Why: The user dropped RDM DHF document templates at .templates/ for
upcoming use and wants them synced through the repository instead of a
local ignore; the temporary .gitignore entry is reverted and .DS_Store
junk is excluded.
Evidence: 44 template files staged (18MB, .doc/.docx across DHF stages);
.DS_Store ignored; working tree clean after staging (owner-directed
disposition of these files per session instruction).
Impact: Data-only addition under .templates/; .gitignore gains
.DS_Store; no code paths touched.
Refs: User instruction 2026-10-13 (templates to be used later).
Why: the 2026-10-11 runtime/ deletion lost all agent SQLite data with no
backup; the svc-autorecover closing report left "agent SQLite backup" as
a follow-up and the user asked to land it (recovery plan U2 residue).
Evidence: tests/test_svc_backup.py 11/11 green locally (live WAL writer,
manifest sha, retention, guards); make test-governance full suite green
(159 tests, rerun twice after one unreproduced flake).
Impact: new service-level actions backup/backups; snapshots live in
runtime-backups/<name>/ outside runtime/; rm --purge removes them; pg
backup and other flows unchanged.
Refs: modules/documents/docs/proposals/2026-10-12-service-restart-data-recovery.md r2 (sec 6, U2 residue); task card .task/feature-svc-agent-backup.md.
Why: U4 acceptance needs a reproducible real-browser run: build the
RDM binary from its origin/main, seed projects/ingest via the command
API, serve with auth on, and drive Playwright against vite preview.
Evidence: scripts/e2e.sh --seed-only smoke (in progress this task);
frontend pin points at the Playwright harness commit.
Impact: dev tooling only (.tmp artifacts ignored; no runtime changes).
Refs: task feature/rdm-e2e-acceptance; frontend feature branch of
the same name.
Why: cleanup, component synchronization, receipt recording and credential handling could contradict the documented development boundaries.
Evidence: SELF 75 isolated governance tests and source checks are captured in .task/feature-governance-reliability.md; combination and CI verification follow.
Impact: hardens local task and CI tooling, aligns policy and component documentation, and adds continuous regression tests without changing product behavior.
Refs: .task/feature-governance-reliability.md; policy/governance.md; policy/platform-admission.md
Why: track 2 of the fake-docx remediation — read-only preview fallback for
stock text-masquerading docx artifacts; also ignore the Mimosa plugin's
per-session .mimosa state dir that kept dirtying the tree and blocking precheck.
Evidence: modules/ui 83367f7 (doc->binary dispatch + readable Office error),
modules/frontend cd77340 (PK magic sniff + markdown fallback); make test-ui
49/49, make test-frontend 33/33, frontend tsc --noEmit clean.
Impact: parent pins move to the two submodule branches; .gitignore gains
.mimosa/; no code outside those modules.
Refs: .task/feature-preview-sniff-fallback.md
Why: cmd_finish ran git submodule deinit --all, but submodule.<name>.url entries live in the shared .git/config — finishing any task silently marked every other checkout and worktree uninitialized (observed twice on 2026-09-30: main checkout uninit=12 after each finish; a parallel session hit it minutes before this fix landed). The deinit serves no purpose: worktree removal with gitlinks is refused regardless, so cleanup already goes through rm -rf + prune. Also aligns AGENTS.md with observed hook behavior (post-merge fires on ff-only pulls too, and its inline close cannot see cards merged remotely until they are pulled), and ignores the ZCode-generated .zcodeignore that tripped the BUSY gate in every session.
Evidence: bash -n clean; abandon-path smoke of the patched script — start + FORCE_ABANDON=1 finish of a throwaway branch left shared submodule url config at 12 entries (pre-fix: 0), main checkout submodule status uninit=0, smoke worktree and branch fully recycled; the smoke close also backfilled a parallel session card left open (gitea-access-facts) via a card-close branch, proving the fallback path.
Impact: scripts/task.sh cmd_finish only (removes one line, updates comment), AGENTS.md card-close paragraph, .gitignore one entry. No product or gitlink change; make test not applicable (repo-level tooling/docs only). web_base default fix intentionally withdrawn from this PR — landed via parallel PR #73.
Refs: .task/fix-task-finish-close-followups.md
Why: R-platform spans core/ui/frontend/documents; also honors the
agreed housekeeping item — .env.dev must be gitignored (it holds live
API keys).
Evidence: make test full suite green on this head (exit 0); headless
walk on the real binary: avatar columns, settings shell with badges,
admin-row avatars, zero console errors.
Impact: capability layer only, no behavior changes. Merge order:
core -> ui -> frontend -> documents -> this PR.
Refs: proposal 2026-09-30-ui-redesign-and-auth.md (capability platform)
Why: a freshly deployed environment boots with an empty settings store,
so the first run dies with "main model unconfigured" and the user has
to open the settings UI before anything works - the opposite of
one-command bring-up.
Evidence: live matrix - full seed (chat+lightweight+tavily) lands in
the settings store (API view shows baseUrl/model with the key masked),
restart without flags does not re-seed and the settings persist,
.svc.env sourcing seeds a fresh environment from the one-time config
file, and a no-flag start stays silent. Also wrapped a /proc read race
in pid_alive that printed tr noise during stop.
Impact: --model-base/--model-key/--model-name, --light-base/-key/
-name, --tavily-keys on start/deploy (idempotent, only provided
fields); SVC_MODEL_*/SVC_LIGHT_*/SVC_TAVILY_KEYS env vars; <repo>/
.svc.env one-time config file (gitignored) makes every future deploy
self-configuring; auth-protected instances fall back to a clear hint.
Refs: feature/svc-auto-seed task card.
Why: deploying a new build meant manually finding and killing the old
process, rebuilding and re-launching with the right flags; dev and prod
instances could collide on ports, data dirs or kill each other.
Evidence: live matrix on the worktree - dev deploy (stop -> make build
-> start with health check), redeploy swaps the pid and keeps seeded
data, prod deploys alongside dev on separate port/data with fully
isolated /api/projects, port takeover is refused with the owning
process named while the running env stays up, stop clears pidfile and
frees the port. A pid-capture bug (compound-background subshell wrote
the wrapper pid instead of the server) was caught and fixed during the
first live run.
Impact: scripts/svc.sh <dev|prod> [deploy|stop|start|restart|status|
logs]; runtime/<env>/{data,svc.pid,svc.log,svc.env} isolation; defaults
dev 127.0.0.1:8788 / prod 127.0.0.1:8787 overridable via SVC_* env
vars (incl. SVC_PROD_DSN for the PG tier); make svc ENV=... shortcut;
runtime/ gitignored. Safety: only processes started by the script are
stopped (pidfile + /proc cmdline double check).
Refs: feature/svc-env-script task card.
Why: the chat page could not scroll once messages exceeded the viewport
and the input bar was pushed off-screen (missing min-height:0 on the
column flex chain .main->.chat->.chat-body).
Evidence: combo make test green with the advanced frontend gitlink;
headless-Chromium before/after measurements and four layout variants
recorded in the task card.
Impact: middle column only; also ignore /data-test/ local runtime data
so precheck does not report BUSY on the user's test artifacts.
Refs: Agent-System-Frontend a54022c (feature/chat-scroll-fix).
Why: zcode lacks a rules feature (AGENTS.md is the resident layer) but
supports PreToolUse hooks that can block Edit/Write before the write lands,
upgrading A1/A3 from commit-time to write-time enforcement; the two block
shapes (integration branch, detached submodule) mirror the real incidents.
Evidence: script-level suite 8/8 (N1-N3 blocks with exit 2 and remediation
hints, P1-P5 allows incl. fail-open degradation paths); config JSON valid;
client-side live-fire interception marked pending-live in the matrix.
Impact: .zcode/config.json enables the hook runner for this workspace;
.zcode/plans/ ignored (client state); no product code change.
Refs: Development-Guidelines 0.1.0-draft.8; policy/tool-adaptation-zcode.md
Why: a running serve instance writes data/ into the working tree, which
trips the precheck SHARED_WORKSPACE_BUSY verdict for every later task.
Evidence: git status showed only untracked data/; runtime state is covered
by make clean and never meant for version control.
Impact: entry-doc only change; no tracked content altered.
Refs: task feature/tool-adaptation-standard
weichen
weichen