Add bounded chart loading, per-layer retry states, and shared SVG skeletons. Add report block downloads with SVG, localized metadata, and inline deletion.
Record verification and retain CRLF export, full-build, and controlled-device acceptance blockers. User authorized staging delivery with these gaps documented.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Create a fresh local consultation for explicit new-chat navigation and keep reserved recovery from taking over its landing. Add regression tests and record validation gaps for remote review.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Gate run 2857 on 36a73761 ran 3,762 tests with one failure, the report
snapshot database test, so it is the last thing between staging and a deploy.
The brief told the executor to move the shared psql and psqlAs helpers to
stdin. That instruction is withdrawn. The two helpers serve 522 calls across
29 test files, and psql -c runs a multi-statement string as one implicit
transaction. selectAsAuthenticated relies on that: it sets the JWT subject
with set_config(..., true), which lasts only for the current transaction.
Statement-at-a-time execution would run every later RLS query with no user
set, so those tests would stop testing what they claim to test. Five other
files also write their own begin, commit or rollback.
The brief now asks for a separate single-transaction stdin helper with an
explicit maxBuffer, used only by the snapshot test, with a test proving a
transaction-local set_config stays visible. It also says that if the snapshot
test then fails a real assertion, that is a product defect to report, not an
assertion to relax.
Privacy scan on this tree before push: zero findings.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017eEAG8HD3mm8gsKXgk8uU8
Preserve the parallel staging acceptance documentation while retaining the verified run 2857 failure evidence and deployment blocker.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Record Gitea run 2857 evidence: H1-H3 pass, BUG-1011 remains the sole E2BIG failure, publish skipped, and staging is not deployed. Mark BUG-1012 through BUG-1014 resolved at the code-contract level while retaining the deployment blocker.
Co-Authored-By: Claude Code <noreply@anthropic.com>
36a73761 fixes exactly the three failures the brief named and adds none:
under Node 22 the frontend goes from 3,748 tests / 26 failing to 3,750 / 23,
and the three that turned green are the breakpoint allowlist, the chat panel
scroll guard and the composer queue contract. Putting isLoading back into
inputDisabled turns the new AST assertion red on its own. The build keeps /
static, first-load gzip moves by 0.001%, and no 375px rule reaches the CSS.
The executor's reading of the real gate log before the fix shows run 2856
failed on exactly four tests, these three and the BUG-1011 database test, so
BUG-1011 is expected to be all that keeps run 2857 red. That still needs the
log to confirm.
Privacy scan on this tree before push: zero findings.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017eEAG8HD3mm8gsKXgk8uU8
Merge entry overflow rules into the existing 480px breakpoint, restore picker focus without scrolling, and sync composer and entry contracts without changing page logic. Add AST generation-state guard and both picker close-path regressions.
Validation: targeted 33/33; Chrome isolated components 145 checks; tsc and lint zero errors. Node22 full suite 3706 tests, no lost names or new failures; three target failures fixed, 88 baseline environment/contract failures unchanged. Windows build remains blocked by symlink EPERM. Changed-file privacy check: 11 files, no findings, not a full-repository pass. BUG-1011 remains separate.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Staging has not deployed since 1bc6a954. Rerunning the shared frontend
failures under Node 22 splits them in two. Three are real, and each passes on
its parent commit and fails from the commit that introduced it: 45ec4617 adds
a 375px breakpoint outside the allowlist, and 2a3013f2 adds two focus() calls
without preventScroll inside the chat panel and changes inputDisabled without
updating the composer's source contract. The rest fail here only because this
machine has no Docker or rsync; the gate has both, so the executor must read
the gate log rather than infer from local runs.
Privacy scan on this tree before push: zero findings.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017eEAG8HD3mm8gsKXgk8uU8
Acceptance of a12f2c0d against TASK-report-density-fix-20260923: F1 to F6
all pass. On the fixture the fact tables are 130 rows across 600 visible
cells with no engine key, no array index and no long decimal, and every
sourcePath resolves back into the packet. The first major period reads 18
years. Python and TS appendix cleaning are byte-identical. Removing the
writer table guard turns four of its six tests red. Under Node 22 the
frontend goes from 3,730 tests / 26 failing to 3,748 / 26 with an identical
list; the Python quick gate goes from 946 passed / 1 failed to 948 / 0.
