Merge branch 'codex/release-core-20261021' into codex/release-telemetry-20261021

docs/performance-release-candidate.md

@@ -5,6 +5,9 @@ Review this as a paired server/web candidate before promoting it from `dev` or
 Atlas sensor cards are a separate dependent change. Basic Atlas and Topology do
 not require that optional service.
 
+See the [21 October qualification record](release-qualification-20261021.md)
+for the paired drafts, exact preview build, measurements and remaining gates.
+
 ## What the core changes
 
 | Area | Result |

docs/release-qualification-20261021.md

@@ -0,0 +1,113 @@
+# Candidate qualification, 21 October 2026
+
+The core backend, basic Atlas and animated Topology candidate has a separate
+optional telemetry layer. All org PRs remain drafts. Only the Canadaverse preview
+was deployed; this record is not production acceptance or a dev/dev1 deployment.
+
+| Layer | Server dev / dev1 | Web dev / dev1 | Documentation |
+| --- | --- | --- | --- |
+| Core | [266](https://github.com/MeshCore-Beacon/beacon-server/pull/266) / [267](https://github.com/MeshCore-Beacon/beacon-server/pull/267) | [182](https://github.com/MeshCore-Beacon/beacon-web/pull/182) / [183](https://github.com/MeshCore-Beacon/beacon-web/pull/183) | [43](https://github.com/MeshCore-Beacon/beacon-docs/pull/43) |
+| Optional collection | [268](https://github.com/MeshCore-Beacon/beacon-server/pull/268) / [269](https://github.com/MeshCore-Beacon/beacon-server/pull/269) | [184](https://github.com/MeshCore-Beacon/beacon-web/pull/184) / [185](https://github.com/MeshCore-Beacon/beacon-web/pull/185) | [44](https://github.com/MeshCore-Beacon/beacon-docs/pull/44) |
+
+The optional branches include core ancestry until the core is accepted. Review
+their optional-only difference against `codex/release-core-20261021`, then
+refresh them after core acceptance. Do not independently merge both the old
+focused implementations and these consolidations. Flutter [draft 11](https://github.com/MeshCore-Beacon/beacon-flutter-app/pull/11)
+targets its canonical dev branch; the app has no upstream dev1 branch.
+
+## Source and deployment identity
+
+Current upstream dev is included: server `080141145e964945d3f105be01903b082ebbfd8b`,
+web `811f8430ea7eea0a556068904e71a43e07ac93f7` and app
+`a8107047f52da43f8b30afb98655bc4452b7a74e`.
+
+The preview combines core/optional source with its existing preview UI and
+route-evidence extensions. Server is `fdae02d4b7c501264280995d145bfe529b9e0d2f`
+and web is `79edb9ce26a8eda0764b32de6545d1d486afa98b`, labelled
+`2.5.0-n30nex.1`. The server API version remains 2.1.0; the separate `/info`
+build fields identify the binary. App is `1f704187a94ea5c84c458a5d63ab8c0a4fdef525`,
+version 2.1.0+3. Intake and headless client retain a separate private lifecycle.
+
+[Public preview](https://canadaverse.org/beacon-dev/),
+[build manifest](https://canadaverse.org/beacon-dev/build.json) and
+[Changelog/source archives](https://canadaverse.org/beacon-dev/source.html)
+identify the running preview. The server/web minimum versions and optional
+capability remain distinct from health and release acceptance.
+
+Artifacts were built locally from exact clean commits qualified by native CI;
+Actions artifact uploads are unavailable for this account. These are preview
+artifacts, not Actions-produced stable releases. The ARM64 runtime uses the
+qualified Alpine 3.22.6/PG16 stage and UID/GID 65532. Original private addresses,
+proxy trust and container limits remain intact. No source credential was added.
+
+## Checks completed
+
+- Core server build/vet/unit and native PostgreSQL, race, vulnerability and
+  runtime-image checks passed. The query-plan fixture corpus has 692 cases:
+  680 ordinary passes, 11 deliberately planted regressions detected, one
+  existing skip. All eight added Topology/history cases pass.
+- Basic web passed 1,512 tests in 164 files. Combined preview web passed 1,555
+  tests in 171 files on native Linux CI, plus build/lint. Two existing React
+  Compiler warnings remain. Initial merged chart-test assumptions were fixed;
