feat: deliver portable incident evidence workflow at scale

[zrack]

Operator outcome

Operators can capture or import non-NSL telemetry, investigate and compare bounded incidents, verify received evidence in the application, and process the published 200,000-record replay tier without freezing or replacing the active workspace when work is cancelled.

Scope

• Add immutable decoder-pack identity and NMEA 0183 as the external reference protocol.
• Add bounded in-application bundle verification with separate consistency, completeness, and authenticity claims.
• Add comparative replay for two operator-selected incident ranges.
• Move session, comparison, and bundle processing into cancellable workers with phase progress.
• Raise imported and saved replay support to 64 MiB, 200,000 records, and 24 hours; retain the lower live-capture ceilings.
• Add deterministic maximum-tier fixtures, IndexedDB compatibility, source and packaged-release gates, and update all owned documentation.

Intentional non-goals: protocol auto-detection, arbitrary JavaScript plug-ins, RF demodulation or radio control, full-session evidence export above existing artifact row limits, and signed source authenticity.

Verification

• npm run check passes locally.
• I exercised import, persistence, cancellation, reopen, comparison, incident export, and receiver verification.
• Tests cover changed pure domain logic and relevant failure cases.
• Applicable Playwright projects pass in Chromium, Firefox, and WebKit.

Results:

• 278 unit tests across 35 files passed.
• Source Playwright matrix: 49 passed; 2 intentional duplicate cancellation-path skips.
• Two production release builds were byte-identical.
• Unpacked release matrix: 6 capture-to-evidence and maximum-session checks passed across Chromium, Firefox, and WebKit.
• Live production QA loaded and persisted the 52,378,445-byte, 200,000-record corpus, selected the exact 10,000-record incident, and reported no browser warnings or errors.

Compatibility and evidence

• Session, record, packet, diagnostic, and bundle schema impact is described below.
• Replay timing and UTC/IANA-timezone behavior remain correct.
• Incident ranges remain half-open ([startUs, endUs)).
• Malformed and partial frames remain inspectable.
• Evidence artifact contents, hashes, and verification behavior remain correct.
• Existing fixtures and imported sessions remain compatible.

Compatibility notes: v1 and v2 session imports remain unchanged. IndexedDB v1 text and v2 Blob records remain readable; new saves use v3 canonical bytes. Decoder, schema, pack, and runtime identities remain exact throughout replay and bundle verification. Version 3 raw and decoded artifacts remain limited to 100,000 rows, so larger replays require a narrower incident selection.

Telemetry safety and provenance

• This PR contains no secrets, personal data, operational payloads, precise locations, device identifiers, or other sensitive telemetry.
• Added fixtures are synthetic and their generation steps are documented.
• Bundled fixtures and user-imported data use the same validation, decoding, replay, incident, and export pipeline.
• Capture changes preserve endpoint or device attribution, bridge-journal evidence, unavailable-counter semantics, and mandatory bundle provenance.

Fixture provenance: npm run fixture:large runs scripts/large-session-corpus.mjs to stream a deterministic synthetic 200,000-record v1 session into ignored output/large-session/.

Visual evidence

• A 1280x720 screenshot of the loaded maximum-tier replay was captured during live QA; attachment upload was unavailable in the browser extension, so the checked-in design QA record contains the acceptance evidence.
• Keyboard focus, axe rules tagged WCAG A/AA, non-color cues, and narrow/zoom-equivalent reflow were reviewed in the release matrix.

Documentation and migration

• User-facing behavior, schemas, workflows, and compatibility changes are documented.
• CHANGELOG.md under [Unreleased] is updated.
• Current-state documents were updated only where their owned truth changed.
• No session-file migration is needed; IndexedDB schema evolution is backward-readable and covered by tests.

The immutable v0.1.0 release note was not changed because these features have not been tagged as v0.1.0.

Reviewer focus

Please focus on worker chunk hydration and post-clone immutability, cancellation preserving the active workspace, exact canonical-byte persistence, maximum-tier memory budgets, and the distinction between the 200,000-record replay limit and 100,000-row evidence artifact limit.