The static adapter catalog still read I2-era states (degraded/shadow) after
the 2026-09-26 dev rollout, so the admin features page showed 降级 for flags
already enabled. Update six entries to live+ready with evidence-dated
reasons (I2/I3/P8 acceptance, P8 per-key gates kept visible, shadow
visibility digest now persisted, REPLACE wildcard wiring, PI narrative dev
rollout); keep FAV red lines untouched. Tests updated; FAV now carries the
configured-value-must-not-imply-readiness assertion.
docflow Commands.run takes SELECT ... FOR UPDATE on document_records inside
its unit of work before calling ApproverApprove; persistApproveAndFAV then
opened a second pool connection and its UPDATE blocked on that row lock until
statement timeout (SQLSTATE 57014), failing every final approval. Join the
ambient uow scope (doc sync + FAV staging on the caller tx, commit owned by
the uow); only open an own tx when no scope is present. Regression test
reproduces the production shape (FOR UPDATE + FAV wiring inside Within).
loadDocumentFromDBLocked selected every column except review_snapshot_id,
so any document loaded after a restart or cache miss lost its frozen review
snapshot and ApproverApprove failed with "approved requires frozen
review_snapshot_id". PG regression test seeds a snapshot and asserts a
fresh engine carries the id through load.
Runtime verification found the deterministic generator merges the prior
served narrative, so a replaced (semantic) narrative would linger after
rollback. Store the displaced deterministic narrative in the shadow report
(persisted via shadow_json) and merge that instead when the prior summary
source is semantic_replace.
Unseal SEMANTIC_SUMMARY_REPLACE under explicit user authorization with a
defense-in-depth session allowlist (SEMANTIC_SUMMARY_REPLACE_SESSIONS):
swap happens only for allowlisted sessions after result digests and served
watermark validation, bounded narrative size; facts/counts stay deterministic
and the daily digest stays advisory. Master flag alone replaces nothing.
Capture trigger_user HITL expectations from dialogue adjudication (previously
dropped at the bizdev call site), project them as chat confirmation cards via
taskrun OnTerminal (exactly-once), arm the session PendingExpectation, and
handle confirm_context_fact hits through the supplement-info blackboard path.
Decline (纠正) guides the user to state the correct fact.
Wire intent→coordinator DocResolver confirm cards→action_executor kinds for comment, reopen, pending-supplements query, and real submit-review execution.
- 5 independent flags (MULTI_INTENT_U11_LIVE_REVIEW/FINAL/PROPOSAL, U12_LIVE_SWITCH/RESTART), default OFF; no full rollout
- DocGovLiveActionKeys/RunControlLiveActionKeys become flag-driven functions; baseline keys unchanged
- DocGovOwner routes review.approve/reject, final.approve/reject, proposal.decide to real engine with slot-driven reason/approve parsing and idempotent receipts
- RunControlOwner routes workflow.switch -> ActivateWorkflow and run.restart -> fresh CreateAndStart run
- policy: 7 keys promoted from TierFull to TierConfirm (real execution still gated per-key)
- tests: default-off isolation, per-key independence, live state advance reviewing->approving, dry-run zero-advance when flag off
Memory CAS iterated memoryRefs map (random order) while PG path uses
ORDER BY id ASC; asset dedup-hint 'first reference unflagged' logic
depends on stable order. Flaky TestUploadProjectAsset_DedupHint
reproduced 2/20 rounds before fix, green 30/30 after.
- Server no longer mirrors app.Runtime services (gov/svc/pwSvc/...): 574 call sites now use accessors in runtime_accessors.go
- backgroundLoop (mutex+sync.Once) stops sweeper/publisher/reminder/wsGC goroutines race-free (baseline 44161d2a reproduced DATA RACE; now green under -race)
- goose 00071 duplicate (dialogue merge 1da17a28 brought two 00071): context-conflict-adjudications renumbered to 00072; dev DB applied only through 00070 so zero data migration
- task_finalize tests build minimal app.Runtime; test injection via serverTestOverrides + setOverride* (explicit-nil markers for fail-closed cases)
Embed web/dist, run events in-process, manage brew PG18+pgvector, add PI host sidecar and launch --no-docker; unify MiniMax-M2.7-highspeed pins and record dev acceptance.
Open member free-lane for chat initiation; auto-claim on author view;
harden lease persist/ownership with readable DOC_BUSY; add notification
inbox and supplement-impact HTTP decision APIs wired to composition root.
Add notification digests with ON CONFLICT DO UPDATE, migrations 00068-00070,
supplementimpact module (analyze → confirm → claim-aware split), and wire
coordinator/mutate hooks plus proposal_required digests.
Implement T20-F4-B reset-password endpoint with one-time temp password,
audit table, frontend wiring, login error envelope parsing, and
CreateUser fail-closed for empty password hashes. Recovered test chenwei
via env write (password out of band).
Payload-sha-only UUIDs collided under artifact_payload_staging_pkey when
two task runs finalized identical deliverable bytes. Key already includes
source_event_id; hash it for stable unique art-/stg- ids.
weichen