Hard refresh wiped cache/ready after a successful hydrate, then the
unchanged fingerprint never re-ran the effect. Invalidate only via a
planner that preserves list-sync hits and re-hydrates after post-task drops.
Co-authored-by: Cursor <cursoragent@cursor.com>
Login-seeded doc-001 is not server-backed; align shouldLoad with
revisionToolbarMountMode so content and revision-state are never requested.
Co-authored-by: Cursor <cursoragent@cursor.com>
Live apply now accepts only :5433/agent_system_dev plus a data/dev
host root, maps stored work dirs fail-closed, and reports unique
O_EXCL backups after a parent-directory fsync.
Co-authored-by: Cursor <cursoragent@cursor.com>
Apply now writes the destructive old head markdown beside the original
file, refuses to clobber existing backups, and fsyncs the parent
directory after the atomic persist.
Co-authored-by: Cursor <cursoragent@cursor.com>
W7 must live-apply project 143 before UI acceptance. Isolated
TEST_DATABASE_URL was unavailable; shared env databases were not used.
Co-authored-by: Cursor <cursoragent@cursor.com>
Default still refuses shared DSN/paths. Apply to dev requires --live,
--environment dev, a single --doc-id, and confirm REPAIR_SINGLE_DEV_DOC.
Co-authored-by: Cursor <cursoragent@cursor.com>
migration_repair is not a human revision. HashUpdater now loads from DB
and retries still sync. Content reads return a structured drift conflict
instead of the destructive old head.
Co-authored-by: Cursor <cursoragent@cursor.com>
00028 check constraints would reject a real PG apply. Add goose 00032
with Up/Down so repair snapshots can persist.
Co-authored-by: Cursor <cursoragent@cursor.com>
Move done DOCREV short-terms, checklists, and handoffs into archive/ops and retarget relative links after Round20 close-out.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record top-level screenshots as 20 main/pre plus 1 post, and the full-package race as FAIL 109.279s instead of a cached ok line.
Co-authored-by: Cursor <cursoragent@cursor.com>
Rename the close-out branch to feature/*, record 20 screenshots, and state rebuild-then-app-restart so the environment notes match Round20.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the official Playwright headless pass for project 6159 and release the runtime integration slot without claiming the whole system production-ready.
Co-authored-by: Cursor <cursoragent@cursor.com>
The 6158 field ledger wrote candidate id=175 and report id=175; 250 is the output snapshot, not the candidate.
Co-authored-by: Cursor <cursoragent@cursor.com>
Claim the document-revision mutex and document the 6158 first-generation not-found root cause without calling UI-03 done.
Co-authored-by: Cursor <cursoragent@cursor.com>
Opening a template stored database IDs without advancing nextSnapID, so the next temporary snapshot could overwrite and then delete the real baseline. Adopt helpers now bump every counter and only drop a map entry when it still points at the same object.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record that the second restart already restored V3/r2 and that only the stale UI-06 bodySnippet expectation was wrong.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-13b already made A1 the durable document, but phase-state still expected the UI-06 marker. Record successful saves as the latest snippet, ignore conflict drafts, and write that final value at UI-15-pre without relaxing the restore assertion.
Co-authored-by: Cursor <cursoragent@cursor.com>
Document that main keeps ui-acceptance-results.json and post-restart writes a sibling ledger so the 18-case main book is not overwritten.
Co-authored-by: Cursor <cursoragent@cursor.com>
A successful post-restart recordPass would overwrite the main 18-case ui-acceptance-results.json. Keep that historical name for main and write ui-acceptance-results-post-restart.json after restart, while still sharing phase-state and secrets.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the schema31 strict-mode failure, the banner/entry locator contract, and phase-split Playwright directories. Do not mark UI-15 passed.
Co-authored-by: Cursor <cursoragent@cursor.com>
Page-wide project-name text hits both the top bar and the session rail after restart. Click the complementary exact title, then assert the banner exact name. Split Playwright output and HTML reports by UI_PHASE so post-restart cannot wipe main traces.
Co-authored-by: Cursor <cursoragent@cursor.com>
Note that HealProjectDocuments now shares pg_advisory_xact_lock(project_id) with member writes so an old reviewer cannot be written back.
Co-authored-by: Cursor <cursoragent@cursor.com>
Heal used to resolve and backfill on the pool without the member-write advisory lock, so a stale snapshot of reviewer A could overwrite a committed transfer to B. Lock, resolve, and document updates now share one transaction and the same lock key.
Co-authored-by: Cursor <cursoragent@cursor.com>
Document that lock, holder reads, member writes, and reviewer/approver slot clears share one transaction, with heal after commit.
Co-authored-by: Cursor <cursoragent@cursor.com>
Duty revoke must share the project advisory lock with reading old holders and writing members, so a post-commit service snapshot cannot miss a transfer. Heal still fills the new holder after commit, and sync failure stays ERR_DUTY_SYNC.
Co-authored-by: Cursor <cursoragent@cursor.com>
Sync short-term, checklist, and handoff with remaining 6145 risk and
the isolated PG verification path.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove now reconciles document slots and returns ERR_DUTY_SYNC on
failure. CreateOrGetDocument errors abort the task. The frontend
refreshes workflow docs after add, update, restore, and remove.
Co-authored-by: Cursor <cursoragent@cursor.com>
Empty assigned heal now clears only exited or non-member reviewer/approver
holders and never blanks author. Explicit reconcile uses the pre-update
duty plus a project advisory lock so viewer demotion and transfers are
not left to generic heal.
Co-authored-by: Cursor <cursoragent@cursor.com>
Require TEST_DATABASE_URL and refuse agent_system_dev. Script creates a
throwaway database, runs packages serially, then drops it.
Co-authored-by: Cursor <cursoragent@cursor.com>
Post-create role changes were silently dropping reviewer/approver
because only project_role was persisted.
Co-authored-by: Cursor <cursoragent@cursor.com>
Omit project_role no longer defaults to member. Exclusive duty writes
take an advisory lock and retry conflicts so last-writer wins without
dual reviewers. Author write tests require err==nil.
Co-authored-by: Cursor <cursoragent@cursor.com>
Align document slots to project document_duty even when the wrong ID is
an active member, and fail generate/list instead of returning stale
placeholder duties. Owner author backfill now picks creator, else lowest ID.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep project_role as member/viewer, send document_duty=reviewer for USER_B, and clear the seed 李主管 reviewer so the assigned reviewer is the one that syncs.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stop inventing reviewer_id=2. Use project document_duty as the authority, heal missing or non-member placeholders, and keep write paths rejected for reviewer and outsiders.
Co-authored-by: Cursor <cursoragent@cursor.com>
Project access roles cannot carry reviewer. Persist a separate exclusive document_duty so later controlled docs can inherit the assigned reviewer.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-13a now proves USER_B is viewer despite UI-01 assigning reviewer; claim a new mutex and document the 6145 ledger gap.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-13a reviewer contract now has 6 unit cases; keep the short-term note aligned without rewriting the already-reviewed fix commit.
Co-authored-by: Cursor <cursoragent@cursor.com>
USER_B is assigned reviewer in UI-01. Accept only role=reviewer on
the duty control, and reject assignable or enabled selects.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-13a treated concatenated select options as the current role.
Assert the control value or badge role for that doc instead.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-13a stayed on private after upload, so the doc menu had no
doc_proj* entries. Always use the category trigger first, then exact id.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-11 can finish before the waiter sees pending. Treat success terminals
as done, keep upload/correspondence/error checks, and cover both timelines.
Co-authored-by: Cursor <cursoragent@cursor.com>
Promote root output.md only when the runner succeeded, protected parents
were untouched, and the local target is trusted. Restore errors abort
instead of being ignored.
Co-authored-by: Cursor <cursoragent@cursor.com>
Repair TASK.md told the model to edit ../../output.md, so the local
target never appeared and UI-03 stayed quality_failed. Snapshot parent
inputs locally, restore them on containment violations, and promote
only a trusted repair/output.md before revalidate.
Co-authored-by: Cursor <cursoragent@cursor.com>
Drop test-only ETag helpers. App now calls saveControlledBlockEdit,
which PATCHes once on the bound editor docId or fail-closes. Resume
hydrate after a blocked first load, and refuse silent doc switches.
Co-authored-by: Cursor <cursoragent@cursor.com>
Background GET rebuilt markdown AST with Math.random ids and dropped
head_block_map, so save closed the modal without PATCH. Align hydrate
to the ledger map, gate in-flight responses, and fail-closed on stale ids.
Co-authored-by: Cursor <cursoragent@cursor.com>
runner.mjs imports ./settle-policy.mjs but the Dockerfile only copied
runner.mjs, which crashed shuimu-pi-agent-dev on import. COPY the
runtime module and assert every relative import is in the image set.
Co-authored-by: Cursor <cursoragent@cursor.com>
auto_retry_end success=true now drops providerTransient and lastErr so
a later agent_settled can succeed when the in-process retry landed a
real target. A new error after recovery still fails.
Co-authored-by: Cursor <cursoragent@cursor.com>
A this-invocation output.md is preserved and never retried over, but
Success=false stays a step failure so truncated writes cannot pass.
Prior-round residue without a trusted patch is also not success.
Co-authored-by: Cursor <cursoragent@cursor.com>
Fresh step invocation is limited to provider terminated/connection plus
a missing target, or an explicit runner failure. A deliverable already
on disk is accepted and never overwritten.
Co-authored-by: Cursor <cursoragent@cursor.com>
*.md was excluding templates/docs from Docker context, so COPY and
go:embed could not see prelim_design.md at /app. Un-ignore those trees
and assert the smoke image can cat the official file.
Co-authored-by: Cursor <cursoragent@cursor.com>
Separate MiniMax/SDK connection failures from the product gap that
reported process 0 and agent_settled as step success.
Co-authored-by: Cursor <cursoragent@cursor.com>
agent_settled after terminated or auto_retry_end success=false is not a
deliverable. Return retryable for provider transients and keep clean
missing targets permanent.
Co-authored-by: Cursor <cursoragent@cursor.com>
runOneStep re-executes the backend at most once when the first attempt
is a settled failure or missing target after provider errors, records
each attempt honestly, and fail-closes after the bound.
Co-authored-by: Cursor <cursoragent@cursor.com>
Treat process-0 plus terminated/Connection error/auto_retry_end as a
provider transient. Permanent missing deliverables stay fail-closed and
are never reconstructed from truncated write arguments.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the missing-output.md failure, embed/path-mapping tradeoffs, and CURRENT mutex without marking the task done.
Co-authored-by: Cursor <cursoragent@cursor.com>
agent_settled after exhausted retries is not success; missing or empty target files must return ok:false instead of an empty patch list.
Co-authored-by: Cursor <cursoragent@cursor.com>
Normalize absolute, ./, and duplicated step prefixes onto output.md, and fail closed when the runner reports ok without a non-empty deliverable.
Co-authored-by: Cursor <cursoragent@cursor.com>
App images have no templates/ checkout, so GetDocTemplate fell back to a two-section stub and prelim_design lost its real contract.
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen