Skip to content

Preserve household access and complete calendar, meal, finance and messaging reads - #969

Merged
NewWorldVenture merged 106 commits into
mainfrom
codex/audit-goal-followups-20261004
Oct 9, 2026
Merged

NewWorldVenture merged 106 commits into
mainfrom
codex/audit-goal-followups-20261004

Conversation

@NewWorldVenture

@NewWorldVenture NewWorldVenture commented Oct 4, 2026 •

Copy link
Copy Markdown
Owner

Household reads preserve private conversation audiences, calendar precision and complete finance results. Existing conversations retain their participants; a separate Family Chat starts empty. Calendar dates and confirmations keep their civil day, and the finance overview includes bills beyond the first 1,000 rows.

Calendar readers carry exact endpoints through recurrence, availability, conflicts, free slots and AI results. Native writes preserve supported PostgreSQL microseconds, validate persisted counterpart endpoints and compare captured state while retaining actor, family and source ownership checks. Relationship dates use midnight and an exclusive next-day end. All-day AI confirmations describe the saved date; timed confirmations retain family-clock formatting.

Finance totals and calendar indicators use complete counted reads. Cached prefixes remain pending until verified, and errors expose retry. The authenticated browser fixture covers the 1,001st bill, transport refusal, SDK retries, recovery and persisted cache. It now starts observation after owned seeding and settles actual requests and body captures before reload, retaining strict count, array and family assertions. This corrects test deadlines and response-capture lifetime without changing product retries or data handling.

School and sports inference groups overlapping roster labels by their child owners. Shared teacher or coach evidence stays unassigned; explicit full child names retain precedence. School windows reject unsupported or impossible written dates before database access. The broader release includes scoped meal, recurring-bill, mobile, notification and complete-read repairs.

Validation:

  • Latest capture repair: full nonincremental types, scoped lint and test collection pass on Node 24.21. The complete helper passes against the actual React, SDK, finance module, query hook and cache in an owned HTTP fixture. Eight independent browser controls retain malformed-data refusal and detect removed drainage/request tracking. All 63 prior assertions remain.
  • School changes pass 29 independent controls; unchanged code fails 20. The relationship/AI DATE repair passes 132 focused controls in three zones.
  • Parent 6954d290 passed 30,023 unit tests in each of UTC, Los Angeles and Tokyo, with 2 expected failures and 95 skips. Its browser run includes a first-attempt finance failure that recovered on retry; this is retained and does not accept the new commit.
  • Fresh complete hosted checks on 55c3a676ef49b51a7a1dc11e479b9aaa4ae556e1, including real Auth/PostgREST finance execution and owned cleanup, remain required before main. Prior Windows and native diagnostic failures remain qualified in finalaudit.md.

Release limits:

  • Migration allocation stays at 451 runnable files, highwater 0476, next 0477. 0488, 0490 and 0492–0494 remain held; calendar source activation remains disabled.
  • No production DDL, configuration changes, provider execution or money movement is included.
  • Counted pagination does not guarantee a coherent snapshot across concurrent equal-count changes. Uninstalled snapshot and year-boundary proposals remain outside this release.
  • Ignored Vercel previews are not deployments. Actual production revision verification follows the guarded merge. The full audit and production-readiness gate remain open.

@vercel

vercel Bot commented Oct 4, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated
bubaly Ignored Ignored Oct 9, 2026 11:28am UTC

Request Review

Copy link
Copy Markdown
Owner Author

Audit coordination blockers at57b9f3fdd7a88bd1b6c58cec4acc44f87d528d76:

Keep this candidate unapplied. Report acknowledgment, ownership and a bounded composition plan without credentials or private data. No merge, deployment, production state change or duplicate implementation task is requested.

@NewWorldVenture

Copy link
Copy Markdown
Owner Author

Reproducible composition finding against #969 57b9f3fdd7a88bd1b6c58cec4acc44f87d528d76 and active Claude #968 309bb8b3b78d0ddc78faedf6868adeb4933744d4:

#968 adds no SQL migration and therefore does not directly occupy this candidate's 0491 namespace. However, its new scripts/audit-migration-versions.mjs rejects every missing generation above retired high-water 0474. The existing #969 migration audit passes 450 files with nextVersion 0492; the #968 guard fails when composed with the same filename set.

