refactor(dada2): assemble the taxonomy CSVs in base R, dropping dplyr entirely by hyperpolymath · Pull Request #57 · JoshuaJewell/MetaManifold-WebUI

hyperpolymath · 2026-10-15T08:37:29Z

Withdrawn; superseded by #61. This branch absorbed unrelated fork history and its original scope and validation claims should not be relied upon. The replacement isolates the intended change and states its current validation status.

What this does

The first slice of the R-to-Julia migration you proposed in #36: dplyr and tibble appear in the codebase only to assemble the taxonomy CSVs in src/pipeline/dada2/dada2_functions.r — four left_joins, one rownames_to_column, two library() calls. All seven sites are now base R, and dplyr leaves renv.lock entirely.

base_left_join() replaces dplyr::left_join, restoring both things merge() alone does not give: x's row order (sort = FALSE) and x's column order (rebuilt from x's columns plus y's non-key ones), so the written CSVs stay byte-for-byte identical. The existing test suite is the oracle: nothing downstream changes.
data.frame(Sequence = rownames(seq_t), seq_t, row.names = NULL) replaces tibble::rownames_to_column — same leading column, row names dropped.
The discovery manifest (R/_renv_dependencies.R) no longer names either package, so renv::snapshot() will not re-record them.
renv.lock loses the dplyr record: nothing in the real dependency graph imports it (dada2, vegan, MASS, zCompositions — none of them). tibble's record stays: dada2 -> ggplot2 -> tibble is dada2's own dependency chain, independent of this codebase, and removing it would break the lock's restore. The corrected measurement is recorded on Proposal: move the general-purpose R calls to Julia one at a time, with R kept as the test oracle #36.

Scope

Three files: src/pipeline/dada2/dada2_functions.r (+22/-8 approx), renv.lock (dplyr record removed), R/_renv_dependencies.R (2 lines). Licence metadata untouched; nothing outside the listed scope.

How to run the tests

julia --project=. test/runtests.jl          # full unit suite
julia --project=. test/runtests.jl test_install_pins.jl   # lockfile/pin consistency

test_install_pins.jl asserts the lock's package set against the discovery manifest and passes 208/208 with dplyr gone and tibble/ggplot2 retained.

Versions tested against

Julia 1.12.5 (the Manifest pin), R 4.5.0 (the renv.lock pin), bun 1.3.x (frontend untouched by this change). The branch is a single commit on your current main (52feb60), so behind_by: 0.

…wo-thread disagreement test (#106) MMW-01, part 1 of 2: the probe and the test. This is the unit that would go upstream to JoshuaJewell once the fork is re-synced. Part 2, the dated typed reading, is stacked on this branch. ## Why The vsearch stage runs its ASV and OTU searches concurrently in a full run, and one after the other in a single-stage re-run. Nothing measures what either shape occupies. The searches are child processes, so `Sys.maxrss()` of the Julia process never sees them. The high-water-mark algebra (occupancy-types, choreographic-types A-2/A-3) makes a falsifiable prediction about this shape: - the cost is the same in every order; - the memory peak is not: the larger search's peak serially, up to the sum concurrently. ## What changes **`MemoryProbe`** (`src/core/memory_probe.jl`). Off unless a `pipeline.yml` sets `occupancy_probe.enabled: true`. For each attested stage it records under a new optional `occupancy` key: - `julia_allocated_bytes`: the `Base.gc_num()` delta over the stage; - per task: the largest sampled VmRSS of the children it started (`peak_rss_kib`) and their kernel VmHWM (`hwm_kib`); - `child_peak_rss_kib`: the largest sum of the stage's children's VmRSS at one sampling instant. It samples `/proc` every 10 ms (`interval_ms`) with preallocated buffers, so the sampling barely touches the allocation figure it reports. **Hooks.** - `Tools._run_killable` registers each child. - `_attest` wraps the stage and passes the record to `Provenance.record_stage!(...; occupancy)`. - Both vsearch call sites label their searches `vsearch:asv` and `vsearch:otu`. **With the flag off nothing changes.** `start` returns `nothing` and every hook passes straight through, so a stage record has exactly the keys it had before. The key is deliberately *not* added to `config/defaults/pipeline.yml`, only documented there as a comment: the run config is embedded in `attestation.yml`, so a default key would change every run's record even with the flag off. **Robustness.** The probe never throws into the stage it measures. `getpid` is read once, while the child is alive. ## The disagreement test `test/occupancy_disagreement_test.jl` runs with the full suite. It runs the two searches in three orders, ASV then OTU, OTU then ASV, and concurrent, on a generated fixture of 1000 reference sequences × 400 bp with 300 ASV and 150 OTU queries. **Why that fixture:** of a calibrated ladder (250, 500, 1000, 2000), it is the smallest that kept both searches resident together for at least 15 samples in all of five repeats. **Asserted:** - the cost agrees within 1%; - the hits are byte-identical in every order. **Recorded, not asserted:** each search's peak and the stage peak. Locally: | order | ASV peak | OTU peak | stage peak (KiB) | Julia allocation (bytes) | |---|---|---|---|---| | ASV then OTU | 9204 | 9180 | 9204 | 978432 | | OTU then ASV | 9152 | 9192 | 9192 | 978720 | | concurrent | 9176 | 9204 | **18380** | 978816 | The cost spread is 0.04%. The concurrent peak is twice the serial one. The prediction would have been falsified had the concurrent peak matched the serial one; it did not. **One finding, not changed here.** The test runs vsearch with `--threads 1`. With several threads, vsearch's output order varies from run to run, and `_sort_hits_by_query!` then does a different amount of work, because its `by=` key splits each line on every comparison. That moved the stage's allocation by up to 12% between repeats of the *same* order. Precomputing the sort key would make production cost order-independent too. The file also covers: - the flag off and on through the real `_attest`; - a failed stage, which keeps its occupancy and still rethrows; - old records, which still parse and merge; - a 64 MiB child against a `sleep` control; - chained commands and an instantly exiting child. ## Verification Run locally with Julia 1.12.5 `-t 2` and vsearch 2.30.5 (the pinned version): - `julia --project=. -t 2 test/occupancy_disagreement_test.jl`: 46/46. - `test/runtests.jl provenance tools routes jobs config_hashing`: 547 passed, 10 skipped (`@test_skip`). One error: the live R probe, which needs the dada2 R package that CI installs and this machine lacks. - Five planted mutants are each caught by a failing test: - children ignored; - flag ignored; - key written with the flag off; - stage peak computed as the sum of the task peaks; - extra work in one order (cost spread 0.249). ## What this leaves out - Typed peaks, Session IR and the dated table: part 2, stacked on this branch. - The open bridge that the typed peak bounds the measured peak: occupancy-types, OPEN. - Memory on the R side. - Stages offloaded with `remote:`, where the local child is an ssh client. - Non-Linux hosts. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_015pMjy981ie74uCttyYDanC --- _Generated by [Claude Code](https://claude.ai/code/session_015pMjy981ie74uCttyYDanC)_ Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

MMW-01, part 2 of 2. Stacked on #106 (the probe and the test). This part is fork-side, about the estate's proof siblings, and is not meant for the upstream PR. ## Summary **`docs/occupancy-2026-10.adoc`** is the dated table (2026-10-14). For each order it gives: - each search's peak; - the measured stage peak; - the Session IR counted bytes; - the HWM typed peak; - the Julia allocation. It also has a status ledger, the limits, and what the next proofs would change. | order | stage peak, measured | counted, Session IR | typed peak, HWM | |---|---|---|---| | ASV then OTU | 9204 | 9204 | 9204 | | OTU then ASV | 9192 | 9192 | 9192 | | concurrent | 18380 | 18380 | 18380 | (KiB.) **The pieces:** - **`docs/occupancy/vsearch-*.sir`:** the stage as occupancy-types Session IR, one buffer per search, in each order. - **`docs/occupancy/TypedPeak.agda`:** the typed peak, computed by `refl` with occupancy-types' `Timeline` over resource-algebra's HWM grade. - A search alone exits holding nothing (drift 0). - The first concurrent search is still resident when the second starts (drift = peak). - `docs/occupancy/reject/` holds two claims that must be refused: *concurrent = serial*, and *serial = sum*, which reads occupancy as cost (R-6). - **`scripts/fetch-siblings.sh`:** pins occupancy-types `af95728` and resource-algebra `cf9235c` (the CONTEXT pins) into `_build/dependencies`. Their definitions are consumed, never copied. occupancy-types type-checks against both resource-algebra `cf9235c` and its own pin `b2c9f1f`. - **`scripts/check-occupancy.sh`:** the gate. It runs, in order: - Session IR `check` and `run --trace`; - `TypedPeak.agda`; - the two rejections, each required to fail at its own declaration; - counted bytes against the typed peak, order by order. - **`.github/workflows/occupancy.yml`:** runs the gate when these files change, on any base branch, so this stacked PR is checked too. It uses the digest-pinned Debian trixie image with Agda 2.6.4.3 that upstream's proof job uses, plus `setup-julia` 1.12.5. - **`docs/occupancy/results-2026-10-14.yml`:** the raw probe records behind the table. - **`.gitignore`:** unignores exactly these docs (`docs/*` is otherwise kept local), and ignores `_build/` and `*.agdai`. ## Status rows | ID | Claim | Status | |---|---|---| | MMW-01.1 | flag off ⇒ record unchanged; on ⇒ `occupancy`; old records parse | TESTED (#106's test file) | | MMW-01.2 | cost commutes for this workload | TESTED (asserted ≤ 1%) | | MMW-01.3 | stage peak order-dependent, task peaks not (A-3) for this workload | TESTED (recorded) | | MMW-01.4 | counted bytes = typed peak for the three programs | TESTED (gate) | | bridge | counted bytes ≤ typed peak in general | OPEN (unchanged: three instances, not a proof) | ## Verification - `bash scripts/check-occupancy.sh` exits 0 locally. It ran with Agda from the PyPI 2.6.4.3 wheel (which reports itself as 2.6.4.1) and Julia 1.12.5. CI runs the Debian 2.6.4.3 package. - Negative controls, each failing the gate: - one byte changed in a Session IR text (`18381 != 18380`); - a true claim planted as a rejection ("invalid claim accepted"); - a rejection failing on a scope error ("failed for the wrong reason"). - `zizmor` finds nothing in the workflow. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_015pMjy981ie74uCttyYDanC --- _Generated by [Claude Code](https://claude.ai/code/session_015pMjy981ie74uCttyYDanC)_ Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

… test here (#108) Follow-up to #106 and #107. Both were merged before their checks ran, so this is the part that never ran. ## Summary **The problem.** The `Occupancy reading` workflow ends in `startup_failure`: on #107's PR run, and again on `main` at `4dc19c0`. This account's Actions policy allows only GitHub's own actions and hyperpolymath's own, pinned to a full commit SHA, and `julia-actions/setup-julia` is neither. The same policy is why `ci.yml` has not started on this fork since at least 2026-10-02: it uses `julia-actions/*`, `oven-sh/setup-bun` and `codecov/codecov-action`. So the three-order test that #106 added has never run here. **The fix.** The workflow now uses no third-party action. It installs: - **Julia 1.12.5** from julialang's tarball, checked against julialang's published SHA256 (`41b84d72…8bae7`, as docker-library/julia `a39df01` records it); - **vsearch** from its `config/defaults/tool_versions.yml` pin, checked against the pinned SHA256, exactly as `ci.yml` does. It has two jobs: - **Occupancy disagreement test:** Julia, R from apt (RCall builds against it), `Pkg.instantiate()`, the pinned vsearch, then `julia --project=. -t 2 test/occupancy_disagreement_test.jl`; - **Occupancy typed peak:** `scripts/check-occupancy.sh` in the digest-pinned Debian trixie image with Agda 2.6.4.3, as before. The path filters now also cover the probe's sources and the test. ## Verification - `zizmor` finds nothing. - The only `uses:` is `actions/checkout`, SHA-pinned. - The `eval` of the pin-reading Julia snippet was rehearsed locally: `2.30.5`, the pinned URL and the SHA256. - This PR's own run of the workflow is the real check. The fork's `ci.yml` will keep failing at startup whatever this PR does. The fix there is an account or repo setting (Settings → Actions → General) that allows those actions. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_015pMjy981ie74uCttyYDanC --- _Generated by [Claude Code](https://claude.ai/code/session_015pMjy981ie74uCttyYDanC)_ Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…o the fork (#109) ## Summary The fork's `main` is upstream `257bcde` plus the three MMW-01 PRs (#106, #107, #108). Upstream has 25 commits since, up to `bcf52af`. Among them: - the PERMANOVA per-term test (JoshuaJewell#35); - the Agda proofs job; - the stable check name; - the config write gates; - clr_welch. This merges them in. It does not rebase, so `main` keeps its history and nothing is force-pushed. It is the base for the upstream PR of the probe (branch `feat/occupancy-probe`), whose files are byte-identical to this branch's. **Conflicts.** There were two. Both were additions on each side, so both sides are kept, upstream first: - **`.gitignore`:** upstream's `proofs/agda/_build/`, then the fork's `/_build/` and `*.agdai` for the fetched proof siblings. - **`config/defaults/pipeline.yml`:** upstream's `differential.replacement_delta`, then the fork's commented-out `occupancy_probe` block at the end of the file. ## Verification The unit suite ran on this tree with Julia 1.12.5, vsearch 2.30.5 and `-t 2`. - **Totals:** 2408 passed, 0 failed, 20 broken (tests the suite marks as known-broken), 1 error. - **The error is environmental.** `live probes of what is actually installed` (test/unit/test_provenance.jl:478) reports `package 'dada2' is not installed in the R library in use`. That sandbox has no dada2; CI restores it from `renv.lock`. - **New upstream tests:** "Config write gate" passes 54/54 and "Pipeline tables cannot be deleted" 24/24. - **Occupancy probe:** 46/46, the test from #106. **Expected CI on this PR:** - **`CI`:** `startup_failure`. This branch still carries upstream's `ci.yml`, whose julia-actions, setup-bun and codecov steps this account's Actions policy refuses. The stacked PR `ci/no-third-party-actions` fixes that and is where `ci.yml` is actually tested, on this merge plus its own commit. - **`Occupancy reading`:** does not run. Its paths are untouched by the merge. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_015pMjy981ie74uCttyYDanC --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Joshua Jewell <developer@joshuajewell.dev> Co-authored-by: x <x@x> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

… fork (#110) Stacked on #109 (the upstream sync); review that first. This PR's own diff is one commit. ## Summary This account's Actions policy allows only GitHub's own actions (`actions/*`) and its own, each pinned to a full commit SHA. `ci.yml` used five actions outside that, so every run on this fork ended in `startup_failure`, since at least 2026-10-02, and the suite never ran here. | Was | Now | |---|---| | `julia-actions/setup-julia` | Julia 1.12.5 from the `tool_versions.yml` archive, fetched with `fetch_pinned` and refused unless it hashes to the pinned SHA256 | | `julia-actions/cache` | `actions/cache/restore` and `actions/cache/save` over the depot's registries, packages, artifacts and compiled caches, keyed on `Manifest.toml`. It is saved only after `Pkg.instantiate()` succeeds. | | `oven-sh/setup-bun` | Bun 1.3.10 from the `tool_versions.yml` archive, checksummed the same way. The step then checks `bun --version` against the pin. | | `julia-actions/julia-processcoverage` | CoverageTools 1.4.2, the exact version, writes `lcov.info` from `src/` | | `codecov/codecov-action` | `actions/upload-artifact` keeps `lcov.info` for 14 days. The Codecov project, its slug and its token are upstream's. | **Other changes:** - `pull_request` runs for any base branch, so a stacked PR like this one is tested. - Both checkouts set `persist-credentials: false`. - `occupancy.yml`'s header no longer says `ci.yml` cannot start. The job names `Julia tests` and `Agda proofs` are unchanged, so the required-check name is stable. **`test/unit/test_install_pins.jl`:** - Julia's URL and checksum are read from the job env and must equal the pin file's `runtimes.julia.archives.linux-x86_64`. Its version must already equal `Manifest.toml`'s. - The Julia and Bun archives must go through `fetch_pinned` and `sha256sum -c`. - New: every `uses:` in `.github/workflows/*.yml` must be an `actions/*` or `hyperpolymath/*` action pinned to 40 hex characters. ## Verification - **`test_install_pins.jl`:** 222/222. - **Negative controls,** each failing it: 1. `setup-julia` restored as a step; 2. one character of `JULIA_SHA256` changed; 3. `actions/checkout` pinned by tag. - **Steps run locally** from this file's own YAML: - **Pin export:** writes `BUN_URL` and `BUN_SHA256`. - **Install Bun:** `bun.zip: OK`, then `bun --version` is 1.3.10. - **Process coverage:** on a covered toy `src/`, it writes `DA:1,1` / `DA:2,0`. - **Install Julia:** identical to `occupancy.yml`'s, which has passed in CI. - **`zizmor` 1.30.1:** no findings on `ci.yml` or `occupancy.yml`. Upstream's `ci.yml` has 2 medium findings ("artipacked": credentials left in the checkout), which `persist-credentials: false` removes. - **The real test is this PR's own `CI` run.** It is the first run of `ci.yml` on this fork, so it starts with an empty depot cache, and the renv restore builds R packages from source. ## Cost This diverges `ci.yml` from upstream's for as long as the account policy stands. A future sync will conflict wherever upstream edits the same lines. The alternative is a settings change: allow those five actions in Settings → Actions → General. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_015pMjy981ie74uCttyYDanC --- _Generated by [Claude Code](https://claude.ai/code/session_015pMjy981ie74uCttyYDanC)_ Co-authored-by: x <x@x> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…tested helper (#112) This is the fork's copy of the commit that answers Codecov's patch report on the upstream PR of the probe (branch `feat/occupancy-probe`, now `4b32184`). Both files end up byte-identical to that branch's, so the fork and upstream stay in step. ## Summary Codecov reported the upstream PR's patch coverage at 94.70%: - **`src/server/routes/pipeline.jl`:** 7 lines missed, 36.36% patch coverage. They are the vsearch searches wrapped in `MemoryProbe.task` in `_run_full_pipeline` and `_run_stage`. No test runs either function, so these lines, like the vsearch calls they replaced, had never been executed. - **`src/core/memory_probe.jl`:** 1 line missed, the `watch!(_)` fallback. **The change:** - **`_vsearch_searches(asv, otu; concurrent)`** holds the stage's two shapes. Concurrently, as the full pipeline runs them, both searches are waited for before a failure is rethrown. One after the other is how a single-stage re-run does it. - **`_vsearch_stage(search, project, asvs, otus, db; concurrent)`** builds the two calls, so each call site is now one line. - **`test/occupancy_disagreement_test.jl`** runs its ASV-then-OTU and concurrent orders through `_vsearch_searches`, so it measures the pipeline's own code rather than a copy. It also gains tests for: - both shapes' return values and task labels; - `_vsearch_stage` with a stub search; - the rethrow-after-both guarantee; - the `watch!` fallback. **One behaviour change.** A single-stage vsearch re-run used to return only the OTU search's result, or `nothing` when there was no OTU search. Its provenance record therefore left out the ASV taxonomy file. It now returns both results, as the full pipeline does. ## Verification - **Occupancy test:** 60/60, up from 46. - **Full unit suite** (Julia 1.12.5, vsearch 2.30.5, `-t 2`): 2422 passed, 0 failed, 20 broken (tests the suite marks as known-broken). The one error is environmental: `dada2` is not installed in that sandbox's R library. - **A first full run caught a bug the test file alone hides.** Other test files bind `SV` in `Main`, so a `const SV` failed to load. I reproduced it, then changed it to a plain binding like theirs. - **Patch coverage,** computed with CoverageTools 1.4.2 as CI processes it, is 156/159 (98.11%): - `memory_probe.jl`: 137/137; - `pipeline.jl`: 16/19. The 3 lines left are the two `_vsearch_stage` calls and the OTU read, inside `_run_full_pipeline` and `_run_stage`, which no test runs. This PR touches `src/server/routes/pipeline.jl` and the test, so the `Occupancy reading` workflow runs here. `CI` will run here only once #110 is in `main`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_015pMjy981ie74uCttyYDanC --- _Generated by [Claude Code](https://claude.ai/code/session_015pMjy981ie74uCttyYDanC)_ Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…e conflicts (#115) Resolves the conflicts that make the fork's `main` unmergeable with upstream — the ones behind the "Sync fork" screen and behind PR #114 showing `dirty`. ## Why they exist Upstream's `main` is 25 commits ahead, and the fork's history carries none of them: #109 synced that content with a **squash**, so upstream's work is in the fork's tree but not in its ancestry. `git merge-base` therefore sat at `257bcde`, and every later merge conflicted on regions where the two sides agree in substance and differ only in wording. ## What this merge does Merges `JoshuaJewell/main` @ `bcf52af` into the fork's `main` (from `a0880df`), resolving 8 conflicted files / 23 hunks. Every hunk was resolved on the fork's side, for a stated reason, and all of upstream's non-conflicting work was absorbed: | file | hunks | resolution | |---|---|---| | `.github/workflows/ci.yml` | 4 | This fork's workflow: Julia and Bun from the archives pinned in `tool_versions.yml`, coverage kept as a workflow artifact, actions pinned to SHAs this account allows. Upstream's side would reinstate `julia-actions/setup-julia` and `codecov/codecov-action`, which this account refuses — the failure that ends a run in `startup_failure` before any job starts. | | `test/unit/test_install_pins.jl` | 2 | Kept `allowed_action` and the `JULIA_URL`/`JULIA_SHA256` env assertions; dropped `ci_step_using`, whose single use asserted a step this fork does not have. | | `src/analysis/differential.jl` | 10 | The fork's docstrings, checked against the merged code (`clr_transform`'s refusal of non-finite values, `_check_compositions`' 1e-8 tolerance and `ErrorException`, `fit_welch`'s failed rows with a note, `volcano_chart`'s `floatmin(Float64)` y-values, `DifferentialConfig`'s strip/lowercase and range checks). | | `src/analysis/analysis.jl` | 3 | The fork's docstrings; the three non-`:computed` statuses, the sample-column exclusion and the length-checked `blocks` all exist in the merged code. | | `src/server/routes/config.jl` | 1 | The fork's docstring, which describes what `_config_value_error` actually checks (enums, `optional_args`, `remote.*`, file-name parts). | | `frontend/src/components/DifferentialPanel.tsx` | 1 | "Welch's t-test on CLR values" — what `clr_welch` does; upstream's line still said "CLR linear model" after the rename. | | `.gitignore` | 1 | `/_build/` and `*.agdai`; upstream's `proofs/agda/_build/` is already present and not duplicated. | | `config/defaults/pipeline.yml` | 1 | The commented `occupancy_probe` block, which upstream has nowhere. | ## Net effect - **Content**: one addition, upstream's `a required check name is a stable identifier` testset (+34 lines). Everything else upstream's 25 commits changed was already in the fork's tree — verified file by file: the other 34 files upstream touched are byte-identical to upstream's copy, or differ only by the fork's own text. - **Ancestry**: upstream's `main` becomes an ancestor, so the next sync merges without these conflicts, and `git merge-base`/the compare API stop reporting the fork 25 commits behind. ## Verification before pushing No Julia in this environment, so verification is what can be shown statically: - `ci.yml` and `pipeline.yml` parse as YAML; no conflict markers remain anywhere (`git grep '^<<<<<<<'`). - Every `uses:` in `.github/workflows/*` matches the fork's allow-list regex; no `CODECOV_TOKEN`, `julia-actions` or `codecov-action` step survives (only the explanatory comments name them). - All 137 mechanical assertions of `test/unit/test_install_pins.jl` emulated in Python against the merged tree: pass — including `JULIA_URL`/`JULIA_SHA256` equalling the pin file, `runs-on: ubuntu-24.04`, no version hard-coded in the workflow, and the new no-matrix/no-interpolation testset. CI on this PR is the real check; `test/unit/test_install_pins.jl` is precisely the guard that the resolved workflow and the pins still agree. Merging this (squash is fine — the content is what matters, the second parent only fixes ancestry) puts the fork's `main` level with upstream. PR #114 can then be rebuilt on top without the `dirty` state. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Joshua Jewell <developer@joshuajewell.dev> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

) (#116) Closes #105. First item of the ordered issue programme (#105 → #1 phase 1 → #21 → …). #105 asks for the amplicon pipeline's stages to be *graded* — alloc/hold/release — and for the predicted peak to be compared with the measured one, with a disagreement meaning a bug in one of them. The probe recorded what a stage reached but nothing read an occupancy out of it, so a `peak_rss_kib` could only be compared against a cost. This reads the occupancy with the algebra the reading is stated in: `ResourceAlgebra.Instances.HWM`, whose reclamation laws `OccupancyTypes.Reclaim` proves (the sibling's PR #9 the issue cites). ## The grade, read from the samples - `watch!`/`unwatch!` now record each task's **sample window** (`first_sample`, `last_sample`) beside its peak; `finish!` attaches the grades read from those windows as the record's `grades` key. - `Grade(peak, drift)` with `drift ≤ peak` (an `ArgumentError` otherwise), `release = peak − drift`; `seq` is the algebra's sequencing `max (peak a) (drift a + peak b)` (`Reclaim.reclaim-law`), `alt` the componentwise join the pair of laws needs; `task_grades`, `stage_grade`, `predicted_peak_rss_kib`, `cost_bound_rss_kib`, `reclaimed_kib`, `graded`. - Tasks are read in **sampled order** (first sample, ties by record order — never the sort's). A task's drift is its peak when the next task started at or before its last sample; the last task keeps its peak only if it was still resident. - A record carrying no windows is left **ungraded** (`nothing`): skipped, never graded on an assumed order, and `disagreement` stays silent — not measured is not a disagreement. ## What it reads out of the recorded run `docs/occupancy/results-2026-10-14.yml`, windows from `docs/occupancy/schedules.yml` (the file the gate and the unit test both read; the raw record of that run predates the window fields, and the Session IR texts in `docs/occupancy/` state the same interleavings): | order | predicted | measured | cost bound | reclaimed | |---|---|---|---|---| | asv_then_otu | 9204 | 9204 | 18384 | 9180 | | otu_then_asv | 9192 | 9192 | 18344 | 9152 | | concurrent | 18380 | 18380 | 18380 | 0 | The prediction is an upper bound (at a handover the task still live holds at most its peak), so `disagreement` reports only what that bound forbids: a measured peak *above* the prediction. `scripts/check-occupancy-grades.jl` re-derives the table from the record and fails on an inequality; the numbers are emulated-checked here because this environment has no Julia. ## The same numbers, as theorems `docs/occupancy/GradedStages.agda` consumes the pinned siblings (occupancy-types `af95728`, resource-algebra `cf9235c` — nothing re-declared; the Timeline names are Reclaim's own instance) and instantiates three of `Reclaim`'s laws at the measured grades: - `no-reclaim` on the concurrent stage — drift = peak, so the peak is the sum (18380); - `reclaimed` on the serial one — drift < peak with a non-empty suffix, so strictly below cost (9204 < 18384); - `occupancy-at-cut` over the stage's timeline, and `protocol-occupancy≤cost` at every cut. `docs/occupancy/reject/ConcurrentDriftIsZero.agda` is the negative control: grading the concurrent stage's drift as 0 — reading the cost as the occupancy — is refused, and `scripts/check-occupancy.sh` now type-checks `GradedStages` beside `TypedPeak` and requires that refusal. ## No ungraded readings `scripts/lint-occupancy-readings.sh` fails if production code outside `src/core/memory_probe.jl` names the `peak_rss_kib` key: from here a stage's occupancy figure has to come from the grading helpers. It passes on this tree. ## Tests and CI - `test/unit/test_occupancy_grade.jl` (new, wired into `test/runtests.jl`): the grade invariant, the `seq`/`alt` laws, the two stage shapes (serial 100/160/60, together 160/160/0), the `graded` record, a measured-above-prediction disagreement, the ungraded no-window record, a `finish!`/`watch!` run on Linux, and the recorded-run replay. - `test/occupancy_disagreement_test.jl`: the two-thread testset now asserts, per order, that every task carries both window keys, that the record is graded, that the prediction reaches the measurement, that it stays at or below the cost bound (`occupancy≤cost`) and that the slack is never negative. The peaks themselves stay recorded, not asserted. - `.github/workflows/occupancy.yml`: two new steps (the graded reading, the lint) in the `disagreement` job, and the new files added to both `paths` filters. - `docs/occupancy-2026-10.adoc`: the window fields, a "Reading the numbers" section, status row MMW-01.5, the new commands. ## Verification limits No Julia and no Agda on this machine, so: the recorded arithmetic and every fixture number were emulated exactly; the Agda follows the import and proof style of `OccupancyTypes.Witness` (checked by the sibling's `scripts/check-agda.sh`, same flags); the workflow YAML and the new scripts were syntax-checked and the lint was run. CI is the verifier here — including whether `OccupancyTypes.Reclaim` type-checks under this repo's flags, which this change is the first to require. ## Not in this change The adoc's `bridge` row — counted bytes bounded by the typed peak in general (occupancy-types' v0 → typed bridge) — stays OPEN: this change gives the graded reading, its instances and its laws, not that proof. --------- Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>

) Two lines of `docs/occupancy/GradedStages.agda` on `main` (from the #116 squash) still carry a draft placeholder: `TH.[_]` where `TH.[]` belongs. Agda refuses it at the parse, before checking anything else: ``` docs/occupancy/GradedStages.agda:77,59-80 Could not parse the application gone 9180 TH.∷ TH.[_] Operators used in the grammar: TH.∷ (infixr operator, level 5) when scope checking gone 9180 TH.∷ TH.[_] ``` So `main`'s **Occupancy typed peak** job is red at `scripts/check-occupancy.sh`, and with it the graded reading the #116 squash landed. This PR is that fix and nothing else: `TH.[_]` → `TH.[]` in both places, 2 lines, no other change (`git diff origin/main..HEAD` = this file only). ## How the error became readable The job's log is served from storage this environment cannot reach, so #116 added `annotate` to `scripts/check-occupancy.sh`: every failure it diagnoses now emits a `::error` line (with the prover's own last lines, escaped as the workflow-command syntax requires), and check annotations — unlike logs — are available through the API. That is how the parse error above was read back from run [38628333902](https://github.com/hyperpolymath/MetaManifold-WebUI/actions/runs/38628333902). It stays silent outside Actions. ## Why the first push looked different The first run on #116 (d49c2e3) failed before the annotations existed, so its cause was never readable; the revision that added them (cf1b726) is what reported this parse error, and it is what the squash carried into `main`. Nothing else in the #116 change is affected: `OccupancyTypes.Reclaim` itself type-checks under this repo's flags — visible in the same job's log, which reaches my file only after checking Prelude, Core, HWM, Order, Reclaim and Timeline. CI on this PR is the check: the typed-peak job must go green, and the disagreement job re-runs the recorded study as usual. --------- Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: CodeRabbit <noreply@coderabbit.ai>

…he reviewer's example (stacked on #117) (#118) Stacked on #117 (base is that branch, so this diff is the delta only, not #117's work). #117 is the right fix; this is what its fix left behind. If you would rather have these three files folded into #117 itself, ask CodeRabbit to apply them there — this session can only push its own branch. ## The audit of CodeRabbit's guidance on #117 (all three findings) | # | Finding (🟠 Major) | Verdict | |---|---|---| | 1 | **Preserve the first child's start boundary** — `isempty(t.live) && (t.first_sample = …)` re-stamped the window on every later child that found `live` empty | **Fixed** by 05e56e7: `t.processes == 1 && (t.first_sample = p.samples + 1)`, set once per task | | 2 | **Do not use zero for a started task's boundary** — two workers registering before any `_sample!` both got `first_sample == 0`, which `_overlaps` reads as never started | **Fixed** by 05e56e7: boundary is `p.samples + 1` (≥ 1), and `_overlaps` now also requires `prev[1] != 0`. The pid push and the boundary are set under the same lock acquisition that precedes the first sample that can see the child, so `first_sample` is exactly the first sample that could count it — no off-by-one remains to chase | | 3 | **Expire earlier drift before grading a later handover** (the A/B/C `201` vs `101` example) | **Fixed** by 05e56e7: per-boundary live sets, per-task drift as the signed delta of the live sum. Verified independently below | **Verification of #3** — the branch head's `_grades_and_labels` emulated against an independent reading of the windows (a task is live at instant `t` when `t ∈ [first, last]`, or `t ≥ first` while `last = 0`): - the reviewer's own case, windows `[1,3] [2,10] [4,5]`, peaks `100, 1, 100`: drifts `[100, −99, −1]`, **predicted 101**, cost 201, reclaimed 100 — the `201` is gone; - exhaustive over n ≤ 3 tasks with peaks 0–3 (**219,660** cases) and 300,000 random records up to six tasks: the fold **equals** the largest simultaneous peak sum for every record the probe can write, and is **never below** it otherwise — so `disagreement` still means "measured above anything the windows allow"; - every task keeps `drift ≤ peak` (no `ArgumentError` path), the folded drift stays ≥ 0, and the recorded run's figures are unchanged: 9204 / 9192 / 18380 KiB, reclaimed 9180 / 9152 / 0 — so `scripts/check-occupancy-grades.jl` and the two-thread test's per-order assertions still hold. ## What is still wrong after that fix (this PR) - **`docs/occupancy-2026-10.adoc` documented the replaced rule**: "a task's drift is its peak when the next task still held it, and 0 when it had exited". It now states the boundary rule — each handover keeps only the tasks still live at it; `drift_kib` is the change in that live sum, negative when the boundary also releases an earlier task; `release_kib` is everything freed between its start and the next boundary and can exceed the task's own peak; the folded drift is the peaks still live at the stage's end. The signed per-task delta is named as the extension `ResourceAlgebra.Instances.HWM`'s header records as **H-2**; the instance's own `drift` is the non-negative live sum. The `first_sample`/`last_sample` bullet is pinned to the probe's own wording. - **The reviewer's example was not a test.** It is now, verbatim: drifts `[100, −99, −1]`, predicted 101, cost 201, reclaimed 100, and — the sharpened bound — 201 KiB resident at once is asserted to be the *disagreement*, where before the fix it was the prediction. - **`src/core/memory_probe.jl`'s own grading comment** said drift was "the net change …" and `release` was "what the frontier reclaims"; both now say precisely what the arithmetic does. Comment-and-docstring changes only in `src/`; no behaviour change. The occupancy workflow re-runs the recorded study on this branch anyway (the path filter matches). --------- Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: CodeRabbit <noreply@coderabbit.ai>

…nning 4, 5) (#119) ## What this changes Both open [code-scanning](https://github.com/hyperpolymath/MetaManifold-WebUI/security/code-scanning) alerts — [4](https://github.com/hyperpolymath/MetaManifold-WebUI/security/code-scanning/4) and [5](https://github.com/hyperpolymath/MetaManifold-WebUI/security/code-scanning/5) — are the same rule, `js/incomplete-multi-character-sanitization` (high, CWE-020/080/116), on the same shape: `text.replace(/<[^>]+>/g, '')` stripping the pseudo-HTML markup Plotly accepts in titles. A single pass is not a sanitizer: in `"<scr<script>ipt>"` the inner tag is removed and the halves join into a fresh `<script>`. The strip now lives in one shared helper, `stripHtmlTags` in `frontend/src/utils/text.ts`, which repeats the replacement until the text stops changing — CodeQL's documented remedy, and a fixpoint by construction. It is used at both flagged sites: - `frontend/src/figure/charts.ts` — the pane title width measurement (alert 5), - `frontend/src/components/AnalysisChart.tsx` — the report figure's default title (alert 4). ## Behaviour on ordinary titles is identical Titles like `CO<sub>2</sub>` or `<b>run</b>` come out exactly as before: the second pass finds nothing and changes nothing. Bare `>` in a title ("p > 0.05") is untouched, as it always was. ## Tests New `frontend/src/utils/text.test.ts` pins the split-tag case (`<scr<script>ipt>...` leaves no complete tag), normal markup, and unchanged plain text. Run them with, from `frontend/`: ``` bun run test bun run typecheck ``` Both pass locally, as does `bun run build` (`tsc && vite build`): 42/42 tests across 7 files. ## What this leaves out No other sanitization sites exist in the frontend (`grep '<\[^>]' frontend/src` finds only these two), no dependency is added (the alternative, `sanitize-html`, is not needed for stripping markup from plain title text), and nothing outside the frontend is touched. The branch is a single commit off the current `main` tip. ## Versions tested bun 1.4.3 (the local mise shim; CI installs the version pinned in `config/defaults/tool_versions.yml`). Julia and R are untouched by this change. Note: this commit is unsigned — the signing key's passphrase was not available in the session that produced it. Amend/rebase to sign if the fork's history requires it. --------- Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