One thing still fails: the database test for the report snapshot passes a
428,557-byte SQL string to psql as a single argument, past Linux's 131,072
byte limit, so it dies with E2BIG before reaching Postgres. The snapshot row
has never run against a real database. Recorded as BUG-1011 with a fix brief.
The real-person checklist the executor's tool refused to write is added here.
Privacy scan on this tree before push: zero findings.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017eEAG8HD3mm8gsKXgk8uU8
Unify reader cleanup rules, lock writer table guards, and register the exact fictional timestamp collision. Preserve existing ordinary-report safety contracts and source-data gaps.
Validation: report Node 165/165, final safety 29/29, Python 101/101, Chrome 28/28; both PDFs retain all 130 rows. Full Node 3704 tests with the same 91 baseline failures. Privacy test: 62 passed, 1 failed due to 17 protected-file READ_ERRORs; not a green gate. Build, DB, manual checklist and controlled-login gaps remain documented. User explicitly authorized staging push with these gaps disclosed.
Co-Authored-By: Claude Code <noreply@anthropic.com>
The product owner chose to remove the leaked birth data from staging history.
The three commits after f77a1b5a were rebuilt with their original authors,
dates and messages, changing only the brief to its cleaned text: baeec66f,
f968cb21 and fcca56fe became a7f82dc2, bbd96d3b and abf28321. The new head's
tree is byte-identical to the old one and the leaked blob is absent from the
new history.
The old commits are still served anonymously by their SHA until the Gitea
server garbage-collects, so BUG-1008 stays mitigated rather than resolved.
Privacy scan on this tree before push: one finding, the fixture collision.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017eEAG8HD3mm8gsKXgk8uU8
Acceptance of f968cb21 against TASK-report-density-20260922. Tasks 1, 2, 4
and 5 pass; task 3 does not. Under Node 22, the gate's version, the frontend
suite goes from 3,698 tests / 26 failing to 3,730 / 26 with an identical
failure list; / stays static and first-load gzip moves by 0.007%.
Task 3 renders the ordinary report's fact tables as 948 key/value rows whose
labels are engine paths: 447 carry snake_case keys and 521 carry array
indices, down to a Julian day. The brief never specified columns, so the fix
brief does.
The quick gate's new failure is the privacy scan, and two thirds of it is
mine: the brief pushed in baeec66f carried the comparison chart's real birth
date, time and coordinates. They are removed here and recorded as BUG-1008.
The copy in baeec66f's history stays until the product owner decides whether
to rewrite staging. The remaining hit is a five-character collision inside an
engine timestamp of the fictional fixture, reproduced by regenerating from its
declared fictional input.
Privacy scan on this tree before push: one finding, the fixture collision.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017eEAG8HD3mm8gsKXgk8uU8
Same-chart measurement against the upstream PL9 export: 847,632 chars and
8,044 table rows there, 309,357 and 1,478 here. The engine is not the gap --
twenty divisional charts, four KP tables, Ashtakavarga, the six Shadbala
components, Avastha, Sahams and the annual pack all compute today. The report
contract has nowhere to put them: REPORT_SECTION_KINDS has no table kind and
CHART_IDS lists nine charts.
The outgoing raw appendix also leaks 925 distinct engineering identifiers over
3,797 occurrences, including an internal function name, a third-party engine
name and a third-party product's page numbers. The comparison report scores
zero on every one of those.
The decision record states plainly that two BUG-999 guards are overridden for
the appendix channel only; the ordinary prose projection is untouched.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017eEAG8HD3mm8gsKXgk8uU8
Selected and hover fill stay on the whole row. The title and ⋯ no longer draw their own canvas or radius, so they stop looking like two controls (BUG-993, recurrence of BUG-024).
Flip archive tokens to must-not-appear on the session row and session hook only. Keep writeChatSession POST/PATCH and assert delete still uses DELETE. Grep tests/ before deleting frontend symbols.
Remove archive/restore from the session menu and drop archived=1 listing. PATCH still accepts archived_at from old bundles then ignores it. A forward migration clears archived_at without bumping updated_at. Delete stays unchanged.
