For: Agon, Sead, Sven (CTO), Vince — lanes: A = Agon, B = Vince, C = Sead

Standard per card: Context · Read first (paths) · Deliverables (files, endpoints, tables, routes by name) · Interfaces (consumes / exposes) · Steps · Acceptance (a command or artifact someone else can verify) · Out of scope · Waits on / Unblocks.

Repo conventions used below: monorepo Rescale-Media/skynet; apps/api = the static-ads FastAPI backend (today static-ads-automation/app/backend + app/pipeline), apps/web = its Vite/React frontend (today app/frontend), packages/contracts, services/scraper|transcriber|agent-runtime|workos, infra/, db/migrations/unified/<schema>/NNN_*.sql, docs/. Until A1a lands, paths below map 1:1 to the source repos named in each card. Tests: pytest apps/api/tests, pnpm --filter <pkg> test, pnpm vitest in workos. Sizes: S ≤ ½ d · M ≈ 1 d · L ≈ 2 d.

Lane C — Sead (Data spine & Bridge)

S0a · Scrubbed-import prep for workos · S · chore/s/s0a-scrub-workos (with Sven)

Context. The rescale-workos repo has live credentials committed on purpose (co-founder handoff). The monorepo import (A1a) must not carry one of them. Decision already taken: no rotation now; credentials are discontinued when workos leaves Railway (S17, S4).

Read first. rescale-workos/CLAUDE.md lines 40–82 (## Access and credentials: ClickUp, AI/comms, Google, Postgres, Railway); rescale-workos/.gitignore lines 1–11 (says credentials are committed; secrets/ is NOT ignored); rescale-workos/secrets/ (≈110 tracked files — SESSION-PRIMING.md, google-service-account.json, field-create.curl, automation-group.curl, apply-migration-00{2,3,4,6}.mjs, ecomprofits-role-test.mjs, reseed-globals-2026-07-09.ts, p*/w*-*.mjs probes); rescale-workos/service/.env.example (the env names, no values).

Deliverables. (1) docs/security/workos-credential-inventory.md in the old repo (private): one row per credential — name, where it lives today (CLAUDE.md line / secrets file / Railway variable), owner, discontinuation date S17. No values in the doc. (2) Under infra/secret-scan/, create both gitleaks.toml and patterns.txt. gitleaks.toml is the single config used by both the manual scan and the pre-commit hook; it must include the stock gitleaks rules plus the custom patterns from patterns.txt (one custom regex per known value: first 8 characters + length, never the value). (3) The scrubbed working tree: rescale-workos checkout with secrets/ removed, CLAUDE.md lines 40–82 replaced by one paragraph "Credentials live in Railway variables and the 1Password vault Rescale workos; the old repo stays private as the archive until S17", .gitignore gaining secrets/, *.pem, *.key kept. Hand the tree's path to Agon. (4) Pre-commit hook config (.pre-commit-config.yaml with gitleaks using the pattern file) ready for A1b.

Interfaces. Exposes the scrubbed tree + pattern file to A1a/A1b.

Steps. Inventory with Sven (30 min) → write patterns → gitleaks detect --source <scrubbed-tree> --config infra/secret-scan/gitleaks.toml → fix until zero hits → grep the tree for each first-8-chars → hand over.

Acceptance. Paste in the TechDesk task: (a) gitleaks detect output on the scrubbed tree = 0 findings; (b) a deliberate test commit containing one known value is rejected by the pre-commit hook (terminal output); (c) inventory doc link.

Out of scope. Rotating anything; Railway changes; the monorepo import itself (A1a).

S1a · Core auth + workspaces + contract · M · feat/s/s1a-core-auth

Context. One login for every surface. Core issues RS256 tokens; every other service only verifies. This is the first cross-lane blocker: V1, V2a, V6b, A3, A5-lite all consume it.

Read first. Lock doc §4.1 (the contract — claims, cookies, refresh rotation, tv logout propagation, service tokens, legacy mapping); static-ads app/backend/auth.py (today's create_token, get_current_user L61–67 reading Bearer or ?token=, token_version check L74–88); app/backend/main.py L75 (auth.router at /api/auth) and L78 (auth_dep); app/backend/db.py (get_pool, get_cursor); schema.sql users table.

Deliverables.

1. Migration db/migrations/unified/core/001_core.sql: core.workspaces(id uuid pk, slug unique, name, settings jsonb, created_at), core.users(id uuid pk, email citext unique, name, password_hash, token_version int default 0, is_active bool, created_at), core.permissions(key text pk, module, action, description), core.roles(id uuid pk, workspace_id uuid null, key, name, is_system bool default false; unique key where workspace_id is null; unique (workspace_id, key)), core.role_permissions(role_id, permission_key, pk both), core.workspace_members(workspace_id, user_id, pk both), core.workspace_member_roles(workspace_id, user_id, role_id, pk all three) — roles are data, a member may hold several, effective permissions = union of allows (no deny rules), core.refresh_tokens(id uuid pk, user_id, family_id uuid, token_hash, expires_at, revoked_at, replaced_by uuid), core.feature_flags(workspace_id, key, enabled bool, pk(workspace_id,key)), core.schema_migrations(version text pk, checksum text, applied_at). Seed: workspace rescale, admin user from ADMIN_EMAIL/ADMIN_PASSWORD; the six system roles admin, strategist, media_buyer, editor, researcher, viewer and the S1 permission catalogue: admin.workspace.manage, admin.members.manage, admin.settings.manage, admin.audit.read, intelligence.read, intelligence.write, intelligence.teardown.run, intelligence.research.promote, studio.read, studio.write, studio.approve, production.read, production.write, production.export, workspace.read, workspace.launch.write, performance.read with the role → permission mapping in packages/contracts/auth/README.md.
2. Module apps/api/core/auth/: keys.py (load AUTH_JWT_PRIVATE_KEY_PEM/PUBLIC, kid = sha256 prefix), tokens.py (issue_access(user, ws) → jwt, issue_refresh, rotate_refresh, revoke_family, issue_service(name, ws)), verify.py (verify_access_token(token) → Claims, checks kid, exp, typ, iss, and tv against a 60-s cached lookup), deps.py (current_user, require_permissions(*keys) — every route gate checks permissions, never role names; require_roles(*roles) exists only as a thin compatibility shim during the port), router.py.
3. Routes under /api/auth: POST /login {email,password} → sets rs_access (12 h) + rs_refresh (30 d, path /api/auth) cookies, HttpOnly/Secure/SameSite=Lax, Domain = exact host from PUBLIC_HOST; POST /refresh (rotation; reuse of a revoked token revokes the family); POST /logout (revokes family, bumps token_version, clears cookies); GET /me → {id, email, name, ws, ws_slug, roles, permissions, feature_flags?} for the current session (roles = the member's role keys; permissions = the effective union resolved server-side with a short cache — the canonical source for UI gating; the JWT carries roles only, never permissions) — the canonical shape V2a/V6 use for the workspace switcher and route gating; GET /jwks; GET /session-token (returns the current access JWT as JSON for the static-ads bridge, same-origin only); GET /tv/:sub (internal, service token); POST /service-token (admin only).
4. packages/contracts/auth/: access-claims.schema.json, service-claims.schema.json, samples/ (valid, expired, wrong-kid, revoked-tv — signed with a test keypair committed under samples/test-keys/), verify.py, verify.ts (jose), verify.node.cjs, and README.md (claim table + cookie table + legacy role mapping).

Interfaces. Exposes the cookie names, claims, JWKS, /session-token, /tv/:sub. Consumed by V1, V6b, A5-lite, A3, X1.

Steps. Migration → keys/tokens → routes → contracts package + samples → tests → README.

Acceptance. pytest apps/api/tests/core/test_auth.py green (login sets both cookies; refresh rotates; reuse revokes family; logout bumps tv; /me 401 after logout); python packages/contracts/auth/verify.py packages/contracts/auth/samples/*.jwt and node packages/contracts/auth/verify.node.cjs packages/contracts/auth/samples/*.jwt print the same 4 verdicts (valid / expired / wrong-kid / revoked-tv). Post both outputs.

Out of scope. Invite/magic link/reset (S1b); users UI (V11); RLS.

S1b · Invite / magic link / reset + user import · M · feat/s/s1b-users

Context. Existing users of static-ads, the scraper admin, and the console must sign in at the terminal go-live (X7; the S1 exit gate until 2026-09-19) without a new password ceremony run by hand.

Read first. S1a routes; static-ads schema.sql users (email, display_name, is_admin); scraper meta_ads.admin_users (email, role admin|user); console users table (RescaleOS/console/src/db/client.ts, roles in src/lib/roles.ts); lock doc §4.1 legacy role mapping.

