[paulyan678]

Cart reads could repopulate stale cache entries or mix totals with line items during checkout. Agent AI could append an old answer to a newly uploaded document, expired PDFs remained in memory until another request, and Android cover art lacked an SVG decoder. This change fixes those behaviors and adds executable integration evidence across the four applications.

• OnlineOrder removes cart caching, reads consistent PostgreSQL snapshots, and adds deterministic stale-read plus real database interleaving regressions.
• Agent AI cancels obsolete requests, rejects late results, periodically removes expired content, and tests successful/failing optional provider contracts. A checked-in CC0 PDF and ten questions provide a reproducible retrieval smoke evaluation.
• SocialAI verifies Elasticsearch, GCS, metadata-token, image-provider, and preview retry contracts with local HTTP fakes; multipart temporary files are removed after handling.
• Spotify registers Coil's SVG decoder and adds device tests for the actual image loader, Room disk reopening, and real Media3 playback/seek.
• Root workflows use the monorepo paths, frozen Node installs, PostgreSQL, and an Android emulator. Dependency updates clear the observed Node audit findings. Documentation distinguishes synthetic fixtures, local contracts, device checks, and live-provider boundaries.

Validation performed locally and in CI:

• OnlineOrder: 16 Java tests + 3 real PostgreSQL tests + bootJar; 9 frontend tests and production build. Cache and read-isolation regressions fail against the corresponding old behavior. The add-versus-checkout test observes PostgreSQL Lock wait state and the held checkout connection in pg_blocking_pids before releasing the transaction; removing FOR UPDATE fails that exact assertion, and restoring it passes all three integration tests.
• Agent AI: 26 Node tests + 6 browser tests, production build/check, and retrieval evaluation (8/8 answerable pages retrieved and 2/2 absent topics rejected in both chunk configurations).
• SocialAI: Go race tests, vet, binary build; 6 frontend tests and production build.
• Spotify: 7 backend tests and offline project validator locally. GitHub Actions executed 6 Android JVM tests and 4 API-35 emulator tests (Room save/delete and disk reopen, actual SVG decode, real Media3 playback/pause/seek), all passing with no skipped device tests; debug/test APK assembly and lint also passed. Runtime evidence at 251f592.
• All three Node workspaces report zero known vulnerabilities for the checked-in lockfiles at validation time.

No paid provider or live cloud service was exercised. Android instrumentation checks focused runtime boundaries, not a full UI-to-backend recording. Existing history, namespaces, and notices are preserved. No merge is requested until the CI results are reviewed.

Final head 251f5921467a385a6ccbe886f1f2b6e08eecb928: all seven checks pass. Workflow results: Agent AI, OnlineOrder, SocialAI, and Spotify Local. Downloaded reports confirm the 16 + 3 Java tests, six Android JVM tests, and four executed device tests with zero failures or skips.