## What this changes Brings the fork back in line with upstream: a true merge of `JoshuaJewell/MetaManifold-WebUI` `main` at `2775faf` into our `main`, continuing the syncs of #109 and #115. Since our last sync, upstream moved three commits past `bcf52af`: - `8dda16d` — harden server origin checks (`JULIA_METAMANIFOLD_ALLOWED_ORIGINS` allowlist), disable Oxygen docs, serve report uploads inert (CSP, nosniff) - `e877e13` — accept the SPA index for `/docs` paths when a frontend build is present - `2775faf` — docs: split deployments and the origins the server must be told about The net tree change against our `main` is 6 files, +226/-13: `src/server/server.jl`, `src/server/routes/report.jl`, `test/unit/test_server_security.jl` (new), `test/runtests.jl`, `README.md`, `frontend/src/components/DifferentialPanel.tsx`. Everything else upstream did since the last shared commit (`257bcde`) was already absorbed here by #115. ## Conflict resolutions (all deliberate fork policy) - `.github/workflows/ci.yml`, `test/unit/test_install_pins.jl` — keep the fork's versions. This account allows only `actions/*` and `hyperpolymath/*` pinned to full SHAs, so Julia and Bun install from the pinned archives and the tests assert that policy. Upstream's `.github/` is unchanged since `bcf52af`. - `src/analysis/analysis.jl`, `src/analysis/differential.jl`, `src/server/routes/config.jl` — keep the fork's docstrings; verified line by line against the merged code (isfinite checks, the 1e-8 composition tolerance, median/max imputed fractions, result sort order, p-underflow handling, the file-name and remote gates). - `frontend/src/components/DifferentialPanel.tsx` — take upstream's wording ("CLR linear model"). - `test/runtests.jl` — take upstream's `test_server_security.jl` entry, keep the fork's occupancy entries. - `.gitignore`, `config/defaults/pipeline.yml` — keep the fork's occupancy blocks; upstream's Agda ignore line was already present. The fork's occupancy work (memory probe, grades, disagreement test) is untouched. ## How to run the tests ``` julia --project=. test/runtests.jl # full unit suite cd frontend && bun run test && bun run typecheck ``` ## Versions tested against Julia 1.13.1 (local; CI installs the pinned 1.12.5), R 4.6.1 (conda-forge; lockfile pins 4.5.0), bun 1.4.3. Full unit suite locally: 2623 passed; the only failures are the "live probes" of pipeline tools this machine does not have installed (cutadapt, vsearch, dada2's R package, etc.), which CI installs by design. Frontend: typecheck clean, 38/38 tests pass. ## Notes - This is a **merge commit**, not a squash: merging it as a merge (not squash) advances the merge base with upstream to `2775faf`, so the next sync is a clean three-way merge from a current base. - The commit is unsigned — the signing key's passphrase was not available in the session that produced it. Amend/rebase to sign if the fork's history requires it. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Joshua Jewell <developer@joshuajewell.dev> Co-authored-by: Mistral Vibe <vibe@mistral.ai> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

…gin tests from the environment (#121) ## What this changes Both of CodeRabbit's functional-correctness findings from #120, accepted and fixed. **1. Wildcard-bind writes (Major).** On a wildcard bind (`start(host="0.0.0.0")`) the origin allow-list excludes the wildcard address and the Host check runs on loopback binds only, so a UI served at e.g. `http://192.168.1.10:8080` received `403` on every write: browsers send `Origin` on same-origin POSTs, and the served address was not in `_allowed_origins()`. The guard now admits, on a wildcard bind only, an origin that names the request's own IP: an `http://` origin whose host is an **IP literal** (IPv4 or bracketed IPv6, never a name), on the bound port, whose host-and-port equals the `Host` header. A browser sends such an `Origin` only for a page it loaded from exactly that address, so the request is same-origin by construction. A DNS-rebinding page arrives with the attacker's domain as both `Host` and `Origin`; a name is not an IP literal, so it is refused exactly as before. Hostnames (e.g. `http://lab-box:8080`) and proxied ports still have to be listed in `JULIA_METAMANIFOLD_ALLOWED_ORIGINS`. **2. Test isolation (Minor).** The baseline origin assertions in `test_server_security.jl` assumed `JULIA_METAMANIFOLD_ALLOWED_ORIGINS` was unset; the suite failed for a developer running it with the variable set (a supported deployment setting). It is now cleared before the testset and restored in the `finally`. ## Tests A new "Wildcard bind" testset covers: the served IP admitted (GET with CORS echo, preflight 204, a POST that reaches the route and fails there with 400, not 403), an IPv6 literal admitted, other addresses/ports/schemes refused, the DNS-rebinding shape (domain matching its own Host) refused, and a listed hostname working only with the variable set. Verified locally, both with `JULIA_METAMANIFOLD_ALLOWED_ORIGINS` unset (86/86 in this file; 2636 passed, 0 failed in the full unit suite) and set to `http://localhost:3000, http://192.168.1.10:8080` (still 86/86; the same run on `main` fails 4 tests). ## How to run the tests ``` julia --project=. test/runtests.jl test_server_security.jl ``` ## Versions tested against Julia 1.13.1 (local; CI installs the pinned 1.12.5), R 4.6.1 (conda-forge; lockfile pins 4.5.0). No frontend change. ## Notes - The commit is unsigned — the signing key's passphrase was not available in the session that produced it. - Rejected the alternative CodeRabbit suggested (admitting a matching request `Host` generally): a rebinding page matches its own Host too, so only the IP-literal form is safe without new configuration. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

…ns (#122) ## What this changes Adds `.github/dependabot.yml` — the repository never had one, which is why Dependabot produced no version updates. (The "Dependabot Updates" workflow runs that did exist were *security* updates, which need no config; they failed 2026-09-26..27 because the `npm_and_yarn` updater refuses a Bun-managed project — `bun.lock` with no npm/yarn/pnpm lockfile — while trying to fix alerts against the since-removed `test/doi` fixtures. Both alerts are already fixed.) ## Configuration | Ecosystem | Directory | Cadence | Notes | |---|---|---|---| | `bun` | `/frontend` | weekly | The ecosystem Dependabot requires for `bun.lock`; `npm_and_yarn` cannot update it | | `github-actions` | `/` | weekly | Advances the full-SHA action pins; the account's allowlist policy (only `actions/*` and `hyperpolymath/*`, asserted by `test/unit/test_install_pins.jl`) survives, since Dependabot updates the existing pinned refs | Both grouped and prefixed `chore(deps)`. ## What Dependabot cannot cover here Julia (`Project.toml`/`Manifest.toml`) and R (`renv.lock`) are not Dependabot ecosystems. Their pins are managed by `config/defaults/tool_versions.yml` and asserted by `test/unit/test_install_pins.jl` and the CI workflow — that stays the mechanism. ## Testing Config-only change; no code path is touched. Dependabot validates the file on merge and the first "Dependabot Updates" run will appear on the default branch within the hour. ## Notes The commit is unsigned — the signing key's passphrase was not available in the session that produced it. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

## What this changes The root currently holds 24 entries, several of which are loose scripts and config files. This applies the root-cleanup doctrine of the RSR template (`rsr-template-repo`, `docs/proposals/root-cleanup.adoc`): the root holds authority files, the entry points a newcomer runs, tool-mandated build metadata, and one directory per concern — nothing else. | Move | Why | |---|---| | `CONTRIBUTING.md` → `.github/` | RSR health-files doctrine; GitHub auto-discovers it there | | `codecov.yml` → `.github/codecov.yml` | Codecov's documented alternative location; inert on this fork (coverage is kept as a run artifact, the Codecov project is upstream's) | | `install.jl` → `scripts/` | 49 KB, invoked only by `install.sh` and the pin tests. `install.sh` stays at the root — the RSR rule that the one file a newcomer runs stays at the root | | `precompile_exec.jl` → `scripts/` | Referenced only by `install.jl` | Plus a new testset, **"the root keeps its shape"**: a *bidirectional* allowlist, per the doctrine that a one-directional allowlist only ever ratchets open. A tracked root entry not listed there fails the suite; a listed entry that goes missing fails it too. It reads the tracked tree (`git ls-tree HEAD`), so local untracked build output (`bin/`, `web/`) does not fail a developer's run. **Kept at the root because the tooling requires it** — not clutter: `Project.toml`/`Manifest.toml` (Julia Pkg), `renv.lock`, `renv/`, `.Rprofile`, `R/` (renv scans `R/` for dependency discovery), `CITATION.cff` (GitHub reads it from the default-branch root only — moving it breaks the citation metadata), and the two launchers `install.sh` / `start.sh`. Reference updates: `install.sh`'s handoff (`julia --project=. scripts/install.jl`), the pin tests' `INSTALL_JL`, `install.jl`'s usage lines and `PRECOMPILE_EXEC_PATH`, the sysimage failure hint, the README's mention of the installer path. `PROJECT_ROOT` in `install.jl` now resolves to the repo root from `scripts/`. ## How to run the tests ``` julia --project=. test/runtests.jl test_install_pins.jl ``` ## Versions tested against Julia 1.13.1 (local; CI installs the pinned 1.12.5). Full unit suite locally: 2658 passed, 0 failed (the one error is the live probe for the `vegan` R package, absent from the local conda R; CI installs it). The new root-shape testset: 23/23. Shell syntax of both launchers re-checked (`bash -n`). ## Notes - Divergence cost, stated plainly: upstream's root layout is the same as this one was, so the moved paths will conflict at the next upstream sync (rename/delete pairs on four files). The conflict set is small and mechanical; the absorption register should record the relocations so a future sync resolves them deliberately. - Renames to full RSR names (`test/`→`tests/`, `bench/`→`benches/`, `proofs/`→`verification/`) are deliberately NOT in this PR: cosmetic value, but they would put every test and proof file in permanent rename/delete conflict with upstream. Recommended only if the layout change is proposed upstream as a unit, not as a fork-side divergence. - The commit is unsigned — the signing key's passphrase was not available in the session that produced it. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