Deliverables. (1) core.auth_tokens(id, user_id, kind ∈ invite|magic|reset, token_hash, expires_at, used_at); routes POST /api/auth/invite (admin), POST /api/auth/magic-link, POST /api/auth/reset/request, POST /api/auth/reset/confirm, GET /api/auth/accept?token= (validates the token and returns {email, kind, expires_at} only), POST /api/auth/accept {token, password} (sets the password for invite/reset, marks the token used, signs in, sets both cookies). (2) apps/api/core/scripts/import_users.py: reads the three user tables (connection strings via env), dedupes by lower(email), creates core.users (inactive until accepted) + workspace_members with roles: static-ads is_admin→admin; if INTELLIGENCE_OWNER_EMAIL is set and the email is in that allowlist (static-ads derives can_see_intelligence from env, auth.py L33 — it is not stored), also add researcher; scraper admin→admin, user→researcher; console editor→editor, creative_strategist→strategist (RescaleOS/console/src/lib/roles.ts L4); everyone → viewer. Writes docs/ops/user-import-<date>.csv (email, sources, roles, invite sent y/n). (3) Emails go through M3's mailer; until M3 lands, the script prints the accept URLs.

Interfaces. Consumes S1a; M3 for sending.

Steps. Table + routes → import script against dumps → dry-run report → tests.

Acceptance. pytest apps/api/tests/core/test_users.py green (invite → accept → login; expired token 410; reset flow); python apps/api/core/scripts/import_users.py --dry-run on the three real dumps prints N users, 0 duplicate emails, and the CSV; post the CSV summary (counts only).

Out of scope. Sending emails (M3); role editing UI (V11).

Amended 2026-09-19 (the owner's decision: production at the terminal go-live). The old users sign in at the terminal go-live (X7), not at the S1 exit gate. The staging import and the dry-run proof in the acceptance above stand as S1 work.

S1c · The deployed stack's request-origin posture: one mutation boundary, one CORS allowlist · M · W6 · feat/s/s1c-request-origin-posture (S1-rev)

Context. Two gaps X1 found, which are one decision. (1) enforce_same_origin (app/core/auth/deps.py) is a CALL inside the handlers that remembered it: every mutating route of the core surface calls it, and NOTHING under app/backend/routes/ or app/backend/intelligence_v2/routes/ does — 169 mutating routes in total — while POST /api/auth/service-token takes no Request parameter at all and so cannot examine an origin. docs/AUTH_SESSION.md § 4 states the limitation in writing and names the fix as one decision rather than a route-by-route sweep, "the kind of partial fix that leaves exactly one hole"; what holds meanwhile is real but narrower — SameSite=Lax cookies and the SPA's Bearer header. (2) CORS_ORIGINS (app/backend/main.py) defaults to two localhost origins with allow_credentials=True and appears in no deploy template, so a deployed stack's allowlist is inherited from dev rather than decided.

Read first. app/core/auth/deps.py (enforce_same_origin: hostname-only, PUBLIC_HOST or the request's host, the deliberate pass for a request with neither Origin nor Referer); app/backend/main.py (the middleware stack and its ordering comment, the CORS_ORIGINS read, the router mounts, the static mount and the SPA catch-all); every caller of enforce_same_origin (core auth, bindings, admin bindings, creative codes, lineage) and GET /api/auth/session-token, whose guard is NOT replaceable by a mutation middleware; apps/api/supervisord.conf (uvicorn runs with no --proxy-headers) and infra/caddy/Caddyfile (the api is proxied), which is why the comparison anchors on configuration, not on request.url; infra/scripts/env.sh (the stage checks for PUBLIC_HOST / PUBLIC_ORIGIN), infra/deploy/required-keys.txt, the three infra/env/*.env.example; infra/smoke/run.sh and infra/synthetic/check.sh (the headerless callers); e2e/auth-policy.spec.ts; docs/AUTH_SESSION.md § 4.

Deliverables.

1. One app middleware over POST, PUT, PATCH and DELETE, with no path special-casing, so a router added later cannot be forgotten: it covers the core, Production and Intelligence-v2 mounts alike. In source it goes BEFORE CORSMiddleware so CORS wraps the refusal (the file's own ordering comment: the last added is outermost), and the request logger stays outermost. OPTIONS is not in the set — preflight stays entirely CORS's.
2. The rule the middleware applies, in deps.py beside the existing helper so both share it: a request carrying neither Origin nor Referer passes (a non-browser caller; the smoke gate's two POSTs and every server-to-server call are exactly this); with PUBLIC_ORIGIN set — every deployed stage, required-keys.txt — the header's scheme, hostname and effective port are compared against the parsed PUBLIC_ORIGIN, default ports normalised; with it unset (dev, tests) the comparison stays hostname-only against PUBLIC_HOST or the request's host; a header that does not parse as an origin is refused. The anchor is the configured origin, never request.url: uvicorn runs without --proxy-headers behind Caddy, so the app sees http and port 8000 while the browser sent https — an exact origin built from the request would refuse every browser mutation on a deployed stack. Adding --proxy-headers is a separate trusted-proxy decision (A3's surface) and is NOT part of this card.
3. The redundant in-handler calls removed from the mutating handlers, including the shared redemption path — no handler can run earlier than middleware, and POST /api/auth/login improves by it: today its rate-limit bucket increments BEFORE the origin check. GET /api/auth/session-token keeps its own call: it hands the cookie token into the Bearer / ?token= bridge and promises same-origin only, and a middleware scoped to mutations cannot cover a GET.
4. No exemptions. The smoke gate's login and service-token POSTs are headerless curl; the synthetic sidecar, the deploy probes, the ?token= media bridge and the SSE streams are GETs; Canva's callback is the SPA's own same-origin POST with its state cookie checked independently; the workos bridge is outbound from Skynet; POST /api/usage already serves headerless service callers. A server caller that starts sending a foreign Origin SHOULD be refused.
5. The CORS allowlist as a decision: explicit CORS_ORIGINS in all three templates (dev = the two local origins; staging = https://staging.app.rescale.media; prod = https://app.rescale.media), and — when PUBLIC_HOST is non-blank, the established deployed marker (dev and the test conftest leave it blank) — the api REFUSES TO START unless PUBLIC_ORIGIN parses and CORS_ORIGINS is exactly that one origin, raised where cors_origins is read so the container never binds, the healthcheck fails and the deploy stops before its smoke gate. The same check in env.sh beside its PUBLIC_HOST / PUBLIC_ORIGIN stage rules, as defence in depth.
6. docs/decisions/ADR-013-request-origin-posture.md — the mutation boundary as middleware, the configured-origin comparison and why not request.url, the headerless pass, no route exemptions, the deployed CORS equality, and the login ordering the change fixes. docs/AUTH_SESSION.md § 4 rewritten to state the guarantee the code now makes and to keep the session-token GET guard distinct. docs/ops/s1c-acceptance.md.

Acceptance. pytest apps/api/app/backend/tests green, including new cases: a foreign Origin on a Production route, on an Intelligence-v2 route and on POST /api/auth/service-token is 403; the same requests with no Origin and no Referer pass; a Referer from the right origin passes and from a foreign one is refused; a header that does not parse is refused; on a stack with PUBLIC_ORIGIN set, an Origin differing only in scheme or port is refused, and one differing only in a default port is accepted; GET /api/auth/session-token still refuses a foreign origin; every OPTIONS preflight still answers from CORSMiddleware. Boot: with PUBLIC_HOST set and CORS_ORIGINS blank, or not equal to PUBLIC_ORIGIN, importing the app raises; with them consistent it starts; with PUBLIC_HOST blank nothing is required. bash infra/scripts/env.sh staging refuses the same two shapes. e2e/auth-policy.spec.ts gains a Production-route foreign-origin case. The full api suite and ci green.

Out of scope. --proxy-headers / ProxyHeadersMiddleware and anything else in the trusted-proxy surface (A3); rate-limit changes beyond the ordering the middleware gives for free; the ?token= bridge's own design (X1's record); any CORS behaviour for a caller that is not the SPA.

Waits on / Unblocks. S1a (S), X1 (A) / an auth posture docs/AUTH_SESSION.md can state without a caveat.

S1d · A migrated account's first contact: the mail it receives, and what its old password does · L · W6 · feat/s/s1d-migrated-first-contact (S1-rev)

Context. Discovered by M6 (open item #44). app/core/scripts/import_users.py creates every legacy user inactive with no password and mints an invite token, and app/core/mail/templates.py renders "You have been invited" — to someone who has used the old tool for months. Their old password meanwhile answers the same generic 401 as a typo (_load_user_by_email filters is_active in SQL), so nothing tells them to look in their inbox; and after the invite's seven days they have no rail at all — /magic-link and /reset/request filter is_active too, a re-run of the import never re-mints, only admin POST /invite does, and the SPA has ONE control before V2b lands: the email/password form at /login (routes.tsx has /login only; LoginPage.tsx's footer is static). Three more facts shape the fix. Every static-ads user's real bcrypt sits in production.users.password_hash on the unified database after the restore (SSO-created rows carry a random sentinel), and the core router already reads that table by email. The two 202 routes mint INLINE and defer only the send, so docs/SECURITY.md's latency sentence overclaims. And the import cannot start inside the api image (REPO_ROOT = Path(__file__).resolve().parents[5] raises IndexError under /app/app/core/scripts/), while seed_core --import-legacy copies the old hashes into ACTIVE rows — the one path that makes an old password sign in. ADR-001 §5's anti-enumeration rule is what makes the login half a design question rather than a wording change.

Read first. app/core/auth/router.py (/login, /invite, /magic-link, /reset/request, _accept, _legacy_user_id); app/core/auth/auth_tokens.py (_TTL, mint's same-kind revoke, preview); app/core/auth/delivery.py; app/core/mail/templates.py and mailer.py; app/core/scripts/import_users.py and seed_core.py; app/backend/auth.py (_legacy_user_for_claims); app/core/db.py and app/backend/db.py (the two pools); db/migrations/unified/core/002_auth_tokens.sql (the kind CHECK); production/001_baseline.sql (the legacy users table); apps/api/Dockerfile (where the scripts live in the image); tests/core/test_users.py, test_mail.py, test_auth.py, test_migrate.py, conftest.py; ADR-001 §1, §2, §5; docs/SECURITY.md § Auth links and logs; docs/comms/creative.md; docs/ops/m6-acceptance.md, v1-acceptance.md, s1b-acceptance.md, m3-acceptance.md.

Deliverables.

1. A fourth token kind, migrate. core/012 widens the CHECK; _TTL gives it the invite's seven days (the link is credential-equivalent and the recipient did not ask for it; the person away for longer is served by the rails below, not by a longer credential); templates.KINDS gains it with its own copy — subject "Your account has moved", a lead that says the account moved without its password, on purpose, button "Set a password", no "If you did not ask for it" sentence, no tool named; _accept activates on it exactly as on invite; GET /accept returns the kind so V2b's page can word itself.
2. The onboarding family. invite and migrate are auth_tokens.ONBOARDING_KINDS: mint_onboarding(user_id, kind) supersedes every pending token of BOTH kinds (one live onboarding link per account), the generic mint keeps its same-kind contract for magic and reset and refuses an onboarding kind, and the account's onboarding kind is the newest row of the family in any state (ORDER BY created_at DESC, id DESC) — the token history is the durable marker, no column on core.users. POST /invite mints that kind when it is migrate and invite otherwise, and reports it as kind.
3. /login answers every miss the same on the wire, and a pending owner's old password re-sends the mail. The lookup is every row for the address; a sign-in still needs an active row with a stored hash that matches. Every miss does the same work before its 401 — one legacy read of production.users by lower(email) (best effort; a failure counts as no hash) and exactly one bcrypt: the account's own hash, else the legacy hash, else a module-level dummy of the same cost — and answers the same status, headers and bytes. When the candidate is PENDING (is_active = FALSE AND password_hash IS NULL) and the LEGACY hash matched, the onboarding mail is re-sent AFTER the response: the old password is proof of ownership for a re-delivery to the account's own inbox, never a credential. The guarantee is the wire response; latency is not promised.
4. /magic-link and /reset/request serve a pending account and become latency-silent. The decision is the handler's (an active account gets its magic link or reset, a pending one its onboarding mail again, an unknown address nothing); the MINT and the send run in the background task for every case, so the routes do the same work before the 202 and docs/SECURITY.md's sentence becomes true.
5. The task. Its own cursor; one of AUTH_TASK_SLOTS (default 2) held for its whole run by a NON-BLOCKING acquire — every slot busy → dropped and logged, the request already answered; every exception caught and logged by type name only; an invalid AUTH_TASK_SLOTS refuses at import. The re-send itself is auth_tokens.renew_onboarding: one transaction under a per-account advisory lock — the row still pending, the account's kind, the cooldown (AUTH_RESEND_COOLDOWN_SECONDS, default 3600, on the database's clock; inside the window nothing is minted and the inbox link stays valid; 0 disables), then the family superseded and a fresh token of that kind. The anonymous re-send is delivered with relay_by_hand=False: in the OFF and DRY_RUN mailer modes its link is dropped, never logged; the import's and the admin's sends, and an active account's magic/reset links, keep M3's relay.
6. The import mints migrate and runs in the container. REPO_ROOT deleted; --report <path> REQUIRED (the runbook row bind-mounts a host directory); the stdout marker migrate <email> <url>; the CSV column mail sent. seed_core --import-legacy retired with import_legacy_users.
7. Docs. docs/decisions/ADR-015-migrated-first-contact.md (amends ADR-001 §5); docs/SECURITY.md § Auth links; docs/AUTH_SESSION.md § 3; docs/comms/creative.md (the mail's name; a typed old password sends a fresh copy); docs/INTEGRATION_CHECKLIST.md row 13b; docs/GO_LIVE.md § 3 step 9b and docs/CUTOVER.md § 3 row 9b (the import runs after the restore and after the DNS flip, before the comms; the exact compose run line with the --report mount); apps/api/CLAUDE.md env rows; the three infra/env/*.env.example; docs/ops/m3-acceptance.md and m6-acceptance.md pointers; docs/ops/s1d-acceptance.md; open item #44 closed.

Acceptance. pytest apps/api/app/backend/tests green, including tests/core/test_migrated_first_contact.py: login by an unknown email, a pending migrated row, a pending invited row, an active row with a wrong password and a pending row with the RIGHT old password → one status, identical headers and identical bytes; exactly one bcrypt and one legacy read per miss, and no miss reaches the session issuer; a legacy hash that is not bcrypt is a miss, not an error; the legacy pool unreachable changes nothing on the wire; the owner's old password → exactly one migrate re-send, after the response, never relayed, the earlier link 410 and the new one 200; a wrong old password, no legacy row, an active row with a legacy row, and no onboarding history → none; inside the cooldown nothing is sent and the earlier link still previews 200, after it the link rotates, the window restarts from the re-send, 0 disables, and the window reads the whole family; an expired newest token re-sends, and an invited account is re-sent invite; the re-send uses the account's canonical email; an admin re-invite of a migrated account answers kind: "migrate" and revokes the older link while an invited account stays invite; the two kinds supersede each other in both directions and mint refuses them; the account's kind is the newest row by created_at then id, None with no history; five concurrent triggers yield one token and one answer; a row no longer pending renews nothing; a task is dropped when every slot is busy and served when one frees; a failing delivery and a failing database call are logged by type name only, with no secret marker in any record, and free the slot; the anonymous re-send logs no link in the OFF and DRY_RUN modes while the operator's send still relays; AUTH_TASK_SLOTS must be a positive integer; the 202 routes re-send migrate for a pending row after the response, mint an active row's magic/reset in the task (no token row when the 202 is written) and answer one body for pending, unknown and active; an imported account's mail says it moved, previews kind == "migrate", accepts a password, signs in, and the link is single-use; core/012 admits the fourth kind and refuses a fifth; seed_core refuses --import-legacy; the import module imports from a path shallower than six parents and refuses to run without --report. The full api suite and ci green. Live half (pending #26, #27): checklist row 13b on staging — a staging import delivers "Your account has moved" to the sandbox inbox, and a login with that user's old password re-sends it.

Out of scope. Any /login page text, form or "resend" control (V2b, open item #27 — a generic notice on every failed login is a V2b hand-forward); an admin pending / resend control (V5); persisting the import's sources on core.users (nothing reads it, and the mail may not name the tool — ADR-001 §2); a per-account lockout; S12's restore semantics and a production/003 re-run for accounts created after the restore (a hand-forward); timing indistinguishability on the login miss.

Waits on / Unblocks. S1b (S), M3 (A) / the first impression every existing user gets at go-live; M6's comms pages can name the mail.

S3 · Creative-code service · M · contract-wave schema first · feat/s/s3-creative-codes

Context. The creative code is the wire that closes the loop: Production stamps it, the ad name carries it, ecomprofits parses it back. There is exactly one generator today, in workos. Skynet must produce byte-identical codes and must draw seq from the same counter, or codes collide.

Read first. Lock doc §4.2; workos service/src/modules/naming/creative-code.ts (buildCreativeCode(parts) L84, variantLetter, kindFromFormat, isTeamMade, teamMadeFromCode), sequence.ts (nextSequence(db, productNumber, codeType) L18 → select rescale_service.next_naming_seq($1,$2)), migrations/001_sequence_counter.sql; workos assemble.ts (assembleAdName, AD_REQUIRED L93–109) and __fixtures__/naming-conventions.ts (META_AD_V3); ecomprofits packages/features/naming-conventions/src/lib/parser.ts (parseNameWithRules(sourceName, rules) L18) and the live rule set for the Rescale Meta account (export it with select rules from naming_conventions where account_id='48810a93-baae-4bc3-b562-5cf8814f0edf' and integration_type='meta' and entity_level='ad' and is_active; and save it as packages/contracts/creative-code/ecomprofits-meta-rules.json).

Deliverables. (1) Migration db/migrations/unified/core/002_creative_codes.sql: core.creative_codes(code text, workspace_id uuid, product_number text, kind text check (kind in ('RC','TM')), team_made bool, seq int, variant text, asset_id uuid null, asset_key text null, asset_type text, session_id uuid null, issued_at timestamptz, issued_by uuid, naming_version text default 'v3', unique (workspace_id, code)). (2) apps/api/core/creative_codes/generator.py: a line-for-line port of buildCreativeCode + variantLetter + kindFromFormat + isTeamMade (same errors). (3) sequence.py: next_seq(product_number, kind) executing select rescale_service.next_naming_seq(%s,%s) on the ecomprofits connection with the rescale_service role (env ECOMPROFITS_WORKOS_URL), inside the same transaction as the insert — no local counter, ever. (4) Routes: POST /api/creative-codes {product_number, kind, team_made, variant?='A', asset_type, session_id?} → {code, seq}; GET /api/creative-codes/:code; POST /api/creative-codes/:code/iterate → next variant letter, same seq. (5) packages/contracts/creative-code/: schema.json, normalize.py/normalize.ts (normalize_creative_code: upper-case → RCi/TMi casing restored, \s*(hook|_HK)\s*(\d) → hook N, trim), fixtures live-samples.json (≥30 real nc_creative_code values from meta_ads_dashboard_view, including RCI31-A_HK 1), and cross-check.json (1,000 random CreativeCodeParts + the TS output). Add the helper script service/scripts/dump-creative-codes.ts in the workos repo in this card (it does not exist yet) to generate that fixture from service/src/modules/naming/creative-code.ts; after A1a the same file lives at services/workos/scripts/dump-creative-codes.ts.

Interfaces. Exposes the routes + the normaliser. Consumed by V7 (stamp), S7 (readback key), S8 (launch task field).

Steps. Contract wave: schema + fixtures merged first. Then generator port + cross-check test → sequence via ecomprofits → routes → parser round-trip test.

Acceptance. pytest apps/api/tests/core/test_creative_codes.py green: (a) 1,000/1,000 cross-check parts produce the TS string; (b) 20 issued codes placed into a v3 ad name (fixture META_AD_V3 layout) parse with the exported ecomprofits rules and creative_code round-trips; (c) two concurrent issues for the same product get distinct seq (test against a scratch rescale_service schema); (d) normaliser maps every live sample to canonical form. Post the test output.

Out of scope. Ad-name assembly (workos endpoint, S8); RescaleOS ad names (A12, S3); changing the grammar.

S4 · Lineage + outbox (minimal) · S · feat/s/s4-lineage-outbox

Context. The S1 exit gate must show the chain session → concept → asset → export → code → performance for one real ad. Only Production (V7) and readback (S7) write to it in S1.

Read first. Lock doc §4 (contract 3); technical plan §2.4.3.

Deliverables. Migration 003_lineage.sql: core.lineage_nodes(id uuid pk, workspace_id, type text check (type in ('session','concept','asset','export','creative_code','launch','performance','winner')), ref_id text, attrs jsonb, created_at), core.lineage_edges(from_id, to_id, relation text, pk(from_id,to_id)), core.events_outbox(id bigserial, workspace_id, type, payload jsonb, created_at, processed_at null). Module apps/api/core/lineage/: POST /api/lineage/nodes (batch: nodes + edges, idempotent on (workspace_id,type,ref_id)), GET /api/lineage/chain?type=creative_code&ref=<code> → ordered chain (both directions, depth ≤ 8), poller skeleton outbox.py (marks processed, no consumers yet). packages/contracts/lineage/schema.json + fixture chain.

Interfaces. Consumed by V7 (writer), S7 (writer), V10 (reader).

Acceptance. pytest apps/api/tests/core/test_lineage.py: insert the fixture chain → GET /chain?type=creative_code&ref=TMi2-A returns session→concept→asset→export→creative_code→performance in order; re-posting the same batch creates no duplicates.

Out of scope. Scraper/studio/workos producers, inbox, coverage store (S14/S15, S3).

S4b · Bindings / spend-guard contract artifact · S · feat/s/s4b-bindings-contract

Context. Vince builds V4 (tables + evaluation) and every sidecar will post usage. The contract must exist before the code so consumers build against fixtures.

Read first. Lock doc §4 contract 4; technical plan §2.4.4; V4 spec below (tables).

Deliverables. packages/contracts/bindings/: binding.schema.json (GET /api/bindings/:workflow response: {workflow_key, provider:{kind, base_url}, model:{slug, modality}, config:{…}, paused:bool, guard:{window_hours, warn_usd, pause_usd, spent_usd}}), usage-event.schema.json (POST /api/usage: {workspace_id, service, workflow_key, model, tokens_in, tokens_out, cost_usd, request_id}), spend-guard-states.md (ok → warn → paused → resumed, who can resume), fixtures (one per state), consumer tests: Python (apps/api), Node (services/scraper, services/agent-runtime — a 10-line client each that validates against the schema).

Acceptance. pnpm --filter contracts test green; the three consumer tests import the fixtures and pass.

Out of scope. The implementation (V4), the admin UI (V5).

S5a · Ecomprofits read layer · M · feat/s/s5a-ecomprofits-read

Context. Performance comes back from ecomprofits by creative code. If the columns or formulas are wrong, the "closed loop" is fake. All facts below are verified against the ecomprofits schema.

Read first. Lock doc §4.3 (contract); ecomprofits apps/web/supabase/schemas/27-meta-ads.sql (meta_ad_insights L383–484, meta_intraday_ad_insights L620, combined_meta_ad_insights L919, meta_ads.parsed_naming L211–244), 40-dashboard-views.sql (readonly grant loop L304–312, role list at L309; klaviyo loop L1514–1522, L1519), 39-ads-performance-unified.sql; packages/features/meta-ads-sync/src/lib/business-logic.ts L257–297 (calculateWinnerLoserStatus). For the readonly-role pattern, copy the existing claude_readonly grant style already present in 40-dashboard-views.sql and 27b-meta-ads-breakdowns.sql; do not look for a separate credentials doc.

Deliverables.

1. Migration db/migrations/unified/core/004_integration_credentials.sql: core.integration_credentials(workspace_id uuid not null, provider text not null, account_id text not null, credential_json jsonb not null, created_at timestamptz default now(), updated_at timestamptz default now(), primary key (workspace_id, provider)). For ecomprofits store provider='ecomprofits', account_id = the ecomprofits account id, and credential_json keys readonly_url and meta_account_id.
2. Role skynet_readonly on ecomprofits Postgres (created out-of-band like claude_readonly; password to the vault) + ecomprofits PR: add 'skynet_readonly' to the rolname in (...) lists at 40-dashboard-views.sql L309 and L1519 and to 27b-meta-ads-breakdowns.sql loops; new declarative file apps/web/supabase/schemas/44-skynet-read.sql with the view below + grant select … to skynet_readonly; migration via pnpm --filter web run supabase:db:diff -f skynet_read.
3. View public.skynet_creative_daily (security_invoker): from combined_meta_ad_insights i join meta_ads a on (a.meta_account_id, a.ad_id) = (i.meta_account_id, i.ad_id); columns account_id, ad_account_id, ad_id, date, creative_code_raw = a.parsed_naming->>'creative_code', product_number = a.parsed_naming->>'product_number', market = a.parsed_naming->>'market', spend_native = amount_spent, spend_eur = amount_spent_eur, impressions, reach, three_second = video_plays, thruplay = video_thruplay_watched, link_clicks, purchases, purchase_value_eur, cost_per_purchase_eur, cpp_meta = cpp, breakeven_roas, seven_day_spend_eur, seven_day_purchases, seven_day_purchase_value_eur, seven_day_roas, seven_day_eligible, winner_loser_status, creative_hit, updated_at.
4. apps/api/core/readlayer/: client.py (connection from core.integration_credentials where provider='ecomprofits': credential_json->>'readonly_url', scoping id = account_id), queries.py (creative_daily(account_id, codes[], date_from, date_to) — always where account_id = %s), metrics.py (hook_rate = three_second/impressions, hold_rate = thruplay/three_second, roas = purchase_value_eur/spend_eur, cost_per_purchase_eur = spend_eur/purchases; None on zero), normalize from S3 applied to creative_code_raw → creative_code.
5. packages/contracts/metrics.md (formulas, column provenance, currency rule: EUR reporting, native for display).

