozen-lockfile --ignore-scripts bun run build # tsc && vite build -- green in 2.9s, same chunk layout bun run test # 42 pass, 0 fail bun run typecheck # clean ``` Verified locally on this exact tree. ## What this leaves out React 19, react-router 7, TypeScript 7 and plotly 4 are runtime majors that type-check and build clean but deserve their own smoke test of the running app; this PR only restores what the bumps broke mechanically. If the majors prove too hot, the alternative is re-pinning them in `package.json` -- but that is a decision about keeping #124, not about fixing it. ## Versions tested bun 1.4.3 (local mise shim; CI installs the `tool_versions.yml` pin). Julia, R and Agda untouched. Note: the commit is unsigned (the signing key's passphrase is unavailable to the session); amend to sign if required. --------- Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

…ecks can be required (#125) ## What this changes #116 merged with this workflow's "Occupancy typed peak" check red (its squash carried a draft `TH.[_]` placeholder; #117 fixed the proof), because nothing required the check to pass first -- and nothing could have: the `pull_request` trigger was path-filtered, so the occupancy checks never posted on PRs that touch no occupancy file, and a required check that never posts can never be satisfied. The Branch-Floor ruleset requires nothing today; ci.yml's header already documents this trap for its own job names. The PR path filter now lives in an `Occupancy relevance` gate job: - the workflow runs on **every** pull request, so all three of its checks always post; - the gate diffs the change against the same file list with plain `case` globs (a third-party paths-filter action would be refused by the account's allow-list; in a case pattern `*` crosses `/`, so `docs/occupancy/*` is the old `docs/occupancy/**`); - `Occupancy disagreement test` and `Occupancy typed peak` run only when the gate says relevant, and post `skipped` otherwise -- which a required check counts as satisfied; - the push trigger keeps its native `paths:` filter, so pushes to main still run this only when they should. All three job names are stable identifiers with no matrix, as `test/unit/test_install_pins.jl` asserts for every job in every workflow. ## What this enables (kept out of this PR on purpose) Once merged, Branch-Floor can require `Occupancy relevance` (itself included: a failed gate skips its dependents, and a skipped check satisfies a requirement silently -- the gate is the one check that must not be skipped), `Occupancy disagreement test`, `Occupancy typed peak`, alongside ci.yml's `Julia tests` and `Agda proofs`. That ruleset change is a settings change and will follow separately. ## How to run its tests From the repository root: ``` julia --project=. test/unit/test_install_pins.jl ``` All 223 assertions pass locally (the gate job satisfies the every-job stable-name and no-matrix rules and uses the pinned `actions/checkout` SHA). CI on this PR is the full check: this PR touches `occupancy.yml` itself, so the gate must mark it relevant and both heavy jobs must run. ## What this leaves out No ruleset change (above), no change to the heavy jobs' contents, and the two startup_failure-era path lists (push trigger, gate patterns) necessarily duplicate each other -- push filtering cannot be scripted, and the gate's list is documented as the pull_request half. ## Versions tested Julia 1.13.1 (local; CI pins 1.12.5 per `tool_versions.yml`). Bun, R and Agda untouched by this change -- CI runs the pinned ones. Note: this commit is unsigned (the signing key's passphrase is not available to the session); amend to sign if the fork's history requires it. --------- Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai> --------- Co-authored-by: Mistral Vibe <vibe@mistral.ai> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

The two things run_permanova decides for itself rather than taking from vegan, proved: the reported min_p_value (the 1/(B+1) floor, never raised by more permutations) and which terms have their p-value withheld (_varies_within_any_block, exactly when no within-block permutation exchanges the term's labels). Rebuilt for this fork's main: the branch this PR carried was based on upstream's history with three superseded commits whose content main already absorbed (#106, #112, #113), so it conflicted and no workflow could post a check. The proof file is byte-identical to the branch's; the import in All.agda, the README's PERMANOVA section and theorem-to-code map entries, and the Agda job's comment are re-applied onto main's side of each file (both sides were identical, so the diff applies clean). Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

