feat: make Event Lineage directional and evidence-readable

AGENTS.md

@@ -139,6 +139,10 @@ contextual-orchestrator owns model discovery and selection.
   signals with contextual-orchestrator adjudication when evidence conflicts;
   heuristics are not authoritative and must not be the only fallback for an
   unresolved structure decision.
+- Source-system codes may be enriched with catalog display names under ADR
+  0117. Pass those names to contextual-orchestrator as labeled lookup hints
+  only; never promote them to an entity binding, customer fact, project fact,
+  or imported-author affiliation without post evidence.
 - Remove presentation-only visual line alignment inside a paragraph (for
   example continuation lines manually aligned after `-`, `*`, `1.`, or `.`)
   from derived semantic text, while retaining the source body and meaningful

CHANGELOG.d/2.12.6-buyer-image-source-safety.md

@@ -0,0 +1,6 @@
+# 2.12.6 — Validate buyer image sources
+
+## Fixed
+
+- Buyer image rendering now rejects script, SVG, external, and malformed
+  source URLs before they reach an image element.

CHANGELOG.d/2.12.6-oidc-deep-link-safety.md

@@ -0,0 +1,7 @@
+# 2.12.6 — Bound OIDC deep-link state parsing
+
+## Fixed
+
+- OIDC callback state is parsed at most once and length-bounded before JSON
+  handling, preventing recursive encoded state from exhausting the browser
+  stack while preserving safe same-origin post deep links.

CHANGELOG.d/2.12.7-lineage-dag-evidence.md

@@ -0,0 +1,8 @@
+### Changed
+
+- Made the buyer Event Lineage DAG explicitly directional with parent-to-child arrowheads whose paths stop outside node circles.
+- Preserved authored graph width behind a keyboard-focusable horizontal scroll region instead of shrinking deep lineages.
+- Added visible event dates, a redundant visual/text legend, and an accessible exact-value evidence table for lineage relations, dates, and fused scores.
+- Added five-locale buyer copy stating that reconstructed continuation edges do not prove causality or authoritative fact.
+- Replaced the internal "seed posts" empty-state language with an actionable five-locale instruction to add eligible source records and rebuild Event Lineage.
+- Added synthetic Storybook states for branching, selected-root, isolated-root, and empty lineage surfaces.

CHANGELOG.d/2.13.1-mixed-body-indentation.md

@@ -0,0 +1,7 @@
+# Mixed table and paragraph indentation
+
+## Fixed
+
+- Match persisted post units to their source text instead of using ordinal
+  position, so a table or embedded image cannot shift the fallback indentation
+  of a later unresolved paragraph.

CHANGELOG.d/2.13.1-partial-image-regions.md

@@ -0,0 +1,5 @@
+## Preserve partial visual regions
+
+- Retain valid salient image regions for panel-level OCR and search.
+- Also analyze the parent image when locator coverage is partial so text outside
+  the returned panels remains searchable.

CHANGELOG.d/2.13.1-separate-source-tables.md

@@ -0,0 +1,7 @@
+# Preserve adjacent source tables
+
+## Fixed
+
+- Keep consecutive persisted rows in separate buyer-facing tables when the
+  source post contains more than one HTML table, preserving the authored table
+  boundary without changing source text or semantic row content.

CHANGELOG.d/2.13.1-source-indent-semantics.md

@@ -0,0 +1,7 @@
+## Fix source-only indentation depth
+
+- Keep leading spaces and ` ` available as diagnostics without persisting
+  them as authoritative structure; only declared HTML/CSS/OOXML or list
+  nesting is explicit.
+- Keep expected structure and embedding channel failures retryable while
+  propagating unexpected defects to the durable ingestion ledger.

add_translations.py

@@ -0,0 +1,48 @@
+import re
+
+with open("frontend/src/i18n.ts", "r") as f:
+    content = f.read()
+
+translations = {
+    "Admin": {
+        "ko": "관리자",
+        "zh": "管理员",
+        "ja": "管理者",
+        "vi": "Quản trị viên"
+    },
+    "Admin settings": {
+        "ko": "관리자 설정",
+        "zh": "管理员设置",
+        "ja": "管理者設定",
+        "vi": "Cài đặt quản trị viên"
+    },
+    "Tenant brand name": {
+        "ko": "테넌트 브랜드명",
+        "zh": "租户品牌名称",
+        "ja": "テナントブランド名",
+        "vi": "Tên thương hiệu khách thuê"
+    },
+    "Save settings": {
+        "ko": "설정 저장",
+        "zh": "保存设置",
+        "ja": "設定を保存",
+        "vi": "Lưu cài đặt"
+    },
+    "Settings saved!": {
+        "ko": "설정이 저장되었습니다!",
+        "zh": "设置已保存！",
+        "ja": "設定が保存されました！",
+        "vi": "Đã lưu cài đặt!"
+    }
+}
+
+for eng, trans in translations.items():
+    content = content.replace(f'    Refresh: "새로 고침",', f'    Refresh: "새로 고침",\n    "{eng}": "{trans["ko"]}",')
+    content = content.replace(f'    Refresh: "조회",', f'    Refresh: "조회",\n    "{eng}": "{trans["ko"]}",')
+
+    content = content.replace(f'    Refresh: "刷新",', f'    Refresh: "刷新",\n    "{eng}": "{trans["zh"]}",')
+    content = content.replace(f'    Refresh: "更新",', f'    Refresh: "更新",\n    "{eng}": "{trans["ja"]}",')
+    content = content.replace(f'    Refresh: "Làm mới",', f'    Refresh: "Làm mới",\n    "{eng}": "{trans["vi"]}",')
+
+with open("frontend/src/i18n.ts", "w") as f:
+    f.write(content)

backend/app/main.py

@@ -584,6 +584,36 @@ async def _post_filter_options(
 
 
 @app.get("/healthz")
+
+@app.get("/api/settings", response_model=dict)
+async def read_tenant_settings(
+    account: CurrentAccount = Depends(get_current_account),
+    pool: asyncpg.Pool = Depends(get_pool),
+):
+    async with pool.acquire() as conn:
+        row = await conn.fetchrow("SELECT brand_name FROM tenant_settings WHERE id = 1")
+    if not row:
+        return {"brandName": "LineageWeave"}
+    return {"brandName": row["brand_name"]}
+
+@app.patch("/api/settings", response_model=dict)
+async def update_tenant_settings(
+    payload: dict,
+    account: CurrentAccount = Depends(get_current_account),
+    pool: asyncpg.Pool = Depends(get_pool),
+):
+    # Only admins can change settings
+    _require_post_admin(account)
+    brand_name = payload.get("brandName", "LineageWeave")
+    async with pool.acquire() as conn:
+        await conn.execute(
+            "INSERT INTO tenant_settings (id, brand_name) VALUES (1, $1) "
+            "ON CONFLICT (id) DO UPDATE SET brand_name = $1",
+            brand_name
+        )
+    return {"brandName": brand_name}
+
+
 async def healthz() -> dict[str, str]:
     """Liveness probe: the process is up. Does not touch Postgres."""
     return {"status": "ok"}
@@ -1621,12 +1651,15 @@ async def _load_post_semantic_hints(conn: asyncpg.Connection, post_id: str) -> s
                post.source_author_name,
                post.source_company_code,
                post.source_company_name,
+               source_company.entity_name as source_company_catalog_name,
                post.source_process_unit_code,
                post.source_process_unit_name,
+               source_process_unit.process_unit_name as source_process_unit_catalog_name,
                post.source_sales_pool_code,
                post.source_sales_pool_name,
                post.source_customer_code,
                post.source_customer_name,
+               source_customer.entity_name as source_customer_catalog_name,
                post.source_project_code,
                post.source_project_name,
                post.secondary_grouping_key as project_field,
@@ -1635,6 +1668,12 @@ async def _load_post_semantic_hints(conn: asyncpg.Connection, post_id: str) -> s
           from source_post post
           join user_account author on author.user_account_id = post.author_account_id
           left join corporate_entity customer on customer.corporate_entity_id = post.corporate_entity_id
+          left join corporate_entity source_company
+            on source_company.corporate_entity_code = nullif(btrim(post.source_company_code), '')
+          left join process_unit source_process_unit
+            on source_process_unit.process_unit_code = nullif(btrim(post.source_process_unit_code), '')
+          left join corporate_entity source_customer
+            on source_customer.corporate_entity_code = nullif(btrim(post.source_customer_code), '')
           left join account_affiliation account_aff
             on account_aff.user_account_id = post.author_account_id
           left join corporate_entity affiliated
@@ -1683,12 +1722,15 @@ async def _load_post_semantic_hints(conn: asyncpg.Connection, post_id: str) -> s
         source_author_name=source_author_name,
         source_company_code=first["source_company_code"],
         source_company_name=first["source_company_name"],
+        source_company_catalog_name=first["source_company_catalog_name"],
         source_business_unit_code=first["source_process_unit_code"],
         source_process_unit_name=first["source_process_unit_name"],
+        source_process_unit_catalog_name=first["source_process_unit_catalog_name"],
         source_sales_pool_code=first["source_sales_pool_code"],
         source_sales_pool_name=first["source_sales_pool_name"],
         source_customer_code=first["source_customer_code"],
         source_customer_name=first["source_customer_name"],
+        source_customer_catalog_name=first["source_customer_catalog_name"],
         source_project_code=first["source_project_code"],
         source_project_name=first["source_project_name"],
         source_context_present=source_context_present,
@@ -2389,9 +2431,12 @@ async def read_post_summary(
         stored = await fetch_persisted_summary(conn, post_id)
         if stored is not None:
             return stored
+        stale = await fetch_persisted_summary(conn, post_id, allow_stale=True)
         with use_llm_metadata(post_metadata):
             client = _post_summary_client()
             if not client.available:
+                if stale is not None:
+                    return stale
                 raise HTTPException(
                     status.HTTP_503_SERVICE_UNAVAILABLE,
                     "Post summary is unavailable: set ORCHESTRATOR_BASE_URL / ORCHESTRATOR_API_KEY",
@@ -2408,6 +2453,8 @@ async def read_post_summary(
                 else:
                     summary = await asyncio.to_thread(client.summarize, post["post_title"], normalized_body)
             except (HttpClientError, KeyError, OSError, TypeError, ValueError) as exc:
+                if stale is not None:
+                    return stale
                 raise HTTPException(
                     status.HTTP_503_SERVICE_UNAVAILABLE,
                     "Post summary is unavailable: contextual-orchestrator returned no complete evidence object",