Bumps the frontend group in /frontend with 10 updates: | Package | From | To | | --- | --- | --- | | [plotly.js-dist-min](https://github.com/plotly/plotly.js) | `2.35.3` | `4.1.2` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `18.3.1` | `19.3.0` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `18.3.28` | `19.3.0` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `18.3.1` | `19.3.0` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `18.3.7` | `19.3.0` | | [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `6.30.3` | `7.18.4` | | [@types/plotly.js](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/plotly.js) | `2.35.14` | `3.0.15` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `4.7.0` | `6.1.2` | | [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `6.4.1` | `8.3.4` | Updates `plotly.js-dist-min` from 2.35.3 to 4.1.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/plotly/plotly.js/releases">plotly.js-dist-min's releases</a>.</em></p> <blockquote> <h2>v4.1.2</h2> <h3>Changed</h3> <ul> <li>Use <code>ResizeObserver</code> for responsive chart resizing instead of listening for window resize events [<a href="https://redirect.github.com/plotly/plotly.js/pull/8017">#8017</a>], with thanks to <a href="https://github.com/Lexachoc"><code>@Lexachoc</code></a> for the contribution!</li> <li>Describe <code>config.toImageButtonOptions</code> in the plot schema [<a href="https://redirect.github.com/plotly/plotly.js/pull/8066">#8066</a>]</li> </ul> <h3>Fixed</h3> <ul> <li>Fix modebar hover colors not updating after <code>color</code> or <code>activecolor</code> changes [<a href="https://redirect.github.com/plotly/plotly.js/pull/8024">#8024</a>], with thanks to <a href="https://github.com/Lexachoc"><code>@Lexachoc</code></a> for the contribution!</li> <li>Correct the image export types: <code>format</code> now accepts <code>full-json</code>, <code>width</code> and <code>height</code> accept <code>null</code>, and <code>ToImgopts.format</code>, <code>ToImgopts.width</code>, <code>ToImgopts.height</code> and <code>DownloadImgopts.filename</code> are optional because <code>toImage</code> and <code>downloadImage</code> supply them [<a href="https://redirect.github.com/plotly/plotly.js/pull/8066">#8066</a>]</li> <li>Pick the trace drawn last on a hover tie in <code>scattergl</code> and <code>splom</code> (matching <code>scatter</code>) [<a href="https://redirect.github.com/plotly/plotly.js/pull/8079">#8079</a>]</li> <li>Allow typed arrays in the types for <code>arrayOk</code> number and color attributes [<a href="https://redirect.github.com/plotly/plotly.js/pull/8087">#8087</a>]</li> <li>Redraw plots when a font that they use finishes loading [<a href="https://redirect.github.com/plotly/plotly.js/pull/8094">#8094</a>]</li> </ul> <h2>v4.1.1</h2> <h3>Changed</h3> <ul> <li>Update <code>maplibre-gl</code> to v6 to address <a href="https://github.com/advisories/GHSA-jrc7-96c5-q579">CVE-2026-85061</a> [<a href="https://redirect.github.com/plotly/plotly.js/pull/8035">#8035</a>] <ul> <li><code>maplibre-gl</code> v6 dropped WebGL1 support, so some older browsers won't be able to use the map traces. Safari 15, Chrome 56, Firefox 51 and later are now required for the map traces.</li> </ul> </li> </ul> <h3>Fixed</h3> <ul> <li>Box and lasso selection of <code>scattermap</code> points are now supported on a rotated or pitched map [<a href="https://redirect.github.com/plotly/plotly.js/pull/8035">#8035</a>]</li> </ul> <h2>v4.1.0</h2> <h3>Added</h3> <ul> <li>Add an opt-in modebar button for downloading Plotly figures as JSON [<a href="https://redirect.github.com/plotly/plotly.js/pull/7990">#7990</a>, <a href="https://redirect.github.com/plotly/plotly.js/pull/8022">#8022</a>], with thanks to <a href="https://github.com/gokul-debugger"><code>@gokul-debugger</code></a> for the contribution!</li> <li>Add <code>legend.groupdoubleclick</code> to set the group behavior for a legend double-click [<a href="https://redirect.github.com/plotly/plotly.js/pull/7997">#7997</a>], with thanks to <a href="https://github.com/rascal-sl"><code>@rascal-sl</code></a> for the contribution!</li> </ul> <h3>Changed</h3> <ul> <li>Increase default double-click delay threshold to 500ms (from 300) [<a href="https://redirect.github.com/plotly/plotly.js/pull/8014">#8014</a>]</li> </ul> <h3>Fixed</h3> <ul> <li>Correct the <code>showspikes</code> axis attribute description to clarify that it applies for all <code>hovermode</code> values except when <code>hovermode</code> is <em>false</em> [<a href="https://redirect.github.com/plotly/plotly.js/pull/7981">#7981</a>], with thanks for <a href="https://github.com/CAOShurong"><code>@CAOShurong</code></a> for the contribution!</li> <li>Update country-iso-search to v0.1.2 to fix issue with UTF-8 characters being decoded incorrectly [<a href="https://redirect.github.com/plotly/plotly.js/pull/7994">#7994</a>]</li> <li>Compile TypeScript files under <code>src/</code> to JavaScript during packaging to fix Node resolution [<a href="https://redirect.github.com/plotly/plotly.js/pull/8000">#8000</a>]</li> <li>Include type defs in appropriate partial bundles [<a href="https://redirect.github.com/plotly/plotly.js/pull/8001">#8001</a>]</li> <li>Add TypeScript declarations for the modular <code>lib/</code> entry points [<a href="https://redirect.github.com/plotly/plotly.js/pull/8009">#8009</a>]</li> <li>Handle regex enum values when generating schema types [<a href="https://redirect.github.com/plotly/plotly.js/pull/8010">#8010</a>]</li> <li>Include trace-contributed layout attributes in generated types [<a href="https://redirect.github.com/plotly/plotly.js/pull/8020">#8020</a>]</li> <li>Resolve the per-point marker color for hover labels in <code>scattergl</code>, <code>quiver</code> traces [<a href="https://redirect.github.com/plotly/plotly.js/pull/8027">#8027</a>]</li> </ul> <h2>v4.0.0</h2> <h3>Added</h3> <ul> <li>Add <code>minscale</code>, <code>maxscale</code> geo plot attributes [<a href="https://redirect.github.com/plotly/plotly.js/pull/7371">#7371</a>], with thanks to <a href="https://github.com/mojoaxel"><code>@mojoaxel</code></a> for the contribution!</li> <li>Enable TypeScript compatibility within the library and start exporting types [<a href="https://redirect.github.com/plotly/plotly.js/pull/7680">#7680</a>]</li> <li>Add <code>quiver</code> trace type to visualize vector fields using arrows [<a href="https://redirect.github.com/plotly/plotly.js/pull/7710">#7710</a>, <a href="https://redirect.github.com/plotly/plotly.js/issues/7945">#7945</a>], with thanks to <a href="https://github.com/degzhaus"><code>@degzhaus</code></a> for the contribution!</li> <li>Use dashed markers in legend for shape traces with dash configured [<a href="https://redirect.github.com/plotly/plotly.js/pull/7845">#7845</a>]</li> <li>Add <code>direction</code> attribute to the Sankey trace, controlling the flow direction along the <code>orientation</code> axis [<a href="https://redirect.github.com/plotly/plotly.js/pull/7870">#7870</a>], with thanks to <a href="https://github.com/wf-r"><code>@wf-r</code></a> for the contribution! <ul> <li><code>forward</code> keeps sources on the left (horizontal) or top (vertical)</li> <li><code>reversed</code> moves them to the right or bottom</li> </ul> </li> <li>Add <code>sort</code> option to Sankey links and nodes [<a href="https://redirect.github.com/plotly/plotly.js/pull/7873">#7873</a>], with thanks to <a href="https://github.com/adamreeve"><code>@adamreeve</code></a> for the contribution!</li> <li>Add support for MathJax v4 [<a href="https://redirect.github.com/plotly/plotly.js/pull/7898">#7898</a>]</li> <li>Add top-level <code>xPixel</code> and <code>yPixel</code> keys to hover and click event data, corresponding to the pixel position of the cursor relative to the top-left corner of the graph div [<a href="https://redirect.github.com/plotly/plotly.js/pull/7966">#7966</a>]</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/plotly/plotly.js/blob/main/CHANGELOG.md">plotly.js-dist-min's changelog</a>.</em></p> <blockquote> <h2>[4.1.2] -- 2026-10-05</h2> <h3>Changed</h3> <ul> <li>Use <code>ResizeObserver</code> for responsive chart resizing instead of listening for window resize events [<a href="https://redirect.github.com/plotly/plotly.js/pull/8017">#8017</a>], with thanks to <a href="https://github.com/Lexachoc"><code>@Lexachoc</code></a> for the contribution!</li> <li>Describe <code>config.toImageButtonOptions</code> in the plot schema [<a href="https://redirect.github.com/plotly/plotly.js/pull/8066">#8066</a>]</li> </ul> <h3>Fixed</h3> <ul> <li>Fix modebar hover colors not updating after <code>color</code> or <code>activecolor</code> changes [<a href="https://redirect.github.com/plotly/plotly.js/pull/8024">#8024</a>], with thanks to <a href="https://github.com/Lexachoc"><code>@Lexachoc</code></a> for the contribution!</li> <li>Correct the image export types: <code>format</code> now accepts <code>full-json</code>, <code>width</code> and <code>height</code> accept <code>null</code>, and <code>ToImgopts.format</code>, <code>ToImgopts.width</code>, <code>ToImgopts.height</code> and <code>DownloadImgopts.filename</code> are optional because <code>toImage</code> and <code>downloadImage</code> supply them [<a href="https://redirect.github.com/plotly/plotly.js/pull/8066">#8066</a>]</li> <li>Pick the trace drawn last on a hover tie in <code>scattergl</code> and <code>splom</code> (matching <code>scatter</code>) [<a href="https://redirect.github.com/plotly/plotly.js/pull/8079">#8079</a>]</li> <li>Allow typed arrays in the types for <code>arrayOk</code> number and color attributes [<a href="https://redirect.github.com/plotly/plotly.js/pull/8087">#8087</a>]</li> <li>Redraw plots when a font that they use finishes loading [<a href="https://redirect.github.com/plotly/plotly.js/pull/8094">#8094</a>]</li> </ul> <h2>[4.1.1] -- 2026-09-14</h2> <h3>Changed</h3> <ul> <li>Update <code>maplibre-gl</code> to v6 to address <a href="https://github.com/advisories/GHSA-jrc7-96c5-q579">CVE-2026-85061</a> [<a href="https://redirect.github.com/plotly/plotly.js/pull/8035">#8035</a>] <ul> <li><code>maplibre-gl</code> v6 dropped WebGL1 support, so some older browsers won't be able to use the map traces. Safari 15, Chrome 56, Firefox 51 and later are now required for the map traces.</li> </ul> </li> </ul> <h3>Fixed</h3> <ul> <li>Box and lasso selection of <code>scattermap</code> points are now supported on a rotated or pitched map [<a href="https://redirect.github.com/plotly/plotly.js/pull/8035">#8035</a>]</li> </ul> <h2>[4.1.0] -- 2026-09-08</h2> <h3>Added</h3> <ul> <li>Add an opt-in modebar button for downloading Plotly figures as JSON [<a href="https://redirect.github.com/plotly/plotly.js/pull/7990">#7990</a>, <a href="https://redirect.github.com/plotly/plotly.js/pull/8022">#8022</a>], with thanks to <a href="https://github.com/gokul-debugger"><code>@gokul-debugger</code></a> for the contribution!</li> <li>Add <code>legend.groupdoubleclick</code> to set the group behavior for a legend double-click [<a href="https://redirect.github.com/plotly/plotly.js/pull/7997">#7997</a>], with thanks to <a href="https://github.com/rascal-sl"><code>@rascal-sl</code></a> for the contribution!</li> </ul> <h3>Changed</h3> <ul> <li>Increase default double-click delay threshold to 500ms (from 300) [<a href="https://redirect.github.com/plotly/plotly.js/pull/8014">#8014</a>]</li> </ul> <h3>Fixed</h3> <ul> <li>Correct the <code>showspikes</code> axis attribute description to clarify that it applies for all <code>hovermode</code> values except when <code>hovermode</code> is <em>false</em> [<a href="https://redirect.github.com/plotly/plotly.js/pull/7981">#7981</a>], with thanks for <a href="https://github.com/CAOShurong"><code>@CAOShurong</code></a> for the contribution!</li> <li>Update country-iso-search to v0.1.2 to fix issue with UTF-8 characters being decoded incorrectly [<a href="https://redirect.github.com/plotly/plotly.js/pull/7994">#7994</a>]</li> <li>Compile TypeScript files under <code>src/</code> to JavaScript during packaging to fix Node resolution [<a href="https://redirect.github.com/plotly/plotly.js/pull/8000">#8000</a>]</li> <li>Include type defs in appropriate partial bundles [<a href="https://redirect.github.com/plotly/plotly.js/pull/8001">#8001</a>]</li> <li>Add TypeScript declarations for the modular <code>lib/</code> entry points [<a href="https://redirect.github.com/plotly/plotly.js/pull/8009">#8009</a>]</li> <li>Handle regex enum values when generating schema types [<a href="https://redirect.github.com/plotly/plotly.js/pull/8010">#8010</a>]</li> <li>Include trace-contributed layout attributes in generated types [<a href="https://redirect.github.com/plotly/plotly.js/pull/8020">#8020</a>]</li> <li>Resolve the per-point marker color for hover labels in <code>scattergl</code>, <code>quiver</code> traces [<a href="https://redirect.github.com/plotly/plotly.js/pull/8027">#8027</a>]</li> </ul> <h2>[4.0.0] -- 2026-08-24</h2> <h3>Added</h3> <ul> <li>Add <code>minscale</code>, <code>maxscale</code> geo plot attributes [<a href="https://redirect.github.com/plotly/plotly.js/pull/7371">#7371</a>], with thanks to <a href="https://github.com/mojoaxel"><code>@mojoaxel</code></a> for the contribution!</li> <li>Enable TypeScript compatibility within the library and start exporting types [<a href="https://redirect.github.com/plotly/plotly.js/pull/7680">#7680</a>]</li> <li>Add <code>quiver</code> trace type to visualize vector fields using arrows [<a href="https://redirect.github.com/plotly/plotly.js/pull/7710">#7710</a>, <a href="https://redirect.github.com/plotly/plotly.js/issues/7945">#7945</a>], with thanks to <a href="https://github.com/degzhaus"><code>@degzhaus</code></a> for the contribution!</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/plotly/plotly.js/commit/bea2af3a45cc1b8753120b00f7f719f03e6ae528"><code>bea2af3</code></a> 4.1.2</li> <li><a href="https://github.com/plotly/plotly.js/commit/9a72399560bd32f2b797455100920f0664e880e7"><code>9a72399</code></a> chore: Updates for release v4.1.2</li> <li><a href="https://github.com/plotly/plotly.js/commit/dc94a203c0f8d7bded9a217d2602c4b5c3d2b68d"><code>dc94a20</code></a> chore: Update maplibre worker</li> <li><a href="https://github.com/plotly/plotly.js/commit/bf765785c386726ea242f68e3e24510787aeef52"><code>bf76578</code></a> chore: Update dependencies, drop extra-iterable</li> <li><a href="https://github.com/plotly/plotly.js/commit/67cc7fabdb6f974506863f70b08c7a688de3b26d"><code>67cc7fa</code></a> Merge pull request <a href="https://redirect.github.com/plotly/plotly.js/issues/8094">#8094</a> from plotly/cam/8089/replot-after-font-load</li> <li><a href="https://github.com/plotly/plotly.js/commit/c281d991f0e9922fc95363db4c030e8146ae0d0f"><code>c281d99</code></a> Be more general in font check</li> <li><a href="https://github.com/plotly/plotly.js/commit/b2aa6c22c8e08a0f9b62c23171b2bfa4ccf3b40f"><code>b2aa6c2</code></a> Use promises for tracking font loading because of Safari limitations</li> <li><a href="https://github.com/plotly/plotly.js/commit/aa448903b388008251e81181a16d4351d0a148d2"><code>aa44890</code></a> Add draftlog</li> <li><a href="https://github.com/plotly/plotly.js/commit/dd658b17c9375b77e4d77f4391b47366aa624c05"><code>dd658b1</code></a> Update internal GraphDiv type</li> <li><a href="https://github.com/plotly/plotly.js/commit/351fe896a54bdbbb8fa2a08519b257d9ddd7ec5f"><code>351fe89</code></a> Add tests</li> <li>Additional commits viewable in <a href="https://github.com/plotly/plotly.js/compare/v2.35.3...v4.1.2">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~camdecoster">camdecoster</a>, a new releaser for plotly.js-dist-min since your current version.</p> </details> <br /> Updates `react` from 18.3.1 to 19.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/react/react/releases">react's releases</a>.</em></p> <blockquote> <h2>19.3.0 (September 9, 2026)</h2> <p>Below is a list of all new features, APIs, and bug fixes.</p> <p>Read the <a href="https://react.dev/blog/2026/09/09/react-19-3">React 19.3 release post</a> for more information.</p> <h2>New React Features</h2> <ul> <li><code><ViewTransition /></code>: Adds <code><ViewTransition /></code> and <code>addTransitionType</code> APIs to power View Transition animations in React (<a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a>, <a href="https://github.com/jackpope"><code>@jackpope</code></a>, <a href="https://github.com/gaearon"><code>@gaearon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/31975">#31975</a>, <a href="https://redirect.github.com/facebook/react/pull/31987">#31987</a>, <a href="https://redirect.github.com/facebook/react/pull/31996">#31996</a>, <a href="https://redirect.github.com/facebook/react/pull/31999">#31999</a>, <a href="https://redirect.github.com/facebook/react/pull/32001">#32001</a>, <a href="https://redirect.github.com/facebook/react/pull/32002">#32002</a>, <a href="https://redirect.github.com/facebook/react/pull/32028">#32028</a>, <a href="https://redirect.github.com/facebook/react/pull/32029">#32029</a>, <a href="https://redirect.github.com/facebook/react/pull/32031">#32031</a>, <a href="https://redirect.github.com/facebook/react/pull/32034">#32034</a>, <a href="https://redirect.github.com/facebook/react/pull/32038">#32038</a>, <a href="https://redirect.github.com/facebook/react/pull/32041">#32041</a>, <a href="https://redirect.github.com/facebook/react/pull/32050">#32050</a>, <a href="https://redirect.github.com/facebook/react/pull/32090">#32090</a>, <a href="https://redirect.github.com/facebook/react/pull/32105">#32105</a>, <a href="https://redirect.github.com/facebook/react/pull/32254">#32254</a>, <a href="https://redirect.github.com/facebook/react/pull/32379">#32379</a>, <a href="https://redirect.github.com/facebook/react/pull/32422">#32422</a>, <a href="https://redirect.github.com/facebook/react/pull/32462">#32462</a>, <a href="https://redirect.github.com/facebook/react/pull/32540">#32540</a>, <a href="https://redirect.github.com/facebook/react/pull/32545">#32545</a>, <a href="https://redirect.github.com/facebook/react/pull/32585">#32585</a>, <a href="https://redirect.github.com/facebook/react/pull/32599">#32599</a>, <a href="https://redirect.github.com/facebook/react/pull/32611">#32611</a>, <a href="https://redirect.github.com/facebook/react/pull/32612">#32612</a>, <a href="https://redirect.github.com/facebook/react/pull/32617">#32617</a>, <a href="https://redirect.github.com/facebook/react/pull/32651">#32651</a>, <a href="https://redirect.github.com/facebook/react/pull/32653">#32653</a>, <a href="https://redirect.github.com/facebook/react/pull/32656">#32656</a>, <a href="https://redirect.github.com/facebook/react/pull/32664">#32664</a>, <a href="https://redirect.github.com/facebook/react/pull/32699">#32699</a>, <a href="https://redirect.github.com/facebook/react/pull/32723">#32723</a>, <a href="https://redirect.github.com/facebook/react/pull/32734">#32734</a>, <a href="https://redirect.github.com/facebook/react/pull/32751">#32751</a>, <a href="https://redirect.github.com/facebook/react/pull/32752">#32752</a>, <a href="https://redirect.github.com/facebook/react/pull/32760">#32760</a>, <a href="https://redirect.github.com/facebook/react/pull/32761">#32761</a>, <a href="https://redirect.github.com/facebook/react/pull/32764">#32764</a>, <a href="https://redirect.github.com/facebook/react/pull/32772">#32772</a>, <a href="https://redirect.github.com/facebook/react/pull/32790">#32790</a>, <a href="https://redirect.github.com/facebook/react/pull/32819">#32819</a>, <a href="https://redirect.github.com/facebook/react/pull/32820">#32820</a>, <a href="https://redirect.github.com/facebook/react/pull/32822">#32822</a>, <a href="https://redirect.github.com/facebook/react/pull/32833">#32833</a>, <a href="https://redirect.github.com/facebook/react/pull/32849">#32849</a>, <a href="https://redirect.github.com/facebook/react/pull/33094">#33094</a>, <a href="https://redirect.github.com/facebook/react/pull/33191">#33191</a>, <a href="https://redirect.github.com/facebook/react/pull/33200">#33200</a>, <a href="https://redirect.github.com/facebook/react/pull/33206">#33206</a>, <a href="https://redirect.github.com/facebook/react/pull/33293">#33293</a>, <a href="https://redirect.github.com/facebook/react/pull/33330">#33330</a>, <a href="https://redirect.github.com/facebook/react/pull/33331">#33331</a>, <a href="https://redirect.github.com/facebook/react/pull/33332">#33332</a>, <a href="https://redirect.github.com/facebook/react/pull/33357">#33357</a>, <a href="https://redirect.github.com/facebook/react/pull/33362">#33362</a>, <a href="https://redirect.github.com/facebook/react/pull/33433">#33433</a>, <a href="https://redirect.github.com/facebook/react/pull/33576">#33576</a>, <a href="https://redirect.github.com/facebook/react/pull/34374">#34374</a>, <a href="https://redirect.github.com/facebook/react/pull/34450">#34450</a>, <a href="https://redirect.github.com/facebook/react/pull/34481">#34481</a>, <a href="https://redirect.github.com/facebook/react/pull/34500">#34500</a>, <a href="https://redirect.github.com/facebook/react/pull/34502">#34502</a>, <a href="https://redirect.github.com/facebook/react/pull/34510">#34510</a>, <a href="https://redirect.github.com/facebook/react/pull/34511">#34511</a>, <a href="https://redirect.github.com/facebook/react/pull/34539">#34539</a>, <a href="https://redirect.github.com/facebook/react/pull/35567">#35567</a>, <a href="https://redirect.github.com/facebook/react/pull/35564">#35564</a>, <a href="https://redirect.github.com/facebook/react/pull/35485">#35485</a>, <a href="https://redirect.github.com/facebook/react/pull/35380">#35380</a>, <a href="https://redirect.github.com/facebook/react/pull/35063">#35063</a>, <a href="https://redirect.github.com/facebook/react/pull/35060">#35060</a>, <a href="https://redirect.github.com/facebook/react/pull/34676">#34676</a>, <a href="https://redirect.github.com/facebook/react/pull/36917">#36917</a>, <a href="https://redirect.github.com/facebook/react/pull/35337">#35337</a>, <a href="https://redirect.github.com/facebook/react/pull/35520">#35520</a>)</li> <li>Fragment Refs: Add Refs to <code><Fragment /></code> to support composable platform behavior (<a href="https://github.com/jackpope"><code>@jackpope</code></a>, <a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>, <a href="https://github.com/Dhakshin2007"><code>@Dhakshin2007</code></a>, <a href="https://github.com/chirokas"><code>@chirokas</code></a>, <a href="https://github.com/teamleaderleo"><code>@teamleaderleo</code></a>, <a href="https://github.com/fallintoplace"><code>@fallintoplace</code></a>: <a href="https://redirect.github.com/facebook/react/pull/32465">#32465</a>, <a href="https://redirect.github.com/facebook/react/pull/32613">#32613</a>, <a href="https://redirect.github.com/facebook/react/pull/32619">#32619</a>, <a href="https://redirect.github.com/facebook/react/pull/32654">#32654</a>, <a href="https://redirect.github.com/facebook/react/pull/32660">#32660</a>, <a href="https://redirect.github.com/facebook/react/pull/32682">#32682</a>, <a href="https://redirect.github.com/facebook/react/pull/32722">#32722</a>, <a href="https://redirect.github.com/facebook/react/pull/32813">#32813</a>, <a href="https://redirect.github.com/facebook/react/pull/32814">#32814</a>, <a href="https://redirect.github.com/facebook/react/pull/33056">#33056</a>, <a href="https://redirect.github.com/facebook/react/pull/33058">#33058</a>, <a href="https://redirect.github.com/facebook/react/pull/33093">#33093</a>, <a href="https://redirect.github.com/facebook/react/pull/34069">#34069</a>, <a href="https://redirect.github.com/facebook/react/pull/34103">#34103</a>, <a href="https://redirect.github.com/facebook/react/pull/34544">#34544</a>, <a href="https://redirect.github.com/facebook/react/pull/34545">#34545</a>, <a href="https://redirect.github.com/facebook/react/pull/37062">#37062</a>, <a href="https://redirect.github.com/facebook/react/pull/37061">#37061</a>, <a href="https://redirect.github.com/facebook/react/pull/37060">#37060</a>, <a href="https://redirect.github.com/facebook/react/pull/36047">#36047</a>, <a href="https://redirect.github.com/facebook/react/pull/36010">#36010</a>, <a href="https://redirect.github.com/facebook/react/pull/35642">#35642</a>, <a href="https://redirect.github.com/facebook/react/pull/35641">#35641</a>, <a href="https://redirect.github.com/facebook/react/pull/35637">#35637</a>, <a href="https://redirect.github.com/facebook/react/pull/35630">#35630</a>, <a href="https://redirect.github.com/facebook/react/pull/34935">#34935</a>, <a href="https://redirect.github.com/facebook/react/pull/37457">#37457</a>, <a href="https://redirect.github.com/facebook/react/pull/37408">#37408</a>, <a href="https://redirect.github.com/facebook/react/pull/37326">#37326</a>, <a href="https://redirect.github.com/facebook/react/pull/37251">#37251</a>, <a href="https://redirect.github.com/facebook/react/pull/37171">#37171</a>, <a href="https://redirect.github.com/facebook/react/pull/37169">#37169</a>, <a href="https://redirect.github.com/facebook/react/pull/37168">#37168</a>, <a href="https://redirect.github.com/facebook/react/pull/37167">#37167</a>, <a href="https://redirect.github.com/facebook/react/pull/37166">#37166</a>, <a href="https://redirect.github.com/facebook/react/pull/37165">#37165</a>, <a href="https://redirect.github.com/facebook/react/pull/37164">#37164</a>, <a href="https://redirect.github.com/facebook/react/pull/37163">#37163</a>, <a href="https://redirect.github.com/facebook/react/pull/37162">#37162</a>, <a href="https://redirect.github.com/facebook/react/pull/37161">#37161</a>, <a href="https://redirect.github.com/facebook/react/pull/37160">#37160</a>, <a href="https://redirect.github.com/facebook/react/pull/37125">#37125</a>, <a href="https://redirect.github.com/facebook/react/pull/37063">#37063</a>)</li> </ul> <h2>New React DOM Features</h2> <ul> <li><code>browser()</code>: a new <code>react-dom</code> API that returns a usable which errors during server rendering and resolves in the browser. <code>use(browser())</code> inside a <code><Suspense></code> boundary marks a subtree as browser-only without reporting a recoverable error (<a href="https://github.com/gnoff"><code>@gnoff</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37143">#37143</a>, <a href="https://redirect.github.com/facebook/react/pull/37241">#37241</a>) <ul> <li>Added an <code>onBrowserBailout</code> option to the <code>react-dom/server</code> APIs to observe when a subtree defers to the browser (<a href="https://github.com/gnoff"><code>@gnoff</code></a> <a href="https://redirect.github.com/facebook/react/pull/37193">#37193</a>)</li> </ul> </li> </ul> <h2>Notable changes</h2> <ul> <li>Enable Trusted Types API integration (<a href="https://github.com/rickhanlonii"><code>@rickhanlonii</code></a> <a href="https://redirect.github.com/facebook/react/pull/35816">#35816</a>)</li> <li>Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/37290">#37290</a>)</li> <li>Added a DEV-only warning when a component appears to have been unblocked by calling <code>use()</code> conditionally (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37104">#37104</a>, <a href="https://redirect.github.com/facebook/react/pull/37203">#37203</a>, <a href="https://redirect.github.com/facebook/react/pull/37491">#37491</a>)</li> </ul> <h2>All Changes</h2> <h3>React</h3> <ul> <li>Fast Refresh Fixes <ul> <li>Fix Fast Refresh to find and remount edits to components wrapped behind <code>lazy()</code> (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36965">#36965</a>)</li> <li>Fix Fast Refresh so edits to a <code>memo()</code> comparison function take effect (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36964">#36964</a>)</li> <li>Fix Fast Refresh crash when an edit changes the kind of a component's type (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36963">#36963</a>)</li> <li>Unify hot reload type resolution for Fast Refresh (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36962">#36962</a>)</li> <li>Fix Fast Refresh to remount correctly when an edit changes the component kind (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36950">#36950</a>)</li> <li>Double invoke effects in StrictMode after Fast Refresh (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35962">#35962</a>)</li> </ul> </li> <li>Performance Track Fixes <ul> <li>Prevent crash when accessing <code>$$typeof</code> in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35679">#35679</a>)</li> <li>Handle non-string function names in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35659">#35659</a>)</li> <li>Use minus (<code>-</code>) instead of en dash for removed props in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35649">#35649</a>)</li> <li>Handle arrays with bigints in deep objects in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35648">#35648</a>)</li> <li>Don't enumerate typed array props in Performance Tracks in DEV (<a href="https://github.com/UditDewan"><code>@UditDewan</code></a> <a href="https://redirect.github.com/facebook/react/pull/36913">#36913</a>)</li> <li>Bail out of diffing wide objects and arrays in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/34742">#34742</a>)</li> <li>Clear potentially large performance measures in DEV (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a> <a href="https://redirect.github.com/facebook/react/pull/34803">#34803</a>)</li> <li>Fix missing else branch for renders with no props change in Performance Tracks (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a> <a href="https://redirect.github.com/facebook/react/pull/34837">#34837</a>)</li> </ul> </li> <li>Activity Fixes <ul> <li>Fix <code>useSyncExternalStore</code> missing store mutations that happened while an Activity tree was hidden (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36947">#36947</a>)</li> <li>Hide portal contents when an Activity is hidden (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/35091">#35091</a>)</li> <li>Prevent metadata hoisting in hidden <code><Activity></code> trees (<a href="https://github.com/ronnakamoto"><code>@ronnakamoto</code></a> <a href="https://redirect.github.com/facebook/react/pull/34983">#34983</a>)</li> <li>Prevent errors thrown inside a hidden Activity from escaping to the visible UI (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/35074">#35074</a>)</li> <li>Don't unhide a node if a direct parent Offscreen is still hidden (<a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a> <a href="https://redirect.github.com/facebook/react/pull/34821">#34821</a>)</li> <li>Don't show internal <code><Offscreen></code> component in error messages (<a href="https://github.com/rickhanlonii"><code>@rickhanlonii</code></a> <a href="https://redirect.github.com/facebook/react/pull/35763">#35763</a>)</li> </ul> </li> <li>Warn in DEV when a component appears to have been unblocked by a conditional <code>use()</code> (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37104">#37104</a>, <a href="https://redirect.github.com/facebook/react/pull/37203">#37203</a>, <a href="https://redirect.github.com/facebook/react/pull/37491">#37491</a>)</li> <li>Render transitions independently instead of entangling them into a single render (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/37290">#37290</a>)</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/react/react/blob/main/CHANGELOG.md">react's changelog</a>.</em></p> <blockquote> <h2>19.3.0 (September 9, 2026)</h2> <h3>New React Features</h3> <ul> <li><code><ViewTransition /></code>: Adds <code><ViewTransition /></code> and <code>addTransitionType</code> APIs to power View Transition animations in React (<a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a>, <a href="https://github.com/jackpope"><code>@jackpope</code></a>, <a href="https://github.com/gaearon"><code>@gaearon</code></a>: <a href="https://redirect.github.com/react/react/pull/31975">#31975</a>, <a href="https://redirect.github.com/react/react/pull/31987">#31987</a>, <a href="https://redirect.github.com/react/react/pull/31996">#31996</a>, <a href="https://redirect.github.com/react/react/pull/31999">#31999</a>, <a href="https://redirect.github.com/react/react/pull/32001">#32001</a>, <a href="https://redirect.github.com/react/react/pull/32002">#32002</a>, <a href="https://redirect.github.com/react/react/pull/32028">#32028</a>, <a href="https://redirect.github.com/react/react/pull/32029">#32029</a>, <a href="https://redirect.github.com/react/react/pull/32031">#32031</a>, <a href="https://redirect.github.com/react/react/pull/32034">#32034</a>, <a href="https://redirect.github.com/react/react/pull/32038">#32038</a>, <a href="https://redirect.github.com/react/react/pull/32041">#32041</a>, <a href="https://redirect.github.com/react/react/pull/32050">#32050</a>, <a href="https://redirect.github.com/react/react/pull/32090">#32090</a>, <a href="https://redirect.github.com/react/react/pull/32105">#32105</a>, <a href="https://redirect.github.com/react/react/pull/32254">#32254</a>, <a href="https://redirect.github.com/react/react/pull/32379">#32379</a>, <a href="https://redirect.github.com/react/react/pull/32422">#32422</a>, <a href="https://redirect.github.com/react/react/pull/32462">#32462</a>, <a href="https://redirect.github.com/react/react/pull/32540">#32540</a>, <a href="https://redirect.github.com/react/react/pull/32545">#32545</a>, <a href="https://redirect.github.com/react/react/pull/32585">#32585</a>, <a href="https://redirect.github.com/react/react/pull/32599">#32599</a>, <a href="https://redirect.github.com/react/react/pull/32611">#32611</a>, <a href="https://redirect.github.com/react/react/pull/32612">#32612</a>, <a href="https://redirect.github.com/react/react/pull/32617">#32617</a>, <a href="https://redirect.github.com/react/react/pull/32651">#32651</a>, <a href="https://redirect.github.com/react/react/pull/32653">#32653</a>, <a href="https://redirect.github.com/react/react/pull/32656">#32656</a>, <a href="https://redirect.github.com/react/react/pull/32664">#32664</a>, <a href="https://redirect.github.com/react/react/pull/32699">#32699</a>, <a href="https://redirect.github.com/react/react/pull/32723">#32723</a>, <a href="https://redirect.github.com/react/react/pull/32734">#32734</a>, <a href="https://redirect.github.com/react/react/pull/32751">#32751</a>, <a href="https://redirect.github.com/react/react/pull/32752">#32752</a>, <a href="https://redirect.github.com/react/react/pull/32760">#32760</a>, <a href="https://redirect.github.com/react/react/pull/32761">#32761</a>, <a href="https://redirect.github.com/react/react/pull/32764">#32764</a>, <a href="https://redirect.github.com/react/react/pull/32772">#32772</a>, <a href="https://redirect.github.com/react/react/pull/32790">#32790</a>, <a href="https://redirect.github.com/react/react/pull/32819">#32819</a>, <a href="https://redirect.github.com/react/react/pull/32820">#32820</a>, <a href="https://redirect.github.com/react/react/pull/32822">#32822</a>, <a href="https://redirect.github.com/react/react/pull/32833">#32833</a>, <a href="https://redirect.github.com/react/react/pull/32849">#32849</a>, <a href="https://redirect.github.com/react/react/pull/33094">#33094</a>, <a href="https://redirect.github.com/react/react/pull/33191">#33191</a>, <a href="https://redirect.github.com/react/react/pull/33200">#33200</a>, <a href="https://redirect.github.com/react/react/pull/33206">#33206</a>, <a href="https://redirect.github.com/react/react/pull/33293">#33293</a>, <a href="https://redirect.github.com/react/react/pull/33330">#33330</a>, <a href="https://redirect.github.com/react/react/pull/33331">#33331</a>, <a href="https://redirect.github.com/react/react/pull/33332">#33332</a>, <a href="https://redirect.github.com/react/react/pull/33357">#33357</a>, <a href="https://redirect.github.com/react/react/pull/33362">#33362</a>, <a href="https://redirect.github.com/react/react/pull/33433">#33433</a>, <a href="https://redirect.github.com/react/react/pull/33576">#33576</a>, <a href="https://redirect.github.com/react/react/pull/34374">#34374</a>, <a href="https://redirect.github.com/react/react/pull/34450">#34450</a>, <a href="https://redirect.github.com/react/react/pull/34481">#34481</a>, <a href="https://redirect.github.com/react/react/pull/34500">#34500</a>, <a href="https://redirect.github.com/react/react/pull/34502">#34502</a>, <a href="https://redirect.github.com/react/react/pull/34510">#34510</a>, <a href="https://redirect.github.com/react/react/pull/34511">#34511</a>, <a href="https://redirect.github.com/react/react/pull/34539">#34539</a>, <a href="https://redirect.github.com/react/react/pull/35567">#35567</a>, <a href="https://redirect.github.com/react/react/pull/35564">#35564</a>, <a href="https://redirect.github.com/react/react/pull/35485">#35485</a>, <a href="https://redirect.github.com/react/react/pull/35380">#35380</a>, <a href="https://redirect.github.com/react/react/pull/35063">#35063</a>, <a href="https://redirect.github.com/react/react/pull/35060">#35060</a>, <a href="https://redirect.github.com/react/react/pull/34676">#34676</a>, <a href="https://redirect.github.com/react/react/pull/36917">#36917</a>, <a href="https://redirect.github.com/react/react/pull/35337">#35337</a>, <a href="https://redirect.github.com/react/react/pull/35520">#35520</a>)</li> <li>Fragment Refs: Add Refs to <code><Fragment /></code> to support composable platform behavior (<a href="https://github.com/jackpope"><code>@jackpope</code></a>, <a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>, <a href="https://github.com/Dhakshin2007"><code>@Dhakshin2007</code></a>, <a href="https://github.com/chirokas"><code>@chirokas</code></a>, <a href="https://github.com/teamleaderleo"><code>@teamleaderleo</code></a>, <a href="https://github.com/fallintoplace"><code>@fallintoplace</code></a>: <a href="https://redirect.github.com/react/react/pull/32465">#32465</a>, <a href="https://redirect.github.com/react/react/pull/32613">#32613</a>, <a href="https://redirect.github.com/react/react/pull/32619">#32619</a>, <a href="https://redirect.github.com/react/react/pull/32654">#32654</a>, <a href="https://redirect.github.com/react/react/pull/32660">#32660</a>, <a href="https://redirect.github.com/react/react/pull/32682">#32682</a>, <a href="https://redirect.github.com/react/react/pull/32722">#32722</a>, <a href="https://redirect.github.com/react/react/pull/32813">#32813</a>, <a href="https://redirect.github.com/react/react/pull/32814">#32814</a>, <a href="https://redirect.github.com/react/react/pull/33056">#33056</a>, <a href="https://redirect.github.com/react/react/pull/33058">#33058</a>, <a href="https://redirect.github.com/react/react/pull/33093">#33093</a>, <a href="https://redirect.github.com/react/react/pull/34069">#34069</a>, <a href="https://redirect.github.com/react/react/pull/34103">#34103</a>, <a href="https://redirect.github.com/react/react/pull/34544">#34544</a>, <a href="https://redirect.github.com/react/react/pull/34545">#34545</a>, <a href="https://redirect.github.com/react/react/pull/37062">#37062</a>, <a href="https://redirect.github.com/react/react/pull/37061">#37061</a>, <a href="https://redirect.github.com/react/react/pull/37060">#37060</a>, <a href="https://redirect.github.com/react/react/pull/36047">#36047</a>, <a href="https://redirect.github.com/react/react/pull/36010">#36010</a>, <a href="https://redirect.github.com/react/react/pull/35642">#35642</a>, <a href="https://redirect.github.com/react/react/pull/35641">#35641</a>, <a href="https://redirect.github.com/react/react/pull/35637">#35637</a>, <a href="https://redirect.github.com/react/react/pull/35630">#35630</a>, <a href="https://redirect.github.com/react/react/pull/34935">#34935</a>, <a href="https://redirect.github.com/react/react/pull/37457">#37457</a>, <a href="https://redirect.github.com/react/react/pull/37408">#37408</a>, <a href="https://redirect.github.com/react/react/pull/37326">#37326</a>, <a href="https://redirect.github.com/react/react/pull/37251">#37251</a>, <a href="https://redirect.github.com/react/react/pull/37171">#37171</a>, <a href="https://redirect.github.com/react/react/pull/37169">#37169</a>, <a href="https://redirect.github.com/react/react/pull/37168">#37168</a>, <a href="https://redirect.github.com/react/react/pull/37167">#37167</a>, <a href="https://redirect.github.com/react/react/pull/37166">#37166</a>, <a href="https://redirect.github.com/react/react/pull/37165">#37165</a>, <a href="https://redirect.github.com/react/react/pull/37164">#37164</a>, <a href="https://redirect.github.com/react/react/pull/37163">#37163</a>, <a href="https://redirect.github.com/react/react/pull/37162">#37162</a>, <a href="https://redirect.github.com/react/react/pull/37161">#37161</a>, <a href="https://redirect.github.com/react/react/pull/37160">#37160</a>, <a href="https://redirect.github.com/react/react/pull/37125">#37125</a>, <a href="https://redirect.github.com/react/react/pull/37063">#37063</a>)</li> </ul> <h3>New React DOM Features</h3> <ul> <li><code>browser()</code>: a new <code>react-dom</code> API that returns a usable which errors during server rendering and resolves in the browser. <code>use(browser())</code> inside a <code><Suspense></code> boundary marks a subtree as browser-only without reporting a recoverable error (<a href="https://github.com/gnoff"><code>@gnoff</code></a>: <a href="https://redirect.github.com/react/react/pull/37143">#37143</a>, <a href="https://redirect.github.com/react/react/pull/37241">#37241</a>) <ul> <li>Added an <code>onBrowserBailout</code> option to the <code>react-dom/server</code> APIs to observe when a subtree defers to the browser (<a href="https://github.com/gnoff"><code>@gnoff</code></a> <a href="https://redirect.github.com/react/react/pull/37193">#37193</a>)</li> </ul> </li> </ul> <h3>Notable changes</h3> <ul> <li>Enable Trusted Types API integration (<a href="https://github.com/rickhanlonii"><code>@rickhanlonii</code></a> <a href="https://redirect.github.com/react/react/pull/35816">#35816</a>)</li> <li>Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/react/react/pull/37290">#37290</a>)</li> <li>Added a DEV-only warning when a component appears to have been unblocked by calling <code>use()</code> conditionally (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>: <a href="https://redirect.github.com/react/react/pull/37104">#37104</a>, <a href="https://redirect.github.com/react/react/pull/37203">#37203</a>, <a href="https://redirect.github.com/react/react/pull/37491">#37491</a>)</li> </ul> <h3>All Changes</h3> <h4>React</h4> <ul> <li>Fast Refresh Fixes <ul> <li>Fix Fast Refresh to find and remount edits to components wrapped behind <code>lazy()</code> (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/react/react/pull/36965">#36965</a>)</li> <li>Fix Fast Refresh so edits to a <code>memo()</code> comparison function take effect (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/react/react/pull/36964">#36964</a>)</li> <li>Fix Fast Refresh crash when an edit changes the kind of a component's type (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/react/react/pull/36963">#36963</a>)</li> <li>Unify hot reload type resolution for Fast Refresh (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/react/react/pull/36962">#36962</a>)</li> <li>Fix Fast Refresh to remount correctly when an edit changes the component kind (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/react/react/pull/36950">#36950</a>)</li> <li>Double invoke effects in StrictMode after Fast Refresh (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/react/react/pull/35962">#35962</a>)</li> </ul> </li> <li>Performance Track Fixes <ul> <li>Prevent crash when accessing <code>$$typeof</code> in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/react/react/pull/35679">#35679</a>)</li> <li>Handle non-string function names in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/react/react/pull/35659">#35659</a>)</li> <li>Use minus (<code>-</code>) instead of en dash for removed props in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/react/react/pull/35649">#35649</a>)</li> <li>Handle arrays with bigints in deep objects in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/react/react/pull/35648">#35648</a>)</li> <li>Don't enumerate typed array props in Performance Tracks in DEV (<a href="https://github.com/UditDewan"><code>@UditDewan</code></a> <a href="https://redirect.github.com/react/react/pull/36913">#36913</a>)</li> <li>Bail out of diffing wide objects and arrays in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/react/react/pull/34742">#34742</a>)</li> <li>Clear potentially large performance measures in DEV (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a> <a href="https://redirect.github.com/react/react/pull/34803">#34803</a>)</li> <li>Fix missing else branch for renders with no props change in Performance Tracks (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a> <a href="https://redirect.github.com/react/react/pull/34837">#34837</a>)</li> </ul> </li> <li>Activity Fixes <ul> <li>Fix <code>useSyncExternalStore</code> missing store mutations that happened while an Activity tree was hidden (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/react/react/pull/36947">#36947</a>)</li> <li>Hide portal contents when an Activity is hidden (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/react/react/pull/35091">#35091</a>)</li> <li>Prevent metadata hoisting in hidden <code><Activity></code> trees (<a href="https://github.com/ronnakamoto"><code>@ronnakamoto</code></a> <a href="https://redirect.github.com/react/react/pull/34983">#34983</a>)</li> <li>Prevent errors thrown inside a hidden Activity from escaping to the visible UI (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/react/react/pull/35074">#35074</a>)</li> <li>Don't unhide a node if a direct parent Offscreen is still hidden (<a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a> <a href="https://redirect.github.com/react/react/pull/34821">#34821</a>)</li> <li>Don't show internal <code><Offscreen></code> component in error messages (<a href="https://github.com/rickhanlonii"><code>@rickhanlonii</code></a> <a href="https://redirect.github.com/react/react/pull/35763">#35763</a>)</li> </ul> </li> <li>Warn in DEV when a component appears to have been unblocked by a conditional <code>use()</code> (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>: <a href="https://redirect.github.com/react/react/pull/37104">#37104</a>, <a href="https://redirect.github.com/react/react/pull/37203">#37203</a>, <a href="https://redirect.github.com/react/react/pull/37491">#37491</a>)</li> <li>Render transitions independently instead of entangling them into a single render (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/react/react/pull/37290">#37290</a>)</li> <li>Fix hang when updating a dehydrated boundary inside a hidden tree (<a href="https://github.com/gaearon"><code>@gaearon</code></a> <a href="https://redirect.github.com/react/react/pull/37135">#37135</a>)</li> <li>Don't reacquire Host Singletons during dev effect validation (<a href="https://github.com/gnoff"><code>@gnoff</code></a> <a href="https://redirect.github.com/react/react/pull/37113">#37113</a>)</li> <li>Only remove properties from Host Singletons on release (<a href="https://github.com/gnoff"><code>@gnoff</code></a> <a href="https://redirect.github.com/react/react/pull/37112">#37112</a>)</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/react/react/commit/2dc7da790d6388b95b83198ca9b588b2ad5f5c0b"><code>2dc7da7</code></a> [test] Bump Jest to 30.4 (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/37382">#37382</a>)</li> <li><a href="https://github.com/react/react/commit/4f9389423b7319e1f7acc3d158c84a8365462748"><code>4f93894</code></a> docs: remove stale parentType param from validateChildKeys JSDoc (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36928">#36928</a>)</li> <li><a href="https://github.com/react/react/commit/dbc37501ffeaf8fec45af5898caf1c3d64ad10bf"><code>dbc3750</code></a> Update required references to GitHub repo (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36752">#36752</a>)</li> <li><a href="https://github.com/react/react/commit/900ae094d85b11c67d53dd14af50a2bda5db4495"><code>900ae09</code></a> [flow] Bump flow to v0.317.0 (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36701">#36701</a>)</li> <li><a href="https://github.com/react/react/commit/fbb137059e4aacfaab1d36516e9b55050b4a0454"><code>fbb1370</code></a> [flow] Bump flow to v0.307.1 (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36199">#36199</a>)</li> <li><a href="https://github.com/react/react/commit/56922cf751fab6c7ab4c12ddbbd15839959fa255"><code>56922cf</code></a> [react-native-renderer] Delete Paper (legacy) renderer (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36285">#36285</a>)</li> <li><a href="https://github.com/react/react/commit/74568e8627aa43469b74f2972f427a209639d0b6"><code>74568e8</code></a> [Flight] Transport <code>AggregateErrors.errors</code> (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36156">#36156</a>)</li> <li><a href="https://github.com/react/react/commit/e66ef6480ecd19c6885f2c06dec34fec1fdc0a98"><code>e66ef64</code></a> [tests] remove withoutStack from assertConsole helpers (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/35498">#35498</a>)</li> <li><a href="https://github.com/react/react/commit/db71391c5c70dc113560d1c23d0b6548604d827f"><code>db71391</code></a> [Fiber] Instrument the lazy initializer thenable in all cases (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/35521">#35521</a>)</li> <li><a href="https://github.com/react/react/commit/3e1abcc8d7083a13adf4774feb0d67ecbe4a2bc4"><code>3e1abcc</code></a> [tests] Require exact error messages in assertConsole helpers (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/35497">#35497</a>)</li> <li>Additional commits viewable in <a href="https://github.com/react/react/commits/v19.3.0/packages/react">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for react since your current version.</p> </details> <br /> Updates `@types/react` from 18.3.28 to 19.3.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react">compare view</a></li> </ul> </details> <br /> Updates `react-dom` from 18.3.1 to 19.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/react/react/releases">react-dom's releases</a>.</em></p> <blockquote> <h2>19.3.0 (September 9, 2026)</h2> <p>Below is a list of all new features, APIs, and bug fixes.</p> <p>Read the <a href="https://react.dev/blog/2026/09/09/react-19-3">React 19.3 release post</a> for more information.</p> <h2>New React Features</h2> <ul> <li><code><ViewTransition /></code>: Adds <code><ViewTransition /></code> and <code>addTransitionType</code> APIs to power View Transition animations in React (<a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a>, <a href="https://github.com/jackpope"><code>@jackpope</code></a>, <a href="https://github.com/gaearon"><code>@gaearon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/31975">#31975</a>, <a href="https://redirect.github.com/facebook/react/pull/31987">#31987</a>, <a href="https://redirect.github.com/facebook/react/pull/31996">#31996</a>, <a href="https://redirect.github.com/facebook/react/pull/31999">#31999</a>, <a href="https://redirect.github.com/facebook/react/pull/32001">#32001</a>, <a href="https://redirect.github.com/facebook/react/pull/32002">#32002</a>, <a href="https://redirect.github.com/facebook/react/pull/32028">#32028</a>, <a href="https://redirect.github.com/facebook/react/pull/32029">#32029</a>, <a href="https://redirect.github.com/facebook/react/pull/32031">#32031</a>, <a href="https://redirect.github.com/facebook/react/pull/32034">#32034</a>, <a href="https://redirect.github.com/facebook/react/pull/32038">#32038</a>, <a href="https://redirect.github.com/facebook/react/pull/32041">#32041</a>, <a href="https://redirect.github.com/facebook/react/pull/32050">#32050</a>, <a href="https://redirect.github.com/facebook/react/pull/32090">#32090</a>, <a href="https://redirect.github.com/facebook/react/pull/32105">#32105</a>, <a href="https://redirect.github.com/facebook/react/pull/32254">#32254</a>, <a href="https://redirect.github.com/facebook/react/pull/32379">#32379</a>, <a href="https://redirect.github.com/facebook/react/pull/32422">#32422</a>, <a href="https://redirect.github.com/facebook/react/pull/32462">#32462</a>, <a href="https://redirect.github.com/facebook/react/pull/32540">#32540</a>, <a href="https://redirect.github.com/facebook/react/pull/32545">#32545</a>, <a href="https://redirect.github.com/facebook/react/pull/32585">#32585</a>, <a href="https://redirect.github.com/facebook/react/pull/32599">#32599</a>, <a href="https://redirect.github.com/facebook/react/pull/32611">#32611</a>, <a href="https://redirect.github.com/facebook/react/pull/32612">#32612</a>, <a href="https://redirect.github.com/facebook/react/pull/32617">#32617</a>, <a href="https://redirect.github.com/facebook/react/pull/32651">#32651</a>, <a href="https://redirect.github.com/facebook/react/pull/32653">#32653</a>, <a href="https://redirect.github.com/facebook/react/pull/32656">#32656</a>, <a href="https://redirect.github.com/facebook/react/pull/32664">#32664</a>, <a href="https://redirect.github.com/facebook/react/pull/32699">#32699</a>, <a href="https://redirect.github.com/facebook/react/pull/32723">#32723</a>, <a href="https://redirect.github.com/facebook/react/pull/32734">#32734</a>, <a href="https://redirect.github.com/facebook/react/pull/32751">#32751</a>, <a href="https://redirect.github.com/facebook/react/pull/32752">#32752</a>, <a href="https://redirect.github.com/facebook/react/pull/32760">#32760</a>, <a href="https://redirect.github.com/facebook/react/pull/32761">#32761</a>, <a href="https://redirect.github.com/facebook/react/pull/32764">#32764</a>, <a href="https://redirect.github.com/facebook/react/pull/32772">#32772</a>, <a href="https://redirect.github.com/facebook/react/pull/32790">#32790</a>, <a href="https://redirect.github.com/facebook/react/pull/32819">#32819</a>, <a href="https://redirect.github.com/facebook/react/pull/32820">#32820</a>, <a href="https://redirect.github.com/facebook/react/pull/32822">#32822</a>, <a href="https://redirect.github.com/facebook/react/pull/32833">#32833</a>, <a href="https://redirect.github.com/facebook/react/pull/32849">#32849</a>, <a href="https://redirect.github.com/facebook/react/pull/33094">#33094</a>, <a href="https://redirect.github.com/facebook/react/pull/33191">#33191</a>, <a href="https://redirect.github.com/facebook/react/pull/33200">#33200</a>, <a href="https://redirect.github.com/facebook/react/pull/33206">#33206</a>, <a href="https://redirect.github.com/facebook/react/pull/33293">#33293</a>, <a href="https://redirect.github.com/facebook/react/pull/33330">#33330</a>, <a href="https://redirect.github.com/facebook/react/pull/33331">#33331</a>, <a href="https://redirect.github.com/facebook/react/pull/33332">#33332</a>, <a href="https://redirect.github.com/facebook/react/pull/33357">#33357</a>, <a href="https://redirect.github.com/facebook/react/pull/33362">#33362</a>, <a href="https://redirect.github.com/facebook/react/pull/33433">#33433</a>, <a href="https://redirect.github.com/facebook/react/pull/33576">#33576</a>, <a href="https://redirect.github.com/facebook/react/pull/34374">#34374</a>, <a href="https://redirect.github.com/facebook/react/pull/34450">#34450</a>, <a href="https://redirect.github.com/facebook/react/pull/34481">#34481</a>, <a href="https://redirect.github.com/facebook/react/pull/34500">#34500</a>, <a href="https://redirect.github.com/facebook/react/pull/34502">#34502</a>, <a href="https://redirect.github.com/facebook/react/pull/34510">#34510</a>, <a href="https://redirect.github.com/facebook/react/pull/34511">#34511</a>, <a href="https://redirect.github.com/facebook/react/pull/34539">#34539</a>, <a href="https://redirect.github.com/facebook/react/pull/35567">#35567</a>, <a href="https://redirect.github.com/facebook/react/pull/35564">#35564</a>, <a href="https://redirect.github.com/facebook/react/pull/35485">#35485</a>, <a href="https://redirect.github.com/facebook/react/pull/35380">#35380</a>, <a href="https://redirect.github.com/facebook/react/pull/35063">#35063</a>, <a href="https://redirect.github.com/facebook/react/pull/35060">#35060</a>, <a href="https://redirect.github.com/facebook/react/pull/34676">#34676</a>, <a href="https://redirect.github.com/facebook/react/pull/36917">#36917</a>, <a href="https://redirect.github.com/facebook/react/pull/35337">#35337</a>, <a href="https://redirect.github.com/facebook/react/pull/35520">#35520</a>)</li> <li>Fragment Refs: Add Refs to <code><Fragment /></code> to support composable platform behavior (<a href="https://github.com/jackpope"><code>@jackpope</code></a>, <a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>, <a href="https://github.com/Dhakshin2007"><code>@Dhakshin2007</code></a>, <a href="https://github.com/chirokas"><code>@chirokas</code></a>, <a href="https://github.com/teamleaderleo"><code>@teamleaderleo</code></a>, <a href="https://github.com/fallintoplace"><code>@fallintoplace</code></a>: <a href="https://redirect.github.com/facebook/react/pull/32465">#32465</a>, <a href="https://redirect.github.com/facebook/react/pull/32613">#32613</a>, <a href="https://redirect.github.com/facebook/react/pull/32619">#32619</a>, <a href="https://redirect.github.com/facebook/react/pull/32654">#32654</a>, <a href="https://redirect.github.com/facebook/react/pull/32660">#32660</a>, <a href="https://redirect.github.com/facebook/react/pull/32682">#32682</a>, <a href="https://redirect.github.com/facebook/react/pull/32722">#32722</a>, <a href="https://redirect.github.com/facebook/react/pull/32813">#32813</a>, <a href="https://redirect.github.com/facebook/react/pull/32814">#32814</a>, <a href="https://redirect.github.com/facebook/react/pull/33056">#33056</a>, <a href="https://redirect.github.com/facebook/react/pull/33058">#33058</a>, <a href="https://redirect.github.com/facebook/react/pull/33093">#33093</a>, <a href="https://redirect.github.com/facebook/react/pull/34069">#34069</a>, <a href="https://redirect.github.com/facebook/react/pull/34103">#34103</a>, <a href="https://redirect.github.com/facebook/react/pull/34544">#34544</a>, <a href="https://redirect.github.com/facebook/react/pull/34545">#34545</a>, <a href="https://redirect.github.com/facebook/react/pull/37062">#37062</a>, <a href="https://redirect.github.com/facebook/react/pull/37061">#37061</a>, <a href="https://redirect.github.com/facebook/react/pull/37060">#37060</a>, <a href="https://redirect.github.com/facebook/react/pull/36047">#36047</a>, <a href="https://redirect.github.com/facebook/react/pull/36010">#36010</a>, <a href="https://redirect.github.com/facebook/react/pull/35642">#35642</a>, <a href="https://redirect.github.com/facebook/react/pull/35641">#35641</a>, <a href="https://redirect.github.com/facebook/react/pull/35637">#35637</a>, <a href="https://redirect.github.com/facebook/react/pull/35630">#35630</a>, <a href="https://redirect.github.com/facebook/react/pull/34935">#34935</a>, <a href="https://redirect.github.com/facebook/react/pull/37457">#37457</a>, <a href="https://redirect.github.com/facebook/react/pull/37408">#37408</a>, <a href="https://redirect.github.com/facebook/react/pull/37326">#37326</a>, <a href="https://redirect.github.com/facebook/react/pull/37251">#37251</a>, <a href="https://redirect.github.com/facebook/react/pull/37171">#37171</a>, <a href="https://redirect.github.com/facebook/react/pull/37169">#37169</a>, <a href="https://redirect.github.com/facebook/react/pull/37168">#37168</a>, <a href="https://redirect.github.com/facebook/react/pull/37167">#37167</a>, <a href="https://redirect.github.com/facebook/react/pull/37166">#37166</a>, <a href="https://redirect.github.com/facebook/react/pull/37165">#37165</a>, <a href="https://redirect.github.com/facebook/react/pull/37164">#37164</a>, <a href="https://redirect.github.com/facebook/react/pull/37163">#37163</a>, <a href="https://redirect.github.com/facebook/react/pul…

