refactor(wp1): persistence + layer discipline + restart safety

.claude/settings.json

@@ -39,6 +39,11 @@
             "command": "bash scripts/check_git_c_cwd.sh",
             "timeout": 5000
           },
+          {
+            "type": "command",
+            "command": "bash scripts/check_no_git_no_verify.sh",
+            "timeout": 5000
+          },
           {
             "type": "command",
             "command": "python3 scripts/check_no_bulk_edit.py",

.claude/skills/babysit-pr/SKILL.md

@@ -336,36 +336,18 @@ Group findings by file. For each file:
 
 If a fix changes test expectations: update the test in the same round. If a fix introduces a new code path: add coverage in the same round.
 
-## Phase 9: verify locally
+## Phase 9: verification is delegated to the commit/push hooks (do NOT re-run them)
 
-Conditional gates by file type touched:
+**Do not manually run `ruff` / `mypy` / `pytest` / `eslint` / `go test` here.** This repo's `.pre-commit-config.yaml` already hard-gates every push:
 
-- **Python** (`.py` in `src/` or `tests/`):
+- **pre-commit stage** (fires on Phase 10's `git commit`): `ruff`, `ruff-format`.
+- **pre-push stage** (fires on Phase 10's `git push`): `mypy` (affected modules, via `run_affected_mypy.py`), `pytest-unit` (affected modules, via `run_affected_tests.py`), `eslint-web`, `go-vet` / `go-test`, plus every convention gate (kill-switch, list-pagination, no-migration-framing, schema-drift, no-magic-numbers, boundary-typed, and the rest).
 
-  ```bash
-  uv run ruff check src/ tests/ --fix
-  uv run ruff format src/ tests/
-  uv run mypy --num-workers=4 src/ tests/
-  uv run python -m pytest tests/ -m unit -n 8
-  ```
-
-- **Web** (`.tsx`/`.ts`/`.css` in `web/src/`):
+A failing hook **aborts the commit or push locally**, so nothing reaches CI or CodeRabbit and no review cycle is burned. The affected-subset hooks are also strictly faster than a manual full-suite run, so re-running the full `pytest -m unit` or whole-tree `mypy` here is pure duplicated wall-clock with no extra safety.
 
-  ```bash
-  npm --prefix web run lint
-  npm --prefix web run type-check
-  npm --prefix web run test
-  ```
-
-- **Go** (`.go` in `cli/`):
-
-  ```bash
-  go -C cli vet ./...
-  go -C cli test ./...
-  go -C cli build ./...
-  ```
+The `skip:` list in `.pre-commit-config.yaml` only suppresses these on **pre-commit.ci** (the cloud mirror); locally they all run. Do not mistake that skip list for "these do not run on my push".
 
-Failure handling: if a gate fails, fix the failure in this round (don't push broken code). If you can't, surface it via `AskUserQuestion` and pause the loop.
+What this phase actually does: **nothing but proceed to Phase 10.** The push there is the gate. If the commit or push is rejected by a hook, Phase 10 step 4 owns the fix-forward loop (triage the hook output, fix the real issue, new commit, re-push; never `--no-verify`, never `--amend`). If a hook failure cannot be fixed this round, surface it via `AskUserQuestion` and pause the loop. The only manual check worth running here is one a hook genuinely does NOT cover (rare, e.g. a one-off repro the reviewer explicitly asked for), and even then scope it to the single file, never the whole tree.
 
 ## Phase 9b: pre-push completeness sweep (mandatory before EVERY push)
 

.claude/skills/pre-pr-review/SKILL.md

@@ -889,38 +889,30 @@ After all fixes:
 - If a fix requires test changes, change the tests too
 - If a fix introduces new code paths, add test coverage
 
-## Phase 8: Post-Fix Verification
+## Phase 8: Stage (verification is delegated to the commit/push hooks)
 
-Run automated checks again (same conditional gating as Phase 2):
+**Do NOT manually re-run `ruff` / `mypy` / `pytest` / `eslint` here.** The Phase 2 initial run already informed the review agents; re-running the full suite before the commit is pure duplicated wall-clock. Phase 10's `git commit` + `git push` fire this repo's real gates:
 
-**Python checks (steps 1-4):** Run only if `src_py` or `test_py` files were changed or modified during Phase 7.
+- **pre-commit stage** (on `git commit`): `ruff`, `ruff-format`.
+- **pre-push stage** (on `git push`): `mypy` (affected, `run_affected_mypy.py`), `pytest-unit` (affected, `run_affected_tests.py`), `eslint-web`, `go-vet` / `go-test`, plus every convention gate.
 