Synthetic reproduction, without changing either author branch:

  1. Extract the exact Migrations land in release order, the audit is counted from its register, and a retired claim cannot come back from the database #968 guard into a disposable directory's scripts/audit-migration-versions.mjs.
  2. Obtain the 450 migration paths using git ls-tree -r --name-only 57b9f3fdd7a88bd1b6c58cec4acc44f87d528d76 supabase/migrations.
  3. Create empty filename-only fixtures at those paths (no SQL is executed).
  4. Run node scripts/audit-migration-versions.mjs in the fixture root.

Observed: exit 1; Migration filename audit: 450 numbered SQL files. followed by missing generations 0475 through 0490 and Migration audit failed: a migration is numbered out of release order. The next-version tests also disagree: 0475 on #968 versus 0492 here.

This is a future composition failure, not a failure of #969's current guard. Reconcile candidate numbering with the actual release sequence and rerun both guards against the composed source. Do not fill holes with fake migrations, take already reserved candidate numbers blindly, or rename production-applied migrations. Hosted migration-catalog compatibility is still unverified. Both candidates remain drafts; the active Claude branch is untouched.

The owner has now selected preserving existing messaging participants' access and creating an empty Family Chat. The authoritative current audit split is independently reconciled to 11,700 NOT STARTED / 2,485 IN PROGRESS; closure remains 344/14,538 (2.37%) without any row-status changes. The successor documentation records this decision and composition finding.

NewWorldVenture pushed a commit that referenced this pull request Oct 4, 2026
…ng map is labelled owner-directed

Review 5984812135: draft #969 publishes 0491_preserve_recurring_bill_anchor
beside #964's 0491 deadlock file. Both are recorded with their exact heads
as an unconfirmed collision. The 0475-0478 landing map is labelled as what
it is: directed by the repository owner in this session, with the
coordinator's request for cross-session confirmation noted, in the registry
and in the eight meal-row annotations.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KP9rt5rVQ9jDMpZp2xBy3K
@NewWorldVenture

Copy link
Copy Markdown
Owner Author

The migration-order finding above is repaired in this candidate at 17c14c98a69e0b68bf89a9bb85da1cee974d61dc. The unapplied bill anchor migration now takes 0475, immediately after current main high-water 0474. Historical reservations and the original 0491 source remain documented; no applied migration or active author's branch was renamed.

The unchanged strict guard from Claude #968 exact head d2a426ce307406b09777076139aafdfcc282e4f8 passes a disposable filename-only fixture of this successor: 450 files, no gaps, next 0476. Updated document/migration tests pass 602/602. The renamed exact DDL and its synthetic fixture replay twice in a fresh identity-verified PostgreSQL 17.10 cluster, preserving unknown legacy anchors and rejecting 0/32; that cluster was stopped.

The prior failure remains reproducible for the recorded old heads. The next separately tested messaging candidate is assigned 0476; any final composition must update its next-version expectation to the actual combined files. Current production catalog compatibility is still unverified. No hosted DDL or production configuration was changed.

Copy link
Copy Markdown
Owner Author

New source-level conflict at17c14c98a69e0b68bf89a9bb85da1cee974d61dc: the bill migration is now0475, while retained #834/#890 already publish other0475 candidates. The updated body also proposes messaging0476, whereas #968's proposed map assigns calendar0476 and messaging0477–0478. These two proposed landing maps disagree with each other, independently of the retained-branch collisions.

Please reconcile both proposed maps with the acknowledged #968 ledger writer and retain the closed-branch evidence in the registry. The cross-session numbering question is still awaiting the user here; a main/open-PR-only scan is not approval to release retained claims. Keep the candidate unapplied and identify exact ownership/baselines as requested in5984749314. No new migration application, production action or duplicate implementation is requested.

@NewWorldVenture NewWorldVenture changed the title Preserve calendar dates and monthly bill anchors Preserve chat audiences, calendar dates and recurring bill anchors Oct 4, 2026

Copy link
Copy Markdown
Owner Author

New exact-head gate at a31bd04: Messaging participant SQL contract run37240532233/job111548182907 failed at “Exercise actual SQL roles and separate concurrent sessions.” Please supply the exact synthetic assertion/cause and focused repair evidence before claiming this expanded messaging candidate is validated. Preserve the existing participant/history assertions; do not make the gate pass by dropping them. Use only already authorized local/CI evidence, with no restricted-log workaround or live database operation.

The newly published0476_preserve_messaging_participants.sql also makes the map conflict in5985019108 concrete. Keep the unresolved numbering and Family Chat policy confirmations separate from test success, and preserve retained candidate evidence. No new implementation owner, migration application, merge or deployment is assigned.

NewWorldVenture added a commit that referenced this pull request Oct 4, 2026
…ter, and a retired claim cannot come back from the database (#968)

* A migration lands in release order: retired holes stay retired, and no number is skipped

Production applies migrations with `supabase db push`, in version order, and
the CLI refuses a file numbered below the last version the remote ledger has
recorded unless it is given --include-all, which the production workflow does
not pass. A number below main's high-water mark that no file holds was being
treated as reservable, and that is how the closed branches came to collide:
#834 and #890 both held 0475/0476, #958 waited behind them on 0477, and
0488/0489/0490 each had to wait on the lower ones before they could ship.

The 43 holes at or below 0474 are now retired (RETIRED_MIGRATION_VERSIONS),
the reservations that left them released: work that once held one takes the
next free number when it lands. Above the mark the sequence has no gaps, so a
migration cannot skip a number to save it for later and leave a new hole.
The filename audit fails on either, naming the file and the number to use;
the test pins the retired list to exactly the numbers no file holds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KP9rt5rVQ9jDMpZp2xBy3K

* The audit summary is counted from its register, and the one-row drift is corrected

The "Current reconciled audit counts" section was a hand-kept tally that every
checkpoint carried forward with "no recount was performed", and two of them
disagreed: one said 11,701 NOT STARTED / 2,484 IN PROGRESS, another 11,700 /
2,485 after LIBRARY-2E628A2A31CE moved to IN PROGRESS. A row-by-row recount of
Register B gives 14,538 unique IDs = 11,700 + 2,485 + 185 PASS + 159 FIXED +
PASS + 9 BLOCKED, 344 closed (2.37%), with no duplicate ID and no status
outside the five.

scripts/audit-register-counts.mjs derives those numbers from the rows and
compares them with the summary; the test fails when the summary, the heading's
declared size or a row's status drifts, so the next checkpoint states what the
register holds instead of copying the last tally forward.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KP9rt5rVQ9jDMpZp2xBy3K

* Register evidence reconciled with main: every MAIN row re-run, citations that never landed named

The 112 MAIN-* rows rest on "historical evidence retained verbatim" from the
upstream appendix (57f22c0), last re-run on 2026-09-27/28. Each now carries a
2026-10-04 reconciliation on main 663d99d: the 80 test files those rows cite
(756 tests) pass together, and the database probes they cite pass in the CI
Database job on that commit (run 37231782229: replay from nothing, every
boundary probe, ledger-repair rehearsal).

Four rows cited evidence that never reached main, and now say so with the
guard main actually carries: MAIN-F-E03's two tests were only on unmerged
commit 68a5a7a (main's are a-family-media-reference-is-never-rendered-raw
and a-private-image-does-not-outlive-the-session); MAIN-F-E02, MAIN-F-K03 and
MAIN-I-01 cited probes from unmerged commits f6b27a3/0c4ad3d5c (main's are
the 0391/0382 step-up probes, member-location-owner-check and
social-restriction-delete-check).

Across all 1,598 test/probe files Register B cites, 10 more rows point at
files absent from main; all ten are IN PROGRESS, so no closure rests on
missing evidence. Each now names where its file lives (unmerged meal-plan,
#890 or repo-connect branches) or that it is on none of the 604 branches.

Every reconciled MAIN row also states the production qualification: the
production ledger records 0001-0176 only (run 37207015645), so a FIXED + PASS
whose fix is a migration from 0177 on is a repository verdict, not a
production one. No status changed; the counts are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KP9rt5rVQ9jDMpZp2xBy3K

* Production handoff: the numbering rule from 0475 on, and the admin digest's 0471/0474

0471 and 0474 landed on main without an entry in the production migration
handoff; they now have one (what each does, deploy order 0471 then 0474, the
probes that prove them in CI). The handoff also states the release-order rule
the filename audit now enforces: holes at or below 0474 are retired, the
reservations that left them released, and work that held one takes the next
free number when it lands.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KP9rt5rVQ9jDMpZp2xBy3K

* A retired claim cannot come back from the database: /mobile stops saying "native iOS"

After #967 shipped, production's /mobile still described "an installable app
with native iOS and Android companions" in its meta description, its Knowledge
Center answer and its FAQPage structured data. Those come from admin-edited
rows (marketing_seo_pages, marketing_pages, marketing_aeo_questions) that
migration 0229 seeded before the correction, and the store overrides the code.