+  Windows shell-entrypoint cases are covered by Linux CI.
+- Both private preview databases were backed up and restored off-host. Core
+  retained schema 53. New intake initialization preserved all 951 restored
+  reports and added its separate ledger. No database reset or historical
+  signal rewrite was performed.
+- All 34 public assets and both source archives matched. Both MQTT brokers
+  connected. A 12-second WebSocket sample received 70 packet observations with
+  valid hello/subscription and no parse error in that sample.
+- Public contract checks verified an instance-bound challenge, rejection of
+  invalid enrollment signatures and unenrolled reports, six retained histories,
+  coverage/cap metadata and channel-2 values. No accepted synthetic report or
+  RF test request was generated by these checks.
+- Browser checks confirmed four saved Atlas cards, bright gap-aware histories,
+  the six-node telemetry filter and live 24-hour Topology with 5,362 loaded
+  nodes and 15,248 connections at the sampled moment. Node/edge counts change
+  with the live dataset.
+- App analyzer and 347 Flutter tests passed. Org/fork Android builds and five
+  native telemetry-service tests passed. The local debug APK signature and
+  package were verified: `meshcorebeacon.app.telemetry`, version 2.1.0+3,
+  Android API 24 minimum and 36 target.
+- The headless worker was updated with its schedule, configuration, private
+  credentials and radio path preserved. RemoteTerm remains suspended. Its
+  post-update journal reported `not_due`; no forced poll or fresh worker
+  acceptance is claimed.
+
+Native CI evidence: [server](https://github.com/n30nex/beacon-server-contributions/actions/runs/39692021754),
+[web](https://github.com/n30nex/beacon-web-contributions/actions/runs/39692465604),
+[Android fork](https://github.com/n30nex/beacon-flutter-app/actions/runs/39689785160).
+
+## Measured limits and remaining gates
+
+Cold global Topology still needs optimization qualification. One public cold
+24-hour request took 13.877 seconds, then 0.336 seconds cached. A later local
+Pi check crossed a minute boundary and measured 5.8027 and 5.2405 seconds for
+two different cold snapshots, followed by a same-window cache hit in 0.0316
+seconds. The new historical-decryption job was progressing; CMI and packet-sites
+were complete. These are individual shared-host samples, not p95 or FPS claims.
+
+Path deduplication before edge expansion returned identical edge sets on the
+restored dataset, but showed no consistent warm speedup. That query change was
+not shipped. Measure query-family cost and cache occupancy before choosing a
+bounded shared snapshot/precomputation model. Preserve explicit as-of/window
+metadata and exact expiry semantics; avoid per-browser pagination fanout.
+
+Private metrics/statement/IO instrumentation and scrapes, whole-host pool/memory
+budgets, least-privilege migration/runtime roles, broker-to-database replay and
+durability, production RPO/RTO and a full maintenance-cycle soak remain explicit
+operator/design work. Sender-time versus receipt-time policy and bounded Atlas
+summary/downsampling contracts also remain follow-ups. The current patch does
+not make these guarantees by adding counters or passing fixture tests.
+
+No Android debugging device was available for this revision. Fresh physical
+BLE/Wi-Fi, screen-off/unlock/reconnect, notification controls, mobile RF-to-intake
+upload and overnight qualification remain pending. Keep the app draft. A
+cross-client RF coordination policy is also needed before broad mobile/headless
+coexistence; signed enrollment is not hardware attestation or sensor truth.
+
+Promote core before optional collection. Rehearse against the actual target
+schema/config/roles, deploy a paired immutable candidate to authorized dev/dev1,
+and qualify the remaining workload/recovery gates before operators approve a
+stable live release. Retained preview recovery copies do not authorize a
+database restore over new traffic or a production deployment.