Why: main recorded the r3.1 deployment notes while this branch records the approved U8 scope, and the pull request could not merge until both remained.
Evidence: bash scripts/lint-boundaries.sh printed architecture ok (84 edges) after the merge. Backend pin 167609b already contains backend main.
Impact: the approval text keeps the U8 scope and the rdmcand note. D1-D3 stay separately reviewable.
Refs: PROJECT.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the guard branch has to contain the identity-open and schema-compatibility commits that landed on backend main.
Evidence: backend 167609b merges origin/main and the local package tests passed before that commit.
Impact: the Dev pin moves from ef66bfb to 167609b. CI still has to rerun on this pin.
Refs: modules/backend
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the boundary lint rejects the new app-to-instanceguard and instanceguard-to-store edges that the activity lock needs.
Evidence: SELF bash scripts/lint-boundaries.sh exited 0.
Impact: the allowlist records those two edges. No runtime change.
Refs: Backend pull request 183
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: inode reuse let a rebuilt lock pass Bind. The pin and the spec now require a shared lock_gen.
Evidence: Backend ef66bfb. SELF go test of instanceguard, store, and app.
Impact: Dev gitlink moves to ef66bfb. Operators still adopt only after confirming the same instance.
Refs: Backend pull request 183
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the integration pin has to include the copy-list registration and the inode-reuse test fix that CI rejected.
Evidence: Backend 15e7ec5. SELF go test of TestCopyOrderCoversAllFixtureTables and TestDatabaseReplacementRefusedBeforeOpen.
Impact: Dev gitlink moves from 1f7bcac to 15e7ec5.
Refs: Backend pull request 183
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the card is the delivery record and needs the Backend and Dev pull request URLs.
Evidence: PR creation returned Backend #183 and Dev #482. CI GATE is not recorded yet.
Impact: task metadata only.
Refs: .task/feature-u8-sqlite-instance-guard.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the first pin allowed adopt to recreate a missing database and could write the guard record through a lock symlink. The spec now matches the refusal rules from review.
Evidence: Backend 1f7bcac; SELF tests named in that commit.
Impact: Dev gitlink moves from 89acd16 to 1f7bcac. Operators still see the same migrate command.
Refs: docs/recovery/u8-sqlite-instance-guard.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the task card has to carry the command output for the SQLite guard tests instead of a hand-copied summary.
Evidence: SELF receipt for go test of instanceguard, store, app, and the migrate command package; exit 0.
Impact: task metadata only.
Refs: .task/feature-u8-sqlite-instance-guard.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=$(git rev-parse origin/main).
Impact: integrate upstream changes without rewriting task history. The backend gitlink stays at 89acd16, which already contains the pinned identity CLI acabb85.
Refs: task-sync
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Operators need the guard error text and the migrate command, and the integration pin has to carry the Backend change. This branch was cut before the identity CLI pin, so the gitlink moves from 8e50977 to 89acd16, which also contains the already merged public identity CLI.
Evidence: SELF go test of the U8 cases in the Backend commit 89acd16. PG durability readback remains NOT_RUN until Dev CI.
Impact: SQLite serve and migrate share one activity lock. docs/svc.md lists the refusal strings. PROJECT.md records the 2026-10-12 approval of the account r2 and recovery r3 additions.
Refs: docs/recovery/u8-sqlite-instance-guard.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: recovery r3 U8 is approved for implementation through a mergeable PR, and the lock, inode and durability rules need a single spec before code.
Evidence: precheck receipt /tmp/u8-sqlite-instance-guard-precheck-2.json (SELF, exit 0, R0 6a494d3977).
Impact: task card and docs only; no runtime change yet.
Refs: docs/recovery/u8-sqlite-instance-guard.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-u8-sqlite-instance-guard.md; R0=6a494d3977e6557e7bebe0e5bb1c4a12091296e0.
Impact: task metadata only; the feature workspace starts at 6a494d3977.
Refs: .task/feature-u8-sqlite-instance-guard.md
weichenandCursor