diff --git a/.doc/ops/CURRENT.md b/.doc/ops/CURRENT.md
index 84fb78d6..d2aa27c9 100644
--- a/.doc/ops/CURRENT.md
+++ b/.doc/ops/CURRENT.md
@@ -5,7 +5,7 @@
 
 ## 焦点
 
-1. **DOC-RELIABILITY**: [M1 活验签字与条件 M2](../ops/short-term/2026-09-14-document-reliability-m1-live-and-m2.md)（`refactor/document-reliability-pilot`；`mutex=docgov`；占集成槽 live 签字）
+1. **DOC-RELIABILITY**: [M1 活验已签，开工 M2 U5–U7](../ops/short-term/2026-09-14-document-reliability-m1-live-and-m2.md)（`refactor/document-reliability-pilot`；`mutex=workspace`；活验报告最后一句 **继续 M2**）
 2. **CHAT-INTENT**: [对话意图运行时状态](../audit/2026-09-13-conversation-intent-runtime-state.md)（`fix/conversation-intent-state`；与文档账本运行时无关）
 3. **CHAT**: [对话历史刷新](../audit/2026-09-13-chat-history-refresh-disappears.md)（认领仍 `in_progress`；gap 行已 PASS，以代码/handoff 为准收敛）
 
@@ -13,7 +13,7 @@
 
 | owner | task | branch | worktree | mutex | status |
 |-------|------|--------|----------|-------|--------|
-| Cursor | document-reliability-m1-live-and-m2 | refactor/document-reliability-pilot | .worktrees/refactor-document-reliability-pilot | docgov | in_progress |
+| Cursor | document-reliability-m1-live-and-m2 | refactor/document-reliability-pilot | .worktrees/refactor-document-reliability-pilot | workspace | in_progress |
 | Codex | module-decoupling-remediation-plan | feature/module-decoupling-remediation | .worktrees/feature/module-decoupling-remediation | architecture-docs | done |
 | verifier_antigravity | controlled-content-ui-acceptance | fix/controlled-content-ui-acceptance | .worktrees/fix-controlled-content-ui-acceptance | document-content-ui-acceptance | done |
 | implementer_cursor | controlled-content-canonical-hash | fix/controlled-content-canonical-hash | .worktrees/fix-controlled-content-canonical-hash | docgov | done |
@@ -54,13 +54,13 @@
 > 新任务开始前登记。`branch` 必须为 `feature/<slug>` 或 `fix/<slug>`，**禁止** `dev` / `test` / `main`。同一 `mutex` 同时仅一个 `in_progress`。
 
 > workflow-plan 409 与治理鉴权 G1–G5 已收口（见 [test-report](../test-reports/2026-09-14-governance-action-level-authz-test-report.md)）。禁止终止或改写项目 143。
-> `document-reliability-pilot` 占 `docgov` + 集成槽做 M1 活验。禁止 worktree 内 `env-service`。项目 143 只读，禁止终止。
+> `document-reliability-pilot` M1 活验已签（继续 M2）。现占 `workspace` 做 U5–U7。禁止 worktree 内 `env-service`。项目 143 只读，禁止终止。
 
 ## 集成槽位
 
 | holder | phase | since | scope | queue |
 |--------|-------|-------|-------|-------|
-| Cursor | e2e | 2026-09-14 | DOC-RELIABILITY M1 live | - |
+| - | idle | - | - | - |
 
 **phase**: `idle` | `merging` | `smoke` | `e2e`
 
@@ -70,7 +70,7 @@
 
 | 环境 | 端口 | schema | 状态 |
 |------|------|--------|------|
-| dev | 8080 | **33** | healthy（`pi-agent`；治理鉴权 G5 页面+API PASS） |
+| dev | 8080 | **33** | healthy（`pi-agent`；M1 活验 rebuild 后 health+ready PASS） |
 | test | 8081 | 25→27* | healthy |
 | main | 8000 | 25→27* | healthy（app + runner + DB） |
 
diff --git a/.doc/ops/checklists/2026-09-14-module-decoupling-refactor-acceptance.md b/.doc/ops/checklists/2026-09-14-module-decoupling-refactor-acceptance.md
index a9b9b044..277ba1c7 100644
--- a/.doc/ops/checklists/2026-09-14-module-decoupling-refactor-acceptance.md
+++ b/.doc/ops/checklists/2026-09-14-module-decoupling-refactor-acceptance.md
@@ -19,10 +19,10 @@ owner: Cursor
 - [x] 人工编辑、agent commit、approve/reject 的跨表写入同事务（U3；隔离库双会话编辑已测）。
 - [x] fault injection 任一点失败均无部分提交（U2 隔离库）。
 - [x] 同 ETag 并发写只有一个赢家（内存 + 双会话）。
-- [ ] 1、2、4 app replicas 结果一致。
-- [x] GET 服务端零写入 + typed consistency（U4 单测）。refresh/reload 真页面未测。
-- [ ] 项目 143 等价 hazard 与新项目真实页面刷新、重登、restart、rebuild PASS。
-- [x] 服务端负例 fail closed；浏览器跨用户未测。
+- [x] 1、2、4 app replicas 结果一致。
+- [x] GET 服务端零写入 + typed consistency（U4 单测）。refresh/reload 真页面 PASS（[活验报告](../../test-reports/2026-09-14-document-reliability-pilot-live-test-report.md)）。
+- [x] 项目 143 等价 hazard 与新项目真实页面刷新、重登、restart、rebuild PASS。
+- [x] 服务端负例 fail closed；浏览器跨用户 401/404 PASS。
 