Interfaces. Consumed by S7 (readback), V10 (winners view).

Steps. Role + grant PR (ecomprofits, Sead owns) → view → client/queries → fixtures from a frozen sample (3 ads × 7 days, exported to apps/api/tests/fixtures/ecomprofits_sample.json) → staging read of real data.

Acceptance. pytest apps/api/tests/core/test_readlayer.py green on the fixture; PR description contains a table: 3 known ads × 1 day with hook/hold/ROAS/cost-per-purchase from this module beside the same numbers from the ecomprofits Meta dashboard (meta-ads.tsx holdPct, meta-master.tsx hookRate) — equal to 2 decimals; a query without account_id fails a unit test.

Out of scope. Winner/loser evaluation (S5b/S9, S3); Pinterest/Taboola; writes.

M3 · Email delivery · S · W6 · Agon · feat/a/m3-email (S1-rev)

Read first. ecomprofits packages/mailers (MAILER_PROVIDER ∈ nodemailer|resend, env EMAIL_*, RESEND_API_KEY); apps/api/app/core/auth/delivery.py (the seam), router.py (the three routes that mint links), scripts/import_users.py.

Deliverables. apps/api/app/core/mail/ (config.py, providers.py, templates.py, mailer.py) with the same provider switch — MAILER_PROVIDER ∈ nodemailer|resend, blank = off (the links are logged, relay by hand; the stack boots without a mailer); nodemailer over the standard library (EMAIL_HOST/PORT/USER/PASSWORD, EMAIL_TLS), resend over httpx (RESEND_API_KEY); sender EMAIL_SENDER, default app@rescale.media; templates invite/magic/reset (product-neutral, the expiry from the token TTLs); MAIL_DRY_RUN=1 renders, validates and logs instead of sending; MAIL_SANDBOX_TO = the staging sandbox (every message to one inbox, the intended recipient in the subject; env.sh + the deploy refuse a staging env with a provider and neither knob); the seam turns a provider failure into sent: false with a redacted reason and never logs the link; /magic-link and /reset/request send after their 202; S1b's invites (POST /api/auth/invite, the import script) go out through it; import_users.py's REPO_ROOT fixed. Env rows in apps/api/CLAUDE.md, the env examples, STAGING.md §2/§7, LOCAL_DEV.md, SECURITY.md, INTEGRATION_CHECKLIST.md row 13.

Acceptance. pytest apps/api/app/backend/tests/core/test_mail.py; on staging one imported user's invite is delivered to the staging sandbox inbox and its token is redeemable through the API (GET /api/auth/accept?token= 200). The browser click-through sign-in (screenshot) is V2b's.

Out of scope. The SPA pages the emailed link lands on (V2b); a branded subject line (waits for a shared brand source — ADR-001 §2 keeps the product name in apps/web/src/shell/brand.ts only).

S7 · Readback job v0 · M · feat/s/s7-readback

Context. Every 15 minutes, performance per creative code lands in Skynet and a lineage node is written — the last hop of the loop.

Read first. S5a module; S4 lineage API; S3 normaliser; lock doc §4.3 snapshot table.

Deliverables. Migration 005_performance_snapshots.sql: core.performance_snapshots(workspace_id, creative_code, ad_id, ad_account_id, date, spend_native, spend_eur, impressions, reach, three_second, thruplay, link_clicks, purchases, purchase_value_eur, cost_per_purchase_eur, hook_rate, hold_rate, roas, breakeven_roas, seven_day_spend_eur, seven_day_purchases, seven_day_purchase_value_eur, seven_day_roas, seven_day_eligible, winner_loser_status, creative_hit, source_synced_at, snapshot_at, unique (workspace_id, creative_code, ad_id, date)). Job apps/api/core/readback/job.py: for each workspace with ecomprofits credentials → codes issued in the active readback window (READBACK_WINDOW_DAYS, default 90) (core.creative_codes) → creative_daily(account_id, codes, last 14 days) → upsert snapshots → one performance lineage node per (code, date) linked to the creative_code node. Scheduler: apps/api/core/scheduler.py (APScheduler or a while loop in the existing scrape_worker process — reuse supervisord program), interval READBACK_INTERVAL_MIN=15; GET /api/performance?code= for V10.

Acceptance. pytest apps/api/tests/core/test_readback.py on the S5a fixture (upsert idempotent; lineage node created once); on staging a stamped test creative's metrics appear in core.performance_snapshots within one cycle — post the row and the chain JSON.

Out of scope. Winner evaluation, alerts.

S7b · Command-line entry points for the readback and the launch-package reconcile · S · W4 · feat/s/s7b-job-cli (S1-rev)

Context. Discovered by S10 (open item #32). Neither app/core/readback/job.py nor app/core/launch_packages/job.py has a command-line entry, an admin route or a __main__ — the reconcile is reconcile-only by design (V27) and the readback runs on the worker's cadence (S7). So docs/runbooks/LOOP_E2E.md § 1 and the "close A6" procedure run both jobs as $COMPOSE run --rm --no-deps --entrypoint python api -c 'from app.core.readback import job; print(job.run_once())': a dataclass repr on stdout, no exit code an operator can act on, nothing that can be captured into an acceptance record, and a different idiom from every other operator command in the tree (-m app.core.scripts.readlayer_parity, -m app.core.scripts.r2_repoint). Both by-hand runs are safe beside the worker already — the readback takes pg_try_advisory_xact_lock per workspace and the reconcile leases its rows — so this card adds an entry point, never a second execution model.

Read first. app/core/readback/job.py (run_once, Report, WorkspaceReport, the advisory lock, _log); app/core/launch_packages/job.py (run_once, Report.error = the workspace scan failed, WorkspaceReport.errors = a count of per-row failures such as a 409 attach refusal, _claim_due); app/core/scripts/readlayer_parity.py and app/core/scripts/r2_repoint.py (the operator-CLI convention: main(argv) -> int, argparse, --json, both renders on stdout, exit 1 for an unmet gate and 2 for unusable input); app/backend/worker.py (_readback_due, _launch_packages_due, main's logging.basicConfig and WORKER_LOG_LEVEL); docs/runbooks/LOOP_E2E.md § 1; docs/ops/s10-acceptance.md hand-forwards.

Deliverables.

1. app/core/scripts/run_readback.py and app/core/scripts/run_launch_packages.py — python -m app.core.scripts.run_readback [--json] and … .run_launch_packages [--json], one cycle of the owning job's run_once(). The job modules stay import-only: no __main__ in either, so no module can be loaded twice under its own name.
2. app/core/scripts/_job_cli.py — the shared skeleton the two commands drive through a per-job adapter: argparse (--json, --log-level defaulting to WORKER_LOG_LEVEL then INFO), logging.basicConfig on stderr in the worker's format so the job's own per-workspace lines are visible while stdout carries the report only (both renders — a --json run pipes to a file), a datetime/date/Decimal JSON encoder over the report dataclasses, and the outcome/exit mapping.
3. One outcome per run, in both renders (the human render's first line and the JSON's outcome), in priority order: SCAN_FAILED → exit 2 (the reconcile's Report.error: the workspace scan itself failed); ERRORS → exit 1 (a workspace's error, or the reconcile's workspace.errors > 0); NO_ELIGIBLE_WORKSPACES → exit 1 (the population is empty — the readback has no core.integration_credentials row, the reconcile no workspace with an in-window code: a configuration fact, never evidence of a cycle); WORKED → exit 0 (the readback wrote snapshots; the reconcile created a row or claimed one); NO_WORK → exit 0 (eligible workspaces, nothing to do — the reason carried per workspace: codes=0, no matched snapshot, the advisory-lock skip, or no due row claimed because rows are attached, leased or in backoff). A healthy reconcile does nothing on most cycles, so NO_WORK must stay exit 0; did_work is the adapter's decision, never inferred generically. Usage errors keep argparse's own SystemExit(2); an exception out of run_once is exit 2 with its line on stderr.
4. Docs. LOOP_E2E.md § 1's by-hand section becomes the two commands with the --json capture, the outcome meanings, the exit codes and the rule that only a WORKED report with the pilot's counters is valid hop evidence (hops 2 and 5 keep their "run once (§ 1)" pointers); docs/ops/s10-acceptance.md's #32 hand-forward (its historical sections are left as they were true when written); docs/ops/s7b-acceptance.md; open item #32 closed.

