Why: the 2026-10-12 drill left artifact recovery failed, and the retest changed that SELF result without changing the write-traffic gate.
Evidence: backup-20261013-013354 on Dev a83588dd and backend 46073d30; K1-K7 true, RPO 65s, RTO 3s, five artifacts matched and cross-user access returned 404. SELF.
Impact: proposal moves to r2.3. Second-instance writes stay closed until REPLAY or CI and the second host exist.
Refs: docs/records/2026-10-12-u7-ops-drill-report.md docs/proposals/2026-10-11-collaboration-storage-and-distribution.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: B6, C4, and C5 now have same-host results, and the plan still said the ops drills were not done and that replay was the next step.
Evidence: Dev results pgbench-20261012-131948, fault-20261012-142734, and backup-20261012-153441 (SELF). The user declined a capacity replay on 2026-10-12.
Impact: Second-instance writes stay closed. K4 remains a product defect. Replay and C3 are not started.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Capacity ladder/60m/2h dual-instance windows finished; planning
progress must reflect SELF-pass vs remaining GATE/REPLAY/C3 gaps.
Evidence: SELF load results summarized in the new capacity report.
Impact: Preferred next becomes independent REPLAY or C3/C4/C5.
Refs: Dev feature/u7-capacity-wrap-measure; release-multi-instance.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Delivery requires writing planning progress back after U7
landed; the proposal still claimed U1+U2 start / NOT_RUN.
Evidence: SELF doc edit against archived U7 cards and release
checklist A1-A7/B1 facts.
Impact: Readers see code-done vs capacity-window-pending; adds
HTTP multi-instance vs Manager-test lesson.
Refs: Dev feature/u7-capacity-wrap-measure; release-multi-instance.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: between the review round and the approval decision another session completed and merged svc-autorecover (PR #396/#400/#401/#402), so the (a)-decision tracking must reflect the landed slice and the remaining U2 delta.
Evidence: SELF - merged main history c622372 and archived card .task/archive/feature-svc-autorecover.md (10/10 tests, 146/146 governance, CI green on e0b49d1).
Impact: review record, INDEX; proposal r2 body unchanged.
Refs: PR #396#401
Why: the human gate resolved on 2026-10-12 - r2 approved (five stages at once) and option (a) adopted; the review record, proposal index and status navigation must reflect it.
Evidence: SELF - user decision relayed in conversation; stage-review details in the Dev task card; proposal r2 body unchanged (SHA256 9cfda252...).
Impact: review record, INDEX entry; no plan content change.
Refs: Dev task card .task/feature-service-restart-recovery-plan.md
Why: the reviewer record must reflect that all r2 gap claims hold at the post-sync backend pin 25fbea85, and that the svc-autorecover ownership decision now has 373 lines of unregistered, partially failing in-flight work to weigh.
Evidence: SELF - drift-check receipt in the Dev task card (exit 0, all cited gaps hold); svc-autorecover suite observed 5 of 10 tests failing on 2026-10-11.
Impact: review record addendum only; proposal r2 (SHA256 9cfda252...) unchanged.
Refs: Dev task card .task/feature-service-restart-recovery-plan.md
Why: absorb the external source-review round - pin the shutdown budget change, close the U1 acceptance gap for program/cwd changes, gate U4 public states on a mapping table, and make the svc-autorecover coordination an explicit human decision.
Evidence: SELF - external review round 2 in the review record; r2 SHA256 9cfda2520b913e6966c68fb3f66fb7bc8382a8f7a2b69cb364122216dcdb72cd; all reviewed claims re-verified against the pinned baselines.
Impact: documents only; four targeted amendments (U1/U3/U4/section 9) plus version bump and INDEX update; requirements and metrics unchanged.
Refs: Dev task card .task/feature-service-restart-recovery-plan.md
Why: reconcile the confirmed project, privacy and duty rules with all approved product requirements.
Evidence: current RDM d8d7e743 source review, recorded source receipt, and exact 34 UR/68 SR/10 F matrix checks; business validation NOT_RUN.
Impact: reviewed planning documents only, covering all 69 template types and the existing XLSX asset; no runtime changes.
Refs: docs/proposals/2026-10-11-rdm-final-target-completion.md
Why: connect the existing RDM assets and two-trees model to a reviewable document workflow.
Evidence: source inventory at RDM 0081628a; document structure and local link checks recorded as SELF in the Dev task card; business validation NOT_RUN.
Impact: planning and inventory documents only; no implementation or deployment.
Refs: docs/proposals/2026-10-11-rdm-template-dialog-generation.md
Why: assess existing two-tree and trace-network capabilities and define project-scoped inspection.
Evidence: SELF source receipt and document checks; business and runtime verification were not run.
Impact: pending-review proposal and index only; no product implementation or deployment.
Refs: Dev feature/rdm-two-trees-audit-plan
Why: freeze the direction for 10-100 user multi-project collaboration storage (PostgreSQL team tier, migration, staged multi-instance) before U1+U2 implementation starts.
Evidence: static review record and SELF audit receipt included; user approval recorded in Dev task card 2026-10-11 (instruction to start the transformation per the plan).
Impact: docs only - new proposal, index entry, review record, audit receipt; no code or runtime change.
Refs: Dev .task/feature-collaboration-storage-plan.md; plan section 5 names U1+U2 as the first increment.
Why: v0.2.0 is the hard prerequisite for RDM shared work, and the release
checklist referenced a stale SurfaceVersion and tag message.
Evidence: SELF - scope lines are tied to merged Backend PRs (#66-#110);
Backend #110 CI success; UI composite run 1369 shows 14 files/103 tests.
Impact: Adds docs/records/2026-10-09-base-v0.2.0-release.md and points the
compat policy and the EXT-1 proposal at the actual 2.5.0-experimental line.
Tag creation and push stay with the owner (dual-key rule).
Refs: Dev feature/base-v020-release; Backend #110
Why: The RDM plan's 2026-10-07 snapshot (downstream at zero, N1 in
flight, O1/O3/O7 blocked) was contradicted by the RDM repo's 103 merged
PRs; the planning index registered this as an open reconciliation item
and named it the preferred follow-up to the stage-record task.
Evidence: isolated clone replay at RDM 4feb2f0 (pins=v0.1.0) - make
test exit 0, -ms1 PASS (same-source gold caveat recorded), ms0
acceptance PASS=9/SKIP=0 on a disposable postgres container, five
upload probes, and entrance probes (chat 400 vs commands 200); card/
PR snapshot JSON; all receipts SELF (RDM has no CI), stored under
docs/records/2026-10-08-rdm-status-*.json. The private minutes probe
receipt stays local by decision; only hashes and metrics are recorded.
Impact: adds plan SS2.3 (row-by-row re-verdict, MS1 seven-clause audit,
six registered gaps), marks SS2 as a historical snapshot, updates the
index milestone table and closes the RDM-snapshot open item, registers
the dual-main-record ruling and the missing-CI gap.
Refs: Dev task feature/rdm-status-review; Documents index next-step
(2026-10-08).
Why: make existing directions, milestones and tasks discoverable without treating document claims as acceptance.
Evidence: fixed file blobs, 55 PR API records and Git ancestry are preserved as SELF observations; document links and all 19 proposals are checked.
Impact: navigation and evidence only; original plans, approval scope and business code are unchanged.
Refs: Dev feature/planning-index; docs/proposals/INDEX.md
Why: The comparison has to say what was borrowed, what was refused, and which product behaviors changed, without copying upstream text.
Evidence: The record lists the verified security gaps and the features implemented in this task. Proposal section 2.5 links to it.
Impact: Deferred and rejected items stay deferred and rejected. Adopted context and secret behavior is no longer described as a later batch.
Refs: feature/sillytavern-review
Why: The October 3 durable note described Pico5 before packages 1-23 existed, and the stack proposal had no place for the v1.0.1 and ZCode v3.14.3 findings.
Evidence: The new record, the correction at the top of the durable note, and proposal section 2.4 link to each other. No code changes.
Impact: Documents only. Later batches can cite the adopt, hold, and reject rows.
Refs: Dev feature/pi-zcode-second-pass
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The review record still said the proposal was unmerged, but Documents PR #34 is on main and this branch is cut from that commit.
Evidence: origin/main is 76044b5, the merge of feature/agent-stack-blueprint.
Impact: One sentence in the review record. The proposal text is unchanged.
Refs: Dev feature/pi-durable-borrow
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Pico5's package is a contract sketch, but its commit and recovery rules match four verified gaps in how runs survive a hard kill.
Evidence: Reviewed earendil-works/pi @ c7cdb460a, packages/durable and docs/pico-v5.md, against the skeleton section 4.2 and the current backend store, run manager, and SSE handler.
Impact: Documents only. The record rejects taking the package as a dependency and lists what the matching backend task changes.
Refs: Dev feature/pi-durable-borrow
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The three libraries cannot be reused or recovered independently, and the tested dependency combination is not the one the product builds.
Evidence: Read-only audit at native c6d867c, squad 590fd86, intent 1dbbe81, recorded with file references in docs/records/2026-10-02-agent-stack-audit.md.
Impact: Documents only. No library code or gitlinks change in this commit. Later stages stay separate tasks.
Refs: Dev feature/agent-stack-blueprint
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: T4 acceptance requires a verification record in this repo before the Dev combo pin.
Evidence: backend full sweep green with TestWorkspacesOverlay; ui 23/23 (OverlayHost semantics); frontend tsc+vitest+build; example plugin workspace/command assets JSON-validated; combo make test at pinned heads.
Impact: docs/records only.
Refs: docs/proposals/2026-09-30-ui-inbox-command-workspace.md T4; task card feature/workspaces-r1
Why: T3 acceptance requires a verification record in this repo before the Dev combo pin.
Evidence: backend 15 pkgs ok incl. new cmdbus suite and danger-confirm e2e (dispatch -> confirm card -> action -> committed -> audit query ordered); ui 18/18; frontend 9/9; combo make test at pinned heads.
Impact: docs/records only.
Refs: docs/proposals/2026-09-30-ui-inbox-command-workspace.md T3; task card feature/command-bus-r1
Why: Delivery gate requires a verification record with per-case PASS evidence
for the T1 contract task before requesting review.
Evidence: record covers core/agent-command/frontend/ui suites, combo test and
the additive-compatibility check; contract change list enumerated.
Impact: Documentation only.
Refs: Dev task feature/core-cards-commands-r1
Why: the migration safety net (archive refs, bundles, SHA maps) had never
been exercised; verification rules treat untested recovery as a claim.
Evidence: 15/15 drill checks in a remote-only fresh environment (fsck, tip
and count matches, go test passing on the restored pre-rewrite tip, parent
gitlink reachability); the found gap — chain SHAs only in local bundles —
fixed by pushing refs/rewrite-backup/pre-2026-09-30-chain.
Impact: record-only; backend full-chain restore noted as a known, accepted
limitation.
Refs: 2026-09-30-history-migration.md; 2026-09-30-history-migration-sha-map.md
Why: the migration recovery data lived only on the migration workstation;
before the local backup bundles are retired, the maps belong in the
process repo per the single-source rule.
Evidence: combined from backups-2026-09-30/mapping-*.txt (10 repos + parent
+ restored chains); migration record pointer updated.
Impact: record-only; enables the scheduled local backup cleanup while
remote archive refs remain the full safety net.
Refs: 2026-09-30-history-migration.md
Why: both 2026-09-30 incidents produced reusable causal knowledge (nil-slice
JSON null vs .map; shared-checkout conflicts and gitlinks pinning unpushed
commits) that meets the lesson bar of trigger, mechanism, checks, and
verified guards.
Evidence: incident records and fix PRs referenced inline; guards validated
in policy/adoption.md and the tool-adaptation matrices.
Impact: record-only; documents no product code.
Refs: Agent-System-Dev 8f7cf2d; Agent-System-Backend fix/empty-list-json
Why: the composition-wide message normalization rewrote ten repos; the
governed-migration rule requires bundle backups, archive refs, SHA maps, and
a recovery record in the process repo.
Evidence: per-repo commit counts and empty tree diffs captured during
execution; remote mains verified against local after force-push.
Impact: record-only; documents no product code. Also records the
multitenancy delivery defect (gitlinks pinning unpushed commits) and its
remediation.
Refs: Development-Guidelines 0.1.0-draft.7 multi-repo.md; Agent-System-Dev ef89fc8
weichenandCursor