Remove browser Actions checks and preserve release fixes

AGENTS.md

@@ -0,0 +1,4 @@
+# Repository instructions
+
+- Never create or push a branch whose name contains `codex`, regardless of case.
+- Use plain, descriptive branch names.

CHANGELOG.md

@@ -47,9 +47,9 @@ upgrades, public posting and reading improvements, and verified native software
 
 ### Testing and maintenance
 
-- Restored version-controlled Playwright infrastructure and browser CI, with normal regression and weekly/manual deep modes. Runtime data, browser profiles, screenshots, reports, traces and disposable audit evidence remain ignored.
+- Restored version-controlled Playwright infrastructure for local normal regression and deep audit runs. Removed browser checks and scheduled browser audits from GitHub Actions. Runtime data, browser profiles, screenshots, reports, traces and disposable audit evidence remain ignored.
 - Added administrator authorization, updater signing/archive/snapshot/rollback/recovery, readiness privacy, all-theme/narrow-screen, keyboard focus and no-JavaScript regressions. Release candidates receive strict Rust lint, locked dependency policy, packaging and browser validation.
-- Stabilized fixture teardown, backup completion and completed-redirect submission assertions and session-revocation fixtures that retain and verify the old session without unrelated polling, preserving test budgets and all-theme coverage. Linux browser CI provides a virtual audio output for genuine native playback checks. Firefox uses an isolated application identity for the macOS 27 upstream Playwright launch defect, with launch regressions and a version guard.
+- Stabilized fixture teardown, backup completion and completed-redirect submission assertions and session-revocation fixtures that retain and verify the old session without unrelated polling, preserving test budgets and all-theme coverage. Native quote-navigation checks open foreground tabs and independently verify Control/Command passthrough. Firefox uses an isolated application identity for the macOS 27 upstream Playwright launch defect, with launch regressions and a version guard.
 - Coordinated CLI test subprocess spawning to prevent Linux fork/exec descriptor inheritance from causing `ETXTBSY`, while preserving parallel test execution. Guarded native updater helpers with Unix configuration so check-only Windows builds remain warning-free. Kept configuration documentation compatible with Rust 1.91 strict lint and refreshed the yanked `yoke-derive` lockfile entry.
 
 ## RustChan 1.5.0 — 2026-09-28

README.md

@@ -219,7 +219,7 @@ cargo clippy --locked --workspace --all-targets --all-features
 cargo test --locked --workspace --all-features
 ```
 
-Browser-test infrastructure and its npm files are local-only and are not included in a fresh clone. Keep browser reports and temporary screenshots out of commits; the demonstration screenshots in `docs/screenshots/` are published documentation. See [CONTRIBUTING.md](CONTRIBUTING.md) for contribution guidance.
+Browser tests run locally; their harness and npm files are tracked, but GitHub Actions does not run browser checks. Keep browser reports and temporary screenshots out of commits; the demonstration screenshots in `docs/screenshots/` are published documentation. See [CONTRIBUTING.md](CONTRIBUTING.md) for contribution guidance.
 
 ## Documentation
 

tests/e2e/README.md

@@ -1,8 +1,8 @@
 # RustChan Playwright E2E Suite
 
-The maintained Playwright harness belongs in version control: `playwright.config.ts`,
-`package.json` / `package-lock.json`, `tests/e2e/**`, and
-`.github/workflows/e2e.yml`. Generated run evidence stays ignored: browser
+The maintained local Playwright harness belongs in version control: `playwright.config.ts`,
+`package.json` / `package-lock.json`, and `tests/e2e/**`.
+Browser tests do not run in GitHub Actions. Generated run evidence stays ignored: browser
 reports, `test-results/`, the `output/playwright/` runtime tree (including
 preserved debug roots and audit output), traces, videos, screenshots, storage
 state, and the rebranded-Firefox workaround bundle. Never force-add generated
@@ -45,8 +45,7 @@ Two supported modes share one configuration; retries stay at **zero** in both.
 
 ### Normal regression mode
 
-Routine CI runs the maintained suite per engine, one project per job, with a
-failure cap. Locally the closest equivalent is:
+Run the maintained local suite per engine with a failure cap:
 
 ```sh
 RUSTCHAN_E2E_SKIP_BUILD=1 npx playwright test --project=chromium --workers=2 --max-failures=5
@@ -56,8 +55,8 @@ RUSTCHAN_E2E_SKIP_BUILD=1 npx playwright test --project=chromium-nojs --workers=
 ```
 
 `npm run test:e2e:ci` is the bounded Chromium shorthand (`--max-failures=5`).
-The tracked workflow `.github/workflows/e2e.yml` runs these four projects on
-pull requests, pushes, and merge groups; evidence is uploaded only on failure.
+These commands run locally; pull requests, pushes, and merge groups do not
+trigger browser checks.
 
 ### Deep audit mode
 
@@ -75,10 +74,8 @@ npm run test:e2e:deep
 
 `npm run test:e2e:deep` is the all-projects matrix (`chromium`,
 `chromium-nojs`, `webkit`, `mobile-webkit`, `firefox`, `mobile-firefox`,
-`firefox-nojs`). The workflow exposes it as `workflow_dispatch` input
-`mode=deep` and as the weekly scheduled pass. Deep diagnostics are expensive;
-they are deliberately not part of the routine pull-request pass. A single
-project can be run deeply with an explicit `--project`.
+`firefox-nojs`). Deep diagnostics are expensive and run only when requested
+locally. A single project can be run deeply with an explicit `--project`.
 
 ## Firefox on macOS 27 (Playwright issue #42768)
 
@@ -119,7 +116,7 @@ Firefox/mobile/no-JS launch probes pass.
 ## Maintained source, fixtures and disposable evidence
 
 Track the TypeScript specs/helpers/configs, helper `.mjs` scripts, npm manifest
-and lockfile, and browser workflow. Required small sanitized regression fixtures
+and lockfile. Required small sanitized regression fixtures
 belong in `tests/e2e/fixtures/`; most current fixtures are generated deterministically
 inside each isolated runtime by `helpers.ts`. Never copy runtime databases,
 authentication state or downloaded browser bundles into source fixtures.
@@ -377,9 +374,8 @@ The retained local npm shorthand runs a bounded Chromium pass with two workers a
 npm run test:e2e:ci
 ```
 
-The tracked browser workflow is `.github/workflows/e2e.yml` (normal regression
-projects on PR/push, deep audit on `workflow_dispatch mode=deep` and the weekly
-schedule). Failure diagnostics retain traces, screenshots, videos, server logs,
+The browser suite runs locally; there is no GitHub Actions browser workflow or weekly
+schedule. Failure diagnostics retain traces, screenshots, videos, server logs,
 and browser errors; retries are disabled.
 
 ## Full Local Matrix

tests/e2e/public-reading-polish.spec.ts

@@ -375,6 +375,23 @@ test('search post numbers and quotes open their thread context', async ({ page,
   await page.goBack();
   await expect(page.locator('#board-search-input')).toHaveValue('unique-search-needle');
   if (['chromium', 'webkit', 'firefox'].includes(testInfo.project.name)) {
+    // Check each modifier independently so the foreground gesture's Shift
+    // cannot hide a broken Control/Command passthrough guard.
+    const intercepted = await page.locator(`#p${reply} a.quotelink`).evaluate(link => {
+      return ['ctrlKey', 'metaKey'].map(modifier => {
+        let preventedByApp: boolean | undefined;
+        document.addEventListener('click', event => {
+          preventedByApp = event.defaultPrevented;
+          // Inspect application handling, then cancel synthetic navigation.
+          event.preventDefault();
+        }, { once: true });
+        link.dispatchEvent(new MouseEvent('click', {
+          bubbles: true, cancelable: true, [modifier]: true,
+        }));
+        return preventedByApp;
+      });
+    });
+    expect(intercepted).toEqual([false, false]);
     await page.evaluate(() => {
       document.addEventListener('click', event => {
         if (!(event.target instanceof Element) || !event.target.closest('a.quotelink')) return;
@@ -386,7 +403,9 @@ test('search post numbers and quotes open their thread context', async ({ page,
     });
     const [opened] = await Promise.all([
       page.context().waitForEvent('page'),
-      page.locator(`#p${reply} a.quotelink`).click({ modifiers: ['ControlOrMeta'] }),
+      // Open the tab in the foreground: Chromium can leave a traced background
+      // tab uninitialized even after its document response has arrived.
+      page.locator(`#p${reply} a.quotelink`).click({ modifiers: ['ControlOrMeta', 'Shift'] }),
     ]).finally(async () => {
       noteEvent('modified-quote-click', JSON.stringify(await page.evaluate(() => (window as Window & { auditQuoteClick?: unknown }).auditQuoteClick)));
     });