…9 types, manualChunks under vite 8 (#140) ## What this changes #124 (Dependabot's frontend group) bumped React 18 -> 19.3, vite 6 -> 8.3, TypeScript 5.7 -> 7, react-router-dom 6 -> 7 and plotly 2 -> 4 in one merge, and -- with no required checks yet -- it landed with `tsc` already failing. Main cannot build its frontend right now; this PR is that repair, two real breaks: 1. **React 19's types dropped the zero-argument `useRef` overload.** `TreeView.tsx`'s two timer refs (`saveTimer`, `scrollTimer`) failed `tsc` with TS2554 twice. They now pass the explicit `undefined` they always had at runtime: `useRef<number | undefined>(undefined)`. 2. **vite 8's rolldown core accepts only the function form of `manualChunks`.** The object form in `vite.config.ts` died at `manualChunks is not a function`. The function keeps the same chunking -- plotly still lands in its own 4.6 MB chunk. ## How to run its tests From `frontend/`: ``` bun install --frozen-lockfile --ignore-scripts bun run build # tsc && vite build -- green in 2.9s, same chunk layout bun run test # 42 pass, 0 fail bun run typecheck # clean ``` Verified locally on this exact tree. ## What this leaves out React 19, react-router 7, TypeScript 7 and plotly 4 are runtime majors that type-check and build clean but deserve their own smoke test of the running app; this PR only restores what the bumps broke mechanically. If the majors prove too hot, the alternative is re-pinning them in `package.json` -- but that is a decision about keeping #124, not about fixing it. ## Versions tested bun 1.4.3 (local mise shim; CI installs the `tool_versions.yml` pin). Julia, R and Agda untouched. Note: the commit is unsigned (the signing key's passphrase is unavailable to the session); amend to sign if required. --------- Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

…ecks can be required (#125) ## What this changes #116 merged with this workflow's "Occupancy typed peak" check red (its squash carried a draft `TH.[_]` placeholder; #117 fixed the proof), because nothing required the check to pass first -- and nothing could have: the `pull_request` trigger was path-filtered, so the occupancy checks never posted on PRs that touch no occupancy file, and a required check that never posts can never be satisfied. The Branch-Floor ruleset requires nothing today; ci.yml's header already documents this trap for its own job names. The PR path filter now lives in an `Occupancy relevance` gate job: - the workflow runs on **every** pull request, so all three of its checks always post; - the gate diffs the change against the same file list with plain `case` globs (a third-party paths-filter action would be refused by the account's allow-list; in a case pattern `*` crosses `/`, so `docs/occupancy/*` is the old `docs/occupancy/**`); - `Occupancy disagreement test` and `Occupancy typed peak` run only when the gate says relevant, and post `skipped` otherwise -- which a required check counts as satisfied; - the push trigger keeps its native `paths:` filter, so pushes to main still run this only when they should. All three job names are stable identifiers with no matrix, as `test/unit/test_install_pins.jl` asserts for every job in every workflow. ## What this enables (kept out of this PR on purpose) Once merged, Branch-Floor can require `Occupancy relevance` (itself included: a failed gate skips its dependents, and a skipped check satisfies a requirement silently -- the gate is the one check that must not be skipped), `Occupancy disagreement test`, `Occupancy typed peak`, alongside ci.yml's `Julia tests` and `Agda proofs`. That ruleset change is a settings change and will follow separately. ## How to run its tests From the repository root: ``` julia --project=. test/unit/test_install_pins.jl ``` All 223 assertions pass locally (the gate job satisfies the every-job stable-name and no-matrix rules and uses the pinned `actions/checkout` SHA). CI on this PR is the full check: this PR touches `occupancy.yml` itself, so the gate must mark it relevant and both heavy jobs must run. ## What this leaves out No ruleset change (above), no change to the heavy jobs' contents, and the two startup_failure-era path lists (push trigger, gate patterns) necessarily duplicate each other -- push filtering cannot be scripted, and the gate's list is documented as the pull_request half. ## Versions tested Julia 1.13.1 (local; CI pins 1.12.5 per `tool_versions.yml`). Bun, R and Agda untouched by this change -- CI runs the pinned ones. Note: this commit is unsigned (the signing key's passphrase is not available to the session); amend to sign if the fork's history requires it. --------- Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai> --------- Co-authored-by: Mistral Vibe <vibe@mistral.ai> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

…PR (#141) ## What this changes #124 grouped every frontend update, and with nothing requiring the checks it merged five framework majors -- React 18->19, vite 6->8, TypeScript 5->7, react-router-dom 6->7, plotly 2->4 -- in one PR, with `tsc` already red until #140 repaired it. A major is a migration, not an update: it must carry its own review and its own CI run. Both update groups (`frontend`, `github-actions` -- checkout v4.4.0 -> v7.0.1 came through #123 the same way) now name `update-types: ["minor", "patch"]` only. A Dependabot update matching no group opens its own PR, so majors arrive one at a time; minor and patch still batch weekly as before, so the noise stays low. A new testset in `test/unit/test_install_pins.jl` pins the shape -- both ecosystems declared, the frontend on `bun`, and no group whose `update-types` admit `major` -- so a future group cannot silently go back to batching majors. This is the same defence-in-depth the file already applies to workflow pins: the config asserts the policy, and the policy is enforced at the door. ## How to run its tests From the repository root: ``` julia --project=. test/unit/test_install_pins.jl ``` All testsets pass locally (223 prior assertions plus the new 9). ## What this leaves out No `open-pull-requests-limit` or other throttles: with majors unbatched the default limit of 5 per ecosystem keeps the queue bounded, and the first runs under this config (#123/#124) showed the volume is small. No change to security updates, which follow their own path. ## Versions tested Julia 1.13.1 locally (CI pins 1.12.5). No other tool touched. Note: the commit is unsigned (the signing key's passphrase is unavailable to the session); amend to sign if required. --------- Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

… entirely The first slice of the R-to-Julia migration's precursor (#36): dplyr and tibble appear in our code only to assemble the taxonomy CSVs -- four left_joins, one rownames_to_column, two library() calls -- and renv's discovery manifest names both. All seven sites are now base R: - base_left_join() replaces dplyr::left_join, restoring both things merge() alone would not give: x's row order (sort = FALSE) and x's column order (rebuilt from x's columns plus y's non-key ones), so the written CSVs stay byte-for-byte identical -- CI's oracle. - data.frame(Sequence = rownames(seq_t), seq_t, row.names = NULL) replaces tibble::rownames_to_column, same leading column, row names dropped. - the discovery manifest (R/_renv_dependencies.R) no longer names either package, so renv::snapshot() will not re-record them. renv.lock loses the dplyr record: nothing in the real dependency graph imports it (dada2, vegan, MASS and zCompositions none of them do). tibble's record STAYS: dada2 -> ggplot2 -> tibble is dada2's own dependency chain, independent of our code, and removing tibble would break the lock's restore -- the corrected measurement is recorded on issue #36. Verified: renv.lock parses (84 packages) with dplyr gone and tibble/ggplot2 retained, and test_install_pins.jl passes 208/208. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

## Summary Adds `proofs/agda/MetaManifold/Permanova.agda`: machine-checked proofs of the two things `run_permanova` in `src/analysis/analysis.jl` decides for itself rather than taking from vegan — the reported `min_p_value` (the `1/(B+1)` floor, never raised by more permutations, and attained) and which terms have their p-value withheld (`_varies_within_any_block`, exactly when no within-block permutation exchanges the term's labels). With the import in `All.agda` (so the axiom audit reaches it), the README's PERMANOVA section and theorem-to-code map entries, and the Agda CI job's comment. The Julia side this branch originally carried (the CLR method chain, the vsearch helper, the server entry-point tests) reached main refined through the upstream syncs — as #112, #113 and the occupancy line — so nothing of it is re-landed here. ## Branch repair The branch as first opened was built on upstream's history and carried three superseded commits, so it was `CONFLICTING` against main — which is also why no workflow posted a check: with no merge ref, GitHub cannot start a `pull_request` workflow at all, and only the external scanners ran. The branch is now a single commit rebased onto current main; every content change is byte-identical to the original rebase commit (`e9bb4e2`, whose conflict resolution already kept main's side of every touched file — both sides were identical, so the diff applies clean). ## Type of change - [ ] 🐛 Bug fix (non-breaking change that fixes an issue) - [ ] ✨ New feature (non-breaking change that adds functionality) - [ ] 💥 Breaking change (would change existing behaviour) - [ ] 🕳️ Soundness fix (fixes a checker/proof false-negative) - [ ] 📖 Documentation - [ ] 🧹 Refactor / tech debt (behaviour-preserving) - [ ] ⚡ Performance - [x] 🔧 Build / CI / tooling (a new machine-checked proof module and its CI wiring; no runtime code changes) ## How has this been verified? - CI on this PR: the **Agda proofs** job type-checks `MetaManifold/All.agda` (which now imports Permanova) with the pinned Agda 2.6.4.3 + agda-stdlib 2.1, and the **Julia tests** job runs the full unit suite including `test/unit/test_permanova.jl`, the code the theorems model. - The proof file is byte-identical to `e9bb4e2`'s, whose theorems were checked there; the only re-applied deltas are the `All.agda` import, the README entries and the ci.yml comment, each applied mechanically from that commit's diff. ## Checklist - [ ] My commits are **signed** (`git commit -S`). — the signing key's passphrase was not available in the session that produced this commit - [x] I ran the project's own checks/tests locally and they pass. — the Julia pin tests and root-shape suite pass locally; the Agda type-check is CI's pinned toolchain, which is authoritative here - [x] New files carry the correct `SPDX-License-Identifier` (code/config `MPL-2.0`, prose `CC-BY-SA-4.0`); I did not relicense existing files. — `Permanova.agda` carries `AGPL-3.0-only`, matching every other file under `proofs/agda/` - [x] Docs are updated, and no public claim now overstates what the code does. — the proofs README gains the PERMANOVA section and theorem-to-code map entries - [x] I have not introduced a soundness hole (or I have flagged where I might have). — no postulates, no holes; `--safe --without-K` as everywhere else in the tree ## Notes for reviewers Nothing here changes runtime behaviour; the risk surface is the Agda job's type-check and the axiom audit. If this unit is later proposed upstream, it should be re-cut fresh from upstream `main` per the absorption register's runbook, not replayed from this fork branch. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

… community files (#143) ## What this changes Three things a newcomer meets before any code (replaces the wedged #133, whose head got stuck at the base commit during branch cleanup; same branch, same change, clean start): 1. **A Documentation section in the README** pointing at the wiki in [metadatastician/MetaManifold-Evidence, under `docs/wikis/`](https://github.com/metadatastician/MetaManifold-Evidence/tree/main/docs/wikis) -- the longer documentation for users, maintainers, developers and theorists, with a Home page entry point. 2. **A Differential Abundance section in the README**, documenting the tab end to end: the two-condition selection (exactly two runs or pooled-run sub-groups, the first as reference so a positive fold change means more abundant in the second), the rank list showing only ranks the selected runs share, aggregation making a pooled run one condition, and then the statistics as the code runs them -- counts summed per taxon at the chosen rank with nameless rows pooled as `Unclassified` after the read-count bounds and any applicable `analysis.exclude_categories`; each taxon fitted with its own negative-binomial GLM `MASS::glm.nb(y ~ group + offset(log(size factor)))` on raw integer counts, no pseudocounts; a Wald test on the group coefficient; Benjamini-Hochberg over the taxa that produced a p-value; size factors from the whole matrix, centred. Cross-references the existing `Configuring analysis` anchor for the settings, and names the code (`src/analysis/differential.jl`) and the route. 3. **The community files**: a bug report and a feature request issue template (both telling reporters to search existing issues first, and to raise a fork's own issues on that fork), a pull request template carrying the PR checklist, and the Contributor Covenant code of conduct. Per this fork's root-shape doctrine the code of conduct lives under `.github/` with `CONTRIBUTING.md` -- the root keeps only authority files and entry points, and `test/unit/test_install_pins.jl`'s bidirectional root check stays green without touching its allowlist. ## How to run its tests Documentation and `.github/` convention files; no code changes. Verified locally on a branch cut from the current `main` tip (`655c4da`, i.e. including the merged occupancy gate): ``` julia --project=. test/unit/test_install_pins.jl # 223/223, root shape 23/23 ``` Every file and anchor the new sections reference exists (`src/analysis/differential.jl`, the `analysis:` settings in `pipeline.yml`, the `Configuring analysis` heading at line 623 that the cross-reference at line 271 points at, this fork's `scripts/install.jl` path untouched), and the templates are the issue-form YAML GitHub expects. ## What this leaves out No changes to any workflow, so nothing for the occupancy gate or the action allow-list to weigh. The commit is unsigned (the signing key's passphrase is unavailable to the session that produced it); amend to sign if required. This same change is also proposed upstream as JoshuaJewell#47, with the one fork-specific difference noted above (the code of conduct's location). ## Versions tested Julia 1.13.1 locally (CI pins 1.12.5). Nothing else touched. --------- Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

The base-R CSV assembly (this PR) removes dplyr from renv.lock, which renv::restore() then no longer installs -- and the two hardcoded checks that still named it failed the run: the install step's verification list (stop(pkg, " failed to install")) and the RCall visibility check. Both now drop dplyr. tibble stays in both the lock and the RCall check: it is dada2's own dependency (via ggplot2), not ours, and remains installed. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

Recorded at the point of failure, for whoever edits either list next: restore() installs only what the lock records, so a package removed from the lock fails these checks at verification, nowhere near the code that stopped using it -- exactly what happened to dplyr in this PR. Any lock change must grep ci.yml for the package name and update both lists in the same commit. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

…ings in the README (#145) ## What this changes Both CodeRabbit findings from #143, accepted; the PR merged before the fixes could ride on it, so they land here. 1. **Bug report form** (`bug_report.yml`) — the R and browser version fields were required from everyone. A command-line reporter has no browser to name, and a web-interface reporter often cannot know the server's R version, so both forced placeholder answers. They are now optional, each saying when it applies; Julia stays required, since every reporter runs the Julia server. 2. **README differential-abundance section** — it described only the default `nb_glm` method and listed only `offset` and `min_prevalence`, presenting the analysis as NB-only. It now documents `method` and `replacement_delta`, notes `offset` applies to `nb_glm` only, and states `clr_welch`'s effect as a CLR difference, not a fold change. Wording follows `config/defaults/pipeline.yml`'s own comments for the same keys. The identical commit is also on `upstream/docs-community` (upstream PR JoshuaJewell#56), so the two copies stay in step. ## Verification Docs-only; no code path changes. The form renders in GitHub's template preview; the README section matches the config keys enumerated in `config/defaults/pipeline.yml` and the `DifferentialConfig` contract in `src/analysis/differential.jl`. ## Notes The commit is unsigned — the signing key's passphrase was not available in the session that produced it. The LanguageTool "loose punctuation" notes from the same review are not acted on: they flag the README's standard markdown list formatting, which the whole file uses. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

…, and the security contact update (#157) ## What this changes Four of the five root-tidy offers, completing the RSR scheme at the repository root: - **`Justfile`** — thin, per the doctrine; every recipe delegates to the repo's own documented entry points (`install.sh`, `start.sh`, the test runner, the frontend's package scripts, the axiom audit). Nothing is defined twice. - **`CHANGELOG.md`** — the root index; release notes stay in `docs/release-notes/` and each release adds a line here in the same commit. - **`.editorconfig`** — 4 spaces Julia, 2 spaces frontend/YAML, final newlines, no trailing whitespace (markdown exempted — two trailing spaces are a hard break). The blanket dotfile ignore gains `!.editorconfig` beside `!.Rprofile`. - **`launcher.sh`** — the launcher-standard 0.6.0 mode vocabulary (`--setup --start --doctor --status --agent --help --version`), hand-adapted for an application repo rather than provision-set-minted, with a praxis-deed header. Its own addition is **`--agent`**: the operator's choice for git-signing agent persistence, all modes reversible — - `--agent systemd` — a systemd user service owns the agent, and the profile *exports* the socket (a service cannot export into login shells); survives reboots, one instance; - `--agent profile` — a marked profile block starts the agent if the socket is dead and exports it; no systemd, works over plain ssh; - `--agent both`, `--agent none`, `--agent status`. - Profile edits are marked-block, idempotent, and backed up; `--doctor` reports the toolchain plus the signing state. - **`SECURITY.md`** — the general-security contact becomes **developer@joshuajewell.dev** (the mathematical-foundations contact stays j.d.a.jewell@open.ac.uk). The **root-shape allowlist** gains all four entries in the same commit, per its own rule. The fifth offer — merging `install.sh`/`start.sh` into the launcher — is deliberately not taken: they are the README's documented entry points and upstream parity; the launcher wraps them without replacing them. ## Verification Pin suite 263/263 (the root-shape guard reads the tracked tree, so the entries land and the guard updates together). `bash -n` on the launcher; its `--version`/`--agent status`/`--doctor` modes exercised live against this machine. The launcher's doctor correctly reported the machine's actual state (R absent from PATH without the conda prefix, `config/tools.yml` absent without a full install, the signing socket it manages distinct from the currently-live one). ## Notes The commit is signed. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai> --------- Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: Mistral Vibe <vibe@mistral.ai> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

…n-jcs; the KYAML ratchet (#159) ## What this adds **`MetaManifold.Canonical`** — `jcs_bytes(x)` and `jcs_sha256(x)`: the deterministic byte form of a JSON-shaped value for hashing, signing and content-addressing, per RFC 8785. Object keys sort by UTF-16 code unit (an astral-plane key sorts *before* a high-BMP key — the trap naive code-point ordering misses); Float64 values serialize per ECMAScript's `Number::toString` (shortest round-trip digits, positional between 1e-6 and 1e21, a *signed* exponent outside it, `-0.0` collapsing to `0`); integers outside I-JSON's exact range and NaN/Inf are refused, as no consumer reads them back as the same value. **The oracle is the estate's own `ijson-jcs` crate** (Rust, RFC 7493 + RFC 8785): the eleven cases in `test/fixtures/jcs_oracle.jsonl` were *produced by that crate*, and `test_canonical.jl` asserts this implementation reproduces every one byte-for-byte — the ES number table (`4.50`→`4.5`, `2.4499999999999998e16`→`24500000000000000`, `1e30`→`1e+30`, `1e-6`→`0.000001`, `1e-7`→`1e-7`, `1e20` positional but `1e21` exponential, subnormals, `-0.0`→`0`), string escaping, and the astral-sort case. Plus hand-written testsets for key-order irrelevance, the refusals, and the content-address property. **KYAML (YAML-POLICY Y-3):** the standards repo's `kyaml-format.sh` is adopted verbatim, and a ratchet testset runs it `--check` over every tracked `*.kyaml`. Per D280/D307: tool-named files keep their extensions, and the shared config defaults convert as an **upstream unit**, not unilaterally — this repo's YAML is upstream-shared or tool-named, and the policy calls unconverted files backlog, not violations. This is the first slice of the ijson-jcs adoption: the writer and the differential-oracle verification. Wiring canonical hashes into `attestation.yml` and the analysis routes is deliberately **not** here — those are upstream-shared files and deserve upstream discussion first. ## Verification - Full local run before the split: 22/22 in `test_canonical.jl`, 285/285 with the pin suite. - The module standalone (this session's local R toolchain expired before this PR was cut): all 11 oracle cases byte-identical, astral case OK, content-address hash computed — CI's `Julia tests` (which installs the pinned R) is the full-suite authority. ## Notes This is #158 rebuilt on `main`: #157's merge auto-closed the stacked original, and the single commit's tree is byte-identical to it. The commit is unsigned — the shared signing agent died mid-session (the fragility the launcher's `--agent` mode exists to fix; its `ssh-add` step needs the passphrase interactively). Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

@claude

## 🤖 Installing Claude Code GitHub App This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository. ### What is Claude Code? [Claude Code](https://claude.com/claude-code) is an AI coding agent that can help with: - Bug fixes and improvements - Documentation updates - Implementing new features - Code reviews and suggestions - Writing tests - And more! ### How it works Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment. Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action. ### Important Notes - **This workflow won't take effect until this PR is merged** - **@claude mentions won't work until after the merge is complete** - The workflow runs automatically whenever Claude is mentioned in PR or issue comments - Claude gets access to the entire PR or issue context including files, diffs, and previous comments ### Security - Our Anthropic API key is securely stored as a GitHub Actions secret - Only users with write access to the repository can trigger the workflow - All Claude runs are stored in the GitHub Actions run history - Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits. - We can add more allowed tools by adding them to the workflow file like: ``` allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test) ``` There's more information in the [Claude Code action repo](https://github.com/anthropics/claude-code-action). After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

## Summary  Closes # ## Type of change - [ ] 🐛 Bug fix (non-breaking change that fixes an issue) - [ ] ✨ New feature (non-breaking change that adds functionality) - [ ] 💥 Breaking change (would change existing behaviour, a config key or an API response) - [ ] 📊 Statistics fix (a method returned a wrong number, or a result it could not support) - [ ] 📖 Documentation - [ ] 🧹 Refactor / tech debt (behaviour-preserving) - [ ] ⚡ Performance - [ ] 🔧 Build / CI / tooling ## How has this been verified?  Tested with Julia `…`, R `…` and bun `…`. ## What this leaves out  ## Checklist - [ ] My branch starts at the current tip of `main` (`behind_by` is `0`; see CONTRIBUTING.md) and has no merge commits from `main`. - [ ] I ran `julia --project=. test/runtests.jl` (and `cd frontend && bun run test` for frontend changes) and they pass. - [ ] CI ran on this PR and passes. - [ ] No generated or vendored files, and no lockfile change the work does not need (or the reason is given above). - [ ] New code is AGPL-3.0, or MPL-2.0 with an SPDX identifier in each file I wrote. I left existing file headers, `LICENSE`, `CITATION.cff` and the licence and acknowledgement sections of `README.md` unchanged. - [ ] Every number shown to a user is computed from their data. When a method cannot run it raises an explicit error. - [ ] Docs are updated, and no claim in them overstates what the code does. ## Notes for reviewers  --------- Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

…CI changes 13 conflicted files. Fork main's versions win everywhere except the R-package lists: per the fork's sync policy (#120), its CI pinning, docstrings, occupancy work and tests are the evolved line, and the branch's older upstream state is superseded. Re-applied on top: dplyr removed from both hardcoded lists (renv.lock no longer installs it) and the comments documenting the renv.lock coupling. The net diff against main is the dada2 base-R refactor (renv.lock, dada2_functions.r, R/_renv_dependencies.R), the CI list updates, and upstream's vsearch entry-point test not yet absorbed. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

…restoring test configs

## Summary  Closes # ## Type of change - [ ] 🐛 Bug fix (non-breaking change that fixes an issue) - [ ] ✨ New feature (non-breaking change that adds functionality) - [ ] 💥 Breaking change (would change existing behaviour, a config key or an API response) - [ ] 📊 Statistics fix (a method returned a wrong number, or a result it could not support) - [ ] 📖 Documentation - [ ] 🧹 Refactor / tech debt (behaviour-preserving) - [ ] ⚡ Performance - [ ] 🔧 Build / CI / tooling ## How has this been verified?  Tested with Julia `…`, R `…` and bun `…`. ## What this leaves out  ## Checklist - [ ] My branch starts at the current tip of `main` (`behind_by` is `0`; see CONTRIBUTING.md) and has no merge commits from `main`. - [ ] I ran `julia --project=. test/runtests.jl` (and `cd frontend && bun run test` for frontend changes) and they pass. - [ ] CI ran on this PR and passes. - [ ] No generated or vendored files, and no lockfile change the work does not need (or the reason is given above). - [ ] New code is AGPL-3.0, or MPL-2.0 with an SPDX identifier in each file I wrote. I left existing file headers, `LICENSE`, `CITATION.cff` and the licence and acknowledgement sections of `README.md` unchanged. - [ ] Every number shown to a user is computed from their data. When a method cannot run it raises an explicit error. - [ ] Docs are updated, and no claim in them overstates what the code does. ## Notes for reviewers  --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Joshua Jewell <developer@joshuajewell.dev> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>

## Summary  Closes # ## Type of change - [ ] 🐛 Bug fix (non-breaking change that fixes an issue) - [ ] ✨ New feature (non-breaking change that adds functionality) - [ ] 💥 Breaking change (would change existing behaviour, a config key or an API response) - [ ] 📊 Statistics fix (a method returned a wrong number, or a result it could not support) - [ ] 📖 Documentation - [ ] 🧹 Refactor / tech debt (behaviour-preserving) - [ ] ⚡ Performance - [ ] 🔧 Build / CI / tooling ## How has this been verified?  Tested with Julia `…`, R `…` and bun `…`. ## What this leaves out  ## Checklist - [ ] My branch starts at the current tip of `main` (`behind_by` is `0`; see CONTRIBUTING.md) and has no merge commits from `main`. - [ ] I ran `julia --project=. test/runtests.jl` (and `cd frontend && bun run test` for frontend changes) and they pass. - [ ] CI ran on this PR and passes. - [ ] No generated or vendored files, and no lockfile change the work does not need (or the reason is given above). - [ ] New code is AGPL-3.0, or MPL-2.0 with an SPDX identifier in each file I wrote. I left existing file headers, `LICENSE`, `CITATION.cff` and the licence and acknowledgement sections of `README.md` unchanged. - [ ] Every number shown to a user is computed from their data. When a method cannot run it raises an explicit error. - [ ] Docs are updated, and no claim in them overstates what the code does. ## Notes for reviewers  --------- Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Joshua Jewell <developer@joshuajewell.dev> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> Co-authored-by: Mistral Vibe <vibe@mistral.ai> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

## Summary  Closes # ## Type of change - [ ] 🐛 Bug fix (non-breaking change that fixes an issue) - [ ] ✨ New feature (non-breaking change that adds functionality) - [ ] 💥 Breaking change (would change existing behaviour, a config key or an API response) - [ ] 📊 Statistics fix (a method returned a wrong number, or a result it could not support) - [ ] 📖 Documentation - [ ] 🧹 Refactor / tech debt (behaviour-preserving) - [ ] ⚡ Performance - [ ] 🔧 Build / CI / tooling ## How has this been verified?  Tested with Julia `…`, R `…` and bun `…`. ## What this leaves out  ## Checklist - [ ] My branch starts at the current tip of `main` (`behind_by` is `0`; see CONTRIBUTING.md) and has no merge commits from `main`. - [ ] I ran `julia --project=. test/runtests.jl` (and `cd frontend && bun run test` for frontend changes) and they pass. - [ ] CI ran on this PR and passes. - [ ] No generated or vendored files, and no lockfile change the work does not need (or the reason is given above). - [ ] New code is AGPL-3.0, or MPL-2.0 with an SPDX identifier in each file I wrote. I left existing file headers, `LICENSE`, `CITATION.cff` and the licence and acknowledgement sections of `README.md` unchanged. - [ ] Every number shown to a user is computed from their data. When a method cannot run it raises an explicit error. - [ ] Docs are updated, and no claim in them overstates what the code does. ## Notes for reviewers  --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Joshua Jewell <developer@joshuajewell.dev> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

## Summary  Closes # ## Type of change - [ ] 🐛 Bug fix (non-breaking change that fixes an issue) - [ ] ✨ New feature (non-breaking change that adds functionality) - [ ] 💥 Breaking change (would change existing behaviour, a config key or an API response) - [ ] 📊 Statistics fix (a method returned a wrong number, or a result it could not support) - [ ] 📖 Documentation - [ ] 🧹 Refactor / tech debt (behaviour-preserving) - [ ] ⚡ Performance - [ ] 🔧 Build / CI / tooling ## How has this been verified?  Tested with Julia `…`, R `…` and bun `…`. ## What this leaves out  ## Checklist - [ ] My branch starts at the current tip of `main` (`behind_by` is `0`; see CONTRIBUTING.md) and has no merge commits from `main`. - [ ] I ran `julia --project=. test/runtests.jl` (and `cd frontend && bun run test` for frontend changes) and they pass. - [ ] CI ran on this PR and passes. - [ ] No generated or vendored files, and no lockfile change the work does not need (or the reason is given above). - [ ] New code is AGPL-3.0, or MPL-2.0 with an SPDX identifier in each file I wrote. I left existing file headers, `LICENSE`, `CITATION.cff` and the licence and acknowledgement sections of `README.md` unchanged. - [ ] Every number shown to a user is computed from their data. When a method cannot run it raises an explicit error. - [ ] Docs are updated, and no claim in them overstates what the code does. ## Notes for reviewers  --------- Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Joshua Jewell <developer@joshuajewell.dev> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

## Summary  Closes # ## Type of change - [ ] 🐛 Bug fix (non-breaking change that fixes an issue) - [ ] ✨ New feature (non-breaking change that adds functionality) - [ ] 💥 Breaking change (would change existing behaviour, a config key or an API response) - [ ] 📊 Statistics fix (a method returned a wrong number, or a result it could not support) - [ ] 📖 Documentation - [ ] 🧹 Refactor / tech debt (behaviour-preserving) - [ ] ⚡ Performance - [ ] 🔧 Build / CI / tooling ## How has this been verified?  Tested with Julia `…`, R `…` and bun `…`. ## What this leaves out  ## Checklist - [ ] My branch starts at the current tip of `main` (`behind_by` is `0`; see CONTRIBUTING.md) and has no merge commits from `main`. - [ ] I ran `julia --project=. test/runtests.jl` (and `cd frontend && bun run test` for frontend changes) and they pass. - [ ] CI ran on this PR and passes. - [ ] No generated or vendored files, and no lockfile change the work does not need (or the reason is given above). - [ ] New code is AGPL-3.0, or MPL-2.0 with an SPDX identifier in each file I wrote. I left existing file headers, `LICENSE`, `CITATION.cff` and the licence and acknowledgement sections of `README.md` unchanged. - [ ] Every number shown to a user is computed from their data. When a method cannot run it raises an explicit error. - [ ] Docs are updated, and no claim in them overstates what the code does. ## Notes for reviewers  --------- Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Joshua Jewell <developer@joshuajewell.dev> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> Co-authored-by: Mistral Vibe <vibe@mistral.ai> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

## Summary  Closes # ## Type of change - [ ] 🐛 Bug fix (non-breaking change that fixes an issue) - [ ] ✨ New feature (non-breaking change that adds functionality) - [ ] 💥 Breaking change (would change existing behaviour, a config key or an API response) - [ ] 📊 Statistics fix (a method returned a wrong number, or a result it could not support) - [ ] 📖 Documentation - [ ] 🧹 Refactor / tech debt (behaviour-preserving) - [ ] ⚡ Performance - [ ] 🔧 Build / CI / tooling ## How has this been verified?  Tested with Julia `…`, R `…` and bun `…`. ## What this leaves out  ## Checklist - [ ] My branch starts at the current tip of `main` (`behind_by` is `0`; see CONTRIBUTING.md) and has no merge commits from `main`. - [ ] I ran `julia --project=. test/runtests.jl` (and `cd frontend && bun run test` for frontend changes) and they pass. - [ ] CI ran on this PR and passes. - [ ] No generated or vendored files, and no lockfile change the work does not need (or the reason is given above). - [ ] New code is AGPL-3.0, or MPL-2.0 with an SPDX identifier in each file I wrote. I left existing file headers, `LICENSE`, `CITATION.cff` and the licence and acknowledgement sections of `README.md` unchanged. - [ ] Every number shown to a user is computed from their data. When a method cannot run it raises an explicit error. - [ ] Docs are updated, and no claim in them overstates what the code does. ## Notes for reviewers  --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Joshua Jewell <developer@joshuajewell.dev> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

## Summary  Closes # ## Type of change - [ ] 🐛 Bug fix (non-breaking change that fixes an issue) - [ ] ✨ New feature (non-breaking change that adds functionality) - [ ] 💥 Breaking change (would change existing behaviour, a config key or an API response) - [ ] 📊 Statistics fix (a method returned a wrong number, or a result it could not support) - [ ] 📖 Documentation - [ ] 🧹 Refactor / tech debt (behaviour-preserving) - [ ] ⚡ Performance - [ ] 🔧 Build / CI / tooling ## How has this been verified?  Tested with Julia `…`, R `…` and bun `…`. ## What this leaves out  ## Checklist - [ ] My branch starts at the current tip of `main` (`behind_by` is `0`; see CONTRIBUTING.md) and has no merge commits from `main`. - [ ] I ran `julia --project=. test/runtests.jl` (and `cd frontend && bun run test` for frontend changes) and they pass. - [ ] CI ran on this PR and passes. - [ ] No generated or vendored files, and no lockfile change the work does not need (or the reason is given above). - [ ] New code is AGPL-3.0, or MPL-2.0 with an SPDX identifier in each file I wrote. I left existing file headers, `LICENSE`, `CITATION.cff` and the licence and acknowledgement sections of `README.md` unchanged. - [ ] Every number shown to a user is computed from their data. When a method cannot run it raises an explicit error. - [ ] Docs are updated, and no claim in them overstates what the code does. ## Notes for reviewers  --------- Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Joshua Jewell <developer@joshuajewell.dev> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

## Summary  Closes # ## Type of change - [ ] 🐛 Bug fix (non-breaking change that fixes an issue) - [ ] ✨ New feature (non-breaking change that adds functionality) - [ ] 💥 Breaking change (would change existing behaviour, a config key or an API response) - [ ] 📊 Statistics fix (a method returned a wrong number, or a result it could not support) - [ ] 📖 Documentation - [ ] 🧹 Refactor / tech debt (behaviour-preserving) - [ ] ⚡ Performance - [ ] 🔧 Build / CI / tooling ## How has this been verified?  Tested with Julia `…`, R `…` and bun `…`. ## What this leaves out  ## Checklist - [ ] My branch starts at the current tip of `main` (`behind_by` is `0`; see CONTRIBUTING.md) and has no merge commits from `main`. - [ ] I ran `julia --project=. test/runtests.jl` (and `cd frontend && bun run test` for frontend changes) and they pass. - [ ] CI ran on this PR and passes. - [ ] No generated or vendored files, and no lockfile change the work does not need (or the reason is given above). - [ ] New code is AGPL-3.0, or MPL-2.0 with an SPDX identifier in each file I wrote. I left existing file headers, `LICENSE`, `CITATION.cff` and the licence and acknowledgement sections of `README.md` unchanged. - [ ] Every number shown to a user is computed from their data. When a method cannot run it raises an explicit error. - [ ] Docs are updated, and no claim in them overstates what the code does. ## Notes for reviewers  --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Joshua Jewell <developer@joshuajewell.dev> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

## Summary  Closes # ## Type of change - [ ] 🐛 Bug fix (non-breaking change that fixes an issue) - [ ] ✨ New feature (non-breaking change that adds functionality) - [ ] 💥 Breaking change (would change existing behaviour, a config key or an API response) - [ ] 📊 Statistics fix (a method returned a wrong number, or a result it could not support) - [ ] 📖 Documentation - [ ] 🧹 Refactor / tech debt (behaviour-preserving) - [ ] ⚡ Performance - [ ] 🔧 Build / CI / tooling ## How has this been verified?  Tested with Julia `…`, R `…` and bun `…`. ## What this leaves out  ## Checklist - [ ] My branch starts at the current tip of `main` (`behind_by` is `0`; see CONTRIBUTING.md) and has no merge commits from `main`. - [ ] I ran `julia --project=. test/runtests.jl` (and `cd frontend && bun run test` for frontend changes) and they pass. - [ ] CI ran on this PR and passes. - [ ] No generated or vendored files, and no lockfile change the work does not need (or the reason is given above). - [ ] New code is AGPL-3.0, or MPL-2.0 with an SPDX identifier in each file I wrote. I left existing file headers, `LICENSE`, `CITATION.cff` and the licence and acknowledgement sections of `README.md` unchanged. - [ ] Every number shown to a user is computed from their data. When a method cannot run it raises an explicit error. - [ ] Docs are updated, and no claim in them overstates what the code does. ## Notes for reviewers  --------- Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Joshua Jewell <developer@joshuajewell.dev> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> Co-authored-by: Mistral Vibe <vibe@mistral.ai> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

## Summary  Closes # ## Type of change - [ ] 🐛 Bug fix (non-breaking change that fixes an issue) - [ ] ✨ New feature (non-breaking change that adds functionality) - [ ] 💥 Breaking change (would change existing behaviour, a config key or an API response) - [ ] 📊 Statistics fix (a method returned a wrong number, or a result it could not support) - [ ] 📖 Documentation - [ ] 🧹 Refactor / tech debt (behaviour-preserving) - [ ] ⚡ Performance - [ ] 🔧 Build / CI / tooling ## How has this been verified?  Tested with Julia `…`, R `…` and bun `…`. ## What this leaves out  ## Checklist - [ ] My branch starts at the current tip of `main` (`behind_by` is `0`; see CONTRIBUTING.md) and has no merge commits from `main`. - [ ] I ran `julia --project=. test/runtests.jl` (and `cd frontend && bun run test` for frontend changes) and they pass. - [ ] CI ran on this PR and passes. - [ ] No generated or vendored files, and no lockfile change the work does not need (or the reason is given above). - [ ] New code is AGPL-3.0, or MPL-2.0 with an SPDX identifier in each file I wrote. I left existing file headers, `LICENSE`, `CITATION.cff` and the licence and acknowledgement sections of `README.md` unchanged. - [ ] Every number shown to a user is computed from their data. When a method cannot run it raises an explicit error. - [ ] Docs are updated, and no claim in them overstates what the code does. ## Notes for reviewers  --------- Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Joshua Jewell <developer@joshuajewell.dev> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

## Summary  Closes # ## Type of change - [ ] 🐛 Bug fix (non-breaking change that fixes an issue) - [ ] ✨ New feature (non-breaking change that adds functionality) - [ ] 💥 Breaking change (would change existing behaviour, a config key or an API response) - [ ] 📊 Statistics fix (a method returned a wrong number, or a result it could not support) - [ ] 📖 Documentation - [ ] 🧹 Refactor / tech debt (behaviour-preserving) - [ ] ⚡ Performance - [ ] 🔧 Build / CI / tooling ## How has this been verified?  Tested with Julia `…`, R `…` and bun `…`. ## What this leaves out  ## Checklist - [ ] My branch starts at the current tip of `main` (`behind_by` is `0`; see CONTRIBUTING.md) and has no merge commits from `main`. - [ ] I ran `julia --project=. test/runtests.jl` (and `cd frontend && bun run test` for frontend changes) and they pass. - [ ] CI ran on this PR and passes. - [ ] No generated or vendored files, and no lockfile change the work does not need (or the reason is given above). - [ ] New code is AGPL-3.0, or MPL-2.0 with an SPDX identifier in each file I wrote. I left existing file headers, `LICENSE`, `CITATION.cff` and the licence and acknowledgement sections of `README.md` unchanged. - [ ] Every number shown to a user is computed from their data. When a method cannot run it raises an explicit error. - [ ] Docs are updated, and no claim in them overstates what the code does. ## Notes for reviewers  --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Joshua Jewell <developer@joshuajewell.dev> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> Co-authored-by: Mistral Vibe <vibe@mistral.ai>

JoshuaJewell · 2026-10-16T21:53:58Z

Same branch problem as #55 and #56. Please reset upstream/dada2-base-r onto bcf52af with only these:

e7ce7c9, aef7522, 5089bf7
the dada2_functions.r part of 64161b6. merge(..., sort = FALSE) doesn't keep x's row order (R leaves it unspecified), so without the position column the byte-for-byte CSV claim isn't guaranteed. Leave out its test_pipeline.jl half, which is for the fork-only occupancy test.

One thing is still missing: install.jl still checks that dplyr is installed, please drop these checks.

hyperpolymath · 2026-10-16T22:15:34Z

@CodeRabbit please second opinion this using seam-architect

hyperpolymath · 2026-10-17T03:27:31Z

Thanks, Joshua — both the row-order point and the missing installer change were correct. I withdrew this branch and rebuilt the change as #61 directly on this repository’s main (52feb605). It explicitly restores left-row and right-match order, removes dplyr from both CI checks and both installer checks, and excludes the fork-only test_pipeline.jl change.

The initial replacement passed full CI, including new exact-output fixtures for the five CSVs. Subsequent review found a suffix-collision case and a tibble discovery inconsistency. These are fixed in d9ea982: unique internal names protect the merged values, repeated suffixing handles sample names such as Species.x, and the tibble discovery marker remains while the installer and CI require it. The new collision regression failed before the fix and passes after it, alongside the existing fixtures, under WebR/R 4.6.0. #61 is back in draft pending CI on that follow-up; the earlier green run is not being presented as validation of the new commit.

hyperpolymath and others added 25 commits October 14, 2026 02:45

hyperpolymath mentioned this pull request Oct 15, 2026

docs(repo): AGENTS.md, recording the traps that are invisible until they bite hyperpolymath/MetaManifold-WebUI#146

Merged

hyperpolymath and others added 2 commits October 15, 2026 09:51

hyperpolymath added this to MetaManifold Work Board Oct 15, 2026

github-project-automation Bot moved this to Todo in MetaManifold Work Board Oct 15, 2026

hyperpolymath mentioned this pull request Oct 15, 2026

Sequencing: the fork is holding its next sync until your verdicts land — no rush, just making the state visible #58

Closed

hyperpolymath and others added 23 commits October 15, 2026 16:55

Fix DADA2 join row ordering and exercise queued vsearch stages while …

64161b6

…restoring test configs

Merge branch 'main' into upstream/dada2-base-r

c2359d0

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>

Merge branch 'main' into upstream/dada2-base-r

79f0f66

Merge branch 'main' into upstream/dada2-base-r

07f8233

Merge branch 'main' into upstream/dada2-base-r

4bfeaea

Merge branch 'main' into upstream/dada2-base-r

a767476

hyperpolymath closed this Oct 16, 2026

github-project-automation Bot moved this from In Progress to Done in MetaManifold Work Board Oct 16, 2026

hyperpolymath mentioned this pull request Oct 16, 2026

refactor(dada2): use base R for taxonomy CSV assembly #61

Merged

Navigation Menu

Repository navigation

refactor(dada2): assemble the taxonomy CSVs in base R, dropping dplyr entirely - #57

refactor(dada2): assemble the taxonomy CSVs in base R, dropping dplyr entirely#57
hyperpolymath wants to merge 55 commits into
JoshuaJewell:mainfrom
hyperpolymath:upstream/dada2-base-r

hyperpolymath commented Oct 15, 2026 •

edited

Loading

Uh oh!

JoshuaJewell commented Oct 16, 2026

Uh oh!

hyperpolymath commented Oct 16, 2026

Uh oh!

hyperpolymath commented Oct 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

hyperpolymath commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this does

Scope

How to run the tests

Versions tested against

Related

Uh oh!

JoshuaJewell commented Oct 16, 2026

Uh oh!

hyperpolymath commented Oct 16, 2026

Uh oh!

hyperpolymath commented Oct 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

hyperpolymath commented Oct 15, 2026 •

edited

Loading