The six claims retired on 2026-10-04 now live in lib/marketing/retired-claims.ts,
shared by the copy contract and the editorial readers. getSeoPage drops a title
or description that states one, so the page's code value is used; every AEO
reader (per path, per category, site-wide, and the page-payload fallback)
leaves such a question out. A true editorial override still wins. The seed
generator's /mobile description is corrected and the contract now scans it.
"free plan" gains a word boundary so the tracked keyword "free planner for
parents" is not mistaken for the claim.

The new test is red without the reader changes (4 of 6) and green with them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KP9rt5rVQ9jDMpZp2xBy3K

* Ledger history restored: #869's checkpoint, the overwritten 06:47 section, two rows' evidence and a Path

Review 5984508520 named four historical-preservation blockers on main's
finalaudit.md that predate this branch, and one error in it:

- #869's 10:44 UTC release checkpoint (head f55b7a2) never reached main:
  #869 closed unmerged. Its 103 lines are restored verbatim.
- #842 (squash 77d73ae) rewrote the 06:47 UTC source checkpoint's header
  in place as the 14:46 UTC one. The 06:47 section as published (ledger
  commit d1afa3c) is restored verbatim beside #869's, under one dated
  "Restored checkpoints" heading that says neither is a current status.
- LIBRARY-3E7235F73734's Notes and SUPPORT-E8F3F434DAC5's Tests, Retest and
  Notes were replaced rather than appended to. The earlier text (d1afa3c)
  is appended back to each cell, quoted, with its source.
- SUPPORT-454BB6ECF37C's Path had been replaced with prose by ac654fe; it
  is restored to supabase/migrations/0475_meal_plan_slot_writes_are_atomic.sql,
  and the absence of that file from main is stated in the Notes instead.

The correction: eight meal-row annotations said 0475/0478 were "retired
below the high-water mark". They are above it (the retired range ends at
0474) and are being taken on main by the month-end bill and messaging work;
the annotations now say so. The 112 production qualifications no longer say
a later migration "is not applied": the ledger does not record it, and the
ledger alone does not prove a schema effect absent.

No ID, status, severity or count changes; the register still reconciles
(14,538 = 11,700 + 2,485 + 185 + 159 + 9).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KP9rt5rVQ9jDMpZp2xBy3K

* Production handoff records every published branch migration candidate

Review 5984531842 asked that branch claims be recorded rather than inferred
from main. All 604 branches were read on 2026-10-04: 22 migration files
numbered 0465 or above exist only on branches, including #964's 0491 and the
colliding pairs at 0475, 0476 and 0477. They are listed with every branch that
carries them. Retiring the holes at or below 0474 deletes none of them; a
candidate that lands takes the next free number then, as the month-end bill,
calendar feed and messaging lanes do (0475, 0476, 0477/0478).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KP9rt5rVQ9jDMpZp2xBy3K

* Ledger: #842's overwritten Last Updated records restored, and #965's #779 evidence composed

Review 5984609845, as the designated ledger writer:

- #842 (squash 77d73ae) replaced seven dated "Last Updated" status lines in
  place: three from main as it stood before #842 (2026-10-01 09:10, 2026-09-27,
  2026-09-30 13:54) and four from the #842 branch at d1afa3c (2026-10-03
  06:47, 2026-10-02 19:01, 17:14 and 14:40). None appeared anywhere else in the
  file. Each is restored verbatim under "Restored Last Updated records", with
  the ledger version and line it came from; none is a current status.
- #965's ledger evidence at its head 0344101 (its one finalaudit.md hunk,
  the #779 dispatch-admission and release sections, 134 lines prepended to the
  top of the file) is composed here verbatim. #965 adding the same hunk later
  is an identical change and merges without conflict.

