Opening a template stored database IDs without advancing nextSnapID, so the next temporary snapshot could overwrite and then delete the real baseline. Adopt helpers now bump every counter and only drop a map entry when it still points at the same object.
Co-authored-by: Cursor <cursoragent@cursor.com>
When a candidate is already committed, matching expected hashes return the
current revision state so projection and MarkProposalApplied can finish;
reject on an already-committed candidate stays an error.
Co-authored-by: Cursor <cursoragent@cursor.com>
Materialize needs_confirmation restores ledger head to output.md and
document_records hash; only committed heads update DocGov. Decision
handler projects after commit or reject. Stage gates DocGov proposals
via PendingProposal, not bare RequiresAuthorApproval.
Co-authored-by: Cursor <cursoragent@cursor.com>
Surface pending_candidate_id, report id, and risk so NeedsConfirmation
candidates are discoverable before they enter the version list.
Co-authored-by: Cursor <cursoragent@cursor.com>
TaskRunResult now fails visibly when ledger/report materialization errors;
invalid or unassessed reports are never auto-committed.
Co-authored-by: Cursor <cursoragent@cursor.com>
Open an explicit empty baseline then create a deterministic candidate/report
so the first squad success is visible as fallback analysis, not OpenTemplate-only.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stage generation without a real document must not panic or enter the ledger.
Unknown orphan IDs are denied, write paths check author/lease/lifecycle, PATCH
no longer returns a fake 200, and overlay matching survives client/server block id drift.
Co-authored-by: Cursor <cursoragent@cursor.com>
