Release notes

The locked install gate follows the fix review of 8d0999eeb: npm_config settings, every npm ci checked on its own, the import check after the last copy · 2a96e3d

Fix review (sonnet, the opus round 1 probes re-run unchanged): approved, all 7 earlier bypasses refused, 5 harmless reformats pass. Three reproduced LOW shapes are closed: any npm_config_* through ENV or ARG in deps or prod_deps (npm 10.9.7 installs dev packages for npm_config_include=dev and npm_config_production=false although --omit=dev is on the command line), a RUN line is split into its commands (shlex words, cut at && || ; | &) and every npm ci must pass --omit=dev itself (a second npm ci without it, an ech…

GetOrCreateConversation with the real identity fallback, from the fix review of batch 8b (hot path order, missing profiles, a network error on one side) · d1f89bd

Adopted from the fix review uber-r58-59-fixrev2-opus (findings L1 and L2): with the real resolveDualSubjectIdentityOrAuthUidOnly (only ProfileService and the logger faked) an existing V1 row returns before any profile read, no profile row or a row without or with a numeric profileId means not migrated (a new row is inserted), a network error on one side's profile read rejects, inserts nothing and logs once at error with that authUid, a migrated row found through the dual-identity filter is returned. 5 tests, test …

The review fixes of batch 8b rows 58 and 59: a failed dual-identity lookup no longer forks a migrated pair's thread, one audit outcome per OIDC callback path, linear redaction of… · e730a04

Reviews of 0dc769e13 (opus approved, sonnet approved after fixes) and of d8a98ad4c's fixes (opus approved). The sonnet review found the same swallowed lookup in getOrCreateConversation: a transient identity or conversations error inserted a second conversation row under the generated id and forked the thread of a migrated pair, nothing logged; it now throws (red 2). OIDC callbacks: a rejected redirectUri writes outcome redirect_rejected, Zitadel in dev bypass writes provider_disabled, and every path writes exactly…

Opus (gate and pipeline angle) approved with 5 LOW findings, sonnet (image and boot angle) approved after fixes: the build-time import covered only the @ifeoma-tc packages, so a m… · 8d0999e

issing zod passed. The import check now imports every production dependency (one fixed line, compared exactly, so `|| true` or a vacuous text cannot pass). The gate reads the Dockerfile with the context gate's reader (comments dropped, continuations joined), checks that the LAST copy into node_modules comes from prod_deps, refuses any package manager in a runtime stage, a second command in prod_deps, --include=dev, --production=false and install-links (also split by a continuation or set through ENV), and accepts …

The api runtime stages install their production dependencies from the tested lock (batch 8b row 58b): a locked prod_deps stage, a build-time import check, a gate, no unlocked inst… · ff74d19

The runtime stages `stage` and `runner` ran an unlocked `npm install --omit=dev` because the lock cannot load in the flat /app layout, so production could differ from the tested lock: the current production image differs from the lock in 94 of 349 packages. A `prod_deps` stage FROM deps now runs a locked `npm ci --omit=dev --ignore-scripts` in the lock layout, both runtime stages copy its node_modules (the relative links resolve to /packages/<name>) and import every @ifeoma-tc dependency at build time. Not --insta…

Fail-fast conversions of batch 8b row 59: one migrated-conversation lookup that throws, no duplicate secret check, no invented flag default; D7 route test on the real database · 0dc769e

resolveMigratedConversationId answers null only for a pair that is not migrated and throws on a failed lookup (the best-effort wrapper and drain row 26b's log test are gone; the purge uses the same function). The chat fakes without findOne that the old swallow had hidden are fixed. openAuthRateStore trusts the env schema's INTERNAL_API_SECRET check. The realtime match flag reader keeps the last value really seen, boot seeding fills it from the stored row so an operator's OFF survives a restart, and with no value e…

The unowned security work is adopted after two reviews (batch 8b row 58): redirect allow-list, linear log redaction, notification target guard, one audit outcome per OIDC callback… · d8a98ad

Redirect allow-list: https only, no userinfo, loopback and *.localhost hosts may use http (the rehearsal host sets CORS_ORIGINS to itself). Log redaction of code, state, sessionId, redirectUri, nonce, id_token and access_token, linear in the url length (a 64000 question mark url took 2.7 s). Service worker: a notification click target must be a same-origin http(s) url, a rejected target is logged once with its origin only. finalizeOidcCallbackSignIn returns signed_in or refused, both callback routes write one audi…

Production run 9ce320871451 (batch 8: the 583 commits since batch 7); records, snapshot, dashboard, review line · a83d340

Batch 8 is in production: rehearsal run 20261101T074600Z-9ce32087-269cb5 green in 7 minutes, production run 20261101T075309Z-9ce32087-47f946 green in 28 minutes, 6 of 6 read-only checks, snapshot of 19 containers with 0 findings, independent checker APPROVED (six LOW findings, filed in docs/notes/backlog.md). The by-hand record is deleted as agreed. APPROVED 776ffa9d8 closes the one gap of the approval table. Correction: the manual push of 776ffa9d8 ran no pre-push hook (the hooks path override named a folder this…

Batch 8 re-freeze after the integration tier fixes, row 55c done: APPROVED [redacted] · 9ce3208

The integration tier found five more specs older than product rules that changed on purpose. Fixed in the test code only (efc6a0b1d), each passes alone. The new code state is [redacted] and this commit is the release commit. The backlog gets the findings of the work: four more specs that read authUid off a discovery card, the web type check that excludes tests, the tombstones of alone runs, the forced worktree removal slip and the lane viewer state. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4K…

Five integration specs follow the product rules of the batch 8 range: full reveal for a contact share, list labels, profile ids on discovery cards (drain row 55c, found by the bat… · efc6a0b

The integration tier went red at five more spec files, each from a product rule that changed on purpose: (1) contact share needs the full reveal, so the contact share contract spec takes the real route (vibe check from both sides, first press, accept); (2) a connection list row shows eight hex characters of the profile id on a discovered row and the uid prefix at every other stage, and the API list item hides the peer uid (userBId null) and names the peer by peerProfileId, so the three peer spec matches both label…

Batch 8 re-freeze after the integration tier fix, row 55c done: APPROVED [redacted] · e0f2eac

The integration tier went red at the contract conformance spec: three expectations were older than product rules that changed on purpose. Fixed in the test only (8e86c5262). The new code state is [redacted] and this documents-only commit is the release commit. The approval report shows no gap. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The contract conformance spec follows the product rules of the batch 8 range: a block ends the pair, a photo needs the full reveal (drain row 55c, found by the batch 8 integration… · 8e86c52

The first t2i run went red at api-response-openapi-contract-conformance.spec.ts, which passed alone in no state of the new code: three expectations were older than the product. (1) Since drain row 31 a block ends the pair for good and the E2E seed cannot advance a rejected pair, so the block, unblock and discovery round trip now runs on a third fresh peer (Carol) and Alice and Bob stay open. (2) The icebreaker steps change the shared pair to anonymous_chat_active, where messaging is refused, so they move to the en…

Batch 8 re-freeze after the Mongo drift gate fix, row 55b done: APPROVED [redacted] · f2a3836

The second gate run went red at the real-Mongo drift check of the stub garbage collection (abuse_ladder_events unclassified). Fixed in 651d37f16 and the by-hand pin in 34f3480b8. The new code state is [redacted], this documents-only commit is the release commit, the approval report shows no gap. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The by-hand record is pinned again to the stub reference list after the abuse_ladder_events entry (drain row 55b) · 34f3480

The no-ids record pins the git blob of each acknowledged list file. stubReferenceSources.ts changed in 651d37f16 by one string map entry (the diff is data only: the check of row 53q passes), so its pin is updated with scripts/pin_by_hand.py. The other two pins are unchanged. The real range is still rehearsal-only with the record applied. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The stub reference lists classify abuse_ladder_events (drain row 55b, found by the batch 8 gate: api-mongo-integration drift check) · 651d37f

The batch 8 gate failed at the real-Mongo drift test of the garbage collection of content-free stubs: the re-key inventories mint abuse_ladder_events (the ephemeral exclusion list got it in drain row 9c) but stubReferenceSources.ts declared only rate_limit_entries as holding no person. The entry is added with its reason. The by-hand record pins this file, so it is pinned again in the next commit. Red: the gate step, and the drift check alone on the live tree (expected [abuse_ladder_events] to equal []). Green: the…

Batch 8 re-freeze after the lint gate fix, row 55a done: APPROVED [redacted] · 2060af4

The first gate run went red at web-lint-ratchet. The cause (a ref written during render, copied into four test harnesses) is fixed in 90a6a2b3e. The new code state is [redacted] and this documents-only commit is the release commit. The approval report shows no gap. The standing owner approval of 2026-10-31 and the rules of the freeze stand. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The polling message list ref is written in a layout effect, not during render (drain row 55a, found by the batch 8 lint ratchet gate) · 90a6a2b

The batch 8 gate in the clean copy failed at web-lint-ratchet: 26 errors against a baseline of 19. useMessagePolling.ts wrote messagesRef.current during render (the react-hooks/refs rule, also the LOW finding of the sonnet fix review), four forward poll test harnesses copied that write and the real-hook test returned an unnamed wrapper component. The hook and the harnesses now assign the ref in a layout effect, which runs before the poll's effects, and the wrapper has a name. Red: the lint ratchet gate (7 new erro…

Batch 8 freeze, row 54 done: APPROVED [redacted], standing pipeline approval recorded · 13b0bfa

The code state of batch 8 is [redacted]. This ledger commit is documents only, so the release commit is this one and no other commit goes on main until the evidence commit of row 57. The approval report shows no gap. The standing owner approval of 2026-10-31 for batches 8, 8b and 9 covers the pipeline code of the range after the pipeline diff was read by the reviewers named in row 54. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Final approvals of the batch 8 commits added after the first report, the approval report shows no gap · 48c4642

Each approval names its basis: the pipeline reviews of rows 47b to 48 by pdiff8 and pipe8-final, the forward poll by fix53g-web, rows 53m and 53n by the referee arb54-pipe and the attack review att54-gate-sonnet, the referee's ordered fixes (4b4ab1617, f5a11dd3f) conditional on the landing verifier's re-run, the generated release-notes bundle and the approval report tool. scripts/release_approval_table.py now prints 573 non-merge commits: 266 docs-only, 307 recorded, 0 gaps. Claude-Session: https://claude.ai/code/…

The data-only check of a by-hand record catches hidden code, in its own module (drain row 53q, referee arb54-pipe F2, attack review att54-gate-sonnet part B) · f5a11dd

The line check accepted code behind a comment, a lone brace pair, a string changed inside a function, a call as an object value, a generator line, a plus-plus line read as a diff header, and a form feed or U+2028 that hides code. The check moves to cicd/compose/data_only_diff.py: lines are cut at newline only, hunk headers are read by position, a line separator is code, a comment must be complete on its line, object entries take string values only, an object or block comment is accepted only when it opens and clos…

Backlog lines of row 53p are two lines again (a literal backslash n had joined them) · 6e87f22

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The Python Dockerfile gate is no weaker than the bash gate it replaced, and refuses the shapes the attack review found (drain row 53p, referee review arb54-pipe F1, attack review… · 4b4ab16

The referee review found that 2538e1330 passed seven unlocked-install and hidden-source shapes the previous bash gate refused: npm ci with a lone &, a command substitution or a backtick, a path-qualified npm, an empty line inside a continuation, a form feed and a lone carriage return inside a COPY. The attack review added a BOM that hides escape=, a custom syntax frontend, SHELL, a variable as command, other installers (pip, go, cargo, gem, apk, apt, curl, wget), a duplicate mount type and Dockerfile names that we…

Rows 53p and 53q file the findings of the sonnet attack review with the declared threat model · 7fd184d

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Review rounds 1 and 2 of the batch 8 pipeline fixes recorded, the referee review (round 3) started · 3f1b797

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The migrated-name exemption covers TypeScript only, and the refusal sentence test can fail (drain row 53o, fix-diff review fix54-pipe-opus on 1c6a705f5) · 6e375b2

The exemption was by location, so a SQL file, a Python data fix or an mjs script named migrated under the api or web src tree came out image-only. It is now the ts and tsx files of those trees only. The first assertion of the refusal sentence test could not fail (an image-only class always explains with an empty list); the test now uses a range that is refused. Red first: 3 of 3 new cases were image-only. Green: 218 classifier-family tests and the real range is still rehearsal-only. Claude-Session: https://claude.…

The product Dockerfile gate is an allow-list over logical lines in Python (drain row 53n, fix-diff review fix54-pipe-opus on e134e148c) · 2538e13

The bash line reader missed 14 more shapes after the first fix: a bind mount next to a cache mount, ARG and ENV hiding .., npm with options before install, the exec form, npm and install on two lines, npm update, an npm alias, pnpm, yarn, npx, an env prefix, sh -c, a backslash plus a space, a heredoc and ONBUILD. A deny list over single lines cannot end that. The gate now joins continued lines and allows only: plain relative COPY and ADD sources in src or tools, a cache mount as the one RUN flag, and a package man…

The no-ids by-hand record names exact lookup lists and its diff must change comments and list entries only (drain row 53m, fix-diff review fix54-pipe-opus on d1c32df1d) · 45a860a

The opus review reproduced that the glob allow-list accepted files that hold step code (types.ts holds the migration id the executor writes), nested and case-variant paths, and that its comment claimed the lists never decide a step although they feed the GC and rekey steps. The allow-list is now an exact, case-sensitive set of eight files checked first, and load_by_hand reads the diff base..head of every acknowledged file in the no-ids form: only comments, blank lines, brackets and string list or object entries pa…

Rows 53m to 53o file the findings of the opus fix-diff review, with the by-hand design decision · 090e9a0

The opus review of the pipeline fixes rejected d1c32df1d (the allow-list holds step code, matches nested and case variant paths, its comment is false) and e134e148c (14 hostile shapes still pass the Dockerfile gate) and approved 1c6a705f5 with follow-ups. Decision for the by-hand form: exact names plus a machine check that the diff of an acknowledged file changes comments and list entries only. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Backlog lines of the sonnet fix-diff review of the inbox back-off and the error page logout · 02b0e4d

The review fix54-web-sonnet approved both commits with LOW follow-ups: the sibling poller useChatSessions has no deadline, a remounted inbox has no data during the wait, a 429 does not stop the rest of the round, per-tab deadline, test hygiene of the logout and providers tests, no federated logout on the error page. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Row 54 part 3, two reviewers read the fix diffs of rows 53h to 53l · c873759

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The migrated-name exemption is limited to api and web source and the refusal sentence shares the class's rule; test clock and dead argument fixed (drain row 53l, final reviews pip… · 1c6a705

The catch-all let any path with the word migrated through as image-only, so scripts/migrated-users.sql, a backfillMigratedAccounts script and a Python data fix were no longer refused. One helper (_is_unrun_migration) now serves classify_change and explain_change: migrated is exempt only in application source of the api and the web, a script, SQL or Python file named migrated stays refused, and the refusal sentence names the same files as the class. The gap test fakes the clock 31 s after the cursor message so a cl…

The error page logout emits the client sign-out event first (drain row 53k, final review fix53g-web B2) · efff270

The error page logged out through NextAuth directly and never told the client session bus, so the failed-send stash, the biometric session and the query cache of that tab survived the logout. handleLogout now calls emitClientSignOut() first, as useAuthSignOut does, and the event fires even when NextAuth throws. A caller's own onLogout still owns the sign-out and the hook emits nothing then. The providers mount test of the stash bridge removes comments before it counts, so a commented-out component no longer passes…

The inbox 429 back-off survives a remount, a stale 429 and a viewer swap (drain row 53j, final review fix53g-web B1) · 9949a05

The retry deadline lived in a per-instance ref, so it was lost when the Chats page unmounted and mounted again (navigate away and back), when a 429 answered a read the effect restart had already made stale (the staleness check dropped it before it was recorded), and when the viewer went A to B to A. Each of the three read every peer at once during a lockout. The deadline is now one module-level map of viewer to retry time, written where the 429 is seen before the staleness check and read at every poll start. The e…

The Dockerfile gate judges every spelling, refuses parent and absolute sources, mounts and unlocked installs (drain row 53i, final reviews pipe8-final-opus F2 F3 F4 and pipe8-fina… · e134e14

The gate said every COPY and ADD and no unlocked install but read only upper-case instructions at column 0, skipped absolute sources, followed .. segments, never looked at bind mounts and allowed any npm install. Each line is now trimmed and its instruction word folded, an absolute source is judged like any source, a .. segment and any non-cache mount are refused, and only the two deliberate api runtime install lines may install without a lock. The builder packages check takes its links expectation from a per-Dock…

The no-ids by-hand form accepts only the three lookup lists, every other migrations file needs ids (drain row 53h, final reviews pipe8-final-opus F1 and pipe8-final-sonnet B1) · d1c32df

The no-ids acknowledgement forbade only registry.ts and the *Migration.ts modules, so the code that drives the steps (executors, planners, cores, repair and swap helpers, the runner) could be acknowledged with a free-text reason and the range classified image-only. Both final reviewers reproduced it. The forbidden list is replaced by an allow-list of the three lookup lists the real record names; every other file needs ids, which claim a run by hand. Rows 53i to 53l carry the other findings of the two reviews. Red …

Batch 8 coverage record names the 152 commits the coverage reviewers read, row 54 part 3 started · e59ab1f

The new approval report found 160 unrecorded code commits. 152 are the ones four opus coverage reviewers read (rows 53a to 53g came from them) or that carry their own drain row verdict: they are named in docs/notes/reviews/batch8-coverage-record.md with the basis stated. The other 8 are read by an opus and a sonnet reviewer now running; their approval is pending. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Release_approval_table.py, a read-only report of every commit of a release range against the review records (drain row 54) · b7c3f64

The freeze needs one answer: which non-merge commits of the range are docs-only, named in a review record or a gap. The row 47 script was a throwaway in the scratchpad. This keeps it (stdlib, imports nothing from cicd, writes only the table file it is given), exits 1 on a gap and 2 on an empty range or bad input, with tests on a throwaway git repository (6 tests: named, unnamed, short sha, table file, empty range, bad input). Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Row 54 part 2, the release-notes bundle is regenerated and committed · 1aef417

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Regenerate release-notes.generated.json for the batch 8 freeze (drain row 54 part 2) · da0cfdc

Regenerated with npm run generate:release-notes after the merge of origin/main: 6505 entries, web 0.1.1015, api 0.1.199, the semver check and the release-notes tests pass. It is committed alone and before the ledger freeze commit so the rehearsal covers it. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Row 54 text names no hex prefix that the tick check reads as a commit · f54fe82

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Row 54 part 1, origin/main is merged into main, merge with a foreign staged hunk done losslessly · 6f9b827

The merge of origin/main (the release-notes bundle commit 5523c625e) was refused by git because another session's staged hunk in glass/README.md differs from HEAD. The index entry, the working file and the staged blob were saved, only that entry was set to HEAD for the merge and set back to the same blob afterwards (checked: MM again, same md5, no other path touched). The three blob ids in row 49 no longer read as commit names in the tick check. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFS…

The forward poll window is anchored at the cursor message again, a late commit after a poll gap is no longer lost (drain row 53g, second review fix53g-api on 8edc2ee1c) · 32275a5

The opus fix-diff review reproduced that the clock-bounded window of row 53b (max(cursor stamp, now) - 30 s) lost a message that committed a moment after its stamp when the poll that should find it came more than 30 s later (a throttled background tab, a dropped network, a phone waking): the window was empty and the message never came while the cursor stayed. The window is anchored at the cursor message as before, the nowMs argument is removed, and the repeat of the last 30 s before the cursor, which the client al…

The 429 back-off survives a restart of the poll effect and the failed-send stash is cleared at sign-out from any page (drain row 53g, second review fix53g-web on 81bfc9548 and 366… · a57ef17

The sonnet fix-diff review reproduced a defect in the inbox back-off: it lived only in the effect closure, so any restart of the poll effect (the parent's inbound-unread map changes whenever an unread flag flips) read every peer at once during a lockout. The retry deadline now lives in a ref per viewer and a restart waits for the rest of it; a restart for another viewer reads at once. The sign-out clear of the failed-send stash sat in a chat-only hook, so a sign-out from the settings page left the private text in …

A plain refusal no longer reads the shadow labels (drain row 53f, coverage review cover8-g1 on 99bee67b3) · 63736fe

The rate middleware awaited shadowLabels(request) on every refusal before it checked whether a lockout started, although only a refusal that starts a lockout becomes an event. On the block policies the labels are two database reads (countLiveChatPeers, isPayingMember), so a refusal flood on block and unblock cost two queries per request that it never cost before. The labels are now read only when decision.lockoutStarted is set. Red first: shadowLabels was called for a plain refusal. Green: the new test (plain refu…

The failed-send stash is scoped by viewer, logs its storage failures and is cleared at sign-out (drain row 53e, coverage review cover8-g3 on 5dafbf54d and c38962268) · 366274e

The stash was keyed by the peer's account id only and nothing cleared it: on a shared tab, account B's chat with the same peer restored account A's private text and idempotency key as B's own failed row, and a retry sent A's words from B's account. It is now keyed viewer, then conversation, then staged id (storage key v2, the unscoped v1 key is never read and removed at sign-out), the empty catch blocks log the failure with its cause (the send path still never fails because of the stash), clearFailedSends runs thr…

The icebreaker reminder finds the right person for a migrated member and no longer starves (drain row 53d, coverage review cover8-g2 on a13e39935 and 45e70aa0e) · 77bcf31

The reminder decided the other member with a plain string comparison of conversationConsent.requestedBy with userAId. Since D5 requestedBy is the requester's CURRENT session id, which for a migrated member matches neither stored side, so the reminder went to the initiator's own old id and the real recipient never got the only reminder (the flag was already taken). The side is now decided identity aware (resolveViewerSide, by profile id), a row with no resolvable side is skipped and logged BEFORE the flag is taken,…

The requester gets the accepted push once, not again on a replayed accept (drain row 53c, coverage review cover8-g2 on 5c165012e) · b85b1b3

The route pushed the requester for every accept that succeeded, but respondConversation also succeeds when the conversation was already active (a double tap, a retry after a lost response, the loser of two simultaneous accepts). respondConversationOutcome now returns {connection, transitioned} like respondChatOutcome (false for the already active row and for a lost compare-and-set that finds it active, true for a real accept and a decline), respondConversation is a thin wrapper, and the route pushes only for accep…

The forward poll invalidates caches and reloads the session only for a message the thread does not hold (drain row 53b part 2, coverage review cover8-g3 on 9e9debcf5) · e479176

The late-commit window of the API can return a message the client already holds. The poll treated any non-empty answer as new: on every tick it invalidated the connection caches (no throttle) and called the throttled session reload, which reopens the rate-limit load of W0.140.al. useMessagePolling now keeps a ref of the thread's messages, and the forward poll counts an answer as new only when it holds an id that is not there. A repeat answer still merges by id (a read status patch lands) and advances the cursor. R…

The forward poll of a quiet thread no longer returns an old message on every poll (drain row 53b part 1, coverage review cover8-g3 on 9e9debcf5) · 8edc2ee

The late-commit window of getMessages was anchored at the cursor message's createdAt, so after a thread went quiet every poll with the unchanged cursor returned the messages stamped up to 30 s before the last one, again and again. The window now starts at max(cursor stamp, now) minus 30 s: a late commit is at most 30 s after its stamp, so an older row cannot be one. getMessages takes the clock as its last argument (the wall clock by default). Red first: the second poll of a quiet thread returned m1. Green: 4 tests…

A contact share is accepted only at the full reveal, also for a request made before that rule (drain row 53a, coverage review cover8-g3) · 51b3199

The request path refuses a contact share before the full reveal (owner decision 1, d01f14c95), but the accept used the wider group contactShareEligible (conversation_active, anonymous_chat_active, chat_requested, chat_active), so a pending request created earlier could be accepted at a blind stage and the phone number was written. The accept now uses isContactShareRevealStage, the same rule as the request. The control test that pinned the wrong behaviour now seeds chat_active. Red first: the accept at conversation…

The coverage review of 113 unreviewed commits found six defects to fix before batch 8 (drain row 54) · 9e93dda

Four opus reviewers read the commits without a review record. Groups 4 (build, pipeline, UI) had no blocker. Fixed: the Chats inbox poll ignored a 429 (81bfc9548). Queued as rows 53a to 53f with the reviewers' reproduced probes: a contact share accepted before the full reveal (privacy), a forward poll that returns an old message on every poll, a duplicate accepted push, an icebreaker reminder for a migrated initiator that goes to the wrong person, a failed-send stash shared across accounts, and two database reads …

The Chats inbox status poll waits the server retry time after a 429 and the wait has a ceiling (drain row 54, coverage review cover8-g1 on ed2bd23ed) · 81bfc95

Since drain row 8 the inbox reads each peer's session in useChatStatus only. The back-off of drain row 7 lived in useChatSessions, which the inbox no longer calls, so a locked-out client kept polling every peer every 10 s and every poll counted as a request during the lockout. useChatStatus is now a timer chain: each load schedules the next poll with nextChatPollDelayMs, and the load returns the 429 of the round with the longest retry time. nextChatPollDelayMs has a ceiling of one hour (CHAT_POLL_MAX_DELAY_MS in t…

Row 53 done, the production Stripe webhook now subscribes to the two async payment events the code handles (drain row 53) · 7d2418a

Read from inside the production api container with its own key (the secret store is not running on the workstation): one live endpoint, api_version dahlia, 8 events. The two events checkout.session.async_payment_succeeded and ..._failed, handled by StripeBillingProvider, were not subscribed, so delayed payments never granted access. Added in place (no new signing secret), guarded against a changed endpoint, read back: 10 events, enabled. The api_version stays as documented in stripeWireHelpers.ts. No code change. …

Row 52 done, the rollback drill passed in both scenarios and the rollback takes about 27 seconds (drain row 52) · b19c458

Scenario verify-unavailable (runs 7841e91f and 8022d63f) and scenario database-down (runs ac7c87fa and 5f5c8b3c), two runs each on the committed pipeline: all ok, five host checks pass, the rollback stage ran 26.5 to 27.0 seconds. The rollback does not restore the database. No code change. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The web builder stage copies and links the rate meter package, and a check keeps the stages equal (drain row 51) · 130a690

The production web build of the committed HEAD stopped at "Module not found: Can't resolve '@ifeoma-tc/rate-meter'": src/apps/web/Dockerfile copied the shared package in the deps stage and not in the builder stage (24 of 25 packages) and did not link it into node_modules/@ifeoma-tc, so only the image build broke (tests and the dev stack never run that stage). Without this the batch 8 release could not have built its web image. The builder stage now copies and links it. At the lowest layer a new check, scripts/chec…

D1 slices 1 and 2 are fixed and slice 3 is suspended (it needs an opaque connection id), D2, D3 and D16 are fixed by the commits named in each status. · c425f10

TICK-CHECK-PLANREF-W25 is closed, the two accessibility lines are marked as fixed on the UI branch and arriving with the merge back. The WAVE-26 plan items move to the records row after the merge back: their verifies name files that do not exist yet on main and the plan file has no item text write operation in this session. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The stage table and the fix queue rows 9 to 11 are corrected with checked facts (drain row 50 part 1) · 2b2126d

Stages B and C of the ledger are done (W24.2.a to W24.2.e and W24.3 are checked in WAVE-24) and D is in progress with production deploys of batches 4 to 7, the canary W24.4.b and the exit demo W24.5 still open. Fix queue items 9 and 10 are DONE (no owner step remains), item 11 is done except D1 slice 3 (suspended, needs an opaque connection id), the D7 route test and the D15 tail (finish plan row 59). The WAVE-26 items need their verify commands rewritten first and stay in row 50. Claude-Session: https://claude.ai…

The locked install of the api runtime stages is row 58b, after batch 8 (drain row 48) · a324015

Found by row 48 as 48b. It changes the packaging of the api runtime image, so it runs in batch 8b after batch 8 is live and verified, with its own rehearsal, and not in the 521-commit release. The unlocked install is the status quo, the release does not worsen it. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

No hidden npm fallback in the product Dockerfiles, and the gate refuses one (drain row 48) · dfe35f6

Owner order: remove fallbacks. The api runtime stages and the simulation worker installed with `npm ci ... 2>/dev/null || npm install`. Removing the fallback showed a real defect: the runtime stages copied their lock with a glob DESTINATION (`package-lock.json*` creates a file named with a literal star, proved with a throwaway image), so `npm ci` never saw a lock, and with the lock copied correctly the lock still cannot load in the flat /app layout (its file: keys are ../../packages/<name>, the flat layout has /pa…

The rehearsal cover by run records is tested and its sentences name them, row 47c is closed (drain row 47c part b) · 746dfe8

Review pdiff8-opus F2 and F4: `rehearsal_evidence` lets a green rehearsal of an earlier commit cover a later one when the classifier says SKIP_DEPLOY, which includes run records since drain row 10, but no test pinned that and the log line, the docstrings and the READMEs said only "documents or the root dev-stack compose files". New cicd/tests/test_rehearsal_cover_records.py: positive (a records-only commit is covered and the log says run records, red first: it did not), negative (a run record next to a source chan…

The range classifier runs git through the pipeline's process adapter, the compose layer may not use subprocess (drain row 47c part d) · 1ad9117

The architecture scan banned `subprocess` in cicd/compose/range_class.py (permitted only in the adapters, the tests and tooling). git now runs through `cicd.adapters.proc.spawn_process`, as by_hand.py does. Same behaviour: 9 tests in cicd/tests/test_range_class.py green, the real range still says rehearsal-only with the three list files lifted. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The range classifier moves from scripts/ into the compose layer, the architecture scan refused tooling importing cicd (drain row 47c part d) · ae1dd58

The Stop-hook architecture scan found four layer-edge violations in scripts/classify_range.py (tooling may not import cicd). The lowest layer that may import the classifier and the by-hand loader is compose, where by_hand.py already lives, so the tool is now `python3 -m cicd.compose.range_class --base SHA` (same behaviour, same output, same exit codes) with pytest tests in cicd/tests/test_range_class.py (9 checks, run by the t0 step cicd-pytest). The scripts copy, its test file, its t0 step and its README rows are…

Classify_range.py, the release class of a commit range offline, with its tests (drain row 47c part d) · c0b1991

The same probe (git diff of the range, then the repo's classifier, then the by-hand record) was typed by hand three times while preparing the release, and both reviewers of the pipeline diff asked for it as a tool. `python3 -I scripts/classify_range.py --base <production sha>` prints the class, the deciding paths, whether pipeline code changed and what the by-hand record for the base lifts with its reason. Exit 2 on a bad revision or a malformed record, no result printed, nothing written. Red first: the tests fail…

The six mongo integration shards get their own vitest module cache, and a test pins it for every sharded vitest step (drain row 47c part c) · d2206a6

Review pdiff8-sonnet F3: api-unit already gives each of its 6 shards its own `--fsModuleCachePath` (a shared cache folder raced), api-mongo-integration shards the same way (6) with the default shared cache, so it carried the same latent race. It now has `node_modules/.vitest-cache-mongo-shard{i}`. The comment of the prep step web-config-sync sat below it and read as describing the typecheck: moved above. Red first: scripts/test_tc_test_all.py `test_every_sharded_vitest_step_gives_each_shard_its_own_module_cache` f…

The record for 726518b90..HEAD is written, pinned and committed (8b447fc01, code in 5884c6be8). · 175d872

test_release_seam.py dry run was red on main and is green on the clean tree, test_by_hand.py is green. Lesson: the seam test skips while cicd/ or deploy/ is dirty, so the gate commits first, then runs it. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The no-migration-step record for the release range 726518b90..HEAD, pinned to the three list files (drain row 49 part 2) · 8b447fc

Reviewed: registry.ts and every migration module are unchanged, the three list files change by list entries and a comment, and nothing was run by hand. The record is valid only while production runs 726518b90 and every listed file keeps its pinned blob. It is deleted in the release's evidence commit. With it the real range classes REHEARSAL-ONLY (it carries pipeline code) instead of MIGRATING. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The by-hand record has a truthful form without migration ids, "reviewed, no migration step changes" (drain row 49 part 1) · 5884c6b

The release range changes three list files under the migrations folder (no migration step differs), which made it MIGRATING and turned cicd/tests/test_release_seam.py red on main. A judge (opus) and a reviewer (sonnet) decided: reuse the by-hand record, do not add a second mechanism, and do not pay the bridge window (its entries are applied since 2026-10-22). The record (deploy/migrations-by-hand.yaml, schema 2) now accepts `migrations: []` only with a non-blank `reason`, never ids together with a reason. In that …

The official cicd-pytest command (1746 passed, 1 failed) found one real red on main: the release seam test stops because three list files under the migrations folder make the rele… · 32e5ac1

ase range MIGRATING. Opus judged five options, sonnet refuted the judge's pick (a new per-range record duplicates cicd/compose/by_hand.py) and showed that paying the bridge window is blocked (the bridge ran green on production on 2026-10-22, the bridge entries are applied, so a rehearsal stops at already_applied). Winner F: the existing by-hand record accepts an empty migrations list with a mandatory reason, refuses registry.ts and new migration modules in that form, and the release note says "reviewed, no migrati…

The product Dockerfile gate judges every source of every COPY and ADD, and the duplicate Python guard is removed (drain row 47c part a) · 7f3540c

Reviews pdiff8-sonnet and pdiff8-opus found that `cicd/tests/test_classify_runs_guard.py` duplicated the t0 gate `scripts/check_product_dockerfile_context.sh` with a weaker matcher, and that the gate itself judged only the FIRST source of a COPY line, so a second source such as `runs/index.jsonl` rode behind an allowed first one (real lines like `COPY src/apps/api/package.json src/apps/api/package-lock.json* ./` have two sources). The gate now judges every source (all words but the destination), also on ADD lines,…

The release classifier no longer refuses a file named after a migrated account, and the run-record rule keeps every other rule (drain rows 47 and 47b) · 3f8005c

`release --dry-run` classed the whole range 726518b90..HEAD as REFUSED, because the catch-all for a migration the pipeline does not run matched the text "migrat" in `[redacted].ts`, a chat helper for accounts that were migrated to a new auth id. The catch-all is now `migrat(?!ed)`: `migrated` names an account state, while `migrate`, `migration` and `migrating` stay refused. The review of the pipeline diff (opus F1, F2, F6) also found the run-record rule wider than its claim: it sat in the inert list, so a refused-…

Plan v3 to finish and release to production, the ledger table rows 47 to 87 (finish to production) · ba5d658

The owner approved the finish plan after two read-only reviewers (opus, sonnet) criticised it and the owner ordered: no fallbacks, no defensive code, and tests inside the blast radius of every change. The table lists the work in order: release preparation (rows 47 to 53), batch 8 (54 to 57), batch 8b (58 to 62), the screen loop in the branch copy (63 to 70), the merge back and batch 9 (79 to 87). Owner answers recorded: one acceptance sign-off, Stripe read then fix, a standing pipeline approval for three releases.…

Row 45g done, the closing check of the UI branch passed and the branch is pushed to the private remote (drain row 45g) · e5f777b

feature/ui-mobile (head e56dddda5): scope guard 0 violations over 102 paths, the full gallery smoke 560 of 561 (the one picture of the chats inbox updated on purpose), the full unit run with two red contract tests that also fail on main, fixed on main in eb2ff49f6 (my own row 28b and an unlisted row 9c module). The remote was PRIVATE both times, gitleaks found no leak in the pushed range, the release notes hook needed the second push, and the remote ref equals the local head. No PR, no merge into main. Claude-Sess…

The reveal offer is written with stage groups only, and the group table lists the live chat peer count (drain row 45g, found by the full unit test run of the UI branch) · eb2ff49

The full unit test run of the closing check of the UI branch had two red contract tests, and both reproduce on main (run in the live checkout at c417708a9, 2 failed of 7), so they are not caused by the UI branch. (1) connectionStageLocalSetsInvariant: connectionStage.ts typed two stage names in canRequestPrivateChat (drain row 28b, my own change: stage !== "anonymous_chat_active" and stage !== "chat_requested"). It now uses the stage groups only: inside blindChat the stages in requestPending are exactly chat_reque…

Row 45f done on the UI branch, the phone sweep, the gallery checks and the fixes they found (drain row 45f) · c417708

On the branch copy (commit 05703fc67): three more gallery stories (match ring, universe guide panel, how-it-works step graphics) pass at 320, 390, 768 and 1440 px; the 320 px pictures were read and one visual finding (the ring's 100% is crowded) is queued for the screen loop. Row 45f is DONE: phone test projects and the route sweep (no overflow on 16 public and 10 member pages), the measured bottom nav, two keyboard focus stops fixed, the broken how-it-works dots fixed at the root, the gallery smoke at four widths…

Row 45f step 6 part A done on the UI branch, the broken how-it-works dots found and fixed, with the slip and its mechanism fix (drain row 45f) · 92fbff7

On the branch copy (commit cd704dd1e): a 320 px screenshot showed the five how-it-works step dots as 48 by 44 px blobs that ran past their column and under the next arrow. Root cause: the global phone button rule of row 45b is unlayered and beats every utility class. It is now button:not([data-own-hit-area]) and the dots own a 24 by 44 px hit area with a small face; measured 24 by 44 px at 390 and 320 px on the rebuilt stack. The footer strip and platform badges pass at both widths, and the discovery and public st…

Row 45f step 5 done on the UI branch, the bottom nav labels are 12 px and the band is measured (drain row 45f) · 3b4f8e8

On the branch copy (commit 8507f8c9a): a new spec measures the bottom navigation at 320, 390 and 768 px. Red first (10 px labels on phones), then the labels and the chat badge are 12 px and the small-text baseline is empty. Measured on the rebuilt stack: the bar is 72 px on phones and 84 px at 768 against 96 px reserved, so the reserved band stays. Step 6 (the remaining measured screens) is next. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Row 45f step 4 done on the UI branch, the gallery accessibility check found and fixed two focus stops (drain row 45f) · 1712b74

On the branch copy (commits fae9f91ca, 94c15928e, acb30378a): the gallery browser smoke over the stories of the five new primitives and the bottom nav found the axe rule scrollable-region-focusable on the scroll areas of the screen frame and the bottom sheet; both are now focusable regions (red first). The stories are opened at 320, 390, 768 and 1440 px (a widths helper from the one viewport list) and all 78 checks pass. A look at 320 px screenshots found one spacing defect in the sheet, fixed. The bottom nav heig…

Row 45f step 3 done on the UI branch, the signed-in phone sweep is committed and measured (drain row 45f) · 03897cf

On the branch copy (commits 24d959186 and 2f7624e6f): the signed-in phone sweep (every member page at 390 and 320 px, landing check, no horizontal overflow) passed 26 of 26 against the stack served from the branch: none of the ten member pages scrolls sideways; /admin could not be judged (the sweep's member is no admin). A first run failed because of a wrong test environment of my own (the integration tier's instead of the authenticated setup step's); the runner is queued as tier steps in the backlog. Step 4 (the …

Row 45f step 3 part B done on the UI branch, the public phone sweep is committed and measured (drain row 45f) · 8c24e17

On the branch copy (commit 24d959186): the public phone sweep spec with its folder notes passes the whole hook chain; the measured result is no horizontal overflow on any of the 16 public pages at 390 and 320 px. The dev stack now runs from the branch copy. The signed-in sweep (project ui-phone-authenticated, a real sign-up through the setup project) is next. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The UI scope guard allows every README of the e2e tree by one rule, not one file at a time (drain row 45f step 3 part A2) · 7d5ac98

The second commit attempt of the public sweep spec on the UI branch was refused again by the readme-depth gate: the parent README tests/e2e/README.md must name the new folder ui-phone/. Root cause of both refusals: the guard allowed README files one at a time while the gate asks for the README of the folder and of its parent. The guard now allows every README.md and README_INDEX.md under tests/e2e with one rule (docs only; a test file there and tests/README.md stay outside). The exception note and the backlog line…

The UI scope guard allows the e2e helpers README, the public phone sweep is measured (drain row 45f step 3 part A) · 7387637

The first commit of the public sweep spec on the UI branch was refused by the readme-depth gate (class I: tests/e2e/helpers/README.md stale, tests/e2e/ui-phone/ without a README). My earlier note that these README rows could wait for main was wrong, so the guard now also allows tests/e2e/helpers/README.md (ui-phone/README.md is under the allowed folder), the exception note names it and the backlog line is corrected. The ledger records the measured result of the public phone sweep: 16 public pages at 390 and 320 px…

A launcher that starts the dev stack of any checkout with the committed dev auth constant, never printing it (drain row 45f step 3) · 07e6e96

scripts/tc_dev_up_with_dev_secret.py reads the literal NEXTAUTH_SECRET of the web service block from the checkout's own docker-compose.yml, puts it in the environment of <repo>/scripts/tc-dev-up.sh, runs it with the arguments after -- and passes its exit code through; the value is never printed. The dev compose file takes the API's secret from the host shell, so starting the stack from a clean copy needed a throwaway script written by hand for rows 28f and 31c and again for the phone sweep: the third time, so it i…

Row 45f step 2 done on the UI branch, the phone browser projects and the route list (drain row 45f) · 21d3736

On the branch copy (commit 3175c4bc1): the Playwright config has the projects ui-phone and ui-phone-authenticated (touch and mobile Chromium at 390 px), phone_sweep.ts holds the two phone viewports and reads the page routes from src/app, and a 7 test vitest file pins both (red first, one defect of my own test fixed); Playwright loads the changed config. README rows outside the branch scope are queued for after the merge. Next: the route sweep spec and its first real run. Claude-Session: https://claude.ai/code/sess…

The UI scope guard allows the three phone test paths, and row 45f is planned in six steps (drain row 45f step 1) · 0231236

The phone project needs three paths the guard reported as outside the UI scope: src/apps/web/playwright.config.ts, the spec folder src/apps/web/tests/e2e/ui-phone/ and the sweep helper src/apps/web/tests/e2e/helpers/phone_sweep.ts. The guard now allows exactly those; every other e2e folder, helper and config stays outside. The exception note names them. Row 45f is planned in six steps (phone project and helper, the route sweep and its first run, the gallery axe check, the bottom nav height with 12 px labels, the m…

Row 45e done on the UI branch, the six primitives (drain row 45e) · 290a8d6

On the branch copy (commit ab68be20a): the StickyActionBar, an action bar on Button with a note, a secondary and a primary action, 48 px buttons and an opaque sticky surface, with three gallery stories and a 6 test vitest file (red first). Row 45e is DONE: five new primitives (ScreenScaffold, AppBar, BottomSheet, ListRow, StickyActionBar), each built after reading what exists and composed on a named base, and the BottomTabBar is the existing AppNavPresentation with its contract pinned. The axe check and the look a…

Row 45e primitive 5 of 6 done on the UI branch, the ListRow (drain row 45e) · d2f8a62

On the branch copy (commit eb1fc92a5): ListRow is the base for simple lists (leading slot, truncating title and subtitle, trailing slot, the whole row one 48 px button with hover, pressed and focus-visible states when pressable); four gallery stories and a 6 test vitest file (red first). The rich discovery and chat match cards are not replaced. One primitive is left: StickyActionBar, after reading the existing sticky action areas. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Row 45e primitive 4 of 6 done on the UI branch, the BottomSheet (drain row 45e) · 6b007b4

On the branch copy (commit 8ad1d6255): BottomSheet composes the existing vaul based Drawer and adds a required title and optional description, a dvh height cap, the bottom safe-area padding, one scrolling body, a fixed footer and an optional 44 px close button; two gallery stories and a 6 test vitest file (red first). The open sheet is proven only by its own test (the gallery render test cannot see inside a portal). Existing Drawer users under src/features are outside the branch scope and can move in the screen lo…

Row 45e primitive 3 of 6 done on the UI branch, the bottom tab bar is the existing nav, its contract is pinned (drain row 45e) · a4af887

On the branch copy (commit 55ebc14d7): after reading the code, the BottomTabBar primitive is the existing AppNavPresentation (a second nav would be a defect), so no component is built; a 5 test contract file pins the tab height against the touch target token, the bottom edge and safe-area padding, the locked tab and the badge. It passed at once, no defect (said so). The real bar height with 12 px labels stays with row 45f. Next primitive: BottomSheet, after reading the existing modal and sheet code. Claude-Session…

Row 45e primitive 2 of 6 done on the UI branch, the AppBar (drain row 45e) · 9c088b4

On the branch copy (commit fc37f5b4c): AppBar composes Button and DirectionalIcon with the row 45b touch target variables (48 px row, 44 px side columns and back button at every width, truncating title), three gallery stories and a 6 test vitest file (red first, one defect of my own test fixed). The axe check and the look at 320 to 1440 px stay with row 45f. Next primitive: BottomTabBar, after reading the existing bottom nav. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Row 45e primitive 1 of 6 done on the UI branch, the ScreenScaffold (drain row 45e) · 0da3955

On the branch copy (commit 4fb1c0a5e): ScreenScaffold composes the existing ScreenShell and adds a fixed header slot, a fixed footer slot, one scroll surface, optional safe-area padding and the layout container; three gallery stories, a 7 test vitest file (red first) and a pinned story-name list. The first commit attempt was refused by the unused-code scan (story exports without a reference): fixed with the pinned names, and the scan's blind spot is queued in the backlog. The axe check and the look at 320 to 1440 …

Row 45d done on the UI branch, the fluid type rule corrected after a research round, no CSS changed (drain row 45d) · daefee9

On the branch copy (commits 476a7e83a and e97a23b66): a size evaluator, and a read-only research round that showed MDN's "max at least twice min" is not a valid test; the guard is max at most 2.5 times min. All four fluid classes pass it and double at a browser zoom of at most 5, so the three sizes the first version listed as failures were never failures. The research folder and decision 5 carry the correction and the slip (a rule resting on one documentation line was pinned without checking its own claim) is reco…

Row 45d part 3 step 1 done on the UI branch, the fluid type rule and the four classes measured (drain row 45d) · fc34d0f

On the branch copy (commit c637e7edd): fluidType.ts holds the clamp rule and reader; of the four fluid classes the hero display meets the 2x rule and three do not (pinned as known exceptions, red first, 7 tests). No CSS changed because the fix makes wide-screen text bigger: step 2 computes the sizes before and after at six widths first. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Row 45d part 2 done except the bottom nav, the small-text baseline is 3 spots in 1 file (drain row 45d) · 3a06718

On the branch copy (commits 309a64e1e and a2c2bf822): the match ring, the universe guide panel and the how-it-works step graphic (24 spots) use text-xs; the baseline went from 45 spots in 13 files to 3 in 1. Only the bottom nav labels stay at 10 px as a named exception because the nav band height was measured for them: the phone sweep of row 45f measures it with 12 px labels first. Layout effects of the other changes are queued for the same sweep. Part 3 (fluid type scale) is next. Claude-Session: https://claude.a…

Row 45d part 2 files 5 to 9 done on the UI branch, eight more texts are 12 px (drain row 45d) · 6710698

On the branch copy (commit 1334fc442): five files (discovery list row, universe info modal, rating card, build strip, platform badges) use text-xs; the small-text baseline goes from 41 spots in 9 files to 33 in 4 (ratchet red first, then green). Layout effects are not measured and are added to the phone sweep of row 45f. Four files are left; the bottom nav and the how-it-works graphic need a measurement or a design decision. Next file: MatchPercentRing.tsx. Claude-Session: https://claude.ai/code/session_013BMqcrc9…

Row 45d part 2 files 2 to 4 done on the UI branch, three more texts are 12 px (drain row 45d) · 8cb78c5

On the branch copy (commit 47c1b2976): the chat group count badges, the inactive filter badge and the discovery scope chip label use text-xs; the small-text baseline goes from 44 spots in 12 files to 41 in 9 (ratchet red first, then green). Next file: DiscoveryListRowView.tsx. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Row 45d part 2 file 1 done on the UI branch, the chat row chip text is 12 px (drain row 45d) · 2084d3d

On the branch copy (commit c6de386c1): the chip in ChatsInboxRowView uses text-xs and the small-text baseline goes from 45 spots in 13 files to 44 in 12 (ratchet red first, then green). Next file: ConversationGroupTabs.tsx. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Row 45d part 2 step 1 done on the UI branch, the minimum text size and its ratchet (drain row 45d) · a598d13

On the branch copy (commit ab06121c2): the audit's 165 small-text spots were split (45 on the UI side in 13 files, the rest under src/features outside the branch scope), minTextSize.ts holds the 12 px minimum and a reader, and a 5 test ratchet with a tracked baseline table keeps the 45 from growing and lowers it file by file (red first; the baseline first sat in a gitignored .json file, now a .ts table). The ledger orders the file fixes and names the two files that need a measurement or design decision first (the …

Row 45d part 1 done on the UI branch, the one breakpoint list (drain row 45d) · b5612a8

On the branch copy (commit 44600ae20): breakpoints.ts holds the Tailwind v4 default list and the phone limit, useIsMobile reads it, and an 8 test vitest file ties the list to the installed Tailwind theme, the media queries of globals.css, the gallery presets and the hook (red first, then green at once: the CSS and the gallery were already consistent, said so). The duplicate 768 in the orb size hook is outside the branch scope and queued in the backlog. Parts 2 and 3 (minimum text size, fluid type scale) stay open.…

Row 45c done on the UI branch, the viewport is declared once and the fixed bars keep clear of the insets (drain row 45c) · 1664367

On the branch copy (commit e51f3cdbc): the scroll progress bar sits at the top safe-area inset, with a 2 test vitest file (red first, one defect of my own test found and fixed). A second read-only scan found no further bar that needs a change. Row 45c is DONE: one viewport declaration with viewport-fit cover, three bars fixed (ResponsiveCard sheet, nav gate overlay, scroll progress bar) and the modal pinned. The look on a real phone is not claimed (row 45f). Landscape side insets are queued in the backlog. Next op…

Row 45c part 2 bars 2 and 3 done on the UI branch, the nav gate overlay clears the insets and the modal is pinned (drain row 45c) · cd85e44

On the branch copy (commit 72c510e7f): the navigation gate overlay pads its card with the top and bottom safe-area insets; the modal host was read and already pads its dialog, so only a pin test was added (green at once, no defect, said so). A 3 test vitest file, red first for the gate overlay. The ledger names the scroll progress bar as the next bar and plans a second scan for bars placed by token constants or style props. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Row 45c part 2 bar 1 done on the UI branch, the ResponsiveCard phone sheet clears the nav band and the inset (drain row 45c) · acaf358

On the branch copy (commit 1abf3f217): the sheet was placed 5rem from the bottom while the nav band is 6rem plus the safe-area inset; it now uses the existing layout token, pinned by a 3 test vitest file (red first). The ledger lists the other fixed bars found by a read-only scan (BaseModal sticky header and footer, the nav gate overlay, the scroll progress bar) and names the next bar. The look on a real phone is not claimed (row 45f). Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Row 45c part 1 done on the UI branch, the app declares its viewport once with viewport-fit cover (drain row 45c) · 8b024ce

On the branch copy (commit 488bbfec4): MOBILE_VIEWPORT and viewportProblems in the design system theme, the root layout spreads it and no longer writes a second tag by hand, pinned by a 5 test vitest file (red first). Next maps viewportFit to viewport-fit=cover (installed source read). The effect on a real notched phone is not claimed and goes to the phone sweep of row 45f. Part 2, the safe-area padding of the fixed bars, stays open. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Row 45b done on the UI branch, the touch target tokens and seven touch-sized files, the part 3 summary is recorded (drain row 45b) · b8cb0d5

On the branch copy (commit 0ca491882): the Save and exit button of the question phase takes the touch minimum on a coarse pointer and shows a pressed colour, with a 2 test vitest file (red first). Row 45b is DONE: tokens and checker, CSS variables and phone rule, and seven files fixed (audit hover-only 125 to 111). PlatformBadges.tsx was skipped because it already has whileTap feedback (backlog AUDIT-HOVER-WHILETAP). Next open row: 45c. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Row 45b part 3 file 6 done on the UI branch (the how-it-works controls), the decorative hover files are skipped with a reason (drain row 45b) · b6c3eab

On the branch copy (commit c0d7a01d1): the arrows of the how-it-works panel take the touch minimum on a coarse pointer and the step dots show a pressed colour, with a 3 test vitest file (red first). Hover-only total 113 to 112. The rendered size of the dots is not claimed and is queued with row 45f. Five files are skipped because their hover is a decorative change on a card that is not clickable (the audit overstates by about 12 spots, backlog AUDIT-HOVER-DECORATIVE). Two real files are left: PlatformBadges.tsx (n…

Row 45b part 3 file 5 done on the UI branch (the footer build strip link is touch sized) (drain row 45b) · be68633

On the branch copy (commit 9f20cc833): the release notes link of the build strip adds a pressed state and the touch minimum height on a coarse pointer, with a 2 test vitest file (red first). Hover-only total 115 to 113. The ledger names the next file, Features.tsx. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Row 45b part 3 file 4 done on the UI branch (the sign-in switch links are touch sized) (drain row 45b) · 44af88b

On the branch copy (commit 81f40ca3e): the passkey and email switch links add a pressed colour and the touch minimum height on a coarse pointer, with a 3 test vitest file (red first). Hover-only total 117 to 115. The ledger names the rest of part 3 and the next file, BuildVersionsStripView.tsx. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Row 45b part 3 file 3 done on the UI branch (the sign-in Email and Phone tabs are touch sized), the measured rest of the part is recorded (drain row 45b) · f8039a4

On the branch copy (commit 146adcb6b): both tabs take the touch minimum height on a coarse pointer and the unselected tab shows a pressed colour, with a 3 test vitest file (red first). Hover-only total 118 to 117. The ledger records two skips with their reason (the desktop-only sidebar shell and the admin sidebar), the measured rest of the part (17 files on the UI side) and the next file, LoginMethodSelector.tsx. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Row 45b part 3 file 2 done on the UI branch (the landing footer is touch sized), the scope text of the part is corrected (drain row 45b) · 0ff0e70

On the branch copy (commit c2e59387b): the footer's social links and text links take the touch minimum on a coarse pointer and show a pressed state, with a 3 test vitest file (red first). Hover-only total 122 to 118. The ledger corrects the scope of part 3: files under src/features are outside what the scope guard allows on the branch, so only src/ui and src/design-system files are worked, and the next file is sidebarShell.tsx. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Row 45b part 3 started on the UI branch, the Universe zoom buttons are touch sized, the scope of the part is decided (drain row 45b) · 98338c8

On the branch copy (commit 0e1ad526f): the three zoom buttons take the touch minimum on a coarse pointer and highlight when pressed, with a 4 test vitest file (red first) and a Tailwind compile check. The audit's hover-only total went 125 to 122. The ledger records the decided scope of part 3 (user-facing files only, one per tick, dev-only and admin files excluded) and the next file. The backlog gets the audit gap: it does not read a coarse-pointer size override. Claude-Session: https://claude.ai/code/session_013B…

Row 45b part 2 done on the UI branch, the touch target sizes are CSS variables and the phone button rule reads them (drain row 45b) · c92f778

On the branch copy (commit b4ace01de): globals.css defines --touch-target-floor, -min and -primary (24, 44, 48 px) and the 767 px button rule reads var(--touch-target-min). Red first with a 4 test vitest file (2 red), blast radius measured on the 9 other tests that read globals.css (all pass). Part 3 (the hover-only spots) stays open. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The clean copy tool recreates symlinked folders inside node_modules, and row 45b part 1 is recorded (drain row 45b) · 325ae2a

After merging main into the UI branch copy the web app failed to type check (cannot find module @ifeoma-tc/rate-meter): prepare_clean_copy.py skipped symlinked folders inside node_modules (workspace packages are linked there; os.walk lists such a link among the directories and does not enter it). They are now recreated as symlinks with their relative target. Row 45b part 1 (the touch target tokens and their checker, commit f6c5f1ed7 on the branch copy) is recorded in the ledger. Test: scripts/test_prepare_clean_co…

The UI scope guard allows the two app shell files that hold the design tokens and the viewport, and row 45 is split (drain row 45a) · 7c9228d

The design tokens live in the Tailwind theme block of src/apps/web/src/app/globals.css and the viewport declaration in app/layout.tsx; the guard reported both as outside the UI scope. It now allows exactly those two files; the other files of app/ (manifest, robots, route pages) stay outside. Row 45 (the design system mobile upgrade) is split into steps 45a to 45g: the guard prerequisite (this), the touch target tokens, the viewport and safe areas, the fluid type and breakpoint list, the six primitives, a phone Pla…

Row 44 done on the UI branch, the research folder has its principles with sources, the measured gaps and the decisions · fd9800c

On feature/ui-mobile (commit 6dd7cdb37, remote e6cea6b46): 01-principles.md (each section with its Sources line, project choices marked Proposed, Apple's own page unreadable so its 44 point figure is marked UNVERIFIED), 03-design-system-gaps.md (the measured readiness audit), decisions.md (four decisions with their reason) and README rows, checked by a 5 test vitest file in the UI tests. The scope guard step of row 43b ran for real in that commit (checked=7, violations=0). The push repeated the private check in th…

Row 43b proved end to end on the real branch copy · 461b2c8

After merging main into the branch copy, the scope guard step with a private index refuses a staged API path (exit 1, "the API app is the data side") and passes a staged UI path (exit 0); the copy stays clean. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The UI scope guard is a step of the shared pre-commit chain, inert on main (drain row 43b, plan step B2 part 2) · 079e8ef

check_ui_branch_scope.py gets --staged (judges the commit being made; nothing staged is fine). The new scripts/check-ui-branch-scope-precommit.sh skips unless the marker file <git-dir>/ui-branch-scope exists, which only the UI branch clean copy has (git rev-parse --absolute-git-dir is the per-copy folder under .git/worktrees/, plain .git on main); with the marker it refuses a commit that stages a data-side or unlisted path. package.json hooks:pre-commit runs it after the unused code scan. The marker is created in …

The scope guard of the UI branch, and row 20 is split into the branch work rows 43 to 46 (drain row 43, plan step B2) · 4141e50

New scripts/check_ui_branch_scope.py is the mechanical form of the owner's rule that a UI change never changes the data model for the same data on screen. It lists the paths the branch itself changed (git diff <base>...<head>, so what main brought in by a merge does not count, rename detection off) and refuses the data side (screen models, the UI contract, the API client, generated clients, the API app, the contracts package, matching and ML) and any path in no table; exit 0 clean, 1 violation, 2 missing ref, 3 no…

Row 42 decided and done, the branch feature/ui-mobile is published on the private origin (c56e9c21c) · ff4f5df

A researcher (opus) and a reviewer (sonnet, 22 of 30) agreed: the rules that gate a push on approval records and an empty review queue name main; the exception line for the branch requires only the PRIVATE check; the repo is private; a regex scan and gitleaks (on the exact pushed range, 446 commits) found no secret. The push was made from the clean copy with the repo's own hooks active and the visibility checked in the same command chain; the remote ref reads c56e9c21c. The claim in row 42 that the release branche…

The clean copy tool replaces the by-hand list, the root node_modules explains the different scan answer (drain row 41) · 8777930

Root cause: the unused code scan's Node detector resolves typescript from the repo root node_modules; the clean copy had only the nested ones, so the detector fell back to its regex mode, which reads words in comments as imports (block=20 in the copy, block=0 in the live tree with the same sources, baseline, allowlist and config). With the root node_modules linked in, the copy prints block=0 next=43 like the live tree. New scripts/prepare_clean_copy.py (stdlib, dry run by default) gives a clean detached copy the r…

Row 40, the clean copy for the UI branch is in place and the first push is tested; two findings become rows 41 and 42 · 536dd24

The origin is PRIVATE (gh repo view). The detached clean copy /var/tmp/clone/IFEOMA-CLOUD360/app-trueconnection/ui-mobile/ exists at the phase A tag merged with origin/main and the current main, and is clean. A dry-run push from it (the repo's own pre-push hooks active, the sanctioned form with the missing hooks folder not used) failed three times and changed nothing on the remote: the installed skills were missing in the copy (fixed), the release notes bundle must be committed before a push, and the unused code s…

Measure which routes reach a screen view, and accept the phase A tag as the branch point (drain row 39) · a575b44

New scripts/ui_route_screen_coverage.py (stdlib, measure only) follows the local imports of every page.tsx under src/app (relative, @/ alias, re-exports, dynamic import(); comments and strings are not followed) and lists the src/ui/screens/<screen>/ folders each route reaches. On the real app: 17 of 29 route pages reach a screen view (every screen that holds data), 12 do not: 4 redirect entries, the static pages about, cookie, cookies, privacy, terms, two release notes pages and a test page (none holds data). The …

The idle clean-up of clean copies keeps unlanded work but cannot be skipped, the note says so (drain row 38); wrong dates in the notes corrected, with a test · d268c1c

Row 38: the installed tmp-age-out tool (system timer, daily, copies idle 2 days) cannot be told to skip a copy, so the promised exemption is removed from the exception note and the global rule bullet. What protects the branch work is read from the tool: it keeps a copy whose HEAD or reflog holds a commit that no branch, tag or remote ref has, and git refuses a copy with modified or untracked files. A push to a URL leaves no remote ref, so the copy is kept until git fetch origin runs inside it. The leftover-branch …

The one feature branch exception needs no guard edit, the steps and a test that pins them (drain row 37) · 19f7fcf

forbidden-guard's own check (no git command executed) allows the guard-free design: a detached clean copy under the clone root, add, commit, merge and fetch inside it, and a push of <sha>:refs/heads/feature/ui-mobile; it keeps denying a clean copy on a named branch, every branch switch (live tree and copy), any other clean copy and any other branch name on a clean copy. The project git-sync-guard only asks when the copy is behind origin/main (merge main first). So the plan's named-branch clean copy is replaced by …

The one feature branch exception is written into the repo texts, with a note as the single place and a test (drain row 36) · e3b1d4c

The owner's order and approved plan of 2026-10-26 grant ONE branch (feature/ui-mobile) in ONE clean copy with ONE merge back for the mobile UI plan (decided in row 34). New docs/notes/ui-branch-exception.md holds the scope, both dated sources, what the guard does and where the exception is named; AGENTS.md and the design system README name it in one sentence and keep the ban for everything else. The global rule files (CLAUDE.md Git section, the workspace push form, the loop rule, the shared worktree memory) were e…

Row 34 decided, the owner's order and the approved plan grant one feature branch exception, with four conditions as rows 36 to 39 · 6ee0acd

A researcher (opus) read the guard hooks and the rule texts, a reviewer (sonnet, 19 of 30) tried to refute the draft conclusion. The owner's order of 2026-10-26 15:57 UTC ("create a feature branch ... merge back") and the plan the owner approved at 16:12:52 UTC (it names the conflicting rule texts and "this one named exception") are dated after the 2026-10-17 rule, so the exception is granted for ONE branch (feature/ui-mobile), ONE clean copy and ONE merge back. The guard denies the plan's named-branch clean copy,…

The daily job that sends the icebreaker reminder (drain row 32c, peer case 7 part 3, row 32 complete), red then green · 45e70aa

New lib/cron/runIcebreakerReminderOnce.ts hands the connections collection, the clock and dispatchIcebreakerReminderPush to remindUnfinishedIcebreakers, logs the counts and lets a failure propagate. scheduled-tasks.ts registers it daily at 10:00 UTC, last (the registration indexes the older tests use stay), with the in-process in-flight flag and the distributed lock "icebreaker-reminder" like every other job. After 7 days without a step the member whose turn it is gets one reminder, and nothing ends automatically.…

The icebreaker reminder push and its nameless texts (drain row 32b, peer case 7 part 2), red then green · 19494ed

dispatchIcebreakerReminderPush (ConnectionWorkflowPushDispatcher.ts) tells the member whose turn it is that the icebreaker waits, with the new nameless keys pushIcebreakerReminderTitle and pushIcebreakerReminderBody in en, de, es, fr and ar and the CSV export (made with the project script, round trip passes). It uses the shared preamble (preference, mute, discoverability) and re-reads the pair row at send time: only while conversation_active, the icebreaker is unfinished and it is still the recipient's turn. The c…

The service for the reminder of an unfinished icebreaker (drain row 32a, peer case 7 part 1), red then green · a13e399

remindUnfinishedIcebreakers (new icebreakerReminder.ts) takes conversation_active rows whose last step is older than ICEBREAKER_REMINDER_AFTER_MS (7 days, a chosen default), whose icebreaker is not complete and that carry no icebreakerReminderSentAt, takes that flag with a compare-and-set BEFORE it calls the injected sender, and names the member who can finish the step (icebreakerWaitingParty, same turn rules as submitIcebreakerStep). Nothing ends automatically. A failing send is logged and counted, not retried. T…

Two real-database tests identify a discovered peer by its profile id, not the removed raw account id (drain row 35) · 956ccaa

Since the discovery card slices 2c to 2e of defect D1 (2dbed42b6, edcfacad2) a discovered peer's card has no raw account id (authUid is null), so bulkMatchProcessorPeerPrivacyCallSite and connectionMaterializationOnFreshMatch failed with "expected [ null ] to include ..." on the committed code. They now compare the card's id with the fixture's profileId. The paused check of the first test had been passing for any reason (not.toContain of an id that is never there); it now compares real ids and its un-paused twin p…

The block and unblock race spec checks that a block ends the chat for good (drain row 31c), run on a stack rebuilt at the latest commit · adef6b5

The dev stack now runs from a clean detached copy at 27134f489. The race spec as it was passed on it (it never read the stage value after the unblock), so it is edited on purpose: the seeded pair must start as an open chat (the contrast), and after the concurrent unblock both the stage read and the connection list entry for the blocked member must say rejected, because an unblock only removes the block and never brings the chat back. The doc text that said every read reverses now says the block exclusion reverses.…

The block confirm and the blocked list text say a block ends the chat for good (drain row 31b part 1), red then green · 27134f4

Since row 31 a block ends the connection and an unblock never brings the chat back. The confirm before a block (chat.messagingHeader.blockUserConfirm) still said the person would disappear "until you unblock them", and the blocked list said "Unblock someone to reverse that". Both texts now state the real consequence in en, de, es, fr and ar. The message bundles and the CSV were regenerated with the project scripts (2 lines per file). Tests (positive and negative pair): tests/atomic/i18n/blockEndsChatCopy.test.ts p…

A block ends the connection, an unblock never brings the chat back (drain row 31, peer case 3, API side), red then green · b72b9c4

POST /api/users/:userId/block calls the new blockPeerAndEndConnection (lib/safety/blockEndsConnection.ts): it stores the block, then ends the connection with the reason "blocked" and persists the chat session. It also ends when the block row already existed (a retry repairs a block whose end did not land), ignores a missing connection (no row is created for a stranger) and lets every other failure propagate (the route answers 500 and logs it). An unblock only removes the block row, so the stage stays rejected, a s…

The inbox list refreshes every 15 seconds and no longer goes blank after a failed refresh (drain row 30, D12), red then green · 1537915

useConversations refetches on a 15 second interval (CHAT_CONVERSATIONS_POLL_INTERVAL_MS) through nextChatPollDelayMs, not in a background tab, waits for the server's retry time after a 429 and does not retry a 429 at once (new retryUnlessRateLimited, other failures follow the client's retry default). conversationsList now reads query.data?.conversations: the old isSuccess read blanked the whole inbox after one failed background fetch. Tests (positive and negative pair): useConversationsQuery.test.tsx with fake tim…

One reveal request push per connection per 24 hours (drain row 29e, D12 last part), red then green · fe966c1

claimRevealRequestPushSlot (new revealRequestPushSlot.ts) is a compare-and-set on the connection row's revealRequestPushAt (absent, null or older than 24 hours); dispatchRevealRequestedPush takes the slot after its row check, so a withdraw-and-press-again does not ping the peer twice and two presses at once send one push. It writes nothing else (updatedAt and lastActivityAt stay). Tests (positive and negative pair): tests/services/connection/revealRequestPushSlot.mongo.integration.test.ts on the real replica-set d…

The reveal routes push only for a real move (drain row 29d, D12 part 4), red then green · 36739f5

press-reveal calls pressRevealOutcome and, only when the stage moved, pushes the other member on a move to chat_requested and the first presser on a move to chat_active; respond-chat calls respondChatOutcome and pushes the first presser on an accept that completed the reveal. A replay, a decline and a refused call push nothing. New fire-and-forget wrappers in ConnectionWorkflowPushDispatcher.ts. Tests (positive and negative pair): tests/routes/connections-reveal-push.test.ts (three pushes sent for the right move, …

The reveal push functions and their nameless texts (drain row 29c, D12 part 3), red then green · dace85b

ConnectionWorkflowPushDispatcher.ts gains dispatchRevealRequestedPush (the other member after the first blind press, the existing private chat request copy) and dispatchRevealCompletePush (the first presser after the peer completed the reveal), with the new nameless keys pushRevealCompleteTitle and pushRevealCompleteBody in the five locales and the CSV export (made with the project's export script, round trip check passes). Both re-read the pair row at dispatch time (request push only while chat_requested and the …

The reveal press and the chat answer say whether they moved the stage (drain row 29b, D12 part 2), red then green · 4186764

pressRevealOutcome and respondChatOutcome return { connection, transitioned } like requestChatOutcome; pressReveal and respondChat stay as thin wrappers returning the row, and ConnectionService has both outcome methods. transitioned is true when this call's write moved the stage (the first blind press, the peer completing the reveal, an accept of an explicit request, a decline) and false for the first presser pressing again, a press or accept on the complete chat, and a lost race that finds the chat complete. The …

The connection pushes skip a recipient who muted the chat, with one shared reader of the mute flag (drain row 29a, D12 part 1), red then green · d95fe37

resolvePushRecipientContext in ConnectionWorkflowPushDispatcher.ts now asks isConversationMutedFor (moved from ChatPushDispatcher.ts into muteConversation.ts, the one module of the mute flag), so the conversation request, chat request and accept pushes honour the per-viewer mute like the chat message push does. Tests (positive and negative pair): [redacted].test.ts (a muted recipient gets none of the three pushes, an unmuted one gets each once, a mute by the sender alone does not stop the push, the lookup is keyed…

The dev stack runs from a clean copy of the latest commit, the vibe check taps reach the last two callers, and icebreaker answers no longer trip the personal-data screen (drain ro… · 7d0ec7f

Four changed specs ran green end to end on the rebuilt stack (vibe check race, blind reveal race, mutual end race, and the contract spec after a role swap in pair B). The humanoid simulator driver taps the vibe check for both actors before the reveal (red then green at its unit tier, a refused tap throws VibeCheckTapRefusedError). The universe journey spec taps with the browser session token for member A (compiled and listed, its run fails earlier on an old peer id break, backlog). Found by the run: fix-queue row …

Eight more end-to-end specs tap the vibe check before the reveal, and the web request private chat handler sends only the blind reveal (drain row 28e), compiled, not run · 6e48930

Eight specs that press the reveal inline after their own icebreaker steps now call the new tapVibeCheckForPairViaApi(page.request, alpha, bravo) (sessions minted from the identities; the harness helper delegates to it) before their first reveal press. Playwright lists all 11 changed specs (13 tests). Web: the connection detail request private chat handler no longer falls through to requestChat, which the api refuses since row 28c. A pure function resolveRequestPrivateChatAction sends the blind reveal only in anony…

Since rows 28b and 28c the first press of the blind reveal needs the vibe check and the request chat route no longer starts a chat. · 1326c5e

dual_client_chat_active.ts gets tapVibeCheckOnBothSides (API taps; the server needs no ten messages) and driveDualClientToPrivateChat calls it before the reveals, which fixes every spec that reaches the private chat through that helper. mutual-blind-reveal-race first asserts the 409 vibe check refusal, then taps and races. The contract spec pairs A and B go through icebreaker, vibe check, press-reveal and respond-chat or a second press, pair A asserts request-chat from conversation_active is 409, and the helpers a…

The private chat request moves nothing and refuses every stage but its same-result replies (drain row 28c, D16 step 3), red then green · 7f33cd4

Decided 2026-10-31 by researcher and critique agents: the private chat is entered through the blind chat (the first press of the reveal, after the vibe check), not by a request from conversation_active, which the web never offers. requestChatOutcome now answers the two same-result replies (the requester asking again while chat_requested stands, a complete chat_active), keeps the 403 for a viewer who is no party of the row, and refuses every other stage with 409 STAGE_MISMATCH. The write, its picture-version fields…

The retention purge holds the migrated thread of every reported pair and fails closed on a lookup error (drain row 26c), red then green · e9a93f3

The second review of the row 26b fixes found one older MEDIUM, reproduced on real data: the purge never worked out the thread id of a MIGRATED pair, so reported evidence was deleted for a pending report made before row 26 (no stored id) and for a report whose migrated-id lookup had failed when it was filed. The purge now looks up the migrated thread of every open report itself, at purge time, through a throwing variant of the resolver (findMigratedConversationId), and holds it next to the stored and the derived id…

The first press of the blind reveal needs the vibe check, with a new transition code and a message in five languages (drain row 28b, D16 step 2), red then green · 7c69ed0

Decided 2026-10-31 by researcher and critique agents, and the copy already promised it ("Mutual reveal unlocks only after anonymous chat meets server checks (messages + vibe)"): pressReveal from anonymous_chat_active now answers 409 with the new code CONNECTION_TRANSITION_VIBE_CHECK_REQUIRED until vibeCheck.bothTappedAt is set. The check runs before the write and in the write filter, so a vibe check that disappears between the read and the write cannot let the press through; on a miss the re-read answers the same …

The review fixes of drain rows 23 to 26: a stale report thread id no longer releases the purge hold, and the row 24 and 25 follow-ups (row 26b), red then green · b8f63c6

Two reviewers independently reproduced one MEDIUM on row 26: the account id rekey rewrites the message thread ids and the report member ids but not the report conversationId, so a pending report stopped holding its thread. The purge now holds the stored id AND the id derived from the members, holds every report that is not actioned or dismissed (a report with no status holds too), and fails loudly with PurgeHeldThreadsCapExceededError over 20,000 held threads instead of an oversized query. A failed migrated thread…

The two parallel reviewers of each topic are round 1, not round 2 (the record script counts each record as a new round) · a956496

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Round 1 review of drain rows 23 to 26 is recorded: row 26 rejected on one medium, rows 23 to 25 approved with follow-ups (filed as row 26b) · d5d1e3d

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The file had 493 lines of the 500 limit and the next two steps add code to it. · b65bf6e

requestChat stays in chatTransitions.ts (the contact-sink guard watches it) and the file re-exports respondChat (chatRespondTransition.ts) and pressReveal (chatRevealTransition.ts), so no importer changes. The shared side guard moved to viewerSideGuard.ts. The code was moved by line range and a script checked that every original body line appears exactly once in the new files. The blind press writes the chat_requested stage, which the contact-sink guard counts as a sink, so chatRevealTransition.ts joined the sink …

The photo rules are pinned on the real driver: only the uploader sends, both members read after an end (drain row 27, peer case 1) · b345768

The forward rule was in the send path but its only test mocked the media lookup to null, so it could not tell the uploader from the receiver. Seven real-database cases now pin it: the uploader sends and the upload row is consumed; the receiver sending the uploader photo, and a forward of a photo already sent, are refused with nothing new stored; both members read a sent photo after the connection ended and at degraded; a non-participant finds no such photo; a blocked peer gets the same not-found as an unknown medi…

A member the peer blocked can report that peer, and the retention purge keeps the threads of pending reports (drain row 26, peer case 4, a safety defect), red then green · e609549

A harasser who blocked their target made the harassment unreportable: the report route answered the unknown-id 404 to the blocked member. The report route now resolves its peer through resolveReportTargetPeerAuthUid, which reads no block in either direction, so a blocked reporter gets the same 200 receipt as any other and learns nothing about the block. An unknown id is still the 404. A new architecture test allows the resolver in the report handler only (with synthetic controls), and the report handler leaves the…

A member consent to the private chat was two booleans, and the picture routes know nothing of the stage, so the peer could change the preview picture after the first consent and c… · 10db2ef

omplete the reveal. The first consent (a request, or a blind press) now records the version of the peer picture in its own field on the connection row (chatConsentPeerPicture, so the chatConsent object that reaches the client does not change). The steps that complete the reveal compare it with the completer current picture. A change or a removal answers 409, clears the first consent and returns the stage to where the request started. A row with no recorded version completes as before. Known limits: one read betwee…

A message can no longer be stored after the connection ended during the send (drain row 24, peer case 6, a race defect), red then green · 791e034

The send checked the stage outside its transaction, so an end that committed between that check and the message commit let the message in. The send transaction now pins the connection row (a write of lastMessageSentAt through ConnectionService.holdStageForSend, called by the messaging and media gates when they get the session). An end that commits first aborts the transaction, the work is retried and the gate refuses with 409. Text and photo sends are both covered. Red first: the real-database end-race case failed…

The transcript export no longer prints the members account ids (drain row 23, peer case 8, a disclosure defect), red then green · 48d8415

The server transcript download printed the member and the peer raw account ids in its header, and the file leaves the app. The two header lines and the two inputs that fed them are removed; each message line already says You or Other participant. The two unused label keys leave the five api locales and the CSV export. Two existing assertions that required the ids were changed on purpose, with the reason in each test. Decided by a researcher and a critique agent (ledger rows 23 to 34); the ids on every message of t…

The old backup-code counter collection leaves the erase, the lists and the tests; every open question is decided and filed as ledger rows (row 5c, rows 12 and 23 to 34) · eb7528d

Row 5c: a researcher and a critique agent found, from the full-database pre-deploy archive of 2026-10-27 and the deploy history, that the collection auth_backup_code_rate_limits does not exist in production and was never created by a deployed build, so there is nothing to count or drop and no production key was used. The code cleanup is done: the legacy delete and its result field, the unused helpers, the ephemeral exclusion entry, the data inventory entry, and the legacy rows in three real-database tests. Red fir…

The feedback barrel no longer carries the toast host, so the UI gate sees only real toast calls (toast rule, critique option C), red then green · 5e741a7

The design-system feedback barrel re-exported Toaster, so every UI file that imported Alert or Skeleton from it reached the sonner library: 21 of the 221 recorded reaches of the UI contract gate, none of them a toast call. Toaster now leaves the barrel, and the app providers, its only importer, import it from its own file. The gate debt goes from 221 to 202: 21 barrel reaches removed, 2 real toast reaches that the barrel chain had hidden are now shown. The decision came from a researcher and a critique agent (opti…

The old clone copies exit5, exit6 and exit7 are removed after a judge approved the inventory (drain row 21); exit8 stays deferred · 273a5bb

The judge reviewed the inventory read-only and approved three copies. Preserved first: the run folder quoted by the ledger, copied into the live runs folder (ignored), and the pipeline artifacts of exit5, in the backup area. Each copy: root-owned Docker mount entries removed through a container, emptied folders removed, rm -r, git worktree prune. exit8 stays: its dev containers mount it. No OPEN row is left in the drain table. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The inventory of the four old clone copies is built, the judge review is pending (drain row 21) · 6033e98

Read-only inventory: exit5, exit6 and exit7 have one uncommitted change each, nine root-owned Docker mount entries each, and no running process; exit8 is mounted by the running dev containers and is deferred. No data was removed. A judge reviews the inventory first, as the rules require. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The rendered peer bubble is brighter than the own bubble in the gallery (drain row 19, rendered part), red then green · 80d3272

A design-system story draws one own and one peer bubble with the real bubble classes. The gallery browser test samples the pixels of both. Red: before the story existed the test failed on its missing id. Green: the peer bubble measured 0.1052 and the own bubble 0.0305, so the peer is the brighter side, as commit 71ae11177 intended. The live two-profile check needs a live stack with two signed-in accounts and was not run here. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The other person chat bubble is pinned as the brighter side, from the stylesheet (drain row 19, stylesheet part), red then green · b2a5b2b

Commit 71ae11177 made the peer bubble brighter than the own bubble. Nothing checks that order. The new test reads the two bubble rules in globals.css, derives each background luminance and requires the peer to be brighter. Red: on the stylesheet from before 71ae11177 the peer was 0.0049 and the own bubble 0.0243, so the test failed. Green: 2 of 2 on the current stylesheet, the control included. The rendered two-profile check needs a live stack with two signed-in accounts and stays open. Claude-Session: https://cla…

In the gallery column with the real banner, the transcript was 31 px tall at 1280 by 560 (the reviewer reported zero). · cc3b44a

The shared scroll region sets min-height 0 in a plain stylesheet rule that comes after the chat rule, so the utility class did nothing. The fix is one compound-selector rule in globals.css, which raises the chat transcript minimum to 48 px. The composer stays in view at 560, 600 and 720 px high. Red first: the gallery spec failed with 31.4 px. Green: the spec 2 of 2 (the control too); the smoke scan of the two new stories; the web typecheck exit 0; the gate rc 0; the design-system, UI and chat folders 2,471 tests.…

The chat message area collapse is reproduced by viewport height in the gallery (drain row 18) · 4c09e31

A gallery column with the real header, banner, transcript, two contact-share rows and composer: the transcript keeps 191 px at 1280 by 720, 71 px at 1280 by 600 and 31 px at 1280 by 560 with the banner. The cause is the banner and the fixed siblings taking the height, with no minimum on the transcript. A minimum alone would push the composer out, so the column must become scrollable first. No product code changed; the story is removed again because the gallery smoke scans every story against its baseline. Claude-S…

The chat transcript under the sign-in banner keeps 332 px in the gallery; the collapse is not reproduced yet (drain row 18) · ce29d77

A gallery column with the real header, the real banner, the real transcript and the real composer, rendered at 1280 by 720 in Chromium: the transcript keeps 332 px with the banner, 490 px without. No collapse, so no product change. The story was removed, because the gallery smoke scans every story against the accessibility baseline. Next: the share rows the backlog names, then measure again. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The chat message area collapse cannot be measured here yet (drain row 18), with the next step recorded · ac81ee2

The live chat page answers 404 on the running server and needs a signed-in account. The built gallery chat story renders only a heading, with no transcript and no sign-in banner. The cause stays unmeasured; it is read from the layout code. The row stays open with its next step: a gallery story that holds the transcript and the banner, then one Chromium measurement. No code changed. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The 40 percent white text class becomes the 50 percent step, and the identity hints keep their tone difference (drain row 17, A11Y-WHITE-40-CONTRAST), red then green · e886d1c

The utility text-white/40 gives white at 40 percent over black: 3.66 to 1, below the 4.5 to 1 of WCAG AA for body text. The 109 uses in 65 files now use text-white/50. The replacement had made the modal and form hint tones of the identity fields equal; the modal tone stays at 50 percent and the form tone moves to 60 percent, so the modal hint stays dimmer. The guard covers 40 and 45 percent. Red first: the guard listed the 40 percent uses. Green: the guard 2 of 2; the design-system, nav, UI and profile folders 417…

The utility text-white/45 gives white at 45 percent over black: 4.43 to 1, below the 4.5 to 1 of WCAG AA. · 11cb3b7

The 58 uses in 42 files now use text-white/50 (5.32 to 1). The guard test derives both values and fails while any use remains. Red first: the guard listed 58 uses. Green: the guard 2 of 2; the design-system, nav and UI folders 244 files, 2,360 tests. Other sessions edits in 15 files were left out. Fixed, re-test pending in the gallery run. The 40 percent class is a new backlog line, not fixed. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The photo section carried role=button and tabIndex=0 and held the pick button, the file input and the label, which axe reports as nested-interactive. · 69b286d

The section keeps its pointer click, but has no button role, no focus stop and no key handler; the pick button and the label are the controls for keyboard and pointer. Red first: the component test named the section as an offender. Green: the new test 2 of 2; the onboarding folders 21 files, 210 tests; the web typecheck exit 0; eslint clean. Fixed, re-test pending: the gallery run must confirm it before the baseline entries are removed. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The backlog line said TypeScript 7 had not started, but most pins already sit on 7.0.2. · 8f2c8e1

The web app keeps the TypeScript 6 alias because the ESLint parser (latest 8.72.1) declares a peer range below 6.1.0. The new guard checks every pin under src. Red: without the recorded exception the guard fails on the web pin. Green: 2 of 2 with it. The backlog line records the decision and the retry condition. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The W25 finish plan names its stories as done, so the tick check passes (drain row 14), red then green · 9f00ed7

The tick check found three stale references on line 70 of the finish plan: W25.3, W25.4 and W25.5 were named as still to do, but WAVE-25 has them checked off. Red: the tick check reported three PLANREF findings. Fix: the line reads as done. Green: the tick check prints OK. The backlog line is marked fixed. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The UI gate follows project imports, and records its current violations as debt (drain row 13, backlog line W26.6.b narrowed), red then green · 2874276

The exit gate read direct imports only, so a UI view could reach the data side through a feature card. The gate now follows the project imports from each UI file and reports a forbidden import found along the way. On the real tree that found 221 reaches, mostly design-system toasts through sonner and feature cards reaching the data side. So the gate is a ratchet: scripts/ui_contract_debt.json records the 221, and the gate fails only on a new one. The debt file is allowlisted in .gitignore. Red first: the transitiv…

One viewer acknowledgement of the icebreaker-complete celebration leaves the other viewer unseen (defect D15, fix-queue row 11), a regression pin · fb0660b

The knowledge file named the server celebration flag per viewer as an open gap. The server already keeps each viewer acknowledgement in its own collection. This real-driver test pins it: viewer A acknowledges, A reads it seen, and B still reads it unseen. Red did not reproduce: both cases passed on the first run. Green: the new file 2 of 2. Row 12 is now blocked on the owner decisions (the reveal push, the peer cases, D16). Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

A database failure in the pair lookup answers 500 on the connection list (defect D14 part 3, route level, fix-queue row 11), a regression pin · 694e867

The service part of D14 part 3 already rethrows any lookup failure except a missing profile. The knowledge file named the route answer as its gap. This test pins it: the list route answers 500 when the pair lookup throws a database error, and 200 when the lookup finds the peer. Red did not reproduce: both cases passed on the first run, so this is a regression pin and not a fix. Green: the new route file 2 of 2 (the control shows the lookup runs). Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPF…

Account deletion erases the member shadow events of the abuse ladder (drain row 9c, step 4), red then green · a070779

The deletion erase removed the shared rate budget but not the shadow events of the abuse ladder, which are keyed by the same subject tag. The erase now removes them inside the deletion transaction, through forgetAbuseLadderSubject, which takes the session. The result reports the count. Red first: the erased member event remained (1 instead of 0); the other member control passed. Green: the real-driver case 2 of 2 on the replica set; the profile folder 77 unit files (821 tests) and 47 real-driver files (208 tests);…

The block and unblock policy records its shadow events, recording only (drain row 9c, step 3d part 2), red then green · bf089c7

The block policy now writes one shadow event when a block is refused and starts a lockout, and counts the requests sent during that lockout. The event carries the client labels, the live peer count and the paid status, read when the lockout starts. The subject is the member erasure tag. Recording only: the 429 is set by the limiter alone. The events collection is classified as an ephemeral exclusion, as the partition invariant requires. Red first: the module did not exist (2 of 2). Green: the real-driver test 2 of…

The shadow labels of a limiter may be read asynchronously, and the subject and policy come from the limiter (drain row 9c, step 3d part 1), red then green · 74e7217

The block policy needs labels that take a read (live peers, paid status), and the lockout id must agree between the event and the later locked requests. The limiter now takes the keyed subject from a shadowSubject option and the policy from its storage prefix. The labels may return a promise; they are read once when a lockout starts, and a failed read is logged without changing the answer. Red first: with async labels no event was recorded (0 calls). Green: the middleware shadow file 6 of 6, including the negative…

A shadow event carries its lockout id, and each request during that lockout is counted on it (drain row 9c, step 3c part 3, second piece), red then green · 45e18dc

A shadow event now names the lockout it came from: the policy, the subject and the time the lockout ends. The middleware calls an optional hook for each request sent during a lockout, with that id, so the count lands on the right event. The lockout end and the 429 do not change. A plain refusal before any lockout is not counted. A failure in the event build or in the count is logged, and the answer does not change. Red first: the id function did not exist, and the hook was not called (3 of 3). Green: the unit test…

Count one request during a lockout on the shadow event of that lockout (drain row 9c, step 3c part 3, first piece), red then green · 7b3ccf9

The ban rule of the abuse ladder needs the number of requests sent during a lockout. The limiter does not look at those requests, so the count is a separate increment on the shadow event of its lockout, with an index on the lockout id. The lockout timer is not touched. Red first: the function did not exist (2 of 2 cases). Green: the real-driver store test 8 of 8; the API typecheck exit 0. The adapter that sets the lockout id and the locked-request call are the next piece. Claude-Session: https://claude.ai/code/ses…

The paid-status label of a shadow event, from the entitlement document (drain row 9c, step 3c, part 2), red then green · d83fb9f

The abuse ladder shadow labels say whether the member pays. The new check reads the member entitlement document and applies the effective tier rule: a paid renewal pays; the explorer tier, a lapsed renewal and a missing document do not. Red first: the module did not exist. Green: the real-driver test 4 of 4; the API typecheck exit 0. The lockout request count is the next part. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Count the live chat peers of a member for the shadow labels (drain row 9c, step 3c, part 1), red then green · 31fe541

The abuse ladder shadow labels need the number of live peers. The new count reads the connections where the member is either party, in an active chat stage. Red first: the module did not exist. Green: the real-driver test 3 of 3 (both sides count; a not-active stage and a pair without the member do not count); the API typecheck exit 0. The paid-status label and the lockout request count are the next part. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Every generated-client API call names our own client and the build (drain row 9c, step 3b), red then green · e23090a

The abuse ladder labels each would-be ban with the client kind and the app version. The web client did not send either label. The generated client now sends x-tc-client-kind (own-client) and x-tc-app-version on every call, through one helper; a build with no version omits the version header, and the API reads unknown. Red first: the labels were missing on a public path (undefined instead of the version and the kind). Green: the new web test 2 of 2; the web typecheck exit 0; the security, journey and connections fo…

Shadow events carry the app version and the client kind from two headers, unknown when missing (drain row 9c, step 3a), red then green · d064951

The shadow ladder labels each would-be ban with the app version and whether our own client sent it. No request carried those labels. The new reader takes x-tc-app-version and x-tc-client-kind, and gives unknown for a missing, repeated or invalid value. The event type gains unknown as a client kind, so a missing label is never a guess. Red first: the module did not exist. Green: the label test and the event test 6 of 6; the API typecheck exit 0. The web client does not send the headers yet (step 3b), so nothing rea…

Row 9c step 2, the shadow ladder policy is the block mutation (judge verdict) · d228115

A read-only judge changed the first shadow policy from the chat session read to the block and unblock toggle. The read policy has no lockout, so it could never write a shadow event. The ledger row and its tick entry record the verdict, its evidence file and the two caveats (few events, lockout in memory until the shared store). No code changed. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Shadow abuse events expire after 90 days, get a TTL index and can be erased by subject (drain row 9c, step 1), red then green · 723aa10

The durable shadow-event record had no expiry, no index and no erasure. Each event now carries expiresAt 90 days after it occurred (ABUSE_LADDER_EVENT_RETENTION_DAYS, a chosen default and not a measured value). ensureAbuseLadderEventIndexes adds a TTL index on expiresAt and an index on subject. forgetAbuseLadderSubject removes one subject events and no other subject events. Red first: 4 of 4 real-driver cases failed for the stated reasons (no expiry, no index function, no erasure function). Green: the store file 6…

A failed private send is restored after a reload with its key (defect D15 row restore, fix-queue row 11), red then green · e5bfbb5

After a reload, the failed private row did not come back, and a retry sent nothing. Root cause: the hook's own reset effect on the viewer and peer pair cleared the restored payloads, because the restore effect was declared before it. The restore effect now runs after that reset, once per conversation, and keeps each stashed key. A failed send stashed for another conversation is not restored (negative case). Two other hook test files now clear the session store before each case, because a stash lasts for a whole fi…

A failed private send is kept for its conversation with its key (defect D15 retry key, hook part, fix-queue row 11), red then green · c389622

The messaging hook kept a failed private send and its idempotency key in memory only, so a page reload lost the key. The hook now also saves the failed send to the session store, and removes it on retry and on dismiss. Red first: a failed send was not stashed for its conversation. Green: the lifecycle test with the new case and the store test 10 of 10; the web typecheck exit 0; the whole web atomic suite 2036 of 2036 files (12102 tests). The failed message row itself is still lost on reload; restoring it is the ne…

Failed private sends keep their idempotency key across a reload (defect D15 retry key, storage part, fix-queue row 11), red then green · 5dafbf5

A failed private send kept its idempotency key only in memory, so a page reload lost it, and a retry after the reload could send a second copy. The new store keeps failed sends per conversation in session storage; reads and writes are guarded, and a refusing storage reads as empty and never throws. Red first: the store did not exist. Green: the stash test 4 of 4 (reload, other conversation, removal, refusing storage), under jsdom; the web typecheck exit 0; the whole web atomic suite 2036 of 2036 files (12101 tests…

The connection stage seed sets the viewer's reveal press (defect D15 reveal part, fix-queue row 11), red then green · 3a8b6ab

The seed for the connection stage dropped the viewer's reveal press. The seed now reads the viewer's own side of the chat consent; a viewer who is neither party reads false. Red first: the seed gave no reveal press. The control also read undefined, so it was not an independent red. Green: the seed, cache and reveal tests 11 of 11; the web typecheck exit 0; the whole web atomic suite 2035 of 2035 files (12097 tests) on the second run. One earlier run failed one rate-limit budget test that passed alone and on the ne…

A mutation seed keeps a cached celebration flag (defect D15 part 3, fix-queue row 11), red then green · 0859e7a

The seed written after a connection mutation replaced the cached stage view, so a cached true for the post-icebreaker celebration was replaced by the seed default false, and the celebration could show twice. The seed now keeps the flag the connection carries, else the cached flag, else false. Red first: a cached true was replaced by false. One existing test checked the write arguments and now checks the same mapped view through the updater. Green: the cache tests 5 of 5; the web typecheck exit 0; the whole web ato…

The connection stage seed keeps the celebration flag (defect D15 part 2, fix-queue row 11), red then green · efa854d

The seed for the connection stage always set the post-icebreaker celebration flag to false, so a viewer who had seen the celebration was seeded as not seen. The seed now keeps the flag when the connection carries it. Red first: the flag was seeded false for a connection that carried true. The stage-group binding table now lists the active-chat group that the replay decision reads, on purpose. Green: the two seed tests 4 of 4 (with the vibe-check test); the binding table 4 of 4; the web typecheck exit 0. The whole …

A replay of an in-progress icebreaker step asks for its transcript again (defect D7 route part, fix-queue row 11), red then green · 6e93024

A retry of an icebreaker step whose transcript append had failed did not write the row again, so the row was lost for good. The append decision now asks again for an in-progress step on a chat stage; the row id is derived from the step, so the repeat writes nothing twice. A completed icebreaker keeps its existing check. Red first: the replay did not ask for the append. Green: the decision and route tests 22 of 22; the real-database routes, chat and connection files 39 of 39 (145 tests); the API typecheck exit 0; t…

A replay of an in-progress icebreaker step asks for its transcript again (defect D7 route part, fix-queue row 11), red then green · ea8086d

A retry of an icebreaker step whose transcript append had failed did not write the row again, so the row was lost for good. The append decision now asks again for an in-progress step on a chat stage; the row id is derived from the step, so the repeat writes nothing twice. A completed icebreaker keeps its existing check. Red first: the replay did not ask for the append. Green: the decision and route tests 22 of 22; the real-database routes, chat and connection files 39 of 39 (145 tests); the API typecheck exit 0; t…

A repeated icebreaker transcript append writes no second row (defect D7 part 1, step 1, fix-queue row 11), red then green · 1196377

Each icebreaker step's transcript row had a random id, so repeating the append for the same step wrote a second row. The row id is now derived from the conversation and the step's payload, so a repeat hits the unique message id and writes nothing; the duplicate is treated as already written. Red first on a real replica set: two appends wrote two rows. A fixture error in the negative case (a step-1 answer needs the picked question) was corrected in the test. Green: the transcript test 2 of 2 (repeat, and two differ…

The connection stage seed keeps the vibe-check state (defect D15 part 1, fix-queue row 11), red then green · 0856201

The seed for the connection stage dropped the vibe-check state, so a connection both sides had tapped was seeded as not done. The seed now derives the state from the tap time, the same rule the server uses. Red first: the seeded state was undefined for a tapped connection. Note: the no-tap control was also red (it expected false), so it is not an independent red. Green: the seed test 2 of 2; the web typecheck exit 0; the whole web atomic suite 2032 of 2032 files (12091 tests). The reveal press and the celebration …

A hostile icebreaker answer is refused (defect D13 hostility part, fix-queue row 11), red then green · 4ce6fb5

An icebreaker answer went into the timeline without the hostility screen a chat message gets. A blocked answer is now refused with the hostile-content error. Decision: the refusal does not open the sender's chat cooldown, which stays a chat-send control. Red first: a hostile answer was accepted. Green: the hostility test, the personal-data test and the icebreaker unit tests 7 of 7; the API typecheck exit 0; the real-database chat and connection files 30 of 30 (109 tests); the wide API folders 1021 of 1021 files (6…

An icebreaker answer is screened for a phone number or e-mail address (defect D13 personal-data part, fix-queue row 11), red then green · ed87db0

An icebreaker answer went into the timeline without the screen that a chat message gets, so a phone number or an e-mail address was accepted. The answer is now screened with the same detector and refused with the same personal-data error. Red first: an answer with a phone number was accepted and the step advanced. Green: the screen test and the existing icebreaker tests 5 of 5; the API typecheck exit 0; the real-database chat and connection files 30 of 30 (109 tests); the wide API folders 1020 of 1020 files (6895 …

An icebreaker step that races an end is not answered 500 (defect D7 part 2, fix-queue row 11), red then green · ecd1e61

The transcript append after a stored icebreaker step was refused when the pair had ended in between, and the refusal was rethrown, so the step answered 500. The append now logs that refusal and returns, so the committed step stays 200. Any other failure is still rethrown. Red first: the refusal was rethrown. Green: the append test 2 of 2; the API typecheck exit 0; the real-database chat and connection files 30 of 30 (109 tests); the wide API folders 1019 of 1019 files (6893 tests). Part 1 of D7 (a lost transcript …

A migrated requester's conversation request is written on the requester's own side (defect D5 part 3, fix-queue row 11), red then green · 0345510

The conversation request took the requester's side from the sorted ids of the pair, so a migrated requester's consent could land on the peer's side. The request now takes the side from the stored row, and refuses a viewer who is not a party. This closes the three sites of D5. Red first on a real replica set: the migrated requester's consent landed on side B. Green: the migrated-requester test 2 of 2; the API typecheck exit 0; the real-database chat, connection and connection-route files 30 of 30 (109 tests); the w…

A migrated requester's private chat request is written on the requester's own side (defect D5 part 2, fix-queue row 11), red then green · 85104fb

The private chat request took the requester's side from the sorted ids of the pair. A migrated requester can sort to the other side, so the consent was written into the peer's side. The request now takes the side from the stored row, and refuses a viewer who is not a party. The now-unused identity import is removed. Red first on a real replica set: the migrated requester's consent landed on side B. Green: the migrated-requester test 2 of 2; the API typecheck exit 0; the real-database chat, connection and connectio…

A migrated viewer's vibe-check tap lands on the viewer's own side (defect D5 part 1, fix-queue row 11), red then green · 9dd0e2d

The vibe check took the viewer's side from the sorted ids of the pair. A viewer whose login id changed can sort to the other side, so the tap was written into the peer's field. The side now comes from the stored row through the shared side helper, and a viewer who is not a party is refused. Red first on a real replica set: the migrated viewer's tap landed on side B. The first attempt failed for a fixture reason (the row lacked the peer's profile id); the test was corrected. Green: the migrated-viewer test 2 of 2; …

A contact share is accepted only while the pair is connected (defect D6, privacy, fix-queue row 11), red then green · 6f23ffa

A contact share requested while the pair was connected could still be accepted after the pair ended, which wrote the recipient's phone number into the row. The accept now checks the pair's stage against the contact-share stage set, and refuses with the not-eligible error when the pair is not in one of those stages. A decline is not checked, since it shares nothing. Red first on a real replica set: the accept after the end wrote the value. Green: the accept test 2 of 2 (the control is an accept while connected); th…

The chat list does not treat a row with no peer as a real one (edge case E36, fix-queue row 11), red then green · d2564b8

A conversation row whose peer id was empty was listed as a chat, and all such rows grouped under one empty peer. The list now drops a row whose peer id is empty, before grouping rows by peer. Red first on a real replica set: the empty-peer row was listed. The first attempt failed for a setup reason (the viewer had no profile); the test seeds both profiles. Green: the withheld-peer test 2 of 2; the API typecheck exit 0; the real-database chat, connection and connection-route files 26 of 26 (101 tests); the wide API…

A retried private chat request sends no second request push (edge case E30, chat-request side, fix-queue row 11), red then green · d2332d0

A repeated private chat request that changed nothing still sent the recipient a request push. The chat request now reports whether the call changed the stage, and the route pushes only then. The old service function is a wrapper, so no other caller changes. Seven older route test mocks gained the new outcome method, each delegating to its existing chat request mock, so their counts and expectations are unchanged. Red first: a retried request sent a second push (expected 2 to be 1). Green: the chat retry test 2 of …

A retried connect request sends no second request push (edge case E30, connect side, fix-queue row 11), red then green · 4c84346

A repeated request that changed nothing (a double tap, a network retry) still sent the recipient a request push. The route now sends the push only when the call changed the stage. Red first: a retried request sent a second push (expected 2 to be 1). Green: the retry test and the refund test 5 of 5; the API typecheck exit 0; the wide API folders 1017 of 1017 files (6889 tests). The chat request route has the same unconditional push; that is the next item, since its service does not yet report whether the stage chan…

The live messaging gate refuses a stage it does not know (defect D9, edge case E25, fix-queue row 11), red then green · 81db73c

The gate refused only the stages on its blocking list, so a stage value outside the known list was allowed. It now refuses any stage outside the known list (the stage config's allStages) as well as the blocking list. The admin route already refused unknown stages by its validation. Red first: the unknown stage resolved instead of rejecting. Green: the gate unit test 3 of 3 (the refused error is compared by name, because the module is loaded after a reset); the API typecheck exit 0; the real-database chat, connecti…

An identity lookup failure is not answered as not found (defect D14 part 3, edge case E24, fix-queue row 11), red then green · 177f948

The identity fallback swallowed every failure, so a database error became a not-found answer for a connection that exists. The fallback now accepts only a missing profile (a typed error); any other failure is logged and rethrown, so the caller answers 500. Red first: the database failure resolved with an empty profile id. Green: the identity unit tests 5 of 5; the chat peer dual-identity test 5 of 5 (its no-row case now models the real contract: a null profile and the missing-profile error); the API typecheck exit…

An old connection row is read, not refused (defect D14 parts 1 and 2, edge case E24, fix-queue row 11), red then green · c47cd81

The stage read failed on two old row shapes: a date stored as text threw, and a missing consent object read as undefined. The read now converts a date text to an ISO string, reads a value that is not a date as null with a logged warning, and reads a missing consent object as an empty one. Red first on a real replica set: both shapes failed. Green: the real-database test 4 of 4 (including a non-date value); the API typecheck exit 0; the wide API folders 1014 of 1014 files (6881 tests). Part 3 (an identity lookup er…

A recipient who muted a chat gets no new-message push (defect D4, edge case E22, fix-queue row 11), red then green · 8722c36

A new-message push went out to a recipient who had muted the chat. The dispatcher now reads the conversation's mute list and skips the push for a recipient who muted it (reason muted). The sender's mute does not count. Red first: the muted recipient was notified. Green: the muted-recipient unit test 2 of 2; the four push unit files 11 of 11; the API typecheck exit 0; the real-database chat, connection and chat-route files 20 of 20 (80 tests); the wide API folders 1014 of 1014 files (6881 tests). Three older unit-t…

An ended connection clears the unread count of its thread (defect D12 part 2, edge case E20, fix-queue row 11), red then green · da3a91d

When a connection ended, the thread stayed listed with its unread count. The thread still shows; its unread flag now clears. A helper lists the viewer's ended peers with the same viewer filter the connection list uses, and the chat list clears the flag for those peers only. No message is marked read. Red first on a real replica set: the flag stayed true after the end. Green: the real-database test 2 of 2; the real-database chat, connection and chat-route files 20 of 20 (80 tests); the API typecheck exit 0; the uni…

An accepted conversation request pushes the requester (defect D12 part 1, edge case E20, fix-queue row 11), red then green · 5c16501

An accept sent no push. Now the requester gets one push when the peer accepts; a decline sends nothing. The push keeps the preference check and the self-send guard. Strings are in the five locale chat files; the CSV bundle was re-exported with the project script, and its round-trip check passed. Red first: the accept push function did not exist. Green: the unit test 3 of 3; the route test 2 of 2 (written after the route change, so its red was not observed); the API typecheck exit 0; the wide API folders 1013 of 10…

The forward message poll also sends messages that commit late (defect D8, edge case E19, fix-queue row 11), red then green · 9e9debc

A message is stamped before its transaction commits. A poll that had already moved its cursor past that stamp skipped the late message for good. The forward poll now also returns the rows stamped within 30 seconds before its cursor, capped at the page size. The strict page and the cursor are unchanged. The web merges by id, so a repeat shows once. Red first on a real replica set: the late message was not returned. Green: the real-database test 3 of 3 (late message, control, and a message older than the window is n…

Blank text is refused and a reused idempotency key with other text is a 409 (defect D10, edge cases E17 and E18, fix-queue row 11), red then green · 09bf6d9

Blank text (spaces, non-breaking spaces, zero-width characters) with no attachment is stored as a message today. It is now refused with 400 and code CHAT_MESSAGE_TEXT_REQUIRED. A client idempotency key reused with other text returned the first message; it is now refused with 409 and code CHAT_IDEMPOTENCY_KEY_REUSED, in the pre-check and in the duplicate-key recovery. The contract documents both on the send operation; the web and API outputs were regenerated with the project scripts. Red first on a real replica set…

The end-connection reason is limited to 200 characters (defect D11 part 3, fix-queue row 11), red then green · c3cb924

endedReason had no length limit. The contract now bounds EndConnectionRequest.reason at 200 characters, the same bound a user report reason already has (the plan names no number). The API zod schema and the web client, spec mirror and schema were regenerated with the project scripts. Red first: a 201-character reason got 200. Green: the end-connection route tests 6 of 6; the API typecheck exit 0; the wide API folders 1010 of 1010 files (6872 tests); the web typecheck exit 0; the whole web atomic suite 2031 files a…

A recipient declines a received chat request with respond-chat, not cancel-request (defect D11 part 2, fix-queue row 11), red then green · a73cd90

The reveal helper sent a decline of a received chat request to cancel-request, which answers 403 to the recipient. The decline branch now calls respond-chat with accept false; both call sites (the chat view and the connection manager) use the helper. Red first: the helper test failed (cancel called instead of respond). Also fixed on the way: two stale rows of the stage-group binding table (contact share fullReveal from D2, discovery mapper stranger from D1 slice 2), and the generated connection model regenerated f…

A replayed reveal cancel answers with its rollback stage, not a 409 (defect D11 part 1, edge case E16, fix-queue row 11), red then green · 170343a

The chat-cancel idempotency check accepted only the conversation stages. A blind reveal rolls back to anonymous_chat_active, so a second cancel of that reveal answered 409. The check now accepts the stages a chat cancel rolls back to, including anonymous_chat_active. Red first: the real-database replay and the unit test both failed. Green: the unit tests 14 of 14; the real-database replay 3 of 3 (blind replay, requested-chat replay, and a rejected pair still refused); the API typecheck exit 0; the wide API folders…

A rejected pair that asks again is refused and stays rejected (edge case E14, fix-queue row 11) · 1e03e34

New real-database test: after an end, a new request from either side, an accept and a reveal are each refused with the stage-mismatch code, and the row stays rejected with no consent written. Green on the first run, so no defect was found and no code changed; the test pins the behaviour against a later regression. Connection README row, atlas paragraph and the ledger row 12 updated. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

A message sent while the other side ends the connection is refused and not stored (edge case E4, fix-queue row 11), red then green · 180a094

The send checked the stage once, in the gate, before its transaction wrote the message. The stage is now checked again right before each message write, text and media, so an end that lands in between refuses the send. Red first on a real replica set: the message was stored after the end. Green: the send race test 2 of 2; the API service, route, library, chat, contract, architecture and middleware folders 1009 of 1009 files; the API typecheck exit 0; the Mongo chat and connection folder 43 of 43. Two contact-safety…

A reveal and an end at the same moment leave the connection rejected and answer cleanly (edge case E3, fix-queue row 11) · 050a9ea

New real-database test: twenty rounds of a reveal and an end at once, from the same seeded pair. Every round ends rejected with both consents cleared, the end always succeeds, and the reveal either succeeds or refuses with the 409 stage mismatch. The first run failed on the test own property name; after the correction all rounds passed. No code changed: the race is handled. The test cannot choose the order of the two calls, so it does not prove that both orders happened. Claude-Session: https://claude.ai/code/sess…

A repeat chat request that changes nothing gives its chat start back (defect D3 second case, fix-queue row 11), red then green · af59470

A conversation request now reports whether this call changed the stage. The route refunds the chat start when the request changes nothing, as a double tab does, as well as when the write fails. Red first: a repeat request kept its chat start. Green: the refund and quota race tests 4 of 4; the five mock files and the refund test 56 of 56; the wide API folders 1009 of 1009 files; the API typecheck exit 0; the Mongo connection and paywall tests 50 of 50. Five route test mocks that modelled only the old method got the…

A paid chat-start refund returns the unit to the grant it came from (defect D3, fix-queue row 11), red then green · 229e94f

The debit now reads the grant document before its update and reports the grant it took, identified by its grantedAt. The refund returns the unit to that grant. Red first on a real MongoDB: after a debit from the second of two grants (the first drained), the unit went back to the drained grant. Green: the real-database refund test 2 of 2; the paywall integration folder 14 of 14; the paywall and refund unit folders 108 of 108; the API typecheck exit 0. Two pinned assertions changed to the source object, and one unit…

A failed connection write gives the daily chat start back (defect D3, fix-queue row 11), red then green · 45299a7

The debit for a chat start reports its source (tier quota or paid grant). A new refund returns one unit to that source. The request route refunds when the connection write throws, so a failed request does not cost a chat start. Red first: the refund was never called. Green: the refund and quota-race route tests 3 of 3; the paywall tests 108 of 108 (two pinned assertions now expect the source, with the reason written beside each); the API typecheck exit 0. Not yet tested: the paid-grant refund and two requests at o…

The interface page lists 39 edge cases, their test status, and the peer interactions no document covers · 5d11971

New section 13: each edge case between two people or between a person and the server, what should happen, whether a test checks it (with the file cited; the 23 cited files exist), and the open plan defects. A second list names peer interactions that no document covers yet. The end-to-end specs were not run for this page. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

A contact share is eligible only at the full reveal (defect D2 contact share, fix-queue row 11), red then green · d01f14c

Eligibility for a contact share now also requires a full-reveal stage (chat_active), as photo, voice and contact share do (owner decision 1). Red first: a complete pair at the blind chat, at chat requested or at conversation active was eligible. Green: 62 of 62 in the three contact-share and stage tests; the API typecheck exit 0; the API service, route, library, chat and contract folders 6490 of 6492 across 971 files, 2 skipped. D2 is complete. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

A message that carries an uploaded photo is refused in the blind chat (defect D2 send path, fix-queue row 11), red then green · c635fcb

A send that carries a media id now goes through the media gate, so an earlier upload cannot be sent in the blind chat (owner decision 1). A text send keeps the messaging gate. Red first: the photo send reached the transaction at the blind chat. Green: 3 of 3 send tests; the API typecheck exit 0; the service, route, library and chat folders 6445 of 6447 across 962 files, 2 skipped. One pinned mock got a media export with its reason written beside it. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4K…

The interface page starts with one example, Maya and Jonas, from discovery to a shared photo · 12caa06

New section 0: the participants (the end user Maya, the peer Jonas, the web app, the API server, the database, the push service), a sequence diagram of one connect, chat and photo flow, a table of what Maya sees at each step and why the interface helps her, and why the interface matters in that flow. The layer diagram shows the end user as the first actor. The flow was checked against the code, not run in a browser. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

A photo or voice note is refused in the blind chat (defect D2 upload path, fix-queue row 11), red then green · 7ed0091

The upload service calls a new media gate before storage and before the database insert. The gate runs the live-messaging checks, then refuses unless the stage is the full reveal (owner decision 1). Red first: a photo uploaded in the blind chat was stored and inserted. Green: the four upload test files 8 of 8; the API typecheck exit 0; the API service, route and chat library folders 4575 of 4575 across 735 files. Three test files that mock the gate module got a media export with the reason written beside it. The r…

The interface page explains how the end user sees the data and how the data model works · ee3b5b6

New section 11: the path of a discovery page view and of a tap, as a flow diagram, and what each connection stage shows the viewer (checked against section 5 of the knowledge file). New section 12: the two identities, the connection row, the chat session and conversation, the stage as a compare-and-set state machine, with an entity diagram. Not read in full: every profile field and the matches collection. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The interface page shows the screen-model layer and ends with an explanation of it · 3023e8e

The layer diagram now separates the view, the screen model (a plain function from facts to a model) and the data hooks. A new final section explains the screen model with the example from buildConnectionsModel, lists the three layers, and adds a Mermaid diagram of the flow from the contract to the view. Not read in full: every screen model; two were read. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Media, voice and contact share are allowed only at the full reveal (defect D2 first step, fix-queue row 11), red then green · a88e4c0

New rule mediaAllowedForStage: true only for the fullReveal group of the gate JSON (chat_active), false for every other or unknown stage (owner decision 1: the blind chat is text only until the full reveal). Red first: the test failed with mediaAllowedForStage is not a function. Green: 3 of 3; the API typecheck exit 0; the API chat route and chat library folders 358 of 358 across 58 files. The chat matrix block was regenerated (one caller line number moved by the earlier @see line). The upload and send paths are t…

A discovered row with a withheld account id is neither visible nor pollable in the chats inbox (defect D1 slice 3, audit of the chat readers, fix-queue row 11) · 1ed3886

Audit of the chats page peer map: the null key for a discovered row reaches a list only when the peer is visible in the inbox, and a discovered peer is never visible. No defect was reproduced, so no code changed. The characterization test pins both predicates on the real code for a discovered row with a withheld id (15 of 15 in the file). With this, all four chat readers are audited. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The embedded chat stage is found by profile id when a discovered row withholds the account id (defect D1 slice 3, audit of the chat readers, fix-queue row 11), red then green · f4ca1c5

The stage resolver matched a connection row only by its account id. A discovered row withholds that id, so the stage was lost when the discovery card was not loaded. The row now also matches by its profile id, which the route carries. Red first: the stage came back undefined. Green: the resolver and chats route tests 12 of 12; the web chat folders 1311 of 1311 across 228 files; the web typecheck exit 0. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The chats inbox selects no peer for a discovered row, with or without its account id (defect D1 slice 3, audit of the chat readers, fix-queue row 11) · dc7eaf6

Audit of selectInboxPeersOutsideDiscoveryWindow: the withheld account id feeds one membership test, and a discovered row has no conversation row and is pre-request, so it is never listed. No defect was reproduced, so no code changed. The characterization test pins the behaviour for both cases (4 of 4 in the file). Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The chats route context maps no peer for a discovered row, which withholds the peer account id (defect D1 slice 3, audit of the chat readers, fix-queue row 11), red then green · 3427bce

A connection row whose peer account id is null (a discovered row) maps no profile id and adds no null peer. Red first: the profile id mapped to null, and null entered the known peers (both cases failed for those reasons). Green: the chats route tests 40 of 40; the web chat folders 1308 of 1308 across 228 files; the web typecheck exit 0. Still to audit: selectInboxPeersOutsideDiscoveryWindow, resolveChatsEmbeddedPeerConnectionStage, useChatsPageClientState. Claude-Session: https://claude.ai/code/session_013BMqcrc9b…

A discovered row of the connection list withholds the peer account id (defect D1 slice 3, list row, fix-queue row 11), red then green · 300b2de

The list route sends null for the peer account id on a discovered row, and the viewer own id stays. The contract fields userAId and userBId of Connection become nullable in the product spec source; the web types and the JSON mirror were regenerated, and nothing else in them changed. The connections page selects a discovered peer by its profile id: before this, tapping such a row selected null. Red first: the route test failed on the peer id in the row; the page model test failed on a null selection. Green: list ro…

The connection list of a discovered row must not carry the peer account id (defect D1 slice 3, first step, fix-queue row 11), red then known red · 15ae852

New route test for a discovered row of GET /api/connections. It failed on the unmodified route for the right reason: the row carries the peer account id. The positive case is marked it.fails until the fix lands, so the suite stays green and the fix must flip it. The control (an interested row keeps the peer id) passes. The assertion skips the connection id, which the scope answer keeps as a known limit. Decision for the fix recorded in the wave ledger. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdo…

A peer with no connection row has no raw account id on its card (defect D1 slice 2e, fix-queue row 11), red then green · edcfaca

The discovery card of a peer with no connection row now sends authUid as null, the same as the discovered stage. The web connects by profile id and shows Connect for this case, so the web does not change. Red first: the new test failed with the raw id in the card. Green: the card and mapper tests and the API discovery folders 366 of 366 across 50 files; the API typecheck exit 0. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Zoom in, zoom out, reset and full-screen controls for the interface diagrams · 9a65433

Each Mermaid diagram on the interface summary page gets a toolbar: zoom out, a level readout, zoom in, reset to 100 percent, and full screen (the browser Fullscreen API). Zoom changes the drawn width of the diagram, and the page scrolls when it is larger. No new library is loaded. The page script was checked for syntax with node. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Interface summary between the browser UI and the API server, with Mermaid data flows · 51a9655

The summary covers the layers (UI, web client, API server, MongoDB and the OpenAPI contract), the authentication and the BFF route handlers, one connect action as a sequence diagram, the stage moves, the refresh intervals, the disclosure rule at a glance, and the known gaps. The page loads Mermaid 10.9.1 from cdnjs. Every claim names its file; the NOT CHECKED section lists what was not read in full. Also logs the bio commit in the wave ledger. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

A stranger sees the first sentence of the bio, at most 120 characters (defect D1 slice 2d, fix-queue row 11), red then green · c76a553

A peer with no connection row, or in the stranger gate group (discovered, rejected, degraded), gets the first sentence of the bio, capped at 120 characters. The rule is section 5 of the matching-to-chat knowledge file and scope answer 2. Red first: the bio case failed (165 characters reached the card). Green: the card and mapper tests 30 of 30; the API discovery service and route folders 365 of 365 across 50 files; the API typecheck exit 0. The helper stays module-private (the unused-export check blocked the first…

Decide the blocked and skipped rows 5c, 9c, 20 and 21 (judge and reviewer, no code change) · a496ee3

Row 5c is a data deletion: the judge approves the inventory, and the code still names the collection, so the old text was wrong. Row 9c is application code, not production config: OPEN. Row 20 stays a hard case (a NEVER rule with a guard), with its branch-free parts waiting for row 13. Row 21: exit5 to exit7 go through a judge-approved inventory first; exit8 waits for the dev stack. Evidence is in the tick entry. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The discovery card of a discovered peer has no raw account id (defect D1 slice 2c, fix-queue row 11), red then green · 2dbed42

The discovery card of a peer at the discovered stage sends authUid as null. The web connects and opens the sheet by profile id, and the sheet and the tooltip show Connect (not Open chat) at this stage, so no chat route is reached with the id. The id is still required by the mapper, so a broken profile is still refused. Red first: the account-id case, flipped from known red to a real test, failed with the raw id in the card. Green: the card test and the mapper test 29 of 30 (the bio case is the expected fail, slice…

A discovered peer is connected by its profile id, without the account id on the card (defect D1 slice 2b, web part, fix-queue row 11), red then green · 018be25

Connect no longer needs the card account id. The request is addressed by the profile id, which the server resolves. The cache invalidation keeps the broad lists when there is no peer id, and keys only the peer stage cache by the peer. The paywall return target is empty when the card has no account id (the paywall still opens). Red first: the invalidation test failed (the lists were not invalidated); the connect test failed (the request was not sent). Green: 66 of 66 for the three changed test files; discovery, con…

A universe tap on a discovered peer opens the profile sheet, not the chat route (defect D1 slice 2, fix-queue row 11), red then green · a41dc53

The gate refuses chat at discovered, so the tap opens the profile sheet by profile id. Rejected and degraded peers keep the chat route, because their read-only transcript lives there. Red first: the new test failed (the chat route was pushed once). Green: the whole web discovery folder, 1201 of 1201 across 209 files; the web typecheck exit 0. Three pinned tests moved to a chat-stage peer on purpose, each with its reason written. The handler moved below the view and close handlers, so its dependencies are declared …

Queue the finding on which interface the summary meant (no code change) · 2b1cb6e

The mobile UI contract plan was not executed in this session: no commit since 2026-10-29 touches the UI contract, UI or screen-model folders. Queued for the next work tick. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

How the matching-to-chat knowledge file was built, and where its pattern applies to other solutions · b9b757b

New research page with the method of the workflow knowledge file (eight sections, two generated, one fixed by hand, one checked constant list, one defect list), the guards and their negative cases, the conditions for reuse in other solutions, the limits and the open items. Every claim names its file, command or test run. Also records the stranger-tap decision for defect D1 slice 2 in the wave ledger (judge option c, reviewer refuted the start-chat half for rejected and degraded peers; the change is narrowed to the…

A connection request is addressed by the profile id (defect D1 slice 1, fix-queue row 11), red then green · f28f74d

The discovery connect handler sends the peer profile id as the request target. The server resolves a profile id to the account id, and it refuses an unconnected peer whichever id is sent. The helper discoveryConnectionRequestTargetId was missing (red: not a function); green: 4 of 4 peer routing tests. Two pinned tests moved from the account id to the profile id on purpose, with the reason written beside the first. Related web files 91 of 91, typecheck exit 0; the server resolver tests 25 of 25. Cache keys still us…

Defect D1 red step, a stranger card must not carry the raw account id and must cut the bio (fix-queue row 11), red then known-red · 9ff7fe3

The new test ran on the unmodified mapper and failed for the stated reasons: the raw id reached the card, and the bio was 165 characters. The two defect cases are marked it.fails until the fix lands, so the suite stays green and the fix must flip them. The control (a peer at chat_active keeps the full bio) passes. The judge decided the web addresses a stranger by profile id in the existing request fields; the reviewer found the connection list, the snapshots and the push sender leak too. Recorded in the wave ledge…

The fifteen key modules refer to their section of the matching-to-chat knowledge file (fix-queue row 11, plan Deliverable 2), red then green · 644e7a5

Each key module has one comment line, `@see docs/knowledge/workflow-matching-to-chat.md#<anchor>`, naming its section. The guard maps each module to its section, checks the reference, and refuses an unknown anchor. Red first: the guard tests failed because all fifteen modules had no reference. Green: guard tests 16 of 16; the guard passes. Each module changed by one added comment line (the diff shows +1 -0 for each). No code changed. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Section 8 names the sixteen defects of the plan, D1 to D16, as candidates. · e7329ef

The plan rule holds: a defect counts only after its red test fails on the unmodified code. It also lists six findings from sections 2 to 7, the known limit of the connection id, and the decisions. Red first: the written-section test failed (8 not in the written list), and the defect test found no problem for D16. Green: guard tests 14 of 14; the guard passes on the committed file. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The matching-to-chat timing section states each constant as the code has it (fix-queue row 11, plan step 3, section 7), red then green · 9d8d662

Section 7 lists the polling intervals, the typing time-to-live, the chat rate windows and the UTC day rule, each as NAME = VALUE with its source line. The guard checks each constant in the section and in the code, so a changed constant stops the guard. Red first: the written-section test failed (7 not in the written list), and the constant test found no problem for a missing constant. Green: guard tests 12 of 12, including a changed code constant reported; the guard passes on the committed file. Claude-Session: ht…

Section 6 is written by scripts/gen_workflow_chat_matrix.py. · f73b3c6

It evaluates the three chat-gate rules over the gate JSON and stops when a rule line in the gate source changes. Red first: the generator module was missing (import failure). Green: chat matrix tests 6 of 6, including the changed-rule refusal; the knowledge guard tests 9 of 9; the guard passes. The unknown-value row records that live messaging fails open for a stage outside the enum, a plan finding for section 8. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Section 5 is the fixed matrix: nine stages plus self and blocked, each cell tied to an owner decision or a gate group, with the keys defined. · 5a31f2c

It is written by hand, so the generated stage machine cannot change the expected answer. Three rules the owner did not state are written with their evidence: the raw account id and the peer signal values never reach a non-self viewer, and a stranger gets no profile photo. Red first: the written-section test failed (5 not in the written list), and the stage-row test found no problem for a missing stage. Green: guard tests 9 of 9; the guard passes on the committed file. Claude-Session: https://claude.ai/code/session…

Section 4 is written by scripts/gen_workflow_stage_machine.py, which reads every stage write in the connection services. · 5455603

The stage list comes from the OpenAPI enum and the groups from the gate JSON. Red first: the generator module was missing (import failure), then the committed block had no markers. Green: generator tests 7 of 7, including a negative case where a hand edit is reported as stale. The first walk gave wrong rows (a group filter read as any, a $ne filter read as its literal); it now expands both, and each row was checked against its source line. Section 8 gets two notes: anonymous_chat_active has no target write in the …

Section 3 lists the collections, the connection row, its indexes, each writer with the fields it sets, and the readers, with a file and line for each claim. · ad26f22

Red first: the guard test for section 3 failed (3 not in the written list). Green: guard tests 7 of 7; the guard passes on the committed file. The read of the peer reply found the raw account ids the plan calls defect 1. Sections 4 to 8 stay open. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Section 2 lists each step from the screen hook to the push, with a file and line for every claim. · 8997685

The guard now refuses a written section that still says not written, or has no sourced fact (2 of 2 new cases red, then the committed file red on section 2, then green: guard tests 6 of 6; guard passes on the committed file). Sections 3 to 8 stay open. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The root dockerignore keeps nested local caches and test output out of a working-tree build (fix-queue row 10, Docker build context), red then green · 228194e

Decided 2026-10-29: a judge (opus) said KEEP, because release images come from a git archive; a reviewer (sonnet) refuted that, because the documented production compose command builds from the working tree and its builder stage copies the web folder (about 1.6 GB of nested caches). Decision: CHANGE. Red first: 4 of 6 positive cases failed (the five nested patterns were missing). Fix: add **/.next-*, **/.local, **/build, **/test-results, **/playwright-report. Green: 6 of 6. No Dockerfile copies any of the new name…

Run records under runs/ plan no image deploy (fix-queue row 10, release classifier), red then green · 9c7ae22

Decided 2026-10-29 by a judge (opus: CHANGE) and a reviewer (sonnet: could not refute it). Red first: a records-only range was IMAGE_ONLY (2 of 3 new cases failed). Fix: RUN_RECORD_PATTERNS, anchored at the repository root, used by the inert rule and the skip rule. Guard: no Dockerfile copies the whole tree or anything under runs/ (7 of 7). Green: the new tests 5 of 5; the classifier and caller tests 535 passed, 3 skipped; the cicd offline selection 1621 passed, 4 skipped, 116 deselected. Claude-Session: https://c…

Red first: the guard test failed on the missing scripts/check_workflow_knowledge.py (ModuleNotFoundError). · 4800425

Fix: the guard checks the eight sections of docs/knowledge/workflow-matching-to-chat.md by number, title and order; the file has the eight headings, and section 1 (actors and identity) is sourced from the code (profile id, account id, the card fields, the web transport). Sections 2 to 8 are headings with a status line, to be written in later steps. Green: the guard tests 4 of 4; the guard on the committed file exit 0. Not done here: the walker, the generator, the @see references, the defects. Claude-Session: https…

No unit-tier test opens a real MongoDB client; the six such files run in the Mongo integration tier (fix-queue row 10, flaky api shard), red then green · c77299b

Red first: the new guard named six unit-tier test files that build a real MongoClient (five start their own mongodb-memory-server, one uses the shared server). Fix: the six are renamed *.mongo.integration.test.ts; vitest.config.ts excludes them by name in tests and src; vitest.mongo-integration.config.ts includes them and gets the shared globalSetup; the hardening test resets the shared rate collection before each case (exported helper sharedAuthRateCollection in openAuthRateStore.ts) and counts its documents. Gre…

The authenticated e2e setup reuses a saved login only when the server still accepts it (fix-queue row 10, stale stored login), red then green · 40a27a5

Red first: the decision function did not exist (TypeError: decideStoredLoginReuse is not a function). The old setup reused any saved login under four hours old without asking the server, so a session that a journey run had ended stayed in use for hours. Fix: decideStoredLoginReuse (pure) reuses only a young file with a server-accepted cookie (liveSession true); a refused, never-checked, old, missing or forced login registers again. The setup asks GET /api/auth/session with the saved cookies only when the file coul…

The 915-line e2e fixture is split by concern, with a barrel that keeps the import path, and the helper size ratchet (fix-queue row 10), red then green · 36039db

Red first: the helper size test failed on the 915-line sim_synthetic_two_peer.ts (the other five over-limit helpers are on a recorded ratchet, so only this file failed). Fix: the helper is a 54-line barrel over sim_synthetic/session.ts (235 lines), onboarding.ts (338) and chat.ts (308); the exports are unchanged (one helper now exported: sleep, used by another module). Two type fixes found on the way, both type-only: the user-status payload type in nextauth_token.ts and the init-script return type in crawlInvarian…

The reviewers' guard probes are committed as tests (drain row 10, guard sensitivity), with one documented limit · 278e974

Three saved probes of the 25 October review (HAR coverage, API path guard, realtime interval guard) are committed under src/apps/web/tests/atomic/guards/ and run against the real guards: 66 of 66 green. Red first: the path guard probe case B5 failed (a segment under a parameter template, `/api/connections/stgae`, is accepted). Judgement, recorded: a `{param}` template matches any value by design (the guard cannot tell a typo from a real id), so refusing it would refuse valid ids; the case is pinned as a documented…

The pipeline page check compares content with the spec build time, not file modification times (fix-queue row 9, PIPELINE-PAGE), red then green · 3a2dbed

Red first: two new checks failed on the modification-time rule: a record touched without a change made the page stale (expected current), and a new record with an old modification time passed as current (expected stale). Fix: the spec keeps its build time (`asOf`); `--check` rebuilds the spec at that time and compares it with the committed spec (exit 0 current, 1 stale, 2 records unreadable); the unused modification-time helper is gone. The committed page was regenerated once with scripts/pipeline_page.py, and the…

Red first: the member subtree list still held the whole profileGenerator subtree, and the member bundle kept its title and preview messages (2 red). · 5843137

Fix: the hook moved to features/admin/profile-generator (only the admin tree calls it; the index export and the README rows updated; the caller and the three test references repointed); MEMBER_ADMIN_SUBTREES narrowed to profileGenerator.quadrantNames, because member screens read the quadrant names (profile header, discovery, match transform); the backlog proposal to drop the whole subtree was rejected on that evidence. Pinned examples updated: the negative control and the provider member case now use the quadrant …

The lockout rollout design per policy (drain row 11), red then green; row 11 DONE at its design step · f47ac7a

Red first: the drift test failed because docs/notes/lockout-rollout-design.md did not exist. Fix: the design note states the rules a lockout must meet (user key only, the web shows the lock, measured first), embeds the census table as scripts/rate_limit_census.py prints it, gives the measurement plan on the refusal log (14 days, metrics M1 to M3, threshold half the capacity, shadow dry run) and the rollout order. Green: the census tests 7 of 7 (the drift check included). Enabling more lockouts needs production log…

The rate-limit census lists each API policy with its caller kind and lockout (drain row 11, precondition 1), red then green · 441910d

Red first: the census tests failed on the missing module (ModuleNotFoundError). Fix: rate_limit_census.py reads each export const ... = createRateLimit(...) through its closing "});" and reports the caller kind (user-or-ip, custom key, global bucket) and the lockout flag. Green: 6 of 6 tests, the count checked against an independent declaration count (121); lockout: the two chat report pilots and no other; custom key: profileAccountLinkEmailRateLimit; global bucket: internalResolvePlatformRoleRateLimit. Claude-Ses…

Every rate-limit refusal log names the caller kind (drain row 11, precondition 1 of RATE-LOCKOUT-ROLLOUT: measure the caller first), red then green · 210d0dd

Red first: the caller-kind test failed on the refusal log lines, which named the policy and a key reference but not the kind of caller (keyKind undefined for an anonymous first refusal and for a signed-in lockout). Fix: one function (callerKind: user, ip, global, custom) decides the kind; the lockout decision and both refusal log lines use it. Green: the caller-kind test 3 of 3 (and 2 of 3 red before); the middleware tests 44 of 44; the 104 API files that mention rate limits, 1033 tests; API tsc exit 0. The API ha…

Red first: an anonymous caller refused 25 times reached RATE_LOCKED_OUT (its 20 strikes started a lockout on its IP). · 27044b4

Fix: the middleware keeps the lockout for a user-keyed caller; an IP-keyed, global-bucket or custom-key caller shares the same meter through a limiter with no lockout, so it is refused as RATE_LIMITED and never locked out. A signed-in caller still gets the lockout (positive control). Green: the new test 2 of 2, the 129 API files that mention rate limits (1030 tests), the mapped API and web invariant tests, API tsc exit 0. The API has no lint configuration. Claude-Session: https://claude.ai/code/session_013BMqcrc9b…

Red first: the 429 mapping test failed on the missing code (undefined, not RATE_LOCKED_OUT) for a lockout body and for a meter refusal. · 74608fc

Fix: the rate-limit error carries the body code (only RATE_LOCKED_OUT or RATE_LIMITED as the API sends it) and lockedUntil (ISO); a body that names neither, or is not JSON, gives none. The axios seam case (a lockout 429 through the browser path) was green on add, because the mapper change came first in this step. Green: the 429 mapping test 5 of 5; the axios test 6 of 6; the whole web atomic folder 2025 files and 11994 tests; web tsc exit 0; eslint exit 0. Row 11 stays open: the measurement design note and the IP-…

The second review of the rate meter (sweep time guard, the hint after a clock step back, stale headers), red then green; row 10 done (drain row 10, step e) · 7b1bc2b

Second review of 236791c4d (one opus critic, fix diff): APPROVE, with four low findings. Each fixed with a red test first: the hint after a clock step back counted from the new time, not from the kept reference (red 12 s, now 3611 s); the sweep accepted a non-finite time (now refused); the infinite and NaN times were tested only for NaN (now all three are pinned as a guard); two test headers named the deleted files (now the merged entry). Green: the whole web atomic folder 2025 files and 11991 tests; web tsc exit …

The rate meter review fixes (exact wait, clock that steps back, non-finite time and key cap refused, sweep on the caller time) and the package as one file (drain row 10 step e rev… · 236791c

Two critics reviewed 4eef243dc. Reproduced and fixed, each with a red test first: the Retry-After hint could be one second too high after a burst (float rounding; now exact to the millisecond, the test expects 11 s, the commit had 12 s); a clock that steps backwards rewound a key and drained it twice (the later time now stays the reference); a non-finite time disabled the budget (now refused); a non-integer key cap held one key too many (now refused); the cap sweep read the clock, not the caller time (now uses the…

The internal-secret failure budget on the shared leaky meter (drain row 10 step e), red then green · 4eef243

Red first: the leaky-budget test failed on the fixed window (the sixth charge reported 60 s, not the 12 s refill; the charge at 12.5 s was still refused). Fix: the failure budget is one createBffRateLimiter with the same 5-per-60 s bound and the same key cap (10,000). The meter check takes an optional time, and the factory takes a key cap and forwards the time, so the existing call shape holds. The pinned atomic test that expected 50 s and 30 s is updated to the leaky rule, the exact 12 s hint is pinned in the new…

Batch 4 of the BFF limiters on the shared factory (drain row 10 step d5), red then green · b8d6721

Red first: the batch test failed on seven positive cases (Retry-After was the rest of the minute, 60 s, not the refill time) and seven source cases (no module imported the factory). The seven negative cases were green by design. The full web atomic folder then failed one pinned test (public-features-bff-rate-limit, W0.135.t): it expected a refusal 5 s after the burst, which the old fixed window gave and the leaky refill does not. Fix: the test now asserts the leaky refill (first refusal waits 1 s) and a stronger n…

Batch 3 of the BFF limiters on the shared factory (drain row 10 step d4), red then green · 6f1582d

Red first: the batch test failed on eight positive cases (Retry-After was the rest of the window: 60 s for one-minute windows, 900 s for the native shell handoff, where one refill is 45 s) and eight source cases (no module imported the factory). The eight negative cases were green by design. Fix: each module keeps its exported names, its result shape and its reset helper, and declares its policy on createBffRateLimiter. Green: batch test 24 of 24; whole web atomic folder 2023 files and 11955 tests; web tsc exit 0;…

Batch 2 of the BFF limiters on the shared factory (drain row 10 step d3), red then green · d6d7f54

Red first: the batch test failed on eight positive cases (Retry-After was the rest of the window: 60 s for one-minute windows, 3600 s for the one-hour dev admin mutation window, where one refill is 720 s) and eight source cases (no module imported the factory). The eight negative cases were green by design. Fix: each module keeps its exported names, its result shape and its reset helper, and declares its policy on createBffRateLimiter. Green: batch test 24 of 24; whole web atomic folder 2022 files and 11931 tests;…

Batch 1 of the BFF limiters on the shared factory (drain row 10 step d2), red then green · bf44c3a

Red first: the batch test failed on eight positive cases (Retry-After was the rest of the minute, 60 for a 60 s window, not the refill time) and eight source cases (no module imported the factory). The eight negative cases were green by design. Fix: each module keeps its exported names, its result shape and its reset helper, and declares its policy on createBffRateLimiter; the check and reset call the limiter. Green: whole web atomic folder 2021 files and 11907 tests; web tsc exit 0; eslint exit 0. Claude-Session:…

The BFF limiter factory on the shared meter (drain row 10 step d1), red then green · b407cee

Red first: the factory test failed on the missing module. Fix: createBffRateLimiter gives one leaky-meter limiter per call with check(identity) in the web result shape and a reset that clears only that limiter. The package entry is now src/index.ts (main dist/index.js). Green: 17 of 17 across the meter, factory and pilot tests; web tsc exit 0. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The users register BFF limiter runs on the shared leaky meter (drain row 10 step c), red then green · ee24aa3

Red first: three cases in the pilot test. Retry-After was 60 where the leaky refill gives 3, and the caller was refused at 3.5 s after the burst. The meter test for the result shape failed too: an accepted result had no wait value. Fix: the pilot delegates to createBoundedRateMeter (same export, same constant, same reset helper). The meter returns one result shape (allowed, retryAfterSeconds 0 when allowed) so the web reads it without narrowing (its compiler has strictNullChecks off). The wait is computed in whole…

The shared rate meter is packaged for the web (drain row 10 step b), red then green · e5f5862

Red first: the packaging test failed on the missing web dependency and the missing Docker copy line. Fix: the package has its own manifest, lock file and build config; its compiled dist is shipped (the gitignore allowlist, the same as error-core); the web declares it as a file dependency (lock entry only); the Docker build copies the package folder. Green: packaging and meter tests 7 of 7; web tsc exit 0; readme depth gate exit 0. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The commit precheck asks for a committed parent README when a new folder appears (drain row 22), red then green · bf167bb

Red first: the new precheck case expected the parent README and got none. Fix: a new folder under a committed folder needs that parent README in the same commit. Green: precheck tests 21 of 21. The precheck now names the parent README before the commit hook refuses it. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 20:25, row 10 step a landed; precheck gap for the folder depth gate recorded as row 22 · ce366fb

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Shared bounded rate meter, tests first (drain row 10 step a), red then green · dc7be9f

Red first: the meter test failed on the missing package module. Fix: createBoundedRateMeter gives the API leaky-meter rule with a bounded store (a key cap, drained keys dropped first, then the oldest key evicted) and a sweep; a refused request is not recorded; the capacity and window are validated. Green: 5 of 5 in the web suite; web tsc exit 0. Packaging, the pilot and the batches are the next steps of row 10. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Web rate limiters through one shared package, design v1 (drain row 10 step 1) · 6031c47

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The rate middleware records a shadow event for a lockout-starting refusal (drain row 9b step b2), red then green · 99bee67

Red first: the middleware shadow test failed (the shadow hook was never called after a lockout started). Fix: createRateLimit takes an optional shadow hook and its labels; a refusal that starts a lockout is recorded as one shadow event; the answer is unchanged; a hook failure is logged and never turns the 429 into an error. Green: middleware shadow test 2 of 2; middleware, route, rate and architecture folders 399 files and 2408 cases; tsc exit 0. No production policy sets the hook; that is row 9c, blocked as a pro…

A lockout-starting refusal becomes one shadow event (drain row 9b step b1), red then green · 09d03af

Red first: the adapter test failed on the missing module. Fix: shadowEventForDecision gives one shadow event for a refusal that started a lockout and none for any other decision. Green: adapter 3 of 3; event file 3 of 3; tsc exit 0. The request-path call is the next step of row 9b. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Durable record of shadow events refuses an enforced event (drain row 9b step a), red then green · 9d451f6

Red first: the real-driver test failed on the missing store module. Fix: recordShadowBanEvent stores a shadow event with its labels and refuses any event not marked not enforced. Green: real-driver record file 2 of 2; tsc exit 0. The request-path call is the next step of row 9b. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The shadow event of a would-be ban (drain row 9b, step 1), red then green · 16fae25

Red first: the event test failed on the missing module. Fix: buildShadowBanEvent labels the event per the design, always enforced false, and refuses a subject that is not a keyed hash. Green: event file 3 of 3; shadow rule 3 of 3; tsc exit 0. The durable record and the request-path call are the next steps of row 9b. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ban rung in shadow mode is a pure rule (abuse ladder, drain row 9), red then green · 186b914

Red first: the shadow-mode test failed on the missing module. Fix: banRungOutcome records every would-be ban and enforces it only when shadow is off. Green: 3 of 3; tsc exit 0. The API package has no eslint configuration, so lint is not a gate here. The event record and the adapter are row 9b. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The Chats inbox reads each peer session once per poll (abuse ladder, drain row 8), red then green · ed2bd23

Red first: the single-read test failed (the status hook returned no session map; the inbox page still called the second session hook). Fix: the status hook returns the session it read for each peer (null on a failed read); the inbox page uses that one read and drops its second hook call and import. Page-state test mocks moved to the one read. Green: single-read test 2 of 2; page-state test 29 of 29; chat folders 228 files and 1306 cases; web tsc exit 0. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsd…

The chat session poll waits the server retry time after a 429 (abuse ladder rung 1, drain row 7 step 3), red then green · 2af09d2

Red first: the back-off case found the poll running at 10 s after a 429 that named 30 s. Fix: the batch loader passes the rate-limit error it saw up to the poll; the poll is a chain of timers scheduled from the last answer, through nextChatPollDelayMs; the first load schedules the first poll. Green: hook file 8 of 8; chat folders 227 files and 1304 cases; web tsc exit 0; eslint exit 0. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Chat poll back-off helper: a 429 delays the next poll to the server retry time (abuse ladder rung 1, drain row 7 step 2), red then green · 45fc213

Red first: the test failed on the missing module. Fix: nextChatPollDelayMs returns the server retry time for a rate-limit failure when it is longer than the normal interval, the normal interval otherwise. Green: 4 of 4; web tsc exit 0; eslint exit 0. Not yet wired into the poll. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

A 429 carries the server retry time into the rate-limit error (abuse ladder rung 1, drain row 7 step 1), red then green · 3dae3a9

Red first: the 429 test failed (the rate-limit error had no retry time where the body named 30 seconds). Fix: httpErrorFromResponse reads retryAfter (seconds) from the 429 body; no value is guessed for a body that names none or is not JSON. Green: 2 of 2; 64 web test files that use the normalizer or the client, 576 cases; web tsc exit 0. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Shared-store documents record the policy id of the limiter that wrote them (drain row 6), red then green · c77ef49

Red first: the real-driver case found no document carrying the policy id. Fix: RateLimiterPolicy takes an optional id; the store writes policyId with each document (none when the policy has no id); the shared secret limiter names its policy after the limiter. Green: real-driver rate store file 18 of 18; rate, auth, route and architecture folders 446 files and 2829 cases; full unit suite 1104 files and 7890 cases; tsc exit 0. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Account deletion removes the erased users shared-store budget (drain row 5b), red then green · 94a10be

Red first: the replica-set erase test found one tagged rate document left after the erase. Fix: eraseMemberDerivedData removes each erased user subject-tagged budget from the shared store, outside the deletion session (the store is idempotent), and reports the count as sharedRateBudgets. Green: erase test 2 of 2; profile, auth and service folders 79 files and 724 cases; full unit suite 1104 files and 7890 cases; tsc exit 0. The legacy erase stays until the production drop (row 5c). Claude-Session: https://claude.a…

Backup-code service no longer touches the old counter collection (drain row 5, step b), red then green · 5d791d0

Red first: the guard found the old collection name in the backup-code service. Fix: removed the index creation, the delete on that collection in the purge, and the unused scope type; two service assertions updated to the new behaviour (the old collection is not created; the purge leaves the other user codes in place). Green: guard and service file 22 of 22; full unit suite 1104 files and 7890 cases; tsc exit 0. Account deletion still erases the legacy rows and does not yet clear the shared-store budget (row 5b). C…

Ledger 12:50, dead backup-code collection counted on the dev stack (0, absent); production drop split off as a hard case · 64fb131

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Erasure removes a user backup-code budget from the shared rate store (drain row 5, step 1), red then green · 4e31123

Red first: the real-driver erasure cases failed (missing subject helper); the memory-store contract case failed (no erase method). Fix: backup-code failures are tagged with a keyed hash of the user id; the shared limiter and the store carry the tag; purgeBackupCodesForUser calls forgetSubject; the in-memory store implements the same erase contract. Green: erasure 2 of 2; contract 11 of 11; auth and route folders 457 files and 2915 cases; full unit suite 1103 files and 7888 cases; Mongo auth and rate 11 files and 6…

Production rate-store keys are keyed hashes, never raw client identities (drain row 0), red then green · c5cbd9c

Red first: the real-driver case found a document whose _id was the raw client IP (the production opener passed no digest). Fix: the opener hashes every key with a key derived from INTERNAL_API_SECRET (purpose label rate-store-key/v1; no new secret), reusing hmacRateKey; it refuses to open without the secret. Green: openAuthRateStore integration file 4 of 4; tsc exit 0. Rotating INTERNAL_API_SECRET restarts the rate budgets once (stated). Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Retire the in-process failed-secret limiter; all secret limiters on the shared store (drain row 4, step c), red then green · f771c11

Red first: the retirement guard listed three source files still importing the old module. Fix: the decision type moved to the shared module; the pre-handler imports it from there; the test reset no longer calls the old class; the old class and its test file are removed; leftover comments point at the shared module. Green: guard 2 of 2; routes, auth, middleware and architecture folders 465 files and 2941 cases; full unit suite 1103 files and 7887 cases; tsc exit 0. The old 10,000-client cap is gone; the Mongo expir…

Backup-code failure limiter on the shared auth store (drain row 4, step b2), red then green · b0fd52d

Red first: the backup-code limiter test failed (the opener never called; the failure allowed instead of blocked). Fix: createBackupCodeFailureLimiter builds the shared limiter; the verify path awaits the decision and reads the call time for its window and its log dedupe. Ripples: the hardening file moved to the awaited API, the retry check to the gradual refill (200 s), its tracked-client checks to the shared store size; the drift table declares the rate collection as non-blocking with its reason. Green: backup-co…

Cron-secret guard charges the shared auth store, keys namespaced by limiter (drain row 4, step b), red then green · 85d74cc

Red first: the cron guard test failed (the shared opener never called); the collision case failed (the internal exhaustion blocked the cron call for the same IP). Fix: verifyCronRouteSecret uses createSharedSecretFailureLimiter with openAuthRateStore; the shared limiter prefixes every store key with its limiter name, so internal and cron budgets stay separate. Green: cron guard 2 of 2; limiter folder 17 of 17; route, auth and architecture folders 434 files, 2651 cases; tsc exit 0. Claude-Session: https://claude.ai…

Internal-secret guard charges the shared auth store (drain row 4, step a2), red then green · f6fa686

Red first: the guard test failed (the shared opener was never called). Fix: verifyInternalRouteSecret builds its limiter with createSharedSecretFailureLimiter and openAuthRateStore. Ripple handled: unit tests get one in-memory store (unit config only), three cases updated to the shared store, both shared limiters read the clock at call time (a real defect: Date.now was captured by reference), and the rate collection is classified as an ephemeral exclusion for the collection invariant. Green: internal guard test 2 …

OpenAuthRateStore opens the shared rate store on the application database (drain row 4, step a1), red then green · 87c6a65

Red first: the opener test failed on the missing module. Fix: openAuthRateStore reads the database when called, opens the rate collection and returns the shared store; the document type is exported from the store module. Green: 2 of 2 on the real database (two openings share one budget; opening again keeps one TTL index); tsc exit 0. The secret limiters do not use it yet. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Shared secret failure limiter opened on first use, two processes share one budget (drain row 4, step 4), red then green · 81cc318

Red first: both new files failed on the missing module. Fix: createSharedSecretFailureLimiter opens the shared store once, on first use; an open failure blocks the call (fail closed) and the next call retries. Green: unit 12 of 12; Mongo integration 1 of 1 (two limiter instances on one collection share one budget: the sixth failure is blocked on either); tsc exit 0. The module-level callers are not switched yet. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The secret pre-handler awaits the failure decision and accepts the shared limiter (drain row 4, step 3), red then green · 1e4fdb2

Red first: the sixth wrong secret answered 401 (the decision was read before it resolved), and a store failure answered 401 instead of 429. Fix: the pre-handler awaits the decision; it accepts any limiter with recordFailure and a message; the shared limiter exposes its 429 message. Green: 10 of 10; the auth and route folders 403 files and 2334 tests; tsc exit 0. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Shared failed-secret limiter logs a store failure at error level (drain row 4, step 2), red then green · e146bf4

Red first: the store-failure case expected one error record and found none. Fix: the limiter logs once at error level with the policy name and the reason, never the client key; the logger is injected and defaults to the shared logger. Green: 7 of 7; tsc exit 0. The three callers are not switched yet. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Shared failed-secret limiter on the rate base, step 1 of drain row 4 (red then green) · bf9af75

Red first: the test failed on the missing module. Fix: SharedFailedSecretAttemptLimiter keeps the first N rejected secrets per client allowed and blocks the next, on the rate base and the shared store, with a gradually refilling budget (leaky meter), lockout off, and fail closed when the store cannot answer. The first draft expected the fixed-window answer at half a window; corrected to the leaky-meter answer the design chose. Green: 5 of 5; tsc exit 0. Not yet wired into the three callers. Claude-Session: https:/…

Subject tag on rate documents and erasure by subject on the shared store (drain row 3), red then green · e1d3921

Red first: three real-driver cases failed (no tag stored; no erasure method). Fix: the store writes the subject tag on insert and update, and forgetSubject removes one subject documents and leaves the others. Green: mongoRateStore integration file, 16 of 16; tsc exit 0. The limiter that passes the HMAC(userId) tag comes with the secret limiters (drain row 4). Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The shared rate store applies a key digest (HMAC option, drain row 2), red then green · 0f4b7a5

Red first: three cases on the real driver showed the raw identity stored (no hashed _id; one document after a rotation). Fix: the store takes a digest (default identity) and applies it to read, write and delete. Green: mongoRateStore integration file, 13 of 13; tsc exit 0. The limiter that supplies the keyed digest comes with the secret limiters (drain row 4). Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

OpenMongoRateStore ensures the TTL index before first use (drain row 1), red then green · 45a1e11

Red first: two cases failed on the missing factory. Fix: openMongoRateStore ensures the index, then returns the store. Convention: services ensure their indexes on first use; no boot call exists for the other stores. Green: mongoRateStore integration file, 10 of 10; tsc exit 0. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Red first: two cases failed on the missing function. · 877a605

Fix: ensureRateStoreIndexes creates the expireAfterSeconds 0 index on expiresAt, safe to repeat. Green: mongoRateStore integration file, 8 of 8; tsc exit 0. The boot call comes next. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger, open items drain list for the drain loop · 8d3fa1e

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 08:40, decision on the superseded local tag (kept, unpushed, correct record in the ledger) · 7bd2109

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Secret limiters, open reads resolved (backup-code decider, async pre-handler, erasure by subject) · b62370b

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Secret limiters on the shared rate base (backlog item 2), design v1 · 3811080

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

HMAC key option for the shared rate store (hash of the identity, rotation candidates, empty secret refused) · 10c24dc

Red first: the eight HMAC cases failed at import (module not found). Fix: rateKeyHmac.ts. hmacRateKey hashes an identity with the secret (no identity in the stored key); an empty secret is refused, never an unkeyed fallback; rateKeyCandidates gives the current key and, during a rotation, the key under the previous secret. Green: tests/lib/rate, 7 files, 113 tests; tsc exit 0. Not yet wired into the API limiters. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 07:20, shared rate store on Mongo done, next the HMAC key option · 8c20474

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Red first: the Mongo component cases failed at import, then on a null field read back from Mongo. · 300a7ff

Fix: mongoRateStore.ts (one document per key, compare-and-set through compareAndSet.ts, expiresAt never earlier than the meter, strike and lockout horizons, duplicate-key insert is a conflict, absent fields restored from null); compareAndSet treats a next of undefined as a read-only decision; the store interface is split (async update and forget; sync reads only in the memory store), and the synchronous calls refuse an async-only store with a TypeError that names checkAsync. Tests: 6 Mongo cases on the real driver…

Ledger 06:00, red component test for the Mongo rate store recorded · 2ca6272

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 06:34, phase B branch finding queued as an open hard case · 773ec3c

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Async path on the rate-limit base (compare-and-set loop, checkAsync, peekAsync, refundAsync, RateStoreUnavailableError) · 851f721

Red first: the compare-and-set loop tests, the async contract cases and the contention cases failed on missing functions. Fix: compareAndSet.ts (conflicts retried with a fresh read and a jittered pause; exhausted attempts are contended; an unknown write outcome is never retried); one planner for the sync and async path in rateLimiter.ts; a contended store gives a rate refusal with a retry hint, never a lockout; a store that cannot confirm its write rejects with RateStoreUnavailableError. Green: tests/lib/rate, 6 f…

Ledger 06:12, red tests for the compare-and-set loop and the async refund recorded · 088f02b

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Rate-limit shared store design v2, applies the design review (ten findings) · 58156f7

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 05:48, red contract test for the shared rate store, design critic dispatched · 2af6a9a

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Peek, refund and reset on the rate-limit base (backlog RATE-LIMIT-ALL-ON-BASE item 1, memory store) · 271348a

Red first: nine cases in tests/lib/rate/rateLimiterOperations.test.ts failed with "is not a function". Fix: check and peek share one decision path; peek writes nothing; refund gives one charge back and never goes below empty; reset deletes the key. Positive and negative cases in the same file. Green: tests/lib/rate, 4 files, 88 tests; tsc exit 0. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 05:20, red test for peek, refund and reset recorded (uncommitted until the fix) · 9da86ee

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Shared atomic store for the rate-limit base (backlog item 1), design v1 · b268a2f

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 05:10, phase A closed, two more old copies removed, four kept with reasons · fa5438a

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 04:58, run evidence of old copies copied to the project, copy removal blocked by root files and a running stack · c723600

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 04:45, two old clean copies removed after judge inventory, four kept (git refuses) · cce5ee1

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Phase A exit gate W26.6.b checked off (real verify run at a59f5b80c); run ids in the ledger · f53b840

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 04:13, offline run progressing (49 steps) · d34158a

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 04:04, offline run alive in its pytest step, keep-test gap for run folders · 47726f0

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 03:55, offline tiers at a59f5b80c still running · d957b29

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger record of the tag decision and the open offline gap · 795c89e

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 03:45, browser tiers green at a59f5b80c, correction of the tag record, offline run started · 818a8f3

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 03:34, browser tier t2i green at a59f5b80c, t2f started there · aa99939

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 03:23, clean browser tier still running · a398f47

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 03:13, clean browser tier still running · 057d391

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 03:03, clean browser tier t2i in its browser steps · bd0e30b

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 02:56, browser tier t2i started at a59f5b80c · 58747e5

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

A guard that the chat transcript shows a message at 1280x720 (layout review, not yet reproduced) · a59f5b8

A browser guard on the chat thread with one stubbed message: the transcript region is at least one message row high and the message is visible. It passes with the stub, so it does not reproduce the reviewed squeeze (which needs the live page rows); it stays as a guard. Checks: 2 of 2 green on the dev stack (setup and the check). Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 02:43, measurement spec re-run with its test address · c5e134e

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 02:34, measurement spec run · 5dd9e2a

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 02:33, banner source unverified, measure the layout first · 95fac21

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 02:22, message-area red test plan using the chat route stubs · ba588eb

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 02:04, message-area defect needs a live browser test · ba13b2b

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 02:10, match guard fixed in code, backlog status updated · 26d0de0

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

A call limited to one peer waits for an in-flight recalculation instead of being skipped (MATCH-GUARD-SKIPS-OTHER-PEER, WAVE-26 W26.6.b) · 60043f4

The same-process guard was keyed by user only: a call limited to one peer was skipped while a full run for the same user was in flight, so the internal pair-materialization route lost one side's match row (the dual-peer race; API log skippedA true). Peer-limited calls now wait for the run in flight, then run; a second full run is still skipped. The pair route uses the waiting helper and no longer carries a dead skip branch. Checks: the new test was red first (the helper did not exist); the guard tests and the rout…

Backlog the two product defects from the in-tier review, decide the order · 1761edc

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 01:44, reviewer still working on the in-tier flakes · 39eae5f

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 01:35, unread-dot passes alone, in-tier cause under review · 862308c

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 01:24, unread-dot journey re-run alone with its test address · d047082

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 01:13, unread-dot journey run alone · 4c25caa

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 01:04, browser tier t2i red in two journey specs, queued in the backlog · 7bddd83

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 00:53, t2i clean run still in browser steps · d991596

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 00:43, t2i clean run still in browser steps · 19862cb

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 00:33, t2i clean run in its browser steps · c258dba

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 00:25, t2i refused on a dirty copy, rerun in a clean copy at HEAD · c52930c

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 00:14, race spec green twice, browser tier t2i re-run started · f58db71

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The race spec accepts either Stripe gap the stack reports, and expects the matching activation message (WAVE-26 W26.6.b) · ed36206

The spec expected "Stripe API key missing", but the stack reports its Stripe gaps from the server environment (the key is set here, the webhook secret is not), so the spec failed on every run. It now accepts either gap message (positive), refuses an ok result (negative), and expects the activation message that matches the gap shown. It also resets the stored Stripe references and the price field first, so the price assertions hold on every run. Checks: run twice in a row on the dev stack after the tombstone clear:…

Ledger 00:08, race spec corrected per review, two runs · f50002c

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 00:03, race spec message mismatch under review · dcf8547

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 23:54, race spec check after the tombstone clear · bbc1f5d

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 23:44, race spec reset fix under test (two runs) · dcc3e0d

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 23:34, race spec root cause (persisted Stripe settings), fix plan · 36a0033

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 23:23, t2i re-run in its browser steps · d3f82ba

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 23:13, t2i re-run still in its browser steps · 7d58079

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 23:03, t2i re-run in its browser steps · 93aaf12

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 22:54, browser tier t2i re-run started · fc78c4e

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 22:48, t2i one red (state leak between specs), rerun next · 697f830

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 22:33, browser tier t2i in its integration step · a620a8c

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 22:23, browser tier t2i still running · a0aec55

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 22:13, browser tier t2i past the stack step · 9d5ca21

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 22:04, browser tier t2f green (3 of 3), t2i started · b305502

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 21:53, browser tier t2f past the stack step · 647b416

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 21:45, browser tier t2f started at 59d6920e9 · adfbc8d

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 21:36, bubble colours checked in a browser (stylesheet level) · 59d6920

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 21:23, dev stack up (web and API healthy) · 03778de

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 21:14, web build-cache volume reset, stack up again · 576c49d

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 21:04, web reinstall stuck, prefetch with network again · f3ebcb4

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 20:58, API secret fix committed and the API healthy · 1d217af

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The dev API gets its auth secret from the host environment (the dev API could not start without it) (WAVE-26 W26.6.b) · c46c665

The dev compose file never passed NEXTAUTH_SECRET to the API service; the production override does, with a literal. The API service now takes it from the host shell with an empty default (the same pattern as INTERNAL_API_SECRET), so no value lives in git. Checks: the guard test fails on the committed file and passes on this one (positive, literal refused, missing line refused); the dev stack brought up with the secret from the host environment: API container healthy, health endpoint answered 200. Claude-Session: h…

Ledger 20:52, loop at 10 minutes, API secret fix under test · d73f7ca

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 20:47, stack API secret not passed to the container · 7b8ad14

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger 20:45, chat bubble analysis and coloring change · f076c7c

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The other person bubble is the brighter one, the own bubble the darker one, on both sides · 71ae111

The thread colored the viewer own messages brighter than the other person (the reverse of what a reader needs to tell who wrote what). Both bubble rules now use the existing violet tokens: own = deep violet, darker; peer = brand violet, brighter. No new colors. Not checked in a browser yet (the local stack is still being brought up); the class rule itself is the only change. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 20:37, stack bring-up retry after the environment link · ea2c342

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 20:30, stack prefetch in the api step · 8685cc9

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 20:26, browser stack prefetch after the package change · c51e382

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 20:21, browser tier t2f bringing up the stack · e57c2f5

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 20:17, browser tier t2f started · 1bddb2f

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 20:11, offline evidence run green (57 of 57) · 1b94637

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 20:06, evidence run 53 steps green · 1573905

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 20:02, evidence run 50 steps green · f0078ae

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 19:57, evidence run 48 steps green · 74c4467

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 19:52, evidence run in the backend step · 5e3630c

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 19:47, evidence run in the backend step · 013e320

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 19:43, evidence run in the backend step · 85666c6

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 19:38, evidence run in the backend step · ae56d48

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 19:33, evidence run at 3b030e71e progressing · ed3f05c

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 19:31, full offline evidence run at 3b030e71e · a0c0a5f

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The offline tier creates the matching environment before the Mongo suites (they require it) · 3b030e7

The full offline run had two erasure suites red (api-mongo-integration): they need the matching service venv, which the matching step creates only later in the tier. A prep step now runs first (uv run --offline, the same way the matching step does). The suites still fail, never skip, when the venv is absent. Checks: the Mongo step alone passed (diagnostic, test copy); the step list shows the prep step before it. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 19:24, Mongo diagnostic running · 82f0b71

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 19:20, offline run 1 red (matching environment order), diagnostic running · f6ff06c

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 19:14, evidence run 52 steps green · cb0a54f

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 19:09, evidence run 50 steps green · 0472bc4

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 19:05, evidence run 49 steps green, backend finished · 9923feb

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 19:00, evidence run backend step past expected time · 9ab7de5

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 18:55, evidence run in the backend step · 267150a

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 18:50, evidence run in the backend step · c64e8ca

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 18:46, evidence run in the backend step · 3345ed8

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 18:41, evidence run at e82a58296 progressing · 113fbe7

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 18:38, full offline evidence run at e82a58296 · 1d2d185

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The full offline run stopped at api unit with exit 1 while every test passed: six parallel shards deleted the same default cache folder at once (ENOTEMPTY). · e82a582

The shard arguments now pass --fsModuleCachePath=node_modules/.vitest-cache-shard{i}. Checks: the api unit step alone (diagnostic, test copy) green: 7791 tests. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 18:34, api unit shard cache race found, diagnostic running · ff76b04

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 18:27, evidence run 49 steps green · ed99971

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 18:22, evidence run 29 steps green · d64f7df

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 18:17, evidence run past the backend step · 757815d

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 18:12, evidence run in the backend step · a1c825a

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 18:08, evidence run in the backend step · af50939

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 18:03, evidence run in the backend step · 42b198b

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 17:58, evidence run at the fixed commit progressing · db8afbe

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 17:57, fresh copy at the fixed commit, evidence run started · f5b8915

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 17:57, first red found and fixed, new clean copy next · 3c32f64

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The guard allowlists the marketing landing by path. · cede5f0

The landing views moved from features/landing to ui/screens/public/landing (WAVE-26 public group), so their max-w-5xl and max-w-7xl wrappers were flagged in the offline tier (red: 6 landing files). The exemption moves with the files; the intent (marketing wrappers) is unchanged. Checks: the guard file passes 2 of 2 in a fresh copy; the guard still flags any shell-tier width in other folders (its existing negative check). Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 17:48, evidence run past the backend step · d3dc57c

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 17:43, evidence run in the backend step · e6ba754

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 17:39, evidence run in the backend step · 93e6186

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 17:34, evidence run in the backend step · 1e1529e

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 17:30, evidence run progressing · f121f83

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 17:25, backend step green alone, full offline evidence run started · 75d0301

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 17:21, backend diagnostic progressing, production test checked as a fixture · eecbfb0

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 17:15, backend diagnostic still running · 00c195e

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 17:10, backend diagnostic still running · 3e05860

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 17:05, backend diagnostic still running · e896e32

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 17:02, backend step as a diagnostic run · db2a64c

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 16:58, new clean copy, backend step alone · 8b70489

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 16:55, offline run 5 reds explained and fixed · d7680e1

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

The offline tier prepares the web config copy, and the depcruise test expects the error severity (WAVE-26 W26.6.b) · c01e26e

The web typecheck, its prod-context and api variants and the api ts6 check all failed in a fresh copy: the @config/* aliases resolve to apps/web/config, a gitignored copy that only the sync script makes (the live folder had it from an earlier run). A prep step now runs the sync before the first type check. The UI dependency rules are errors (commit d24b6017d), so the depcruise test now asserts the error severity; its previous assertion (warning) was stale. Checks: depcruise test 6 of 6 green; the sync and the type…

Ledger tick 16:43, offline run 5 still in the backend step · 9e74aaa

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 16:38, offline run 5 progress · 2953d08

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 16:36, offline run 5 at the fixed commit · 17cb15c

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 16:33, offline run repairs (lock, package declaration, clean-copy setup) · fb719a8

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Declare @storybook/react (the gallery render test imports it; the undeclared-import check was red) · d0e8cf9

The gallery render test (tests/atomic/ui/gallery/storiesRender.test.tsx) imports composeStories from @storybook/react, which the web app did not declare; it resolved through a transitive package, so the live tree passed and a clean copy failed. Declared at the same exact version as the other Storybook packages (10.6.5); both lock files follow. Checks: undeclared-import check rc 0 (it flagged the import before), lockfile parity rc 0, the render test 378 of 378 green. Claude-Session: https://claude.ai/code/session_0…

The pnpm workspace lock follows the bumps of bf6ebabad (lockfile parity was red on 9 packages) · fe219fb

The npm lockfiles moved in bf6ebabad; the pnpm workspace lock still had the old versions, so check-lockfile-version-parity failed for the web and api apps. Re-resolved in lock-only mode (no install, no other package changed); the parity check now agrees on 57 api and 130 web dependencies. Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 16:14, cache judge running · e51e0e3

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 16:10, disk at 98 percent, runs held · b5f7d99

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 16:06, offline run void (clean copy had no packages), reinstalled · 9412e77

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Ledger tick 15:56, offline tier run on the exit-gate sha · 5a49776

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

UI dependency rules at error level; exit gate verify checks them (WAVE-26 W26.6.b) · d24b601

The three UI rules in .dependency-cruiser.cjs (ui-no-data-side, data-side-no-ui, design-system-no-sides) move from warn to error; the cruise of the web source reports no violation. The exit gate verify now also checks that no warn level remains and that the accessibility baseline file exists. The item text names what the gate does not check (imports through feature modules, screen hosts). The item stays open until the offline and browser tier runs are recorded. Claude-Session: https://claude.ai/code/session_013BMq…

Check off W26.2, W26.5, W26.5.b, W26.5.c and W26.6.a (WAVE-26); exit gate kept open · 3cea423

The visual baselines (W26.5.c), the readiness audit (W26.6.a) and the parent items are checked by their own verify. W26.6.b stays open: its verify covers the rules gate only (backlog EXIT-GATE-VERIFY-W26.6.b). Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

First visual baselines of the gallery at phone and desktop width (WAVE-26 W26.5.c) · ae46a45

Adds the first pictures of the built gallery: the shell frame, the bottom navigation, the Chats inbox (empty and ready) and the button variants, at 390 and 1440 wide, stored beside the spec. The page setup the two browser specs share moves to galleryPage.ts (no behaviour change; the smoke subset re-run green). Red first: before the pictures existed the ten picture tests failed (no stored picture); the guard test passed. Then the pictures were written once with the update flag and the spec ran green (11 of 11). One…

Ledger tick 15:37, A0 bumps and A1 done, A2 next · 194ace3

Claude-Session: https://claude.ai/code/session_013BMqcrc9bgsdoJ4KzPFSJy

Bring web and api packages to their latest versions (WAVE-26 step A0) · bf6ebab

Web runtime: @hookform/resolvers 6.0.2, axios 1.21.0, framer-motion 14.7.1, lucide-react 1.63.0 (kept as an exact pin, as before), glob 14.0.3 (a major; its only uses are two test files, which call globSync and pass unchanged). Web dev: storybook, @storybook/addon-a11y and @storybook/nextjs-vite 10.6.5 (moved together). Api: @parse/node-apn 8.1.1. Checks: web and api typecheck clean; 387 affected web tests and 23 api push-provider tests green; the gallery build and the full browser smoke over every story at 390 an…

Browser smoke of every gallery story at phone and desktop width (WAVE-26 W26.5.c) · 41f451b

Adds a Playwright run over the built Storybook gallery at 390 and 1440 wide. Each story must draw, with no page or console error, no horizontal scroll, and no new axe violation against the tracked baseline (a11y-baseline.json; the known findings stay listed there until fixed). Defects found by the first full run, each fixed with a test first: the birth-year text input carried range attributes (aria-allowed-attr); the gallery now answers the diagnostics settings and the anonymous session call the way a signed-out v…

Ledger tick 17:25, gallery browser smoke in progress · 6f6eb5d

Ledger tick 17:05, gallery slice 12 (design system) · 73eca99

The first design-system gallery stories: button, glass card and the feedback parts (WAVE-26 W26.5.b, slice 12) · 15a213c

The button in its eight variants, three sizes and the disabled state; the glass card; the alerts, the skeleton and the error recovery card with and without its retry button. The design-system stories take no data. Tests: 378 offline render tests (every story in English and Arabic); the three files were red first (missing); the error card rule (retry labels are required with a retry) showed in the render test and the story passes them; typecheck, eslint and the Storybook build clean; dead-code scan 0 blocks after t…

Ledger tick 16:50, gallery slice 11 · 4754692

Gallery stories for five public sections; the gallery now merges the landing and public overlays the way the app does (WAVE-26 W26.5.b, slice 11) · f8d2bff

The public sections read keys that live in the locale overlays (src/i18n/bundle/overlays), not in messages/<locale>.json, so the gallery drew them with missing-text errors. mergedGalleryMessages in .storybook/galleryConfig.ts now merges the landing and publicPages overlays with the same helpers the app uses (deepMergeLanding and deepMergeMessageNamespace). Five sections get one story each (features, comparison, FAQ, testimonials, trust indicators). Tests: 361 offline render tests (every story in English and Arabic…

Ledger tick 16:20, gallery slice 10 · 0569545

Gallery stories for the onboarding form, the cancel control and the recovery step (WAVE-26 W26.5.b, slice 10) · a26f5ec

20 stories from the onboarding contract fixtures: the form in thirteen states (empty, filled, second contact, no identity, account email, saving, error, photo uploading and ready, location detecting and failed, long name, Arabic), the cancel control in three and the recovery step in four. A story-only helper gives the views that take a translator prop the gallery translator. The offline render test stubs ResizeObserver, as the existing tests do. Tests: 346 offline render tests (every story in English and Arabic); …

Ledger tick 15:50, gallery slice 9 · 9721e5a

Gallery stories for the Discovery chrome: reshuffle, strict scope, scope chip, supermatch and the toolbar row (WAVE-26 W26.5.b, slice 9) · b8fca39

14 stories from the Discovery chrome fixtures (reshuffle 2, strict scope 3, scope chip 3, supermatch 4, toolbar row 2); the host-provided parts of the toolbar are labelled slots. The Universe canvas and its guide are not in the gallery yet. Tests: 303 offline render tests (every story in English and Arabic); the five new files were red first (missing); typecheck, eslint and the Storybook build are clean; the dead-code scan has 0 blocks after the allowlist entries.

Ledger tick 15:25, gallery slice 8 · 49e3814

Gallery stories for the Discovery list: one row, the empty states and the body (WAVE-26 W26.5.b, slice 8) · 99fcf64

23 stories from the discovery list contract: eleven row states and shapes (connect, connecting, chat, request pending, terminal, invalid, no match percentage, unknown name, very long name, Arabic, long bio), eight empty variants with the operator hint, and four body states (rows, skeleton, failure, empty). Picture, fit lines, scores panel, failure card and hint are labelled slots. Tests: 270 offline render tests (every story in English and Arabic); the three new files were red first (missing); typecheck, eslint an…

Ledger tick 14:55, gallery slice 7 · 4b94768

Gallery stories for the shell frame: seven statuses and three layouts (WAVE-26 W26.5.b, slice 7) · bc8d227

Ten stories from the shell frame fixtures: loading, redirecting, invalid session, account removed, profile error, mailbox unresolved and ready, plus the ready frame in the match, chat thread and onboarding layouts. Content, bottom bar, connection indicator and overlays are labelled slots. Tests: 221 offline render tests (every story in English and Arabic); the new file was red first (missing); typecheck, eslint and the Storybook build are clean; the dead-code scan has 0 blocks after the allowlist entry.

Ledger tick 14:35, gallery slice 6 · a022a1f

Gallery stories for the admin frame and the shell bottom bar (WAVE-26 W26.5.b, slice 6) · 4fb0cc4

8 stories from the contract fixtures (admin frame 4 states with the content, status, loading and bar as labelled slots; the bottom bar 4 states, including the landing page) and the story-only link stand-in src/ui/gallery/StoryNavLink.tsx. The offline render test stubs window.matchMedia (jsdom lacks it; the desktop-first admin frame reads it). Tests: 200 offline render tests (every story in English and Arabic); the two new files were red first (missing); typecheck, eslint and the Storybook build are clean; the dead…

Ledger tick 14:05, gallery slice 5, commit blocker (tmp quota) recorded with the judge step queued · 048bd53

Gallery stories for the safety hub, the profile page and the journey route (WAVE-26 W26.5.b, slice 5) · cb93cab

12 stories from the contract fixtures (safety hub 2, profile 4, journey route 6 including the two redirect states); the host-provided parts are labelled slots from the story-only StorySlot helper; the three story files are allowlisted in plan/compliance-state/unused-code-allowlist.txt. Tests: the offline render test (182 tests, every story in English and Arabic) found the three files missing first (red), then green; the Storybook build, typecheck and eslint are clean; the dead-code scan has 0 blocks.

Gallery stories for the Connections list, the connection panel and the chat thread shell (WAVE-26 W26.5.b, slice 4) · 1107eb3

25 stories from the contract fixtures (every phase and state of the three contracts); the parts the host fills (consent screen, starters, the thread, the peer panel) are labelled boxes from the new ui/gallery/StorySlot.tsx, a story-only helper. Tests: the offline render test (155 tests, every story in English and Arabic) found the new files through the required list, red first; the Storybook build passes; the dead-code scan has 0 blocks.

Ledger tick 12:05, gallery slice 3 · 4bc96da

Gallery stories for the analytics dashboard, the subscription menu, the paywall dialog, the footer build strip and the welcome language gate (WAVE-26 W26.5.b, slice 3) · b41ca7f

27 stories from the contract fixtures (every status of each contract), the story files are added to the required list of the render test and to the unused-code allowlist. The render test now finds the story files with a directory scan and imports them at run time: Vitest caches a transformed test file together with its import.meta.glob result, so five story files added later were silently not found until the test file changed. The direction check reads the gallery wrapper (the welcome gate holds language names in …

Ledger tick 11:40, gallery slice 2 · d40aa5f

Gallery stories for the sign-in card, the auth gate screens and the you hub, rendered offline in English and Arabic (WAVE-26 W26.5.b, slice 2) · 55bf120

Six sign-in stories (every step and state, texts from the copy fixtures in the toolbar language), the auth error page (English and Arabic with a long message) and the redirect stub, three you hub states; the two data-fetching components the you hub imports are replaced by labelled stand-ins through exact vite aliases in main.ts; preview.tsx gives an anonymous session. main.ts no longer uses __dirname (the build failed on it as an ES module). Tests: storiesRender renders every story through the portable stories wit…

Ledger tick 11:05, you hub reviews accepted and fixed, W26.4 accepted, gallery slice 1 · 6cebfc4

Story W26.4 accepted and checked off: every screen is behind the UI contract; R-BUILD 7.5 of 10 (WAVE-26) · ffd2161

The parent verify (UI contract rules over all screens: 98 view files, 0 violations) passes; the score with its evidence, the sum last and the red rows with their next change is docs/notes/wave26-r-build-scores.md.

W26.4.c checked off: the last screen group is behind the UI contract (WAVE-26) · 5cf88cd

auth (S1 to S5 and the review fixes), you (Y1 to Y4) and the earlier groups: the verify (UI contract rules for paywall, auth, public, safety, analytics, admin and you) passes with 0 violations on 55 files; browser specs green on the rebuilt stack for auth (8 tests) and you (7 tests); two reviews per group accepted (rounds.tsv).

The two you hub reviews accept the model hook and the view; their low findings are fixed (WAVE-26 W26.4.c, group you) · 66f5d0b

rv-you-a (opus) ran the old host, controller and body against the new code in 6000 random steps and found them identical. rv-you-b (sonnet) found 12 low items. Fixed here: a test name that said the opposite of its assertion, a negative line that could not fail (the error page wins when Settings are requested while the profile failed), the message keys derived from the source of the view and the host (all five languages), a fixture for the blocked users section, the builder table widened to 512 inputs (status 500 a…

The gallery gets the one viewport list, a language toolbar with Arabic right to left and the viewport presets (WAVE-26 W26.5.b, slice 1) · 7c7824f

design-system/theme/viewports.ts holds the viewport list (320, 375, 390, 768, 1280, 1440) the gallery, the baseline screenshots and the responsive specs share; .storybook/galleryConfig.ts derives the Storybook viewport options and the English and Arabic locales (with their message bundles and direction) from it; preview.tsx uses both. Tests: the list is ascending, unique, with positive heights and kebab ids and holds the baseline widths and the responsive spec widths (the validity check is also run on bad lists an…

Ledger tick 10:30, you hub browser specs green, you hub review running · b53f3e6

Ledger tick 10:15, you hub browser specs running · c5b0ec2

The second auth review accepts the fixes; its test gap is adopted; ledger, review rows and backlog (WAVE-26 W26.4.c, group auth closed, group you built) · bfe2f97

rv-auth-fix (sonnet, fix diff only): ACCEPT, no MEDIUM. SignInPasskeyIdentifierToggle pins the step and offered terms of the passkey option active flag (fresh option after the Email/Phone toggle round trip; the old code input is gone). Backlog AUTH-REVIEW-LOWS-2 holds the three LOW items.

The you hub is a model hook and a props-only view behind the host YouScreen (WAVE-26 W26.4.c, group you, slices Y3 and Y4) · e4540e0

useYouScreenController moved with git mv to screen-models/you/useYouHubModel (modal state, the four one-shot effects, prefetches and data hooks unchanged; it builds the YouHubModel with buildYouHubModel and returns it with the slot data for the host's menus). YouScreenHubBody moved to ui/screens/you/YouHubView and is props-only (the model, its own texts through useTranslations, actions called without the click event). YouScreen stays the host and now owns the error page texts and the loading message (the model car…

Behaviour tests of the you hub, green on the old screen before it moves (WAVE-26 W26.4.c, group you, slice Y3) · b85e994

youHubEffects (15 tests) pins the one-shot effects of the old controller: ?subscription=1 opens once and the close is not undone; the ?settings= deep link opens Settings on the section, strips the parameter and keeps the other parameters; ?setupPasskey=1 and the stored flag open the passkeys section; the profile refetch; the account-swap close; negatives: no profile, unknown section, other address flag, a consumed link is not consumed twice. youScreenHost (13 tests) pins the host: error page status and texts (500,…

Ledger tick 10:10, auth review round 1 done and fixed, round 2 running; backlog AUTH-REVIEW-LOWS · 2f74fb5

The Email/Phone toggle of the sign-in card reads its texts from the translated copy, and the phone step titles use their sibling wording (review findings rv-auth-b F2 and F3, WAVE… · 097fe90

The toggle showed three English literals (group label, Email, Phone) in every language; they are LoginFormUiCopy.identifierToggle, loaded from auth.login.identifierToggle.* in the five shards (bundles, CSV, the copy fixtures and the text-scan baseline follow; the baseline loses the entry). The phone step titles now equal title.getStarted and title.enterOtp in every locale (de, fr, es, ar differed inside one card). Tests: shard test per locale (three keys present, none repeats the English text), the loader maps eac…

Review round 1 of the auth group, part 2: the phone number is a left-to-right run in Arabic, the contract loses an unused field, five tests and the stale docs (WAVE-26 W26.4.c, gr… · 9c6da1e

F1 (rv-auth-b, reproduced in Chromium): in an Arabic sentence the plus of +12025550123 drew on the wrong side; the number span is dir=ltr now (adopted probe: positive for the not-delivered and the code-sent line, negative: the text around it is the template). F5: SignInModel.setGlobalError was read by no view, so it left the contract (shape pins, fixtures, composer; the flow controller keeps it for the composer). F6: the composer test now pins the exact contract keys (no challenge ids leak) and a showCardContent t…

The old form mounted the passkey option only while the passkey method was chosen, so switching to "Use email instead" threw away its busy flag, email-code fallback, code challenge… · f1e4b7e

and typed code. Since the composer model never unmounts, the state survived the switch: a code challenge minted before the switch showed again and a newer code was checked against the old challenge. usePasskeyLoginModel now takes active (email step, passkey method, offered): it resets when the option leaves and a result started before the reset is dropped (a run counter, which also covers leaving and coming back with the same address). Tests: the reviewer probe adopted as SignInPasskeyMethodSwitch (positive: fresh…

BuildYouHubModel, the pure model step of the you hub, with the old controller formulas as the test oracle (WAVE-26 W26.4.c, group you, slice Y2) · bbb3acf

Phase (error page first and only once the profile is no longer loading, then loading, else the hub), the error kind and status, the settings section precedence and the retry routing are the old controller formulas unchanged; the settings menu is open only with a profile. Tests: the oracle written out from the old controller over all 256 combinations of seven flags and two error shapes; negatives: settings closed without a profile, no error page while loading, no loading screen over an open modal, retry reloads the…

Ledger tick 09:35, you hub design and slice Y1 done, auth reviews running · 3a82fa4

The you hub has its UI contract: YouHubModel, eight fixtures and the shape pins (WAVE-26 W26.4.c, group you, slice Y1) · bd3555d

ui-contract/youHub.ts lists the phase, the error (kind, status, retry), the journey button state, the orb size and reduced motion, the three modals and the seven actions; the menus, the boost button, the subscription card and the error page stay host slots (design note ui-contract-you.md). Fixtures: ready, journey complete, loading, gateway, profile and bank meta errors, passkey setup pending, subscription menu open. Tests: contractShape pins the field lists of the model and its nested groups against all eight fix…

Design note of the you hub on the UI contract (WAVE-26 W26.4.c, group you): model, host slots, layers, five slices with tests first · 4257a32

Ledger tick 09:15, auth browser specs green, auth review round 1 running · b9a3ab3

Ledger tick 09:05, auth browser specs running · b068cf9

Ledger tick 09:30, auth group slice S5 done · a66e0fd

The sign-in page redirect is useSignInRedirect in screen-models/auth, with the first behaviour test it ever had (WAVE-26 W26.4.c, group auth, slice S5) · b650d0d

The effect that sends a signed-in visitor away from the sign-in page moved unchanged out of SignInPageClient into a hook; the 100 ms full navigation goes through lib/navigation/hardNavigate so a test can replace it. The page host now only composes the hook and the form. Tests: positive (journey hub, internal redirect target with the locale prefix removed, hard navigation after 100 ms) and negative (loading, anonymous, other page, router already left, foreign and protocol-relative addresses stay a same-origin path).

Ledger tick 09:10, auth group slice S4c done, two import cycles fixed at the root · 8031399

The sign-in card is a props-only view of the UI contract: SignInView, with the field components moved to ui/screens/auth/sign-in (WAVE-26 W26.4.c, group auth, slice S4c) · 9da00da

SignInView draws a SignInModel with the server-loaded copy and calls the model's actions. LoginForm stays as the host (useSignInModel + SignInView) with its path and props. The identifier toggle, method selector, code and phone fields, provider block and passkey option moved with git mv (move-modules rewrote the imports); the passkey option takes the passkey group of the model. Two import cycles found by the layer gate are fixed at the root: the shared error alert has its own file, and the auth barrel no longer re…

Ledger tick 08:50, auth group slice S4b done · fa94f53

The sign-in card has a UI contract: SignInModel, its fixtures and one composer model (WAVE-26 W26.4.c, group auth, slice S4b) · b347f80

ui-contract/signIn.ts lists what the card shows and does (steps, drafts, flags, busy flags, the passkey group and the five actions) with the plain login value types. The copy type moves with git mv to ui-contract/signInCopy.ts. useSignInModel composes the flow model and the passkey model, so the passkey option works on the typed address and reports into the form's global error in one place. Six fixtures cover all four steps plus the fallback and an error with a provider running. Tests: the contract shape pins and …

Ledger tick 08:30, auth group slice S4a done, architecture report written · 5b47a0c

The phone step of the sign-in card reads its texts from the translated copy, not English literals (WAVE-26 W26.4.c, group auth, slice S4a, finding AUTH-FORM-FINDINGS) · 5101c0e

Nine texts (step titles and descriptions, the number placeholder, the two code lines, the two validation messages) are LoginFormUiCopy.phone, loaded from auth.login.phone.* in the five shards (en, de, fr, es, ar). The two lines that name the number keep the {phone} token and the view puts the number in its own element. The hardcoded-text baseline drops the four moved literals. Tests: positive and negative pair per locale (nine keys present, none repeats the English wording, token kept), the loader maps each field …

The UI interface architecture as an HTML report with four mermaid diagrams (data side, UI contract, UI side, run time, import rules, UI swap, status), checked with a headless rend… · 89beac2

Ledger tick 08:15, auth group slice S3d done · 4c1e39c

The Google and Zitadel sign-in and the passkey option are actions of the sign-in models (WAVE-26 W26.4.c, group auth, slice S3d) · e96cbe4

signInWithProvider and pendingProvider join useLoginFormModel (LoginSocialProvidersBlock is props-only). The passkey option's state and three button branches move to usePasskeyLoginModel with the logic unchanged. Two source-text tests follow the moved code. Tests: positive and negative pairs for the provider sign-in (pending, error text, default text) and for the passkey model (passkey, fallback, code sign-in, invalid address and code, stale address).

Ledger tick 19:00, auth group slices S3b and S3c done, scan slip recorded · 7022691

The hardcoded-text scan baseline follows the moved lines of LoginPhoneOtpFields (four entries, line numbers only) · 74a0b79

The slices S3b and S3c shortened LoginPhoneOtpFields.tsx, so the four existing English literals of the phone steps (still tracked as AUTH-FORM-FINDINGS) sit on new lines. No new string.

The email code verification and the phone code request and verification are actions of the login form model (WAVE-26 W26.4.c, group auth, slices S3b and S3c) · a94303b

LoginOtpCodeFields, LoginPhoneOtpNumberFields and LoginPhoneOtpCodeFields kept the guarded sign-in and request calls, the country and E.164 checks, the busy flag and the error handling next to their forms. They move unchanged into useLoginFormModel as verifyEmailCode, requestPhoneCode (with phoneSubmitting) and verifyPhoneCode; the three components are props-only (onVerify, onRequestCode, isSubmitting) and keep only react-hook-form UI state. The controller no longer hands the raw email and phone auth functions to …

Ledger tick 18:30, auth group slice S3a done, auth design written · 0db62cb

The email sign-in code request is an action of the login form model (WAVE-26 W26.4.c, group auth, slice S3a) · 2232f3f

LoginOtpEmailFields kept the address validation, the request, the busy flag, the stale-session guards and the error handling. They move unchanged into useLoginFormModel as requestEmailCode and emailSubmitting (the server-loaded copy supplies the validation messages and the default failure text); LoginOtpEmailFields is a props-only form (onRequestCode, isSubmitting) and LoginForm wires them. Same behaviour: an invalid address sets the validation message and requests nothing; a success after an account swap is dropp…

Ledger tick 18:00, analytics and paywall groups reviewed and closed · c4c3192

Review rv-ap-b of analytics and paywall: one wording per event, exporter-ordered CSV, unconfirmed return logged, contract pins and tests made real (WAVE-26 W26.4.c) · 6751282

rv-ap-b (sonnet) ACCEPT-AFTER-FIXES; its F1 (the dialog toast promising a verify step) was already fixed in ccca3b8e0. This commit takes the rest: - F3: subscription.toast.superLikeSent had a different wording than discovery.paywall.superLikeSent for the same event in ar and es; it now equals the discovery wording (shards, bundles and CSV rebuilt with the project's build and export tools). F5: the CSV rows of the new group were hand-inserted out of exporter order; regenerated. F4/F5 guard and F3 guard: adopted pro…

Ledger tick 17:40, auth group slice S2 done · 2df7903

The sign-in form's flow state moves to useLoginFormModel (WAVE-26 W26.4.c, group auth, slice S2) · 5a0501e

LoginForm.tsx kept the step machine, the method and identifier type, the email and phone drafts and challenges, the feature-flag gates, the "what is offered" rules and the account-swap reset next to its markup. They move unchanged into screen-models/auth/useLoginFormModel.ts (a LoginFormController, including the six sign-in functions of the auth hook for the field components); LoginForm.tsx renders what the hook returns and its markup is untouched. The existing four LoginForm suites and the field-component tests p…

Ledger tick 17:15, review rv-ap-a taken, one medium fixed · ea61b6a

The paywall dialog's second-contact toast no longer promises a verify step the dialog does not have (review rv-ap-a F1, MEDIUM; WAVE-26 W26.4.c, paywall) · ccca3b8

When checkout was blocked because the second contact was not verified, usePaywallToasts showed subscription.menu.secondContactGate.body: "...Finish verifying below and we'll continue your checkout automatically." That sentence belongs to the subscription menu, which has the inline verify step; the paywall dialog has none and never resumes, so the viewer was told to look below at nothing. The old code showed the API's own English message (correct for the screen, English only). A new message subscription.toast.secon…

Ledger tick 16:50, auth group slice S1 done · 77004e1

The auth error page and the auth redirect stub are props-only views behind thin hosts (WAVE-26 W26.4.c, group auth, slice S1) · 2ff300f

AuthErrorView (the shared error page inside the auth gate shell: warning severity, retry back to sign-in, home button) and AuthRedirectingView (the public redirect screen with its label) move into ui/screens/auth; AuthErrorPageClient and AuthIndexRedirectClient keep their paths and props and build the models (retry stays a hard navigation to the localized sign-in page; the redirect stays in the index client). The contract ui-contract/authGate.ts (AuthErrorModel, AuthRedirectingModel) documents the one exception to…

Ledger tick 16:20, checkout e2e green, analytics and paywall reviews dispatched · 0487ded

Ledger tick 15:50, reconcile lint fixed, money-path e2e run started · 70233c6

The lint ratchet baseline keeps the gain of the reconcile hook (21 to 19 errors, 15 to 14 files) · c9d3b91

The checkout-return reconcile hook lints clean; its window lifecycle gets two regression tests (WAVE-26 W26.4.c, group paywall, slice S5d, part 1) · 84d90c6

useCheckoutReturnReconcile had two react-hooks/set-state-in-effect errors that predate this work. Both effects start or stop an external system (the polling interval of one checkout return), which is the legitimate use of setState in an effect: the window begins on a transition, not on a value, so it cannot be derived during render. The two calls now carry scoped disables with the reason, as the design-system precedent does; no behaviour change. Tests first (green on the unchanged code, they pin the lifecycle befo…

Ledger tick 15:20, paywall slice S5c done, menu split complete in code · c567e5f

The subscription menu is a contract model, a pure builder and a props-only view behind a thin host (WAVE-26 W26.4.c, group paywall, slice S5c; a money path) · f79ba1a

ui-contract/paywall.ts gains SubscriptionMenuModel (processing note, loading, load error with retry, busy, the second-contact gate, and the plan: current plan, renew, change-plan table with selection and benefit reminder key and numbers, add-ons, billing portal) with nine fixtures and shape pins. buildSubscriptionMenuModel (screen-models/paywall) turns the S5b controller into it with the old JSX conditions; SubscriptionMenuView (ui/screens/paywall) is the markup of SubscriptionMenu.tsx, unchanged; SubscriptionMenu…

Ledger tick 14:50, paywall slice S5b done · 127f843

The subscription menu's state and actions move to useSubscriptionMenuModel (WAVE-26 W26.4.c, group paywall, slice S5b; a money path) · d3f6015

SubscriptionMenu.tsx kept the entitlement query, the selected SKU, the Stripe return URLs and the return-reconcile window, attemptCheckout with the second-contact gate and its resume, and the billing portal call next to its markup. They move unchanged into screen-models/paywall/useSubscriptionMenuModel.ts (a SubscriptionMenuController); the component renders what the hook returns and its markup is untouched. The error-toast source-text invariant now reads the model plus the component. Tests (red first, the module …

Ledger tick 14:10, paywall slice S5a done, menu split plan written · 9308900

The subscription menu's plan table and renew-SKU decision are pure functions in screen-models/paywall (WAVE-26 W26.4.c, group paywall, slice S5a) · 3ab7bdb

SUBSCRIPTION_TIER_GROUPS, UPGRADE_SKUS and resolveSubscriptionMenuSelectedOption move out of SubscriptionMenu.tsx into screen-models/paywall/subscriptionPlanCatalog.ts, and the inline renew handler becomes resolveSubscriptionRenewSku (previous Visionary or Seeker on the previous term, 12 months when unknown, an unpaid previous tier renews as Seeker, a term outside the catalog falls back to seeker.12m). Behaviour is unchanged; the old inline code was the oracle. The first step of the menu split (money path); the mo…

Ledger tick 13:40, paywall slice S4 and bug B1 done, gate item queued · d6e513c

The paywall provider's toasts are translated message keys and never show a raw error message (WAVE-26 W26.4.c, group paywall, slice S4, map bug B1) · 473a149

PaywallProvider toasted seven hard-coded English sentences, and three of them (the retry after a blocked chat start, the pending super like, the checkout start) showed the raw message of the failure (`toError(error).message || "..."`, for example an HTTP status line). They are now callbacks of usePaywallToasts (screen-models/paywall) with the message group subscription.toast.* in the five locales (shards, messages/*.json bundles, translations CSV). A failed follow-up toasts the localized text only and logs the cau…

Ledger tick 13:00, paywall slice S3 done · 40ba7fc

The paywall dialog takes a PaywallDialogModel; the provider builds it (WAVE-26 W26.4.c, group paywall, slice S3) · 9c5cd77

PaywallDialog({ model }) replaces the six props (presentation, isOpen, pending, processing, onDismiss, onSelectOffer); PaywallProvider mounts it with the model as an object literal built from the same values as before (the isOpen rule, the purchase-pending flag, the checkout-return processing flag, dismiss and the offer handler). Behaviour is unchanged. The long notes on pending and processing are kept as a comment beside the props type. The two old dialog test files keep their prop style through a small local ada…

Ledger tick 12:30, paywall slice S2 done, copy finding queued · 72addec

The paywall contract: offer and presentation types move to ui-contract/paywall.ts, plus the dialog model and fixtures (WAVE-26 W26.4.c, group paywall, slice S2) · 322337e

PaywallOffer, PaywallPresentation, PaywallOfferKind, PaywallPresentationEntryPoint and PaywallTriggerId move from features/paywall (buildPaywallPresentation.ts, paywallLimitErrorCodes.ts) into ui-contract/paywall.ts (already plain data); the builder, the provider, index.ts and the three paywall views import them from the contract. PaywallDialogModel is new (presentation, isOpen, pending, processing, onDismiss, onSelectOffer); the next slice makes the dialog take it. Catalog id types come from @ifeoma-tc/paywall-ty…

Ledger tick 12:00, public group closed, paywall slice S1 done · d1eb8a8

The proxy cookie redirect: file-shaped paths, no Set-Cookie and API paths are pinned (review rv-public-d, ACCEPT with three LOW test gaps) · 018c9c6

rv-public-d (sonnet, 9a259ebbe only) swept 41 paths x 7 cookie states x navigation and prefetch (560 rows) against the commit and its parent: the only rows that differ are the 95 prefetch rows of cookie holders (200 to 307), no loop, no 5xx. Its test gaps are adopted in landingRouteLocaleCookieThroughProxy.test.ts: a cookie holder's /.well-known/api-catalog and /favicon.ico are not redirected (navigation and prefetch), the redirect sets no cookie, an /api path is not redirected to a locale prefix. Two README sente…

The paywall dialogs, offer card and checkout second-contact gate move to ui/screens/paywall (WAVE-26 W26.4.c, group paywall, slice S1) · ada347d

PaywallDialog, PaywallOfferCard, PaywallSubscriptionTermDialog and CheckoutSecondContactGate move from features/paywall (git mv, importers rewritten by move-modules; code unchanged). The rule pass for --screens paywall reports 0 violations over the 10 files. Source-text paths, READMEs, the second-factor README and the atlas point at the new paths; the provider, the subscription menu and the checkout logic stay in features/paywall until their slices (money path: the provider split and the menu split get their own r…

Ledger tick 11:20, prefetch fix, analytics S5 done, bug B8 not a bug · 575926b

The analytics data side moves to screen-models/analytics: aggregation hook, metrics, gate, connections scope, account-swap reset, typed errors (WAVE-26 W26.4.c, group analytics, s… · cbc5efd

git mv (importers rewritten by move-modules): features/analytics/hooks.ts -> screen-models/analytics/useUserAnalytics.ts, utils/metrics.ts, utils/analyticsAggregationGate.ts, utils/resolveAnalyticsConnectionsListScope.ts, clearedUserAnalyticsAfterAccountSwap.ts and errors/analyticsAggregationErrors.ts -> screen-models/analytics/. features/analytics/index.ts keeps re-exporting the public names; the leftover utils/ and errors/ folders are gone (their README content is in the new folder README). Code unchanged. Sourc…

Router prefetches of an unprefixed page honour the locale cookie too; dead proxy branch removed (WAVE-26 W26.4.c, review rv-public-c finding 1 to 3) · 9a259eb

rv-public-c reproduced that B7 was still reachable through Next.js router prefetches: the proxy let a prefetch through before the cookie step and the static /landing page (revert of the first fix) answers with the default locale; a German visitor following a prefetched <a href="/landing"> could end on /en/landing and next-intl would then overwrite the cookie. The cookie step now runs before the prefetch stage (a 307 does not touch the cookie), skipping paths the proxy passes through anyway (locale-prefixed, allow-…

Ledger tick 10:50, analytics slices S3 and S4 done, time correction · 9d26b01

The analytics dashboard is a props-only view over a pure model builder behind a thin host (WAVE-26 W26.4.c, group analytics, slices S3 and S4) · 81e8d1b

UserAnalyticsDashboard kept the branching, the error-to-copy mapping and the markup in one component. buildAnalyticsDashboardModel (screen-models/analytics) turns the aggregation hook's output into AnalyticsDashboardModel in the old order (loading, error, empty, ready) with the error kind (ratings and journey banks have their own copy, everything else is generic); AnalyticsDashboardView (ui/screens/analytics) draws it; the host composes the hook, the builder and the view and keeps its path. Behaviour is unchanged;…

Ledger tick 10:20, public group reviews taken and fixed, fix-diff review dispatched, review lows queued · 181e48c

Public group review fixes: the locale cookie is honoured by the proxy (B7 root fix), the welcome failure toast is fully localized and logged (B4), weak tests made real (WAVE-26 W2… · 42d8ab9

rv-public-a REJECTED the first B7 and B4 fixes (both tests mocked the layer where the failure happens): - B7: src/proxy.ts answers an unprefixed path before the page and next-intl runs with localeDetection false, so it ignored the cookie: /landing, / and /about went to the default locale for a German visitor. The proxy now sends a visitor with a valid NEXT_LOCALE cookie to /{cookieLocale}{path} (307, query kept). The page change of the first fix is reverted (the page never ran for this case) and its mocked test re…

Ledger tick 09:50, analytics group slice S2 done · 29f98c5

The analytics contract: metric types move to ui-contract/analytics.ts, plus the dashboard model and fixtures (WAVE-26 W26.4.c, group analytics, slice S2) · 485bc8b

features/analytics/types.ts moves to ui-contract/analytics.ts (git mv; the types were already plain numbers, booleans and strings). AnalyticsDashboardModel is new: loading, empty, error (errorKind ratingsUnavailable, journeyBanksUnavailable or generic, the error for the recovery component, retry) and ready (UserAnalytics). Fixtures: ready (full, new viewer, Arabic insights), loading, empty and the three error kinds. The shape test pins every field and checks that the fixtures cover every status and every error kin…

Ledger tick 09:20, analytics group slice S1 done · a427561

The four analytics metric sections move to ui/screens/analytics (WAVE-26 W26.4.c, group analytics, slice S1) · e6d3f3d

EngagementSection, JourneySection, ConnectionsSection and InsightsSection move from features/analytics/components/sections to ui/screens/analytics (git mv, paths and imports only; the code is unchanged). UserAnalyticsDashboard and the section tests import the new paths, the percent-display source-text invariant and four SRC tags point at the new files, the old folder README is replaced by the new folder's README, READMEs and the atlas are updated.

Ledger tick 09:00, public group bug B7 fixed, marketing decision, reviews dispatched · 85c7e96

Unprefixed /landing honours the NEXT_LOCALE cookie like / and /admin (WAVE-26 W26.4.c, group public, map bug B7) · b1f4c1b

/landing always redirected to the default locale, so a German visitor opening an old bookmark landed on English. The route read no cookie because force-static made that impossible. It is now force-dynamic and redirects to /{locale}/landing for a valid cookie; a missing or corrupt cookie falls back to the default locale (a recoverable user-state problem, as at /). The cost is that the redirect is no longer cached for an hour; the localized landing page itself is unchanged. Tests (red first, 5 of 8 failed): tests/at…

Ledger tick 08:30, public group welcome gate and bug B4 done · a1c4dc8

The welcome language gate is a contract model and a props-only view behind a thin host; a failed language switch shows a localized message (WAVE-26 W26.4.c, group public, slice S6… · 99f4740

WelcomeLanguageGate kept the host suggestion, the pending choice, the cookie write and the markup in one component. The data side is useWelcomeLanguageModel (screen-models/public), the contract is WelcomeLanguageModel (ui-contract/welcomeLanguage.ts, fixtures, shape pin) and the markup is WelcomeLanguageGateView (ui/screens/public/welcome). The host keeps its path. B4: a failed write toasted the raw error text (an English technical string, a status line for LocaleCookieWriteError) or the page heading for a non-Err…

Ledger tick 08:00, public group bugs B5 and B6 fixed · 29a9ba6

The coming-soon dialog keeps a guest's return path, and the waitlist thanks timer is cancelled on unmount and account swap (WAVE-26 W26.4.c, group public, map bugs B6 and B5) · 3e5a15d

B6: "use the web version" always pushed the journey hub, so a guest went through the auth guard and lost the intent. The dialog now uses useLandingCtaModel, the same rule as the page's conversion buttons (sign-in with the hub as the redirect when signed out). Test (red first, 2 of 3 failed): comingSoonUseWebVersionKeepsReturnPath.test.tsx, positive for guest and signed-in, negative: a guest never gets the bare hub route. B5: the 3 s thanks reset timer of useLandingWaitlistModel kept running after unmount or an acc…

Ledger tick 07:30, public group slice S7 done · 60f45ec

The footer build strip is a contract model, a parser and a props-only view behind a thin host (WAVE-26 W26.4.c, group public, slice S7) · 8366259

BuildVersionsStrip kept the fetch of /api/build-info, the trimming and the markup in one component. The data side is now parseBuildInfo and useBuildVersionsModel (screen-models/public), the contract is BuildVersionsModel (ui-contract/buildVersions.ts, fixtures, shape pin) and the markup is BuildVersionsStripView (ui/screens/public/landing). The host keeps its path, so Footer and the feature index are unchanged. Behaviour is unchanged; the old inline parsing was the oracle. Tests (positive and negative): useBuildVe…

Ledger tick 07:00, public group slice S5 done, origin merge decision recorded · 0f0df17

The paint-deferral hook moves to ui/hooks so the public home page view and the journey bank share one copy (WAVE-26 W26.4.c, group public, slice S5) · 46458a1

useDeferUntilAfterPaint moves from features/journey/hooks to ui/hooks (git mv; its test to tests/atomic/hooks). LandingPage and journey/hooks.ts import it from there; the code is unchanged. Gates, type check and the folder-wide scan dirs (i18n, nav, security, ui, design-system, seo, crawl, landing, journey, hooks) are green.

Ledger tick 06:50, public group slice S4 done · 8d4b25f

The mobile-app waitlist form of the public home page is one contract model shared by the closing section and the coming-soon dialog (WAVE-26 W26.4.c, group public, slice S4) · 358d8ea

useLandingWaitlistModel (screen-models/public) owns the email draft, the busy flag, the stale-session guards and the account-swap reset that CTASection and ComingSoonModal each kept inline; inline mode shows the thanks state for 3 s, callback mode clears the email and calls onSubmitted (the dialog's toast). LandingWaitlistModel is the contract type, with fixtures and a shape pin. Behaviour is unchanged; the old inline logic was the oracle. Tests (positive and negative): tests/atomic/ui/landing/useLandingWaitlistMo…

Ledger tick 06:15, UI batch 2 published, public group slice S3 noted, publish-check lows queued · 208dd17

The public home page conversion handler is a contract model: one target decision, one hook (WAVE-26 W26.4.c, group public, slice S3) · 6282edf

useLandingBeginJourneyCta moves to screen-models/public/useLandingCtaModel.ts and returns a LandingCtaModel (ui-contract/landingCta.ts, fixture, shape pin). The signed-in or anonymous decision is the pure resolveLandingCtaTarget. Hero, StickyNav, Pricing and CTASection use the model; behaviour is unchanged. Tests (positive and negative): tests/atomic/ui/landing/useLandingCtaModel.test.tsx (hub for a signed-in visitor, sign-in with redirect for an anonymous one, nothing pushed before the click, never the bare hub f…

The presentational landing sections move to ui/screens/public/landing (WAVE-26 W26.4.c, group public, slice S1) · e95916a

Twelve section files, the how-it-works sub-folder with its docs and swipe test, moved with git mv and move-modules (42 import specifiers rewritten). Hero, Pricing, StickyNav, CTASection, ComingSoonModal, LandingPage and BuildVersionsStrip stay in features/landing until their models (hook, form, toast, fetch) exist. Eight source-text tests and two docs name the new paths; Footer imports BuildVersionsStrip through the alias until then. The rule script passes for the public screen with 26 files examined.

W26.4.d checked off, ledger tick 05:10, chat reviews taken, safety and admin frame groups done · 55dd9dd

The chat review findings of W26.4.d: a draft of exactly 100 characters can be sent, the busy gone-peer action keeps keyboard focus, the direct end-and-report run is separate from… · b43fe77

Reviews rv-chat-a (opus) and rv-chat-b (sonnet), both ACCEPT-AFTER-FIXES. Red first: the 100-character tests (the product copy promises up to 100), aria-disabled instead of disabled on the busy action (a disabled button loses focus in a real browser), the direct run taking over another dialog, the topic sequence after a swap, the bubble sender label. Also stable action ids as keys, Boolean(currentQuestion), stale docs and props, the cluster boundary test, and the admin view and model added to the operator trees of…

The admin panel frame is a props-only view with a contract model and a thin host; admin stays a documented desktop-first exception (WAVE-26 W26.4.c, group admin) · d0acc35

AdminPanel's role filter, ?section= handling and select move to useAdminFrameModel, its layout to AdminFrameView, and the section sidebar moves with git mv to ui/screens/admin (opaque string ids). The 14 tabs keep their data hooks; docs/notes/ui-contract-admin.md writes the exception per rule 7. The AdminPanel behaviour test passes unchanged; four source-text tests now read the view and the model. The rule script passes for the admin screen with 8 files examined. Positive and negative tests: AdminFrameView.test.ts…

The safety center is a props-only view with a contract model, fixtures and a thin host (WAVE-26 W26.4.c, group safety) · 8102a05

SafetyHubPage moves with git mv to ui/screens/safety/SafetyHubView and takes a SafetyHubModel; features/safety/SafetyHubPage is the host (same path, export and namespace), useSafetyHubModel is the constant action table. The 20 old safety tests pass unchanged. The rule script passes for the safety screen with 6 files examined. Positive and negative tests: SafetyHubView.test.tsx (five locales, one-action model, model equals the live table) and the contract shape pins.

Design note of the chat thread inside on the UI contract; the composer view test carries the name the plan item names (WAVE-26 W26.4.d, chat slice C6) · d3005e3

The Q&A input area is a resolver, a props-only view and a thin host without its dead private branch; the gone-peer action stays disabled while it runs; an empty peer name falls ba… · 2e62e54

Map 1.7-2: the gone-peer action only changed its label, stayed clickable and remounted (the label was in its key). Map 1.7-6: an empty peer name was used raw in the waiting text, the header title and the typing label. Map 1.7-11: ChatInputArea's private branch was dead (its only caller passed isPrivate=false) and is removed with its three tests. Red first: chatSystemThreadPhaseBody.test.tsx (the first component test of the ten thread phases) and chatEmptyPeerNameFallback.test.tsx. Positive and negative tests: reso…

The chat transcript is a row builder, a props-only view with a sticky scroll hook and a thin host; the load-earlier button stays reachable and the typing row scrolls into view (WA… · 3930d70

Map 1.7-7: when every loaded older row was an empty private text the empty state hid the load-earlier button although more history existed. Map 1.7-8: the typing row grew the list by 48 px with no scroll, so it could sit below the fold. Both red first in chatMessagesAreaHistoryAndTyping.test.tsx. buildTranscriptRows (old logic as oracle over 110,592 sequences), ChatTranscriptView and useStickyBottomScroll replace the inline code; ChatMessagesArea keeps its path and props and builds each bubble in its error boundar…

Map 1.7-1: a rejected mute or report handler was an unhandled rejection. · c916d17

Map 1.7-9: with end-and-report unavailable a double selection called the handler twice. Both red first in messagingHeaderSafetyErrors.test.tsx. useChatSafetyModel holds the rows and the dialog state machine, ChatHeaderView draws, MessagingHeader keeps its path and props. The 18 header tests pass unchanged; three source-text tests now read the view and the model. Positive and negative tests: ChatHeaderView.test.tsx, useChatSafetyModel.test.tsx and the contract shape pins.

W26.4.e checked off, ledger tick 04:10, connection detail reviews taken · 7eb4f03

A peer resolved by id below the discovery window stays on screen when a later discovery refetch fails; the review findings of W26.4.e part 2 are taken · f00fd16

Reviews rv-conndetail-a (opus) and rv-conndetail-b (sonnet) both reproduced it: the by-id lookup was gated on isSuccess, which is false after a failed refetch although the rows are kept. Now gated on the kept rows (the probe is ConnectionDetailBelowWindowRefetchFail.test.tsx, red then green). Also: ErrorPage props, own-page precedence, lookup ids, reduced-motion argument and grid fall-through are pinned by tests, the dead fallback is removed, stale comments and READMEs are corrected, open LOWs are in docs/notes/ba…

The private chat composer is a model hook, a props-only view and a thin host (WAVE-26 W26.4.d, chat slice C2) · 96b1482

useChatComposerModel holds the draft, the account-swap reset, the topic merge, the cooldown lock, the typing routing and the send; ChatComposerView draws; PrivateMessageInput keeps its path and props. The 14 composer tests and the Enter and limit tests from slice C1 pass unchanged; two source-text tests (directional icon policy, layout polish) now read the view. Positive and negative tests: ChatComposerView.test.tsx and useChatComposerModel.test.tsx, plus the contract shape pins.

The chat composer's Enter key follows the send button's rule and ignores an input-method confirmation; the composer rules are a pure function (WAVE-26 W26.4.d, chat slice C1) · 3b4ec5c

Map 1.7-3: Enter sent any text, so a paste of 150 characters bypassed the 100-character limit that the button enforces. Map 1.7-5: an Enter that confirmed an input-method composition sent the half-typed text. Positive and negative tests (red first): privateMessageInputLimitAndIme.test.tsx; resolveComposerState.test.ts holds the old inline logic as an oracle for lengths 0 to 150.

The connection detail starts a chat through its model hook; design note and the decision on map item 2.7-4 (WAVE-26 W26.4.e part 2, slice D4) · 3b66f11

Positive and negative tests: startChat override, chat route, own page and a row without an auth uid in useConnectionDetailModel.test.tsx; the component ladder test passes unchanged.

W26.4.f checked off, ledger tick 03:10, discovery list reviews taken · 1633335

The discovery list fires its load-more once per change, keeps the focused show-more button while its page loads, and the review findings of W26.4.f are taken · e24c0c4

Reviews rv-disclist-a (opus, ACCEPT) and rv-disclist-b (sonnet, ACCEPT-AFTER-FIXES): the position the rows view reports now carries its row count and a stale report counts as no position (the opus probe becomes DiscoveryListViewLoadMoreStalePosition.test.tsx, three cases red then green); the offer stays on screen, disabled and busy, while the asked page loads (focus is no longer lost); the callback ref is written in an effect (lint error gone); the body copy names the button in five languages; the e2e empty-headin…

The connection detail page is a props-only view with a contract model, fixtures and a thin host (WAVE-26 W26.4.e part 2, slice D3) · 17a75ab

ConnectionDetailView draws the not-found and chat-unavailable panels and the ready page; the error page, loading screen, orbs, radar, profile card and own block are host slots. The component ladder test from slice D1 passes unchanged against the new host. Positive and negative tests: ConnectionDetailView.test.tsx (every body, the flags, the builder) and the contract shape pins.

Ledger tick 02:40, discovery list slices L1 to L4 and connection detail slices D1 and D2 done, list e2e green, two reviews running · 6836b87

The connection detail reads its data through a model hook (WAVE-26 W26.4.e part 2, slice D2) · d2f6a81

useConnectionDetailModel holds the five data hooks, the memos and the ladder decision; ConnectionDetail keeps the markup and the handlers of its props. The component ladder test from slice D1 passes unchanged, the applySessionMatchIntentScope invariant test reads the model file.

The render ladder of the connection detail is a pure function with a component test; the orbs follow reduced motion, a server failure is status 500, a failed refetch keeps the res… · 0c04b75

Positive and negative tests: ConnectionDetailLadder.test.tsx (the real component, written against the old one first, three cases red then green) and resolveConnectionDetailBody.test.ts (old chain as oracle over 16,384 combinations, the two deliberate differences named).

The discovery list is a model hook, a body view with the virtualizer and a thin host (WAVE-26 W26.4.f, slice L4 part 2) · 2921465

useDiscoveryListModel holds the filter and sort, the admin flag, the bound counter and the load-more rule; the rows view reports the last mounted row and resets it to -1 when the rows go away. The failure card, the operator hint and each row stay slots of the host. The three existing list tests pass unchanged. Positive and negative tests: useDiscoveryListModel.test.tsx (real pure rules, request storm guard) and DiscoveryListBodyView.test.tsx (every body, slots, reported position).

The scroll-container hook of the virtualized lists moves to ui/hooks (WAVE-26 W26.4.f, slice L4 part 1) · 614c744

git mv with move-modules: three import specifiers rewritten, no code change. ui/ may not import @/hooks, and the discovery list view is its only user.

The empty states and the loading skeleton of the discovery list are views; after the automatic loads the list offers to show more people instead of "no matches", and the skeleton… · cea1fe5

New message keys discovery.list.loadingAria, moreAvailableTitle, moreAvailableBody and showMore in the five language shards (bundles and CSV rebuilt). Positive and negative tests: DiscoveryListEmptyView.test.tsx, the show-more cases in DiscoveryListViewEmptyFirstPageLoadsMore.test.tsx and the moreAvailable cases in resolveDiscoveryList.test.ts.

Ledger tick 01:50, batch 7 published, discovery list slices L1 and L2 done; publish check lows queued, stale spec comment fixed · c54baab

A row of the discovery list is a row model, a props-only view and a thin host; a numeric id disables the connect button and the stage badge shows no raw code (WAVE-26 W26.4.f, sli… · 1ea8875

Positive and negative tests: buildDiscoveryListRowModel.test.ts (action against the old branch chain over every stage), DiscoveryListRowView.test.tsx, and the map 3.7-3 and 3.7-4 cases in DiscoveryListProfileCard.test.tsx. Three source-text tests are repointed at the new files.

The discovery list body, the load-more rule and the bound counter are pure rules; the empty state no longer flashes while the last automatic page loads (WAVE-26 W26.4.f, slice L1) · 2cdf123

Positive and negative tests: resolveDiscoveryList.test.ts (old chain as oracle over all combinations) and the map 3.7-1 regression in DiscoveryListViewEmptyFirstPageLoadsMore.test.tsx.

Production run 726518b90 (batch 7: UI contract for shell, chats, connections and discovery chrome, discovery fixes); records, snapshot, dashboard, queue note · d24c610

Ledger tick 00:35, batch 7 release commit frozen: rehearse and deploy this exact head · 726518b

Ledger tick 00:10, batch 7 integration tier green, rehearsal running · f2ac1f6

Ledger tick 23:50, integration tier restarted in full after the resumes hit the phone-code limit · 3a3a311

Ledger, per-screen review in phase B is done by the agent reviewers, not by waiting · 222827e

The three read-only maps of the remaining screens, and the design note of the discovery list body (W26.4.f) · cbd7033

Backlog, resuming integration specs skips the tombstone cleanup and spends the phone-code bucket · ec27e93

Ledger tick 23:50, map of the six remaining screen groups read, order and bug list set · a4ed4ca

Ledger tick 23:45, map of the chat inside, detail panel and list body read, slice order set · 9ebdb81

Ledger tick 23:25, owner order: the full finish list, integration red explained (OTP request bucket), maps for the remaining screens started · 6c08a4d

Backlog, one integration spec timed out once in sequence and passed alone · 93db675

Ledger tick 23:15, integration spec red explained and fixed, integration tier resumed · f2fadf4

The account-deletion race against a contact-share request has a third valid outcome, 409 not eligible (found by the batch 7 integration run) · 0e38ae5

requestContactShare reads eligibility before its alive-guard transaction, so when the deletion's early sweeps win, the request is refused with 409 CONTACT_SHARE_NOT_ELIGIBLE: no row, no 500. The spec accepted only 200 and 410 and failed on every attempt; the API is identical to batch 5. The spec now accepts 409 with exactly that code, keeps the no-orphan check and documents the ordering. Run alone: passed.

Ledger tick 22:40, batch 7 browser tier green twice, integration tier running · 79e643b

Ledger tick 22:35, browser tier runs from the live folder, copy-based stack abandoned · 76f253c

Backlog, a dev stack cannot run from a gate-worktree copy because container bind mounts follow absolute host symlinks · b05c81f

Backlog, the offline model volume vanished and the stack-up took the stack down before failing · 419224f

Ledger tick 22:00, batch 7 t0 and t1 green, browser tier t2f running · 7141d90

Backlog, vitest cache race between api-unit shards in a linked worktree · 72fb181

Backlog, orphaned test children after a stopped run held the rehearsal lock · 5e0bc9f

Ledger tick 10:05, lockfile parity red fixed, t0 and t1 rerunning on the new release sha · a406529

The pnpm workspace lock follows the bumped and added dependencies (lockfile-parity was red on the batch 7 release copy) · dc62275

react-query and devtools 5.105.0, react-virtual 3.14.23, i18next 26.5.11 and the Storybook 10.6.4 dev dependencies were in package.json and the npm locks but not in src/pnpm-lock.yaml. Re-resolved with pnpm 9.15.9 (lockfile-only); check-lockfile-version-parity is green for api (57) and web (129). The mechanism fix is queued in the backlog (SLIP-DEP-BUMP-PNPM-LOCK).

Ledger tick 09:45, batch 7 release started, t0 and t1 running in the clean copy · 2697295

W26.4.b checked off, W26.4.f (discovery list body) filed; the UI batch is published; flag-reset cases from the publish check · 60a9a11

Independent check verify-land-ui-3: PUBLISH. Pushed 4fcf3bf16 to the private origin. The checker's LOW findings: supermatch and reshuffle retry cases (the in-flight flag is cleared on success and failure), the missing guide case, a stale comment. rounds.tsv and the ledger carry the record.

Ledger tick 08:45, publish check of the UI batch running, review record corrected · 0a92cec

Ledger tick 08:30, discovery reviews accepted, slices 4 and 5 done, landing next · 89e4982

Review fixes for discovery slices 2 and 3: the reshuffle and supermatch models guard against a second call, the chip test checks the title mapping (review rv-disc-b, 5 LOW fixed,… · 82dec32

A model is a contract any view can call, so useDiscoveryReshuffleModel and useDiscoverySupermatchModel now ignore a second call while one is in flight (red tests first: two calls sent two requests). The chip fixture used a group id instead of a scope id, which the old assertion could not see; the catalog title function now takes a string so the view needs no cast. Hook tests use the exact query keys and pin the call order. APPROVED lines for slices 2 to 5 are in rounds.tsv.

The universe guide is a model hook (WAVE-26 W26.4.b, discovery chrome slice 5) · aa62491

useUniverseGuideModel holds the guide's open state, its reset on an account swap, the switch to the list and the "do not show again" storage with the same log line and failure toast; UniverseView passes the model's fields to the unchanged modal and top chrome. The canvas props, the admin debug panels and the performance hand-off stay in UniverseView (decision in the design note). Tests: hook test, shape pin, the account-swap source-text test follows the hook; 308 impacted files green, gates clean.

Ledger tick 08:10, discovery page hook moved to screen-models · 358f58e

The discovery page hook and its three helpers move to screen-models/discovery-chrome (WAVE-26 W26.4.b, discovery chrome slice 4) · 2356439

useDiscoveryPageContent, buildUserMatchingDiscoveryProfile, resolveDiscoveryFetchLimit and resolvePreviewedProfileCandidates move with git mv (no code change); 24 import specifiers in 11 files were rewritten with move-modules, seven source-text tests and the match-score audit list follow the new path. Checks: tsc clean, layer cycles, cruiser and UI rules clean, 381 impacted test files green (discovery, ui, journey, paywall).

Ledger tick 07:55, discovery chrome slice 3 complete, review of slices 2 and 3 running · e41fb2b

The supermatch card is a model hook, a view and a thin host; a reveal is kept per viewer and profile (WAVE-26 W26.4.b, discovery chrome slice 3 complete) · f43afd8

useDiscoverySupermatchModel holds the reveals (a set of JSON viewer+profile keys: a top match that flips away and back stays revealed, no second allowance, no key collision; review rv-disc-a L1 and L2), the entitlement check, the request, the paywall hand-off and the failure toast. DiscoverySupermatchView draws the card; DiscoverySupermatchRevealCard stays as the host. Tests: view and hook tests, contract shape pin, two paywall source-text tests repointed to the hook; 145 impacted files plus ui and paywall suites …

Ledger tick 07:40, scope chip on the contract · 258a989

The scope chip is a model hook, a view and a thin host (WAVE-26 W26.4.b, discovery chrome slice 3, third part) · 8ef7a10

useDiscoveryScopeChipModel gives the session scope id and the picker opener (null while no scope is ready); DiscoveryScopeChipView draws the pill and maps the id to its title through the catalog; MatchIntentScopeChip stays as the host. Tests: view and hook tests, contract shape pin, host test and two source-text tests repointed; 143 impacted files plus the ui and paywall suites green, layer cycles and cruiser OK.

Ledger tick 07:25, strict scope switch on the contract, import cycle broken at its root · 8213bf8

The strict scope switch is a model hook, a view and a thin host; the session scope context moves to its own module (WAVE-26 W26.4.b, discovery chrome slice 3, second part) · d55cb97

useDiscoveryStrictScopeModel holds the provider state, the disabled rule, the storage of a change, the refresh and the failure toast; DiscoveryStrictScopeView draws the pill; MatchIntentStrictScopeToggle stays as the host. The picker body holds the toggle, so the hook import made a cycle through the model layer: the context and useMatchIntentScope now live in matchIntentScopeContext.ts (matchIntentScope.tsx re-exports the hook). Tests: view, rule table and hook tests, contract shape pin; the 65 impacted test files…

Ledger tick 07:10, reshuffle control on the contract, slip recorded · fa78a66

The paywall trigger invariant follows the reshuffle paywall call into its model hook (missed in the previous commit: the paywall suite was not run to green before committing) · 5a7252e

The reshuffle control is a model hook, a view and a thin host (WAVE-26 W26.4.b, discovery chrome slice 3, first part) · c6e7eb5

useDiscoveryReshuffleModel holds the request, the query refresh, the paywall hand-off and the toasts; DiscoveryReshuffleView draws the button from a DiscoveryReshuffleModel; DiscoveryReshuffleButton stays as the host, so the two callers and the existing host test are unchanged. Tests: view test from fixtures, hook test with the edges doubled, contract shape pin; impacted discovery, paywall and ui tests green, UI rule scripts clean.

Ledger tick 07:00, discovery review accepted, slices 1 and 2 done, move-modules tool added · 128c960

Review fixes for the discovery fixes: the connect key is collision-free, a new viewer and a retry are pinned, a dropped duplicate connect is logged (review rv-disc-a, 5 LOW fixed,… · c5e25a9

Eleven components (toolbar row, view switch, header and headlines, info modal and guide panel, zoom controls, canvas stage and placeholders, skip link) move with git mv; the code… · e919b8f

does not change. 41 import specifiers in 24 files were rewritten with the new move-modules tool, a source-text test now checks the layout rule instead of the old JSX conditions. Checks: tsc clean, check_ui_contract_rules --screens journey,onboarding,discovery-chrome 0 violations, layer cycles and cruiser OK, 4134 web tests green.

The discovery page decides its phase and its content body through two pure rules (WAVE-26 W26.4.b, discovery chrome slice 1) · 0c00c21

resolveDiscoveryPagePhase and resolveDiscoveryContentLayout (screen-models/discovery-chrome) replace the inline conditions of DiscoveryPageClient and DiscoveryPageContent; the JSX is otherwise unchanged. Contract types are in ui-contract/discoveryChrome.ts and pinned by the shape test. Proof: a table test, the old chain frozen as an oracle over all 768 input combinations, and the existing page tests unchanged. Design note: docs/notes/ui-contract-discovery-chrome.md.

A second connect for the same profile while the first is in flight sends no second request; the sign-in gate and the guide flag are pinned (discovery chrome leads 3, 5, 6) · 0e15b70

Lead 5 was reproduced red (two requests for a double call) and fixed with an in-flight set keyed by viewer and profile. Lead 3 was disproven: the match query, its poll and the stream are gated on a signed-in viewer, now pinned by a test with the real hook. Lead 6 is a dead flag with no visible effect (the guide opens only on request): documented with a test, a first-visit auto-open is a product decision.

Ledger tick 06:30, connection panel review accepted, two discovery fixes recorded · 5be62da

The connection panel pins its stage copy, the payload without a stage and the retry call (review fixes: the stage title and description were asserted nowhere) · a933aeb

Adds the view test for the title and description of the stage and of another stage, the builder and host tests for a stage that is undefined (as the hook gives it), and the retry call without the click event. Rewords the view comments that overclaimed, simplifies the stage ternary in the host, and renames two stale card names in the e2e comments.

The reshuffle toasts are translated: the success and failure texts were hard-coded English in every language (found by the discovery chrome map) · d257bd3

Both toasts now read discovery.paywall.reshuffleDone and reshuffleFailed in en, de, fr, es and ar. The aggregated messages and the translation CSV were rebuilt from the shards. Tests: DiscoveryReshuffleButton.test.tsx pins both keys (red before the fix); key-in-source, key-parity and CSV round-trip checks pass.

The supermatch reveal belongs to one viewer and one profile: a new top match is blurred again and needs its own reveal (found by the discovery chrome map) · c0e231e

Red first: after a reveal, a rerender with another profile id still showed the card unblurred (no reveal call, no allowance used). The reveal is now stored as the key of viewer and profile. Positive: a new profile shows the reveal button and reveals only with its own call. Negative: a rerender for the same profile keeps the reveal.

Ledger tick 06:50, discovery chrome map read, filter reset bug fixed · 6f08e05

The universe/list toggle no longer clears the discovery filter and sort: the swap reset runs only on a real viewer change (regression of W0.111.a, found by the discovery chrome ma… · ecab5c0

Red first: with the real match segment provider and the real page client, a filter or sort set by the viewer was cleared when the page was remounted by the toggle, because the swap reset effect (keyed on the uid) also ran on mount. Now useResetOnAccountSwapAfterMount. Positive: the filter and the sort survive a remount; a genuine account swap clears both. Negative: a mount and a rerender with the same viewer reset nothing (the two older client tests pin that).

Ledger tick 06:05, usage limit reset, two agents resumed · 4417a7f

Ledger tick 07:55, connection panel committed and under review · 676f479

The connection panel on the UI contract: phase builder, ConnectionManagerView with the three cards, ConnectionManager as the host (WAVE-26 W26.4.e, first part) · a33df86

ConnectionManager had no test: a 9-test safety net (every phase, the precedence, the consent view props, the detail card and the starters' handlers) was written against the old component first and passes unchanged against the host. Builder 12 tests, view 9, contract pinned. The loading, error and detail cards moved into the view; the consent view and the starters are slots built only in their phase. ConnectionDetail (profile depth panel) is the rest of W26.4.e.

Ledger tick 07:05, onboarding route behind the contract, review read and the README slip fixed · c3113d4

Restore docs/notes/README.md emptied by an edit slip, onboarding review fixes (WAVE-26 W26.4.b, review rv-onb-a) · f276aec

MEDIUM: commit a4ce8b91f emptied docs/notes/README.md (a one-line helper opened the file for writing before reading it); restored from the parent commit plus the onboarding row; slip, root cause and mechanism fix recorded in the backlog. LOW: the selected culture copy is memoised, the draft-storage double is complete and the page test asserts no failure is logged, the empty-mailbox state has its no-hint test, the gender chip test asserts values, fixtures match the contract, the plan note is corrected.

The title, the lead, the 1 of 2 pill and the header cancel control (form only) are drawn by the view from a pure page model; the host picks the body (form view or a recovery step). · f529878

Builder 4 tests, view 6 tests; the page tests (form branch 10, existing account 8, email in use 6, cancel 11) and the hook tests pass unchanged; 811 UI and onboarding tests green. The onboarding route is now behind the contract.

The onboarding escape hatches on the UI contract: cancel control, existing-account step and email-in-use step as model hooks and views (WAVE-26 W26.4.b, onboarding slice 4a) · ed289c2

The cancel sequence (clear draft, clear form, discard the stub within 5 s, mark the account chooser, sign out), the account link with its redirect and the sign-in-to-existing-account action moved unchanged into model hooks; the views draw the same DOM and test ids; the three components stay as thin hosts with the same props and exported test ids, so the 11 cancel, 8 existing-account and 6 email-in-use tests pass unchanged. View tests 18 from fixtures; dialog footer order test points at the view. 800 UI and onboard…

Ledger tick 06:20, onboarding slice 3 committed and under review · 4a17639

The onboarding form on the UI contract: contract and fixtures, form model builder, OnboardingFormView, the four sections move to the UI layer (WAVE-26 W26.4.b, onboarding slice 3) · a01c323

buildOnboardingFormModel (14 tests) carries the hook's values and viewer-marking setters unchanged; OnboardingFormView (16 tests from the fixtures) draws the same DOM, copy and test ids; the second-contact step and the server photo are host slots. The two source-text tests of the account-email section and the photo lead ids are replaced by the view test. The 10 form-branch page tests, the existing page tests and the 3 hook tests pass unchanged; 781 UI and onboarding tests green. The page frame and the recovery bod…

Ledger tick 05:40, onboarding slice 2 (move of the form state) committed · 92af756

The form state, its seven effects and the actions move unchanged from the route folder to screen-models/onboarding (WAVE-26 W26.4.b, onboarding slice 2) · 3a217f5

git mv of useOnboardingPage, useOnboardingPageEffects, useOnboardingPageHandlers, useOnboardingRecoveryView, onboardingGeolocation and onboardingPageConstants; only importers changed (the page, three hook tests, four onboarding tests, docs). No effect order or dependency array touched. 228 onboarding tests and the 142 impact tests green; rule gate, cruiser and cycles green.

Ledger tick 05:10, UI batch published to the private origin, publishing check recorded · 3fb6a20

Positive and negative: without --check a clean tree is a report (exit 0), with it exit 1; an empty scope is exit 3 either way. · 529203b

The entrypoint checker flags 'cd x && npm install', 'if ! npm install', 'npm i' and 'npm ci' without --include=dev, and ignores comments, log lines and echoes.

The form body of the real page pinned against the old page: markup, identity block, alerts, submit states (WAVE-26 W26.4.b, onboarding slice 1) · f30cb6e

10 tests, green on the unchanged code.

The identity table and the checks before submit are pure rules in screen-models/onboarding, moved unchanged and pinned directly (WAVE-26 W26.4.b, onboarding slice 1) · a4ce8b9

resolveOnboardingIdentity (14 tests) and validateOnboardingSubmit (13 tests); useOnboardingPage and submitOnboardingProfile call them. The 164 existing onboarding tests and the 27 added safety-net tests stay green (218 onboarding tests, 132 impact tests). Plan note docs/notes/ui-contract-onboarding.md.

Safety net before the move: residence detect (15 tests) and form submit (12 tests) pinned against the old code (WAVE-26 W26.4.b, onboarding slice 1) · eb6b21f

Both had no direct test. Detect: granted, denied, other position errors, failed lookup with and without a server message, invalid codes, network error, viewer swap after each await. Submit: payload, cache merge, refetch, one redirect last in the member's language, identity and birth-year guards, age floor for a new year only, swap after write and after refetch, email collision, other errors. Green on the unchanged code.

Ledger tick 04:30, journey review fixed, slip and mechanism fix recorded, publishing check running · 89edba2

Review fixes of the journey route: the base screen invariant reads the view, a stable model across unrelated query keys, the gated flag honoured, redirect timing and sign-in order… · cb94b77

MEDIUM: baseScreenInvariant.test.ts read the shells from the old route page and went red; it reads JourneyRouteView now. Positive: a signed-out viewer is never redirected, the session-scope redirect runs before the scroll reset and a later one after it, a before-paint redirect performs before a sibling passive effect, an unrelated query key keeps the model. Negative: a progress URL with another key gets a new model, a gated:false screen has no gate, an empty phase is not rewritten.

Ledger tick 03:50, W26.4.a checked off, thread review fixed, journey route committed and under review · 2405621

Positive: consent gets onCancel only for a request the viewer sent, embedded layout and the back label; payload missing carries back, retry and retrying. · 6b7048c

Negative: the request direction is not resolved outside the consent phase; no back button on the missing-payload panel without a dismiss action.

The journey route on the UI contract: decision table, redirect model, view with shells, route page as host (WAVE-26 W26.4.b, first part) · 34e4856

A 23-test safety net of the real route page was written against the old page first and passes unchanged against the host (every phase and section as a screen or a redirect, gating, shells, completion handlers, the bare-URL fix). Resolver 22 tests, builder 3, view 12; contract pinned. Redirects are still performed under the sign-in requirement. No intended difference.

W26.4.a rescoped to what is built (list page, profile, thread shell); the thread inside and the connection detail panel are W26.4.d and W26.4.e; decision on the 12 react-query hos… · b6a44b1

Ledger tick 03:20, profile review read, chat thread shell committed and under review · c650765

The shell around the embedded chat thread on the UI contract: two pure builders, ChatThreadView, the stage gate and stage data components become hosts (WAVE-26 W26.4.a, chat threa… · bc8d5e2

Builders 12 tests, view 12 tests (replaces the source-text test of the unavailable copy), contract pinned (also the profile mode list). The consent screen, starters and ChatSystem stay slots. 13 existing chat view tests are the safety net; the banner test now reads the drawn text and has a negative case. Removed ChatViewSessionScopeBanner (its markup is the scope note of the view). No intended difference.

Positive: a real swap resets the update mutation exactly once; the journey button pushes JOURNEY_YOU and the scope button MATCH. · a405105

Negative: a rerender with the same viewer does not reset again.

Ledger tick 02:50, Connections review read and fixed · d9a6f47

Review fixes of the Connections page: undefined list shows nothing (pinned), falsy dates, non-vacuous canRetry test, all stage copy keys, dead helper removed (WAVE-26 W26.4.a, rev… · 5cac92d

Positive and negative: a loaded empty list shows the empty notice, an undefined list shows neither notice nor rows; canRetry true for a timeout and false for an auth error; each of the seven stage ids maps to its own key; a zero or empty activity value is no activity. Docs: second intended difference and the single log point recorded.

Ledger tick 02:30, Profile page slice committed, two reviews running · 7dfcb85

The Profile page on the UI contract: model, builder, view with the form, summary and card as slots, route page as host (WAVE-26 W26.4.a, second screen) · 3f92dbc

A 15-test safety net of the real page was written against the old page first and passes unchanged against the host (modes, save guard after an account switch, reset on a real swap, scope block, navigation). Builder 8 tests, view 10 tests, contract pinned. No intended difference.

Ledger tick 02:10, Connections page slice committed and under review · 55bd395

The Connections page on the UI contract: model, builder, view with the peer panel as a slot, host (WAVE-26 W26.4.a, first screen of the roll-out) · 520ffac

ConnectionsPageClient is a host; useConnectionsModel holds the moved state and effects, buildConnectionsModel is pure (15 tests), ConnectionsView draws the contract (16 tests from fixtures), the contract is pinned in contractShape. The five existing page tests pass unchanged. One intended difference: an invalid activity date is no longer printed as Invalid Date.

Pilot screenshots of the shell and Chats inbox after the contract refactor equal the baseline (WAVE-26 W26.3.c, W26.3) · 740ee96

12 pairs (you, chats-inbox, chat-thread at 320, 390, 768, 1440) compared with the stored baseline: largest difference 0.05 % of the pixels, limit 2 %. 37 files, 4.5 MB, in docs/research/ui-mobile/02-pilot with a README.

The web entrypoint installs devDependencies also under NODE_ENV=production (the --prod-server stack lost typescript after a manifest change and the build failed) · 941b4d7

Root cause: a changed package manifest made the entrypoint reinstall node_modules; with NODE_ENV=production a plain npm install omits devDependencies, so next build failed with Module not found for the @/ alias and the container restarted in a loop. Both npm install calls now pass --include=dev. Test: scripts/test_web_entrypoint_install_dev.py (red before, green after; a negative case for the checker).

Inbox fix-diff re-check ACCEPT recorded, W26.3.b checked off, dup-key lead in backlog · cf0a98f

Pad the two inbox review lines of rounds.tsv to seven fields · d4ebe65

Ledger tick 01:15, Storybook spike item checked off · 0e1b6b0

Review fixes of the Chats inbox slice 3: remove test id in its own table, stronger view tests, stale docs and counts (WAVE-26 W26.3.b, reviews rv-inbox-a, rv-inbox-b) · 6513fa4

MEDIUM: chats-inbox-remove-inactive-conversation no longer sits in MATCH_CARD_TEST_IDS (matchCardTestIds.test.ts red); positive and negative test added. Spinner test id; error body keys and the retry word asserted for their own reason; source-text test removed; contract header and canRetry text corrected; doc-comments; README test id list.

Ledger tick 01:00, Storybook spike committed, opus inbox review read and fixed, sonnet review pending · f473f3a

Positive: two visible matches with one id both appear with their own data. · 14b2ecd

Negative: a key with no visible match draws nothing and is logged once; no gate in the model gives no gate layer.

Storybook spike works on this repo: nextjs-vite framework, a11y addon, first story of the Chats inbox view from the contract fixtures (WAVE-26 W26.5.a) · b4be7ed

Build passes in about 4 s; the story renders with real copy and styles at 390 and 1440 px, no overflow, no console error. Telemetry off. storybook, @storybook/nextjs-vite, @storybook/addon-a11y 10.6.4 as dev dependencies; npm scripts storybook and storybook:build.

Ledger tick 00:50, audit tool committed, W26.6.a verify recorded (item waits for W26.4.c) · 537919e

Ui_readiness_audit.py ranks desktop-only components of the web app (WAVE-26 W26.6.a, measure only) · bac9a92

Five static signals per .tsx file (fixed width over 320 px, text under 12 px, hover-only styling, layout without responsive prefix, tap target under 44 px), weighted score, files and features ranked; --check fails on an empty scope or when no rule fires; --json writes the full report. 10 tests incl. a real-repo smoke run; first run: 660 files examined, discovery/admin/design-system/profile/landing rank first.

Ledger tick 01:20, inbox views committed and under review; contract README names its two shared values · a04ae6d

The Chats inbox as views of the UI contract: ChatsInboxView and ChatsInboxRowView, the page and the row become hosts (WAVE-26 W26.3.b, slice 3) · 5e74f1a

New src/ui/screens/chats-inbox: ChatsInboxView (heading and count line, recovery notices from the model, spinner, empty notice, inactive filter bar, group tabs or inactive description, rows through renderRow, the gate as a slot) and ChatsInboxRowView (the card with name, stage pill, consent pill or unread dot, profile button, match ring, the six primary actions, chips, invalid-orb alert; avatar, fit lines and sheet are slots). ConversationGroupTabs, ChatsInboxInactiveFilterBar and the test id table moved into the …

Ledger tick 00:35, UI batch published to the private origin, gate-worktree skill root slip recorded · bb38539

Publishing check of the UI batch recorded, approvals of the accept guard, the fix commits, the dependency bump and the baseline capture · 38f6cd2

Accept guard review lows: a request that a swap made stale cannot release a newer request's guard, swap and exit-path tests adopted (WAVE-26 W26.3.b) · ce05f5c

Review rv-accept-guard (sonnet, ACCEPT, 11 probes). L1: after a viewer swap and swap-back (v1, v2, v1) an old request of the same pair finishing released the guard and the busy state of the newer request, so a third accept could go out (3 requests instead of 2). Each request now takes a number (requestSeqRef); only the request that holds the current number releases the guard and the busy state, and a swap bumps the number. L2: the swap behaviour had no test: the reviewer's probes are adopted as useConversationMatc…

The Chats inbox row host hook: the per-row logic of ConversationMatchCard behind the row model (WAVE-26 W26.3.b, slice 2 part 2) · 91ab9bd

useChatsInboxRowModel takes over what ConversationMatchCard did per row: the session, the viewer profile, the thread application, the accept and delete mutations, the profile sheet resolver and its open key, with the hooks in the same order. It returns the ChatsInboxRowModel (built by the reviewed pure builder) and, for the host to pass to the view as slots, the props of the avatar, the fit lines and the profile sheet. chatsInboxStageBadgeKind maps a stage to the five pill kinds through the real badge helper. A ma…

Ledger tick 00:05, inbox slices 1 and 2a approved, accept guard under review · f36d155

Inbox row builder review lows: contract wording, remove-busy and other fixtures, value lists pinned, design note deviations (WAVE-26 W26.3.b, slice 2 part 1) · 9cbd7b2

Review rv-inbox-row (sonnet, ACCEPT): a differential probe of 129,024 combinations against the old row decisions found 0 mismatches (a swapped accept and open in the probe's own copy gave 4,608, so the probe can fail). Applied the 8 lows: the matchPercent comment says a default row with null draws a placeholder ring and an inactive row draws none; the busy contract says a busy button is shown disabled with aria-busy and a view calls the run of the model it renders now; three new row fixtures (remove busy, inactive…

Accepting an incoming request from the inbox row is guarded in the hook, not only by the button (WAVE-26 W26.3.b, design review M6) · 6bc3137

useConversationMatchCardAccept sent respondConversation or respondChat on every call: the only protection against a double accept was the button's disabled flag, and "accepting" is state, seen only after the next render, so two calls in the same tick (or a replacement view that forgets disabled) sent the request twice. A ref now marks the request in flight; it is released in the finally for the same viewer and peer, and by the account-swap reset, so a stale request of a previous viewer cannot lock the next one. Po…

Chats inbox page model review findings: stable model identity, no early filter bar, canRetry without logging, more fixtures (WAVE-26 W26.3.b, slice 1) · bad56b9

Review rv-inbox-s1 (sonnet, ACCEPT-AFTER-FIXES) of 31bcd1be1. M1: the hook depended on the whole shellNavGates object, which the real hook returns fresh on every render, so the model changed identity on every render although the test claimed otherwise (it used one fixed object); it now depends on the gate kind and the retry function, on counts and on two key strings (row keys, tabs) instead of the arrays. M2: hasMatches and the only-inactive hint could be true while the page state was loading (a connection-only st…

W26.3.a checked off, shell frame approved; ledger tick 23:50 · 6fd0044

Shell frame review round 1 findings: tests that can fail, the host wiring tested, real predicates, frame fixtures, an exhaustive status switch (WAVE-26 W26.3.a) · f317b32

Reviews rv-frame-a (opus, ACCEPT: 0 differences over 3072 gate states, 2500 random states and 400 re-render walks against the old component) and rv-frame-b (sonnet, ACCEPT-AFTER-FIXES: no behaviour defect, two new tests that could not fail). Fixed: the content band test compared single class tokens that every <main> contains, so it passed for any band; it now asserts the whole class string of each band and that the other two are absent (also shellConstrained). The "no onboarding redirect" negative asserted only it…

The Chats inbox row model on the UI contract: row types, nine row fixtures and the pure row builder (WAVE-26 W26.3.b, slice 2, part 1) · 571d740

ChatsInboxRowModel (name or null, variant, stage badge kind, match percent, orb, invalid orb flag, marker, primary action, synergies, common ground flag, profile opener) and buildChatsInboxRowModel.ts, the branches of the old ConversationMatchCard and its two action columns as a pure function: the primary action in the old precedence (unresolved, remove for inactive rows, accept, requested, open, unavailable), run of accept and remove a no-op while busy (design review M6, enforced by the model), an incoming reques…

The Chats inbox page model on the UI contract: contract, fixtures, pure builder and the adapting hook (WAVE-26 W26.3.b, slice 1) · 31bcd1b

New ui-contract/chatsInbox.ts (page state, count phase, errors with canRetry, filter, group tabs, row keys only, the blocking gate) with seven fixtures, screen-models/chats-inbox/buildChatsInboxModel.ts (pure) and useChatsInboxModel.ts, which takes the result of useChatsPageClientState as an argument so that hook still runs once per page (design v2, review M1). Rows are keys: the row data comes from a data-side row host in the next slices. canRetry is computed the way the recovery notice did (handleError, once per…

Ledger tick 23:25, frame host split committed, two reviewers on it · 20dc810

Ui_compare_baseline review findings: explicit widths must exist, unreadable and linked shots are refused, alpha counts, --phone-gates; frame decision tests pin the order (WAVE-26… · 857e853

Review rv-frame-cmp (sonnet, ACCEPT-AFTER-FIXES for both items). Compare script: F1 (MEDIUM) a width given with --sizes that the baseline lacks was skipped and exited 0, now exit 3, and without --sizes every width the baseline has for the screen is compared; F2 an unreadable candidate shot is exit 3 with a log line instead of a traceback; F3 images are read as 8-bit RGB, RGBA, grey or palette, alpha is composited on white and on black so a transparency change counts, 16-bit images are refused; F4 the same folder i…

The 432-line AppPagesLayoutClient is split. · d361654

screen-models/shell/useShellFrameModel.ts holds the session, profile, route and match intent logic and the effects (sign-in redirect with its 200 ms and 100 ms timers, the onboarding and You hub redirects with the passkey resume query, the mailbox gate log) and returns the ShellFrameModel plus the viewer facts for the overlays. ui/shell/ShellFrameView.tsx draws the frame per status (loader, the four message screens, the ready page area with bottom bar and dock spacer) from the model and the server copy; AccountRem…

Ledger tick 23:35, shell pilot and inbox design approved, frame functions under review · 5536db7

Chats inbox design v2 after the design review: hosted rows, one state hook, canRetry, full row model, source-text tests per slice (WAVE-26 W26.3.b) · d54b2d9

rv-inbox-design (opus, APPROVE-AFTER-FIXES) found one blocking defect in v1: hooks cannot run in a loop, so the page model cannot return finished row models. v2 lists row keys in the page model and builds each row model in a data-side row host (the pattern of AppNav passing the link component). Also applied: the state hook runs once and the model takes its result (M1), errors carry canRetry computed on the data side (M2), the row model has the seven primary actions, the marker, the common-ground block, the invalid…

Shell bottom bar review round 1 findings: the click contract takes the tab id, the model ignores active and locked clicks, seam and equivalence tests, an import cycle removed and… · e05126f

Reviews rv-shell-a (opus, ACCEPT: 0 differences over a matrix of hostile routes, phases, gates, counts against the old controller) and rv-shell-b (sonnet, ACCEPT-AFTER-FIXES). Contract: ShellNavModel.onTabClick takes the tab id only; useShellNavModel looks the tab up in its own tabs and ignores a click on an active or a locked tab (a view could mark a locked tab pending, or the active one). View: the badge and its spoken label only for a positive count. Cycle (rv-shell-a F1): features/app-shell/index.ts exported A…

The shell frame decisions as pure functions on the UI contract: status, onboarding redirect, layout (WAVE-26 W26.3.a, third slice, part 1) · 1db164d

New ui-contract/shellFrame.ts (ShellFrameStatus, ShellFrameLayout) and screen-models/shell/resolveShellFrame.ts with resolveShellFrameStatus (the early returns of AppPagesLayoutClient in their order), resolveOnboardingRedirect and resolveShellFrameLayout (content band, embedded chat thread, orb backdrop, hidden bottom bar, push prompt eligibility). Nothing calls them yet: the hook and the view that replace the 432-line component follow, with the five source-reading tests converted to behaviour tests. W26.3.a stays…

Ledger tick 22:48, three reviews running, compare script and inbox design done · 44fc7c0

Design note for the Chats inbox on the UI contract, four slices (WAVE-26 W26.3.b) · c1171bd

Reads the inbox as it is (the 30-field state hook, the 24-field Pick view, the 332-line card controller with its presentational row), defines ChatsInboxModel and ChatsInboxRowModel with no DTO, no translated string and no error object, keeps the peer sheet as a host slot, and orders the build: page model, row model, views, screenshots against the baseline. Risks and their checks are listed (single source for the filtered list, unresolved peer rows, the count phases, the e2e test ids).