No register row, status or count changes (14,538 = 11,700 + 2,485 + 185 + 159
+ 9).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KP9rt5rVQ9jDMpZp2xBy3K

* Migration registry: the second 0491 (#969) is recorded, and the landing map is labelled owner-directed

Review 5984812135: draft #969 publishes 0491_preserve_recurring_bill_anchor
beside #964's 0491 deadlock file. Both are recorded with their exact heads
as an unconfirmed collision. The 0475-0478 landing map is labelled as what
it is: directed by the repository owner in this session, with the
coordinator's request for cross-session confirmation noted, in the registry
and in the eight meal-row annotations.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KP9rt5rVQ9jDMpZp2xBy3K

---------

Co-authored-by: Claude <noreply@anthropic.com>

Copy link
Copy Markdown
Owner Author

Independent read-path follow-ups at ef3a1a9, for existing owners with non-overlapping scopes:

  • Exact clock helper: offset normalization can admit UTC year0000/10000 although format/parse cannot round-trip it. Enforce one supported normalized range in parseExactInstant and formatExactInstant; test both year edges with offsets.
  • Service scheduling: findFreeSlots still calls BigInt(granularityMin*60000). 1.001 becomes60059.99999999999 and throws. Reuse the already-fixed exact decimal conversion from pure scheduling and test the exported service; default AI-tool granularity is unaffected.
  • Held source snapshot: source-snapshot.ts:240 still uses rounded millisecond bounds. A source09:00–10:00 disappears from a nonempty .000003–.000007 window; a source point at .000000 can enter a window starting .000001. Generate with safe outward bounds then apply exact final membership, including real sourceGroups fixtures rather than native-only rows with capability=true. Keep activation held.
  • Downstream spans/briefing: consumer-spans.ts:44–54 and display-spans.ts:45–66 truncate before day membership. An event ending just1µs after midnight disappears from the next day. first-brief.ts:169–173/265–283 also collapses positive sub-ms occupancy/clashes. Carry exact comparisons through membership, clipping and conflict decisions; add cross-midnight and positive sub-ms controls.

These are read-qualification gaps, separate from the retained write-precision hold. Existing pure scheduling repair and browser dependency changes were source-verified; no tests were rerun in this review. Existing card/schema requests remain open. Coordinate with current file owners before implementation; no parallel duplicate lane or activation change.

Copy link
Copy Markdown
Owner Author

Bounded residual for the existing relationship-calendar owner at 990ab7d: the civil-DATE/AI-label repair is supported by source review, but toggle creation/linking remains non-atomic and non-idempotent. Concurrent reads of an unlinked date can each create an event before overwriting the link; link refusal followed by retry can duplicate. The action supplies no idempotency key and link/unlink predicates lack captured calendar_event_id comparison.

Scope a source/test repair that makes retries converge on one relationship event and refuses stale link/unlink changes. Include concurrent toggles, link-failure retry and competing-link controls; preserve session-derived family/actor checks and canonical exclusive DATE endpoints. Do not use destructive cleanup of unrelated events or production schema changes. This predates the current commit and is separate from its verified date correction; current sequential tests do not establish concurrency safety.

Coordinate with existing ownership before implementation. Earlier precision tasks and hosted CI qualification remain open.

Copy link
Copy Markdown
Owner Author

New exact-head hosted blocker for the existing authenticated-bill owner: 990ab7d run37865850805/job113612503880 failed step23, the authenticated durable bill test after a fresh server. Smoke20, real-auth messaging RPC21 and isolated held-fixture22 passed; failure evidence upload and cleanup passed. Core, Database, Mobile and all six auxiliary workflows passed.

Inspect this phase’s uploaded failure evidence through authorized access and reproduce the specific bill scenario before changing code. Repair source or fixture without weakening assertions, skipping the phase or accepting stale-cache/partial totals. Publish the exact diagnosis, focused result and fresh CI. The failing scenario is not yet independently established from metadata; this is distinct from earlier smoke failures. Preserve held0488 and all production/policy holds.

@NewWorldVenture
NewWorldVenture merged commit 6d9d920 into main Oct 9, 2026
13 checks passed
NewWorldVenture pushed a commit that referenced this pull request Oct 9, 2026
…osed, carried by #969)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KP9rt5rVQ9jDMpZp2xBy3K
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants