Write applied status to Postgres before mutating memory so a failed UPDATE
cannot leave a false in-memory applied state; treat already-applied as
idempotent success and expose PutChangeProposal for compensation seeding.
Co-authored-by: Cursor <cursoragent@cursor.com>
History refresh now preserves awaiting-author status and shows a visible
待编制人确认 label; live done path reads run terminal status before paint.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stage chain now stops on high-risk candidates; full-link mirrors the
product path of confirm + re-run until success or DocGov proposal intercept.
Co-authored-by: Cursor <cursoragent@cursor.com>
PendingAgentCandidateID must not continue the stage loop or inject
unconfirmed MarkdownBody/ExtractedData as PriorDoc. Return explicit
awaiting-confirmation status; user re-runs the stage after deciding.
Co-authored-by: Cursor <cursoragent@cursor.com>
Sync coordinator and async CompletionSummary use pending_author_confirmation
with artifact metadata for document entry; completed only after commit.
Co-authored-by: Cursor <cursoragent@cursor.com>
Materialize needs_confirmation restores ledger head to output.md and
document_records hash; only committed heads update DocGov. Decision
handler projects after commit or reject. Stage gates DocGov proposals
via PendingProposal, not bare RequiresAuthorApproval.
Co-authored-by: Cursor <cursoragent@cursor.com>
Prefer pending reports on the toolbar, show risk items and impacts, and
call the decision API only when can_decide_pending is true.
Co-authored-by: Cursor <cursoragent@cursor.com>
Surface pending_candidate_id, report id, and risk so NeedsConfirmation
candidates are discoverable before they enter the version list.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unauthorized actors no longer grab leases; controlled PATCH projects through
DocGov so author_last_edited and audit survive, with idempotent retry on failure.
Co-authored-by: Cursor <cursoragent@cursor.com>
TaskRunResult now fails visibly when ledger/report materialization errors;
invalid or unassessed reports are never auto-committed.
Co-authored-by: Cursor <cursoragent@cursor.com>
Expand the headless UI checklist and record remaining real blockers without
claiming PI narrative or E2E completion.
Co-authored-by: Cursor <cursoragent@cursor.com>
Bump revisionRefreshKey on save/hydrate so r and overlay reload; add a
latest change-report button wired to version change_report_id.
Co-authored-by: Cursor <cursoragent@cursor.com>
Open an explicit empty baseline then create a deterministic candidate/report
so the first squad success is visible as fallback analysis, not OpenTemplate-only.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stage generation without a real document must not panic or enter the ledger.
Unknown orphan IDs are denied, write paths check author/lease/lifecycle, PATCH
no longer returns a fake 200, and overlay matching survives client/server block id drift.
Co-authored-by: Cursor <cursoragent@cursor.com>
Separate browser-only real acceptance from engineering unit/build gates and record gate evidence on the short-term task.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stop skipping freeform PATCH saves and decorate BlockRenderer for pure/manual/all revision views with clear empty states.
Co-authored-by: Cursor <cursoragent@cursor.com>
Resolve controlled/freeform/orphan docs, bootstrap on GET, write output.md or freeform content on PATCH, and wire lineage impacts for agent candidates.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record in-memory ledger root cause, PG persistence plan, and CURRENT mutex claim on fix/document-revision-runtime.
Co-authored-by: Cursor <cursoragent@cursor.com>
Accept DOCREV decision gates, archive design short-term, and mark
FEATURE-MATRIX partial as implementation starts on feature branch.
Co-authored-by: Cursor <cursoragent@cursor.com>
