Docs: 2026-07-17 overnight delivery sweep (11 PRs)

[Chris0Jeky]

Docs-only post-merge sweep for the 2026-07-17 overnight run (11 PRs merged to main; three — #1385, #1381, #1390 — landed after the initial sweep and were folded in at 7bfff9d). No source changes; the underlying issues are already closed by their own merged PRs, so this PR intentionally uses no closing keywords.

What changed

• docs/STATUS.md — one consolidated dated entry, "Overnight substrate + correctness wave (2026-07-17, 11 PRs merged)", inserted after the existing 2026-07-17 REVIVAL-02 note. It does not restate the in-PR REVIVAL-02: Remove the fake undo timeline and correct reversibility copy (no revert endpoint exists) #1298 / ARCHIVE-06: Re-point automated coverage at the Paper UI - core-loop E2E defaults + Paper axe suite #1274 paragraphs already present; it references them.
• docs/IMPLEMENTATION_MASTERPLAN.md — matching "Delivery update (2026-07-17)" section in the established format; Last Updated bumped to 2026-07-17.
• docs/agentic/failure_ledger.jsonl + rendered docs/agentic/FAILURE_LEDGER.md — three ledger rows flipped to resolved in place (the file's established convention), with the resolving PR recorded in future_fix. Re-rendered via scripts/agent_hooks/render_failure_ledger.py.

Merge set documented (Refs)

Refs #1373 (#1282, shared UseTaskdeckSqlite test/prod parity), #1375 (#1298, REVIVAL-02 fake-undo removal), #1374 (#1370, proposal preview==apply), #1372 (#1367, MCP host-security fail-closed), #1377 (#1357, concurrent-migrator final-state assertion), #1378 (#1369, artefact extraction wall-clock budget), #1362 (#1274, Paper P-I E2E ship gate), #1366 (#1365/#1371, presence broadcast delivery proof), #1385 (#1355, batched export blob loads), #1381 (#1368, MCP pre-auth failure budget + per-IP concurrency admission gate + abort-proof consumption), #1390 (same-night hotfix of the #1377 fail-open collision test; flake-run evidence 29552875836).

Ledger rows marked resolved (Refs)

• test/sqlite-concurrency — Refs Flaky: ConcurrencyRaceConditionStressTests.BoardCreation_ConcurrentMultiUser_NoCrossContamination — transient 500 during concurrent auth setup #1282, resolved via Mirror production SQLite settings in the API test factory #1373
• frontend/paper-review-contract — Refs Paper Review crashes on numeric deep-review enum payloads #1347, resolved via Fix Paper deep-review enum wire contract #1360 (2026-07-14)
• backend/similar-past — Refs Similar-past endpoint returns 500 for real SQLite proposals #1348, resolved via Fix SQLite similar-past history query #1361 (2026-07-14)

Gates run (all green, re-run after the #1385/#1381/#1390 fold-in)

• node scripts/check-docs-governance.mjs — passed
• node scripts/check-golden-principles.mjs — passed
• python scripts/agent_hooks/render_failure_ledger.py — clean idempotent re-render; JSONL parses (14 rows)

Accuracy notes

• No open PR is described as shipped. Prevent late summaries from overwriting a newer workspace-mode choice #1386 (final review round in flight) and the human-gated holds fix(#1293): consolidate deny-floor to global + thin overlay #1295 / Publish permanent licensing posture and advisory DCO check #1337 / Repair nightly k6 summary ownership and capacity gate #1359 are explicitly listed as still open in the STATUS/masterplan entries.
• Seeded-tonight follow-ups (Preview/apply asymmetries remaining after #1370: expiry not checked at diff time; zero-op proposals diverge (200/404 vs 400) #1376, Artefact extraction: bound parser resource consumption (memory/decompression + worker), not just wall-clock #1379, Flaky E2E: ops console health.check run — InputAssistField fill/overlay race swallows the Run Template click #1380, E2E: pre-existing page.once('dialog') handlers accept confirmations without failing when absent #1382, Flaky: AuditRetentionRepositoryIntegrationTests.DeleteOldEntriesAsync deleted=0 despite 70-day margin (windows API Integration) #1383, MCP per-key rate limit does not bound auth-stage database work for valid over-quota keys #1384, Buffered account export: batch artefact extraction-history loads (avoid N+1) #1387, Workspace-mode staleness: server-order and cross-device gaps after #1343 #1388) are listed as seeded, not shipped.
• Every claim for the three folded-in PRs was verified against the merged commit messages on origin/main (20d7f0c, e1ecd28, 493d450), including the Spend MCP pre-auth IP budget only on authentication failures #1381 abort-proof finally consumption and the Make the fail-open collision test deterministically intercept mid-chain #1390 run-29552875836 flake evidence.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Chris0Jeky]

Self-review (adversarial accuracy pass) — docs-only

Scope: 4 files, +32/-7. No source changes. Reviewed for the one failure mode that matters on a delivery-sweep: overclaiming or misattributing merged work.

Verification performed

• Every documented PR claim cross-checked against the merged commit messages on this checkout (git log of b751a1d9 #1373, 4a953f54 #1375, 7f3158b8 #1374, 0183bcaf #1372, ded2b020 #1377, 72203426 #1378, 40b7bb2f #1362, 92774c7f #1366). Specific load-bearing claims confirmed in-commit: the shared UseTaskdeckSqlite helper routing both prod DI and the test factory (Mirror production SQLite settings in the API test factory #1373); the stable 409 at proposal preview for create-card id collisions and the shared ProposalOperationStructureValidator (Make proposal preview match apply for reorder, create-card ids, and structure limits #1374); fail-closed on separator-only/blank AllowedHosts mirroring HostFilteringMiddleware (Fail closed on separator-only AllowedHosts in standalone MCP host security #1372); final-schema-state assertion + AcquireLock internal-seam contract (Make the concurrent-migrator test assert final schema state instead of no-throw #1377); Artefacts:ExtractionTimeoutSeconds budget with real PdfPig/plain-text extractors (Bound artefact extraction with a wall-clock budget #1378); focus-follows-selection + hard-asserted apply confirmation dialog (Align core E2E coverage with Paper #1362); per-join/leave broadcast-delivery proof referencing the Mirror production SQLite settings in the API test factory #1373 parity (Stabilize rapid presence snapshot ordering #1366).
• Ledger resolutions verified against GitHub, not just the task brief: Flaky: ConcurrencyRaceConditionStressTests.BoardCreation_ConcurrentMultiUser_NoCrossContamination — transient 500 during concurrent auth setup #1282 CLOSED 2026-07-17 by Mirror production SQLite settings in the API test factory #1373; Paper Review crashes on numeric deep-review enum payloads #1347 CLOSED 2026-07-14 by Fix Paper deep-review enum wire contract #1360; Similar-past endpoint returns 500 for real SQLite proposals #1348 CLOSED 2026-07-14 by Fix SQLite similar-past history query #1361 (issue closedAt matches each PR mergedAt). All three rows flipped open→resolved in place per the ledger's established single-row convention and re-rendered.
• Open vs shipped boundary honored: Spend MCP pre-auth IP budget only on authentication failures #1381 / Batch buffered account-export artefact blob loads (#1355) #1385 / Prevent late summaries from overwriting a newer workspace-mode choice #1386 and holds fix(#1293): consolidate deny-floor to global + thin overlay #1295 / Publish permanent licensing posture and advisory DCO check #1337 / Repair nightly k6 summary ownership and capacity gate #1359 are stated as still open; seeded-tonight items (Preview/apply asymmetries remaining after #1370: expiry not checked at diff time; zero-op proposals diverge (200/404 vs 400) #1376/Artefact extraction: bound parser resource consumption (memory/decompression + worker), not just wall-clock #1379/Flaky E2E: ops console health.check run — InputAssistField fill/overlay race swallows the Run Template click #1380/E2E: pre-existing page.once('dialog') handlers accept confirmations without failing when absent #1382/Flaky: AuditRetentionRepositoryIntegrationTests.DeleteOldEntriesAsync deleted=0 despite 70-day margin (windows API Integration) #1383/MCP per-key rate limit does not bound auth-stage database work for valid over-quota keys #1384/Buffered account export: batch artefact extraction-history loads (avoid N+1) #1387/Workspace-mode staleness: server-order and cross-device gaps after #1343 #1388) are stated as seeded, not shipped.
• Governance gates: check-docs-governance.mjs passed, check-golden-principles.mjs passed, render_failure_ledger.py idempotent + JSONL parses (14 rows). Last Updated: 2026-07-17 line intact in STATUS (not duplicated).
• Close-keyword hygiene: closingIssuesReferences is empty — no issue is auto-closed by this docs PR.

