Gate run 2857 on 36a73761 ran 3,762 tests with one failure, the report
snapshot database test, so it is the last thing between staging and a deploy.
The brief told the executor to move the shared psql and psqlAs helpers to
stdin. That instruction is withdrawn. The two helpers serve 522 calls across
29 test files, and psql -c runs a multi-statement string as one implicit
transaction. selectAsAuthenticated relies on that: it sets the JWT subject
with set_config(..., true), which lasts only for the current transaction.
Statement-at-a-time execution would run every later RLS query with no user
set, so those tests would stop testing what they claim to test. Five other
files also write their own begin, commit or rollback.
The brief now asks for a separate single-transaction stdin helper with an
explicit maxBuffer, used only by the snapshot test, with a test proving a
transaction-local set_config stays visible. It also says that if the snapshot
test then fails a real assertion, that is a product defect to report, not an
assertion to relax.
Privacy scan on this tree before push: zero findings.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017eEAG8HD3mm8gsKXgk8uU8
Record Gitea run 2857 evidence: H1-H3 pass, BUG-1011 remains the sole E2BIG failure, publish skipped, and staging is not deployed. Mark BUG-1012 through BUG-1014 resolved at the code-contract level while retaining the deployment blocker.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Merge entry overflow rules into the existing 480px breakpoint, restore picker focus without scrolling, and sync composer and entry contracts without changing page logic. Add AST generation-state guard and both picker close-path regressions.
Validation: targeted 33/33; Chrome isolated components 145 checks; tsc and lint zero errors. Node22 full suite 3706 tests, no lost names or new failures; three target failures fixed, 88 baseline environment/contract failures unchanged. Windows build remains blocked by symlink EPERM. Changed-file privacy check: 11 files, no findings, not a full-repository pass. BUG-1011 remains separate.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Acceptance of a12f2c0d against TASK-report-density-fix-20260923: F1 to F6
all pass. On the fixture the fact tables are 130 rows across 600 visible
cells with no engine key, no array index and no long decimal, and every
sourcePath resolves back into the packet. The first major period reads 18
years. Python and TS appendix cleaning are byte-identical. Removing the
writer table guard turns four of its six tests red. Under Node 22 the
frontend goes from 3,730 tests / 26 failing to 3,748 / 26 with an identical
list; the Python quick gate goes from 946 passed / 1 failed to 948 / 0.
One thing still fails: the database test for the report snapshot passes a
428,557-byte SQL string to psql as a single argument, past Linux's 131,072
byte limit, so it dies with E2BIG before reaching Postgres. The snapshot row
has never run against a real database. Recorded as BUG-1011 with a fix brief.
The real-person checklist the executor's tool refused to write is added here.
Privacy scan on this tree before push: zero findings.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017eEAG8HD3mm8gsKXgk8uU8
Unify reader cleanup rules, lock writer table guards, and register the exact fictional timestamp collision. Preserve existing ordinary-report safety contracts and source-data gaps.
Validation: report Node 165/165, final safety 29/29, Python 101/101, Chrome 28/28; both PDFs retain all 130 rows. Full Node 3704 tests with the same 91 baseline failures. Privacy test: 62 passed, 1 failed due to 17 protected-file READ_ERRORs; not a green gate. Build, DB, manual checklist and controlled-login gaps remain documented. User explicitly authorized staging push with these gaps disclosed.
Co-Authored-By: Claude Code <noreply@anthropic.com>
The product owner chose to remove the leaked birth data from staging history.
The three commits after f77a1b5a were rebuilt with their original authors,
dates and messages, changing only the brief to its cleaned text: baeec66f,
f968cb21 and fcca56fe became a7f82dc2, bbd96d3b and abf28321. The new head's
tree is byte-identical to the old one and the leaked blob is absent from the
new history.
The old commits are still served anonymously by their SHA until the Gitea
server garbage-collects, so BUG-1008 stays mitigated rather than resolved.
Privacy scan on this tree before push: one finding, the fixture collision.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017eEAG8HD3mm8gsKXgk8uU8
Acceptance of f968cb21 against TASK-report-density-20260922. Tasks 1, 2, 4
and 5 pass; task 3 does not. Under Node 22, the gate's version, the frontend
suite goes from 3,698 tests / 26 failing to 3,730 / 26 with an identical
failure list; / stays static and first-load gzip moves by 0.007%.
Task 3 renders the ordinary report's fact tables as 948 key/value rows whose
labels are engine paths: 447 carry snake_case keys and 521 carry array
indices, down to a Julian day. The brief never specified columns, so the fix
brief does.
The quick gate's new failure is the privacy scan, and two thirds of it is
mine: the brief pushed in baeec66f carried the comparison chart's real birth
date, time and coordinates. They are removed here and recorded as BUG-1008.
The copy in baeec66f's history stays until the product owner decides whether
to rewrite staging. The remaining hit is a five-character collision inside an
engine timestamp of the fictional fixture, reproduced by regenerating from its
declared fictional input.
Privacy scan on this tree before push: one finding, the fixture collision.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017eEAG8HD3mm8gsKXgk8uU8
Selected and hover fill stay on the whole row. The title and ⋯ no longer draw their own canvas or radius, so they stop looking like two controls (BUG-993, recurrence of BUG-024).
Flip archive tokens to must-not-appear on the session row and session hook only. Keep writeChatSession POST/PATCH and assert delete still uses DELETE. Grep tests/ before deleting frontend symbols.
Remove archive/restore from the session menu and drop archived=1 listing. PATCH still accepts archived_at from old bundles then ignores it. A forward migration clears archived_at without bumping updated_at. Delete stays unchanged.
Local Postgres not() only handled eq/cs, so archived=1 threw and the sidebar archive view returned 500. Compile is not null/true/false instead of inequality.
Empty-consultation filtering is now session_type scoped so birth-time rows stay in the sidebar. Subtitles use updatedAt with sort/group/cursor. New chats stay local until the first send.
Gitea run 2828 validated, then publish hit the 60-minute deadline while
Aliyun apt/pip crawled at about 22 kB/s after a 72h cache prune on a
runner with 677 GiB free. Skip BuildKit prune when disk is above the
minimum, split API apt/pip layers, and point apt/pypi at Huawei Cloud.
Carry explicit local date intervals instead of inferring the day from clock
order. Cluster width, delivery, adoption, and reports keep the actual civil
date; adopted date is stored separately from the reported birth_date.
Algorithm identity is scoring-9 / spec-v5. Scoring weights, confirmation
thresholds, and Skill version are unchanged. Isolated Linux final-3 gates
passed; four pre-existing Python failures remain. This is not a production
release.
Unify minute and block cache identity, keep unverifiable historical results read-only across server tools and write entrypoints, and aggregate completed receipt sources chronologically through a compatible function migration.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Implement BUG-984 F2 option A and reproduce mixed completed identities through real tools. Stop at the required SQL authorization boundary; F1/F3/F4 remain pending.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Resolve BUG-985 using independent third-environment review recorded in 0ca3871d. Retain staging's complete BUG-984 task and approved read-only policy.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Replace machine-specific float hashes with strict score and matrix byte comparisons. Keep quick bridge coverage and document duplicate collection. Verify Windows/Linux float behavior and in-memory candidate-date reversal; record the separate-machine acceptance gap and BUG-984 end-to-end blocker.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Preserve both the reviewed implementation and latest staging records. No production scoring changes beyond aa46da10.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Add date-isolated caches and regression coverage, align scoring identity, and freeze full research reruns while preserving historical artifacts. Record unresolved cache/receipt identity and end-to-end acceptance gaps for branch review only.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Keep full consultation tool contracts unchanged. Persist short replies and refund the original reservation atomically while recording actual model usage. Verify Linux frontend 3566/3566, database 40/40, Static home and gzip +0.0493%.
Co-Authored-By: Claude Code <noreply@anthropic.com>
The staging gate failed on READ_ERROR .venv after a docs commit tracked a
symlink that gitignore .venv/ does not ignore. CI replaces that path with a
real venv directory. Drop the symlink, ignore the name itself, and lock it
in the privacy scan. Also point the Beam avatar source contract at the
current profile-panel copy so npm test stops failing after Python.
Separate shell subscriptions from Home session data and cover effect convergence, transition cleanup, current callbacks and signed-out fallback with real React lifecycle tests. Record baseline-equivalent local failures and outstanding browser/build verification.
Co-Authored-By: Claude Code <noreply@anthropic.com>