-1. `uv run ruff check src/ tests/`
-2. `uv run ruff format src/ tests/`
-3. `uv run mypy --num-workers=4 src/ tests/`
-4. `uv run python -m pytest tests/ -n 8`
+A failing hook aborts the commit/push **locally** (nothing reaches the remote or a PR), and the affected-subset hooks are faster than a manual full run. The `skip:` list in `.pre-commit-config.yaml` only suppresses these on pre-commit.ci (the cloud mirror); locally they all run.
 
-**Web dashboard checks (steps 5-7):** Run only if `web_src` or `web_test` files were changed or modified during Phase 7.
-
-5. `npm --prefix web run lint`
-6. `npm --prefix web run type-check`
-7. `npm --prefix web run test`
-
-If anything fails, fix and re-run. Stage all changes after passing:
+Just stage:
 
 ```bash
 git add -A
 ```
 
+If Phase 10's commit or push is then rejected by a hook, Phase 10 step 6 owns the fix-forward loop (fix the real issue, NEW commit, re-push; never `--no-verify`, never `--amend`).
+
 ## Phase 9: Polish Pass (code-simplifier)
 
 **Skip this phase if:** quick mode was used, OR no agent findings were implemented (nothing changed beyond Phase 2 auto-fixes).
 
 1. Launch `code-simplifier` on all modified files
 2. If it suggests improvements, apply them
-3. Re-run verification (same conditional gating as Phase 8):
-   - If `src_py` or `test_py` changed: `uv run ruff check src/ tests/` + `uv run ruff format src/ tests/` + `uv run mypy --num-workers=4 src/ tests/` + `uv run python -m pytest tests/ -n 8`
-   - If `web_src` or `web_test` changed: `npm --prefix web run lint` + `npm --prefix web run type-check` + `npm --prefix web run test`
+3. `git add -A`. Do NOT manually re-run ruff/mypy/pytest/eslint; Phase 10's commit + push hooks gate the final state (see Phase 8). A hook rejection there is handled by Phase 10 step 6's fix-forward loop.
 
 ## Phase 10: Commit + Push + Create PR
 
@@ -964,7 +956,7 @@ git add -A
    - Review coverage note (agents run, findings count)
    - Issue linkage (`closes #N`) if user provided an issue number as argument or commits reference one
 
-6. **If commit fails due to pre-commit hooks:** fix the issue and create a NEW commit. **NEVER use `--no-verify`.**
+6. **If the commit or the push is rejected by a hook** (pre-commit: ruff/ruff-format; pre-push: mypy-affected, pytest-unit-affected, eslint-web, go, convention gates): triage the hook output, fix the real issue, create a NEW commit, and re-push. **NEVER use `--no-verify`, never `--amend`.** If a hook failure cannot be fixed in this pass, surface it to the user rather than bypassing.
 
 ## Phase 11: Summary
 

.pre-commit-config.yaml

@@ -621,6 +621,19 @@ repos:
         pass_filenames: false
         stages: [pre-push]
 
+      - id: schema-drift-revisions-sqlite
+        name: schema.sql matches accumulated revisions (sqlite arm)
+        entry: uv run python scripts/check_schema_drift_revisions.py --backend sqlite
+        language: system
+        # Trigger when the sqlite schema, sqlite revisions, the gate
+        # script itself, or this config changes. The postgres arm
+        # needs Docker and runs in CI only; sqlite catches the
+        # 'forgot to update schema.sql' bug-class at pre-push without
+        # external dependencies (~5-10s).
+        files: ^(src/synthorg/persistence/sqlite/(schema\.sql|revisions/.*\.sql)|scripts/check_schema_drift_revisions\.py|scripts/_schema_drift_.*\.py|\.pre-commit-config\.yaml)$
+        pass_filenames: false
+        stages: [pre-push]
+
       - id: convention-gate-inventory
         name: convention-gate inventory (MANDATORY <-> gate parity)
         entry: uv run python scripts/check_convention_gate_inventory.py
@@ -666,3 +679,11 @@ repos:
         # ~13s wall-clock on the full repo; same cost trade-off as
         # no-review-origin-in-code above. Moved to pre-push.
         stages: [pre-push]
+
+      - id: no-api-dto-in-persistence-or-service
+        name: forbid synthorg.api.dto_* imports inside persistence/ and service/
+        entry: uv run python scripts/check_no_api_dto_in_persistence_or_service.py
+        language: system
+        files: ^(src/synthorg/(persistence/.*\.py|api/services/.*\.py|.*_service\.py|.*/service(?:/.*)?\.py)|scripts/check_no_api_dto_in_persistence_or_service\.py|\.pre-commit-config\.yaml)$
+        pass_filenames: false
+        stages: [pre-commit, pre-push]

