[Oionos]

Increment 10: performance and operations

Changes

• Measured mobile startup, deferred remote wallet initialization/chart loading and optional diagnostics; preserved persisted-wallet reconnect.
• Private error/route metrics with release/environment labels; all replay disabled. Bounded API/SSE health counters, heartbeat detection, retries and visibility cleanup.
• Scheduled read-only operations checks for both existing APIs, incident runbook, backup/ownership guidance and a read-only coordinated migration-window preflight.
• OpenAPI and client types updated. No DDL; schema remains e93a107bd624. Production indexing stays disabled. No paid resource or notification recipient added.

Measured evidence

Three cold-cache mobile Lighthouse samples per build, identical frozen fixtures/browser/gzip/throttling: median LCP 11.33→5.37 seconds, transfer 1,671,523→660,866 bytes, initial JS gzip 1,226,486→383,058 bytes; performance 47→61, TBT 463→448ms, CLS0. Not a field percentile claim. See PERFORMANCE.md, performance/increment10.json and OPERATIONS.md for methods and limits.

Validation

• PostgreSQL regression matrix: 507 passed, 5 intentional skips.
• Frontend: 304 unit tests with coverage passed; 38 browser regressions passed (one existing exception-page retry under load); all 40 contract tests passed.
• Real local API/Postgres/Hardhat journey, reorg recovery, interrupted PostgreSQL writes, two restarts/replay, locked backup/restore and real browser wallet registration/sign-in/reconnect/custody/delivery/QR/permissions passed.
• Hosted testing passed mobile exception/history, anonymous permission rejection, exact source/environment/isolation, deferred chart and wallet SDK loading, wallet picker access, sanitized release-labeled telemetry and active SSE checks. The sustained hosted operations check passed with zero confirmed-block lag and a real heartbeat. Final source adds trusted-template URL construction (including opaque-URL rejection), monitor snapshot validation, tests and documentation; protected-main CI and final provider verification are complete; see release evidence below.

Remaining operational limits

No historical production field comparison or external Sentry delivery claimed. Periodic checks use native GitHub Actions failure state; personal notification delivery is not tested. Hosted production restore/backfill remains a separate approval gate.

Final staged source

• Feature: e1879d1.
• Testing merge: fceae6c; tree identical to the reviewed feature.
• Render testing: dep-dbba0eivcj2c739jvgag (live). Vercel testing: dpl_XRS8cYNKbazGAQsd3sbit441ShQL (READY).
• Final hosted mobile/history/permissions and operations browser acceptance passed on that exact testing commit; no page errors or wrong API requests. Browser metric payloads carry only metric/route/value/environment/release, no auth/cookie or canary query input. Chart is deferred and wallet picker usable.
• Testing readiness current with zero confirmed-target lag and an actual heartbeat; scheduled monitor source checks passed locally and on testing.
• Production baseline: 1 product, 1 shipment. Testing baseline: 3 products, 2 shipments. No hosted business write or schema change performed.

Protected merge admission

All eight required GitHub Actions app 15368 checks passed on e1879d1. PR CI: https://github.com/Oionos/Veritras/actions/runs/39338393045 ; integration: https://github.com/Oionos/Veritras/actions/runs/39338393053 . Main remained protected and the PR was clean/up to date.

The inherited desktop Lighthouse job audits /index.html and passed its hard LCP assertion; its performance score 0.57 and TBT 27.8 s still produced warnings. These are retained as limitations, not represented as a clean performance score or compared with the controlled mobile dashboard figures. The new dashboard browser budget is enforced separately. Field observation and further blocking-time investigation remain follow-ups; no threshold was weakened.

Released and verified

• Protected squash: 9c4f819. Main tree equals the reviewed feature and final testing tree.
• All eight exact-main trusted checks passed: CI39339991524, integration39339991414. Render build logs confirm release admission with those exact workflow IDs/attempts; no gate or schema bypass.
• Render dep-dbba77ks728c73b7i2ug live, Vercel dpl_3KfXHLgL8jBFQmg9KVETCz6o8ape READY. Public frontend release attestation and live API both identify the exact main commit.
• Production mobile/history/permissions, deferred chart/remote SDK startup, wallet picker, private release-labeled telemetry, active stream, independent QR decode, public verification/evidence, keyboard navigation and isolated demo passed with no page errors or wrong API calls. Legacy production registration remains truthfully unverified with zero canonical events.
• Production counts remain 1 product / 1 shipment; testing remains 3 products / 2 shipments. CSV/PDF exports returned200 with valid content. No hosted business or schema mutation. Production INDEXER_ENABLED=false; schema e93a107bd624 unchanged.
• Operations Monitor39341491929 passed both Observe production and Observe testing, including sustained policy-aware readiness, API counters and actual SSE heartbeat. Hosted API Readiness39341243236 also passed. New scheduled workflow is active (four times/day).
• No Render production error logs from live transition23:24:49UTC through23:26:58UTC. Private preview access file removed; no credentials or private links in release evidence.
• A repeated testing browser snapshot briefly saw not_ready during normal confirmed-target catch-up; it recovered to current/zero lag with no API 5xx or stream failures. The bounded acceptance recheck and sustained monitor both passed. A free-service public read also needed a cold-start retry; final source/count/export checks passed.

IMPLEMENTATION_PLAN.md marks increment10 done and fixes stale increment8/9 sequence rows. PERFORMANCE.md retains controlled lab methods/limits; OPERATIONS.md covers privacy, incidents, single-writer ownership, backup/restore and future coordinated DDL. Remaining: production field comparison, inherited desktop blocking-time warnings, personal notification-delivery validation, optional Sentry delivery, and the separately approved production restore/reconciliation/indexing enablement gate.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
veritras	Ready	Preview	Oct 19, 2026 10:57pm UTC

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.