# Release compatibility and validation

## 0.4.0 target

Checked **`@jmfederico/pi-web@1.202611.1`** and PI WEB source checkout **`98316bd8`**, including recent release history, plugin documentation, public declarations and relevant lifecycle source. The supported host minimum is **1.202611.1** because comment previews require `pi-web/markdown-rendering@1`. The development dependency and lockfile pin that minimum. The Review UI workflow checks both the pinned minimum and npm's `latest` host; at assessment time both resolve to 1.202611.1. Future releases are tested by CI, not assumed compatible.

## Integration

- Browser and server entries use **API v5**. The server rejects machine/project scopes before executing Git and continues to use host-resolved workspace paths, bounded argv-based execution and request cancellation. Its operations remain read-only.
- Requires public **stylesheet-integration v1** and **markdown-rendering v1** capabilities, resolved in `start`. One Lit stylesheet controller per panel opts into shared UI and releases/reconnects through component lifecycle.
- Markdown parsing, syntax extensions, sanitization and code-fence previews belong to the host. The plugin supplies the actual machine and unchanged comment text; it no longer bundles Marked or a private renderer. Document policy permits safe external links including `mailto:`, omits images, escapes raw HTML and does not navigate workspace-relative links. This is a preview-policy change, not a saved-data or exported-feedback migration.
- Uses shared `ui-button`, `ui-select`, `ui-toolbar` and `ui-file-row` patterns, inherited `--pi-*` tokens and component-scoped CSS. File rows stay compact for every pointer type; larger source/editor controls follow container width, not coarse-pointer detection. Shared styling is experimental upstream.
- Registers English source messages under **`plugin:code-review:review`**. Translation packs can target the stable keys in `src/browser/localization.ts`. No translations are bundled. Host localization controllers update mounted panels while preserving draft DOM/state and release observers on disconnect. Counts use host number formatting, RTL controls follow interface direction, and source code remains LTR. Staged chip labels capture the language at attachment time; reattaching uses the current language. Coordinate/provenance labels and backend diagnostics remain verbatim.
- Composer-chip ownership, acceptance callbacks, storage transactions, comparison endpoints, plugin ID and comment schema are unchanged. No comment-data migration is required.
- No private host imports, custom network endpoints, hard-coded application URLs, core config readers or deployment environment dependencies were introduced. Generic host settings remain unused; layout/wrapping preferences remain browser-local.

## Automated results

| Check | Result |
| --- | --- |
| Typecheck and typed ESLint | Passed |
| Unit/DOM/real-Git tests | Passed: 8 files, 114 tests |
| Browser/server build | Passed |
| Unpacked artifact smoke | Passed |
| Packed/extracted artifact smoke | Passed |
| Production-bundle Chromium acceptance | Passed |
| Runtime dependency audit (`--omit=dev`) | 0 known vulnerabilities |
| Full lockfile dependency audit | 14 advisories: 12 moderate, 2 high |

The advisory-bearing dependency tree is development-only and is not shipped as runtime dependencies. Remaining advisories include lint tooling, happy-dom, Undici and host/Pi development dependencies; this release does not claim a clean development audit. No force downgrade or unrelated dependency migration was used to suppress the report.

The tests cover non-workspace backend rejection, actual Git/index safety, captured chip ownership, durable storage, shared Markdown request wiring, live translated controls/direction, retained drafts and localization observer cleanup. Chromium checks cover dark/light desktop layouts, 360/390/430px viewports, wrapping, dialogs, keyboard modality, range editing, draft retention, navigation scroll restoration, frozen comparisons, expanded context and mocked attachment. Dark/light desktop and phone screenshots were inspected.

The artifact harness supplies mocked host contexts and DOM/IndexedDB adapters. Chromium uses native browser storage and the production plugin with sample backend, stylesheet and Markdown adapters. It does **not** reproduce the running host's shared CSS, Markdown parser/extensions or real send admission. Current screenshots are written to ignored `artifacts/review-ui/`; older committed screenshots remain historical evidence.

## Follow-up acceptance

- Live-host registration, theme/shared stylesheet adoption and shared Markdown extensions, including theme/language changes in narrow panels.
- Real iOS/Android keyboards, viewport changes, touch selection and assistive technology.
- Successful/failed/chips-only sends, steer/follow-up, in-flight replacement, two-tab acknowledgements, real storage failures and remote-machine scoping.

These live checks remain follow-up work under the existing [publication policy](composer-design.md#release-gate). No live plugin installation, host modification or daemon restart was performed. Updating this server-backed package requires a separately approved safe restart of the target daemon and browser reload.

## Earlier releases

Version 0.3.0 targeted PI WEB 1.202610.6 with browser API v5, server API v3 and a private Markdown renderer; its 109 tests and standalone browser checks passed. Versions 0.1.1 and 0.1.2 targeted PI WEB 1.202610.3 and browser API v4/server API v3. Historical [before](screenshots/review-before.png) and [after](screenshots/review-after.png) captures are standalone previews, not live-host screenshots.