Live apply now accepts only :5433/agent_system_dev plus a data/dev
host root, maps stored work dirs fail-closed, and reports unique
O_EXCL backups after a parent-directory fsync.
Co-authored-by: Cursor <cursoragent@cursor.com>
Apply now writes the destructive old head markdown beside the original
file, refuses to clobber existing backups, and fsyncs the parent
directory after the atomic persist.
Co-authored-by: Cursor <cursoragent@cursor.com>
W7 must live-apply project 143 before UI acceptance. Isolated
TEST_DATABASE_URL was unavailable; shared env databases were not used.
Co-authored-by: Cursor <cursoragent@cursor.com>
Default still refuses shared DSN/paths. Apply to dev requires --live,
--environment dev, a single --doc-id, and confirm REPAIR_SINGLE_DEV_DOC.
Co-authored-by: Cursor <cursoragent@cursor.com>
migration_repair is not a human revision. HashUpdater now loads from DB
and retries still sync. Content reads return a structured drift conflict
instead of the destructive old head.
Co-authored-by: Cursor <cursoragent@cursor.com>
00028 check constraints would reject a real PG apply. Add goose 00032
with Up/Down so repair snapshots can persist.
Co-authored-by: Cursor <cursoragent@cursor.com>
Move done DOCREV short-terms, checklists, and handoffs into archive/ops and retarget relative links after Round20 close-out.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record top-level screenshots as 20 main/pre plus 1 post, and the full-package race as FAIL 109.279s instead of a cached ok line.
Co-authored-by: Cursor <cursoragent@cursor.com>
Rename the close-out branch to feature/*, record 20 screenshots, and state rebuild-then-app-restart so the environment notes match Round20.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the official Playwright headless pass for project 6159 and release the runtime integration slot without claiming the whole system production-ready.
Co-authored-by: Cursor <cursoragent@cursor.com>
The 6158 field ledger wrote candidate id=175 and report id=175; 250 is the output snapshot, not the candidate.
Co-authored-by: Cursor <cursoragent@cursor.com>
Claim the document-revision mutex and document the 6158 first-generation not-found root cause without calling UI-03 done.
Co-authored-by: Cursor <cursoragent@cursor.com>
Opening a template stored database IDs without advancing nextSnapID, so the next temporary snapshot could overwrite and then delete the real baseline. Adopt helpers now bump every counter and only drop a map entry when it still points at the same object.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record that the second restart already restored V3/r2 and that only the stale UI-06 bodySnippet expectation was wrong.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-13b already made A1 the durable document, but phase-state still expected the UI-06 marker. Record successful saves as the latest snippet, ignore conflict drafts, and write that final value at UI-15-pre without relaxing the restore assertion.
Co-authored-by: Cursor <cursoragent@cursor.com>
Document that main keeps ui-acceptance-results.json and post-restart writes a sibling ledger so the 18-case main book is not overwritten.
Co-authored-by: Cursor <cursoragent@cursor.com>
A successful post-restart recordPass would overwrite the main 18-case ui-acceptance-results.json. Keep that historical name for main and write ui-acceptance-results-post-restart.json after restart, while still sharing phase-state and secrets.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the schema31 strict-mode failure, the banner/entry locator contract, and phase-split Playwright directories. Do not mark UI-15 passed.
Co-authored-by: Cursor <cursoragent@cursor.com>
Page-wide project-name text hits both the top bar and the session rail after restart. Click the complementary exact title, then assert the banner exact name. Split Playwright output and HTML reports by UI_PHASE so post-restart cannot wipe main traces.
Co-authored-by: Cursor <cursoragent@cursor.com>
Note that HealProjectDocuments now shares pg_advisory_xact_lock(project_id) with member writes so an old reviewer cannot be written back.
Co-authored-by: Cursor <cursoragent@cursor.com>
Heal used to resolve and backfill on the pool without the member-write advisory lock, so a stale snapshot of reviewer A could overwrite a committed transfer to B. Lock, resolve, and document updates now share one transaction and the same lock key.
Co-authored-by: Cursor <cursoragent@cursor.com>
Document that lock, holder reads, member writes, and reviewer/approver slot clears share one transaction, with heal after commit.
Co-authored-by: Cursor <cursoragent@cursor.com>
Duty revoke must share the project advisory lock with reading old holders and writing members, so a post-commit service snapshot cannot miss a transfer. Heal still fills the new holder after commit, and sync failure stays ERR_DUTY_SYNC.
Co-authored-by: Cursor <cursoragent@cursor.com>
Sync short-term, checklist, and handoff with remaining 6145 risk and
the isolated PG verification path.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove now reconciles document slots and returns ERR_DUTY_SYNC on
failure. CreateOrGetDocument errors abort the task. The frontend
refreshes workflow docs after add, update, restore, and remove.
Co-authored-by: Cursor <cursoragent@cursor.com>
Empty assigned heal now clears only exited or non-member reviewer/approver
holders and never blanks author. Explicit reconcile uses the pre-update
duty plus a project advisory lock so viewer demotion and transfers are
not left to generic heal.
Co-authored-by: Cursor <cursoragent@cursor.com>
Require TEST_DATABASE_URL and refuse agent_system_dev. Script creates a
throwaway database, runs packages serially, then drops it.
Co-authored-by: Cursor <cursoragent@cursor.com>
Post-create role changes were silently dropping reviewer/approver
because only project_role was persisted.
Co-authored-by: Cursor <cursoragent@cursor.com>
Omit project_role no longer defaults to member. Exclusive duty writes
take an advisory lock and retry conflicts so last-writer wins without
dual reviewers. Author write tests require err==nil.
Co-authored-by: Cursor <cursoragent@cursor.com>
Align document slots to project document_duty even when the wrong ID is
an active member, and fail generate/list instead of returning stale
placeholder duties. Owner author backfill now picks creator, else lowest ID.
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen