refactor(notes): decompose Notes into feature-owned modules (#6713)

* refactor(notes): decompose Notes into feature-owned modules

* fix(notes): avoid HTML interpolation in reminder picker

* docs(notes): drop checkpoint archives, session logs and publication drafts

The N0-N6 tarballs and raw pytest/node logs are not read by any script or
test, and the logs carry absolute home-directory paths. Once squashed into
dev they would stay in history for good. notes-pr.md and notes-issue.md
were the drafts used to open #6712 and #6713, not documentation.

notes-validation.md keeps the counts, the checkpoint hashes and
implementation.sha256 as the record; local interpreter paths and the local
Docker image name are replaced with portable placeholders.

* fix(notes): keep the state store raw and stop masonry re-observing after close

- state: writes built from views (filter, spread, splice) stored nested
  read-only views in the store, so structuredClone on a stored note threw
  DataCloneError. Store writes now unwrap nested views.
- layout: a save that resolves after closePanel re-renders the leaving pane
  and re-created the masonry ResizeObserver that teardown had disposed.
  Skip creating it once Notes is closed.
- index.js: drop 30 imported or declared names that were never used and
  group the imports at the top. Import order is unchanged.
- Revert unrelated punctuation edits in .gitattributes and keep the header
  comment and docstring first in compare/vote.js and
  test_notes_dom_xss_helpers.py.

Both fixes have a node test that fails on the previous head.

* test(notes): make script rejection assertion case-insensitive

Address CodeQL js/bad-tag-filter alert #1150 in test-only assertion and refresh Notes evidence manifest checksum.

---------

Co-authored-by: Léo <leograndcontact@gmail.com>

scripts/verify_frontend_runtime.py

@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
 """Verify the current Python runtime from an isolated distribution without frontend tooling."""
 import os
+import json
 from pathlib import Path
 import shutil
 import socket
@@ -13,12 +14,20 @@ ROOT = Path(__file__).resolve().parents[1]
 PROBE = """
 from pathlib import Path
 import shutil
+import json
+import sys
 from starlette.testclient import TestClient
 from app import app
 assert not Path('frontend').exists()
 assert not Path('node_modules').exists()
 assert shutil.which('node') is None
 with TestClient(app) as client:
+    for output in json.loads(sys.argv[1]):
+        asset = client.get('/static/' + output)
+        assert asset.status_code == 200, (output, asset.status_code)
+        assert asset.content == Path('static', output).read_bytes(), output
+        assert asset.headers['content-type'].startswith('text/javascript'), output
+        assert asset.headers['cache-control'] == 'no-cache', output
     response = client.get('/static/js/actionMenuOrder.js')
     assert response.status_code == 200, response.status_code
     assert response.content == Path('static/js/actionMenuOrder.js').read_bytes()
@@ -58,7 +67,10 @@ def main() -> int:
         )
         # A caller's Python search path must not import the original checkout.
         env.pop("PYTHONPATH", None)
-        result = subprocess.run([sys.executable, "-c", PROBE], cwd=target, env=env, capture_output=True, text=True, timeout=60)
+        outputs = [entry['deployment'] for entry in json.loads(
+            (ROOT / 'frontend/modules.json').read_text(encoding='utf-8')
+        )['modules']]
+        result = subprocess.run([sys.executable, "-c", PROBE, json.dumps(outputs)], cwd=target, env=env, capture_output=True, text=True, timeout=60)
         print(result.stdout, end="")
         if result.returncode:
             print(result.stderr[-8000:], file=sys.stderr)

scripts/verify_notes_browser_runtime.py

@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+"""Run real Notes UI and API against a disposable native distribution and database."""
+import os
+from pathlib import Path
+import shutil
+import socket
+import subprocess
+import sys
+import tempfile
+import time
+from urllib.request import urlopen
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def main():
+    with tempfile.TemporaryDirectory(prefix="ody-notes-native-") as directory, socket.socket() as chroma_guard:
+        target = Path(directory)
+        for name in ("app.py", "HARNESS_VERSION"):
+            shutil.copy2(ROOT / name, target / name)
+        for name in ("core", "routes", "src", "services", "resources", "mcp_servers", "companion", "config", "static"):
+            shutil.copytree(ROOT / name, target / name, ignore=shutil.ignore_patterns("__pycache__", ".env", "secrets.env*", "*.db", "*.sqlite*"))
+        chroma_guard.bind(("127.0.0.1", 0))
+        with socket.socket() as app_port:
+            app_port.bind(("127.0.0.1", 0))
+            port = app_port.getsockname()[1]
+        env = dict(os.environ)
+        env.update(
+            ODYSSEUS_DATA_DIR=str(target / "data"),
+            DATABASE_URL="sqlite:///" + str(target / "notes.db"), AUTH_ENABLED="true",
+            ODYSSEUS_STARTUP_WARMUPS="0", ODYSSEUS_TOOL_INDEX_PREWARM="0",
+            CHROMADB_HOST="127.0.0.1", CHROMADB_PORT=str(chroma_guard.getsockname()[1]),
+            FASTEMBED_CACHE_PATH=str(target / "fastembed"),
+        )
+        env.pop("PYTHONPATH", None)
+        server = subprocess.Popen(
+            [sys.executable, "-m", "uvicorn", "app:app", "--host", "127.0.0.1", "--port", str(port)],
+            cwd=target, env=env, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True,
+        )
+        result = None
+        try:
+            origin = f"http://127.0.0.1:{port}"
+            deadline = time.monotonic() + 45
+            while time.monotonic() < deadline:
+                if server.poll() is not None:
+                    raise RuntimeError("Disposable Notes server exited during startup")
+                try:
+                    with urlopen(origin + "/", timeout=1) as response:
+                        if response.status == 200:
+                            break
+                except OSError:
+                    time.sleep(0.1)
+            else:
+                raise RuntimeError("Disposable Notes server did not become ready")
+            result = subprocess.run(
+                ["node", "tests/browser/notesNative.mjs"], cwd=ROOT,
+                env=dict(os.environ, ODYSSEUS_NOTES_RUNTIME_ORIGIN=origin, NOTES_TEST_PYTHON=sys.executable),
+                capture_output=True, text=True, timeout=120,
+            )
+            print(result.stdout, end="")
+            if result.returncode:
+                print(result.stderr, file=sys.stderr)
+            return result.returncode
+        finally:
+            server.terminate()
+            try:
+                logs, _ = server.communicate(timeout=10)
+            except subprocess.TimeoutExpired:
+                server.kill()
+                logs, _ = server.communicate()
+            if result is None or result.returncode:
+                print(logs[-8000:], file=sys.stderr)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())