…PR (#141) ## What this changes #124 grouped every frontend update, and with nothing requiring the checks it merged five framework majors -- React 18->19, vite 6->8, TypeScript 5->7, react-router-dom 6->7, plotly 2->4 -- in one PR, with `tsc` already red until #140 repaired it. A major is a migration, not an update: it must carry its own review and its own CI run. Both update groups (`frontend`, `github-actions` -- checkout v4.4.0 -> v7.0.1 came through #123 the same way) now name `update-types: ["minor", "patch"]` only. A Dependabot update matching no group opens its own PR, so majors arrive one at a time; minor and patch still batch weekly as before, so the noise stays low. A new testset in `test/unit/test_install_pins.jl` pins the shape -- both ecosystems declared, the frontend on `bun`, and no group whose `update-types` admit `major` -- so a future group cannot silently go back to batching majors. This is the same defence-in-depth the file already applies to workflow pins: the config asserts the policy, and the policy is enforced at the door. ## How to run its tests From the repository root: ``` julia --project=. test/unit/test_install_pins.jl ``` All testsets pass locally (223 prior assertions plus the new 9). ## What this leaves out No `open-pull-requests-limit` or other throttles: with majors unbatched the default limit of 5 per ecosystem keeps the queue bounded, and the first runs under this config (#123/#124) showed the volume is small. No change to security updates, which follow their own path. ## Versions tested Julia 1.13.1 locally (CI pins 1.12.5). No other tool touched. Note: the commit is unsigned (the signing key's passphrase is unavailable to the session); amend to sign if required. --------- Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

hyperpolymath · 2026-10-15T03:35:56Z

Closing in favour of #55, which carries the identical change on its own branch.

The structural problem this PR could not escape: its head branch, proofs/permanova-permutations, is also the head of the fork's own PR for the same proofs, and the two PRs need different bases -- the fork's main for one, this repository's main for the other. One branch cannot serve both: every rebase for one side broke the other, and this PR kept flipping back to conflicted whenever the fork's version was updated (most recently an hour ago, when its branch was rebased onto the fork's main for the fork's own PR). #55 starts from a dedicated branch, upstream/permanova-proofs, cut from this repository's main tip -- nothing else changes, and it can no longer be broken from the fork side.

hyperpolymath and others added 14 commits October 14, 2026 02:45

hyperpolymath and others added 3 commits October 15, 2026 02:59

hyperpolymath force-pushed the proofs/permanova-permutations branch from f59842c to 3809be0 Compare October 15, 2026 02:36

hyperpolymath force-pushed the proofs/permanova-permutations branch from 3c16cdb to e9bb4e2 Compare October 15, 2026 03:02

hyperpolymath and others added 2 commits October 15, 2026 04:14

hyperpolymath force-pushed the proofs/permanova-permutations branch from e9bb4e2 to 161d86a Compare October 15, 2026 03:28

hyperpolymath and others added 2 commits October 15, 2026 04:34

Merge branch 'main' into proofs/permanova-permutations

fee3a9b

hyperpolymath mentioned this pull request Oct 15, 2026

proofs(agda): PERMANOVA's p-value floor and which terms are withheld #55

Closed

hyperpolymath closed this Oct 15, 2026

hyperpolymath deleted the proofs/permanova-permutations branch October 15, 2026 03:56

Navigation Menu

Repository navigation

proofs(agda): PERMANOVA's p-value floor and which terms are withheld - #42

proofs(agda): PERMANOVA's p-value floor and which terms are withheld#42
hyperpolymath wants to merge 22 commits into
JoshuaJewell:mainfrom
hyperpolymath:proofs/permanova-permutations

hyperpolymath commented Oct 15, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Oct 15, 2026

Uh oh!

hyperpolymath commented Oct 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

hyperpolymath commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this changes

What is modelled, and what is not

How to run its tests

What this leaves out

Versions tested

Uh oh!

codecov Bot commented Oct 15, 2026

Codecov Report

Uh oh!

hyperpolymath commented Oct 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

hyperpolymath commented Oct 15, 2026 •

edited

Loading