 ## M2 事件与 FAV
 
@@ -61,9 +61,9 @@ owner: Cursor
 - [x] PostgreSQL integration 证据（隔离库，非共享 env 库）。
 - [x] race/concurrency 目标包证据（非全仓 race）。
 - [x] fault injection 证据（U2）。
-- [ ] 真实 PI 证据。
-- [ ] 真实浏览器证据。
-- [ ] restart/rebuild 证据。
+- [x] 真实 PI 证据。
+- [x] 真实浏览器证据。
+- [x] restart/rebuild 证据。
 - [x] cross-user/project authorization negative 服务端证据。
 - [ ] scratch recovery 与完整 DB restore 证据。
 
diff --git a/.doc/ops/short-term/2026-09-14-document-reliability-m1-live-and-m2.md b/.doc/ops/short-term/2026-09-14-document-reliability-m1-live-and-m2.md
index 503c8900..d59a1af0 100644
--- a/.doc/ops/short-term/2026-09-14-document-reliability-m1-live-and-m2.md
+++ b/.doc/ops/short-term/2026-09-14-document-reliability-m1-live-and-m2.md
@@ -6,7 +6,7 @@ updated: 2026-09-14
 owner: Cursor
 branch: refactor/document-reliability-pilot
 worktree: .worktrees/refactor-document-reliability-pilot
-mutex: docgov
+mutex: workspace
 ---
 
 # 文档可靠性 M1 活验签字与条件 M2
@@ -32,18 +32,24 @@ mutex: docgov
 
 ## 步骤
 
-1. [ ] 占集成槽并合入本地 dev rebuild
-2. [ ] 浏览器 + 跨用户
-3. [ ] 真实 PI
-4. [ ] 双 pool/4 会话
-5. [ ] 活验报告
-6. [ ] 条件 M2
+1. [x] 占集成槽并合入本地 dev rebuild
+2. [x] 浏览器 + 跨用户
+3. [x] 真实 PI
+4. [x] 双 pool/4 会话
+5. [x] 活验报告（最后一句：继续 M2）
+6. [ ] 条件 M2（U5–U7）
 
 ## 验收标准
 
-- [ ] health + ready 来自本分支镜像
-- [ ] 143/新项目刷新 404/409/projection-missing = 0 或报告停止扩面
-- [ ] 报告最后一句只能是继续 M2 或停止扩面
+- [x] health + ready 来自本分支镜像
+- [x] 143/新项目刷新 404/409/projection-missing = 0 或报告停止扩面
+- [x] 报告最后一句只能是继续 M2 或停止扩面
+
+## 相关链接
+
+- Checklist: [../checklists/2026-09-14-module-decoupling-refactor-acceptance.md](../checklists/2026-09-14-module-decoupling-refactor-acceptance.md)
+- Prior report: [../../test-reports/2026-09-14-document-reliability-pilot-test-report.md](../../test-reports/2026-09-14-document-reliability-pilot-test-report.md)
+- Live report: [../../test-reports/2026-09-14-document-reliability-pilot-live-test-report.md](../../test-reports/2026-09-14-document-reliability-pilot-live-test-report.md)
 
 ## 相关链接
 
diff --git a/.doc/remediation/gap-matrix.md b/.doc/remediation/gap-matrix.md
index e4d19fd7..a8ff5189 100644
--- a/.doc/remediation/gap-matrix.md
+++ b/.doc/remediation/gap-matrix.md
@@ -70,7 +70,7 @@
 | DOCREV-ACTIVE-DOC-ROUTING | UI-05「当前受控文档」被法规关键词改路由到 `feasibility_reg`，intake 无 pending | **PASS** | [audit](../audit/2026-09-13-document-revision-active-doc-routing.md)；Round20 UI-05 pending 停在 intake V2 | **不改弱 E2E**；不删证据 |
 | DOCREV-QUALITY-STATUS-FP | 行动计划表状态列「待续」被门禁当敷衍，两轮 repair 后 quality_failed 80 | **PASS** | [audit](../audit/2026-09-13-document-revision-quality-status-false-positive.md)；Round20 UI-03 | **不删禁词、不放宽正文**；不删证据 |
 | GOVERNANCE-ACTION-AUTHZ | 文档动作按职责鉴权；未激活 202-blocked；关闭创建直通 | **PASS** | [test-report](../test-reports/2026-09-14-governance-action-level-authz-test-report.md)；[audit 异态](../audit/2026-09-14-planning-with-workflow-key-anomaly.md) | 不改 83 条 planning+key 夹具；none 长 PI 审批链另开 |
-| DOC-RELIABILITY-PILOT | 受控文档写路径跨表非同事务、读路径被 projection 绑架、授权 TOCTOU；刷新/重启后可能 404/409/projection-missing | OPEN | [复核](../audit/2026-09-14-module-decoupling-plan-review.md)；[重构计划](./2026-09-14-module-decoupling-refactor-plan.md)；[试点任务](../ops/short-term/2026-09-14-document-reliability-pilot.md)；[M1 报告](../test-reports/2026-09-14-document-reliability-pilot-test-report.md) | U1–U4 已编码。M1 **停止扩面**（无真实 PI/浏览器/rebuild）。未占槽不得 rebuild；禁止 U5–U12 |
+| DOC-RELIABILITY-PILOT | 受控文档写路径跨表非同事务、读路径被 projection 绑架、授权 TOCTOU；刷新/重启后可能 404/409/projection-missing | OPEN | [复核](../audit/2026-09-14-module-decoupling-plan-review.md)；[重构计划](./2026-09-14-module-decoupling-refactor-plan.md)；[试点任务](../ops/short-term/2026-09-14-document-reliability-pilot.md)；[M1 停止扩面](../test-reports/2026-09-14-document-reliability-pilot-test-report.md)；[M1 活验](../test-reports/2026-09-14-document-reliability-pilot-live-test-report.md) | M1 活验 **继续 M2**。U5–U7 进行中；未签字前禁止 U8–U12 |
 
 ---
 
diff --git a/.doc/status/FEATURE-MATRIX.md b/.doc/status/FEATURE-MATRIX.md
index 7b018a68..5cf61b22 100644
--- a/.doc/status/FEATURE-MATRIX.md
+++ b/.doc/status/FEATURE-MATRIX.md
@@ -27,7 +27,7 @@
 | PI Runner / 配置链 | pi-agent + MiniMax 真实链路 | done | [test piagent](../test-reports/2026-09-13-codex-audit-p0-remediation-test-report.md)；[container-env](../test-reports/2026-09-13-container-env-configuration-test-report.md) | — | `pi-agent` |
 | 三环境运维 | dev/test/main + 共享 KB | done | [PROJECT.md](../../PROJECT.md) §4；四环境 healthy | — | `infra` |
 | CI / E2E | PG 集成 + 真实 PI E2E | partial | [gap-matrix BUG-08](../remediation/gap-matrix.md)；[test pg-ci](../test-reports/2026-09-12-pg-ci-soak-e2e-test-report.md)；[运行时 UI Round20](../test-reports/2026-09-14-document-revision-runtime-ui-test-report.md) | CI `TEST_DATABASE_URL` 隔离库仍缺；文档运行时真实 UI 已按 UI_PHASE 分文件且 post-restart 断言最终 A1 正文。`-race` 全包并行 TempDir flake 为基建残留 | `ci` |
-| 模块解耦与可靠事件 | 文档可靠性纵向试点、跨属主事务、多副本互斥、FAV 与选择性模块化 | partial | [架构](../system-design/2026-09-14-module-decoupling-architecture.md)；[ADR](../adr/2026-09-14-modular-monolith-decoupling.md)；[重构计划](../remediation/2026-09-14-module-decoupling-refactor-plan.md)；[试点任务](../ops/short-term/2026-09-14-document-reliability-pilot.md)；[M1 报告](../test-reports/2026-09-14-document-reliability-pilot-test-report.md) | U1–U4 已在 `refactor/document-reliability-pilot` 落地（Unit/隔离库 PASS）。M1 **停止扩面**：真实 PI/浏览器/rebuild 未签。禁止 U5–U12 | `docgov` |
+| 模块解耦与可靠事件 | 文档可靠性纵向试点、跨属主事务、多副本互斥、FAV 与选择性模块化 | partial | [架构](../system-design/2026-09-14-module-decoupling-architecture.md)；[ADR](../adr/2026-09-14-modular-monolith-decoupling.md)；[重构计划](../remediation/2026-09-14-module-decoupling-refactor-plan.md)；[试点任务](../ops/short-term/2026-09-14-document-reliability-pilot.md)；[M1 停止扩面](../test-reports/2026-09-14-document-reliability-pilot-test-report.md)；[M1 活验](../test-reports/2026-09-14-document-reliability-pilot-live-test-report.md) | U1–U4 活验 PASS（rebuild + 真实 PI + 浏览器 + 双 pool/4 会话）。活验最后一句 **继续 M2**。正在 U5–U7 | `workspace` |
 
 ---
 
diff --git a/.doc/test-reports/2026-09-14-document-reliability-pilot-live-test-report.md b/.doc/test-reports/2026-09-14-document-reliability-pilot-live-test-report.md
new file mode 100644
index 00000000..1d5d954e
--- /dev/null
+++ b/.doc/test-reports/2026-09-14-document-reliability-pilot-live-test-report.md
@@ -0,0 +1,137 @@
+# 文档可靠性试点 M1 活验签字测试报告
+
+## 一、 测试背景 (Background)
+
+上一份 [M1 试点报告](./2026-09-14-document-reliability-pilot-test-report.md) 在 Unit/隔离库通过后，因未占槽 rebuild、无真实 PI/浏览器/4 会话而把最后一句写成 **停止扩面**。本轮不改写那份结论句；只补活验签字，决定能否开工 U5–U7。
+
+## 二、 测试目标 (Test Objectives)
+
+- A1：占集成槽，本地 `dev` `--no-ff` 合入试点分支，`env-service.sh dev rebuild`，health+ready 来自本分支镜像。
+- A2：项目 143 只读打开/刷新/重登；新建项目打开/刷新/重登；`GET .../content` 为 200 且带 `consistency`；禁止把 missing 当 404。
+- A3：真实 `pi-agent` + MiniMax 编制一条受控文档，刷新不丢正文。禁止 stub 当终态。
+- A4：隔离库两个 pgx pool + 4 会话同 ETag 一赢，同 key+digest 跨 pool 重放。测完 `DROP DATABASE`。
+- A5：分栏签字；最后一句只能是「继续 M2」或「停止扩面」。
+
+## 三、 测试方案与环境 (Test Plan & Environment)
+
+| 项 | 值 |
+|----|-----|
+| OS | Linux 7.0.0-31-generic |
+| Go | 本机 `go test`；容器 `agent-dev-app` |
+| 合入 | 主仓 `dev` `--no-ff` `refactor/document-reliability-pilot` → `cb8eaca` |
+| 部署 | 主仓 `./scripts/env-service.sh dev rebuild`（禁止 `compose restart` 当证据） |
+| Compose | 项目 `agent-dev`，HTTP `:8080` |
+| Agent | 真实 `pi-agent`（`AGENT_BACKEND=pi-agent`），模型 `MiniMax-M2.7-highspeed`（云端 API，非 stub） |
+| Schema | **33** |
+| `FAV_DEGRADED_READ` | unset / 默认 false |
+| 浏览器 | `mcr.microsoft.com/playwright:v1.63.0-noble`，`--network host --ipc host` |
+| PostgreSQL | 隔离库 `agent_rel_itest`（`shuimu-system-pg-test:5434`），测完 `DROP`；禁止 `agent_system_dev/test/main` |
+| 项目 143 | **只读**；未 terminate，未 `PUT /143/workflow-plan` |
+| 证据 | `.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/` |
+
+镜像身份（rebuild 后）：`app_image=sha256:251fa99d5de47d452b7f099304aa34b1e2aacf1b4e9d2d23d1cb4b850084910e`；随后把 `pi-agent` force-recreate 到 rebuild 所打的 `sha256:21fc9b64066c33e94d8db83695b4ff64ea5e49f6d65661f8ccab11ead083042d`。见 `rebuild-health-ready.txt`。
+
+## 四、 预期结果 (Expected Results)
+
+| 栏 | 期望 |
+|----|------|
+| Unit / stub | `go test -short` 全绿；hydrate 把 `missing` 当正文 |
+| PostgreSQL | 双 pool 同 ETag 一赢；同 key+digest 跨 pool 重放；4 会话同 ETag 一赢 |
+| 故障注入 | 与上一份隔离库 U2 一致，本轮 `-race` 再跑目标包 |
+| 真实 PI | 新建项目激活后编制，账本 head 可读 |
+| 真实浏览器 | 143 与新项目刷新/重登 200 + markdown；页面无「加载失败」；无 PROJECTION 409 |
+| restart/rebuild | health/ready `status=ok`，`agent_backend=pi-agent`，`schema_version=33`；ready 不因 vault 未配置假绿，响应无路径泄漏 |
+| 跨用户 | 匿名 401；非成员/跨项目/错误 stage-duty 同一 404 `DOCUMENT_NOT_FOUND` |
+
+## 五、 实际测试结果与判定 (Actual Results & Evaluation)
+
+### 5.1 Unit / stub
+
+- **测试输入**: `unset TEST_DATABASE_URL; go test -short ./...`；`npx tsx --test src/lib/controlledDocHydrate.test.ts`；`./scripts/arch-check.sh --mode warn`
+- **实际输出**: 全仓 short 包 `ok`；hydrate **17 passed**；`arch-check warn: production gate passed`
+- **评价判定**: **PASS**
+- **性能与耗时**: `internal/server` 约 9.6s。日志：`go-test-short.txt`、`hydrate-unit.txt`、`arch-check-warn.txt`
+
+### 5.2 PostgreSQL 事务与并发
+
+- **测试输入**: 隔离库 `TEST_DATABASE_URL` → `./internal/docrevision -run 'TestDocumentCommitConcurrencyPG|TestDocumentCommitTwoPoolsAndFourSessionsPG'`
+- **实际输出**:
+
+```
+--- PASS: TestDocumentCommitConcurrencyPG (0.03s)
+--- PASS: TestDocumentCommitTwoPoolsAndFourSessionsPG (0.03s)
+```
+
+两个独立 `pgxpool` 打同一 ETag 仅一赢；赢家 key+digest 跨 pool 重放 head 一致；随后 4 个会话同 ETag 仅一赢。测完 `DROP DATABASE agent_rel_itest`。
+- **评价判定**: **PASS**（不是 4 个 OS 进程，是计划要求的双 pool 模拟两进程 + 4 会话；未使用进程内全局 mutex）
+- **性能与耗时**: 62ms。日志：`go-test-pg-two-pool.txt`
+
+### 5.3 故障注入
+
+- **测试输入**: `go test -race ./internal/app/uow ./internal/app/docflow ./internal/docquery`（同一隔离库，DROP 前）
+- **实际输出**: 三包 `ok`（含 cached）
+- **评价判定**: **PASS**
+- **性能与耗时**: 亚秒到约 1.8s
+
+### 5.4 真实 PI
+
+- **测试输入**: Playwright 新建项目 → 未激活编制被 202 `blocked_pending_governance` → 配置并激活 → 发送「请基于本项目编制首轮《用户需求》摸底文档…」→ 等待小队终态 → 打开 `doc_proj*` intake
+- **实际输出**: 编制用例 **4.2min PASS**。`GET /api/v1/docgov/documents/{id}/content` **200** 且 `markdown` 非空；刷新与重登正文相同。截图 `07-new-doc.png` / `08-new-doc-reload.png` / `09-new-doc-relogin.png`
+- **评价判定**: **PASS**（真实 `pi-agent`，非 stub）
+- **性能与耗时**: 编制+打开约 4.2min
+
+### 5.5 真实浏览器
+
+- **测试输入**: `RUN_UI_ACCEPTANCE=1 BASE_URL=http://127.0.0.1:8080`；`web/e2e/controlled-document-reload.spec.ts`（官方 Playwright 镜像）
+- **实际输出**:
+
+```
+✓ project 143 content is 200 with consistency; anonymous is 401; unknown is 404 (4.6s)
+✓ non-member GET of project 143 is the same 404 as unknown (7.4s)
+✓ new project PI compile then reload keeps ledger markdown (4.2m)
+✓ cross-project and wrong-stage GET stay DOCUMENT_NOT_FOUND (3.8s)
+4 passed (4.5m)
+```
+
+143 打开/刷新/重登均为 200 + markdown + typed `consistency`，无 `PROJECTION` 409，页面无「加载失败」。未对 `/143/` 发 `PUT workflow-plan`，未 terminate。
+- **评价判定**: **PASS**
+- **性能与耗时**: 整套 4.5min。日志：`playwright-controlled-reload.txt`；截图 `screenshots/01`–`10`
+
+### 5.6 restart / rebuild
+
+- **测试输入**: 占槽后 `./scripts/env-service.sh dev rebuild`；`curl -sf http://127.0.0.1:8080/api/v1/health` 与 `/api/v1/ready`
+- **实际输出**: 两者 HTTP 200，body 均为
+
+```
+{"status":"ok","env":"dev","agent_backend":"pi-agent","version":"v1.0","shared_kb_port":5432,"database_ready":true,"schema_version":33,"schema_ready":true,"task_store_ready":true}
+```
+
+无文件系统路径字段。vault 未配置时 ready 仍按 DB/schema/task_store 判定，不是假绿。
+- **评价判定**: **PASS**
+- **性能与耗时**: rebuild 约 79s。日志：`rebuild-health-ready.txt`、`health.json`、`ready.json`
+
+### 5.7 跨用户负例
+
+- **测试输入**: 匿名 GET 143；局外人 D GET 143 与新项目文档；审核人 B GET 143 与伪造 `_design_control` stage
+- **实际输出**: 匿名 **401**；其余均为 **404** `DOCUMENT_NOT_FOUND`，不泄露存在性
+- **评价判定**: **PASS**
+- **性能与耗时**: 3.8s。截图 `10-fail-closed.png`
+
+## 六、 自动化测试套件汇总 (Test Suite Execution)
+
+| 命令 | 结果 |
+|------|------|
+| `go vet ./...` | PASS（合入后、rebuild 前） |
+| `go test -short ./...` | PASS |
+| 隔离库双 pool / 4 会话 | PASS，随后 `DROP DATABASE` |
+| 目标包 `-race` | PASS |
+| `arch-check --mode warn` | PASS |
+| hydrate 单测 | 17/17 PASS |
+| Playwright 活验（官方镜像） | **4 passed** |
+| 宿主 `npx playwright` | 因缺 `libatk-1.0.so.0` 无法启动；改走已验证的 `mcr.microsoft.com/playwright:v1.63.0-noble` |
+
+## 七、 测试结论与后续优化建议 (Conclusion & Next Steps)
+
+活验补齐了上一份报告缺的 rebuild、真实 PI、真实浏览器、双 pool/4 会话与 HTTP 跨用户负例。hazard 真页面 404/409/projection-missing 本轮观测为 0；授权未靠放宽；4 会话赢家来自数据库锁而非进程内 mutex。M1 签字通过，允许按计划实施 U5–U7。上一份「停止扩面」报告保持原句，不改写。
+
+继续 M2
diff --git a/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/arch-check-warn.txt b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/arch-check-warn.txt
new file mode 100644
index 00000000..7153443d
--- /dev/null
+++ b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/arch-check-warn.txt
@@ -0,0 +1,4 @@
+arch-check mode=warn
+boundaries=/home/weichen/projects/Agent-System/.doc/system-design/module-boundaries.yaml
+ok  	chat-agent-system/internal/archtest	0.096s
+arch-check warn: production gate passed
diff --git a/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/go-test-pg-two-pool.txt b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/go-test-pg-two-pool.txt
new file mode 100644
index 00000000..6897099f
--- /dev/null
+++ b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/go-test-pg-two-pool.txt
@@ -0,0 +1,12 @@
+=== go test uow docflow docquery -race ===
+ok  	chat-agent-system/internal/app/uow	(cached)
+ok  	chat-agent-system/internal/app/docflow	(cached)
+ok  	chat-agent-system/internal/docquery	(cached)
+=== go test docrevision concurrency ===
+=== RUN   TestDocumentCommitConcurrencyPG
+2026/09/14 14:29:18 goose: no migrations to run. current version: 33
+--- PASS: TestDocumentCommitConcurrencyPG (0.03s)
+=== RUN   TestDocumentCommitTwoPoolsAndFourSessionsPG
+--- PASS: TestDocumentCommitTwoPoolsAndFourSessionsPG (0.03s)
+PASS
+ok  	chat-agent-system/internal/docrevision	0.062s
diff --git a/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/go-test-short.txt b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/go-test-short.txt
new file mode 100644
