docs(planning): mark Phase 0.3 PARTIAL + add Phase 0.3.1

Phase 0.3's scope (Playwright `undefined` env var failure / Windows
binary path on Linux runner) is fixed by commit e47ad78 — workflow run
25920807221 shows Smoke 1 ✅ + Smoke 2 ✅, the chromium launch is now
working on Linux. Smoke 3 still fails, but at a different point: LC01
and LC02 are gate-rejected because the wladmin1 CI user doesn't have
`allow_admin_create_rule` / `allow_admin_create_csv` permissions seeded
in Admin Settings, and the subsequent `waitForSelector` times out
because pending table is empty.

That's a test-seed pollution issue analogous to Phase 0.2.1's
KV/rate-limit pollution — `setup_test_env.sh` provisions roles but
doesn't seed Admin Settings KV. Spun out as Phase 0.3.1 so Phase 0.3's
own scope is honestly tracked (`⚠️ PARTIAL` per the same pattern as
Phase 0.2).

Following the convention from Phase 0.2 / 0.2.1 (see commit 7202cc1):
when a fix unmasks a pre-existing infrastructure issue, declare the
original phase partial-done with evidence, then split the unmasked
failure to a new sub-phase so the acceptance criteria are individually
trackable instead of conflating two distinct bugs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: wildleo91

docs/PUBLIC_RELEASE_PLAN.md

@@ -67,7 +67,8 @@ CLAUDE.md split. Purely internal; no external dependencies.
 | 0.1 ✅ 2026-05-14 (commit 7d4765a) | Fix `validate-and-package.yml` — bump `actions/upload-artifact` v3→v4 (also `actions/checkout` v3→v4 same file; audited all 10 workflows in `.github/workflows/` — none of the other 9 still on v3) | Workflow green on next push | 15 min |
 | 0.2 ⚠️ 2026-05-14 (PARTIAL — see note) | Fix `ci.yml` + `integration-tests.yml` pytest/Python mismatch (pytest 9.x requires Python ≥3.10; CI uses 3.9). **PARTIAL FIX:** bumped Python 3.9 → 3.11 in 4 places (ci.yml × 2, integration-tests.yml, release.yml) in commit `1fe4f92`; fixed 2 unmasked mock bugs in `tests/unit/test_limits.py` in commit `c5c08d1`. **Result on c5c08d1:** `ci.yml` GREEN (4/4 jobs); `integration-tests.yml` STILL FAILING — 23 fails + 220 errors. The integration-tests failures are NOT the Python mismatch alone; the round-7 install failure was masking a large body of pre-existing infrastructure debt: Splunk container 10-s curl-timeout under chaos load, KV-state pollution between tests, rate-limit state leaking across the suite, and one Python-version issue (pytest 9 dropped `pytest.skip(msg=dict)`). These need their own phase — see new Phase 0.2.1. | Both workflows green. Decision documented: cap pytest at ≤8.4.x OR upgrade workflow Python to 3.10+ | 30 min (Phase 0.2 estimate accurate for the mismatch fix itself; 0.2.1 scope much larger) |
 | 0.2.1 | Fix `integration-tests.yml` red — separate from 0.2's Python bump. Triage: (a) `pytest.skip(msg=dict)` → `pytest.skip(reason=str)` migrations (pytest 9 API), (b) chaos-test docker curl timeout 10s → ≥30s for GitHub-Actions runners, (c) container_state fixture KV/sentinel cleanup race (Ring 2 Day 7 work), (d) rate-limit state pollution between RBAC-matrix tests. Acceptance: ≤2 flake-resilient retries, 0 hard failures. | `integration-tests.yml` green on 2 consecutive pushes | 4-8 hr |
-| 0.3 | Fix `e2e-smoke.yml` Playwright `undefined` env var failure (Windows binary path appears on Linux runner) | Workflow green | 1-2 hr |
+| 0.3 ⚠️ 2026-05-15 (PARTIAL — see note) | Fix `e2e-smoke.yml` Playwright `undefined` env var failure (Windows binary path appears on Linux runner). **PARTIAL FIX:** commit `e47ad78` replaces the hard-coded `process.env.LOCALAPPDATA + "/ms-playwright/chromium-1208/chrome-win64/chrome.exe"` constant in `tests/e2e/lib_helpers.cjs` and `tests/e2e/test_task8_modularization.mjs` with a platform-aware `resolveChromiumExecutable()` (honors `PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH` → Windows-with-`LOCALAPPDATA` path → `undefined` so playwright-core auto-resolves). Also pins `e2e-smoke.yml` / `e2e-full.yml` / `a11y-audit.yml` to `npx playwright@1.59.1 install ...` so the installed chromium revision matches `playwright-core@1.59.1`. **Result on e47ad78:** workflow run `25920807221` — Smoke 1 ✅ + Smoke 2 ✅ (chromium launch verified working on Linux runner), Smoke 3 ❌ failing at a *different* point: `LC01`/`LC02` rejected by the admin-settings gate ("Creating detection rules is not permitted. An admin must enable it in the Control Panel"), then `bPage.waitForSelector("table.wl-table tbody tr")` at line 155 times out because pending table is empty. This is test-seed pollution analogous to Phase 0.2.1's KV/rate-limit pollution — `setup_test_env.sh` provisions the wladmin1 user/role but doesn't seed `allow_admin_create_rule = true` / `allow_admin_create_csv = true` in Admin Settings. Belongs in a follow-up — see new Phase 0.3.1. | Workflow green | 1-2 hr (env-var fix accurate; test-seed work much larger) |
+| 0.3.1 | Fix `e2e-smoke.yml` Smoke 3 (`test_control_panel_long_content.cjs`) red — separate from 0.3's chromium-launch fix. Triage: (a) `setup_test_env.sh` needs to seed Admin Settings KV with `allow_admin_create_rule = true` + `allow_admin_create_csv = true` for the CI wladmin1 role, OR test must bypass the gate by setting these via REST API in a pre-test step, (b) LC05+ visual checks assume pending-table population; if the test seeds entries via REST it should also clean them up to avoid cross-run pollution. Acceptance: `e2e-smoke.yml` green on 2 consecutive pushes. | `e2e-smoke.yml` green on 2 consecutive pushes | 2-4 hr |
 | 0.4 | Verify `a11y-audit` / `zap-baseline` / `pip-audit` workflows fire on schedule | At least one successful recent run of each | 10 min |
 | 0.5 | CLAUDE.md 3-bucket migration: extract Decision Log → `docs/DECISION_LOG.md`, Operational Procedures + Disaster Recovery + Rollback → `docs/RUNBOOKS.md`, Splunk Quirks → `docs/SPLUNK_QUIRKS.md` | 3 files exist, cross-references in CLAUDE.md updated, doc-drift hook passes | 2-3 hr |
 | 0.6 | LICENSE: MIT → Apache 2.0 + add NOTICE file | LICENSE replaced; NOTICE added per Apache 2.0 conventions | 30 min |