Findings by severity

• CRITICAL: none
• HIGH: none
• MEDIUM: none
• LOW: none

Residual risk / NOT verified

• The "7223 passed / 0 failed / 1 skipped" full-suite figure is the reported result from the Mirror production SQLite settings in the API test factory #1373 landing, not re-run here (a docs sweep cannot and should not re-run the backend suite); it is written as "reported" everywhere it appears.
• No behavioral verification is in scope — this PR only documents already-merged, already-CI-green work.

[gemini-code-assist]

Code Review

This pull request updates several documentation files, including the implementation masterplan, status reports, and agentic failure ledgers, to reflect the delivery of eight merged pull requests from the July 17, 2026 substrate and correctness wave. The review feedback is highly constructive, pointing out minor copy inconsistencies regarding the REVIVAL-02 ship gate description in both docs/IMPLEMENTATION_MASTERPLAN.md and docs/STATUS.md, as well as correcting a broken markdown bold syntax rendering error in docs/STATUS.md.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[Chris0Jeky]

Update: three late-landing PRs folded in (commit 7bfff9d)

Three more PRs merged to main after the initial sweep; the overnight entry now documents 11 PRs, not 8:

• Batch buffered account-export artefact blob loads (#1355) #1385 (Buffered account export: batch artefact blob loads (avoid N round-trips) #1355) — batched buffered account-export artefact blob loads (bounded Chunk() reads, SQLite parameter-limit guard pinned at 900 ids, export-JSON round-trip + missing-blob contract tests). Verified against merged commit 20d7f0cb.
• Spend MCP pre-auth IP budget only on authentication failures #1381 (MCP /mcp pre-auth IP rate limiter throttles valid traffic and defeats per-key isolation (post-merge finding from #1364) #1368) — MCP pre-auth per-IP limiter reworked into a failure budget (spends only on 401s; non-consuming pre-check; per-IP concurrency admission gate RateLimiting:McpAuthenticationPerIpConcurrency default 16; abort-proof consumption via marker + finally; forwarded headers now applied to the standalone host, default OFF). Verified against merged commit e1ecd284.
• Make the fail-open collision test deterministically intercept mid-chain #1390 — same-night hotfix of the Make the concurrent-migrator test assert final schema state instead of no-throw #1377 fail-open collision test: staged mid-chain interception replaces the flaky barrier design (it had failed unrelated-PR run 29552875836); pathological staging miss now passes gracefully with a loud WARNING: STAGING MISSED. Verified against merged commit 493d4505.

Also updated: the entry's "Still open — NOT shipped" line now reads #1386 (final review round in flight) plus the human-gated holds #1295 / #1337 / #1359, since #1381 and #1385 have shipped. Mirrored identically in docs/IMPLEMENTATION_MASTERPLAN.md. PR title/body updated from "(8 PRs)" to "(11 PRs)".

Re-verified after the fold-in:

• check-docs-governance.mjs — passed
• check-golden-principles.mjs — passed
• Failure-ledger files untouched by this commit; the three resolved rows from 0616f773 remain intact (diff vs origin/main is exactly the three status flips)
• closingIssuesReferences still empty after the body edit — no accidental issue closures

[Chris0Jeky]

Fix evidence — Gemini review (3 MEDIUM findings)

Finding	Disposition	Evidence
M1 (masterplan): REVIVAL-02 bullet conflated apply-risk copy with the confidence label	Fixed	36fb655 — now: apply-risk guidance ("Apply considerations") while the confidence label renders "Operation safety"
M2 (STATUS): same imprecision in the #1375 bullet	Fixed	36fb655 — both labels now named explicitly, matching the in-file REVIVAL-02 note
M3 (STATUS): claimed missing opening ** on the Seeded follow-ups line	Not reproducible on current head	Raw grep confirms - **Seeded follow-ups:** is correctly paired; the suggestion was built on pre-7bfff9d3 text and would have reverted the still-open list (re-adding shipped #1381/#1385). Rebuttal with evidence posted on the thread

Gates re-run after 36fb655: check-docs-governance.mjs passed, check-golden-principles.mjs passed. Failure-ledger files untouched by both follow-up commits.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 36fb655fa2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".