index 00000000..c650c5d8
--- /dev/null
+++ b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/go-test-short.txt
@@ -0,0 +1,44 @@
+ok  	chat-agent-system/cmd/bizdev-cli	(cached)
+ok  	chat-agent-system/cmd/document-content-reconcile	(cached)
+?   	chat-agent-system/cmd/document-revision-backfill	[no test files]
+?   	chat-agent-system/cmd/recategorize	[no test files]
+?   	chat-agent-system/cmd/server	[no test files]
+ok  	chat-agent-system/internal/agent	(cached)
+ok  	chat-agent-system/internal/app/docflow	(cached)
+ok  	chat-agent-system/internal/app/uow	(cached)
+ok  	chat-agent-system/internal/archtest	0.104s
+ok  	chat-agent-system/internal/auth	(cached)
+ok  	chat-agent-system/internal/authz	(cached)
+ok  	chat-agent-system/internal/bizdev	(cached)
+ok  	chat-agent-system/internal/chat	(cached)
+ok  	chat-agent-system/internal/config	(cached)
+ok  	chat-agent-system/internal/coordinator	(cached)
+ok  	chat-agent-system/internal/ctxmgr	(cached)
+ok  	chat-agent-system/internal/db	(cached)
+ok  	chat-agent-system/internal/docduty	(cached)
+ok  	chat-agent-system/internal/docgov	(cached)
+ok  	chat-agent-system/internal/docquery	(cached)
+ok  	chat-agent-system/internal/docrevision	0.006s
+ok  	chat-agent-system/internal/freedoc	(cached)
+ok  	chat-agent-system/internal/fsutil	(cached)
+ok  	chat-agent-system/internal/intent	(cached)
+ok  	chat-agent-system/internal/kb	(cached)
+ok  	chat-agent-system/internal/notification	(cached)
+?   	chat-agent-system/internal/observability	[no test files]
+ok  	chat-agent-system/internal/projectcontext	(cached)
+ok  	chat-agent-system/internal/projectinstance	(cached)
+ok  	chat-agent-system/internal/projectworkflow	(cached)
+ok  	chat-agent-system/internal/quote	(cached)
+ok  	chat-agent-system/internal/replyexport	(cached)
+ok  	chat-agent-system/internal/server	(cached)
+ok  	chat-agent-system/internal/squad	(cached)
+ok  	chat-agent-system/internal/storage	(cached)
+ok  	chat-agent-system/internal/stream	(cached)
+ok  	chat-agent-system/internal/taskrun	(cached)
+ok  	chat-agent-system/internal/template	(cached)
+ok  	chat-agent-system/internal/upload	(cached)
+?   	chat-agent-system/internal/workflow	[no test files]
+ok  	chat-agent-system/internal/workflow/runtime	(cached)
+ok  	chat-agent-system/internal/workflowdef	(cached)
+ok  	chat-agent-system/internal/workspace	(cached)
+?   	chat-agent-system/templates	[no test files]
diff --git a/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/health.json b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/health.json
new file mode 100644
index 00000000..3ac7f9f3
--- /dev/null
+++ b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/health.json
@@ -0,0 +1 @@
+{"status":"ok","env":"dev","agent_backend":"pi-agent","version":"v1.0","shared_kb_port":5432,"database_ready":true,"schema_version":33,"schema_ready":true,"task_store_ready":true}
diff --git a/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/hydrate-unit.txt b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/hydrate-unit.txt
new file mode 100644
index 00000000..d7276575
--- /dev/null
+++ b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/hydrate-unit.txt
@@ -0,0 +1,27 @@
+▶ controlledDocHydrate
+  ✔ shouldLoadControlledContent when non-template workflow doc (0.560314ms)
+  ✔ shouldLoadControlledContent rejects local legacy/mock ids like doc-001 (0.079977ms)
+  ✔ shouldLoadControlledContent keeps canonical, freeform-off, and template preview rules (0.081697ms)
+  ✔ hydrateControlledDocumentContent never requests content/revision for doc-001 (0.145305ms)
+  ✔ hydrateControlledDocumentContent never requests for template preview or registered freeform (0.078298ms)
+  ✔ shouldLoadControlledContent stays inside toolbar server-backed eligibility (0.101657ms)
+  ✔ resolveCanonicalDocId maps doc-p56-intake to doc_proj56_intake (0.176655ms)
+  ✔ canonicalDocIdForTask maps doc-p56-research to doc_proj56_research (0.088608ms)
+  ✔ hydrate treats projection missing as ledger content, not 404 (0.944302ms)
+  ✔ attaches hydrate ETag as PATCH baseline and ignores a later GET (0.468346ms)
+  ✔ rejects hydrate when revision-state network or 5xx fails (0.359089ms)
+  ✔ aligns markdownToBlockAST random ids onto revision-state head_block_map (0.647101ms)
+  ✔ leaves Math.random ids when head_block_map is omitted (why gate + fail-closed remain) (0.227144ms)
+  ✔ rejects controlled hydrate on NOT_FOUND or NEEDS_CONTENT (0.129726ms)
+  ✔ fingerprint stays stable when only object identity changes (0.060068ms)
+  ✔ dedupes in-flight hydrate for the same doc fingerprint (0.127606ms)
+  ✔ aligned late hydrate still cannot overwrite a PATCH-success baseline (0.226964ms)
+✔ controlledDocHydrate (5.36378ms)
+ℹ tests 17
+ℹ suites 1
+ℹ pass 17
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 72.177737
diff --git a/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/playwright-controlled-reload.txt b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/playwright-controlled-reload.txt
new file mode 100644
index 00000000..ae00c1e5
--- /dev/null
+++ b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/playwright-controlled-reload.txt
@@ -0,0 +1,14 @@
+
+Running 4 tests using 1 worker
+
+  ✓  1 [chromium] › e2e/controlled-document-reload.spec.ts:200:3 › controlled document reload M1 live › project 143 content is 200 with consistency; anonymous is 401; unknown is 404 (4.6s)
+  ✓  2 [chromium] › e2e/controlled-document-reload.spec.ts:266:3 › controlled document reload M1 live › non-member GET of project 143 is the same 404 as unknown (7.4s)
+  ✓  3 [chromium] › e2e/controlled-document-reload.spec.ts:310:3 › controlled document reload M1 live › new project PI compile then reload keeps ledger markdown (4.2m)
+  ✓  4 [chromium] › e2e/controlled-document-reload.spec.ts:443:3 › controlled document reload M1 live › cross-project and wrong-stage GET stay DOCUMENT_NOT_FOUND (3.8s)
+
+  4 passed (4.5m)
+npm notice
+npm notice New major version of npm available! 11.19.0 -> 12.0.2
+npm notice Changelog: https://github.com/npm/cli/releases/tag/v12.0.2
+npm notice To update run: npm install -g npm@12.0.2
+npm notice
diff --git a/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/ready.json b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/ready.json
new file mode 100644
index 00000000..3ac7f9f3
--- /dev/null
+++ b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/ready.json
@@ -0,0 +1 @@
+{"status":"ok","env":"dev","agent_backend":"pi-agent","version":"v1.0","shared_kb_port":5432,"database_ready":true,"schema_version":33,"schema_ready":true,"task_store_ready":true}
diff --git a/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/rebuild-health-ready.txt b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/rebuild-health-ready.txt
new file mode 100644
index 00000000..2182e205
--- /dev/null
+++ b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/rebuild-health-ready.txt
@@ -0,0 +1,34 @@
+=== health ===
+HTTP/1.1 200 OK
+Access-Control-Allow-Headers: Content-Type, Authorization, Accept, X-Session-Token, X-Requested-With
+Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE
+Content-Type: application/json; charset=utf-8
+Date: Mon, 14 Sep 2026 14:29:03 GMT
+Content-Length: 180
+
+
+{"status":"ok","env":"dev","agent_backend":"pi-agent","version":"v1.0","shared_kb_port":5432,"database_ready":true,"schema_version":33,"schema_ready":true,"task_store_ready":true}
+
+=== ready ===
+HTTP/1.1 200 OK
+Access-Control-Allow-Headers: Content-Type, Authorization, Accept, X-Session-Token, X-Requested-With
+Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE
+Content-Type: application/json; charset=utf-8
+Date: Mon, 14 Sep 2026 14:29:03 GMT
+Content-Length: 180
+
+
+{"status":"ok","env":"dev","agent_backend":"pi-agent","version":"v1.0","shared_kb_port":5432,"database_ready":true,"schema_version":33,"schema_ready":true,"task_store_ready":true}
+
+=== compose identity ===
+=== images ===
+app_image=sha256:251fa99d5de47d452b7f099304aa34b1e2aacf1b4e9d2d23d1cb4b850084910e created=2026-09-14T14:27:53.849178188Z status=running health=healthy
+pi_image=sha256:575eda543c653e68fbc79920d2e798def834e3734b7f27b0c8e5c80850cd5c0a created=2026-09-14T13:09:50.656750669Z status=running health=healthy
+=== env (redacted) ===
+AGENT_BACKEND=pi-agent
+ENV=dev
+HTTP_PORT=8080
+=== post-recreate pi-agent ===
+pi_image=sha256:21fc9b64066c33e94d8db83695b4ff64ea5e49f6d65661f8ccab11ead083042d created=2026-09-14T14:29:37.389718802Z health=healthy
+app_image=sha256:251fa99d5de47d452b7f099304aa34b1e2aacf1b4e9d2d23d1cb4b850084910e created=2026-09-14T14:27:53.849178188Z health=healthy
+compose_project=agent-dev schema=33 agent_backend=pi-agent FAV_DEGRADED_READ=unset
diff --git a/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/01-project-143.png b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/01-project-143.png
new file mode 100644
index 00000000..1877396e
Binary files /dev/null and b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/01-project-143.png differ
diff --git a/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/02-after-reload.png b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/02-after-reload.png
new file mode 100644
index 00000000..7723384e
Binary files /dev/null and b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/02-after-reload.png differ
diff --git a/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/03-after-relogin.png b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/03-after-relogin.png
new file mode 100644
index 00000000..6354cbd6
Binary files /dev/null and b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/03-after-relogin.png differ
diff --git a/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/04-outsider-143.png b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/04-outsider-143.png
new file mode 100644
index 00000000..c2b1ba97
Binary files /dev/null and b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/04-outsider-143.png differ
diff --git a/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/05-new-project.png b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/05-new-project.png
new file mode 100644
index 00000000..9579d6c4
Binary files /dev/null and b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/05-new-project.png differ
diff --git a/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/06-activated.png b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/06-activated.png
new file mode 100644
index 00000000..af8b6c66
Binary files /dev/null and b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/06-activated.png differ
diff --git a/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/07-new-doc.png b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/07-new-doc.png
new file mode 100644
index 00000000..2795865a
Binary files /dev/null and b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/07-new-doc.png differ
diff --git a/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/08-new-doc-reload.png b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/08-new-doc-reload.png
new file mode 100644
index 00000000..82adc619
Binary files /dev/null and b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/08-new-doc-reload.png differ
diff --git a/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/09-new-doc-relogin.png b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/09-new-doc-relogin.png
new file mode 100644
index 00000000..9cdc70c6
Binary files /dev/null and b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/09-new-doc-relogin.png differ
diff --git a/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/10-fail-closed.png b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/10-fail-closed.png
new file mode 100644
index 00000000..c236d734
Binary files /dev/null and b/.doc/test-reports/assets/2026-09-14-document-reliability-pilot-live/screenshots/10-fail-closed.png differ