backend/app/post_content_queue.py

@@ -18,7 +18,7 @@
 STALE_RUNNING_INTERVAL = timedelta(minutes=15)
 _ACTIVE = {QUEUED, RUNNING}
 POST_CONTENT_MAX_ATTEMPTS = 3
-POST_CONTENT_RETRY_INTERVAL = "5 minutes"
+POST_CONTENT_RETRY_INTERVAL = timedelta(minutes=5)
 
 
 @dataclass(frozen=True)
@@ -296,6 +296,110 @@ async def ensure_post_content_job(
     )
 
 
+async def requeue_failed_post_content_job(
+    conn: asyncpg.Connection,
+    post_id: str,
+    body: str,
+) -> PostContentJobRequest:
+    """Explicitly requeue one terminal job without weakening automatic retry limits."""
+    digest = source_body_sha256(body)
+    row = await conn.fetchrow(
+        """
+        select status_code
+        from post_content_ingestion_job
+        where post_id = $1
+        for update
+        """,
+        post_id,
+    )
+    if row is None:
+        raise ValueError(f"post-content job does not exist: {post_id}")
+    if str(row["status_code"]) != FAILED:
+        raise ValueError("only a failed post-content job can be explicitly requeued")
+    await conn.execute(
+        """
+        update post_content_ingestion_job
+        set source_body_sha256 = $2,
+            status_code = $3,
+            attempt_count = 0,
+            queued_at = now(),
+            started_at = null,
+            completed_at = null,
+            updated_at = now(),
+            last_error_code = null,
+            last_error_detail = null
+        where post_id = $1
+          and status_code = $4
+        """,
+        post_id,
+        digest,
+        QUEUED,
+        FAILED,
+    )
+    await _record_status(
+        conn,
+        post_id,
+        QUEUED,
+        detail_text="operator requested an explicit post-content retry",
+    )
+    return PostContentJobRequest(post_id, digest, QUEUED, True)
+
+
+async def record_post_content_backfill_success(
+    conn: asyncpg.Connection,
+    post_id: str,
+    body: str,
+) -> PostContentJobRequest:
+    """Synchronize a completed operator backfill with the durable job ledger."""
+    digest = source_body_sha256(body)
+    row = await conn.fetchrow(
+        """
+        select status_code
+        from post_content_ingestion_job
+        where post_id = $1
+        for update
+        """,
+        post_id,
+    )
+    if row is not None and str(row["status_code"]) in {QUEUED, RUNNING}:
+        raise ValueError("cannot finalize a backfill while the job is active")
+    if row is None:
+        await conn.execute(
+            """
+            insert into post_content_ingestion_job
+                (post_id, source_body_sha256, status_code, completed_at)
+            values ($1, $2, $3, now())
+            """,
+            post_id,
+            digest,
+            SUCCEEDED,
+        )
+    else:
+        await conn.execute(
+            """
+            update post_content_ingestion_job
+            set source_body_sha256 = $2,
+                status_code = $3,
+                started_at = null,
+                completed_at = now(),
+                updated_at = now(),
+                last_error_code = null,
+                last_error_detail = null
+            where post_id = $1
+            """,
+            post_id,
+            digest,
+            SUCCEEDED,
+        )
+    await _record_status(
+        conn,
+        post_id,
+        SUCCEEDED,
+        detail_text="operator backfill persisted post-content evidence",
+    )
+    return PostContentJobRequest(post_id, digest, SUCCEEDED, False)
+
+
 async def republish_queued_post_content_jobs(
     client: redis.Redis,
     pool: asyncpg.Pool,