Why: The login recovery contract reserved the owner browser login step
for the user (passwords never pass through the agent); the user
confirmed the test passed on 2026-10-13, closing the final acceptance
loop.
Evidence: User session confirmation 2026-10-13; deploy and prior
verifiable acceptance under receipt 5396054b.
Impact: Doc-only status update in the leftover section.
Refs: docs/svc-deploy/2026-10-13-login-recovery-contract.md.
Why: The remaining open items (API-key SSE closure, cross-instance
redeem backoff, U7 atomic bootstrap/create, CLI credential delivery)
landed in Backend #192; Dev pins it and closes the contract leftovers.
Evidence: Backend #192 CI success at head bc1e0a3 (GATE); composite CI
on this PR re-runs the suite incl. test-pg (GATE).
Impact: backend pin cfb8308; contract leftover section now records all
items closed; task card H1-H6 requirement table.
Refs: Backend #192; docs/svc-deploy/2026-10-13-login-recovery-contract.md.
Why: The completion audit flagged four gaps over the merged login
recovery implementation: real-browser acceptance, the login-key e2e
spec, SSE stream invalidation, and the Documents write-back.
Evidence: Browser acceptance receipts be7ae9a2/b3a9e691 (SELF, bound to
Dev HEAD 268ef29); Backend #189 CI success at head 8b73afe (GATE);
Documents #94 merged; this PR's composite CI is the GATE for frontend
pin 44b9646.
Impact: Pins backend=349a47d (SSE close) and frontend=44b9646 (e2e
spec); contract doc leftovers updated; task card carries the follow-up
record for closure.
Refs: docs/svc-deploy/2026-10-13-login-recovery-contract.md; Documents
proposal r3; Backend #189; Frontend #77.
Why: The 2026-10-13 login flow plan requires a frozen contract record
(three adjudications against the r2 proposal) and a traceable task card
before implementation merges.
Evidence: doc-only commit; acceptance matrix cites backend/frontend test
files added in companion commits (SELF).
Impact: docs/svc-deploy/2026-10-13-login-recovery-contract.md becomes
the authoritative login-recovery contract; task card records user
authorization and requirement table L1-L9.
Refs: modules/documents/docs/proposals/2026-10-12-svc-unified-deploy-and-login-key.md r2
Why: preserve current source and service snapshots before final verification.
Evidence: SELF task-sync and read-only runtime receipts in the task card.
Impact: planning metadata only; no runtime or account changes.
Refs: account r2; recovery r3
Why: preserve evidence, current contracts and the next review scope without changing the running system.
Evidence: SELF startup, sync and document validation receipts in the task card; runtime and fault acceptance NOT_RUN.
Impact: task metadata, planning index and account specifications only; component pins and business code unchanged.
Refs: feature/svc-account-durability-plan; Documents account r2 and recovery r3
Why: #428 landed the same svc-deploy specs; U1 branch still had parallel copies causing add/add conflicts.
Evidence: U1 docs kept branch「已启动」; U4 docs took main (#428) versions
Impact: PR #429 should become mergeable.
Refs: Dev pulls/429; merged #428
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Backend #171 HEAD advanced with must_change e2e fix; keep Dev gitlink in sync and mark U4 specs started.
Evidence: Backend go test store/server/app green at 47463a9
Impact: Dev U4 branch tracks Backend PR #171 tip.
Refs: docs/svc-deploy/u4-one-time-login-key.md; Backend pulls/171
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: wire Dev to the Backend feature that delivers OpenExisting and
one-time login keys for the approved deploy proposal.
Evidence: SELF Backend tests; gitlink 1ba7225.
Impact: Backend gitlink + docs; runtime via new binary.
Refs: .task/feature-svc-deploy-u4-login-key.md
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen
