# 019 — Handover to AGENT_DAYBOOK__LLM_TEST (round 4 — pre-deploy sign-off)

**Status:** For information — final regression pass before deployment.

This is the **last test round before the app is deployed**. Unlike previous
handoffs, there are essentially no new features to probe: since round-3
(#018), the only changes are cosmetic CSS (table fonts → monospace cells /
Arial headers; document body prose → system sans-serif). **No API or
behavioral surface changed.** So the goal here is a **broad regression
sweep** to confirm nothing has broken, so the maintainer can deploy with
confidence.

Everything is on `main` (pushed) and live on the local dev instance
(`http://127.0.0.1:8001`). Use the `test` / `testpwd` account and clean up
what you create.

## What to do: full regression sweep

Confirm the whole API still behaves. Don't just re-run one thing — cover the
surface, since a clean pass here is the deploy gate.

### Core CRUD, every kind
- `POST` each text kind (markdown, html_fragment, html_full, deck, json,
  csv) → `201`, correct `kind`, renders, `raw_available` correct.
- `POST` each file kind (image, pdf, binary) and `.xlsx` (→ converts to csv).
- `GET /api/artifacts` (list, filters: source/label/day/kind/q) and
  `GET /api/artifacts/{id}` (session-authed).
- `PATCH` (title/tags/metadata/source_* fields) and the immutable-field
  rejections (content/source/kind/day → 400).
- `DELETE` → 204, files gone, second delete 404s.
- `/api/capabilities` returns the current kind/method/filter lists.

### Auth boundaries (important pre-deploy)
- No token / bad token on writes → 403.
- One user's token cannot read/patch/delete another user's artifact (404).
- List/detail reads require a session, not just a bearer token.

### Confirm every closed issue stays fixed
Spot-check the earlier repros — these are the regression-risk areas:
- **#014** — script/onerror in markdown/deck/html_fragment still stripped;
  CSP `script-src 'none'` present on those (and `/s/`); html_full still
  verbatim.
- **#015** — deeply nested JSON (content *and* request body) → 400, not 500.
- **#016** — ragged CSV rows don't drop cells.
- **#010 / #006** — quota race and eviction (thin/no automated coverage):
  concurrent posts never exceed quota; a doomed post doesn't destroy unkept
  artifacts.
- **#008** — non-string source_* → 400.
- **#003 / #004** — length limits and content-shape checks still enforced.

### Sharing (the unauthenticated surface — worth re-checking before going live)
- Share toggle creates/clears the token; `/s/{token}` serves unauthenticated;
  unsharing kills the old link immediately; a bad/guessed token 404s; an
  unshared artifact's embedded assets are not reachable anonymously.

## Cosmetic changes since #018 (not API-testable, FYI only)

- Table cells render in monospace, headers in Arial.
- Document body prose is system sans-serif (was serif in the report theme).
- Earlier UI-only work: unified off-white artifact backgrounds, greyscale
  chrome, dark-mode toggle, top-bar logo, sidebar width behavior.

None of these change API responses; verify only if a render looks broken.

## Out of scope / don't report
- **#017** (customizable theme variants) is an accepted design issue, not a
  bug.
- `html_full` being verbatim/unsanitized is by design.
- `pdf` using the browser's grey viewer chrome is expected.

## Outcome
- **Clean sweep → the maintainer deploys.** If you find anything, file it as
  a new numbered issue (next is **#020**), severity-tagged, so it can be
  triaged as deploy-blocking or deploy-after.

As always: `test`/`testpwd`, clean up, and check `artifacts/views.py` before
calling a surprise a bug.