CLAUDE.md

@@ -10,7 +10,7 @@ Web: see `web/CLAUDE.md`. CLI: see `cli/CLAUDE.md` (use `go -C cli`, never `cd c
 - **Planning (MANDATORY)**: present every plan for accept/deny before coding.
 - **Web Dashboard Design System (MANDATORY)**: reuse `web/src/components/ui/`; design tokens only. Detail in `web/CLAUDE.md`.
 - **Regional Defaults (MANDATORY)**: no region/currency/locale privileged; metric units; British English. See [docs/reference/regional-defaults.md](docs/reference/regional-defaults.md).
-- **Persistence Boundary (MANDATORY)**: only `src/synthorg/persistence/` may import sqlite/psycopg or emit raw SQL. See [docs/reference/persistence-boundary.md](docs/reference/persistence-boundary.md).
+- **Persistence Boundary (MANDATORY)**: only `src/synthorg/persistence/` may import sqlite/psycopg or emit raw SQL. New repository protocols inherit one or more generic categories from `persistence/_generics.py` (`SingletonRepository` / `IdKeyedRepository` / `FilteredQueryRepository` / `AppendOnlyRepository` / `StatefulRepository` / `MVCCRepository`); bespoke methods are permitted only under [ADR-0001](docs/decisions/0001-repository-protocol-consolidation.md) D7 (real perf optimisation or domain invariant callers must not bypass). Protocols stay `@runtime_checkable`. See [docs/reference/persistence-boundary.md](docs/reference/persistence-boundary.md).
 - **Convention Rollout (MANDATORY)**: every convention PR ships its enforcement gate. See [docs/reference/convention-gates.md](docs/reference/convention-gates.md).
 - **Configuration Precedence (MANDATORY)**: DB > env > code default via `SettingsService`/`ConfigResolver` (Cat-1) or env > code default (Cat-2, `read_only_post_init`); Cat-3 bootstrap secrets are pure env at the boot site. YAML is a company-template ingestion format, not a precedence tier. No `os.environ.get` outside startup; pre-init Cat-2 reads use `settings.bootstrap_resolver.resolve_init_value`. See [docs/reference/configuration-precedence.md](docs/reference/configuration-precedence.md).
 - **No Hardcoded Values (MANDATORY)**: numerics live in `settings/definitions/`; allowlist 0/1/-1, HTTP codes, hex masks, powers-of-2, and module-level annotated named constants of the form `NAME: int|float|Final|Final[int]|Final[float] = literal`. Enforced by `scripts/check_no_magic_numbers.py`.

data/runtime_stats.yaml

@@ -1,13 +1,13 @@
 schema_version: 1
-last_generated_utc: '2026-05-16T21:47:36Z'
-generator_revision: 7088ff365
+last_generated_utc: '2026-05-17T01:30:00Z'
+generator_revision: 949abda43
 stats:
   tests:
-    raw: 30667
-    rounded: 30000
-    display: 30,000+
+    raw: 31136
+    rounded: 31000
+    display: 31,000+
   mem0_stars:
-    raw: 55866
+    raw: 55881
     rounded: 55000
     display: 55k+
   providers_curated:
@@ -20,8 +20,8 @@ stats:
     raw: 26
     display: '26'
   convention_gates:
-    raw: 46
-    display: '46'
+    raw: 47
+    display: '47'
 sources:
   tests: uv run python -m pytest --collect-only -q
   mem0_stars: gh api repos/mem0ai/mem0 --jq .stargazers_count