[DeusExTaco]

Summary

• Add reviewed issue metadata editing, series/library and series.json editing, and explicit selected-field propagation into comic files. Keep paired XML output reconciled and preserve later edits during import rollback.
• Recover retained downloads, oversized comics, overlapping packs, and interrupted AirDC++ work without unnecessary downloads or overwriting owned files. Keep incomplete story extracts actionable through the replacement workflow.
• Correct provider catalog counts and linked-catalog extension, Metron pacing, background activity counts, multi-tab responsiveness, Story Arc copy retry, download sizes, and preview loading feedback.
• Qualify the release with patched Pillow and stylesheet-build dependencies, bounded container exceptions, and regression coverage for import history and browser fixture isolation.

Validation

• make ci-full passed: main suite 16,477 passed, 1,772 skipped, one expected failure; 91.74% coverage.
• Accessibility: 26 passed. Chromium and Firefox: 817 passed and two documented skips each.
• SQLite/PostgreSQL metadata publication, conversion, and rollback-preservation contracts: 140 passed, eight local native-tool skips.
• Patched Pillow reader/cover/conversion regressions: 197 passed.
• Patched npm lockfile: zero audit findings; production CSS is byte-identical and watch-mode rebuilding succeeds.
• Production container runtime checks, blocking High-severity scan, and all seven Docker smoke tests passed. All four GitHub aggregate checks remain required before merge.

Release Boundaries

• This remains a 2.0.0-dev edge preview, not the completed v2.0 general release. Existing feature-flag defaults remain unchanged.
• The uncommitted Anna verification prototype is excluded and remains parked.
• The container allowlist is reduced from 109 entries to 17 exact, explicitly accepted package/CVE/version combinations. Approval expires October 31, 2026 or at the next base refresh, whichever comes first. This is residual risk acceptance, not a vulnerability fix. All other High findings and changed package versions remain blocking.
• Preserve existing file-safety, identity review, source preservation, and import recovery behavior. Completed import history permits explicit later editing; unfinished import or rollback work still defers it.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-21T04:51:21.748190Z	fa335bf	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3d3b4b44eb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[DeusExTaco]

@codex review

Please review fa335bf, including the cancellation/admission coordination fix. This is the second and final requested review pass for this PR.

[DeusExTaco]

Release qualification update: make ci-full passed after the AirDC++ ownership fix, including the full test suite, accessibility, Chromium, Firefox, image security/runtime checks, and Docker smoke. SQLite/PostgreSQL ownership interleavings also passed in 78 focused tests. Commit 8e8a8c5 only makes the file-proof test wait for an actual filesystem ctime change on Linux; it changes no production code or safety policy. Full GitHub checks are rerunning on that exact head. Anna verification remains excluded.

[DeusExTaco]

The remaining Linux browser failures were screenshot capture paths hard-coded to /private/tmp, after their UI assertions had passed. Commit 83d40a2 uses pytest per-test temporary directories; both affected modules pass 44 Chromium/Firefox cases locally. All Python versions passed on the preceding head. The post-review commits are test-only; no additional review pass is requested.

[DeusExTaco]

Release qualification update:

• Local make ci-full passed, including coverage, both browser suites, accessibility, production-image security checks, and Docker smoke tests.
• The runner disk-full failure was resolved by removing 139 obsolete virtual-environment caches, preserving current environments and recovering 55 GB. All six runner services are healthy; production services were untouched.
• The latest test-only correction makes the AirDC++ retry assertions deterministic rather than depending on an asynchronous request counter. All 12 focused Chromium/Firefox cases pass; normal commit hooks pass. Required checks are running for 73ef3db.
• The first review finding is fixed and resolved. The second requested review remains stalled without a result. The maintainer explicitly approved proceeding once every required CI gate is green. No third review will be requested.
• Edge publication remains gated on full manual validation of the exact merged develop commit. Anna verification remains excluded.

[DeusExTaco]

Edge publication completed successfully from merged develop commit caf422018033bb3871a6abce28bef98f96147513.

All four exact-commit manual validation workflows passed. Docker Release run 39667906190 built AMD64 and ARM64, verified platform runtime protections and signatures, and promoted both registries to the same signed digest:

sha256:9ba9fbe097173257c22fa809034d713cacf9b748c86aa05a8dc0ca2a415f165c

Images: ghcr.io/pullboxapp/pullbox:edge and docker.io/pullbox/pullbox:edge.

Release run: https://github.com/pullboxapp/pullbox/actions/runs/39667906190

Anna verification is excluded. No production deployment was performed.