# V2 Phase B Implementation Evidence

**Date:** 26 August 2026  
**Revision:** `0.2.0` working tree  
**Decision:** `PASS` for implementation/local verification; `BLOCKED` for public-hosted release evidence

## Delivered

- Unique, opaque anonymous demo sessions in an HTTP-only signed browser cookie; separate sessions receive separate subjects and duplicate tabs restore one subject.
- Server-validated protected intents and durable `/queue/[queueRef]` recovery URLs.
- Deterministic 35–55 second public and 12–15 second video cohorts with irregular batches, approximate ranges, server-directed polling, slowdown/recovery, activity, and no poll-frequency advantage.
- Idempotent fast-forward, leave, and claim transitions. Fast-forward is persistently disclosed; leave cancels once; claim issues a scoped, fenced, session-bound signed permit with a hard two-minute limit.
- Shared `C=3`, `R=2/s`, reserve, offer-expiry, permit-expiry, and audit semantics without catalogue inventory mutation.
- Memory, atomic local-file, and Redis REST single-store adapters behind `TQM_STATE_DRIVER`. The Redis adapter uses a distributed lock for cross-process atomic mutation.
- Responsive waiting-room UI with refresh/offline recovery copy, ARIA material-state announcements, reduced-motion behavior, background compact mode, explicit synthetic-demand truth, and destructive leave confirmation.
- V2 API schemas/routes, persistence schema additions, OpenAPI updates, and versioned policy/decision records.

## Automated evidence

`pnpm typecheck`: pass  
`pnpm test`: pass — 30 tests across four files  
`pnpm build`: pass — all V1/V2 pages and API routes compiled

Phase B tests cover:

- two-session subject isolation and same-session restoration;
- session-creation replay after a lost cookie response;
- same-time polling invariance and monotonic progress;
- public/video timing bounds;
- slowdown and recovery;
- acceleration disclosure and normal offer transition;
- exactly-once acceleration audit under a second command key;
- exactly-once leave and claim rejection after cancellation; and
- session-scoped, idempotent reset without cross-session effects;
- shared `R=2/s` and `C=3` admission ceilings;
- normal offer-to-claim transition and complete session-bound permit scope; and
- restoration through a fresh service instance backed by the atomic file adapter.

Production-build HTTP smoke passed for `session -> intent -> queue -> status`. A second production server process, using the same file adapter and signing secret, restored the same active queue reference after the first process stopped. An in-app browser check completed the results-to-queue interaction and verified the 390 × 844 queue layout without horizontal overflow.

## Versions and seeds

- Policy: `sim-policy-2026-08-26.3`
- Schema: `sim-schema-v2-phase-b`
- API: `v1+v2-phase-b`
- Per-run seed: `SHA-256(v1 scenario seed | opaque subject | intent | train run | class | quota)`
- Only the seed commitment is exposed in durable evidence; public queue status never exposes the seed.

## Unmet release evidence

The repository has no hosted Redis credentials or public deployment target. Therefore a real multi-instance Redis transaction test, hosted cold-start smoke, public-link two-browser test, full browser acceptance suite, and assistive-technology review cannot be truthfully attached here. Public deployment must set `TQM_STATE_DRIVER=redis`, Redis REST credentials, strong session/permit secrets, and then run those checks. In-memory public deployment is a release blocker.