Add round-4 (pre-deploy) handover for the LLM test project

Final regression sign-off before deployment. Since #018 the only changes
are cosmetic (table/body fonts), so no new API surface — this round is a
broad regression sweep: full CRUD across all kinds, auth boundaries,
confirmation that every closed issue (#003/#004/#006/#008/#010/#014/#015/
#016) stays fixed, and a sharing re-check. A clean pass is the deploy gate.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

issues/019-handover-to-llm-test-round-4-predeploy.md

@@ -0,0 +1,77 @@
+# 019 — Handover to AGENT_DAYBOOK__LLM_TEST (round 4 — pre-deploy sign-off)
+
+**Status:** For information — final regression pass before deployment.
+
+This is the **last test round before the app is deployed**. Unlike previous
+handoffs, there are essentially no new features to probe: since round-3
+(#018), the only changes are cosmetic CSS (table fonts → monospace cells /
+Arial headers; document body prose → system sans-serif). **No API or
+behavioral surface changed.** So the goal here is a **broad regression
+sweep** to confirm nothing has broken, so the maintainer can deploy with
+confidence.
+
+Everything is on `main` (pushed) and live on the local dev instance
+(`http://127.0.0.1:8001`). Use the `test` / `testpwd` account and clean up
+what you create.
+
+## What to do: full regression sweep
+
+Confirm the whole API still behaves. Don't just re-run one thing — cover the
+surface, since a clean pass here is the deploy gate.
+
+### Core CRUD, every kind
+- `POST` each text kind (markdown, html_fragment, html_full, deck, json,
+  csv) → `201`, correct `kind`, renders, `raw_available` correct.
+- `POST` each file kind (image, pdf, binary) and `.xlsx` (→ converts to csv).
+- `GET /api/artifacts` (list, filters: source/label/day/kind/q) and
+  `GET /api/artifacts/{id}` (session-authed).
+- `PATCH` (title/tags/metadata/source_* fields) and the immutable-field
+  rejections (content/source/kind/day → 400).
+- `DELETE` → 204, files gone, second delete 404s.
+- `/api/capabilities` returns the current kind/method/filter lists.
+
+### Auth boundaries (important pre-deploy)
+- No token / bad token on writes → 403.
+- One user's token cannot read/patch/delete another user's artifact (404).
+- List/detail reads require a session, not just a bearer token.
+
+### Confirm every closed issue stays fixed
+Spot-check the earlier repros — these are the regression-risk areas:
+- **#014** — script/onerror in markdown/deck/html_fragment still stripped;
+  CSP `script-src 'none'` present on those (and `/s/`); html_full still
+  verbatim.
+- **#015** — deeply nested JSON (content *and* request body) → 400, not 500.
+- **#016** — ragged CSV rows don't drop cells.
+- **#010 / #006** — quota race and eviction (thin/no automated coverage):
+  concurrent posts never exceed quota; a doomed post doesn't destroy unkept
+  artifacts.
+- **#008** — non-string source_* → 400.
+- **#003 / #004** — length limits and content-shape checks still enforced.
+
+### Sharing (the unauthenticated surface — worth re-checking before going live)
+- Share toggle creates/clears the token; `/s/{token}` serves unauthenticated;
+  unsharing kills the old link immediately; a bad/guessed token 404s; an
+  unshared artifact's embedded assets are not reachable anonymously.
+
+## Cosmetic changes since #018 (not API-testable, FYI only)
+
+- Table cells render in monospace, headers in Arial.
+- Document body prose is system sans-serif (was serif in the report theme).
+- Earlier UI-only work: unified off-white artifact backgrounds, greyscale
+  chrome, dark-mode toggle, top-bar logo, sidebar width behavior.
+
+None of these change API responses; verify only if a render looks broken.
+
+## Out of scope / don't report
+- **#017** (customizable theme variants) is an accepted design issue, not a
+  bug.
+- `html_full` being verbatim/unsanitized is by design.
+- `pdf` using the browser's grey viewer chrome is expected.
+
+## Outcome
+- **Clean sweep → the maintainer deploys.** If you find anything, file it as
+  a new numbered issue (next is **#020**), severity-tagged, so it can be
+  triaged as deploy-blocking or deploy-after.
+
+As always: `test`/`testpwd`, clean up, and check `artifacts/views.py` before
+calling a surprise a bug.