Ui_compare_baseline.py, the before/after screenshot check of the UI refactor (WAVE-26 W26.3.c) · 5b545a9

Compares the shots of a candidate run with the stored baseline (docs/research/ui-mobile/00-baseline/01-seeded): per selected screen and width the same image size and at most --max-diff of the pixels differing by more than --tolerance in any channel. A missing shot, an unknown screen or an empty selection is exit 3, never a pass; the JSON report names every pair. The baseline compared with itself gives 12 pairs, all 0.0000; the default candidate folder (02-pilot) does not exist yet, so the plan verify of W26.3.c st…

Ledger tick 22:55, import rules approved, shell pilot slices under review · 0938841

UI import rules, fix-diff re-check findings: an apostrophe in JSX text and a long comment no longer hide imports, bad --screens names are refused (WAVE-26 W26.1.c) · e6238f7

Re-check rv-uirules-fix of c8af65e81 (ACCEPT-AFTER-FIXES). F1 (regression): a ' or " string now ends at the first unescaped newline, so "You don't have chats" in JSX text cannot swallow the rest of the file. F2 (regression): the context window that tells a module specifier from other text collapses whitespace and blanked comments to one space, so a long comment between import( or from and the string no longer hides it. F3: --screens names must be [A-Za-z0-9_-]+ (exit 2 otherwise, also for an empty list), and the e…

The shell bottom bar as the first view of the replaceable UI layer: ShellBottomNavView in src/ui/shell, the hook moves to screen-models/shell (WAVE-26 W26.3.a, second slice) · 39f28d2

useAppNavController moves to src/screen-models/shell/useShellNavModel.ts and returns the contract model (tabs, isLandingPage, prefetchTargets, onTabClick), no labels or icons. New src/ui/shell/ShellBottomNavView.tsx takes the model and a link component, derives label and icon from the tab id and renders the design-system bar; AppNav is now only the host. The first file under src/ui passes scripts/check_ui_contract_rules.py (1 file, 0 violations). The sign-in and onboarding redirect policy of AppPagesLayoutClient i…

The shell bottom-bar model on the UI contract: ui-contract/shell, a pure model builder, the controller uses it (WAVE-26 W26.3.a, first slice) · 042afc2

New src/ui-contract (ShellTabModel and fixtures, types only) and src/screen-models/shell/buildShellNavModel.ts: the per-tab rules (active by route and journey phase, locked by the match and chat gates unless active, chat badge only above 0, pending) moved out of useAppNavController into one pure function. The controller now calls it and only adds labels, icons and the badge aria text for the current view, so behaviour is unchanged: the 43 neighbouring test files (207 tests) and the typecheck are green. W26.3.a sta…

Ledger tick 22:15, W26.2.d done, W26.1.c review fixes landed locally and under re-check · b49b171

UI import rules, review round 1 findings: strings and comments cleaned in one pass, require and template imports, exact screen names, gate with no source, ESLint patterns widened,… · c8af65e

Reviews rv-uirules-a (opus, REJECT) and rv-uirules-b (sonnet, ACCEPT-AFTER-FIXES) of e66e842cd. Script: a one-pass cleaner so "image/*" or "a//b" no longer hides a later import and text in a string is not an import; require(), import x = require() and template-literal imports are read; .js/.jsx/.mts/.mjs are scanned; @/lib/api* and @/lib/bff* match by prefix; --screens takes exact folder names, each must exist (exit 3), and always also checks the files outside src/ui/screens; --gate exits 3 when src/ui holds no so…

W26.2.d checked off, TypeScript 7 is already the compiler; its verify now asks for the native compiler (WAVE-26) · cbfd366

The old verify demanded that require("typescript") in the web app is 7, but that name is deliberately the TS 6 API for typescript-eslint and Next (e743a0c44, Microsoft's side-by-side setup). The verify now checks @typescript/native 7.x and tsc "Version 7". The two simulator tools stay on 6.0.3 as the recorded exception in docs/notes/backlog.md.

The UI import rules resolve relative imports to their alias before checking (WAVE-26 W26.1.c, own finding) · b90ac2b

A relative import such as ../../lib/api-client-generated from src/ui matched none of the rules (they matched the @/ spelling only), so the script missed what dependency-cruiser caught. imports_of now turns a relative specifier that lands inside src into its @/ form for all three rules and the legacy report; one that leaves src is left as written. Positive test: test_relative_imports_are_resolved_to_the_alias_before_the_rules_apply. Negative test: test_relative_imports_inside_the_same_layer_are_not_reported. Red fi…

Slip of the overwritten folder README (caught by the gate), rounds file padded to seven fields · 76ddc41

The import rules of the UI contract in warning mode: rule script, dependency-cruiser rules, ESLint block for src/ui (WAVE-26 W26.1.c) · e66e842

scripts/check_ui_contract_rules.py reports three rules with file and line (ui-no-data-side, data-side-no-ui, design-system-no-sides), counts the legacy components that still import the data side (321 components, 18 of them), has --gate for the interface gate and exits 3 on an empty scope. dependency-cruiser gets the same three rules as warnings (proved to fire on a planted tree); ESLint gets a block for src/ui/** that keeps the dev-only and chat sync bans. WAVE-26 W26.1.c and W26.1 checked off. Positive tests: a c…

Ledger tick 21:50, release line finished, UI refactor A0 done and A1 under way (fix-queue tick) · ffc916e

WAVE-26, the mobile-first UI refactor behind one contract (plan step A1) · 49d3122

New wave file from the wave-authoring template: operational anchor of 2026-10-26, user stories US-P26-001 to 004, requirements REQ-26-001 to 008, stories W26.1 to W26.8 and the exit demo W26.9. Done: the contract note, the wave file, the dependency bumps and both baseline passes (verifies recorded with record-verify-pass.py). Open: the import rules in warning mode, TypeScript 7, the pilot on the shell and Chats, the roll-out, the gallery, the audit and interface gate, the feature branch with its scope guard, the p…

UI baseline pass 2 with a seeded pair: inbox, open thread, match screens, connections, profile, safety (36 shots and records) · b7514aa

New ui-baseline-seeded.spec.ts (one resumable test per screen) and shared capture.ts; the match screens are captured as a gate state (the session-focus picker opens first) and then with the scope set. Measured on the seeded pair: no sideways overflow, the inbox is the densest small-text screen (14 of 21 text elements under 12px at 390px), tap targets under 44px only on tablet and desktop (thread back button 27x36, match list 7 of 12, universe 8 of 13), truncated peer names and intent label on phones. Baseline READ…

UI baseline capture and the first baseline of 16 screens at 4 sizes (mobile-first UI refactor, step A0) · c0ecc74

New capture spec tests/e2e/ui-baseline/ui-baseline.spec.ts with playwright.ui-baseline.config.ts (outside every test tier): per screen and size a full-page screenshot and a measured record. Baseline in docs/research/ui-mobile/00-baseline (64 shots, 22 MB): no sideways overflow anywhere, text under 12px only on phone widths (bottom-nav labels, journey phases), tap targets under 44px on the landing, sign-in and legal links and on tablet and desktop icon buttons. Limit of pass 1: a fresh test user is gated, so the da…

React-query and devtools 5.105.0, react-virtual 3.14.23 (web), i18next 26.5.11 (api, lock entry patched by hand because the api lock is out of sync); UI refactor step A0 · fff7945

Web typecheck clean, 448 web test files (2552 tests) and 4 api i18n files (49 tests) green on the new versions. The out-of-sync api lock is queued as API-LOCK-OUT-OF-SYNC.

Production run 64e59fd3d (batch 6: live inbox peers outside the discovery window are fetched before rejected ones); records, snapshot, dashboard, queue note · 2eb920f

A negative by-id cap selects nothing, boundary tests and README wording for the starvation fix (review rv-starve F1, F2, F4); approvals, queued lows and the ledger of the landing… · 2fe37ff

Positive test: cap 0 and a negative cap select nothing; negative tests: only terminal peers, a rejected peer with a conversation row, an unknown stage counts as live, a shared profile id keeps the first row.

Live inbox peers outside the discovery window are fetched before terminal ones, so 25+ rejected rows no longer starve them of the by-id cap (review rv-b5-gatefix F1, MEDIUM, the r… · c85ba8e

selectInboxPeersOutsideDiscoveryWindow applied its cap of 20 in connection order, and rejected or degraded peers counted, so an account with dozens of rejected rows never reached a live peer ranked below the discovery window: that peer still showed "Conversation unavailable". Live (pollable) peers now come first, then terminal ones, each group in connection order; the cap is applied after the ordering. Also: the comment on isPeerChatSessionPollable no longer claims a terminal peer has no status row (F5), and the s…

Landing check fixes: no mailboxes in the table row, the release READMEs name the batch 5 records, review rows for the by-hand path and the chat fix (checker land-b5 F1, F2, F5) · ba28260

Production run 18d7ef5b7 (batch 5: items 3 to 8, 12, 13, chat 429 fix, rate limits on one base); records, by-hand repair evidence, dashboard; the by-hand acknowledgement file is d… · 3a82649

One loop prompt for the release, the UI wave and the pending items (owner request 2026-10-26) · 18d7ef5

UI contract design note, step A1 of the mobile-first UI refactor plan (owner order 2026-10-26) · 04b1582

Ladder design v2 after both reviews, rate base review outcomes, UI refactor plan queued (fix-queue tick) · e7e6d02

Reviewers reproduced that the default lockout (on 108 policies) turned a second tab, a typing poll or a shared NAT address into an outage of up to 15 minutes (R2-1, N1, N3). · ecc82c0

The lockout is now an option a policy asks for with lockout: DEFAULT_LOCKOUT. Pilots: userReportMutationRateLimit and userBlockMutationRateLimit (account-keyed, a person clicks them a few times an hour). isSharedCallerPolicy is removed (moot). emailCheck and register get their own key prefixes (N2). RateLimiter marks the first refusal of a run by the last refusal time, so policies without a lockout log it too (R2-5). Tests: opt-in vs no lockout per policy, own keys, the 29-peer and 14-per-tab refusals over 30 minu…

Rate base v2 committed, four reviewers running (fix-queue tick) · 2dc0de5

Every rate limit runs on one base: decaying meter, timed lockout that doubles, RateLimiter over a store; chat session read sized from the inbox polling (owner orders 2026-10-26) · 066f919

Base lib/rate: leakyMeter gains a decaying drain (halfLifeSeconds) and meterFromWindow; a clock that steps back no longer refills, a NaN clock throws. New penaltyBox: refusals are strikes in a decaying meter, a full meter starts a fixed timer that doubles per repeat (capped, forgotten after a calm period). New rateLimiter: RateLimiter + MemoryRateStore compose both behind check(key, now). createRateLimit is now only the Fastify adapter: all 122 window policies become meters with the same sustained rate, 429 bodies…

Research README row for the leaky meter; t2i red was an edit under the running api, leaky-meter reviewers running (fix-queue tick) · 96580fe

Leaky-meter rate limits: a pure base in lib/rate, a leaky option in createRateLimit, chat session read as the first policy (owner order 2026-10-26; production 429 Too many chat se… · 445017f

Base lib/rate/leakyMeter.ts: level rises per accepted request, drains at a fixed rate, refusal only above capacity, refused requests not recorded, injected clock. Policy chat session read: capacity 40, drain 2 a second (a person never reaches it, a machine is held to it). Tests: 22 base, 24 middleware including the human inbox of 8 peers and the broken 68-peer case. Research doc, READMEs, atlas. Backlog: other polled limiters, and the slip of editing under a running tier.

Listed peers that are not polled keep a transcript-only status row; the poll-set tests use the real rule (reviews c429-a opus, c429-b sonnet) · f6be415

c429-a (opus) reproduced that leaving rejected peers out of useChatStatus also dropped their unread dot, the app badge count and their grouping (the unread flag from the conversation list was only attached to polled peers). useChatStatus takes the listed-but-unpolled peers and builds a transcript-only row for each from the conversation list alone (hasSession false, hasUnread from the transcript), no network call; useChatsPageClientState passes them (listed minus polled). c429-b (sonnet): the poll-set hook tests no…

Chat 429 root cause and fix, reviewers running (fix-queue tick) · 46d376b

The Chats inbox no longer polls the chat session of rejected or degraded peers (production: "Too many chat session reads", owner report 2026-10-26) · 4cc81f5

Root cause (read in code, counted read-only in production): isPeerVisibleInConversationsInbox keeps terminal peers listed, and the poll set of useChatStatus and useChatSessions was built from the same rule, so the inbox read GET /api/chat/session for every rejected connection twice every 10 s. The test account of the report has 68 connections, 67 of them rejected (the admin delete of test accounts ends connections as rejected): about 134 reads per 10 s against the per-user budget of 60 a minute (chat_session_read)…

T2f twice green, t2i started (fix-queue tick) · d5199ae

T2f run 1 green, run 2 started (fix-queue tick) · 5339df1

Batch 5 offline gate complete, browser tier t2f run 1 started (fix-queue tick) · 6aa7dd8

Gate part 1 result, one red fixed, part 2 running (fix-queue tick) · da7f9d0

Only the real provider reads the by-hand acknowledgement; stub and fake worlds never do (batch 5 gate: test_f5 red) · 7ffc169

The full-sha rule for the commit under test (review bh-crit-s F1) made every stub run with a short fake sha fail in classify, because compose/root.py wired the committed deploy/migrations-by-hand.yaml into all providers (review bh-crit-b F8 had flagged the coupling). assemble() now takes the acknowledgement as a parameter; build_orchestrator passes it only for provider real. Regression test: a malformed file in the repository root does not turn a stub or fake run red.

Final gate restarted at the layering fix (fix-queue tick) · 640bb7e

The pin tool asks the pipeline validator through a module call instead of importing cicd (architecture scan: tooling may not import cicd layers) · 8f1686e

Final offline gate running at c5177bf16, cleanup slip (fix-queue tick) · 664286f

By-hand acknowledgement review lows: full-sha head, path whitelist, release record names the lifted paths, pin tool hardening (reviews bh-crit-b and bh-crit-s) · c5177bf

bh-crit-s (sonnet) ACCEPT and bh-crit-b (fable) ACCEPT-AFTER-FIXES, only LOW findings, all reproduced: - load_by_hand refuses a commit under test that is not a full sha (an empty one read the git index, a short one could be shadowed by a tag); blob_at uses --end-of-options and logs git's own failure with its exit code and stderr; schema true is not schema 2. - validate_by_hand accepts only a plain src/apps/api path of letters, digits, _ . - (no //, ./, trailing slash, #, NUL, look-alikes, upper-case prefix); the r…

By-hand code review result, waiting for the sonnet re-review (fix-queue tick) · 20376bd

By_hand reads git through the adapter process helper, not subprocess in the compose layer (architecture scan) · d2db16b

Reviewer tier order memorised, by-hand review fixes, next steps (fix-queue tick) · 2628d46

The by-hand acknowledgement is pinned to the reviewed file contents and refuses the runner, the framework, documents and globs (review bh-crit-a, two MEDIUM) · 2eb1747

bh-crit-a reproduced: (1) the acknowledgement listed paths only, so a second migration registered inside a listed file (registry.ts) shipped by image swap; (2) validate_by_hand accepted the migration runner and framework (runMigrationsCli.ts, MongoMigration.ts, scripts/run-migrations.ts, scripts/migrations/*), which the bridge executes from the image. Fix: schema 2 maps every listed module to its reviewed git blob and load_by_hand(repo, base, head) applies it only while each blob is unchanged at the commit under t…

Batch 5 release path decided (by-hand acknowledgement), table row 13, reviewers running (fix-queue tick) · f8e88ce

A one-range acknowledgement lets migration code that is run by hand ship with an image swap (batch 5 release path, design critic b5-path) · 49cf0c2

Batch 5 changes the api migrations folder, so the plan classes it migrating and the bridge cannot release it (reproduced by the design critic: the three listed migrations are already applied, the bridge rehearsal ends STOPPED at "already_applied"; no run mode ships a migrating range as an image). The only new migration is a one-off repair run by hand with explicit selection, and no runtime code reads what it writes. deploy/migrations-by-hand.yaml (schema 1, deployed sha, migration ids, migration code paths) is the…

Api-unit red is a load effect, queued; final gate with fewer parallel jobs (fix-queue tick) · 5c360c6

Batch 5 gate red in three steps, two fixed, api-unit under diagnosis, release path question to a critic (fix-queue tick) · a1e70b9

The chat page state test stands in for the new by-id peer hook, like its other collaborators (batch 5 gate: 25 tests had no QueryClient) · 819368d

The release plan bridge-entry gate reads the real bridge.yaml (expected, not a missing migrations field) and has a test against the real file (batch 5 gate) · 283cc73

The batch 5 change touches the api migrations folder, so the plan classes it migrating and ran the gate for the first time: BridgeConfig has no migrations attribute (AttributeError). The plan tests faked the collaborator, so nothing had run the real read. bridge_has_entries is now a module function with a seam test.

Gate still running, pipeline page fixed (fix-queue tick) · 3d43b14

The pipeline page survives a record that lacks a stage, closes its file, logs success at info, says it is built from untracked files (fix-queue item 9, PIPELINE-PAGE) · 168dfda

Positive and negative tests: a newest production record without the verify stage still builds and logs the gap; the limits text names the untracked sources.

First gate red fixed, gate rerun, slip about worktree remove (fix-queue tick) · 2c4b22b

Two new lint errors from item 3 (a React Compiler memo dependency and an unnamed test wrapper) found by the batch 5 gate (lint ratchet) · 60ca1bc

Batch 5 offline gate running in the clean copy (fix-queue tick) · 76020b6

The evidence check knows the inputs gate-worktree.sh linked, so a clean gate copy is evidence (batch 5 gate, first real use) · 53e3edc

The first --final in a gate worktree refused: its own links to ignored folders counted as untracked source. gate-worktree.sh now names the links in the worktree private git folder and the check exempts exactly those untracked symlinks. Seam test: real script, real verdict.

Review outcomes of items 8 and 12, batch 5 code complete (fix-queue tick) · bd71228

Item 12 review fixes: a mailbox release frees a second sign-in identity, the release has its own limit and takes the mailbox in the body, audit log, exact count (fix-queue item 12) · 24a1c92

Critics i12-crit-a (opus) and i12-crit-b (fable), both ACCEPT-AFTER-FIXES: - MEDIUM a release did not free the same person's second sign-in identity: an admin delete now records the verified NextAuth identity mailbox on a row without a stored mailbox (readVerifiedNextAuthIdentityEmail), so the mailbox release frees all of them. - MEDIUM the release shared the 3-per-hour delete limit: it has its own limiter (10 per hour); it is now POST /api/admin/profile-tombstones/release with the mailbox in the body (the URL lin…

The evidence verdict counts every uncommitted path that can change a result, notices a change during the run, treats a partial run as no evidence (fix-queue item 8 review fixes) · de2c82c

Critic i8-crit reproduced three MEDIUM holes: src/ was the wrong scope (an uncommitted scripts/ or deploy/ edit still gave evidence), known-dirty.txt hid a dirty source file, and the verdict was taken before the steps. Now: every dirty path counts except runs/, plan/knowledge-base/ and docs/notes/ (not the known-broken ledger); known-dirty is gone from the verdict; the dirty set is read again after the run; --stop-on-red and --only are partial runs; porcelain is read with -z --untracked-files=all (renames, odd nam…

Comment only: no test can check a comment, the exception is recorded in the table. · 7d11717

The evidence test stages its throw-away repo by folder name, not with the denied add-all argv · 34dd75e

Items 8 and 12 built, critics running (fix-queue tick) · 95feae7

The test runner says when a run is not evidence of its commit, --final refuses a dirty src tree, and one script links the gate worktree (fix-queue item 8) · 84a2bb3

A gate run over uncommitted paths under src/ tested code no commit holds (a clean worktree gate had been mixed with the live folder several times). Each summary now carries evidence {is_evidence, reason}; a message names a non-evidence run; --write-baseline refuses it; --final refuses to start; docs/notes/known-dirty.txt prefixes are not counted. gate-worktree.sh link/unlink replaces setup_worktree_links, link_skills and link_extra and includes both generated zod folders. The stop-on-red test file, which was never…

A removed account gets a plain notice with sign-out, and the admin delete says it writes removal records, can skip them, and a mailbox can be released (fix-queue item 12) · f40d58e

Owner report 2026-10-26: after the admin delete of test accounts the owner could not sign in or register again and the app said "We couldn't load your match profile, check your network". - Web: a 403 PROFILE_AUTH_UID_TOMBSTONED on the profile read shows AccountRemovedGate (what happened, sign out, no retry) instead of the network message; five locales. - API contract: DELETE /api/admin/profiles takes allowReregistration (default false = the tombstone stays, so the ban bypass stays closed) and answers tombstonesWri…

Items 4 and 7 built and reviewed, review outcomes, next steps (fix-queue tick) · aa56616

Item 4 arbitrator fixes: flip parity from the window start and end, chain end checked, unreadable history counted, cutoff required for the dry run too (fix-queue item 4) · 3cb30e9

Arbitrator rk-arb (LAND-AFTER-FIXES) reproduced that the repair compared the rebound person with the peer's LIVE value, so a peer rebind after the cutoff left the sides wrong and stamped the row as repaired. - The flip is (aStart < bStart) !== (aEnd < bEnd) from the two participants' values at the start and end of the window; both-rebound pairs are decided the same way (N1). - A participant's chain from its first window entry to its current value must have no gap, else history_chain_broken (N4). - An entry whose r…

Item 7 review fixes: an ADMIN_EMAILS that names nobody revokes nobody, one role decision for sign-in and every request, guarded role write (fix-queue item 7) · b03851a

Reviewers rv-r1-a (ACCEPT) and rv-r1-b (ACCEPT-AFTER-FIXES) reproduced that an unset, blank or semicolon-separated ADMIN_EMAILS demoted every env-granted admin and stored it. - An empty list revokes nobody, logs one admin_emails_empty error per window, and server.ts warns at boot (adminEmailListIsEmpty in platform-role, warnIfAdminEmailsNamesNobody). - decidePlatformRoleForDoc is the single decision for the every-request resolution and the sign-in provisioning path, so an unproven-marked env admin is demoted at si…

Item 4 rework after both reviews: shape-preserving per-side swap in the executor, and the repair decided per row from the participants' own history (fix-queue item 4) · 02fbcd0

Executor: connectionPerSideSwap rebuilds the consent objects from $objectToArray minus the owned keys (a missing key stays missing, a null stays null, no duplicate consent), with tests for the missing-key flip, null, side-B/new-first and odd shapes. Repair: no global old-to-new map. Per row, history entries between createdAt and the cutoff; skip with a counted reason (held by another profile, broken chain, both rebound, no createdAt, already repaired); flip derived against the live peer; A/B fields swapped; guardM…

An admin granted by ADMIN_EMAILS is revoked when the mailbox leaves the list or the identity is marked unproven (fix-queue item 7, audit F2 and F5) · 1c67797

The promotion by ADMIN_EMAILS now records its source (profiles.platformRoleSource "env", on a new row, an existing user row and in the per-request resolution). An env-sourced admin whose mailbox is no longer in the list, or whose identity carries an unproven mailbox mark, is demoted on the next resolution, and the source is cleared. An admin granted in the database has no source and is never revoked by the list; a legacy admin without a source is treated as a database grant (the only production admin is one). Each…

The owner login hotfix (four tombstones removed in production), item 12 for the admin delete, item 4 review outcome · cb7925b

A connection row whose canonical peer is the viewer itself is dropped with one warning (fix-queue item 6) · 00bc0b6

The production log showed the canonical-peer invariant error every ~12 s for one viewer whose canonical peer was the viewer. A read-only trace on 2026-10-26 found no such row in the data (2278 connection rows, ids resolved through profiles and authUid history: 0 self-pairs) and no log line in 48 hours, so the cause was a transient mapping. The canonical dedupe now drops such a row at the lookup, once per call, and no longer keeps it as the best row of a group. Tests (positive / negative): viewerPairDedupe.selfPeer…

A rebind that flips the sorted order of a pair carries the per-side consents with their person, and a one-off repair of the rows damaged earlier (fix-queue item 4) · fac95cc

The connection rekey wrote userAId/userBId in sorted order but left the per-side state where it was, so after a flip the person's consent sat on the peer's side (production: a pending request showed the requester with userAConsent null and the recipient with userBConsent true), and requestedBy still named the displaced authUid. The connections update is now an aggregation-pipeline update: consents inside conversationConsent and chatConsent and the vibe-check taps swap when the order flips, requestedBy/rejectedBy a…

The discovery list makes no automatic page load for a list the parent emptied, plus the real error shape test (fix-queue item 3, referee dv-arb) · 6f8ec69

The referee (fable) reproduced one more medium defect: the automatic empty-list load also fired for a viewer the PARENT emptied (journey bank incomplete, no matching signal, or still loading), who got up to 4 page loads, a skeleton instead of the call to action, and the 8 s poll re-requesting 5 pages. The load effect and the skeleton condition now exclude isLoading, viewerJourneyGated and viewerDiscoveryGated. The by-id hook test now also uses the real DiscoveryRequestError(cause: ApiError) shape. The ConnectionDe…

Bounded automatic loading of an empty list, a connection detail that waits for its peer lookup, and a failure that is not "not found" (fix-queue item 3, reviewer dv-r1-a) · ed5e9c8

Reviewer dv-r1-a (opus) reproduced two medium defects. M1: with every row filtered away on the client, the list walked the whole server pool by itself (66 peers: 5 requests, 1000 peers: 67 requests), and the 8 s poll re-requests every loaded page, so a gated viewer could exhaust the 60 reads a minute shared with the by-id lookups. The list now stops after 4 automatic loads while nothing is visible and shows the empty state, a changed filter starts the bound again. M2: the connection detail screen said "Profile not…

A peer refused after a successful by-id load disappears, and the list view asks for the next page once per settled page (fix-queue item 3, review fixes) · 946e167

Reviewer dv-r1-b (fable) reproduced two defects. F1 (privacy): TanStack Query keeps the old data when a refetch is refused, so a peer who blocked the viewer, hid, or was dismissed after one successful by-id load stayed in the inbox and the connection detail. The hook now keeps only queries in the success state, so the row falls back to the connection-only stub like a peer the list drops. Capacity: the list view's load-more effect depended on the callback identity, and a parent that passes a new arrow each render r…

The connection detail screen fetches the opened peer by id when it ranks below the discovery window (fix-queue item 3, F2) · c374f9e

The detail screen read the same top-50 window as the inbox, so a connected peer ranked below it showed as not found. It now adds the peer to its profiles through the by-id hook of the inbox fix. Covered by the hook's own tests (each id once, refused lookup dropped), the typecheck, the architecture guards and the 23 connections test files; there is no render test of this screen today (queued).

The chat inbox fetches connected peers ranked below the discovery window by id, so they are no longer shown as "unavailable" (fix-queue item 3, F2) · f85ded0

The design reviewer (fable) found that the inbox read only one window of the ranking (the top 50 rows). A connected peer ranked below it, for example a member who sent a request from rank 66, became a connection-only stub and showed as "Conversation unavailable" although the member exists. A selector names the visible inbox peers (a request or later, or a conversation row) that the window lacks, at most 20, and a hook fetches each with the existing by-id endpoint; the profiles join the rows of the inbox builder. A…

Discovery visibility design review, decision and follow-ups · 48fa0e9

The discovery list asks for the next page when its visible list is empty, and a production-shaped pool test (fix-queue item 3) · 46a49fa

Design reviewer dv-crit (fable) reproduced a dead end: the List view skipped its load-more request when the visible list was empty, so a first page emptied completely by the client gates (strict intent scope, signal overlap, client-only filter keys) never fetched page 2 although the server had more rows, and a peer ranked below it was unreachable. The effect now asks for the next page, and the view shows the loading state instead of "No matches yet" while more pages exist. The 3D Universe stays a 10-peer highlight…

Production run 8909743a7dab (batch 4, realtime match recalculation, three reviewed fixes, admin promotion proof), pushed to origin; ledger tick · 2ec5059

The independent check before the push, its findings and decisions · 100d731

The public release notes redact e-mail addresses in commit text · 5d20c2c

The independent check before the push found two commit bodies that name real mailboxes. The pre-push hook copies commit bodies into the release-notes bundle, and the page is readable without login, but the sanitizer had no rule for e-mail addresses. It redacts them now, in subject and body, before the other replacements. Credentials in URLs keep their own rule. Tests (positive / negative): sanitizeReleaseNoteText: two addresses in one sentence and in a built summary are redacted / text with "user@", "@mentions" an…

Batch 4 is in production, evidence of the release and the refreshed pipeline dashboard · 499d86c

Run 20261026T071530Z-8909743a-267e82 green, readonly-check 6 of 6, snapshot 19 containers 0 findings, live read-only checks in the ledger.

Batch 4 gate record, the offline, browser and integration tiers on the exact code, and the 429 retry backlog entry · 8909743

Two real-Mongo tests seed their mailbox owner as confirmed, since an unconfirmed email is no longer stored (fix-queue item 2) · 0cc77d0

The gate's real-Mongo step found two files that seeded the victim or owner profile with an unconfirmed email and expected it stored. The seeds now pass checkEmailTombstone (the mailbox was confirmed by its owner). The attacker side of both files is unchanged and still passes an unconfirmed email. Tests (positive / negative): profileProvisioningEmailLinking (9 cases: no rebind without trust or consent) and ProfileService.updateProfile (the email conflict error), 13 tests, green.

The release command tests use a fixed clock, so the gate no longer goes red inside the daily api cron window · 157a963

The offline gate on 2d31d5ee3 ran at 04:53 UTC and 8 release-command tests failed: they read the real clock, and the release plan correctly refuses a start within 25 minutes of the 05:00 UTC api cron. The unit tests now pass a fixed clear clock (12:00 UTC). The one seam test spawns the real command and cannot inject a clock, so it skips with the refusal as its reason when the clock is inside the window (the release itself is refused there as well). Tests (positive / negative): test_release_command, 28 tests, now i…

Fix-queue items 0 to 2 approved in code, batch 4 goes to the release gate · 2d31d5e

Claude-Session: https://claude.ai/code/session_01RH2PDQaru2uEQqBSwHZBQ8

No unproven email claim is stored on a profile row, the referee's final rule for the admin promotion (fix-queue item 2) · 0a55c95

The referee (fable) found that the listed-only rule judged the mailbox at write time: a mailbox planted unverified while unlisted, and listed later (new admin onboarding, mailbox rotation), still reached admin through passkey sign-in (A-1, reproduced). Every production caller already passes the token's trust verdict or a proven mailbox, so the broad rule costs no production flow. getOrCreateProfile stores no unproven email, POST /api/profile refuses one (400 PROFILE_EMAIL_UNVERIFIED), a call that proves the mailbo…

Batch 4 items 0 and 1 approved by the referee, item 2 fix built and in its referee review, backlog and ledger · fdcbd5e

Claude-Session: https://claude.ai/code/session_01RH2PDQaru2uEQqBSwHZBQ8

An unproven claim on an ADMIN_EMAILS mailbox is never stored, and the referee's small follow-ups (fix-queue items 0 to 2) · 2a0eece

Item 2, first review (opus) finding F-A, reproduced: a stored unverified listed mailbox was a credential. Passkey sign-in finds a row by mailbox and answers the stored mailbox back, the web session presents it as trusted, so the planter became admin. Now provisioning never writes an unproven claim on a mailbox that grants admin, and POST /api/profile refuses it (400 PROFILE_EMAIL_UNVERIFIED). Unlisted unverified mailboxes behave as before; proven ones are stored and promote. Design note updated (decision, known li…

Item 2 review follow-ups, a withheld admin promotion is logged and the reviewer's attack suite is a test · 2fc1650

The second reviewer (fable) accepted 549d9f71b with three LOW findings. LOW-2: a withheld promotion logs one warn per identity per 10 minutes, no mailbox value. LOW-3: two stale comments corrected (platformRbac header, internal_access_token). LOW-1 (web session refresh never promotes, heals on the first API call) is accepted as a documented lag in the design note. The reviewer's 11-case attack suite is adopted as a committed test. Tests (positive / negative): - platformRbac.unprovenPromotionLog: unverified listed …

The match sort is a total order, equal scores sort by peer id (fix-queue item 3, tie order) · 7c5e42f

With equal percentage and equal calculatedAt (a nightly batch stamps many rows in one millisecond) the order was the database scan order, so a peer could move between pages from one read to the next. The final key is the peer id, compared by code unit. Tests (positive / negative): discoveryMatchRowPipeline.tieOrder: output independent of input order, a 40-peer tied list walked in pages shows every peer once / a higher percentage and a newer calculatedAt still win over the peer id. Claude-Session: https://claude.ai…

Review fixes of batch 4 round 1 (change stream, realtime flag, account link, admin recalculation) · bc6e80a

Reviewers b4-crit-a (opus) and b4-crit-b (fable) rejected 20f30b7ef with two MEDIUM findings each; every reproduced finding is fixed: - A-F1 / B-F3: the missing-inbound completion is opt-in (completeMissingInbound), on only for the debounced scheduler; the nightly batch and the admin recalculation keep refreshing existing rows, so the committed includePeers test is green again and no pair is calculated twice. - A-F2: after an account link the member's outbound match rows move onto the new authUid before the recalc…

Two billing route tests keep the real platformRbac module, so provisioning finds the role constants (fix-queue item 2) · 5619bff

The full api unit run after 549d9f71b found two suites whose hand-made platformRbac mock lacked PLATFORM_ROLE_USER, which the proof rule now reads when a new row is created. They use the shared withPlainUserRoleStubs double (real module, two stubbed functions), as the double's own doc recommends. Tests (positive / negative): billing-checkout-portal-rate-limit and billingCheckoutUrlAllowlist, 8 tests, green again. Claude-Session: https://claude.ai/code/session_01RH2PDQaru2uEQqBSwHZBQ8

An ADMIN_EMAILS mailbox promotes to admin only when the call proves the mailbox (fix-queue item 2) · 549d9f7

One owner (platformRbac: effectivePlatformRoleWithMailboxProof, isMailboxProvenForPromotion) decides. The three promotion places use it: every-request role resolution, provisioning (new row and existing row) and the ensureProfile path. A stored admin keeps its role. POST /api/profile copies the token email onto a row with none only when the token vouches for it. Tests (positive / negative): - adminPromotionNeedsProvenMailbox (real Mongo): token-verified and one-time-code listed mailbox create admin, promotion afte…

Fix-queue loop state, item 0 committed and round-1 critics running · 3093ea0

Claude-Session: https://claude.ai/code/session_01RH2PDQaru2uEQqBSwHZBQ8

Realtime match recalculation, on by default, switchable live in Admin > Feature flags (fix-queue item 0) · 20f30b7

Why: in production the route trigger was off by design and the profiles change stream was the ONLY trigger; it was dead for days (poisoned resume token), so no edit was recalculated and new members waited for the nightly batch. What: feature flag `realtimeMatchRecalculation` (contract without service import, registered, seeded ON at boot and never overwritten); the scheduler checks it when the debounce fires (OFF: nightly batch and the Admin recalculation only; a missing row or a failing read FAILS OPEN and logs a…

Ledger tick 87, the owner-ordered deletion of the four gmail accounts in production · a3ef062

Claude-Session: https://claude.ai/code/session_01RH2PDQaru2uEQqBSwHZBQ8

The fix-queue loop and the researched design of realtime match recalculation as a live Admin switch · 342f7ff

Claude-Session: https://claude.ai/code/session_01RH2PDQaru2uEQqBSwHZBQ8

An account link schedules a match recalculation, so the linked account no longer sees an empty list and "Conversation unavailable" · c609ddd

Production finding (account [redacted email], which linked a second sign-in at 2026-10-26 01:44 UTC): the link moved the authUid, the connection rows were rekeyed, but the viewer's own `matches` rows stayed under the OLD authUid (66 rows, newest 25 Oct 02:00) because the rekey excludes `matches` on the promise that the scheduler recomputes them, and a rebind is no match-relevant profile change for the change stream. The discovery list was empty, the chat inbox built a connection-only stub for the pending request (…

Recalculate matches live in both directions, by auth uid or by email (Admin, Match Management) · 78e6e36

What existed: Admin > Match Management > Recalculate has "my matches", "this user" (by auth uid) and "all users". The one-user run writes member -> peers and only refreshes inbound rows that already exist, so a new member stayed invisible to everybody until the nightly batch (production 2026-10-26: 67 outbound rows, 0 inbound). New: POST /api/admin/recalculate-matches accepts `email` (resolved to the member, 404 if unknown) and `includePeers`; with it, materializeInboundMatchesForMember writes every candidate peer…

Ledger tick 86, production hotfix by data for the change stream · a29a4a1

Claude-Session: https://claude.ai/code/session_01RH2PDQaru2uEQqBSwHZBQ8

Ledger tick 85, the change stream finding and fix · 62d654c

Claude-Session: https://claude.ai/code/session_01RH2PDQaru2uEQqBSwHZBQ8

The profiles change stream recovers from a dropped collection, so profile edits trigger match recalculation again · b6e965c

Production finding (viewer [redacted email] saw an empty Universe and list): the profile was ready for matching but had no match rows, because in production edits are recalculated only through the profiles change stream (route-level scheduling is off when NODE_ENV=production), and that stream had been dead: the profiles collection was dropped on 2026-10-22, the stored resume token (2026-09-21) pointed before the drop, every resume ended about 2 s after the start with no error (the pipeline filtered the invalidate …

Batch 3 pushed, landing checker findings queued, ledger tick 84 · 2c77418

Claude-Session: https://claude.ai/code/session_01RH2PDQaru2uEQqBSwHZBQ8

Production runs deafd3a90089 (batch 3, admin Subscription Disable switch); pipeline statistics dashboard and tools; ledger tick 83 · 675e384

Production run 20261026T003223Z-deafd3a9-bd22f3 green in 7 minutes, rehearsal 20261026T002449Z-deafd3a9-b91891 green, read-only checks 6 of 6, snapshot 19 containers 0 findings (only the four deploy-set containers changed), live checks of the new admin route (401 without a session), the admin page redirect and the member page. Dashboard: scripts/pipeline_stats.py, scripts/pipeline_page.py (+ tests) and docs/research/pipeline-statistics.html rebuilt with the new run; made with the global trace-diagram tool. Claude-…

Arbitrator test gaps closed (tab mounts the card, ADMIN_EMAILS never decides, non-object bodies), review record of the admin dev flag, ledger tick 82 · deafd3a

Positive: the tab mounts exactly one developer flags card / negative: a mailbox in ADMIN_EMAILS with stored role user and a stray flag gets no lift, bodies [true], "true" and 1 are refused with 400. Review record docs/notes/reviews/admin-dev-flags.md: audit, two round-1 critics, arbitrator LAND. Claude-Session: https://claude.ai/code/session_01QuhmGtffsBXMjU4FZysDVJ

Real admin route, role guard, dev flags service, entitlement service and the daily chat-start quota in request-conversation. · 29cec99

Positive: an admin with a spent quota is refused, admitted after the flag is on (nothing debited, stored tier untouched), refused again after it is off. Negative: a plain user with a stray stored flag gets 403 on read and write, the row is unchanged and the user stays refused; a stored admin without a mailbox gets 403 and no lift. Claude-Session: https://claude.ai/code/session_01QuhmGtffsBXMjU4FZysDVJ

F2 (MEDIUM): the checked-in axios client was stale (generatedApiAxiosClientFreshness red): regenerated. · 642e8f2

F4: the tier is resolved only inside the two stackable quota branches, so the other quotas no longer cost two extra profile reads; the stale "no Mongo round-trip" comment is corrected. F6: the dev flags service applies the same effective-admin rule as the lift and the routes (a stored admin without a mailbox reads and writes nothing). F5, F7: tests for the demo bypass lifting journey caps and chat starts, the emailNormalized-only mailbox, the weekly super likes lift, the read budget and a failed save. Tests (posit…

Review round 1 of the admin dev flag, security critic (admin-crit-sec F1, F2, F3, F4, F6, F7, F8) · d8c9301

F1 (MEDIUM): PlatformSettingsTab.test.tsx was red (6 of 6, green on the parent): the tab now mounts the card; the test stubs the card, which has its own test. F2: the switch refreshed ["entitlements"], a key no query uses; it now refreshes the viewer's userEntitlements snapshot. F6: a refused read (guard said admin, no admin row) logs a warning like the write. F7: PUT refuses an extra body key with 400 (checked by hand, a Fastify body schema would coerce "true", 1 and null). F3, F4 and F8: comments say what the co…

Batch 2 pushed, plan check-offs with evidence, discovery visibility report, ledger tick 81 · 0289e5b

Plan: W25.3.a/b, W25.4.c, W25.5.a-d, W25.6.c checked by their own verify; stories W25.1, W25.3 to W25.6 and W25.12 closed with evidence notes. W25.3.b's verify now clears the fixture tombstones and runs through the spec runner (the bare playwright call could not resolve the base URL). Report: docs/research/discovery-visibility-and-freshness-2026-10-25.html (process trace, sequence, data trace, findings, freshness table), generated by the trace-diagram tool from the spec next to it. Backlog: DISCOVERY-VISIBILITY ro…

The journey caps lift with the limits, and the lift needs an effective admin (admin audit F3, F4) · 79d35c9

F3: getEntitlementSnapshot built the journey caps from the stored tier, so an admin with Subscription Disable still hit the reflection and connection caps (the demo bypass had the same gap). The journey now uses the lifted tier from limitTierIdFor. F4: the lift read the stored role only. It now applies the same rule as the admin routes (effectivePlatformRoleForProfileEmail): a stored admin without a mailbox is a plain user. Backlog: the other audit findings (F1 unverified-email promotion HIGH, F2/F5 env revocation…

Per-admin Subscription Disable flag, lifts every subscription limit for the admin's own account · a43f42c

One owner (EntitlementService.limitTierIdFor) decides the limit tier for the snapshot and for the stackable quota paths (daily chat starts, super likes), which ignored the demo bypass before. The lift needs the stored role admin AND adminDevFlags.subscriptionDisabled true (default off). GET|PUT /api/admin/me/dev-flags: admin only, own account only, role filter inside the query. Switch in the Admin menu, Platform Settings tab; copy only in the admin bundle (admin.devFlags.*). Tests (positive / negative): - entitlem…

The bundle after the WAVE-25 batch 2 commits (5725 entries) · 3aa8a5f

Regenerated last with `npm run generate:release-notes` (generated file, no hand edit); the product semvers match. Claude-Session: https://claude.ai/code/session_01QuhmGtffsBXMjU4FZysDVJ

The exit demo of WAVE-25 (W25.8): runs, comparison with REQ-25-001 to 009, R-BUILD score 9.0 of 10 · 9745537

The second green journey run needed `clear-fixture-tombstones` first (the ban rule refused the shared test mailbox: an environment state, proven by the api log line); the spec header now says so. Backlog: the release classifier counts runs/ files as image changes (item with its test pair), and what the W25.12 acceptance rests on. Claude-Session: https://claude.ai/code/session_01QuhmGtffsBXMjU4FZysDVJ

Production runs 9708f17b77a6 (WAVE-25 batch 2); records, ledger tick 80 · ba0b905

Rehearsal run 20261025T192443Z-9708f17b-902dd9 green, image deploy run 20261025T193628Z-9708f17b-6f8ef9 green in 28 minutes. Read-only checks 6 of 6, snapshot 19 containers with 0 findings, only the four allowed images changed, live pages checked in a browser. Records, README rows, atlas paragraph, ledger tick 80, run index. Claude-Session: https://claude.ai/code/session_01QuhmGtffsBXMjU4FZysDVJ

Reviewer w258-css2-critic: ACCEPT, lows only. · 9708f17

The globals.css comment said "no .git" plays a part and that `build` is read; both were wrong: Tailwind honours every .gitignore from the app up to the nearest .git; the repo-root rule for .next-* does not reach the app in the Docker build context or below a stray .git; `build` is covered by the app own .gitignore (defence in depth). Comment only in globals.css (the generated sheet is unchanged). Tests (positive / negative): tailwindIgnoresBuildCaches: Docker layout case (.next-<name> garbage: 0 control characters…

The review record of the web build fix and the tool-library commit named by its title · c0bd589

The tick check refused the commit id of the tool library inside this repo. Record of review W25.8 round 1 (rounds.tsv, reviews README). Claude-Session: https://claude.ai/code/session_01QuhmGtffsBXMjU4FZysDVJ

The Tailwind build fix, second round: the real trigger was a stray src/.git, and the test is now self-contained (W25.8 review) · e9b9ec7

Reviewer w258-css-critic (opus) REJECTED 8e18d1ed0: the two `@source not` lines are right and harmless, but my diagnosis and my test were wrong. - Real trigger: a stray `src/.git/` folder (written 2026-10-25 14:38 by `commit-paths` run from `src/`; one 593-byte error log of my own failed commit). Tailwind reads `.gitignore` files only up to the nearest `.git`, so the repo-root rule for `.next-*` stopped applying and old binary cache folders fed bytes into the style sheet. `.next` itself is skipped by Tailwind anyw…

Tailwind no longer reads the Next build caches, which broke the Turbopack build (maintainer gate) · 8e18d1e

The maintainer gate step `npm run build` failed on be64ba1a3 with "Parsing CSS source code failed: Unexpected token Delim('\u{10}')" in globals.css, alone and again. Cause, found with Tailwind's own PostCSS plugin on globals.css: it scans every folder below the web app, git-ignored ones too, and the binary build caches (.next, .next-*, build; .sst files, 2.6 GB in .next after a day of stack runs) hold text such as `calc(100vw-` followed by binary bytes. It wrote classes with 324 control characters into the style s…

Owner rule: every dependency on the latest version. · be64ba1

`pnpm outdated -r` listed this one package for the whole workspace (api, simulation worker, matching and ml-service report nothing). pnpm up, then scripts/regen-npm-locks.sh web (npm ci --dry-run proves the lock the image installs), lock parity script OK for api and web. Tests (positive / negative): positive: web typecheck clean and the design-system and ui atomic folders 733 passed; negative: lock parity and `npm ci --dry-run` fail on a manifest and lock that disagree (the check ran green on the new pair). The we…

The fixes of the second review of the push chain: skip on next dev, a proven focus check, raw bytes and exact status (W25.4.c) · a39bce8

Reviewer w254c2-critic (opus, read-only) on 97d2750a9: ACCEPT-AFTER-FIXES, one medium and five lows. Record: docs/notes/reviews/w25-4c-push-chain-and-specs.md (round 2). Defects and their tests (positive / negative): - M1 the service worker spec cannot pass on the next dev server of tier t2 (the app registers no /sw.js there). The spec waits at most 20 s for a registration and skips with the reason; [redacted].test.ts: positive (production registers /sw.js with scope /) / negative (development registers nothing an…

The fixes of the second round on the journey spec and of the first review of the push chain (W25.3.b, W25.4.c, W25.2) · 97d2750

Two reviews, both read-only opus reviewers. W25.3.b round 2 (w253b2-critic, ACCEPT, lows only) and W25.4.c round 1 (w254c-critic, ACCEPT-AFTER-FIXES, two medium). Records: docs/notes/reviews/w25-3b-journey-and-fixes.md (round 2), docs/notes/reviews/w25-4c-push-chain-and-specs.md. The session-switch lows of W25.2 are done in the same change. W25.4.c (push chain). The web test pinned a payload the api does not send (it left out data.senderAuthUid). Now the bytes are shared fixtures src/packages/contracts/fixtures/pu…

The simulator tool packages on the latest of every dependency, majors included (batch 2) · 3c7ddab

Owner rule: all code dependencies are on the latest version. The product packages were already current (api, web, simulation worker, matching, ml-service all report nothing outdated except react-resizable-panels 4.14.8 -> 4.15.0 in the web app, done in its own commit). The two tool packages lagged by several majors: typescript 5.9 -> 7.0.2, vitest 2.1 -> 5.0.5, @types/node 22 -> 26.6.5, @anthropic-ai/sdk 0.124 -> 1.3.0, dotenv 17 -> 18.0.9, playwright 1.63 -> 1.64.1, @cursor/sdk 1.0.31 -> 1.0.40, tsx 4.23.13 -> 4.…

The fixes of the first review of the journey spec: a real end-connection check, stronger guards (W25.3.b, W25.6.c, W25.5.d) · 54b914f

The reviewer (opus, read-only) rejected b958a4697 on one medium finding and eight lows. Everything it reproduced is fixed with tests, the rest is queued. Record: docs/notes/reviews/w25-3b-journey-and-fixes.md. Defects and their tests (positive / negative): - F1 medium, the end-connection step passed when the end failed. Fix: the helper waits for the end-connection answer and requires ok, B must see "Conversation ended". The journey spec is the regression check: green alone on the local stack (run 20261025T150613Z)…

The intent scope on a new device and a degraded thread at two sizes (W25.4.c) · fb8026b

Two browser specs on the local stack, plus a stage option in the thread stub helper. Tests (positive / negative): - positive: a member on a new device gets the saved intent scope read back from the profile, no gate shows, and the scope is written to local storage - negative: a profile without a scope shows the gate - negative: a failed profile read shows the restore error text and no gate - positive: a degraded thread renders its header at desktop and phone size - negative: the degraded thread shows no legal name …

A conversation request reaches the recipient's stored subscription as one Web Push, and the web shows it (W25.4.c push chain) · 6c3b815

Two tests close the chain from the request to the notification, with the only mock at the network edge (web-push sendNotification). Api half (real Mongo replica set): route, block check, privacy gate, connection push dispatcher, preference and locale reads, notifyUserAcrossChannels, WebPushNotifier with its endpoint policy and the subscription store. The dispatcher call is wrapped only to keep its promise, so the test waits for the dispatch instead of sleeping. Web half: the same payload shape through parsePushPay…

The full journey of a new member in one spec, and the coverage test of the HAR evidence base (W25.3.b, W25.6.c) · b958a46

tests/e2e/integration/universe-to-chat-full-journey.spec.ts walks one new member from an empty browser to the end of a connection, in the browser: nothing stored, a real sign-up with the email code of the local stack, onboarding, journey welcome, match-intent gate, the lab peers in the match list, the network budget of the match list and the chat inbox (HAR, through the evidence base), Connect on a peer card, the peer's accept in a second browser context, the icebreaker in the product's turn order, the reveal on b…

The fixes of the first review of the shared constants (W25.5.d): the api poll-budget test, a stricter path guard, a wider interval guard · 9735727

The reviewer rejected on one HIGH (docs/notes/reviews/w25-5d-shared-constants.md): the interval commit moved CONNECTION_STAGE_REFETCH_INTERVAL_MS_CONSENT_PENDING out of the file that apps/api/tests/routes/connection-stage-poll-rate-limit.test.ts reads as text; that api test was red and unseen because only web tests were run. The test now reads src/lib/realtime/realtimeIntervals.ts. The slip and its mechanism fix (search the whole repository before moving a symbol, run the api suite when a web file moves) are recor…

The profile sheet asks the reveal policy, the chat header falls back to the list row's consent (W25.5.c second review fixes) · d212a07

The second privacy review approved 0106426d2 with lows (docs/notes/reviews/w25-5c-one-reveal-rule.md). Fixed: - L2: the profile sheet trimmed a padded stage (" chat_active") and showed the legal name while the policy refused; it now calls peerLegalNameAllowedForStage like its own picture-reveal control (no leak: the api tier-filters the name; one answer per stage inside one component) - L1: the sheet half of the gate-group fix is pinned by peerProfileSheetFollowsGateGroup.test.tsx (adopted from the reviewer's prob…

One module of journey steps that the dual-client and the full-workflow helpers call (W25.3.a) · 66f0e96

tests/e2e/helpers/journey_steps.ts holds what two helpers carried separately: the step runner with its BEGIN / END timeline and the optional Playwright test.step wrapper, the icebreaker step (driveIcebreakerStep), the completion dialog step, the private composer check, and the selectors the web specs and the humanoid simulator both rely on (JOURNEY_SELECTORS). dual_client_chat_active.ts and full_workflow_app_shell_e2e.ts call it. The simulator package may not import across the package boundary, so its literals (MA…

The stage action label is a typed map keyed on the stage type; the stage guard has one allowlisted file less (W25.5.d part 5: keys) · df815b6

getConnectionActionLabelKey was a `switch` with case runs and a default. It is now a `Record<ConnectionStage, ConnectionStageActionLabelKey>`: a tenth stage in the OpenAPI is a compile error here and not a silent fall-through. The anonymous blind chat has no label of its own and shows the neutral "view" label, as it did through the default (now an explicit entry). A value outside the nine (wire drift) still gets the neutral key and never throws. The stage guard (connectionStageLocalSetsInvariant.test.ts) loses its…

One table and one resolver from API wire codes to localized text; the second translator is gone from the chat safety handlers (W25.5.d part 4: errors) · 1aa993e

resolveConnectionTransitionUserMessage (relative `workflowErrors.*` keys, a `connections` translator) and resolveChatSafetyApiUserMessage (a root translator) are replaced by src/lib/utils/errors/apiErrorCodeMessages.ts: TRANSITION_CODE_MESSAGE_KEYS (typed on the package's transition codes), SAFETY_CODE_MESSAGE_KEYS and resolveApiErrorUserMessage(error, t, scope) with FULL next-intl keys and one root translator. Callers: mapChatApplicationError and useConnectionWorkflowErrorHandler. The chat safety handler family (…

The fixes of the guard review of the stage groups part 2 (W25.5.b): mixed chains, signature allowlist, binding table, normal-caller refusal, test prep · da828c4

The guard reviewer approved 3128a0ec1 with lows (docs/notes/reviews/w25-5b-stage-groups-2.md). Fixed: - the scanner reads a whole logical expression (mixed || and &&, parentheses) per subject, equal and not-equal counted apart; the positive case was red first - the allowlist records the signatures of the findings (kind and stage names), so a list that gains a stage fails - negative cases: two different subjects joined by || or by && with !== are not a tier - new stageGroupBindingsTable.test.ts: which group each of…

One typed factory for the connection stage body and the connection list row that the e2e stubs serve (W25.5.d part 3: stubs) · 33560c3

Three stub helpers (openers language note, chat header legal name, icebreaker complete dialog) each built the `GET /api/connections/stage` body and a `Connection` row by hand. tests/e2e/helpers/connection_stage_stubs.ts now builds both from the generated wire models (a required wire field the contract adds or renames is a compile error in the stubs, not a generic error screen with 200 responses). The helpers pass only what differs. The factory test found one stale stub at once: the openers row served `null` consen…

Every /api path literal of the web, the e2e specs, the simulation worker and the simulators is a declared path (W25.5.d part 2: paths) · f50f433

945 `/api/...` literals are written by hand in the web source, the e2e specs, the simulation worker and the two simulators. A renamed or mistyped route would only fail in a browser run. The guard reads them with the TypeScript parser and checks each against the product OpenAPI paths, the Next backend-for-frontend families (read from the folders of src/app/api, not typed) and three internal api routes listed with their reasons (dev-bypass-status, mobile-app-waitlist, resolve-platform-role). The first run found no s…

The chat consent now reaches the legal-name rule, and the full photo and the profile sheet read the same reveal group (W25.5.c review fixes) · 0106426

The privacy reviewer rejected 1825ad83b (docs/notes/reviews/w25-5c-one-reveal-rule.md): no live leak (the api withholds name and full photo below the full tier), but the consent check never ran in the app. Fixed: - transformToMatch and the chat thread enrichment pass the connection's chat consent to the rule (before: the stage only, so a one-sided chat_active showed the name) - the full photo choice (profilePictureStreamSelection) and the profile sheet read the gate group fullReveal instead of the literal "chat_ac…

One table for every realtime polling interval of the chat, connection and discovery features (W25.5.d part 1: intervals) · 435fc68

src/apps/web/src/lib/realtime/realtimeIntervals.ts now holds the 13 intervals that were typed in ten files: the connection stage poll (8 s) and its consent-pending cadence (2.5 s), the incoming requests poll (12 s), the discovery profiles refetch (8 s) and the stream-open freshness window (3 s), the match-intent heartbeat (5 min) and operator poll (30 s), the chat message (3 s), typing (1 s), session reload (10 s), status (10 s) and sessions (10 s) polls, and the peer presence recheck (30 s). The values are unchan…

The fixes of the first review of the stage groups (W25.5.b): a syntax-based guard, pinned bindings, three small gaps · 3128a0e

Both reviewers approved 807d23c3b with lows only (docs/notes/reviews/w25-5b-stage-groups.md). The lows are fixed: - the stage guard reads code with the TypeScript parser (stageAstScan.ts) and finds a list with casts, spreads or template literals, a type union, a case run, `.add` calls, `||` / `&&` tests and Yoda tests, and is not fooled by a regex literal or JSX text; it scans the api, the web and the simulation worker, and the two files that still hold a tier are allowlisted with exact counts and reasons (validat…

One reveal rule for the legal name and the full photo: the web rule takes the stage and the chat consents and equals the api tier rule (W25.5.c) · 1825ad8

The api decided "may the peer's name and full photo be shown" from the stage AND both chat consents AND agreedAt (discoveryTier.ts). The web decided it from the stage alone (peerNameDisclosurePolicy.ts). Now both read the gate group fullReveal, and the web function peerLegalNameAllowedForStage(stage, chatConsent) applies the consent when the surface has it (profile.chatConsent, null = no connection row refuses, undefined = a surface that carries no consent data: the api already withheld the name there, so only the…

The last 13 stage tier tests of the api and web read named groups; the guard now forbids them (W25.5.b part 2) · 56d87d3

Three new groups in the gate JSON: conversationCancelable (conversation_active, interested), blindChat (anonymous_chat_active, chat_requested) and peerBioVisible (conversation_requested, conversation_active, anonymous_chat_active, chat_active: the stages in which the peer's bio is shown, so the coming bio cut is one edit). 13 files that compared one stage value with several names (`x === "a" || x === "b"`) now call isInStageGroup with the SAME members: the transcript-append gate, the cancel replay check, the score…

Named stage groups in the gate JSON replace the local stage lists (W25.5.b part 1) and the fixes of the first review of the one stage schema (W25.5.a) · 807d23c

Stage groups: src/config/connection-stage-messaging-gate.json gets `groups` (trusted, pending, stranger, chatEligible, preRequest, ratingEligible, contactShareEligible, previewPhotoEligible, livePostIcebreaker, terminal, preIcebreaker, conversationActiveOrLater, openerEligible, requestPending, activeChat). The api (lib/connection/stageGroups.ts) and the web (features/connections/utils/stageGroups.ts) read them with stageGroup / isInStageGroup (fail closed, an unknown group name throws). 14 modules that typed their…

One ConnectionStage schema in the OpenAPI; the api and web types derive from it, the admin stage route refuses a name that is not a stage (W25.5.a) · 7a8a5f1

The nine stage names were repeated as enums in four schemas, as a hand-written union in the api and in the web, and as a free string in the admin request. Now the product OpenAPI names them once (ConnectionStage) and Connection, PersistedChatSession, ConnectionStageResponse and AdminSetConnectionStageRequest reference it. The api type is z.infer of the generated zod enum, the web type comes from the generated api-types, CONNECTION_STAGES comes from the gate JSON, and the admin request body is typed ConnectionStage…

The nine connection stage names are equal everywhere (W25.4.c part 1, tier T0) · 48ee90c

connectionStageParityInvariant.test.ts reads the gate JSON allStages as the reference and compares, by name and order: the api union, the web union, CONNECTION_STAGES, every enum of the product OpenAPI that carries the stage names and every enum of the generated api zod schemas; both gate lists must be subsets of allStages without duplicates. All lists are equal today (10 tests green), so the test pins the contract; it can fail: the comparison and the union parser (a comment with a semicolon inside the union broke…

I18next 26.5.10 in the api and starlette 1.10.0 in matching and ml-service (the drift found by the final scan of 2026-10-24; owner rule 2026-10-19: all dependencies at the latest… · c37267b

api: package.json ^26.5.10, src/pnpm-lock.yaml and src/apps/api/package-lock.json regenerated with scripts/regen-npm-locks.sh (the lock parity check passes: 57 api and 126 web dependencies agree). matching: requirements.lock (uv pip compile --upgrade-package starlette) and uv.lock. ml-service: uv.lock. The environments were synced once online (uv sync) so the offline tier steps find the wheel. Evidence: matching-pytest 430 tests and ml-service-pytest 712 tests green offline on the new locks (runs/test/20261025T111…

The ban gap after its second review: the legacy-row repair, the picture routes and the refusal logs (R2-F1, R2-F2, R2-F4); the review is recorded · a121004

Second review of the ban gap (w0107-ban-critic-r2, opus): APPROVE-WITH-LOWS, round-1 findings F1 to F6 closed, the saved probes go red as expected. Fixed with tests written red first: - R2-F1: the profileId repair of a legacy row (no profileId, no email) wrote the banned mailbox and the deleted profile's id. The repair no longer sees a banned mailbox; the lookup runs only when a repair is due. - R2-F2: the picture routes were exempt in the routing invariant because "a row exists"; the tombstone now fires on an exi…

The ban gap after its two reviews: a banned mailbox is not backfilled onto an existing row, an unproven one never brings the deleted profile back, the registration refuses before… · b9ea3b1

Round 1 of the ban gap fix (f35773a53): reviewer A REJECT (two MEDIUM, reproduced), reviewer B APPROVE-WITH-LOWS. Fixed, each with a test written red first: - F1 (A, MEDIUM): the existing-row branch wrote a banned mailbox onto the email-less row of a fresh authUid (two steps: sign in unverified, verify, sign in again). Now refused for a proven mailbox, skipped for an unproven one. - F2 (A, MEDIUM, the original W0.107.a symptom): an UNPROVEN email on a plain getOrCreateProfile re-created the deleted profile under t…

An admin-deleted mailbox cannot be provisioned again through ensureProfile under a fresh authUid (F1 of the landing review; the gap dates from W0.107.a) · f35773a

POST /api/users (password registration) and the api OIDC callbacks call ensureProfile, which called getOrCreateProfile with the linking trust at its default false, so the admin-delete tombstone looked up only the new authUid and never the mailbox. A person an admin deleted could register again with the same mailbox, pass the one-time code, get a fresh identity-provider id and have the profile created again under the same deterministic email-derived profileId (reproduced by the reviewer w251-catchup-api-critic). Fi…

W25.1.e checked off with its verify (the ship and re-measure note exists) · b6e867e

W25.1 (story) and W25.12 (story) stay open on purpose: W25.1's acceptance names Chrome and Brave on the live /en/match (signed-in request counts, console and Brave are UNVERIFIED, see docs/notes/w25-1-ship-remeasure.md) and is judged in the wave exit demo W25.8; W25.12's acceptance needs a PRODUCTION release through `release` (the two production updates of this wave used the `run` sequence; the real rehearsal leg of the seam test passed), so the next production update uses `release --profile prod --approve head`. …

W25.1.e ship and re-measure of the page-weight group, with what could not be verified marked UNVERIFIED · 20b0e6a

Live site after the production update: /en is 294,432 bytes decoded and 89,131 gzip, against 695,789 and 213,845 in the HAR of 2026-10-23 (-58 percent); /en/match 302,372 against 704,943. The COOP header and the one-day icon cache are live. Signed-in request counts, the live console and Brave are UNVERIFIED (no production identity, no Brave); the local production-mode evidence is cited. Claude-Session: https://claude.ai/code/session_01QuhmGtffsBXMjU4FZysDVJ

The review of the watch units and the seam-test fix is recorded; W24.4.e and W24.4.f carry their real scope · edcb84d

The reviewer (sonnet) approved e5e43178f and 5a428a23f with seven lows, all queued in backlog.md. Its plan-integrity point is accepted: the completion notes of W24.4.e (a decision loop plus four manual releases as proof, no unattended deploy by design) and W24.4.f (the stale-runbook sweep is not done, filed) now say what was delivered. Claude-Session: https://claude.ai/code/session_01QuhmGtffsBXMjU4FZysDVJ

W24.4.e, W24.4.f, W25.2 and W25.12.h checked off with their evidence; ledger tick 78 · be6306a

W24.4.e and W24.4.f by their own verify (the watch dry run, the production bindings), W25.2 by manual evidence with pointers (the integration tier green twice, 100 tests), W25.12.h after the real rehearsal leg of the seam test passed (4 passed in 398 s). The canary W24.4.b stays open and is recorded as blocked in backlog.md (needs a production identity). Claude-Session: https://claude.ai/code/session_01QuhmGtffsBXMjU4FZysDVJ

The real leg of the release seam test reads the release record as it is written (found by its first real run, W25.12.h) · 5a428a2

The first real run of the rehearsal release ended green (stages R0 to R9 done, verdict green, exit 0) but the test raised a TypeError: it iterated the record's stages as a list of dicts, the record keeps a dict keyed by stage id. The assertion now checks the dict: the seven stages of the rehearsal path exist and every stage is done and green. Pair: positive "the real rehearsal release ends green and leaves the evidence" (was red with the TypeError, run again below); negative: any stage that is not done and green f…

The watch loop as systemd user units (a decision every 30 minutes, never a deploy) and the close-out of the stage bindings (W24.4.e, W24.4.f) · e5e4317

deploy/systemd/tc-cd-watch.service and .timer run `watch --profile prod --once --dry-run` and append the JSON line to runs/log/watch.jsonl. A deploy stays `release --approve head` (or the run sequence) after the gate and the rehearsal: an unattended production deploy is a production-pipeline change and is not built. Proof for the item: four consecutive commits went through gate, rehearsal, production and verify with records (c03335cd 10-23, 4c1424c2 10-24, 3c7094af2 and d527ba7cd 10-25), one rollback drill on the …

The second landing check passed; the header commit is reviewed; lows queued; ledger tick 77 · a7c888d

VERIFIER: PASS on 50ca05c59 (second round). The COOP header commit 1a8fa029e, the one product commit without a review, is APPROVED (opus, nothing breaks, live headers checked). Tooling and test lows are in backlog.md. Claude-Session: https://claude.ai/code/session_01QuhmGtffsBXMjU4FZysDVJ

Production runs d527ba7cd046 (the final commit of WAVE-25 batch 1); records, ledger tick 76 · 315073e

Rehearsal green in 7 minutes, image deploy green in 7 minutes (delta upload of 330 MB). Independent checks: readonly-check 6 of 6 (sourceRevision d527ba7cd046), snapshot 19 containers and 0 findings, only backend, matching, ml-service and web-client changed, live /en 294 KB in 0.24 s. Claude-Session: https://claude.ai/code/session_01QuhmGtffsBXMjU4FZysDVJ

The four reviews before the landing (security fix, release and backup, api), their rounds, the queued lows and ledger tick 75 · 2e513cd

The independent checker failed the first push attempt for three reasons, all fixed or ruled (2c5729f4c, 0c072d59b, b7d0126f5, catch-up approvals). Finding F1 (older ban bypass through ensureProfile) is queued first for the next batch; eight files of abandoned uncommitted API work are listed for a decision. Claude-Session: https://claude.ai/code/session_01QuhmGtffsBXMjU4FZysDVJ

The redirect target is normalized after the locale segment too, and the security test can fail for every branch (round 1 of both security reviewers: APPROVE-WITH-LOWS) · b7d0126

Review findings fixed, each with a test written red first: - /en/\evil.com stayed unchanged after the locale segment and became /\evil.com once the intl router took the locale off again (an open redirect if the prefix mode ever changed from "always"). resolveAuthCallbackUrl now normalizes the rest after the locale like any other path. - The percent-encoded cases and the CR/LF cases could not fail (an origin check cannot see them): exact-output assertions added. - The doc comments claimed that /%5Cevil.com resolves…

The sign-in callback path no longer lets a backslash or encoded slash run become a scheme-relative URL (the security test was red in every clean checkout; found by the verifier of… · 0c072d5

normalizeAuthCallbackPathInput("/\\evil.com") resolved to https://evil.com: browsers treat a backslash like a slash, and only the plain "//" run was collapsed. The fix existed since 2026-09-28 as an uncommitted change in the live tree (no session owned it; the gates were green only because the live tree carried it). It strips a leading run of "/", "\" and their percent-encoded forms to one "/", removes tab and newline first, and forces a relative leading "/" on any other value. Test: tests/atomic/security/sign-in-…

The seam test of the release command no longer assumes the state of the target (found by the verifier of the landing) · 2c5729f

test_the_dry_run_of_the_rehearsal_release... expected the gate pipeline_approval always. The plan adds that gate only when the range since the deployed commit changes the pipeline's own code, so right after a rehearsal of HEAD (docs-only range) the test was red. The seven stable gates are now asserted in order and the one conditional gate may follow, nothing else. Red before the fix (run alone on a clean tree: "Right contains one more item: pipeline_approval"). Pair: positive "stable gates in order, pipeline_appro…

The session-switch round is recorded with review-round.py and has its report file · 38f37aa

The hand-appended row had 3 fields; review-round.py refused the whole ledger at line 70. Replaced by a recorded round (W25.2 round 1, critic opus, 3c7094af2) and the report docs/notes/reviews/session-switch-crit.md. Slip recorded: hand-edited-ledger-row. Claude-Session: https://claude.ai/code/session_01QuhmGtffsBXMjU4FZysDVJ

Production runs WAVE-25 batch 1 (commit 3c7094af2be4); records, review round, ledger tick 74 · 886c009

Image deploy green in 27 minutes (run 20261025T053058Z-3c7094af-4b2229), rehearsal green in 10 minutes. Independent checks: readonly-check 6 of 6 (sourceRevision 3c7094af2be4), snapshot 19 containers and 0 findings, only backend, matching, ml-service and web-client changed, live /en 294 KB in 0.17 s. Review round W25.2-session-switch recorded (APPROVED 3c7094af2, 7 lows queued). Claude-Session: https://claude.ai/code/session_01QuhmGtffsBXMjU4FZysDVJ

The session switch of the two-peer helper keeps the member it was asked for (found by the integration tier, mutual contact-share race) · 3c7094a

The spec failed in the tier (both attempts) and passed alone. The browser's own view at the failure showed the page at /chats?userId=<alpha> with the session of alpha: the switch to bravo had not taken. A page of the previous member was still open and polling, and a late answer of it put the old cookie back. The warm-up read accepted any 200. signInBrowserContextAsSimSyntheticUser now takes every open page to about:blank before the swap, reads the session back after the warm-up, repeats the swap up to three times …

The approved workflow verification plan (matching to chat), with the Step 0 result · 63d5af1

Traces the workflow, records it in a knowledge file, references it from code and proves it with tests. 16 defects with positive and negative test names, test layers, blast-radius map, migration. Step 0: connection rows exist only in the backend scoring mode, so production (backend mode) is unaffected and the default mode is filed as defect 17.

The icebreaker replay after its review (APPROVE, 5 lows fixed with pairs): picks replay before the step guard, the replay is logged, the doc comment is true · 1da9879

F1 and F2 negatives (wrong actor on an answer replay, a row that left conversation_active stays 409), F3 a delayed identical pick retry after the other side advanced is an idempotent 200 for the right actor only (wrong actor never 200), F4 the mutated:false comment lists the three cases, F5 the route logs an idempotent replay with action and connection id and never the answer text. F6 and the transcript-repair note are queued. Api suites around the service: 382 files, 2566 tests green; tsc clean.

An identical replay of an icebreaker step the row already holds is an idempotent 200, not a 409 that depends on read timing (found by the integration tier) · 86fdeeb

icebreaker-submit-step-same-account-concurrent-race failed 1 run in 3 (passed 2 of 3 alone): the call that lost the compare-and-set race got a clean idempotent answer, the call that read the row after the first write met the "already chosen/recorded" guard and answered 409. Both are the same double-tab. alreadyHolds() answers mutated:false with no write and no second transcript message for the five step kinds; answers are checked before the step guard (they advance step on write), for the right actor only. Positiv…

Five integration specs no longer create questions with an operator message key (found by the integration tier, W25.1.j regression) · f7d8397

The specs used admin.questions.status.active as a filler textKey and left the rows in the shared database. The icebreaker pick list translates textKeys with the strict translator, and the member bundle (W25.1.j) has no admin keys, so every later two-user chat spec showed a 404 page for both peers (trace of admin-chat-session-reset: MissingMessageKeyError at the chats page). The filler is a seeded question key now. Positive: the guard test in clientMessagesScoped scans tests/e2e and passes; the red file passes alon…

W25.9 checked off with a real verify; dependency drift queued for batch 2 · 8ed561e

No home-directory literal in cicd/ comments (product isolation guard, found by the final gate) · 558e2bc

architecture-guards failed at check_product_isolation: two comment lines named a /home/<user>/ path (redact.py and a test docstring). They name <home> now. No behaviour change. Positive: verify-architecture-guards passes. Negative: the guard still flags a real /home/<user>/ literal (it flagged these two).

The restore drill joins the shared-host test group (found by the final gate) · e6bbfcc

The parallel cicd run failed with 1 failed and 3 errors: test_xdist_groups caught that test_backup_restore_drill reaches the rehearsal host and was not in the docker-host group, so it ran beside test_bridge_drill and both collided on the rehearsal lock. The file is in the group now. Positive: test_xdist_groups passes (6) and the drill file alone passes (5 in 277 s). Negative: the guard test still fails for a rehearsal-host module that is not listed (it just did).

The lint ratchet was 1 worse: the guard reads the clock on purpose (W25.1.d) · b3c8ed0

The final gate stopped at web-lint-ratchet (21 -> 22 errors): react-hooks/purity on Date.now() in LocaleSubtreeIntlProvider. The clock is compared with a timestamp persisted by an earlier document, so it cannot come from props or state; the line carries the disable with its reason. Ratchet back at 21. The guard tests (11) stay green.

Release trains: batch 1 goes to production now, batch 2 (stage contract, journey spec, exit demo) follows · 7a99ae6

Releasing a feature is the single release command; the gap list shrinks to what is left (W25.12.h) · 05f1aef

The seam test of the release command as a real process (W25.12.h) · aede522

The command runs against the real repository with the event log and the run index in a temp folder: the dry run plans every gate and changes nothing (positive), a wrong approval is refused with exit 2, a reason, no record and an issues file (negative). The full rehearsal release on the rehearsal host is opt-in with TC_CD_SEAM_REAL=1 and asserts the green record, the command events with exit codes, the issues file and the index line.

W25.9.c, W25.9.d and W25.10.b checked off with the built design and the measured result · 1706851

A viewer whose peer pressed reveal first keeps the button through their own mutation (W25.4.b) · 57b9a2a

mergeConnectionMutationIntoConnectionStage set both reveal flags to stage === anonymous_chat_active, so an icebreaker or vibe-check mutation of the viewer, returning chat_requested while the peer had pressed, hid the button until the next refetch. When the cached row was already chat_requested the server flags stand now. Positive: the viewer keeps the button. Negative: a viewer who pressed stays without it; other stages never show it; the viewer own press (into chat_requested) hides it.

The chart marker of the network check is the class names recharts renders, the You page is checked too (W25.1.k) · 891fe7a

The first marker (RadarChart) matched the component names in the light modules and gave a false alarm on all routes. recharts-wrapper and recharts-surface exist only in the chart chunk. Real-browser run on the rebuilt stack: match, match-list, chats and you pass, no chart code in the first view.

Stale reference to W25.2.b in the finish plan corrected · 1c297c2

Review row for W25.1.j and W25.1.k · 52e1804

The radar charts after their review (6 lows): the chart is lazy inside each radar, not the whole radar; inline retry; test and evidence gaps (W25.1.j, W25.1.k) · 5d03e91

Critic w25-1jk-critic: APPROVE-AFTER-FIXES. A failed chart chunk (stale tab after a release, offline) replaced the whole page and its Retry rethrew; the placeholder was shorter than the real radar (layout shift). Now LazyRadarChart loads only the chart part (the light parts stay static: empty states, legend, table), the placeholder has the chart box classes, a failed load shows an inline message with a retry that fetches again (new keys radarLoadFailed and radarRetry in five locales), and the failure is logged. Po…

The match-scope workaround is retired from the dual-client chat helper; W25.2.b checked off with the decision on the other two · a3f3d7c

The three race specs (mutual-end-connection-race, chat-vibe-check-race-two-peer, entitlement-daily-chat-start-dual-peer-race) pass on the rebuilt stack without the match-scope record. With item stats and pair materialisation switched off the thread never reaches the reveal button: they are the harness seed bypass, not product defects. The hard block on a missing match row is queued as a resilience finding.

Every BFF answer carries Server-Timing with a total in the real-browser network check; W25.7.d checked off · d572ce8

Live HAR on the rebuilt stack: all /api answers except the NextAuth handlers and the event stream (no end, so no total) carry total, bff and upstream parts. Positive: the rule passes on /match, /match/list and /chats. Negative: the rule fails with the list of answers lacking the header (seen red on the event stream before it was excluded with a reason).

Stale references in the finish plan and the ledger corrected · 5eaa946

W25.6.b and W25.6.g checked off, verifies point at the real spec and tests, tick 73 · 8b696fe

W25.1.j and W25.1.k checked off (real-browser checks green: document 302 KB, no chart code in the first view) · 4c13f12

The chats first view carries no chart code, the size waivers are gone, a real-browser spec for the signed-in redirect (W25.1.h, W25.1.k) · d5f4db4

The HAR of /chats still held the chart library: ConnectionDetail and YourMatchingSignalsCard imported the radar statically. Both use the lazy module now. The HAR evidence spec asserts no chart code in the first view and has no document-size waiver (the finding is gone: document 704 KB -> 302 KB on /match). Positive: the invariant test scans the connections and journey features too. Negative: the spec fails when a chart script is in the first view. New spec: a signed-in /en answers 307 to /en/you, /en/landing is se…

The root layout sends the member message bundle, the admin and dev layouts add the operator bundle for their tree (W25.1.j) · c00440a

The catalogue without devShell, devTheme and most of admin (the keys member screens read stay: profileGenerator, debug.matchIntentScope, sections, userProfiles.missingValueEmDash) is what every page carries; the admin and dev layouts add the operator namespaces through ScopedMessagesProvider after their role guard. Positive: member plus operator bundle equal the catalogue in all five locales; the operator tree reads admin and dev keys; the layouts hand the scope after the guard. Negative: an operator key read outs…

The design-system display barrel no longer re-exports the chart components (W25.1.k) · eccaf70

The on-demand radar did not remove recharts from the first load: the HAR of the rebuilt stack still held the 277 KB chart chunk on /match, /match/list and /chats, because ui/display/index.ts re-exported ChartContainer, so every Card import pulled recharts. No module used the chart through the barrel (tsc clean). Positive: the barrel has no chart export, only the radar modules import the chart path. Negative: the pattern still catches a static chart import.

The radar charts load on demand, recharts leaves the first load of Match and Chats (W25.1.k) · 1b561d1

recharts (chunk 1952, 278 KB) was in the first load of /match, /match/list and /chats because the peer profile sheet imported both radar charts statically. A lazy module (next/dynamic, no SSR, a placeholder as tall as the chart) now carries them. Positive: the lazy module and the sheet use it, no static chart import in the profile, chat and discovery features. Negative: the pattern catches a static chart import and a recharts import. PeerProfileSheet.test waits for the chart (findBy) because it arrives asynchronou…

W25.1.h checked off (two reviews, all findings fixed with pairs) · 985f425

The signed-in locale-root redirect after critic B (5 lows): the client subject rule, edge tests, doc and plan text (W25.1.h) · 3efb0f3

The proxy takes the same subject as the client (id or sub, trimmed): positive an id without a sub redirects, negative a blank sub does not. The edge tests (query string, two hops from /, URL locale over cookie locale, RSC navigation, /en/landing served) are adopted from the critic probes.

The signed-in locale-root redirect after critic A (3 lows), each with a positive and a negative test (W25.1.h) · 2e9a273

Decode failures and a missing NEXTAUTH_SECRET are logged with their cause (positive: garbage and foreign-secret cookies log once; negative: expired and no-cookie log nothing). The cache policy is asserted exactly (positive: the 307 carries it; negative: the signed-out answer has the same policy and no location). The production cookie shape (__Secure- on the internal http URL) and chunked cookies are tested (negatives: the unprefixed cookie on https, a foreign-secret chunk set).

The Match list is as live as the universe, pinned by an invariant test and the HAR evidence route match-list (W25.1.i) · ce917f7

HAR2 F8 is not reproduced on the current build: one discovery stream, one profiles request, one token call on /en/match/list. The recorded repeated 178 byte body was an empty result. Positive: the page client and the stream hook are shared, the HAR holds exactly one stream and one profiles request. Negative: the extraction catches a view-mode condition; the spec fails with a second request.

Finish-to-production-plan item 6 names the open W25.1 items · c72acd0

A signed-in member on the locale root is redirected to the You hub by the proxy (W25.1.h) · a097fcc

HAR2 F7 re-read: the only client redirect is /en -> /en/you after the landing document was sent and rendered (the journey and match requests are router prefetches). The proxy now answers a signed-in GET of /<locale> with 307 to /<locale>/you (decode-only session check, uncached). Positive tests: /en, /en/ and /de with a valid session redirect. Negative tests: no cookie, foreign secret, expired token, garbage cookie, /en/landing, /en/you, a POST and a router prefetch keep the old answer. proxy() is async now.

W25.1.b to d checked off, the rest of d filed as W25.1.j and W25.1.k, decision on the push-dialog browser test · c3a2116

The Brave push dialog cannot open in the browser tier (no VAPID key on the dev stack, 2 of 2 tests skipped), so the item is closed on the component tests and the live Brave check of W25.1.e. The scope of W25.1.d beyond one provider is now W25.1.j (route-scoped namespaces) and W25.1.k (radar chart on demand).

Reload marker is cleared on a matching render (positive: a later unrelated navigation reloads; negative: two mismatches in a row still throw). · 2498754

Blocked sessionStorage: the marker rides in window.name, a foreign name is left alone (positive: second mismatch throws; negative: one mismatch reloads once). The reload decision is logged once (negative: nothing logged on a match). proxy.ts: only next-router-prefetch short-circuits, a browser document prefetch gets the URL locale (positive: de handed over with an en cookie; negative: router prefetch still short-circuits). clientMessagesBudget measures the served bundle in UTF-8 bytes (ar 385,576 was over the old …

W25.12.a to g, i and j checked off (187 release and backup tests green), tick 72 · 13b2fde

The locale layout sends no second message bundle, a guard checks the root provider's locale (W25.1.d) · a134781

The document carried the ~290 KB message bundle twice (88 percent of the HTML, HAR2 F1). The [locale] layout no longer loads messages. LocaleSubtreeIntlProvider is now a guard: it reloads once on a locale mismatch and throws LocaleSubtreeMismatchError on a second one inside 15 s. Positive tests: localeSubtreeGuard (matching locale renders, one reload on a mismatch), clientMessagesBudget (the layout sends no messages). Negative tests: a second mismatch inside the window throws, no reload loop. Real render on next d…

The referee's finding on the restore fixes (one new defect, three lows), each with a positive and a negative test; the drill covers TTL reaping on a real mongod · b3d9d5c

arb-restore on 006f5782e: LAND-AFTER-FIXES, every round-1 finding closed. F-R2-1 the post-restore verify compared the fixture's archive state with production, each reaped by its own TTL monitor: production could hold more documents and end red-data with the services stopped. Step 3.5 only: an expiring collection passes on an equal index list whatever its count (the canonical fingerprint already decided that); step 3.3 stays strict (a TTL count may only fall). test_restore_state::test_the_post_restore_verify_accept…

`backup verify --latest`, the periodic proof that the newest production archive restores (W25.12.j/i); the backup handlers move out of cli.py · 145e858

Restore.verify() is the inventory without a record, without hash1 and without the 'nothing to restore' refusal: it checks the archive, restores it into the scratch database of the rehearsal host (rehearsal lock, fixture taken down after), compares the collections with production, checks the previous images and prints what it found. It writes no record and no hold and stops nothing. `backup verify --latest|--run ID --approve head`; restore_command.newest_restorable_run picks the newest green production deploy whose…

Server-Timing after its review (ACCEPT-AFTER-FIXES, 8 lows), each with a positive and a negative test (W25.7.d) · 3b828e4

crit-timing found no HIGH or MEDIUM; the lows are fixed: F1 server.ts registers it before the routes (source-order test) / a route registered before it shows total and pre only F2 the two assertions that could not fail compare with a stopwatch now (api total, BFF bff vs upstream) F3 the checkout's stack and gateway parts are tested on the real route (billingCheckoutServerTiming.test.ts) / a throwing gateway is still timed and the error reaches the caller F4 the route's own header is captured once: a failing later …

`backup restore` after two reviews (1 HIGH, 4 MEDIUM, lows), every defect with a positive and a negative test; design v4.2 · 006f578

crit-restore-b (safety, REJECT) and crit-restore-a (correctness, REJECT) on 7b8607e46. The drill against the real mongo (4 scenarios) and 160 tests pass after the fixes. B-H1 the restore's own deploy/HOLD made the clean-tree gate refuse apply/abort/finish/status after the services were stopped: the gate exempts the untracked or ignored hold file (cicd/compose/snapshot.py; the same deadlock hit `bridge-release --abort` after a red run) test_prod_snapshot::test_the_clean_tree_gate_passes_with_only_the_pipelines_own_…

COOP same-origin: safe here because the app opens external links with noopener only and sign-in and checkout are full-page redirects (grep of window.open and opener in src). · 1a8fa02

Icons (icon-192/512 and maskable, favicon.ico/svg/32): public, max-age=86400 instead of max-age=0 (7 requests per page load in the HAR); not immutable, they are not fingerprinted. The icon source pattern was checked with Next's own path-to-regexp (matches /icon-192.png, not /en/icon-192.png, /og-image.png or /icon-192.png.map). Pairs: COOP present next to the other security headers and the .well-known exclusion kept / icons get exactly one day and the patterns match the eight files and none of six look-alikes / th…

Server-Timing on every /api answer, split at the api and at the BFF, and the checkout broken into its parts (W25.7.d, HAR2 F13) · c9ed712

api: src/middleware/server-timing.ts adds total, pre (hooks and pre-handlers: authentication, gates, rate limits), handler and the parts a route times with timed(); the route handler start is marked by wrapping the handler in an onRoute hook (a global preHandler hook runs BEFORE the route's own pre-handlers: found by the first test run). The checkout times its billing stack and its gateway call (database and payment provider), so the 942 ms first byte can be read apart in the next HAR. web: bffServerTiming.ts + bf…

Backlog line of the slip commit-of-unchanged-file (done in the global commit-paths tool) · a6b3eac

The slip commit-of-unchanged-file: premortem line and the metrics entries (open, then fixed by the commit-paths warning) · c342322

Ledger tick 71 (restore built and proven on a real database, prune accepted, referee findings fixed) · ae86537

Real procedure, real remote operations, real rehearsal fixture, real hold file and record, a production-shaped stand-in database and stand-in app containers; only the stack ports… · 7b8607e

Real procedure, real remote operations, real rehearsal fixture, real hold file and record, a production-shaped stand-in database and stand-in app containers; only the stack ports are fakes. Four scenarios, 115 s, all green on the first run: - green restore: every collection equals the backup, documents added since are gone, the deleted one is back, the previous images started and verified against the old commit, the hold stays, the fixture holding production data is gone - a service that comes back before the appl…

cicd/compose/restore_run.py: inventory, quiesce, apply, abort, finish, status behind host / rehearsal / hold interfaces. · ef1c898

cicd/compose/restore_command.py: the real host over ProdDataSsh, the ansible rollback and the read-only verify, the production-shaped fixture (taken down after the inventory), deploy/HOLD; the production lock for the changing modes; one JSON line; exit 0 ok, 1 red end, 2 refused. cicd/cli.py: `backup restore --run ID [--quiesce|--apply|--abort|--finish|--status] --confirm H --approve head` (no profile option). Also: catalogue.image_exists + ProdDataSsh.missing_images (A10), BridgeRehearsal.close (N13), the record …

Design v4.1 of `backup restore`: the referee's corrections A1 to A11 (this is the change the previous commit 5ab5d36b0 announced; that commit held only the review row) · c5168ef

A1 the record stores the FULL state, the canonical form is applied only when fingerprinting; A2 the inventory stores archive_state (no second restore at apply); A4 step 3.3 uses the derived ephemeral set (auth_backup_codes expiring is not a writer); A5 a restored record reopens and clears every flag; A3, A6 to A11 wording. No fifth reviewer: the referee's probes are re-run as the verify of the build. Slip: a script stopped on a stale anchor before writing and the commit tool still committed the unchanged file; mec…

Design v4.1 of `backup restore`: the referee's corrections A1 to A11 (the design is the contract of the build) · 5ab5d36

A1 the record stores the FULL state, the canonical form is applied only when fingerprinting; A2 the inventory stores archive_state (no second restore at apply); A4 step 3.3 uses the derived ephemeral set (auth_backup_codes expiring is not a writer); A5 a restored record reopens and clears every flag; A3, A6 to A11 wording. No fifth reviewer: the referee's probes are re-run as the verify of the build.

cicd/core/restore_state.py: TTL-derived ephemeral set, canonical fingerprint (null count/hash for TTL collections), hash1/hash2, the comparisons of step 3.3, 3.5 and 1.2. · 7e95834

cicd/compose/restore_record.py: one private atomic record per deploy run; flags written before their action; validate() refuses contradictions before any remote call; an aborted record reopens. cicd/compose/restore_inputs.py: archive, previous images and the previous commit from the deploy record, checked (path, mode 0600, digest, size, tombstone sentence). Pairs (positive / negative) in cicd/tests/test_restore_state.py, test_restore_record.py, test_restore_inputs.py, named after the design's C1/C2/C3/C6/C7/C10 an…

Prerequisites of `backup restore`: prune --apply is refused under a hold, the deploy stage records the archive sha256, its size and the previous commit · 8d0e462

Both are decided in every version of the restore design (docs/notes/backup-restore-design.md C8, F4/N3). - backup_command.run_prune(apply=True) calls hold_refusal: test_prune_apply_is_refused_while_a_hold_exists_and_a_dry_run_still_plans (positive: refused, nothing deleted; negative: the dry run plans under the hold, apply without a hold deletes) - BackedUpDeploy adds backup_sha256, backup_size and previous_sha (the seeded deployed_sha): test_the_deploy_result_carries_what_a_restore_needs_to_check_the_archive_and_…

Design v4 of `backup restore` after design round 3 (7 MEDIUM, 5 LOW), every finding decided · e818c2e

C1 TTL reaps in cronLocks are not a writer; C2 the verify's ephemeral set is derived from the TTL indexes; C3 canonical state and a hash1 computed once; C4 write order hold, record, stop plus a half-state table; C5 --finish confirms the services stopped first; C6 record validation and --status; C7 refused/aborted records; C8 prune --apply refused under a hold (build item); C9 previous images must exist on the host; C10-C12 equality rule, decision facts, rollback context. Each rule has its positive and negative tes…

The four lows of the prune fix review (crit-prune-c ACCEPT), each with a positive and a negative test · a349946

LOW-1 a restore never hears "pruned" for an archive that is still on disk (a prune cut short between the two manifest writes): test_a_kill_during_the_deletions_leaves_a_tombstone_for_every_archive_already_deleted_and_never_tells_a_restore_pruned_for_a_present_one LOW-2 the applied JSON line and R9 list and count only archives really removed, and free only their bytes: test_the_applied_json_line_lists_only_archives_really_removed_and_frees_only_their_bytes, test_a_removal_that_fails_is_logged_recorded_and_the_other…

The verify commands of W25.12.d, e, f name the tests that exist (test_release_run, test_release_command), not three files that were never written · b5e9a09

The three files were planned in design v2 and the tests landed in the two files above; each new verify was run green (4 and 10 tests).

Design v3 of `backup restore` after design round 2 (REDESIGN scoped: 3 HIGH, 5 MEDIUM, 6 LOW), every finding decided · 8d11fe5

N1 re-check of the stopped services and clients right before the drop, strict operational collections; N2 hash2 binds the stored quiesced state; N3 the old commit is the classify fact compared_with (the record's deployed_sha is the NEW commit); N4 --abort refused after drop_issued, --finish defined; N5 the quiesce refuses without a real image id per service; N7 the hold is written before the stop and owned by the restore; N8 one resumable record per run; N9 the hold pins the archive against prune; N10 strict verif…

`backup prune` after two reviews (7 MEDIUM, lows), every defect with a positive and a negative test · b4b9bbf

crit-prune-a (data loss) and crit-prune-b (safety) both rejected 6ba46a237. Overlap: A-M1 = B-F1, A-M2 = B-F2, A-M3 = B-F5, A-M4 = B-F8, A-L6 = B-F9. Code: cicd/compose/backup_retention.py, backup_command.py, release_run.py, release_command.py, cli.py. - M1/F1 only PRODUCTION records pin; a green rehearsal or dev run never closes a red production deploy or release test_a_red_production_deploy_stays_pinned_across_green_rehearsal_and_dev_runs_and_a_green_production_run_frees_it test_a_running_production_release_pins…

The referee's findings on the release fixes (one MEDIUM, four lows), each with a positive and a negative test · c4ce783

Referee arb-release on e09ad6a51: LAND-AFTER-FIXES. M-ARB-1 git worktree add ran the live checkout's post-checkout hook (published code) with the operator's environment: every git command of the landing now runs with core.hooksPath=/dev/null, the push names its own hooks path. test_release_land::test_the_landing_worktree_is_created_with_the_installed_hooks_off (the same world with plain git does write the dump) test_release_land::test_the_pre_push_hook_of_the_published_commit_still_runs_and_regenerates_the_bundle_…

Ledger tick 70 (review fixes of the one-command release, the CI/CD trace tool, rolling backups command) · d7bbd02

`backup prune`, the rolling window of database archives, and the last stage R9 of a green release (W25.12.j) · 6ba46a2

`python3 -m cicd.cli backup prune [--keep N] [--apply]` gathers the digests of the deploy records, the pins (deploy/HOLD, red or running deploys and releases no green run followed, bridge results) and calls the retention planner. A dry run takes no lock and changes nothing; --apply plans INSIDE the production lock and deletes exactly the listed archives, then writes the manifest with tombstones. A green release runs it last (R9) and applies only once the manifest exists (the first deletion of a new policy is read …

The one-command release after two reviews (1 HIGH, 13 MEDIUM, lows), every defect with a positive and a negative test · e09ad6a

crit-release-a (correctness) rejected 8578e5790: H1 and M1 to M6. crit-release-b (safety) accepted after fixes: F1 to F13. Overlap: A-M1 is B-F4. v4 of the design decides each one. Pairs (positive / negative), in cicd/tests: H1 test_release_plan::test_the_rehearsal_profile_refuses_a_migrating_range_and_production_runs_it test_release_command::test_the_migrating_path_never_starts_the_production_bridge_on_the_rehearsal_profile M1/F4 test_release_run::test_a_refusal_raised_inside_r5_closes_the_record_as_refused_and_t…

CI/CD data trace tool with Mermaid and Mermaid Live links · 3c42da7

scripts/cicd_trace.py traces how the pipeline works from the code of cicd/ and the records in runs/ and writes docs/diagrams/cicd-data-trace.md and .html. Seven static diagrams (commands to modules, stage walk, release steps, layers with real import counts against the contract, data stores, outside tools, fact flow) and up to five live ones (newest production run as a sequence, coloured stage walk, fact producers, release record, tool use). The live part keeps keys, verdicts, counts and durations only. --check fai…

Ledger tick 69 (the one-command release and its neighbours) · 480988b

Rolling retention of the database archives, the planning and applying module (W25.12.j, first part) · c106d24

scan_archives verifies every archive (sha256, gzip stream test, the digest prefix of the deploy record); plan_prune keeps the newest N verified pre-deploy archives (default 5, floor 2: 0 and 1 are refused), counts verified archives only (a broken newest one is kept for a person and never pushes a good one out), keeps the oldest of each of the last 4 weeks and 3 months, every pinned archive, and bridge restore points until the run is closed plus 14 days; apply_prune deletes exactly what the plan lists and writes in…

Design v2 of `backup restore` after the design review (REDESIGN of the apply sequence, F1 to F13) · 8578e57

F1 (HIGH): the confirm hash bound the live state, which moves every 15 minutes and with every user write, so the apply was unreachable or would be loosened; now hash1 binds the archive and the state it restores to, a quiesce step stops the writers and prints hash2 over the quiesced state, and the apply requires the quiesced state to be unchanged under the bridge's equality rule. F2 (HIGH): every end after the stop left production down with no pipeline command to bring it back; now the snapshot's images are restart…

Snapshot findings are only a record on the rehearsal host (second seam run of the release command) · dc6920b

The second seam run was green through the rehearsal run, the read-only check and the smoke pages, and red at the snapshot with exit 1: the snapshot of the rehearsal host has findings against production's reviewed baseline, which says nothing about the rehearsal. Defect -> positive test, negative test: exit 1 is ok on the rehearsal profile; exit 1 is red on production, and a refusal or an unreadable host (exit 2, 3) is red on both.

Rolling backups for the pipeline: keep the newest 5 verified archives, never the only good one (owner order), filed as W25.12.j · 7a12135

Analysis of what exists (8 pre-deploy archives of 1.7 MB, 22 MB in all, never deleted, no rule except the bridge archives' next-green-bridge-plus-14-days, one disk at 88 %) and of what restic and the grandfather-father-son tiering do. Decision: count-based retention at this size; an archive is deleted only when N newer ones are verified; the newest verified archive is never deleted; pinned archives (hold, running, interrupted or red release, bridge restore points, open restore inventories) are never deleted; a wee…

The release's snapshot stage passes the out-dir, not its adoption sub-folder (found by the first seam run on the rehearsal host) · a8ccc47

The seam run of `release --profile rehearsal` was green through the rehearsal run (R5) and the read-only check (R6) and smoke pages (R7), and red at the snapshot: the stage passed `<out-dir>/adoption` and the snapshot refused it because it adds that folder itself. Defect -> positive test, negative test: the stage passes the out-dir itself; a refusing snapshot (exit 2) is a red outcome with its exit code. This is why a seam test with the real classes exists: no fake would have caught it.

Design of `backup restore` (W25.12.i), for a design review before the build · 69b5480

The release passes no verify suite of its own: each run mode seeds its own (as `run` does without the flag) · 58dc723

`tc-cd release`, the one command that releases the clean HEAD (W25.12.c to g), first real dry run included · 12e596a

The command composes the existing pipeline code: real collaborators for the plan (git, the site's health answer, the ssh configuration, gh, the release records, the bridge file) and real stage operations (housekeeping with the image prune, the rehearsal host, run_pipeline for the rehearsal and the production image deploy, run_bridge for a migrating release, the read-only check, the snapshot, the smoke pages of deploy/release.yaml, release_land). It prints one JSON line (verdict, path, shas, stage table, reason, re…

Publishing of the released commit (stage R8, W25.12.g), and the design correction for the release-notes bundle · 27eda93

release_land.land: fetch, origin/main must be an ancestor of the released commit (an origin that moved is a red "origin moved", never a merge), a throwaway detached worktree with the dependency folders linked in, the repository's pre-push hook run there; when it regenerates release-notes.generated.json it commits the file and exits 1 and that child commit (touching only the bundle) is pushed after the hook passed a second time with no diff; the push is the estate's sanctioned command; the live checkout is never ch…

The release record and the stage runner (design v3, W25.12.d and e), behind injected stage operations · 4d0fefe

release_record.py writes runs/release/<id>.json (mode 0600, atomic rewrite after every step, states and ids only). release_run.run_release walks the plan's path: image (housekeeping, rehearsal host, the rehearsal run only without evidence, window wait that re-reads HEAD every slice, the production run with at most three window re-entries), migrating (host, wait directly before run_bridge, each bridge outcome mapped to one sentence, no rehearsal run of its own), idle, skip and interrupted (after-checks first); the …

The reviewer's findings of round 3 on the slow-request overlay: bounded log entries, a monotonic clock, no pending path after a one-render show and hide (crit-slowoverlay-c, W0.16… · 3b71e07

Defect -> positive test, negative test (slowRequestOverlayInvariant.test.tsx): - M1 (MEDIUM, an entry over 2000 characters loses its whole batch at the ingest) -> 60 hung id paths make entries of at most 2000 characters naming "and 50 more"; five short paths are written in full - L1 (clock comparison at the cap contradicted the docs) -> a forward wall-clock step does not give up a fresh request (performance.now is the clock); without a step the next slow request still shows - L2 (a layer that shows and hides insid…

The release inputs and the release plan (stage R0 of the one-command release, W25.12.c), and design v3 after the second design review (G1 to G15) · e799ba7

New release_inputs.py (key file path: TC_PROD_SSH_KEY or exactly one non-default identityfile with identitiesonly, never printed, registered for redaction; GitHub origin forms; PRIVATE visibility gate) and release_plan.py (every gate evaluated with its value: clean tree, hold, approval, key, running commit, classification with the deciding paths, bridge entry, window with and without --wait, disk, rehearsal evidence, private origin, release-notes freshness, live release, interrupted release; the path idle/skip/ima…

The body of `tc-cd run` is one function, run_pipeline, so the one-command release can call it (W25.12, design v2) · 08658c2

Behaviour unchanged: `cicd/cli.py` keeps the flags, the output and the exit codes and calls `cicd.compose.run_command.run_pipeline`, which holds the sha checks, the production run plan, the orchestrator with the hold observer and the hold after a red production image deploy. The two image-deploy tests that patched `cicd.cli.build_orchestrator` patch `run_command` now (the code moved); every other test of the command is untouched and green (189 tests). New test_run_command.py (positive and negative per rule): a gre…

The debug mode keeps event logs private, hides key paths and never tails private operation output; the image-deploy gates log their values (design review crit-release-design F8 an… · bfd59b0

Defect -> positive test, negative test (test_debug_mode.py, test_image_deploy.py): - F8 event logs were created 0664 -> the event log is 0600, and still holds every line - F8 the key path could appear in a command tail (ssh "Load key ..." lines) -> the value of TC_PROD_SSH_KEY and a registered private path become `<key file>` in file and terminal; another file that starts like the key path, a different path and plain text stay - F8 operations whose answer is host or database data were tailed in debug mode -> db_st…

Design v2 of the one-command release after the design review (REDESIGN: three HIGH, four MEDIUM, fourteen LOW), plus W25.12.i (restore command) · 6915ef1

Every finding of crit-release-design is decided in the note with its number. F1 (a migration next to pipeline code read as rehearsal-only) is fixed in classify (dcd78a339). F2: the owner's decision is the `--approve <sha12|head>` flag, recorded with who and which session ran it, no ledger gate (the mechanical approval check was deleted on 2026-10-17 on the owner's order). F3: the after-checks run on every path including idle and skip, and a release record of HEAD that is `running` past R5 is verified before it can…

The blind-reveal guard of 9f2fcc163 decided the viewer's side by sorting the two ids of the call. · 9249dde

A viewer whose session authUid changed after the pair was created (the row keeps the stale id and the profile companions) was read as the wrong side: Alice (now `zed-...`, row side A) was refused 403 when answering Bob's blind reveal, and her own reveal press landed on Bob's side. Now `resolveViewerSide` (the row's `userAId`/`userBId`, then the profile companions, the same rule as `requestedByMatchesViewer`) decides at the three sites of chatTransitions.ts (respondChat blind guard, pressReveal, pressRevealFromChat…

A range with a migration is migrating whatever else it changes; pipeline code in the same range asks for the owner's approval on top (design review crit-release-design F1, W25.12.… · dcd78a3

Reproduced by the reviewer: classify tested the pipeline paths (`cicd/*`, `deploy/*`) before the migration paths, so a migrating release (which edits `deploy/bridge.yaml`, a pipeline path) read as rehearsal-only and an image deploy could ship the migration onto unmigrated data. Now the migration test comes first; `pipeline_changed(paths)` is a separate fact, and the production classify stage refuses a migrating range that also changes the pipeline unless the owner approved that commit. Defect -> positive test, neg…

The reviewer's findings of round 2 on the slow-request overlay: a log entry for a layer that is really seen, one entry per show, the give-up logged, no stream of requests keeping… · d9fd5e4

Defect -> positive test, negative test (all in slowRequestOverlayInvariant.test.tsx unless named): - N1 (MEDIUM, the F6 fix dropped the report of a layer that appears when a loading screen ends) -> logged when the loading screen ends while the request is pending, nothing logged when the request ends behind the loading screen - N2 (the F1 and F3 tests did not fail on the parent) -> the round-1 clock probes are tests now; slowRequestTrackerFuzz.test.ts keeps the 400-seed interleaving fuzz - N3 (deferral untested) ->…

F1 (HIGH, both reviewers, pre-existing): after A pressed reveal from anonymous_chat_active the row is chat_requested with requestedBy null. · 9f2fcc1

A's own respondChat accept skipped the requester guard (null matches nobody), built BOTH consents and ended in chat_active: the identity reveal for a peer who never consented. A's own decline ended the connection as declined by the peer (F2). Now the side whose own consent is already granted gets 403 for accept and decline (it withdraws with cancel), the peer's accept goes through pressRevealFromChatRequested (records only the peer's side), the peer may decline. Defect -> positive test, negative test: - F1 -> peer…

A positive and a negative test for every defect found today (owner order 2026-10-24) · 8f3b759

Defect -> positive test, negative test: - overlay F2 (takeover is reported) -> reported once per request, not again when another one joins - overlay F3 (clock step) -> a slow request still shows after the clock jumps back, a fast request is not shown after it jumps forward - overlay F4 (classifier never throws) -> a normal call reaches the real fetch with exactly its arguments and answer - overlay F6 (held back by a loading screen) -> nothing logged while held back, logged when not - repeated chat accept -> a thir…

The debug mode logs all five levels and every command ends with an issues summary file (W25.12.b) · e3cb1c8

Owner order 2026-10-24: a debug mode that logs all levels of issues. `--debug` (a global option) or `TC_CD_DEBUG=1` sets every level on the terminal and in the event log (until now the file followed the terminal level through TC_CD_LOG_LEVEL only), `log_command` writes the redacted stdout tail (4000 characters; stderr 4000 instead of 300) of every command, stages log their outputs, the classification logs the changed paths and the window gate logs the values it compared. EVERY command, debug or not, ends with `<ev…

Design of the one-command release and the debug mode (W25.12.a) · 4e8b6f2

`cicd.cli release` resolves its own inputs (commit, running commit, key path, approval), decides the path from the change class and runs rehearsal, backup, production deploy or migrating release, after-run checks, evidence files, smoke list and landing in one process built from the existing stage code. Landing is last so a failed release never puts an undeployed commit on the origin. Git commits stay outside (the architecture contract forbids them in cicd code), so the command lists the evidence files it wrote. Th…

The stage chain test is a bullet of the folder README, like its neighbours · f2ab1e0

A repeated chat accept on an active chat answers with the row, and the whole stage chain is walked on a real Mongo (W25.4.a) · baf95f6

The new walk test (9 tests: every stage and transition of a connection, each result and each refusal with its status and transition code) showed that respondChat answered a second accept on a chat that is already active with 409 "requires stage chat_requested", while respondConversation, requestChat and pressReveal answer an already-reached state with the row. A double tap, a retry after a lost response or a second tab therefore got an error for a connection that was fine. Now an accept on an active chat with both…

W25.12 files the one-command release with its debug mode (owner orders of 2026-10-24) · 0797b4f

The owner wants every release step baked into the pipeline so that one command handles everything, and a debug mode that logs every level of problem. New story W25.12 (user story US-P25-010, requirement REQ-25-010) with eight sub-todos in build order: design note and design review, debug mode with an issues summary file at the end of every command, release inputs/plan/gates/dry run, the image path in one process, the migrating path, evidence without hand work, landing on the private origin, and the proof on the re…

F1 (MEDIUM): a request that turned slow between two clock reads of the cap step could pin the layer for ever. · 832bf88

A request now counts as slow when its own timer fires (no clock comparison), the cap step marks what is slow at that moment, and a visible layer always has a cap timer behind it. F2: a request that takes the layer over is reported too. F3: a clock step no longer hides a slow request. F4: the classifier never throws before the real fetch runs. F5: the tracker has dispose(), called when the provider unmounts, so nothing is logged for a layer that is gone. F6: nothing is logged while a full-screen loading screen hold…

Releasing a feature through the pipeline: paths by change class, stages, backups, rollback, migration release and the gaps (owner question) · a8f289a

New `release-a-feature.md`, written from the code of `cicd/` and the run records of the production updates of 2026-10-23 and 2026-10-24. It states which commands release a feature, what each stage does by itself (stage times, backup size and sha256 of the last run), the rollback table including the bridge release outcomes, the migration release steps and downtime, and seven things that are not automated yet: no single release command, evidence capture by hand, production runs a commit that is not on origin (watch …

The slow-request overlay is bounded and never traps the page (owner report 2026-10-24, W0.169.h) · 61975d9

A member on the Universe screen saw an opaque full-screen layer "Loading… Taking a little longer than usual" that took every tap until a reload. Cause: any fetch pending 5 s showed it and nothing ended it while that fetch stayed pending, and page fetches have no timeout. Now: the layer is shown at 5 s and given up after 8 s for the requests that made it show, and those requests cannot bring it back; event streams, keepalive calls and router prefetches are never counted; each show logs the paths that caused it (pat…

Backlog line for the Chrome DevTools MCP as an agent-only debug tool (owner question) · ee84760

The slow-request overlay that blocks /match (owner report): analysis, test strategy, defect filed as W0.169.h · 6adc356

The owner saw a full-screen "Loading… Taking a little longer than usual" layer on the Universe screen that takes every tap until a reload. It comes from SlowRequestOverlayProvider: any fetch pending 5 s shows an opaque fixed layer with no timeout, retry or log of the request. The note names the rule, the five design defects, what is and is not established (dev HARs show the discovery stream answers in 14 to 35 ms, production not reproduced) and a layered test strategy. Filed as a plan sub-todo with a verify that n…

W25.10.d (Dockerfile layer order) deferred with its measurement: code-only updates already ship 3 minutes · f844eee

The two code-only production updates of 2026-10-23 left 3397 and 3305 MB of 3633 MB out of the upload (ship 3 minutes each), so the layers that change with the revision argument are small. The 23-minute ship of 2026-10-24 was a dependency bump with really new node_modules bytes. Reopen when a code-only update ships more than 500 MB.

Production runs 4c1424c24e90 (the WAVE-25 batch): record, snapshot, ledger tick · 96a3e79

Image deploy green in 27 minutes after a green rehearsal of the same commit. readonly-check --expect-sha: 6 of 6. Snapshot: 19 containers, 0 findings, only backend, matching, ml-service and web-client changed. The live site answers /en with 200 and no console error, /api/health reports the commit. The upload took about 23 minutes because every image layer changed (Dockerfile layer order, W25.10.d, is still open). Tick 68 also notes that the subject of a600701c2 says fifteen items where eleven were checked off.

Review row for the dev-stack exemption of the deploy classification (both reviewers ACCEPT) · 4c1424c

Both reviewers accepted 01bf6bc01. · d481ca1

Their lows are fixed: the exemption is one case-sensitive name pattern (`DOCKER-COMPOSE.YML`, `docker-compose.dev-x.yml.prod.yml` and a space in the name are refused again, as the comment always claimed), the wording of the skip reason, the covering-rehearsal docstrings, the runbook and two READMEs now says "documents or the root dev-stack compose files", and a new guard test (`test_classify_dev_stack_guard.py`, with a planted-violation self-test) fails the day a target, a release image or deploy code starts to re…

The root dev-stack compose files no longer make a change "refused" (the rehearsal of the production candidate stopped at classify) · 01bf6bc

The rehearsal of 5407a6feb ended red after 4 s: classify compared with the running c03335cd8495 and refused the range because `docker-compose.yml` changed (env passthrough for the integration tier's stack). That file, and the root `docker-compose.dev-*.yml` files, define the developer's local stack (dev sign-in bypass on). No deploy code reads them: `rg docker-compose cicd` outside tests finds nothing, the rehearsal host reads `cicd/infra/rehearsal-host/compose.yml`, production is operator-driven. They now count a…

The integration project is registered in the tier file and ran green on 81 files in 31 minutes, the item is checked off in WAVE-25. · 5407a6f

The plan text still described it as open work. The plan-reference check prints 0 findings now.

Four wave-plan structure defects that stopped the maintainer gates (they also exist on the production commit c03335cd8495) · ffff9c5

verify-maintainer-gates stopped at `wave-state-dashboard --check`: WAVE-0 W0.140.bf.a/.b/.c did not parse as items (the item id grammar allows a two-letter last part, `.bf.a` has two parts: they were dropped from every total) and WAVE-24's story W24.6 needed W24.4.c, a sub-todo, not a known story id. Run on a detached worktree of c03335cd8495 the check printed the same four defects. The three WAVE-0 items are renamed to the free ids W0.140.bh, W0.140.bi and W0.140.bj (the id appears only in WAVE-0 and in one histo…

The LCP probe ignores largest-paint candidates inside the shell's second-factor banner (the second browser gate run still needed one retry) · 9087777

Final gate, browser run 2 of 2: 138 passed, 0 failed, 31 skipped like run 1, but match-universe-lcp-probe passed only on its retry again, although d8eba473a already waits for the strapline. The failure screenshot shows why: the viewer's "Add a backup way to sign in" banner (data-testid second-factor-prompt-banner, 3 of 3 skips used) was on the page, and its wide paragraph is the largest paint, an element without a test id, for the whole 10 s wait. Whether the banner arrives in time depends on the viewer's account …

Fifteen WAVE-25 items checked off by their own verify through the plan tool (their work is built, tested and reviewed); the plan write tool is reachable again · a600701

W25.1.a, W25.2.a, W25.6.a, W25.9.a, W25.9.b, W25.9.e, W25.9.f, W25.9.g, W25.10.a, W25.10.c and W25.10.f: wave_run_verify passed in this session and wave_check flipped the box. Not checked, on purpose: items whose verify passes without the work being built (the stage schema and disclosure items, W25.3 to W25.5), W25.1.c (its need W25.1.b, the Brave push item, is open), W25.9.c and W25.9.d (leftovers named in their text), W25.10.b and W25.10.d (the 5-minute target and the Dockerfile layer order are not done). proces…

The dependency reviewer's findings (crit-depsbatch, W25.1 round 1: ACCEPT-AFTER-FIXES): the ml-service tests now run on the image's own packages · d3509b5

- MEDIUM (reproduced, a gate that proved nothing): src/apps/ml-service/pyproject.toml declared no dependencies, so `uv sync` emptied the venv (my dependency commit did exactly that) and `uv run pytest` fell back to the host's pytest on Python 3.14 with fastapi 0.141.1 while the image pins 0.162.0: "ml-service-pytest 708 passed" said nothing about the image. pyproject now repeats the image pins of requirements.txt (fastapi 0.162.0, uvicorn[standard] 0.54.0, pydantic 2.14.1, pydantic-settings 2.16.1, numpy 2.5.4; re…

The reviewer's lows on the cicd batch (crit-cicdbatch, W25.10 round 1: ACCEPT-AFTER-FIXES, no HIGH or MEDIUM) and the marker that keeps offline selections off the real host · 1df6373

- prodshape.up: the record of a first attempt that will be recreated is a warning, only the final timeout is an error (the docstring said warning; a green run carried an ERROR line); a short mongo log no longer prints its lines twice. Five tests (from the reviewer's probe): the second attempt gets the full wait, the first container is removed before the second starts, the first attempt's record is logged when the second is green, warning level, no doubled lines. - bridge_rehearsal._boot_stack logs that it clears t…

typescript 6.0.3 to 7.0.2 is a major. · e743a0c

Installed plainly, ESLint stops ("typescript-eslint does not support TS 7.0"; its peer range is >=4.8.4 <6.1.0, support for 7.1 is tracked in typescript-eslint#10940): TypeScript 7 is the native compiler and ships no JS API. Microsoft's own setup for this (announcing-typescript-7-0, "Running side by side with TypeScript 6.0"), applied in src/apps/web/package.json: "@typescript/native": "npm:typescript@^7.0.2" (provides `tsc`, 7.0.2) and "typescript": "npm:@typescript/typescript6@^6.0.2" (the TS 6 API for typescrip…

Npm and pnpm dependencies to the latest release except TypeScript 7 (owner order 2026-10-19), and the new Sentry data category switched off · dd07597

Class O of the wave scan listed 18 outdated pnpm packages. Bumped with `pnpm update -r --latest "!typescript"`: @fastify/multipart 10.1.6, @react-three/postprocessing 3.2.2, @sentry/nextjs 11.9.0, @tanstack/react-virtual 3.14.22, dotenv 18.0.9, eslint-config-next 16.4.3, framer-motion 14.6.0, i18next 26.5.7, lucide-react 1.61.0, next 16.4.3, nodemailer 10.2.1, react-hook-form 7.91.0, react-resizable-panels 4.14.8, stripe 23.0.1, tsc-alias 1.9.9, turbo 2.11.10, vite 8.3.5; pnpm-lock.yaml and the two npm locks that …

Python dependencies to the latest release (owner order 2026-10-19: all code dependencies up to date, majors included) · b37e40b

The wave scan's class O listed 5 outdated packages in matching and 7 in ml-service. matching: certifi 2026.10.23, fastapi 0.151.0 to 0.162.0, pandas 3.0.6 to 3.1.0, pydantic-settings 2.16.1, python-dateutil 2.9.0.post0 to 3.0.0 (a major; it brings tzdata): requirements.lock recompiled with scripts/uv-compile-ci-python-deps.sh --upgrade, uv.lock upgraded and the venv synced. ml-service: the two pins of the image requirements (fastapi 0.162.0, pydantic-settings 2.16.1), uv.lock upgraded, venv synced (httpx2 and http…

Commit the reviewed baseline of the findOne-then-updateOne race check (the gate's maintainer script was red on one old candidate because the baseline file was never in git) · b28cb25

scripts/check_findone_updateone_race.py keeps its reviewed findings in scripts/.rmw-race-baseline.json, which the global `*.json` ignore rule hid: the file was never committed, was missing on this machine and the check reported its one old candidate as new (verify-maintainer-gates: FAIL). The candidate, PreferencesService.setMaxVisibleProfiles (W0.145.r), reads and writes inside runAccountAliveGuardedWrite: one Mongo transaction that first touches the account row, so a concurrent writer gets a write conflict and a…

The crawl's non-semantic pointer finding now says which element it is (parent chain and what the node holds); it showed up once in a full integration run and not when the file ran… · bd6814a

authenticated-shell-crawl failed in the gate's integration run with one finding outside the committed baseline: pointer-cursor-non-semantic on /:locale/you, a generic node with an empty name, box 812x20 at y=-88; it passed when run alone (3 passed). The same finding was seen in cycle 41 and "could not be pinned down" then; the box added for it did not say which element it was, and the failure text did not even print the box. PointerCursorFinding now carries `context`: up to four ancestors from the outside in as `r…

The integration tier's first gate run stopped at ensure-simulation-worker (HTTP 500): the stage simulation worker's persona was tombstoned by the previous run's "clear all profile… · dad917f

api-response-openapi-contract-conformance failed with "POST /api/internal/e2e/ensure-simulation-worker failed: HTTP 500". The api log: "Profile bootstrap did not return profileId for authUid=sim-gen-stage-sim-tick-1" (STAGE_SIMULATION_WORKER_AUTH_UID, a fixed persona). The last spec of a full integration run, "clear all profiles", tombstones every profile, this fixed one included, so the next run's bootstrap is refused. clear-fixture-tombstones removed only dev-user-* and the registration mailboxes; it now also re…

The LCP probe read the first largest-paint candidate, which can be another element, instead of waiting for the strapline (the one flaky test of the browser run) · d8eba47

Browser run 1 of the gate (137 passed, 1 flaky, 31 skipped, 0 failed): match-universe-lcp-probe passed only on its retry, attempt 1 read `lcpElementTestId` null (expected "discovery-universe-strapline"). The probe's observer keeps the LAST largest-contentful-paint entry; the earlier fix (2026-10-23) waited for the first entry to exist, but the first candidate can be an element without a test id and the strapline becomes the largest a moment later. After that wait the probe now also waits (10 s) until the reported …

My wait in the journey welcome helper failed every lane's sign-in setup (the viewer was already on the reflection step); it now waits for three outcomes · bce10a1

47a2d2553 made ensureJourneyWelcomeCompleteForShellE2e wait for the welcome Continue button or the hub hero title. In the next browser run the setup of every lane failed ("The journey page must settle on the hub or on the first-visit welcome screen", 26 files with exit 125 and the registration files red): the setup viewer is sent on to the reflection step, where neither exists, and the old early return was right for it. The helper now waits until the page has settled on one of THREE outcomes: the welcome screen (C…

Remove the stale known-broken entry of the browser tier's lanes step (the tier is green) · a9760c0

docs/notes/known-broken-tests.yaml listed e2e-lanes (the match-universe-lcp-probe on the production-mode server). The gate's browser run reported it stale: the step passed (138 passed, 0 failed, 31 skipped) and the probe's file passed. Entries for the other tiers (e2e-ui-authenticated, e2e-i18n-fingerprints) are untouched.

The journey welcome helper looked at the URL once while the page was still deciding between the hub and the first-visit welcome screen (the one flaky test of the gate's browser ru… · 47a2d25

First good t2f run of the gate: 138 passed, 0 failed, 31 skipped (the baseline sets), but one test passed only on its retry: journey-hub-and-you-smoke, attempt 1 expected the hub's return-visit subline and found the first-visit welcome screen ("Find Real Connections ... Settle for a breath"). ensureJourneyWelcomeCompleteForShellE2e returned at once when the URL did not say phase=journey-intro, but the journey page keeps phase=welcome (the hub) in the URL until the profile has loaded and only then shows the welcome…

The browser tier failed 40 of 79 files because the integration tier's "clear all profiles" spec leaves admin-delete tombstones for the browser tier's registration mailboxes · 2415ea9

First t2f run of the gate: 35 files with exit 125 (the lane's sign-in setup failed, so every signed-in file of the lane was skipped) and 5 registration files red, all with "We couldn't load your match profile". The web log named the cause: get-or-create-profile failed: "This account was removed by an administrator and cannot sign in again" for [redacted email]. The integration spec "clear all profiles" deletes every profile and tombstones it (deletedAuthUidTombstones: authUid and emailNormalized), and the tombston…

Two test files used /home/u/... as example paths and the product-isolation guard of the gate refuses machine paths under cicd/ · 0804032

scripts/check_product_isolation.sh bans `/home/<name>/` literals in .py files under cicd/ (the pipeline never walks into a checkout or a home folder). test_ansible_transport.py (3 lines) and test_command_events.py (1 line) used `/home/u/.ssh/...` as fake key paths; they are now `/srv/u/...` (the tests only compare the strings, 54 tests pass). The guard was red in the fifth gate pass, after the earlier steps; it had not been reached before.

The production-shaped mongo is recreated once when the first container is not PRIMARY in 60 s (bounded mitigation of an intermittent hang whose cause is still open) · 66df870

The parallel cicd run of the gate failed once in 4 of 5 runs with "production-shaped mongo not PRIMARY after 180 s", a different rehearsal-host test each time, each green alone; the fifth run passed (1296 tests, 950 s). The fixture starts PRIMARY after 8.8 s on an idle machine (15 starts in a row), and the record of run 4 showed a running mongod with a replica set that never got a primary. The root cause is not found, so this is a MITIGATION and says so: ProdShapeMongo.up gives the first container FIRST_ATTEMPT_SE…

A readiness timeout of the production-shaped mongo now also names the last readiness probe and the warnings of the mongo log, not only the noisy tail · beee59d

The fourth parallel gate run failed again ("not PRIMARY after 180 s", test_the_rehearsal_is_green_on_a_clean_backup...) and the new container record showed: running, exit 0, no OOM, but a log tail made only of the repeated informational "Failed to refresh key cache / ReadConcernMajorityNotAvailableYet" line, which fills any tail and hides the cause. On the idle machine the same start is PRIMARY after 8.8 s (15 runs in a row, probe in ~/.claude/backups/uber-w25/app-trueconnection/probes). ProdShapeMongo.up now keep…

A readiness timeout of the production-shaped mongo now says what the container looks like (the gate's parallel runs failed three times with only "last state ''") · 2b204e2

The fixture is PRIMARY after 8.8 s on an idle machine (probe: three runs, 8.8 s each, ~/.claude/backups/uber-w25/app-trueconnection/probes/prodshape_up_timing.py), yet in three parallel gate runs a different rehearsal-host test failed with "not PRIMARY after 180 s (last state '')", each green alone, also with the docker files in one group (third run, 18 min): so it is not cross-group contention alone, and the error held nothing to read the cause from. ProdShapeMongo.up now logs, on a timeout, the container's state…

One xdist group for everything that touches docker: the rehearsal host is a container of the local daemon, so two groups competed for it · 8e1b41b

The parallel cicd run of the gate failed in three runs out of three with "the production-shaped mongo is not PRIMARY after 180 s" (or a leftover container name after a killed run, fixed in 80f5394e8), each time in a different rehearsal-host test, each green when run alone (11 passed in 463 s). The rehearsal host is `tc-rehearsal-host`, a container of the local docker daemon with its own nested daemon on a volume (cicd/infra/rehearsal-host), so the rehearsal-host files and the local-docker files (image builds, comp…

The gate ran the cicd suite serially into its 600 s step limit, and a killed rehearsal leaves boot containers that fail the next run · 80f5394

- deploy/test-tiers.yaml: the cicd-pytest step ran the suite serially (about 1000 s) with a 600 s step limit and was killed at 27 % in the gate of 2026-10-24 (not a failing test). It now runs `-n 6 --dist loadgroup` (the suite marks its rehearsal-host and local-docker files with xdist groups for this) with a 1200 s limit; scripts/test_tc_test_all.py pins the line and the groups. - The first parallel run in the tier: 1292 passed, 2 failed (test_bridge_drill, test_bridge_rehearsal::restore), both in the rehearsal-ho…

The live view may import exactly the one redaction file of the pipeline, not all of cicd-core (the gate's contract test failed), and the spec-each tool tests no longer depend on t… · 8eabd90

- plan/architecture-contract.yaml: the tooling layer was allowed the whole cicd-core layer for the sake of cicd/core/redact.py, so scripts/tool.py -> cicd/core/types.py was no longer a layer-edge finding (scripts/test_architecture_contract_cicd.py failed in the gate). redact.py is now its own one-file layer cicd-redact, declared before cicd-core so it matches first; tooling may import only that layer; cicd-core and every layer that was allowed cicd-core are also allowed cicd-redact, so their permissions are exactl…

The reviewer's three lows on the Integrations save patch, and the logging ratchet of the gate (one logging site for the harmless uncaught errors) · 29a36df

- Review of 86b932fc6 (crit-intsave, W25.2.a round 1): ACCEPT-AFTER-FIXES, no HIGH or MEDIUM. Three tests added: the tab sends the exact body {enabled, mode, secretRefs: {apiKeyRef}, priceMap: {}} for a changed ref on a row that already has prices and refs (the old test used objectContaining and stayed green on a revert of the wiring), a loaded price cleared to blank goes out as an empty string, a SKU typed and erased again is not sent when the row never had it. The module doc comment says the loaded price map is …

The lint ratchet of the gate failed on one new error: the test component returned from makeApp had no display name · adb23bc

identityHookStrictMode.test.tsx (added with the token-reuse reviews) returned an anonymous arrow function as a React component, which the react/display-name rule counts as a new error (ratchet 22 errors in 16 files against a baseline of 21 in 15). It is now a named function App; the 4 tests of the file pass and the ratchet is back at its baseline.

Three integration specs that still asserted behaviour the product changed on purpose; the tail of the integration tier is now green (0 of 11 red) · cbce129

- onboarding-second-contact-gate-two-directions: since W9.6.g (2026-08-28, commit 646466bb5) onboarding needs ONE verified contact; the second is encouraged and no longer blocks submit (checkout still requires both). The spec asserted onboarding-submit is disabled; it now asserts enabled, and it uses the shared ensureMandatoryOnboardingCompleteForShellE2e to fill the required year of birth and gender before submitting (the form needs them; the old spec never filled them). - profile-settings-privacy-notifications-s…

Three more integration causes found one red file at a time (each green alone, the run continued from it): the journey gate and a paid filter behind two discovery specs, and a hang… · 6a835b1

- Journey gate: the discovery list and the Universe stay behind "Finish reflection and connection first" until the VIEWER has answered the bank minimums, and a peer who has not answered is listed to nobody, so a match materialized between members who answered nothing is never drawn, SSE event or not (discovery-match-materialized-sse-two-new-peers-race: the page showed the gate, then an unrelated persona row). The journey logic is now ONE implementation, completeJourneyWithBearer, behind two entry points: the exist…

The next causes of the integration tier, one red file at a time (each green alone, then the run continued from it): seven dev-fake billing files had one root cause, plus five more · 6f50b69

- Dev-fake billing (7 files, HTTP 401 "Missing or invalid Authorization header"): activateDevFakeBillingProviderForE2e used the no-token dev-bypass admin path, which devBypassGate.ts locks for good once any other profile exists. It now signs in as a platform admin (sim-synthetic identity, mailbox in ADMIN_EMAILS) and activates with a bearer token, so the order of profile creation no longer matters; the helper README row says so; the billing, chat and cron files after it passed in the run. - Settings modal helpers …

The next causes of the integration tier, found one red file at a time (each file green alone, then the run continued from it): a real lost-update defect in the Integrations tab an… · 86b932f

- Product defect (found by admin-integrations-concurrent-price-map-race on its second run, against a row that already held prices): Save sent every loaded price and secret ref, and the server merges field by field, so an admin saving only an API key ref overwrote another admin's concurrent price change with the stale loaded value. New integrationsSavePatch.ts sends only the fields the admin changed (a cleared ref goes out as null), IntegrationsTab.tsx uses it; 5 tests; the spec is green on a non-empty row. - admin…

The next causes of the integration tier, found one red file at a time with the fail-fast runner (each fix proven by running only that file; the files that were red for these cause… · e557f6a

Why the integration tier hung: the first-session push prompt, a modal dialog over /match and /chats, covered the whole page for every simulated member, so every click of the two-p… · 0fc1324

Fail fast in the pipeline (owner order 2026-10-23: the run must stop when an error is found, the test with the issue is fixed and just that test run until it is green): tc-spec-ea… · 50db4ae

W25.9.i (live view truth fixes) checked off by its own verify after the hunt (12 findings), one reviewer round (4 reproduced MEDIUM, all fixed in 12640619e with tests) and the sav… · c88bed1

The reviewer's findings on the live view truth fixes (W25.9.i round 1, ACCEPT-AFTER-FIXES, four reproduced MEDIUM): the page no longer freezes when the server clock steps back (th… · 1264061

The live view marks a red run that a later green run of the same profile followed as history (superseded: shown in plain colour with the words), not as the current red state; the… · 4c06cd6

The live view shows the CI/CD state and stays true (W25.9.i, owner order and the hunt of the live view, 12 findings): a CI/CD block read as data (the sha production runs, the last… · d32ad86

The integration tier now really caps each file at 300 s: the commit that said so left "900" in the tier file (a sed that matched nothing), so the fourth run sat 26 minutes on file… · 06b5be2

W25.1.g (the APM agent only when active) and W25.1.f (duplicate requests) checked off by their own verify: both were built, reviewed and are in production, the plan boxes were sta… · bf2279e

Process slip of the mistyped message path recorded as fixed by one fixed short path (pre-mortem checklist), learnings regenerated · 9de2add

The undici double close classifier after the reviewer report (W25.2.a, ACCEPT with three lows, all done): the reviewer reproduced the crash against unmodified undici and found tha… · 47a94ce

The reviewer's findings on the integration tier fixes (W25.2.a, round 1 of the test stack part): reset-limits restarts the api first and then empties the persisted OTP budgets (a… · 92e045b

The three biggest causes of the integration tier's red files (W25.2.a, third run: 59 of 81 red): (1) the production web server CRASHED on an uncaught TypeError from Node's bundled… · f1ec44e

Scripts/cicd-tests.py, the parallel runner of the cicd suite (W25.10.b): --jobs N runs pytest with xdist and loadgroup (default min(6, cores/4), 0 is serial), every file red in th… · 42512fe

Process learnings with the slip of the tooling import · 9ebd4e7

The live view imports no pipeline code (the architecture scan blocked two edges: scripts/ is tooling and reads the pipeline's records as data): the stage order is read from the ne… · 4e95104

The process overview gets section 8, the feedback loop and the live view (tick check, slip gate, automatic measures, live page); the intro no longer mentions a shared online page;… · 8ea1097

W25.9.h (the live process view) checked off by its own verify after two critic reports and the arbitrator (LAND-AFTER-FIXES, fixed in ff4af681f) · b22c826

The live view after the arbitrator (W25.9.h round 2, LAND-AFTER-FIXES): a run that raised or was interrupted has no exit code (run_log writes exit_code null and outcome "exception… · ff4af68

Scripts/process_auto_metrics.py, the measures of the delivery process derived from records that already exist (bug hunt finding: the hand-typed record held none of the 38 rehearsa… · 5e1843f

Scripts/tick_check.py, the one call that starts a loop tick, the STATE table as a priority order, and a check of the finish plan's own item list (bug hunt angles A, C and D): tick… · 1f08ecc

The bug hunt of the delivery process and the two reviews of the live view (owner order: hunt the process until it works flawlessly, test atomic then integrated; 4 read-only report… · 52df83b

The disk guard's build cache housekeeping after two critic reports (W25.12, both ACCEPT-AFTER-FIXES): the refusal text is unchanged again (the added suffix changed the feedback fa… · 0a8b1c4

The live process view (W25.9.h, owner order: a view that updates by itself, shows where we are, in which step, for how long, and what is worked on; a researcher compared a push se… · 71ccc0c

The feedback loop of the delivery process (owner order: a continuously improving loop, bug-hunt the process, test atomic then integrated): process_metrics.py keeps slips, work ite… · 53abc25

Scripts/run_status.py, one call for the progress block of a loop tick (first tool of the process feedback loop): running tools, files done/red/at the cap with ETA, newest tier sum… · 7653d5c

The whole process as seven mermaid diagrams with plain-word descriptions (process-overview.md) and an HTML view that renders them in a browser from a pinned mermaid library (proce… · dad9bea

The integration tier caps each file at 300 s: the second run showed that the two-peer files, which used to fail at once on the tombstone error, now get past their first step and w… · aa186ff

The integration tier no longer fails six files on a tombstone it made itself (W25.2.b): the admin clear-all-profiles spec tombstones every profile including the fixed dev users, s… · e62dba3

A permanently deleted account is a refusal (403, code PROFILE_AUTH_UID_TOMBSTONED), not a server fault (W25.2.b, found by the first run of the integration tier): six spec files go… · f7ff53b

W25.7.b is done: a test scans the api source for every place that sets its own Cache-Control and requires each to be on a reviewed list (the discovery event stream, the personal f… · 4bb7dbd

W25.6.g research: the 704 KB page document is the whole message catalogue in one flight payload (215 KB gzip on the wire), a wholesale cut is unsafe because the admin namespace is… · 777c273

The finish plan ends with the landing of the verified commit on the private origin (59 local commits were unpushed) · 2003f09

The integration project gets its own tier t2i (W25.2.a, first part): 81 spec files one after another on the production-mode stack with the api restarted every 6 files, because the… · 1568ea6

The finish-to-production plan: one loop plan that works the open points in order (tier registration of the integration project, the product and quality items, the wave exit demo,… · 72dd20c

Tick 66 closes the speed and logging work of the day: what was done, the numbers, what is open on purpose, and the housekeeping rule for the Docker build cache · 97c83db

W25.11.e is done: the second timed run of the integration project (81 files, 67 minutes at a 240 s cap, 19 green, 62 red, 13 files stopped at the cap) replaces the first note with… · 39ccbb2

W25.7.c (token lifetime) and W25.7.a (catalogue caching) are checked off: the first with a verify that names the web tests where the work is (it was filed against the api), the se… · 53dea34

The first timed run of the integration project (W25.11.e: 81 files, 644 s, 13 green, 68 red) is recorded with every file and its cause, and its biggest cause is fixed at the helpe… · 74c9057

W25.11.d is deferred with its measurement (the fixed sleeps sit in poll loops and in Zitadel flows the local stack skips, no file in a results.tsv shows them), ledger tick 65 for… · 17b31c2

W25.11.c (the 194 s spec) is checked off with a verify that can run: the committed lane timing of that spec is under 60 s (it is 8 s), the item text names the cause and the fix · 2344559

The lane timings are refreshed after the fix of the 194 s spec: the run on d431caf4b passed the same 138 tests (0 failed, 0 flaky) but the lanes were unbalanced (322, 117, 299, 27… · 1167d62

The registration spec that took 194 s takes 8 s (W25.11.c): the poll of completeMagicLinkSessionFromVerificationMail called waitForNextAuthSessionEmail, which loops for up to 180… · d431caf

The web fixes (one token request and one preferences read per page load) are in production (c03335cd8495, green in 8 minutes): the copied record, the snapshot after it (19 contain… · c0efd66

W25.6.e and W25.6.f are checked off (the HAR spec findings: one token request and one preferences read per page load), proof: the tier run on e5cc3f9e0 with both waivers deleted,… · c03335c

The lows of the second review of the token reuse and the preferences share (crit-w256e-r2: accept after fixes, no medium): the share now keeps a read that is still in flight for a… · 97fb8b7

The review of the token reuse (crit-w256e rejected with one reproduced MEDIUM) and the second duplicate request of the HAR spec (W25.6.f): after an account swap in one commit the… · e5cc3f9

A page load makes one /api/auth/token request again (W25.6.e, found by the HAR spec on /match): the discovery stream asked for a fresh token on its first connect although the API… · 2da37e7

W25.11.b is done with its proof: two clean runs of the fast browser tier on one commit (138 passed, 0 failed, 31 skipped, 0 flaky, both), the longest lane 316 and 324 s instead of… · 9cc6601

The loading-time probe of the match page waits for the first largest-contentful-paint candidate before it reads it: since the page got faster (cached token, fewer requests) the st… · 17dbd00

The first run of the HAR spec in a lane found real problems and they are filed instead of hidden: match asks /api/auth/token twice (the event stream asks for a fresh token), chats… · 702f28c

The lane timings of the live browser tier are refreshed from the last measured run (runs/dev/spec-each/20261022T013704/results.tsv, 78 files): offline, with the real seconds of th… · 6a732e7

W25.10.e (the layer-aware upload) is checked off with its real tests: the verify named a test file that was never written under that name, the item text now names the tests, the p… · 747eb14

The first production deploy with the layer-aware upload (fec5ed7f54ab) took 5 minutes instead of 27, ship 149 s instead of 1378 s: the copied record, the snapshot after it (19 con… · c852594

The lows of the arbitrator on the layer-aware upload (arb-w2510d, verdict LAND): a delta load that loads no image is followed by the full send (it would only turn the ship stage r… · fec5ed7

The review of the layer-aware upload (crit-w2510d-a rejected with one reproduced HIGH, crit-w2510d-b accept after fixes with two MEDIUM): a layer is now judged by its chain id (th… · 35de630

The image upload leaves out the layers the host already holds (W25.10.d): measured on the two last production images only 0.33 GB of 3.8 GB were new (the 3.2 GB ml-service image h… · a3b440d

The environment check of every command takes no optional git lock (arb-w259 L1: git status refreshes the index of a checkout that other sessions commit in, a lock clash could fail… · 500fd0f

The image deploy of the review fixes is in production (903232f73dec, green in 27 minutes): the copied record, the snapshot after it (19 containers, 0 findings, only backend, match… · 2e3986a

The review of the token lifetime (crit-w257-token, both commits accepted, seven low findings fixed with tests): the cached login token ends at the earlier of the server-reported e… · 903232f

Round 2 of the critic on the pipeline logging (crit-w259-r2; all ten round 1 findings fixed, one new reproduced medium): the description of the environment can no longer stop a co… · c2b2948

The hold history, retention of the event logs and no silent error (W25.9.f, W25.9.g): every hold is kept in runs/hold-history.jsonl with the hold it replaced and shown by tc-cd ru… · e37721d

Round 1 of the two critics on the pipeline logging (crit-w259-safety, crit-w259-corr; both accept after fixes; four reproduced medium findings): a failing event log file (full dis… · b87466d

Every command of the pipeline leaves a persisted record, and there is a command to read them (W25.9.a to e, W25.10.b): a redacted JSON-lines event log per sub-command in runs/log… · 6ab402d

The security headers hook is a callback hook too, and the test that guards the double send can fail (review crit-w25-hook F2 to F4): an async onSend hook beside another one answer… · 635e37d

Evidence of the production deploy of the cache-control hook fix (68b510166f57): run record (green, 27 minutes), snapshot after it (19 containers, 0 findings, only backend, matchin… · 0d29f1a

The cache-control hook is a callback hook, not an async one (found by the bridge rehearsal on the deployed commit): an async onSend hook finishes a microtask after the send, so a… · 68b5101

Where the browser tier time goes and what was decided about Playwright and the Chrome DevTools tool (W25.11.a): offline numbers of the last fast-tier run (perfect lane balance sav… · 8ecba47

HAR evidence in the browser runs (W25.6.b): a spec in the ui-authenticated project loads /match and /chats in a fresh recording context and judges the network against committed pe… · 5784de8

The five low findings of the second critic round and the token lifetime from the server (W25.7.c, reviews crit-w25-r2 L1 to L5): /api/auth/token answers { token, expiresIn } with… · a936f89

Evidence of the production deploy of the review fixes (35cd4915a831): run record (green, 27 minutes, ship 1391 s of 1635 s), snapshot after it (19 containers, 0 findings, only bac… · f0ab3ca

The folder README check of the commit gate takes seconds, not a minute (W25.10.f): scripts/check_readme_stale_fast.py computes class I of the wave scan from one git log pass (0.5… · 5538a3a

Tc-test-all.py --stop-on-red for fixing (W25.10.c): no step starts after the first failing one, the rest are recorded as not-run, a known-broken step does not stop the run, the fl… · c7100fb

Findings of the first critic round on the WAVE-25 commits (reviews crit-w25-sec and crit-w25-corr): a cached bearer token is no longer used after its own expiry (MEDIUM, productio… · 35cd491

WAVE-25 gets three stories before the exit demo: pipeline logging with a run index and a runs command (W25.9, seven items), process efficiency with the measured time wins (W25.10,… · 18039bc

The folder READMEs that the commit gate (class I) reported as stale are current again: 17 folders list every file they hold (the bridge and image-deploy tests of cicd/tests, WAVE-… · f641894

The reflection screens made the same requests twice, and the api answers carried no cache rule (W25.1.f, W25.7.a, W25.7.b): the questions and the reflection progress are now fetch… · b55fa5b

Evidence of the WAVE-25 production image deploy of 53beb67d41f1: the run record, the snapshot after it (19 containers, 0 findings, only backend, matching, ml-service and web-clien… · 8fb8901

The loop plan works WAVE-25 in order while no application change waits to deploy, and ships the committed WAVE-25 fixes with the rehearsal run and the image deploy · 53beb67

The Elastic RUM agent is no longer in every page (W25.1.g): ApmProvider used a synchronous require, which kept the 72 KB agent in the bundle although APM is inactive in production… · a18a379

The discovery event stream refetched the profiles right after the first load (W25.1.c): onOpen invalidated unconditionally, so a /match load requested the same profiles twice (the… · 7e6950f

The browser asked /api/auth/token 5 to 19 times per page load (W25.1.c): only calls in flight at the same moment were shared; a resolved token is now reused for 30 seconds and dro… · 0389b12

Push registration in Brave (W25.1.b): Brave switches Google push off by default, so PushManager.subscribe fails with "Registration failed - push service error"; the toast now name… · 7756af2

The HAR evidence analyzer and its CLI (W25.6.a): one pure module that judges a HAR against a budget (failed requests, duplicate GETs, token calls, document, script and stylesheet… · 3d49ca6

The 13 findings of the second HAR filed in WAVE-25 (frontend W25.1.f to i, a new backend story W25.7 with the catalogue cache, private no-store by default, token lifetime, Server-… · 6d3a264

The crop modal and its stylesheet load only when the cropper opens (W25.1.a): /match and /profile no longer preload react-easy-crop.css that they never use (Chrome: "preloaded but… · 48b6ad6

WAVE-25 gets the HAR evidence story W25.6 (a network record for every checked browser route, measured against committed budgets, usable on a hand-captured HAR) and the item for th… · b369204

WAVE-25 filed before the work: the /match browser issues (unused CSS preload, push on Brave, repeated requests, 705 KB document), the integration specs in a tier, the full Univers… · 5bad17c

W24.4.d (the first real production deploy) checked off with its evidence; its verify text corrected (the old command named a flag that does not exist; the proof is the sourceRevis… · 5af14e8

The redacted playbook logs of the two latest production snapshots (they were left untracked; the README says these logs are kept, scanned clean) · 53ed93b

The first routine image deploy to production is green (run 20261022T205421Z-129adee0-ea3481, 27 minutes, rehearsal run of the same commit as evidence, verified backup before the s… · 1522e85

The loop plan gets the waiting state of the first routine deploy (what to read, what to do per state, rehearsal run then image-deploy outside the cron window) · 129adee

Tick 56: the local main (255 commits) is pushed to the private origin after the approval catch-up, the independent check and the pre-push hook; origin equals local HEAD; the watch… · 5958c5a

Regenerate release-notes.generated.json before the first push of the 253 local commits (the pre-push hook W0.154.p regenerates it from git history; done here because the hook cann… · 1a4e527

The seven catch-up reviews for the push are answered (all clusters accepted, medium findings fixed in earlier commits); APPROVED lines in the ledger; stale 30-day comments in phon… · 5f7d28c

Findings of the catch-up reviews before the push: --release-sha must be the running commit or a descendant (it accepted any ancestor), the preflight report folder must be git-igno… · 4b7d410

The openers stub names the real viewer in the connection row (08fa90e29 left the call without its new argument, found by the catch-up review of the push; tsc does not check tests/… · 09951d3

Tick 53: the image deploy mode is green on the final commit (1146 passed); the one red run was a docker collision, shown by the files passing alone; next item is the push that put… · 722022b

The referee's low findings on the image deploy (decision LAND): the hold is written at the red stage by an observer, so a lost record or an interrupt cannot hide it; every test ge… · 91e26c4

The image-deploy mode after the code review round 1 (safety: accept after fixes, correctness: reject; seven medium findings, all fixed with tests that were red first) · 185ce37

A disk error during the backup is a refusal that changed nothing, not a crash that triggers a rollback on production. deploy/HOLD stops the plan before anything is built or sent, and a red deploy that rolled back or may have touched the host writes the hold. The plan seeds the full approved commit (classify compared it with the full commit and refused the short one). The rehearsal evidence needs the real adapter set, the newest run of a commit decides, and an earlier rehearsed commit covers a documents-only change…

The routine production deploy of an image-only change: --run-mode image-deploy (W24.4.d), built and tested, not yet run on production · 4905da1

The run plan refuses before anything is built: no deployed or approved commit, another commit than the approved one, a commit that is not newer than the running one, the api cron window, and no green rehearsal run of exactly this commit (read from the run records, a check or dry run does not count). The rehearse stage is skipped only with that evidence named. Classify demands that the host reports the commit the run was told runs now. The deploy port takes a verified database backup first (runs/backups/<run id>/pr…

W24.6.i and the story W24.6 checked off (database migration in the pipeline: migrating class, production build, transport, backup and restore, rehearsal, bridge orchestration, rev… · 3312328

The bridge release is done: production is migrated and runs 3ce8b99b3 (run 20261022T155534Z-bridge, green, window about two minutes); W24.6.h closed; the snapshot check no longer… · b9efd10

Evidence: readonly-check with the new sha passes, 19 containers, database ifeoma 61 collections / 7455 documents with the migration ledger (the connections backfill accepted partial, 8 rows). The post-release snapshot found that the labels name the transient override; the check now ignores it like the drift check does, pinned by that real snapshot.

The first real bridge release was restored at the deploy step: the precheck read the stale unhealthy health of the four services the bridge itself had stopped; the exemption now c… · ba885ab

The failure path worked for real on production: the migrations had been applied, the database was restored from the final backup on the first try, the old images came back and the six read-only checks passed. Evidence and root cause in the design note.

Seam tests of the command line (every bridge-release mode reaches its function with the right arguments and exit code; every subcommand has a dispatch branch), after the owner's o… · 3ce8b99

Runbook: later deploys that carry a migration use the same bridge-release command (W24.6.i) · bec9c5a

W24.6.a to g checked off (migrating class, production build inputs, image transport, data operations on a production-shaped mongo, migration rehearsal on a restored copy, bridge o… · 21932c7

Ledger tick 48, the bridge release is ready for the real run in the quiet window · be18884

Bridge failure drill with the real operations against a stand-in database (green run, failing deploy restored, dead pipeline finished from its record), abort command glue test; th… · 2152213

The bridge applies the migrations one at a time and accepts a bounded partial of one listed additive migration (found by the first dress rehearsal on the real backup: 8 connection… · 7ebaf38

The run stopped before the window with production untouched, as designed. connections_chat_profile_id_backfill_v1 is additive and nothing reads its ledger entry; deploy/bridge.yaml accepts up to 20 unresolvable rows for it, every other migration must report applied. The accepted count goes into the run record. Decision and evidence in the design note.

The bridge run context resolves the owner-approved commit (the first prepare run on production refused the word HEAD), with tests for the context and for the assembly of the bridg… · 39dcd20

Bridge-release --prepare, the dress rehearsal on the real data: build, backup 1, rehearsal on the restored real backup, ship, production dry run, then stop (status prepared); no w… · feb8f7a

Bridge release after the referee (land after fixes A to D): the failure path remembers what it did (old_restarted, drop_issued are on disk before the act), a run on a stopped stac… · 628e19f

The referee re-ran every saved probe; its probes became tests. The pre-check ran on production for the first time (read-only): deploy/bridge.yaml now has db_name and the 15 expiring collections.

Docs+feat(cicd): bridge runbook; the read-only pre-check also reads the app database state (collections, counts, hashes, index lists: the TTL and operational reviews need it) · 0f3ab8e

Referee on 872a9d5de: land after four fixes, pre-check may run on production now.

Bridge release after the code review round 1 (safety and correctness): the run record is written before the stop and before the apply, --abort refuses an ended run and checks the… · 872a9d5

Both reviewers: accept after fixes, nine findings each answered in the design note. New: data_diff (data writes only), TTL-lenient diff_state, verify_archive, the rehearsal measures what the booting stack writes by itself and the bridge stops before production when it is not inside deploy/bridge.yaml operational_collections. The live fixture test found docker's lower-case "no such object".

A database is dropped only when it differs from the verified restore point and only with a BackupProof; no exit code decides a data action. · 5cf4209

The migrations are selected explicitly (--only). The baseline exempts the containers the bridge itself stopped. Proven on the rehearsal host: a restored backup is migrated by the real CLI of an api image, a second apply changes nothing, the new api answers ready on the migrated copy, an unresolvable row stops the rehearsal, and the adapter restores a migrated database to the restore point. Nothing here has run against production; db_name stays empty until the read-only preflight has read it.

Bridge data design v3 after the round 2 review (a drop needs a backup proof, no exit code decides a data action, the database name has one source, cron lock rows do not decide RED… · 7771781

Closed catalogue of remote operations for the bridge release (W24.6.d): database dump, state, drop, restore, stop, detached migration run; proven on a production-shaped mongo; des… · 70536bf

The password never appears in an argv (config file inside the container, mongosh reads stdin). A restore is drop plus restore: proven that a ledger, lock and new collections created after the backup are gone afterwards. Design note v2 answers every finding of the safety and correctness reviews.

Production-shaped mongo on the rehearsal host (6.0.28, replica set, keyfile, root login) for the bridge data steps (W24.6.d groundwork); fix: the rehearsal ssh helper quotes its w… · d86cf33

Image transport to production (W24.6.c): key and pinned host keys from the run variables, production host disk checked before any send, sending off for the no-op redeploy · 8cd115d

Database migrations are a supported change class (W24.6.a) and production images can be built (W24.6.b) · 86f5876

migrating class replaces the migration refusal (red unless the migration steps are wired), watch action would-deploy-with-migration, ports 1.6.0 facts. Production build: stable pipeline secret outside the repo (0600), public push key in the prod profile, AdoptedImages hands every mode except the no-op to the builder, shared build_disk_guard. WAVE-24 gets story W24.6.

Ledger tick 45 (loop stopped at the owner's decisions), drill failures git-ignored · 8bfb956

The backup procedure no longer starts a process in the compose layer (architecture contract): spawn_to_files lives in cicd/adapters/proc.py, with a test · c1390a9

Database backup and restore check (W24.4.d groundwork), proven on the rehearsal host: mongodump archive with sha256, restore into a scratch database, equal collection hashes, a ch… · 68e3a15

backup-proof --profile rehearsal seeds its own synthetic database and never touches application data. runs/backups/ is git-ignored (a production backup holds real user data).

Stage C closed (W24.3: acceptance drill passed twice), decision pack for the first real production deploy (W24.4.d), ledger tick 44 · dffe4a6

Pipeline runbook, production bindings for stage-deploy-verify (W24.4.f start); two security items filed in the wave plan · d0a77f5

The first no-op production run is green (W24.4.c closed): 19 containers compared before and after, none changed, nothing recreated · 2089569

Run 20261022T094608Z-b98a179a-5f29aa on the owner's approval of production writes: adopted images, nothing shipped, whole-host capture twice, recreate never, six read-only checks. An independent snapshot afterwards equals the one from before any pipeline run. Evidence: the run record, the new snapshot and its log, the design note result, ledger tick 43, plan check-off.

Production target and profile enabled after the owner's approval of production writes ("PRODUCTION WRITE IS APPROVED", 2026-10-22); only the no-op redeploy exists and every run st… · d85781d

Tests updated (the CLI and composition refusals now stop at the reviewed-sha gate, before any connection; the helper sets the switches both ways). The approval is read as the first no-op run only: the database backup, the migration bridge, production secrets and the canary identity stay open. Ledger tick 42.

Production no-op run, referee findings: the first whole-host capture is judged against the reviewed baseline before anything changes; the discovery asks the public site for the ru… · c094ffb

845 cicd tests pass.

Watch --once --dry-run (W24.4.e start): follow origin/main, read the running commit, decide idle, skip, would-deploy, held, needs-human or busy; first pass finds production 260 co… · 60f0c1b

GitCli.fetch_branch fetches remote-tracking refs only. Dry run only: a real deploy is W24.4.d. The finding (the first real deploy is not an automatic image-only deploy) is in the design note, the ledger (tick 41) and the knowledge base.

Production no-op run, review round 1 findings (safety A and correctness B) · 04c54d3

The no-op compares every container (the app services too), a failed change still gets the second host capture, the rollback runs inside the same two captures, a deploy service without a container is refused before anything changes, a host that runs another commit than the run was told is refused, files hidden from git status (assume-unchanged, skip-worktree) are refused by the gate, every stored ansible log is redacted, one reader for inventory host lines (; comments), changes name old and new values, a conftest r…

The no-op production run (W24.4.c built, production target disabled): own-images deploy guarded by a whole-host capture before and after, adopted-images build, honest not-used ope… · 180b887

Proven end to end against a local fixture host with the real orchestrator, ansible and docker (no container recreated). The production target stays enabled: false until the owner approves the first production write. The comparison of two host snapshots moves to core (hostdiff) and ignores list order. Also: ini comments with ';' in inventories, backlog note about a pre-existing caplog order dependency, 820 cicd tests pass.

Verification suite review findings (W24.4.a closed) and the own-images target mode for the first production run (W24.4.c start) · 62df0bb

Suite: deploy set as (project, service) pairs, more compared fields, an empty or malformed expected commit is refused, DNS fails on an unexpected extra address, stricter header checks, one retry, total time limit, TLS 1.2 floor, redirect targets named, logging of every check. Own-images mode: targets whose compose files pin the images (compose_checksums), a real run pins every deploy service by image id, the no-op run writes no override and forbids a recreate; proven against the real local docker and ansible. Desi…

Production verification suite prod-readonly (W24.4.a): DNS, TLS, health with the expected commit, build info, page and security headers with GET and HEAD only; readonly-check comm… · bd5a5ae

First read-only production snapshot taken (W24.3.f closed) with the reviewed baseline · 88df555

Snapshot of the production host on 2026-10-22 (19 containers in two compose projects, no change made, redacted, scanned): runs/deploy/adoption/prod-20261022T073834Z.json and its ansible log, the reviewed baseline deploy/adoption-expected.yaml, the findings note docs/notes/prod-adoption-2026-10-22.md (app images carry no revision label, only the application project is the pipeline's target, the app database lives in the operator's mongodb), a test that pins the evidence, the expected-file parameter of run_snapshot,…

Read-only production snapshot, build review findings (safety A and correctness B) · b9d82ee

Linter read-only mode refuses connection variables, wait_for, file:// urls, dumps of the variable space, and tracks a docker result copied by set_fact; group_vars beside an inventory are refused; the reviewed-commit gate counts ignored files; a linter refusal is exit 2. Redaction covers upper-case env secrets, password hashes and a token without signature. Playbook: first task names a missing requests library, vanished containers are counted, disk list is / and the docker root, volume names published. Checks: publ…

Failure feedback loop (W24.3.e) checked off after the fix review, the referee and the fixes · 6cd1d01

Read-only production snapshot (W24.3.f) and feedback loop round 3 · a649fd3

Snapshot: linter read-only mode (read-only modules plus the mount facts, no fact run, no_log on docker results, no printing of a docker result, uri limited to GET keys), runner read_only (pipelining, no lingering ssh session, stored log redacted), playbook prod_snapshot.yml, strict prod.ini and committed public host keys, adoption checks with the 17 known issues, compose/snapshot.py (key path from TC_PROD_SSH_KEY, reviewed sha with clean folders, empty container list refused, redaction before writing), CLI snapsho…

Feedback loop round 2 (a fix must follow every commit that failed with the key, not only the latest report; a closed item turns red when a later failure is counted; exit codes and… · 07c3774

Feedback loop reviewer findings (fix must follow the latest failure, drills file nothing on the real board, secrets redacted, verify stays green after close, key validation, atomi… · 5bac1ae

Referee findings for the rehearsal host (known_hosts aliases of /dev/null, option case, drill output, plan text) and a scoped prune of old pipeline image tags · 125e999

Feedback loop (W24.3.e): stable failure keys, failure ledger, one open item per key, escalation on the second report, close only on proof; ledger tick 37 · 3b348a9

The pipeline's own deploy config counts as pipeline code (rehearsal only, production waits for an owner) instead of a refused manual deploy · 4c41d59

Rehearsal host reviewer findings (safety: option injection in the ssh endpoint, clean environments, host key re-pin refusal, purge inventory, locks, real set for the rehearsal pro… · e79633d

Rollback drill on the rehearsal host (W24.3.d): synthetic commit, environmental and verification faults, judged from the host · 8be3836

First green real run on the rehearsal host; build disk estimate depends on an earlier release; tests for the real provider set · e84f5ee

First real run findings: absolute image id path, API env needs NEXT_PUBLIC_API_BASE_URL, in-place release export, rehearsal host definition classified as pipeline code · 6d91301

Arbitrator findings N1-N6 for the ansible adapters (container stop bound to a project-filtered list, compose file checksums, health wait only when something runs, strict images-on… · 49b17f3

Rehearsal host live-run fixes: data images tagged in the host, build disk guard, rehearsal profile and target enabled · d6ae153

Rehearsal host (W24.3.c first parts): docker-in-docker host with sshd on loopback, host manager, ssh image transport, real provider set, rehearsal CLI, discovery of the deployed c… · 10892f0

Ansible adapters reviewer findings (safety: clean env, unsafe vars, lint args/environment/roles; correctness: rollback stops new services, own logs, no-change modes, release_dir);… · 7e7d0e1

Ansible adapters for ship, deploy, rollback and host (W24.3.b): playbooks, targets file, target lock, per-service facts 1.4.0; judged against real docker and ansible · cab90fe

Ansible runner and playbook allow-list linter (W24.3.b first layers) with the design note and review amendments · 41c6d38

Docker_build reviewer findings F1-F12 (shadowed short id, build-inputs label for reuse, symlink and tar cleanup, strict images file, no silent skip without docker) · a7f3548

Docker_build adapter for the image port (W24.3.a): clean git archive, one labelled image per service, release manifest digest, confirmed by docker inspect · 139b0d4

Stage B closed (W24.2.d, W24.2.e, W24.2 checked off), ledger tick 36 · 74546eb

Operator mapping referee A1-A3 (secret with line break refused and never printed, unencodable host is broken, proxy test reloads the opener); queue lows · d74eda8

Guards referee follow-ups N1-N8 (redaction bound, Mongo URI without database, exact @prod-safe tag, silent route guard, drill classification, logging) · 185904e

Second operator-mapping review (N1 to N9): foreign out folder, no-generate, proxy, swap rollback · 1014a91

The vendoring script refuses an out folder that is not empty and was not written by it, replaces only the items it owns (two contracts, VENDORED.md, generated/), refuses --no-generate over existing models, uses random staging names and puts every previous item back when a swap fails part-way. The doctor reaches the operator without any environment proxy, validates IPv6 and port syntax, bounds a whole request by a deadline in a daemon thread. check notices a model without a recorded hash. The parameter drift test r…

Say what the new browser target policy does to the examples that name a non-local base URL · c4dd3e3

Restore four unrelated tool-test minimums that a broad replace changed in the previous commit · 48fadff

Slip: a sed over 'min_tests: 11' raised four other steps to 12 and broke t0. Cause: a global replace without checking the match count. The step minimums are now read from the diff before a commit.

Operator mapping review (crit-operator-doctor H1, M1 to M7 and the lows) · 814f979

The doctor never follows a redirect (the secret went to any host the operator redirected to), sends the required profile query and the contract's /v1 prefix, treats an operator that does not answer as broken (it read as healthy), refuses an operator URL with credentials, a query or a foreign scheme, keeps two reports of one second, bounds the response and does not send the secret over plain http to a non-loopback host. The vendoring script refuses a dirty, untracked or shallow-boundary source (the pin must describ…

Redaction covers the secret shapes this repo uses (Zitadel, Brevo, Twilio, Stripe webhook, JWT, env-style assignments). · 0161037

The target policy reads database keys and Mongo URIs on every fact (parity with tc-env.py, tested on the same pairs) and compares hosts canonically (full-width letters, ideographic stops, trailing dots, subdomains, decimal, hex and IPv4-mapped addresses). A noop-redeploy applies only to the commit that runs now, a rollback drill never to production. enabled must be a real boolean in both profile readers. A dangling-symlink hold file counts. The plan text of the guards item names test fixtures, not synthetic accoun…

The target policy now guards local requests, is asked by the Playwright config and has a request guard (guards review M1 M2) · 56506e1

A local run no longer lets a request to another host go out (an absolute production URL baked into a build), the config parses E2E_TARGET_MODE, asserts the base URL against it and runs only @prod-safe specs in production modes, canary write prefixes must be real prefixes and encoded or dotted paths never match, installRequestGuard aborts refused requests on a context. The manual production mail project now sets E2E_TARGET_MODE=prod-canary and is filtered out until its spec is reviewed and tagged.

Test fixtures are also left out of entropy and learning input, and cross-boundary match rows are removed on a profile change (guards review, product reviewer F1 F4 F5) · e402b38

Ledger, Stage B state · 743c295

Operator contracts vendored at a pinned commit and tc-cd doctor (W24.2.e) · 80c639c

scripts/vendor-operator-contracts.py copies the operator's gateway and pipeline-api OpenAPI files with the commit they were copied at and their hashes, and generates stdlib dataclass models. tc-cd doctor checks which operator capabilities the pipeline needs exist (offline from the contract, and with an operator URL through the read-only routes, never a write route) and writes runs/doctor/<time>.json. docs/notes/operator-status-and-handoff.md records why the operator service has been down since 2026-10-15 (its cont…

Operator workflow in the profile info, table 1.3.0; plan text of the guards item records the fixture decision · d813cf9

Real people and test fixtures no longer meet: match pool and read-time gate (guards part 4) · 2c8ed0a

Test fixtures are the end-to-end identities (sim-gen-e2e-*), the production canary (sim-gen-canary-*) and the reserved QA accounts. Without a scope, a viewer's match candidates, the discovery list, the single-peer read and the notification recipients are limited to the viewer's own class. The rest of the simulated cohort stays open to real people: the product owner's 2026-09-06 decision (57e5efd3b) for the human + simulant study is deliberately not undone, which narrows the plan text 'real viewers never see synthe…

Interfaces frozen item W24.2.c checked · 3db1c26

Target policy for browser and simulator runs: local, prod-readonly and prod-canary (guards part 3) · 0e96a26

One browser-free module decides which host a run may touch and which requests it may send: loopback and *.localhost for local, exactly trueconnection.app over https for production, reads only for prod-readonly, a named write allow-list for prod-canary. Look-alike hosts, subdomains, http, ports and credentials in the URL are refused, a spec needs the @prod-safe tag against production, there is no environment-variable escape hatch, and the crawler's host list is now the local list. 39 tests.

File-based profile switch and target policy, redaction instead of refusal, noop redeploy (guards part 1, design review fix-diff) · 553f4cc

FileProfiles and ConfigSafety read deploy/profiles.yaml (case-insensitive production host and address, live secrets, production database names, the run's own database, dev flags in production, a hold file blocks a deploy), with parity to scripts/tc-env.py and a contract run. A record is redacted, not refused, when a value looks like a secret (the evidence of a run that changed a host is never lost), and only secret-shaped values count. A noop-redeploy or rollback-drill run mode redeploys the running version even t…

GET /api/health reports sourceRevision, the commit the image was built from · ee8809f

Same contract as the web image: a runtime env GIT_SOURCE_REVISION baked in by the Dockerfile (stage and runner targets, empty by default), reported only when it is a 7 to 64 digit hex commit id. A deploy pipeline asserts it equals the commit it shipped. Tests: true positive, trimmed and lower-cased, unset, and hostile values are never echoed.

Port design review of the frozen interfaces: facts vocabulary, finalize, ancestry, rehearsal and safety fixes (crit-cicd-ports-design) · 83b9f2f

Table version 1.1.0: git.is_ancestor, deploy.finalize and the FINALIZE stage after a green verify, a Facts vocabulary with patterns (digests are release-manifest digests) in the frozen IO schema, a failure key that admits an error hash, the fingerprint now covers the run record schema. A rehearsal run no longer rehearses on its own host and so rolls back to the image that ran before. Classify compares with the deployed sha and fails closed when it is unknown on a rehearsal or production target. The rehearsal deplo…

Ledger after the stubs item, W24.2.a and W24.2.b checked · 8acb7e1

Fix-diff review findings: empty commit id, documents about migrations, deploy suite on busy targets, fingerprint covers the run record schema · e835d88

Review round 1 of the stub pipeline and its port contracts (crit-cicd-stubs) · 4256b41

Deploy crash keeps the snapshot, a deploy that never touched the target does not roll back, the profile is bound at composition and a string cannot slip past the production check, run ids carry a random suffix and records are written once, commit ids must be 7 to 64 hex digits, the change classification refuses config and migration shapes at any depth, stub failure names are validated, the CLI maps a pipeline error to exit 3 and a bad log level to exit 2. The contract suites now judge behaviour through a probe (wh…

The files of the stub pipeline that the previous commit missed, plus frozen ports, fakes and contract suites · 2242cb9

Commit b032d0f73 only held the READMEs: its file list was built with git ls-files -m -o, which leaves out files that an earlier failed commit attempt had already staged. This commit holds the whole package: core, thirteen ports frozen at 1.0.0 with a registry and a JSON schema for their inputs and outputs, nine domain services, the stage graph and orchestrator, stub and fake adapters, the composition root (production refuses stubs and fakes), the CLI and 138 pytest tests including one contract suite per port run a…

Stub adapters, stage graph, orchestrator and the dry pipeline (tc-cd run --profile dev --providers stub) · b032d0f

Core types, one shared logger, thirteen ports (version 0.1.0), nine domain services, the stage graph with rollback after a red deploy or verify and a tracked item for a red run, canned stub adapters with switchable failures, the composition root that refuses a stub for production, the CLI, the run record JSON schema and 59 pytest tests (tier t0 step cicd-pytest). The change classification refuses compose, score, env contract, migration and deploy-config changes for an automatic image-only deploy.

Declare the cicd layers first, add the tests layer and a catch-all (review round 1) · 583876d

The review found two reproduced defects: generic service globs (main.py, config.py, domain, client, jobs, routes, lab) and the generated, legacy and tests globs took cicd paths before the cicd layers, so cicd code could import service code unseen. The cicd block now comes first, cicd-tests is the only layer that sees every cicd layer, service tests may not import cicd, and cicd-undeclared catches every other path under cicd. Tests pin each finding (service-named files, generated models, resolved-edge guard, scanne…

Declare the cicd layers in the architecture contract, with a test per layer pair · bbe751e

Layers core, contracts, ports, one per domain, adapters, orchestrator, compose and cli, declared ahead of the generic service globs. Domains import only core and ports, adapters are the only layer that may use subprocess, only compose and cli know both. Tests for one allowed and one forbidden import per pair run the real architecture-scan on a throw-away repo (tier t0). Empty package marker and README, cicd added to the file-size and duplication roots.

Stage A story W24.1 checked · e971c59

Stage A review gate confirmed with evidence · 14640cd

Current test baseline after the fast tier pair · ce77a61

Stage A evidence from the fast tier pair, speed report results, ledger, backlog · 8a7fb2a

Section 4 of the review note now holds the fast-tier pair (runs 3 and 4, identical, equal to the serial run F except four improvements) and the final t0/t1 run. The speed report got its measured results (section 5). Item W24.1.e now verifies with the fast tier.

The scope gate helper unit test knows the enabled wait and the repeat click · 9d6e67d

The helper change of the lane proof (wait until Continue is enabled, click again until the gate is gone) was never run against its own unit test. The stub of expect had no toBeEnabled or poll, so the full web offline step failed. The stub now has both, the fake page hides the gate after a click, and a new test pins that the forced click comes only after the enabled wait.

Fast test lanes, the inner loop and the proof loop · 5846b35

How to use the hot-reload dev server for editing and the production-mode server with four lanes for evidence, with the commands and the known differences between the two servers.

Glass press test judges the way back to rest by the share of changed values, not the largest single change · 242e4d6

The first full lane run saw one colour value off by 255 after the release on a busy host (four lanes). A dent that stays changes a large region, a hover residue changes a handful of values. The check now allows at most 0.1 % of values to differ by more than two levels. Idle host measurement: 814 values differ by exactly 1.

Lane proof round 2: service worker blocked in the authenticated project, locale helper race, seed budget, known-broken entry for t2f · 99471a7

First full fast-tier run on the production-mode server (3628 s, 12 red files in the authenticated step): all but three were one cause. A production build registers the service worker, the "Notifications for Universe & Chat" dialog opens on /match and /chats and its full-screen backdrop intercepts every click; the dev server never registers the worker. The ui-authenticated project now blocks service workers. After that the 12 files ran in 197 s with 3 red: - ensureViewerE2eLocale raced waitForURL against goto and b…

Lane proof on the production-mode server: four races and limits fixed at their layer · b087bad

The first lane proofs of the fast tier (infra step, 4 lanes: 249 s instead of 2787 s) found real differences between `next dev` and `next start` and between one browser and four: - A production-phase server demands a Zitadel issuer (placeholders added to the flavour, as docker-compose.prod.yml does). - The scope gate's Continue is enabled before the viewer's session has resolved on a fast server; a click then does nothing. The helper now waits for an enabled button and clicks again until the gate is gone (a normal…

Review round 1 of the browser-tier speed work: tier t2f test set, orphan processes, production-mode flavour, gate tests · a3afa41

Three read-only reviewers checked fd0b5dbd1. The gate change was accepted (six low findings; three fixed here with tests, three queued). The runner and the flavour were rejected, and every reproduced finding is fixed: - t2f ran a file the serial tier never runs (the 60-minute fingerprint file, known red under another step): new lane category `skip`, and a test that pins the translation files of t2f to the --only list of t2. - A step timeout left Playwright and its browsers running in their own sessions: the lane r…

Browser-tier speed work, part 2: lane runner, shards, fast tier t2f, production-mode web flavour and the dev-only build flag · fd0b5db

Run F spent 53 % of its time restarting and re-warming `next dev`, and the api steps ran one worker for 29 minutes. This commit adds the mechanisms of the approved plan (docs/research/browser-tier-speed.md): - scripts/tc-spec-each.py --lanes N: spec files in lanes at the same time, each lane with its own viewer, storage and output folder, the sign-in setup once per lane, solo files after the lanes; refuses more than one lane on the `next dev` server (7 tests with a fake Playwright). - scripts/tc-test-all.py `shard…

Browser-tier speed work, part 1: measurement tool, lane planner, production-server override, research and the memorisable loop prompt · cedfae7

Run F spent 53 % of its 1 h 56 min restarting and re-warming `next dev --webpack` (15 times, about 240 s each), 39 % in spec files. This commit adds the groundwork of the approved speed-up plan, nothing wired into a running tier yet: - scripts/web-log-compile-times.py: framework time per route from the web log (5 tests). - scripts/tc_lanes.py + deploy/test-lanes.yaml + deploy/test-lane-timings.yaml: lane categories (free, last, pool, solo) and a reproducible longest-first plan; on the measured times 4 lanes come t…

Glass press test checks the return to the pre-press rest frame; arbitrator verdict LAND recorded · 73a64e9

The referee review (round 3) found no high or medium finding and four low ones. Two are fixed here: the comment on the click blocker named the wrong reason (the 800 ms wait keeps one try's release pulse out of the next, the blocker keeps the page), and the test only checked a stable frame after the release. It now compares the pixels with the pre-press rest frame within one colour level per channel. The first strict version failed, and a probe measured 814 channel values that differ by exactly 1. Report, ledger ro…

Second review of the A3 note: wait limit reaches the offline config, compare-last picks the same tiers, press test tests the hold alone · df0403b

Reviewer round 2 (crit-a3sec4r2) rejected on three medium findings, all fixed here. (A) The Testing Library wait limit was wired into vitest.config.ts only; the web-atomic-offline step runs vitest.offline.config.ts. Both configs load tests/vitest.setup.ts now, and testingLibraryWaitLimit.test.ts runs under both. (B) tc-test-all.py --compare-last compared a run with the newest run of any tier; it now picks the newest run with the same tiers and the same steps (test added). (C) The glass press test blocks the click …

Owner note section 4 filled, two known-broken entries recorded; test(web): wait limit and glass press test hardened · eb73a65

Run F and the t0/t1 run 3 are written into section 4 of the A3 note after a reviewer rejected the first draft (two medium findings). The glass press test now waits for a drawn frame at full size, needs two equal rest reads and a non-blank change while held; it no longer claims anything after the release because the release is a click that navigates away. A web atomic setup file raises the Testing Library wait limit to 5 s: two onboarding tests that pass alone in 2.4 s failed under load. known-broken-tests.yaml rec…

Estate sweep leftovers: two repos blocked by the legacy .ai size baseline, four repos without a matching origin · c460a8b

Glass CTA specs wait for the canvas and retry the press; owner-action hook noted · 59af1fc

A headed hardware-GPU run failed the same press test as the headless run, so the glass failure is not an environment limit: the test pressed a canvas that was still a 28x28 placeholder, before hydration and below the fold of a 1280x720 viewport. It now scrolls the CTA into view, waits for the real size and retries the press. The standalone raytracer route test polls the distinct-colour count instead of reading after a fixed 400 ms. Both pass (13 of 13) with the tier step's environment.

Owner note rewritten after review, run history, review reports, backlog, ledger · 4e15f9e

Owner note (docs/notes/a3-review.md): hunt findings in plain words, the nine red tests described by cause (eight fixed, one classified), a decision rubric for the known-broken list, open items grouped (security decision, deployment-stage items, billing, single instance, queued hunt items). Section 4 waits for run F. New docs/notes/test-run-history.md, review report unreviewed-hunt-commits-crit.md, README rows, backlog entries, atlas notes, ledger rows.

Reviewer crit-a3note M5: a proof not tied to a commit is weak, and the live tree holds another session's uncommitted edits. · d82122e

summary.json now has git.head, git.dirty_count, git.dirty_digest and git.dirty_paths (names only, first 50); on a git failure the run goes on with head null and an error text. Four tests (clean tree, dirty tree changes digest and lists paths, not a repository, run summary carries it). The runner test step guard is raised to 33 tests.

The affect backend is built with the resolved key · 7b23caf

Reviewer crit-unrev4 F3.1: a blank id was read from the environment twice and could be cached under the wrong key.

Streamed uploads are not cut by the proxy deadline; Next proxy body limit raised for 15 MiB photos; paywall button follow-ups · ba094c9

Reviewer crit-unrev4 (opus). - F4.1 (medium): the deadline for the upstream response started before a streamed multipart upload had been sent, and the api only answers after it read the whole file, so a healthy slow upload was cut with a 504 at 120 s. createBffUpstreamAbort can start unarmed and arm() runs when the last byte was forwarded (a TransformStream flush). Tests: five deadlines pass while the body streams, then 119 s then 504. - F4.2 (medium): Next 16 ends a proxied request body at 10 MiB with only a cons…

Review fixes: the single-profile read checks the viewer first, test bridge flags refused against production data, collection classified, nine red tests fixed · 8c5080c

Reviewers crit-unrev4 (opus) and crit-a3note (opus); reports in docs/notes/reviews/. - F1.1 (medium): GET /api/discovery/profiles/:profileId ran the hidden-peer check before the viewer's own readiness check, so a not-ready viewer got 403 for an unknown id but 404 for a member who had blocked them (an oracle for any fresh account holding a profileId). loadReadyDiscoveryViewerProfile now runs first; the hidden-peer reads run for every id with no early exit (F1.2), an unknown id looks up a placeholder uid. - F1.4/F1.…

Push endpoint policy accepts only the canonical spelling; follow-ups of the second push review; README audit in pre-commit · 521b801

Second review (crit-sec5, opus): LAND, seven low findings, handled here. - L4: an endpoint must equal new URL(endpoint).href and must not end in a dot; one subscription can no longer be stored under several spellings that the ownership check and DELETE (raw string compare) would miss. - L3: ignored WEB_PUSH_EXTRA_ALLOWED_HOSTS entries are logged once per process by position, never by text. - L1, L2: test for the plain-host rule alone; seeded 20,000-case differential fuzz (every accepted endpoint is read the same b…

Two add-on purchases at the same moment on a brand-new account no longer lose a paid grant · 8f6809a

Found by the t1 evidence run ([redacted].mongo.integration.test.ts), a regression of my webhook lease fix. The add-on write is filtered on "no grant from this event yet"; on a brand-new account the second of two simultaneous first purchases collided on _id (E11000) and the collision was read as "this event was already applied", so its grant was lost. Now a collision looks for this event's grant: present means replay (skip), absent means a concurrent first write created the row, and one retry takes the update path.…

The BFF proxy deadline covers the wait for response headers only; a browser abort still cancels the body · 9d05154

Reviewer crit-batch2 F2.1: AbortSignal.timeout(120 s) also covered the body, so a healthy large upload or download could be cut after 120 s. createBffUpstreamAbort arms the path's timeout, disarm() ends it when the headers arrive, a browser abort stays linked. Real-timer tests for 504, for the disarmed body, and for abort propagation.

The affect backend cache is keyed on the resolved backend id · 6025def

Reviewer crit-batch2 F3.1: "LOCAL" and "local" built two backends. New test. Follow-ups F3.2 and F3.3 (lock held during a model download, shared pipeline thread safety) are in docs/notes/backlog.md.

Push allow-list closes the URL parser differential; log fixes from the review (message ids, vendor errors, price list); cold-start test leaves no process · 7ff2cb3

Reviewers crit-sec4 (opus) and crit-batch2 (sonnet); reports in docs/notes/reviews/security-hunt-fixes-crit.md and hunt-fixes-batch2-crit.md. - H1 (high, reproduced end to end): web-push connects with the legacy url.parse host, the allow-list used WHATWG URL, so https://169.254.169.254;.web.push.apple.com/... passed. Now the text must start with https://, the host may hold only letters, digits, hyphens and dots, and both parsers must read the same host. Extra hosts like *.com are dropped. Tests: 12 differential in…

The super like, photo reveal and supermatch reveal buttons tell the viewer when something fails or succeeds · a1af521

Hunt web-features 2. Three paywall-gated buttons swallowed every error that was not a paywall error (nothing happened on screen), and the super like had no success message, so the viewer could click again and spend a second weekly super like. Now: a paywall error opens the paywall and shows nothing else; any other error shows a translated error toast (discovery.paywall.actionFailed); a sent super like shows discovery.paywall.superLikeSent. Two new message keys in five languages, added to the shards under src/i18n/…

Server boot steps log through the shared logger, not console · 66544d0

Hunt tests-logging F. lib/init.ts wrote 19 plain-text console lines between pino JSON lines, so LOG_LEVEL and the JSON shape did not apply and the failure line had no structured cause. All now go through rootLogger with component "serverInit" and named fields (flag, reason, counts, devBypassLocked); the boot failure is one error record with the cause, still rethrown. Two tests: every boot step is logged with the component and console stays silent; a failing step logs once and rethrows. Logging ratchet baseline low…

Logging ratchet: no new console.* or print() in product source · 04f6983

Owner order (logging concept: one shared logger per app, standard levels). scripts/check-adhoc-logging-ratchet.py counts console.* (web, api, simulation worker) and print() (matching, ml-service) in tracked source, compares per file with docs/notes/adhoc-logging-baseline.txt (99 calls in 27 files today) and fails when a file gains a call; allowed: the logger modules, dev pages, the service worker, generated code, lab tools. An empty scan fails (exit 2). Tier t0 steps for the gate and its 11 tests; README rows; atl…

The real src/server.ts boots on an empty database, answers health and exits 0 on SIGTERM; env files can be switched off · 39cb3ff

Hunt tests-logging gaps 5 and 6: no test ever ran the entry point (every api test builds a Fastify harness). New tests/server/serverColdStart.mongo.integration.test.ts starts src/server.ts as a child process against an empty in-memory replica set with a production-shaped environment: boot, GET /api/health/ready 200, /api/health identity and version, SIGTERM exit 0 within 10 s with "Server shutdown complete" (end-to-end proof of the shutdown order and the idle-socket sweep), a missing NEXTAUTH_SECRET stops the boot…

The affect backend is built once per process and the generator cache loads atomically · 03a0ed7

Hunt python H1 (high) and M1. /v1/nlp/affect rebuilt both HuggingFace pipelines on every call (matching sends 16 snippets per call, so a cohort recompute loaded them again and again, and concurrent calls multiplied memory against the container limit). get_affect_backend caches one backend per backend id behind a lock; a failed build is not cached. LocalQwenGenerator.get_cached now holds a lock across check, load and store (two first requests used to load about 6 GB each). Tests: built once across calls, once under…

Shutdown fix review follow-ups: warning helper, leaked-timer test, 400-digit timeout value, docs · e003c44

Second review (crit-sd3, sonnet) LAND-AFTER-FIXES; the main finding (setTimeout overflow above 2^31-1 ms) was already fixed in the previous commit. This commit adds: warnIfShutdownTimeoutIgnored (testable, accurate wording), a test that the idle-sweep timer is cleared when close() rejects, more malformed values (400 nines, leading zero, plus sign, exponent), README text. Review saved in docs/notes/reviews/billing-shutdown-fixes-crit.md, ledger row recorded. Backlog: multi-replica decision (prod runs one api contai…

The BFF proxy aborts a stalled upstream call at the path's timeout and when the browser goes away · 53a3eaf

Hunt web-core M1. The Edge proxy called fetch with no signal: a stalled Fastify held the request for undici's 300 s and a closed tab did not free the upstream connection (the timeout constants only served the Node undici routes). buildBffUpstreamSignal combines the request's own signal with AbortSignal.timeout(resolveBffUpstreamTimeoutMs). A timeout now answers 504, a browser abort 499 (logged at info), any other failure stays 502. Tests: signal passed, abort propagates, 504, 499, 502 unchanged, the delay armed pe…

A malformed STRIPE_PRICE_MAP is logged once with its cause instead of silently disabling every price · d325fc7

Hunt tests-logging C. Each failure (invalid JSON, not an object, unknown SKU, non-string or empty entry) now logs one error per process with the cause and the entry key, never the raw value. Still a log, not a boot failure: the database price map can supply prices and the live host env cannot be checked from here (deploy preflight item in the backlog). Four new tests assert the log records and that the raw value never appears.

SHUTDOWN_TIMEOUT_MS above the setTimeout limit reads as unset; loop notes tick 28 · f9e8806

setTimeout fires at once for a delay above 2^31-1 ms, so a huge value would have made the shutdown deadline force exit 1 immediately. The env schema now treats such a value like any other malformed one (unset, default 8 s). Tests cover 2147483647 (used) and 2147483648 and 99999999999999999999 (unset).

Push sender logs carry a hash reference, never a device token or Web Push endpoint · ace626c

Hunt tests-logging D. FCM, APNs and WebPushNotifier logged the full token or endpoint on every prune and failed dispatch; a token addresses one device and a Web Push endpoint URL is secret in itself. New pushLogRef (12 hex digits of SHA-256) replaces the value. The new test drives every prune, failure and breaker-open path with a recognisable token and searches all log records; it also found that a WebPushError object serialised its endpoint property, now logged as name and message only. Blast radius: only log fie…

Shutdown review round 1 fixes: late streams get 503, idle keep-alive sockets are swept, a bad SHUTDOWN_TIMEOUT_MS no longer stops the boot · 1c49fe2

Reviewer crit-billing2 (opus), REJECT as committed; report in docs/notes/reviews/billing-shutdown-fixes-crit.md. - F1: test double gets addHook; registerDiscoveryRoutes awaits its four registrars (a throw now fails the boot). - F2: a stream request that reaches the handler after the shutdown started answers 503 (closing flag set by the preClose hook, which now logs). - F3: SHUTDOWN_TIMEOUT_MS reads as unset when malformed; server.ts logs a warning. - F7: the SSE drain test uses createFastifyGracefulShutdown, the f…

The WhatsApp delivery webhook no longer logs the recipient's phone number · 7ce9694

Hunt api-rest F11. The route logged the whole parsed payload; each statuses[] entry carries recipient_id, the phone number. It now logs message id, status and numeric error codes through summariseWhatsappStatusPayload (any other field, also future ones, is dropped). Unit tests and a route test with a real log stream assert the number never appears. Blast radius: only the log line changes (field whatsappWebhookPayload replaced by statuses); the response and the signature check are untouched; no dashboard or alert r…

Push subscriptions must point at a known push service; the api no longer calls other hosts · 6a0375d

Hunt api-rest F6 (server-side request forgery). POST /api/push/subscriptions took any https URL and WebPushNotifier later requested it from the api host with no timeout. New webPushEndpointPolicy.ts: https, no credentials, default port, no IP literal, host in the vendor list (FCM, Mozilla autopush, Apple, Windows) plus WEB_PUSH_EXTRA_ALLOWED_HOSTS. Checked at registration (400) and again before every dispatch, so rows stored earlier cannot be used. web-push now gets a 10 s timeout. Blast radius: readers are the pu…

The api refuses to boot with DEV_AUTH_BYPASS=true when NODE_ENV=production · 12268c1

Hunt api-rest F9. middleware/auth.ts ignored the flag in production, but UserRegistrationService, OAuthService, registerUsersRoutes and the dev-fake billing provider read env.DEV_AUTH_BYPASS directly. The env schema now stops the boot once, at the lowest layer. Four boundary tests (tests/config/env.devAuthBypassProduction.test.ts); the old gate test that expected a quiet "no" now expects the boot error. Blast radius: docker-compose.prod.yml already sets "false" for api and web; development and test still boot with…

Review-round.py prints the round line a reviewer brief opens with, from a committed ledger · ce6eea3

The dispatch-lint hook asked for this line on every reviewer brief and the script did not exist (backlog item since 2026-10-20), so rounds were counted by hand. Ledger docs/notes/reviews/rounds.tsv, `record` appends a round, round 3 names the arbitrator. 9 stdlib tests, tier t0 step, README rows. The four hunt reviews so far are recorded under W24.1.

An open live-update stream no longer holds the shutdown until its deadline; default deadline under Docker's stop timeout · 4760223

Reviewer crit-sdweb (opus): F1 reproduced against real Fastify, F2 to F5 from reading. - registerDiscoveryEventsRoutes: a preClose hook ends every open SSE stream, so fastify.close() returns and MongoDB closes cleanly (exit 0). - createFastifyGracefulShutdown carries the server.ts wiring (drain is fastify.close(), then the database); default deadline 8 s, under Docker's 10 s; SHUTDOWN_TIMEOUT_MS is in the env schema. - init.ts logs a late successful recompute with its numbers. - Review saved in docs/notes/reviews/…

A subscription cannot be activated for a longer term than was paid; delayed-payment checkouts grant nothing until paid; a partial refund keeps access · 9232165

Hunt api-rest F2, F3, F4. - activateSubscription refuses a term longer than the verified billing row's term (shorter and equal stay allowed; a legacy row with no term is not limited). - checkout.session.completed with payment_status "unpaid" returns no event; checkout.session.async_payment_succeeded grants like a paid completion; async_payment_failed is logged. - charge.refunded with refunded=false (partial) is ignored; a full or unflagged refund still lapses. Blast radius: readers of activateSubscription are the …

Loop control tick 27 after the shutdown and web data fixes · 64e4797

Removing an inactive chat refreshes the Match list; one failed chat reload keeps the messages on screen · 02d8516

Bug hunt web-features 1 and 3. 1: acknowledgeUnavailablePeerForViewer invalidated the query key ["discovery"], which nothing uses (the Match list and Universe caches are keyed ["match", viewerAuthUid, ...]), so the removed peer stayed on those lists until the 8 s poll or the next SSE event. It now invalidates discoveryKeys.allForViewer(viewer). The old test asserted the key string against a mock and so passed; real QueryClient cases now seed the real keys and check the viewer's caches are invalidated and another v…

Shutdown drains HTTP before closing MongoDB and has a deadline; boot waits at most 10 s for the matching recompute · a2a6b5d

Bug hunt api-rest F7 and F8, tests-logging B. F7: shutdown() closed MongoDB before the HTTP server, so requests in flight during the drain ran against a closed client (500s on every rolling deploy); it also ran twice on SIGTERM then SIGINT and had no deadline (fastify.close() waits on open keep-alive and SSE connections until SIGKILL). New lib/gracefulShutdown.ts: stop cron and change streams, drain HTTP, close MongoDB, once, with a deadline (SHUTDOWN_TIMEOUT_MS, default 20 s) that forces exit 1 with a log record;…

Webhook lease review fixes: fencing token, event-keyed add-on grant, retryable checkout 503 · cc2e078

Reviewer crit-webhook (opus), LAND-AFTER-FIXES, two reproduced medium findings; the earlier claim "the apply phase never runs twice" was wrong. F1: a worker that outlived its lease was not stopped (a takeover and the stale worker both applied, and a failing stale worker released the new holder's lease). Now: a random lease token, every phase mark and the release are fenced on it, a stale worker logs and stops; the lease is 10 minutes (the sync transaction's driver retry can last 120 s). F2: the add-on grant was a …

Review fixes for the profile crash and logout cookie changes · 99eaebb

Reviewer crit-websession (opus), LAND-AFTER-FIXES, no high or medium finding. F1: the redirect component logged a failed profile fetch a second time on top of useProfile (a 500 gave two records, a 401 and a 502 gave one although they are expected noise). Root fix: the component no longer logs; useProfile is the single source with the project's noise policy. The component test now runs on the real useProfile and React Query (one record for a 500, none for 401 and 502, StrictMode, recovery fires the redirect). Added…

Hidden peers answer like unknown ids; the plaintext e2e OTP mirror is written only when the e2e bridge is on · f5b8a18

Bug hunt api-core F9 and F7. F9: assertDiscoveryPeerNotBlockedOrDismissed took a hiddenPeerError factory but used it only for the privacy case. The block (either way) and dismiss branches always threw PROFILE_NOT_FOUND, while an unknown id on the single-profile read answers MATCH_NOT_PRECOMPUTED, so a viewer who had seen a peer could tell "blocked me" or "I dismissed them" from "left" (REQ-22-010). All branches now throw what the factory builds; mutation routes keep the default error. No web code reads either code…

Loop state tick 26 · a151cd8

A Stripe webhook that failed half way is finished by the redelivery, not dropped · 5096443

Bug hunt api-rest F1. applyNormalizedEventIdempotently inserted the idempotency row first and applied the event after; if the apply or the paywall-side sync threw, the route answered 500, Stripe redelivered, the redelivery hit the duplicate key and was answered "already handled": the member paid and never got the entitlement (the paywall purchase path had fixed the same shape by rolling its marker back). The row is now a lease with two phase marks: processingUntil, appliedAt, syncedAt. A failed phase releases the …

Logout deletes the production session cookie (Secure) and the logout state cookies at their own path · 3949ed9

Bug hunt web-core H2 and L1. response.cookies.delete(name) emits "name=; Path=/; Expires=1970" without Secure (re-run of the finder's probe on this tree before the change: no Secure, Path=/). Browsers reject a __Secure- or __Host- cookie without Secure, so in production the NextAuth session cookie was not deleted by the Zitadel logout callback (only Clear-Site-Data was left, support unconfirmed), and logout_state and logout_destination (set at Path=/api/auth/logout/callback) were deleted at Path=/, which matches n…

Review of the phone guess budget fix saved · 500e5a2

Phone guess budget review fixes: 429 end to end, no charge without a live challenge, no 30-day lockout · 7749e61

Two reviewers (crit-phone-a opus: REDESIGN, crit-phone-b fable: LAND-AFTER-FIXES) found, and this commit fixes: - the internal phone verify route had no 429 mapping, so the web sign-in showed the "unknown" error and every refusal wrote an error log and a diagnostic row; it now answers 429 like the email twin and the web provider maps it to OtpTooManyAttempts; the trusted client address now reaches the API for the per-IP budget (web client, provider, internal route); - a guess with nothing live to compare (made-up,…

A failed profile fetch no longer crashes the whole app for a signed-in user · 327f6a4

Bug hunt web-core H1. LocaleFromProfileRedirect (a cosmetic locale sync) sits in app/[locale]/layout.tsx above every route error boundary and re-threw profileError; useProfile has retry false, so one BFF 502, a 429 or a brief 503 from /api/auth/token replaced every page with the root error page. It now logs the failure once with its cause and skips the sync; the next good profile fetch resumes it. Blast radius, predicted: one component, one mount point, no other reader (grep over src and tests found only READMEs);…

Backlog adopt item for the 500-line rule and the instruction diet · 74149cf

Phone sign-in guess budgets use the shared module; nobody can lock a known number out · b1215d2

Bug hunt api-core F1, F2, F3, F4, F8 and tests-logging A. The phone verifiers charged a per-phone counter BEFORE the comparison, even for made-up challenge ids, with no refund, no per-IP budget and no day cap: four junk requests a minute refused 98 percent of the owner's real attempts (model), while a patient attacker had 1440 guesses a day (0.14 percent). phoneOtpService now runs both verifiers through otpVerifyGuessBudget.ts like the email channel (per phone 15 minutes, day, consecutive; per IP), policy keys add…

Impact and blast radius research filed (KB), rule edits queued for adopt, loop state · f51c478

Six bug hunt reports saved with their findings; fix order queued in the backlog · 2a9e116

Read-only finders covered api auth/profile/discovery, api billing/push/startup, web server and session, web features, the Python services, and the test and logging audit. Fix-now items are listed in docs/notes/backlog.md.

Loop control tick 24 (reviews copied, estate no-work-lost snapshot) · 5c5cb31

Raw notes of five more reviewers copied into docs/notes/reviews · 3a18825

Knowledge base entries for the t2 run B and C findings · 30a3aea

Reviewer F fixes, failure artifacts kept by the runner, t2 browser steps run with one retry · 47ed4a6

Reviewer F rejected the hero spec change: waitUntil "commit" has no effect on a client-side navigation and the three failure logs show the URL did not change within 30 s of the click, so the cause is open. The spec now waits 60 s without waitUntil and records the click-to-URL time as an annotation; the backlog holds the open cause. Also: scope gate helper uses .first() and swallows only a timeout, with a Continue-visible test; the warm list gains the phone code route and a route-exists test; the t2-slow step timeo…

The landing hero spec waits for the sign-in URL at navigation commit, not for the load event · 7a7331f

One of the last locale cells (ar in runs A and B, es in a pair run) failed after the CTA click: the web log shows the sign-in request arriving 18 s after the page went idle and then no load event within 30 s. The landing page draws its orb with software WebGL in headless Chrome, which starves the main thread. The contract is the URL, so the wait now ends at commit with a 60 s budget and each cell has 120 s. The four-file chain that reproduced it passes 10 of 10.

The signed-in shell content wrapper clips horizontal overflow, so the orb glow no longer widens main on a 320 px phone · e812174

The brand orb back glow is 369 px wide once the viewer's profile sets a large orb. <main> already cut it off on screen (overflow-x-hidden) but it still counted in main.scrollWidth (344 at 320 px) and responsive-auth-viewports failed, alone and in the run. The wrapper under <main> now has overflow-x-clip. Screenshots of /en/you and /en/journey at 320 and 390 px before and after are pixel-identical. The spec passes alone (5 of 5, was 4 of 5).

The match scope gate helper no longer waits 45 s when an earlier spec already set the viewer's scope · 53ad84f

match-intent-scope-chip-a11y failed in both full t2 runs and in a pair run after match-fit-narrative-peer-sheet-viewports. The helper waited only for the Continue button. With the scope already set (the viewer is shared by all signed-in specs) it never came, the 45 s wait plus the 20 s URL check ran past the 60 s test budget, and the error showed an empty URL. The helper now waits for Continue OR the scope chip (rendered only when a scope is set). Pair run: 126 s red -> 16 s green.

The dev warm step compiles the sign-in API routes; the 70-slot fingerprint step moves to tier t2-slow · 09046f9

The first sign-in of t2 run B compiled three POST-only routes inside the mail send. The dev server stalled 33 s, nodemailer gave up after 30 s ("Greeting never received") and the route answered 503. A GET compiles a POST-only route too, so tc-dev-up.sh warm now requests them once. scripts/test_tc_dev_up_warm_list.py pins the list (tier t0). The fingerprint file needs about 60 minutes with one worker and is a proposed known-broken step, so it runs only with --tier t2,t2-slow (5 of 75 slots passed in the 55 minutes …

Stage A review note (draft, final run numbers follow) · b39a7a2

Loop state, t2 run B started · 09b7b0f

The translation deep step runs its two deterministic specs; the 70-slot fingerprint file is its own proposed known-broken step · 4d032f4

Its saved fingerprints date from 2026-08-30 (65 of 80 drifted) and signed-in app routes flip between two loading shells, so a refreshed baseline is unstable too (51 passed, 8 failed, 11 flaky in the next run). The refreshed file is not committed. Fix design is in the backlog.

The reflection nudge spec answers through the product API and opens the question phase, 12 s instead of a 900 s stall · 416fef0

The click loop over 8 questions never advanced on the dev server, also when run alone. The spec checks the nudge layout, not the click path.

Loop state after t2 run A · 8d7ec63

Translation deep specs: matrix timeout belongs to the test, language menu waits for hydration, a null goto response is retried · c0d01f9

Found by t2 run A. The matrix spec ran with the 60 s default (the timeout was set in beforeAll); the switch spec clicked before hydration; page.goto returned null when the app redirected.

Review fixes for the t2 tier, lint ratchet and locale guard; the orb glow cap is reverted · b5d0bfa

A step that died is never known-broken, the defs tier cannot be run, spec-each handles timeouts, flaky counts and a failed listing, the lint ratchet rejects parse errors and partial reports, the locale guard follows helpers and variables (two more specs restore English), the hero spec waits for a first route compile, and the commit tool uses literal pathspecs. Review saved in docs/notes/reviews.

Plan for the Docker base image upgrades, review-round tool gap · 3aff8f1

Loop state after the lint gate · 77da859

Web lint ratchet in tier t0 (errors may be fixed, never added), baseline of 21 errors, two cheap errors fixed · bc431de

No hook ran ESLint, so 24 errors had piled up unseen. The gate freezes the count per file.

Loop state after the push privacy review and the orb glow fix · 12df04a

Push names and the blocked list follow the full-reveal rule (chat_active with mutual chat consent), after review · b3fa376

The reviewer showed stage alone is not the server rule: mutual chat consent is needed too. The blocked-peers list also returned the legal name at any stage; it now follows the same tier. Wider invariant, real stage path in the match test, all non-reveal stages tested. Review saved in docs/notes/reviews.

The orb back glow is capped at the viewport width, so a 320 px phone no longer reports horizontal scroll on the you page · 42a9a76

The glow is about twice the orb diameter and centred; at 369 px it was wider than a 320 px screen. Hidden by overflow-x on main, but counted by the responsive audit. Test for the sizing rules.

Push notifications show a member's name only at the chat_active stage, from one shared module · 475bf81

Four dispatchers each copied a displayName/name/chosenName chain and put the stored legal name of never-connected members in titles such as New match: Jane Realname. They now call services/push/peerPushLabel.ts, which fails closed to the neutral copy. Boundary tests plus an architecture invariant; two tests that pinned the old behaviour changed.

Warm compiles the public routes of every locale, so the first visit in a test does not compile during a 10 s navigation budget · 6d402d8

Reviewer reports now live in the repo (docs/notes/reviews) with their findings and dispositions · 0d80fb0

Signed-in specs no longer leak viewer state into later files: German specs restore English, viewer-rewriting specs run last, deep-translation step runs file by file · a005e75

Pairs of spec files showed that one shared viewer carries state across files (a leaked "de" locale broke the live-updates spec). Guard test for the locale rule, tc-spec-each --last, backlog note on the profile-edit overflow.

Restore the t2 re-warm step between the infra and authenticated steps, with a test for the step order · 1ea4be8

Tier t2 runs the public browser specs one file at a time too, with the dev web server re-warmed every 8 files · d683092

One 30-minute run degraded next dev until /api/health timed out; three specs that pass alone failed.

Cap the uuid override below 12 (next-auth needs the CommonJS build) and list all Playwright specs in tier t0 · 3627f26

uuid 14 is ESM only and made every Playwright run fail at module load once node_modules became a pure pnpm layout.

Tc-dev-up.sh up names the missing prefetch when a service is installing packages offline · 7729537

README row of tc-spec-each.py names its role as the t2 authenticated step command · f8b60ee

Tier t2 runs the authenticated browser specs one file at a time with the dev web server re-warmed every 8 files · 619440c

The one long Playwright run made order-dependent specs fail that pass alone (next dev leaks memory and degrades). The tier step now calls tc-spec-each.py, which prints failed tests and totals in Playwright's shape; the command lives in a definition step in tier defs; the setup project is its own step; the runner marks the run lock as held for its steps. Tests for each.

Dependency review fixes: simulation worker lock, lock-sync and undeclared-import gates, packages on TypeScript 7, Sentry and dotenv details · eabba4b

A read-only review found the simulation worker lock stale (its image fell back to an unlocked install) and three imports no package.json declared. The worker lock is rebuilt, regen-npm-locks.sh --check and the new check-undeclared-imports.py run in tier t0 with tests. The 23 shared packages move to TypeScript 7 (only the web stays on 6, backlog updated). Sentry gets queues off and a satisfies type so a new category fails the typecheck, dotenv 18 runs quiet, sharp and yaml are declared, eslint names the React versi…

All Node dependencies at the latest major versions except TypeScript for web and packages (blocker recorded); call sites migrated · e3dcfa4

Majors: next 16.4, @sentry/nextjs 11 (sendDefaultPii replaced by explicit dataCollection, pinned by a new test), stripe 23 (API version 2026-09-30.endive, changelog reviewed), eslint 10, framer-motion 14, dotenv 18, chokidar 6, @hookform/resolvers 6, vitest 5.0.5. TypeScript 7 breaks typescript-eslint and the TS JS-API tests, so web and packages stay on 6.0.3 (api is on 7); backlog has the evidence and retry condition. use-intl is now a declared devDependency, node_modules is a pure pnpm layout. Web: 1810 files, 9…

Node dependencies at the latest minor and patch versions; production npm locks rebuilt with a new tool · 3624d8c

Web, api and root package.json bumped (npm-check-updates --target minor), pnpm and both npm lock files regenerated, the lock parity gate passes. Web typecheck and 9266 offline tests pass, api typecheck passes, api unit tests show only the 9 known red tests. New scripts/regen-npm-locks.sh. Major versions follow one by one.

Bridge move review fixes: importer check covers the new paths, spec helpers name the missing dev build, dynamic-import ban, wider scan (W24.1.l) · 73f1e6e

Two read-only reviews of the bridge move. The importer check now also matches devOnly/e2eBridge, so the item's verify can fail. The user-status spec helpers stop with "start the stack with the dev profile" on the production stand-in. The bridge marker sits in the gate every bridge module reaches, the scan matches get/persist/delete backend paths, ESLint bans dynamic imports of devOnly, HEAD is served by GET, the dispatcher logs 404/405 and thrown handlers, magic-link persist failures keep their old logs. Tests for…

Python dependencies at the latest version (matching, ml-service, CI helpers); 430 matching and 699 ml-service tests pass · cdb3fa0

The e2e bridge lives behind the dev-only seam, a production web build holds none of it (W24.1.l) · aca0f94

The seven /api/auth/e2e routes, their gate, code stores, three rate limiters and the mail trace move to src/devOnly/e2eBridge. One catch-all route calls handleE2eBridge from @dev-only/server. The production stand-in answers 404 with e2e_bridge_not_in_build, so spec helpers name the missing dev-profile build. Login handlers hand codes and links to captureE2eLoginSecret. New check_e2e_bridge_http.py (HTTP matrix), bridge markers in check_dev_only_absent.sh.

Repo CLAUDE.md points to the global tool library; backlog: memory consolidation state · efbc4ee

Check_e2e_bridge_importers.sh finds production importers of the e2e bridge (W24.1.l verify) · bc81934

Wave item W24.1.l for the e2e bridge move; backlog follow-ups · e69c392

Design note for the e2e bridge move, corrected after the design review (3 HIGH, 9 MEDIUM adopted) · 08b2dcd

Restart and re-warm the dev web server before the authenticated step and every 8 spec files (next dev reaches its memory cap) · 3ef6f05

Loop file: state after the one-by-one authenticated run · b9e32be

Propose the two LCP probes as known-broken on next dev (owner decides at the review gate) · f50d039

Scope realtime spec follows the product: bounded self-healing poll, strict toggle in the list toolbar · 25c8e02

The viewer completes its journey through the product API before the peer seed (the seed route refuses non-synthetic viewers) · e4758af

Photo spec applies the crop modal and picks the enabled Cancel button · 5fefd39

Journey bank spec: navigate before the in-page fetch, empty-bank stub has count, rating chips are radios · c2d034e

The lifecycle spec confirms the in-app block dialog · bf8daf1

Supermatch name policy as render tests; chat stub stage matches its name; queue push-title privacy finding · 722acae

The Supermatch card shows the policy label, not the legal name; shared statement stub matches the parser · ab9b400

Three WAVE-24 findings (overlapping runs, stub drift, .ai move) · 8a8a4c7

Loop file and backlog (state of the .ai move); atlas maps deploy and runs · c6df898

Move .ai to .claude (repo-owned config, allowlists, baselines, hooks, skills lock) · 6354553

The staged move found in the index is completed after a read-only review: .gitignore rewritten cleanly (repo-owned files un-ignored at .claude, no duplicate rules), check-skill-updates.mjs and rmw_race_common.py read .claude, hook paths and the gate's code paths carried over, READMEs merged, two closed wave verifies repointed. Left out on purpose: blind rewrites of closed wave files, the generated release notes, learning-root (machine-local).

Design note for moving the e2e bridge behind the dev-only seam · 84d7a44

Tc-spec-each runs every browser spec file alone and lists the red ones · 2b65051

Loop file: the .ai to .claude move is owner order, step 1b · 22b867f

One shared viewer-id helper; the openers stub names the real viewer; README rows and KB findings for WAVE-24 · 08fa90e

The test runner refuses a second run while one is active (overlapping runs broke each other) · c3657bf

Chat thread stubs match the API contract (discovery skips and timestamps, stage field, real viewer id) · 4413580

English browser for every spec; the onboarding helper confirms the product's account-link step · 5052d1e

A German workstation browser registered the test user with preferred locale de and every signed-in page redirected to /de. Deleting the E2E user keeps its profile row, so a fresh registration meets 'You already have an account here'; the helper now confirms it.

The authenticated step always refreshes its stored session (a reused one belonged to a deleted user) · 29281d3

Warm-up covers every language's sign-in page; second WebGL case proposed as environment-limited · abcd056

The dev profile allows the web dev server 24g (it thrashed at the 10g cap under a browser tier) · 2479fff

T2 gets the authenticated step; integration-internal moves to T3 (decision in the backlog) · a1be457

One shared helper steps into the app from the site root (onboarding and mailbox-gate waits) · 8e73688

WAVE-24 loop state after the small-test round · aa91570

Warm-up covers every language home page; propose the WebGL spec as environment-limited · 42a5c4f

Wait for hydration before clicks; dev-server-only skips (cache headers, LCP budget); slow locale specs join the deep step; wider warm-up · e55c9ec

Single-spec fixes: landing CTA and release-notes tabs click only after networkidle; document-cache-control and landing-lcp-probe skip with E2E_WEB_DEV_SERVER=1 (next dev forces no-store and ships unminified code); locale-public-routes matrix and switch carry @i18n-deep; tc-dev-up warm compiles the routes the tiers visit.

Cancelled RSC prefetches are not request failures · 4c50041

Onboarding helper steps into the app from the site root and fills gender and birth year; self-peer spec matches the privacy gate · b8eb29c

Small-test round on the running dev stack: auth-registration-http-api, auth-recorded-create-user-flow and connections-self-peer-rejected pass alone in seconds; auth-new-user-creation now passes login, magic link and onboarding (its nav tour is slow on the dev server).

Dev stack: api EMAIL_OTP_LOCAL_LAB_WINDOW_MS=2000 (isDev-gated override). · ce51d87

Onboarding helper checks the verified identifier only when shown. Self-peer spec completes onboarding first. Recorded flow checks the sign-in status. Zitadel MFA spec skips without an auth domain.

WAVE-24 loop state: KB order, login analysis thread · 4b0c228

check_dev_only_absent.sh: production output must hold the stand-in marker and no real marker, dev output the real one, an empty scan is an error. · 2e975d5

check_web_dev_only_build.sh builds the web app twice in copies (production shape without src/devOnly, then the dev profile) and scans both; verified green (prod: 0 real, 5 stand-in; dev: 5 real). tc-test-all gets a playwright parser and names failed Playwright tests without line numbers. tc-dev-up warm resets the dev server manifest and compiles the public pages. Tier t2 gets stack-up, stack-warm and e2e-ui-infra.

WAVE-24 loop state after the critic fixes; web README row for tsconfig.prodctx.json · 3c0a325

Sign-in code prefill, loopback-only dev ports, critic fixes for the dev-only seam (W24.1.h, W24.1.i) · 1727c7c

Client seam @dev-only/client prefills the code field in a dev build (opt-in NEXT_PUBLIC_DEV_ONLY_AUTOFILL=1, prefill only). Round 1 critics (opus hostile inputs, fable production build) found: the dev profile published ports on all interfaces (now every port 127.0.0.1, static test as a tier step); the ignore pattern dropped the shared contract folder and would break the production image build (folder renamed to src/lib/devSeam, tier step type-checks the tree without src/devOnly); no test pinned the default mapping…

WAVE-24 loop state after the web dev-only seam; web README row for tsconfig.dev.json · eb926a7

Dev-only sign-in code behind one seam, compiled into dev builds only (W24.1.h) · 8aaa03f

@dev-only/* resolves to the empty stand-in (src/devOnlyStub) by default and to the real code (src/devOnly) only when TC_BUILD_PROFILE=dev, chosen through next.config typescript.tsconfigPath so webpack and Turbopack agree. In a dev build with DEV_ONLY_SIGNIN=1 the login handler adds devCode to the response for test-domain addresses on a loopback Host, on the cleaned address only; every decision is logged through the new shared web server logger with request id and masked address, never the code. ESLint bans direct …

Sign-in heading matches the current copy (Step inside); t2 findings in the backlog · 87da135

Record dev-only seam design review (9 fixes), re-scope W24.1.h and W24.1.i · bbe4b1b

Plain one-time codes and sign-in links are captured only while the e2e bridge is on · d33a6ed

Every real sign-in request stored the plain email code, phone code and sign-in link in web memory and, through the three persist routes, in Mongo (auth_e2e_email_otp_codes and siblings), bridge on or off. The persist routes checked only the shared secret. Capture now no-ops unless E2E_NEXTAUTH_BRIDGE_ENABLED is on (leaf gate e2eBridgeGate.ts, used by the memory lane and the link module) and the three api persist routes use the same second gate as the read routes. Regression tests are red on the old code. Found by …

W24.1.g-j dev-only code seam (email sign-in code handed back in dev, compiled out of production); design note · 479c765

REQ-24-009 and four items: design review, api seam, web seam, marker scan. Also fixes the dev web container: its own .next volume (a shared .next corrupted prerender-manifest.json and made /api/auth/providers answer 500).

Dev profile opens discovery on a fixed bridge subnet; verify probes every service · 0e2acfc

docker-compose.dev-isolation.yml turns DEV_DISCOVERY on and pins the project network to 172.29.250.0/24 so the one trusted gateway peer is exact. tc-dev-up.sh builds on up and verify checks /_dev/service on api, web, matching and ml-service and a foreign Host. Offline verify green with all four.

Dependency fingerprint of the api and web entrypoints ignores prose and release version · 17726b0

The fingerprint hashed the whole package.json and package-lock.json, so a new description or a version bump forced an npm install, which needs the network and broke the offline dev start. It now hashes only the dependency sections of the manifest and the lockfile without its root name and version. Test covers both entrypoints.

Gate (switch plus loopback Host), document builders and a first proxy stage. · d5fd4f3

A closed gate falls through the proxy and is answered like an unknown path. The catalog path joins the proxy matcher (mirror and test kept equal). WAVE-24 A1.c, web slice. All four services now describe themselves.

One module mirrored byte for byte in both services (each is its own image), kept in step by scripts/test_dev_discovery_parity.py (tier t0). · 9ad3a61

Identity comes from pyproject.toml. WAVE-24 A1.c, python slice.

WAVE-24 loop state after the api discovery slice; routes tests README row · dc6ff26

Pure gate and builders in lib/devDiscovery, route plugin in routes/system. · 297e43e

Closed gate answers like an unknown path. Service id and description move to backendPackageVersion.ts (health reuses the id). WAVE-24 A1.c, api slice.

WAVE-24 loop prompt and loop control state · 893dd0c

Tc-dev-up --real-signup and the local e2e backdoors for dev tests · 38abce7

Baseline of t0+t1 (two runs), per-test known-broken entries, regenerate stale web axios client · 0674364

The runner accepts a tests: list per known-broken step so a new failure in the same step still fails the run. docs/notes/test-baseline.md records the two runs and the defects found. The generated web client is regenerated from product.openapi.yaml (freshness test green).

A same-owner lease refresh in one millisecond no longer reads as lost · e49b075

tryAcquireCasLease judged success by modifiedCount. An identical rewrite reports 0 modified, so the owner's own lease looked lost. Judge by matchedCount instead. Regression test with a frozen clock. Found as the flaky distributedCronLock integration test in the WAVE-24 baseline run.

Offline dev proof verified, test-tier runner, dev isolation override, Dockerfile context guard allows the two schema generators · 73e0048

WAVE-24 W24.1.b/d. tc-dev-up.sh verify starts the whole dev stack with no route to the outside (no NAT, unroutable DNS, Hugging Face offline) and passes: api, web, matching, real ml-service (+ready), mailpit healthy, public DNS and public IP unreachable from inside. tc-env checks a compose service's real environment (several -f files); the isolation override stops a local .env.development with a production CORS origin from reaching the web container. tc-test-all.py + deploy/test-tiers.yaml run the tiers with zero-…

Tc-env profile switch, tc-dev-up launcher, offline dev override, api entrypoint skips needless npm install · b971d37

WAVE-24 W24.1.a/b: deploy/profiles.yaml (dev, rehearsal, prod) read only through scripts/tc-env.py, which refuses production markers in dev and rehearsal; scripts/tc-dev-up.sh starts the dev stack (real ml-service, mailpit, dev bypass) with prefetch/up/verify/down; docker-compose.dev-offline.yml removes NAT and public DNS to prove the stack needs no outside route. The api dev entrypoint no longer deletes node_modules and reinstalls on every start (needs network every time); it uses the same fingerprint skip as the…

File WAVE-24 — dev proof without external services, repo-owned continuous delivery · 66e45d7

Epic from the owner's 2026-10-19 request: dev proof with internal services only, one dev/rehearsal/prod switch the operator understands, a cicd package built stubs first behind versioned ports, automatic production deploys with rollback, safe production testing, and a failure feedback loop. 5 stories, 25 sub-todos, 8 REQs.

README review round 2 — fix lib import rule, test folder paths, fragment rows · 20e51be

lib/ does import services/ in some modules (README said never). Child test READMEs now use the corrected source paths. 21 truncated or comment-copied rows rewritten from the code. Backlog lists the remaining LOW row quality work.

Record root cause of the crashing unused-code pre-commit scan · ceae7c8

Correct README rows after independent content review; rewrite low-value generated rows · 6de6c71

Fixes 17 wrong statements (matching .dockerignore and lock-compile rows, simulation-worker test coverage claim, web atomic folder paths, ml-service health and Docker COPY statements, misquoted inline comments) and rewrites rows that only repeated a file name, class name or bug id.

README depth — list files and subfolders in src READMEs (api, web, ml-service) · e578c9d

Locale shard tables, lib/features/design-system maps, __tests__ links, generated file tables from doc comments and test titles; content corrected after an independent review. Audit tool: 0 missing, 0 tier1, 0 tier2, 0 unnamed subfolders.

README depth — test folder tables, app root file tables, packages, audit tool fixes · 49074ab

All test READMEs under src/apps/*/tests list their files (describe titles) or name-prefix groups. api, matching and ml-service roots list their files. The audit tool (round-2 review fixes) names folders written as name/, treats extension-less files as files, and exits 2 on write/decode errors. 30 tool tests.

Readme_depth_audit review fixes — stricter name matching, errors exit 2 · a4d68e3

Stem and prose words no longer credit a file or folder (route.test.ts did not name route.ts; the word 'admin' named admin/). Globs apply only to their own folder and support braces. Dot-files/folders are not required. Read, write and decode errors exit 2, never 1. 17 regression tests added. Regenerated backlog.

Name package.json, package-lock.json and tsconfig.json in 14 package READMEs · aa10124

The module map a README points to named 7 tier-1 folders and 39 reports' entries; the tool ignored it. · c0a42e4

The module map a README points to named 7 tier-1 folders and 39 reports' entries; the tool ignored it. Regenerated backlog: tier1 52->45, tier2 177->164, unnamed subfolders 171->132.

Record installerRoot and pipeline-runner version causes of the blocked Stop gate · 4639a74

Record root cause of the self-exec Stop-hook shims · bd80eca

Readme_depth_audit.py — report README entries a folder README leaves unnamed · 5002457

Read-only audit with glob-family support, tests, generated backlog under docs/notes and a backlog line. scripts/README.md row follows once the other session's uncommitted edits in that file are committed.

Scope the self-contained rule to non-agent scripts; fix atlas wording · 663177c

Critic follow-up to 4f8bd2d87: scripts/README.md said no script depends on a sibling repo or the control plane, which the moved *.reuseNN.* agent tools contradict. Adds an explicit carve-out, a folder-structure row for *.reuseNN.*, and scopes the Boundaries row to CI/gate scripts. plan/system-atlas.html: 'paragraphs below' -> 'paragraphs in this atlas'.

Move keepers to scripts/ and docs/, untrack .scratchpad · 4f8bd2d

Agent scratch moved to /var/tmp/scratchpad/IFEOMA-CLOUD360/app-trueconnection/ (user decision 2026-10-12). 677 tracked .scratchpad files removed from the index after judge approval (inventory /var/tmp/scratchpad/IFEOMA-CLOUD360/ai-workflow-stack/notes/scratchpad-tracked-removal-IFEOMA-CLOUD360__app-trueconnection.md, judge re-run PASS at 85c2c6b29). Content kept at /var/tmp/scratchpad/IFEOMA-CLOUD360/app-trueconnection/ and in history. .gitignore now carries `.scratchpad/` (it was ignored only via .git/info/exclud…

Commit stale release-notes regeneration before levelling · 03f36fe

Commit straight to the default branch — no worktrees, branches or PRs (owner rule) · f0f33d1

Track the prod Mongo credential rotation (W21.4.aa) and the stray untracked files (W0.169.e) · c331546

W21.4.z pointed the Mongo password rotation at an 'existing D2 story' that does not exist as a wave item; it now has its own item, W21.4.aa (after the prod ship, secret store only, prove the old password is refused). W0.169.e covers the leftover mutation copies under src/apps/api/.scratchpad/mut-w22-2-ae-b794e463/ and nmap.pid in the repo root.

Refresh pipeline-runner install record to kit v1.1.0 · ba32f4c

The stop hook's code-check failed on agents-verify with state=version_mismatch: the repo recorded pipeline-runner v1.0.5 while the skills kit ships v1.1.0. Reinstalled from the kit (install.py install pipeline-runner --reinstall); agents-verify now reports OK v1.1.0 (health + 16 MCP tools at 127.0.0.1:8790) and code-check passes.

Record the open next steps from the 2026-09-28 session (W21.1.f-h, W21.4.z, W0.169.c-d) · 502c2a4

W21.1.f (high): the uncommitted W21.1 log censor is quadratic on long URLs (unauthenticated DoS, critic round 3 REJECT) and blocks committing W21.1.c/d/g. W21.1.g: the pre-existing request-log leak of OAuth code/state/sessionId, fixed in the working tree. W21.1.h: post-exchange failures are mislabelled exchange_failed. Status notes on W21.1.b-e say what is built, what is committed (nothing yet) and what each needs next. W21.4.z: the owner-gated prod ship of the stage-proven release plus the W21.4.q/t prod migratio…

Check off — ledger records verify pass on c0d198cf3; tests/routes README lists the new wiring test · 4a84f32

Tighter account-link confirm limits — 3/hour per user, 5/hour per trusted email (W21.4.c) · c0d198c

POST /api/profile/link-account/confirm rebinds an email-owning profile to the caller's identity. It was limited to 10/hour per user. It now allows 3/hour per user plus 5/hour per email address, so rotating accounts cannot hammer one victim's email. The email limiter keys on the normalised trusted email and skips sessions whose email is not trusted for linking (the route refuses those with 400), so unverified identities cannot exhaust the owner's budget. The shared limiter core gains an optional RateLimitConfig.key…

Check off — ledger records verify passes on 52ec58799 · 80cbabe

HSTS on page routes; session-fixation test reads the real authOptions (W21.24.c, W21.10.c) · 52ec587

W21.24.c: next.config.ts sends Strict-Transport-Security max-age=31536000; includeSubDomains; preload on page routes (the value Traefik and the API already send, so duplicates are identical). Tests select the page-route group by source, evaluate the .well-known exclusion regex, and require the manifest group to exist. W21.10.c: the old test asserted jwt strategy on a mock it built itself and could never fail. It now imports the real authOptions and asserts strategy jwt, maxAge > 0, callbacks present and the secret…

Close story — assert-drained exit 0 after W0.146.s/.ac/.ad/.bb closed (ledger) · cc4abda

The standalone API no longer inherits .env.development's REDIS_URL; W0.146.s passes live (W0.146.ad, W0.146.s) · b5871d3

`npm run dev:standalone` starts an in-memory Mongo but let `.env.development`'s REDIS_URL=redis://localhost:16379 through (dotenv never overwrites a key already set), so isRedisConfigured() reported a Redis nobody started and DELETE /api/profile returned 500 on the deliberately non-swallowed Redis erasure. The script now passes REDIS_URL="" unless DEV_STANDALONE_REDIS_URL is given, logs whether Redis is on, and exports resolveRedisUrl for a unit test (main() runs only when executed directly). Runbook and scripts R…

Progress — passes the discovery and OTP steps; now stops at DELETE /api/profile 500 because dev-standalone inherits REDIS_URL from .env.development with no Redis running · 395955c

The phone-OTP readback poll honors Retry-After and has a time deadline, so two peers onboarding together no longer exhaust the e2e BFF limit (W0.146.ac) · 3d02b3b

completeSimSyntheticOnboarding polled GET /api/auth/e2e/phone-otp-code every 1.5 s (up to 20 times) for each peer; two peers in one minute exceeded the BFF's 30/60 s guard, and the poll ignored the 429 and kept hammering, so W0.146.s failed before its assertions. The poll core now lives in tests/e2e/helpers/phoneOtpPoll.ts: on 429 it waits Retry-After (fallback 5 s, cap 30 s) without spending an attempt, polls every 3 s, and stops at a 90 s deadline. The route already sends Retry-After; the rate limit itself is un…

Progress — with the matching service up, ml-health no longer 502s; the run now stops earlier at the fixture's phone-OTP polling hitting the e2e BFF rate limit · e801396

Since b8c7d1211 the discovery peer routes resolve only the profile document id; the description still offered the authUid. · f8f4621

Web types and the bundled OpenAPI JSON regenerated (description text only; line count unchanged). Verify in the ledger; api and web tsc clean.

Record progress — the fixed discovery assertions pass live; the run now stops at admin ml-health (no ML service in dev-standalone), item stays open · 98dfacb

Contract-conformance spec targets discovery peers by profileId, not authUid (W0.146.s); file W0.146.bb · 1527f57

Since b8c7d1211 (W0.152.g) the discovery peer routes check the target profile exists (by its internal profileId) before the entitlement gate, so super-like, supermatch-reveal and profile-picture-reveal answered 404 for the spec's `profileId: bob.authUid` instead of the expected 403. The spec already resolves bobProfileId in the same test; the three payloads now use it (.scratchpad/notes/W0-146-s-diagnosis.md). W0.146.s stays open until a live run with a correctly configured API passes. W0.146.bb files the stale Op…

Close story — assert-drained exit 0 after W0.145.q closed (ledger) · 74925e0

Verify placeholders resolved to the dev-standalone values; block-vs-accept race spec passes twice live (ledger); close · 0fbc60e

Close story — assert-drained exit 0 after W0.144.aa–ad closed (ledger) · baa31ce

The admin-override race spec asserts previousStage is a stage the race could have left (W0.144.ad) · 4532329

After 492174ac5 the admin override returns previousStage. The spec's own setup primes the connection at discovered/interested; if Alice's request-conversation commits first, the admin replaces conversation_requested. The assertion allows exactly those three. Passed twice on a local dev-standalone stack (1 passed each, the second via record-verify-pass). A forced red could not be shown: repeated runs hit the shared phone-OTP rate limit; recorded as such in the item's note.

A connection-stage override records who replaced which stage and returns previousStage (W0.144.aa decision; W0.144.ab/ac) · 492174a

W0.144.aa asked whether an admin's unconditional stage override may silently overwrite a user's just-committed transition. Decision (.scratchpad/notes/W0-144-aa-decision.md): keep the force-override (a support tool must be able to unstick a connection; nothing in the UI calls this route today, so a compare-and-set check would guard nothing), but make it traceable and non-silent: setConnectionStage now writes with findOneAndUpdate(..., { upsert, returnDocument: "before" }) (same filter and $set/$setOnInsert; mongod…

Close story again — assert-drained exit 0 after W0.141.w/.bo/.bp/.bq closed (ledger) · 147cec0

Close — bearer/SSE follow-ups (bb575220e, 6b8edfcfb), verify 48 files / 214 tests, critic ACCEPT · da2591b

Resolve the <backend> placeholder to http://localhost:3198 in six closed W0.141 verifies so they re-run as written; close W0.141.bq · 884ada6

W0.141.aa/.ad/.ag/.aj/.am/.bc: NEXT_PUBLIC_API_BASE_URL and E2E_BACKEND_URL both set to the dev-standalone API port, the convention W0.141.w and W0.141.az use. Checkbox states unchanged. Verify exit 0, in the ledger.

Its description no longer contains the literal placeholder its verify searches for · bcbe03a

Closed W0.141 siblings still carry an unresolved <backend> placeholder in their verify, so those verifies cannot be re-run as written · 61db0bf

Found while closing W0.141.w (same defect, fixed there with http://localhost:3198). The item's own verify uses a self-excluding pattern so it does not match its own text.

Close — the dual-session crawl passes on the dev-standalone stack (2 passed, incl. the interleaved chat crawl), no "No access token found" on "Open full profile" · 09c4b74

The race fixed by 0cf08b68b / bb575220e / 6b8edfcfb no longer shows in the crawl that found it; the crawl itself needed c2efb7a1e (Playwright 1.63 [aria-hidden] marker) to run at all. Verify recorded in the ledger.

The aria-snapshot parser accepts Playwright 1.63's [aria-hidden] marker; hidden nodes are never click targets (W0.141.bp, REQ-00-R42) · c2efb7a

Every e2e crawl failed at 0 actions with `unparsed trailing key text " [aria-hidden] …"`: parseNodeKey only matched marker names of [a-z]+, and Playwright 1.63.0 emits the hyphenated `aria-hidden` marker (full list read from playwright-core's bundled ariaSnapshotRenderer createKey: checked, disabled, expanded, active, invalid, level, pressed, selected, aria-hidden, ref, cursor, box). The marker name may now contain hyphens, aria-hidden is a known marker decoded into state.ariaHidden, and enumerateCrawlActions skip…

Vitest collects tests/lib/** — the OIDC userinfo timeout test (VUL-019) finally runs (W0.169.a/b); close story W0.169 · 0caf1f5

The web vitest configs only included tests/atomic/** and src/**/__tests__/**; a sweep of all 2002 web test files (minus 172 Playwright specs) found one unit test outside those globs: tests/lib/auth/nextauth/providers/ fetch_oidc_userinfo_json.test.ts, which was also hidden by the bare `lib/` .gitignore rule (fixed in dc724e757). Both vitest.config.ts and vitest.offline.config.ts now include tests/lib/**; the file is tracked (folder READMEs added) and passes 6/6; the offline suite passes 1794 files / 9137 tests. St…

Drop the builder-stage ENV that mirrored the Server Actions key into image config (W21.11.h); un-ignore src/apps/web/tests/lib (W0.169.a) · dc724e7

W21.11.h: `ENV NEXT_SERVER_ACTIONS_ENCRYPTION_KEY=$NEXT_SERVER_ACTIONS_ENCRYPTION_KEY` baked the key into the builder stage's Config.Env. A build-arg is already exported to every RUN in its stage, so the ENV was redundant: a real `docker build --target builder` without it still yields a server-reference-manifest encryptionKey matching the supplied key (sha12), and Config.Env no longer holds it. The guard test now expects zero violations in the real Dockerfile; re-adding the line turns it red. W0.169.a: the bare `l…

Second stage ENOSPC outage; a failed deploy removed the running backend/web first; image-ID churn · 8ac434f

Stage ship 629ec881 (20265dd64) failed its deploy at 06:44:49Z with ENOSPC while unpacking the rebuilt ~9.3 GB ml-service image on the 38 GB stage host, after it had already removed backend-stage and web-client-stage: stage served 502 until the operator rollback to d8e1bcff4 (job afa04c41) at 06:56:10Z; Mongo crashed three times and recovered cleanly. W3.3.bb (high): the operator must load every new image before replacing any running container; REQ-03-009: a failed deploy leaves the previous release serving. W3.3.…

Secret-echo guard covers every Dockerfile shape that leaks, runs from a tracked folder; close W21.11.g; file W21.11.h and W0.169.a · ce81371

Two critic rounds on the W21.11.g guard. It now: joins continuations past comment and blank lines (as Docker does), tracks single and double quotes separately (a backslash inside single quotes is literal), scans RUN heredoc bodies and the arguments of LABEL/ENV/ADD/COPY/WORKDIR/USER/ EXPOSE/VOLUME/STOPSIGNAL/ONBUILD, matches KEY|SECRET|TOKEN|PASSWORD|PASS| CREDENTIAL(S)|_SK|DATABASE_URL|DSN, and leaves escaped \$VAR and NEXT_PUBLIC_* alone. Each shape has a test that was red before its fix (15/15 now). The tests l…

The NEXT_SERVER_ACTIONS_ENCRYPTION_KEY length check no longer puts the key into the build log (W21.11.g, REQ-21-017; open pending guard hardening) · 2f24857

The builder-stage RUN that checked the key's length referenced "$NEXT_SERVER_ACTIONS_ENCRYPTION_KEY" directly, and BuildKit shows the RUN text with build-arg values resolved on the --progress=plain vertex line, so the operator's captured build log held the key (14 occurrences masked in conformance-api.stderr.log today; the key is generated per build and is replaced by the next ship). The check now runs in a single-quoted `sh -c '...'` body: same pass/fail, 0 occurrences in the log (old form 1). The key is declared…

Stage Mongo crashed twice on ENOSPC during a deploy's image pull; track a deploy disk guard and a separate data volume · 93f1cc1

Stage mongodb-ifeoma aborted at 2026-09-27 23:39:52Z and 2026-09-28 01:48:06/09Z (WiredTiger error 28, fatal assertion 50853) because a deploy's image pull filled the root disk that also holds the Mongo data volume; it recovered cleanly from its checkpoint (not OOM, not recreated; .scratchpad/notes/stage-mongo-restart-2026-09-28.md). W3.3.z tracks an operator-side disk guard (refuse a pull that would exhaust the disk, prune untagged images beyond kept rollbacks); W3.3.aa is the owner's decision to put stateful vol…

Not a product defect — the badge is the dev-only React Query devtools toggle (QueryProvider.tsx, NODE_ENV!=production); absent on the d8e1bcff4 stage build; closing waits on a ver… · 0a34637

W21.4.x/y: verifies re-ran green and are in the ledger; the CLI shipped in d8e1bcff4 and was used on stage. · 53898bd

W21.4.x/y: verifies re-ran green and are in the ledger; the CLI shipped in d8e1bcff4 and was used on stage. W21.4.q/u/w stay open: stage applied 2026-09-28 04:16Z (cutoff 2026-09-27T23:41:05Z, 1 marked, residual 0, ledger row present); the prod run waits for the owner's GO.

Close on the d8e1bcff4 stage ship (browser check 6/6, gap 48px, labels inside buttons; login-form 25/25) · c867a79

Stage ship bf3a80f1 of d8e1bcff4 carries 5d5afcc4d + 9bc4344c7. Both items' verifies re-ran green and are in the ledger; the extended stage browser check (.scratchpad/stage-signin-card-fix-check.reuse70.py) passed en/es at 1440x900, 390x844 and 360x800.

A stream closed during the session settle opens no connection; correct probeBackendSession comment (W0.141.bo critic lows) · 6b8edfc

The `if (closed) return;` after the settle in authenticated-event-source connect() was untested; the new case closes while the settle is pending and resolves it "ok" -> no connection (removing the guard turns it red, 238 tests green). The probeBackendSession comment wrongly said the "unconfigured" Zitadel refresh sets session.error; only RefreshAccessTokenError does, and unconfigured sessions keep the settle path.

Critic follow-ups on 0cf08b68b. · bb57522

(1) Only a signed-out 401 from /api/auth/token triggers the session settle: 429 and timeouts make exactly one fetch (tests; widening the guard turns them red). (2) The authenticated event source (discovery live updates) treated the same brief post-sign-in 401 as final and stopped the stream until the viewer changed; connect() now calls the shared settleSignedOutBearer once before going terminal (one implementation, exported from backend-bearer). (3) A session carrying `error` (RefreshAccessTokenError, whose token …

CLI subprocess tests point the Zitadel PAT path at a fresh missing file, so a stray /tmp/admin-pat.token cannot flip exit 3/4 (W21.4.y critic low) · 65e6177

31/31 with and without /tmp/admin-pat.token present.

Critic mediums on 4e445c880: (1) the dangerous paths were untested; (2) `--only mark_unproven... · e307b50

Critic mediums on 4e445c880: (1) the dangerous paths were untested; (2) `--only mark_unproven... ` dry run with Zitadel unavailable printed "NOT PLANNED (nothing counted)" and exited 0, easy to mistake for a real dry run before --apply. A structured `notPlanned` flag now flows from the migration report through the runner result; with --only, a dry run that evaluated nothing exits 4 (documented; runs without --only and applies are unchanged). 23 new tests: every bad argv form exits 1 and runs nothing, --only <id> -…

A 401 from /api/auth/token right after sign-in is settled once against /api/auth/session before an API call goes out without a Bearer (W0.141.w) · 0cf08b6

Opening "Open full profile" in chats right after sign-in logged "No access token found": /api/auth/token answered 401 once (17ms, then 200 for the same identity), so the shared axios interceptor sent the call without a Bearer and the BFF rejected it. resolveBackendBearerToken (the single Bearer source for every generated api.* client) now, on a signed-out 401, asks /api/auth/session once and re-reads the token only if that session carries a user; concurrent callers share one attempt; at most token -> session -> to…

A provider error shows exactly once when the email form is present; file W3.3.y (floating avatar covers the last provider row at 360px) · 9bc4344

Critic gap on 5d5afcc4d: forcing showErrorHere={true} (error rendered twice when the email form is shown) passed every test. New case: mail available + Google rejects -> exactly one alert; the forced-true mutation turns it red (25/25 otherwise). W3.3.y: at /es/auth/sign-in 360x800 a fixed floating avatar badge overlaps the Apple row; its component is not yet identified (candidates ruled out are listed).

A compiled migration CLI runs inside the deployed backend image and reads the container's MONGODB_* env (W21.4.x) · 4e445c8

The documented `npx tsx scripts/run-migrations.ts` could not run on stage or prod: the backend image has no scripts/ and no tsx, and the script read MONGO_URL/MONGO_DB while the container sets MONGODB_URI/MONGODB_DB_NAME. Since mark_unproven registered, it could not run locally either (the registry pulls in config/env.ts and lib/db/connection at import). Today's stage dry run had to pipe an ad-hoc script into docker exec. src/lib/db/migrations/runMigrationsCli.ts is compiled into dist (the image already copies dis…

Sign-in card without Email code has no orphan divider or empty gap, keeps long provider labels inside, and shows provider errors (W3.3.w, W3.3.x, REQ-03-007) · 5d5afcc

After W3.3.l hid the Email-code form on stage (no mail, no passkey) the card showed an empty gap (an empty CardContent still took the Card's flex gap-6 on both sides) and an "OR SIGN IN WITH" divider with nothing above it. Both are now rendered only when a primary method (email code or passkey) or the phone toggle is shown; otherwise layout is unchanged. Disabled "Coming soon" rows wrap the badge below the label instead of squeezing it (flex-wrap; no nowrap, so es/fr/de labels wrap inside the button at 390 and 360…

Close story W0.140 (assert-drained exit 0, ledger); file W3.3.x (sign-in errors invisible when the email form is hidden); fix W3.3.w verify path · da539af

W0.140's acceptance verify (wave-compliance-bugs assert-drained) reports no open sub-todo. W3.3.x, found by the W3.3.w critic: on stage (no mail, no passkey) a failed Google/Zitadel sign-in sets an error that nothing on the card displays, because error output lives only inside the hidden email form. W3.3.w's verify named a test file that does not exist; it now runs the login-form test folder.

Verify runs the ajv check with its own temp dir; closed (check exit 0, stage-build of 35b2045b3 succeeded) · 752066c

The verify held a literal `/path/to/fresh/tmp/dir` placeholder, so record-verify-pass could not run it. web-image-ajv-check.reuse70.sh now makes and removes its own mktemp dir when called without an argument; the verify calls it that way. Re-run: ajv/dist/core resolves, npm ls ajv clean, eslint still works (exit 0, ledger). Real-Docker proof: stage-build of 35b2045b3 (job b14d25b3) succeeded.

Close W3.3.l on stage evidence (35b2045b3); file W3.3.w + REQ-03-007 for the sign-in card's orphan divider and phone wrap · a965073

W3.3.l: its verify (POST /api/auth/email-otp/request on stage -> 503 mail_unavailable) passed and is in the ledger; the browser check at 1440x900 and 390x844 shows no Email code / Send code (.scratchpad/notes/stage-release-35b2045b3.md). W0.140.bf.a's note gains the real-Docker proof (stage-build of 35b2045b3 succeeded). W0.140.bf.b stays open: its verify still holds a placeholder path. W3.3.w: with Email code hidden the card shows an empty gap and an "OR SIGN IN WITH" divider with no method above it, and disabled…

Close W0.140.bg (76/76, ledger); W21.4.w verify recorded (15/15, critic ACCEPT), box waits on W21.4.u · 244f4a7

Cutoff overflow test covers ±hh:mm offsets; README names the real source of the W21.4.e deploy time (W21.4.w follow-up) · 6dba9e4

Critic minors on b566c5370: every overflow case used Z, so forcing the offset to 0 left the suite green. Added 2026-03-01T00:30:00+01:00 (accepted) and 2026-02-29T23:30:00-01:00 (rejected); the offset=0 mutation now fails. The README's deploy-time pointer now says: the completion time of the first ship job whose revision contains ede7174bc (`git merge-base --is-ancestor`), never later than suggestedCutoff; the backend /api/health carries no sourceRevision.

Wire field mapper tests run over every SUPPORTED_LOCALES and PROFILE_GENDERS value (W0.140.bg) · 50ff682

The "known locale" and "known gender" cases used one hand-picked literal each, so a locale or gender added to the catalogs, or dropped from the mapper's accepted set, was never exercised. They are now it.each over the same lists the mapper validates against (69 -> 76 tests). Dropping "non_binary" from PROFILE_GENDER_SET turns exactly that case red.

Mark-unproven cutoff rejects calendar rollovers and future constructor cutoffs; tests for the remaining guards (W21.4.w) · b566c53

Critic minors on d8e21abac: `new Date` silently rolled 2026-02-30 and T24:00 into the next day; the parser now rebuilds the written fields (offset applied) and rejects a mismatch, still accepting 2028-02-29. The constructor path now refuses a future cutoff like the env path. New tests: calendar overflow, constructor Invalid-Date and future-cutoff guards, runner `details` on a proof-incomplete apply (no ledger write). 34/34, tsc 0. Disabling each new check turns its test red. README says where to find the W21.4.e d…

Close W0.140.bf.c (verify 22/22, ledger) and W0.140.be (manual, evidence + critic ACCEPT); open W0.140.bg · 52857b6

W0.140.bf.c: releaseNotesDirectBuild verify re-run green and recorded. W0.140.be (manual): completion note carries the re-run evidence: no source importer of valibot/fromValibotError, `npm ls valibot` empty, ajv@8.20.0 still top-level, validationErrorFromIssues test green, and the independent critic ACCEPT (.scratchpad/notes/W0-140-be-critic.md). W0.140.bg: the item's own "also consider" (parameterize profileWireFieldMappers.test.ts over SUPPORTED_LOCALES/PROFILE_GENDERS) was not done in 40990903a, so it is now an…

Stage host disk is too small for its image churn (38 GB, 9.5 GB free after reclaim) · b958c9d