Acceptance. pytest apps/api/app/backend/tests/test_job_cli.py green (no database): exit 0 for WORKED and for NO_WORK, 1 for a workspace error, 1 for the reconcile's workspace.errors > 0, 1 for NO_ELIGIBLE_WORKSPACES, 2 for the reconcile's Report.error, 2 for an exception out of run_once, SystemExit(2) for a bad flag; the --json render parses, carries the outcome and agrees with the human render's counters; stdout holds the report only, with every log line on stderr. Plus one case per job in the docker core tier (test_readback.py, test_launch_packages.py) calling the command's main([]) against the real database. The full api suite green.

Out of scope. The synthetic cycle's entry point (app/core/synthetic/checks.py — a different report, its own alert state and notifications; ALERTS.md § 5's drills are about the worker's cadence, and open item #32 names these two jobs only); any admin route or UI; a --workspace filter or any other change to run_once; a scheduler.

Waits on / Unblocks. S7 (S), V27 (V) / S10's hop-2 and hop-5 by-hand runs; the "close A6" readback leg.

S10 · Creative-code loop E2E with one real ad · M · W4 · chore/s/s10-e2e-loop (S1-rev)

Deliverables. docs/runbooks/LOOP_E2E.md with proofs at each hop: (1) Production export with a code (V7) → (2) the package on the real Launch card of the pilot creative — V27's reconcile evidence: the job's log line, the Launch comment with working links, the lineage chain carrying the launch node (S8a is the bridge's side; no manual bridge POST) → (3) the media buyer uploads the ad with the assembled ad name → (4) the ecomprofits read, two variants: select date, ad_id, nc_creative_code, amount_spent_eur, purchase_value_eur, winner_loser_status, is_final from meta_ads_dashboard_view where nc_creative_code = '<raw code as the ad name spells it>' and level = 'ad' and is_latest order by date desc limit 20; as metabase_readonly (the view's security_invoker chain is not granted to skynet_readonly), and the loop proof select date, ad_id, creative_code_raw, spend_eur, purchase_value_eur, winner_loser_status, is_final from skynet_creative_daily where account_id = '<tenant>' and creative_code_raw = '<raw code>' order by date desc limit 20; as skynet_readonly (the DSN Skynet reads with) → (5) GET /api/performance?code=<code> (the primary proof) + the core.performance_snapshots row (S7; core/008_performance_snapshots.sql) → (6) GET /api/lineage/chain?type=creative_code&ref=<code>. Mismatches fixed in the owning card the same day.

Acceptance. Runbook with all six proofs on staging with a real ad id; Agon signs the task.

S12 · Migration dry run (production PG) + rollback scripts · M · chore/s/s12-migration-drill

Context. Production's data (the baseline's 65 tables and one materialized view — the card said 63) moves from the in-container Postgres to unified PG at go-live. The drill proves it twice before it counts. Built (ADR-011): the old dump lands as a legacy public copy and is copied into production over the shared columns (never pg_restore --clean); the checksums hash ROW(<shared columns>)::text (not t::text); rollback.sh starts the old app on its own host and restores the archive dump only on request — nothing repoints DATABASE_URL (the old container is on another host).

Read first. V3 spec (baseline + init guard); static-ads docker/init-db.sh (init guard L38, re-runs schema.sql every boot L72–97); schema.sql; implementation PRD §5 (migrate step guarantees) and §6.

Deliverables. infra/migrate/production/: dump.sh (pg_dump -Fc from the old host container), restore.sh (into unified production schema on staging), checksums.py (introspects each table's real primary-key columns from pg_index/pg_attribute, then writes checksums.sql with deterministic per-table queries: count(*) for every table, and for the 20 largest tables an ordered row hash md5(string_agg(t::text, '|' order by <real pk columns>)); never a literal order by pk), verify.sh (old vs new checksum table → docs/runbooks/MIGRATION_PRODUCTION.md with timings), rollback.sh (repoint DATABASE_URL to the old container + restore pre-migrate dump), all idempotent. Run the full drill on staging twice.

Acceptance. Runbook with two drill runs, all checksums equal, timings; rollback drill restores the pre-migrate dump under 15 min. Post the checksum table.

Out of scope. The go-live run itself (X7, Agon + Sead).

S12b · The restore re-runs 006's instructions backfill · S · W6 · chore/s/s12b-restore-instructions-backfill (S1-rev)

Context. Open item #47, discovered by V8b. ADR-011's restore copies every paired table over the column intersection, so a column the old schema lacks — every workspace_id a migration added — lands NULL, and the migration's own backfill, applied once by the ledger, never runs again. The restore re-ran #22's three workspace backfills inline and 003's data move from its file (and, since V8b, 008's), but not 006's: after the go-live restore storyboard_llm.load_instruction (SELECT … WHERE workspace_id = %s AND step = %s) and the System routes find no workspace row and fall back to the shipped file — the operator's edited prompts sit in the table, invisible, until someone runs the UPDATE by hand. The drill seeded no instructions table, so nothing caught it. Lane S: S12's script, by the plan's W5 assignment — the plan's exception to the package map's infra/ → A. The outcome this card buys: the restored operator prompts are the workspace's on the day, and the next migration that adds a workspace column to a paired table cannot forget the restore silently.

Read first. infra/migrate/production/restore.sh (the copy transaction, #22's inline backfills, the 003 and 008 re-runs), db/migrations/unified/production/006_workspace_instructions.sql (the DDL the ledger applied once; the one data step), 004/005 (the same shape), infra/migrate/production/test.sh + test-old-schema.sql (the drill), ADR-011 §5, ADR-014, pipeline/storyboard_llm.py::load_instruction.

Deliverables. (1) restore.sh: one inline counted UPDATE for instructions (user_id = 1 AND workspace_id IS NULL → the slug's workspace) beside #22's three — inline, not \i 006, because 006's DDL must not run twice under session_replication_role = replica and its data step is one line; the transcript line gains instructions (006, user 1's) <n>, the JSON report's backfills gains instructions. (2) The drill: the old instructions table (the baseline's DDL) with two legacy users' rows; after the restore user 1's row carries the workspace and user 2's stays NULL (006's own rule), the transcript and the report say so, verify.sh compares instructions equal (the backfilled column is not a shared column); pairs and table counts move; a second restore with S12_WORKSPACE_SLUG=other proves every backfill follows the slug and none spells rescale. (3) apps/api/app/backend/tests/test_restore_backfills.py: a migration that ADDS workspace_id to a production table AND backfills it owes restore.sh an inline line for that table — the scan over production/*.sql and restore.sh, with a negative case and a pin that every inline update takes the slug. (4) ADR-011 §5 names the four inline backfills, the two file re-runs and the rule; MIGRATION_PRODUCTION.md (the restore row, the transcript line, §4); docs/ops/s12b-acceptance.md; open item #47 closed.

Acceptance. The S12 drill green with its new checks (the backfill, the NULL row, the transcript, the report, the comparator's instructions line, the other slug case); test_restore_backfills.py green; shellcheck clean; gitleaks clean. docs/ops/s12b-acceptance.md; open item #47 closed.

Out of scope. The unmigrated legacy rows (006's decision); M2b's re-point (its own runbook step); 008 (V8b).

Waits on / Unblocks. S12 (S), V29 (V), V8b (V) / the go-live restore's prompts.

S13 · Cross-tenant isolation: the proofs, and Production scoped at its resolvers · M · W5 · test/s/s13-isolation (S1-rev)

Context. The core routes prove workspace isolation already (docs/SECURITY.md, the core table). Production, the imported app, does not: its reads are keyed by a global product name or a bare session id, and /api/winners and /api/canva are authenticated but never bind the request's workspace. "User A on a B-owned id → 404/403" is therefore impossible for the Production routes the card names without giving Production a workspace boundary; S13 builds it at the resolvers and proves it. S1 has one workspace, so the boundary costs nothing today and is what S5's multi-tenant operation stands on; RLS stays S5's.

Read first. docs/SECURITY.md; tests/core/test_isolation.py + tests/core/conftest.py (two_workspaces); services/workspace_scope.py + auth.py::request_scope; main.py (router dependencies, the error handlers); db_service.get_product_id / create_product / list_products and the session lookups; storyboard_service.get_storyboard_session_detail / list_storyboard_sessions + routes/video_storyboard._session_or_404; routes/localize_video.py; routes/winners.py; routes/canva.py; production/004_sessions_workspace.sql; .github/workflows/ci.yml.

Deliverables. (1) production/005_products_workspace.sql: products.workspace_id and storyboard_saved_characters.workspace_id (nullable until S12's restore; backfilled to the default workspace like production/004; indexed) — open item #22 gains both UPDATEs. (2) The resolvers scope: get_product_id filters by the workspace (the explicit id a create path resolved, else the bound scope; a caller with none is refused, 403, never served the world); create_product stamps it and resurrects only within it (a name owned by another workspace → 409; the global UNIQUE (name) stands until S5); list_products / deleted / restore / the admin overview list the bound workspace; every session read and write carries sessions.workspace_id = <bound> — the product-session lists and details, Localize Video's, Storyboard's, the winners, the system session lists, the canva polishes — and the helpers keyed by a bare session id (progress + SSE, images, input, approvals, the stamp, the localize file routes, the three storyboard image routes) check the product–session pair AND the workspace first (require_session); the saved-character library is per workspace; the run-side product lookups use the same resolver; winners and canva routers bind request_scope; the Canva routes that resolve a session_image_id or a polish_id (/open, /return, /polish/{id}/…, /polished) resolve within the caller's workspace; has-creatives resolves the product first. A product or session with no workspace is invisible to everyone (fail closed, like a run). (3) tests/core/test_isolation.py, the Production half on two_workspaces: the ten routes the card names, the lists, a write, a ?token= image route, the SSE first event, the wrong-product URL, the 409 name collision, the library, the Canva /open and /return write proofs, and the no-workspace legacy user → 403; each test truncates the Production rows it made. (4) docs/SECURITY.md: the Production table, the "not scoped in S1" list (Intelligence v2, labs, scraped ads, camera moves), the CI wording; docs/decisions/ADR-009-production-workspace-boundary.md; docs/ops/s13-acceptance.md; the CLAUDE.md paragraph.

Acceptance. pytest apps/api/app/backend/tests/core/test_isolation.py green, covered by the api job inside the required ci workflow; 0 leaks in the two tables; the full suite green (the legacy tier binds TEST_WORKSPACE_ID suite-wide, so the resolver's filter costs it nothing).

Out of scope. RLS (S5); per-workspace product names beyond the 409 (S5); the Intelligence v2 / labs / explore-experiments id-keyed and case-insensitive product reads, the scraped-ads mappings (S2) and camera moves — listed in SECURITY.md.

Waits on / Unblocks. S1a, S3, S4, S7, V4, V8 / S5's tenancy work.

M5 · Retention / archive plan · S · W5 (S1-rev)

Deliverables. docs/ops/RETENTION.md: old static-ads host read-only for the agreed post-cutover retention window, archive point (final dump + R2 prefix manifest), deletion owner + trigger (Agon, after the S1 exit gate and the retention window); the standalone scraper and console are NOT in scope (they stay live until S2/S3); Skynet backup retention (20 days local, Storage Box per its policy), pre-deploy dump folder policy (alert at 20 GB, never auto-pruned).

Acceptance. Doc merged; Agon and Vince acknowledged.

Lane B — Vince (Production & Brain)

Static-ads facts every V card relies on: backend entry app/backend/main.py (routers L75–122; auth_dep L78, admin_dep L92, intelligence_dep L93; SPA mount L170–180); auth app/backend/auth.py (create_token L48, get_current_user L61–88 reads Bearer or ?token=); DB app/backend/db.py (get_pool L26, get_cursor L58); frontend app/frontend/src/App.tsx (routes L56–138, RequireAuth L47), components/layout/{AppLayout,Sidebar}.tsx, lib/api.ts (getToken L6 → localStorage.auth_token, authHeaders L18, ?token= at 22 call sites incl. getProgressStreamUrl L1021), SSE consumers in pages/products/SessionView.tsx:352 etc.; model calls: app/pipeline/utils/claude_client.py (_call_claude_impl L44, POST L129), openrouter_client.py (generate_image L57), embeddings.py (_post_with_retry L43), app/backend/services/analysis_llm.py::chat L53, fal_client.py::_request L198, heygen_client.py::_request L171, elevenlabs_client.py (_with_retry L128, _tts_request L483); image registry app/pipeline/config.py (IMAGE_MODEL_IDS L111, resolve_image_model L141, load_settings_from_db L189); settings app/backend/services/settings_service.py, encryption.py (Fernet, ENCRYPTION_KEY); export routes/products.py:213 → services/export_service.py::export_product L18, zips in routes/video_storyboard.py L1079/L1170, client zip lib/download.ts; tests pytest app/backend/tests (no DB fixture; conftest.py blocks real network); Docker: Dockerfile L38–56 installs Postgres, supervisord.conf programs postgresql/uvicorn/scrape_worker, docker/init-db.sh re-runs schema.sql on every boot with an init guard at L38.

V1 · SSO in production API/UI · S · feat/v/v1-sso

Context. One cookie must open Production. Today it mints its own HS256 JWT and the frontend keeps it in localStorage and appends ?token= to 22 image/SSE/download URLs. Rewriting those is not S1 work, so S1 keeps the token paths and swaps the token.

Read first. Lock doc §4.1 incl. "static-ads compatibility bridge"; app/backend/auth.py L48–88; app/backend/main.py L75–78; app/frontend/src/lib/api.ts L6–59 and the ?token= lines; packages/contracts/auth/verify.py + samples (S1a).

Deliverables. (1) auth.py: get_current_user decodes with verify_access_token from the contracts package (cookie rs_access → Bearer → ?token=, in that order); map claims → the existing user dict: email, is_admin = 'admin' in roles, can_see_intelligence = {'researcher','admin'} & roles, token_version = tv; look up users by email; if missing, create the row with email, display_name = claim.name, is_admin from roles, token_version = tv, and password_hash = a bcrypt hash of a random 32-byte secret (users.password_hash is NOT NULL) so legacy password login stays unusable when LEGACY_LOGIN_DISABLED=1. (2) Remove create_token usage from the API path and disable the legacy auth routes that actually exist today (app/backend/routes/auth.py, mounted under /api/auth): POST /api/auth/login, PUT /api/auth/me/password, PUT /api/auth/users/{user_id}/password. Keep GET /api/auth/me. Leave the /api/auth/users* admin-management routes in place until V11 replaces them. LEGACY_LOGIN_DISABLED=1 returns 410 on each disabled route until cutover cleanup. (3) lib/api.ts: getToken() reads localStorage.auth_token as today; add refreshSessionToken() = GET /api/auth/session-token → setToken(), called on app mount (main.tsx) and once on any 401. V2a owns the shell login UI and route wiring.

Interfaces. Consumes S1a. Exposes nothing new.

Steps. Verifier swap → route disabling behind flag → frontend token refresh → tests.

Acceptance. pytest app/backend/tests/test_auth_sso.py green (valid → 200; expired / wrong-kid / revoked-tv → 401; admin route with viewer token → 403); manual on local stack: with a valid rs_access cookie present, open a Production page and an <img src=…?token=…> — both load; after POST /api/auth/logout, both 401 within 60 s (screenshots or curl transcript).

Out of scope. Removing ?token= (V21, later slice); users/roles UI (V11, later slice).

V2a · Shell skeleton · S · feat/v/v2a-shell

Context. The unified frontend is the static-ads frontend grown into a shell. The nav becomes the product's map.

Read first. Functional design §3 (modules), §5; App.tsx L47–138; Sidebar.tsx L42–44, L107–307; index.css @theme L7–56; lock doc §4.1 cookie names.

Deliverables. (1) src/shell/: ShellLayout.tsx (top nav: Intelligence · Strategy (stub page "a later slice") · Studio · Production · Workspace · Inbox (stub) · Admin; workspace switcher reading /api/auth/me — consumes exactly the S1a shape {id, email, name, ws, ws_slug, roles, permissions, feature_flags?}), routes.tsx (route folders /intelligence, /strategy, /studio, /production/* = all existing routes moved under the prefix with redirects from old paths, /workspace, /inbox, /admin), auth/ (LoginPage posting to /api/auth/login), RequirePermission.tsx (gates on permissions[], never on role names). (2) Theming: keep tokens; product name appears only in the nav brand component (BRAND_NAME const, one place). (Invite/reset pages are delivered in V6 after S1b; the session-token refresh hook is V1's.)

Acceptance. pnpm --filter web build clean; pnpm --filter web lint clean; local: every existing Production page renders under /production/*; old URLs redirect; a user lacking admin.settings.manage cannot open /admin (screenshot).

Out of scope. Legacy mounts (V6), launch board (V9), admin content (V5).

V3 · Production on unified Postgres · M · feat/v/v3-production-pg

Context. Production's Postgres lives inside its container today (supervisord starts it; init-db.sh re-runs schema.sql every boot). On unified PG it becomes schema production with real migrations.

Read first. Dockerfile L38–56, L131–140; supervisord.conf; docker/init-db.sh L12–19, L38–97; schema.sql (63 CREATE TABLE IF NOT EXISTS, migrations block from L336 — idempotent ALTER … IF NOT EXISTS); app/backend/db.py; implementation PRD §5 (migrate step: ledger, checksum, pre-dump).

Deliverables. (1) db/migrations/unified/production/001_baseline.sql = schema.sql rewritten for schema production (create schema if not exists production; set search_path = production, public; + create extension if not exists vector in public), unchanged otherwise. (2) apps/api/migrate.py (the runner, shared with core): applies db/migrations/unified/*/NNN_*.sql in order inside one transaction each, records in core.schema_migrations(version, checksum, applied_at), refuses a changed checksum, --dry-run, exit ≠ 0 on error; docker compose run --rm migrate entrypoint. (3) db.py: DATABASE_URL + options=-c search_path=production,public. (4) Dockerfile: remove Postgres install (L38–56), init-db.sh, postgresql program; keep uvicorn + scrape_worker. (5) docs/MIGRATIONS.md (forward-only, additive during S1, how to add a file). (6) Ops endpoints in app/backend/main.py: GET /api/healthz → {"ok":true} once the API is up and can read the migration ledger; GET /api/version → {"sha":"<git sha>","migration_head":"<latest applied version>"} (sha baked in at build via GIT_SHA build arg). These are the endpoints A2/A6/X3/X5 and the smoke gate use.

Acceptance. python apps/api/migrate.py --dry-run lists 001; pytest app/backend/tests green against unified PG in the existing docker-compose.yml dev stack (postgres service added there; A2 introduces the monorepo compose files later); full Explore + Storyboard run on the local stack (session created, images generated, storyboard delivered — screenshots); image no longer contains postgres binary (docker run … which postgres → empty); curl -s localhost:8000/api/healthz → {"ok":true} and curl -s localhost:8000/api/version returns the current git sha plus the latest applied migration version.

Out of scope. Data migration of the live DB (S12/X7); R2 changes.

V4 · Model bindings + usage events + spend guard · L · feat/v/v4-bindings-spend-guard

Context. Which model runs which job becomes a setting, not a deploy; spend gets a guard. Production is the first consumer; sidecars post usage later.

Read first. S4b contract (packages/contracts/bindings); app/pipeline/config.py L111–216 (IMAGE_MODEL_IDS, CLAUDE_MODEL, load_settings_from_db writing module globals); app/backend/services/system_settings_service.py (resolve L280, set_value L294); technical plan §2.4.4.

Deliverables. (1) Migration core/006_bindings.sql: core.providers(id, workspace_id, kind check in ('openrouter','vendor','claude_subscription'), name, base_url, config_encrypted, created_at), core.models(id, provider_id, slug, modality check in ('chat','image','video','tts','embedding'), price_in_usd, price_out_usd, active), core.model_bindings(workspace_id, workflow_key, model_id, provider_id, updated_by, updated_at, pk(workspace_id, workflow_key)), core.usage_events(id bigserial, workspace_id, service, workflow_key, model, tokens_in, tokens_out, cost_usd numeric(12,6), request_id, created_at), core.spend_guards(workspace_id pk, window_hours default 24, warn_usd, pause_usd, paused_at, paused_by, resumed_at). Seed for rescale: OpenRouter provider (key from env), models = today's CLAUDE_MODEL, LONGFORM_OPUS_MODEL, HAIKU_MODEL, GENDER_DETECT_MODEL, the three IMAGE_MODEL_IDS; bindings for workflow keys production.concepts, production.longform, production.image, production.analysis, production.embeddings, production.storyboard.llm, production.video, production.tts. (2) apps/api/core/bindings/: GET /api/bindings/:workflow (resolves binding → provider config decrypted server-side, returns the contract shape + paused + guard state), POST /api/usage (service token or user), PUT /api/admin/bindings/:workflow, PUT /api/admin/spend-guard, POST /api/admin/spend-guard/resume; admin read endpoints required by V5: GET /api/admin/bindings (all workflow keys, current binding, available models grouped by modality, masked provider metadata) and GET /api/admin/spend?window=24h|7d (totals per provider and workflow from core.usage_events plus the current guard state); guard.py (rolling sum over window_hours; ≥ warn_usd → one Discord/Telegram message per hour; ≥ pause_usd → set paused_at; SPEND_GUARD_KILL_SWITCH=1 env pauses everything). (3) apps/api/core/gateway.py: @gated(workflow_key) decorator: pre-call resolve_binding() → raise SpendPaused (HTTP 402, message "Spend guard paused this workspace at €X; an admin can resume in Admin → Spend") if paused; post-call record_usage(tokens, cost); cost from models.price_* or the provider's usage field.

Interfaces. Exposes the contract endpoints; V8 wires production calls; V5 is the UI.

Acceptance. pytest app/backend/tests/core/test_bindings.py green: change the binding for production.concepts → next resolve_binding returns the new model (no restart); usage of 3 events sums correctly; crossing pause_usd pauses and the decorator raises 402 with the message; resume clears. Post output.

Out of scope. The admin UI (V5), wiring the call sites (V8), per-user keys (M1).

V2c · Web foundations layer · L · W6 · feat/v/v2c-web-foundations (discovered by the S1 pages UX design, S1-rev 2026-09-07)

Context. The five remaining S1 frontend surfaces (V2b, V5, V31, V33, V10a/V10b) would each hand-roll the same missing pieces: the app has no toast, alert, skeleton, table, sheet, tooltip, label, empty-state component, no 403/404 surface, no per-page document title, no aria-live region and not one htmlFor/id pair (final/skynet-s1-pages-ux-design.md §2; the reader reports in development-processes/skynet/ux-design/). It has three error treatments, two label styles, raw palette colours beside tokens, alert() in four files, a login page off the design system, gates that redirect silently, a ConfirmDialog that swallows errors and no money or date formatter. The muted text token measures 4.72:1 on the page background but 4.44:1 on cards (WCAG AA needs 4.5). The web app has no unit-test runner (apps/web/src/README.md). This card builds the shared layer once so the five pages cannot diverge.

Read first. final/skynet-s1-pages-ux-design.md §1–§2 (the principles, the component contracts, the token change, the lint rules); apps/web/src/index.css; components/ui/* (button.tsx, dialog.tsx, confirm-dialog.tsx, segmented-toggle.tsx — the @base-ui/react 1.3.0 + cva idiom); shell/RequirePermission.tsx, shell/routes.tsx (LegacyRedirect), shell/pages/ModuleStub.tsx; lib/api.ts:402-457 (handle401, ApiError, apiError), lib/utils.ts:170-200 (EYEBROW_CLASS, formatRelativeTime); pages/system/Settings.tsx:329-338 (the canonical catch); pages/team/TeamPage.tsx:152-241 (the table shape); pages/products/SessionsList.tsx:640-662 (the empty state); pages/system/PastSessions.tsx:132-141 (the one keyboard-reachable row); e2e/ (Playwright), .github/workflows/ci.yml web job, docs/CI.md; docs/ops/v2a-acceptance.md:13,66 and docs/ops/v6-acceptance.md:28 (the pinned denial redirect).

Deliverables. (1) components/ui/: toast.tsx (Toaster, Base UI Toast, one region mounted in App.tsx; the manager and the toast.success / toast.error calls live beside it in lib/toast.ts — amended at build time so the component file exports only a component and so lib/download.ts can raise a message without importing the viewport —, aria-live polite for success and role=alert for errors, 4 s auto-dismiss paused on hover/focus, errors stay, max 3), alert.tsx (variant error|warning|info|success, icon, title?, action?, onDismiss?, role per variant), skeleton.tsx, empty-state.tsx (icon, one sentence, at most one action), table.tsx (Table, THead, TBody, TR, TH, TD; align, tabular-nums on right-aligned cells, TR interactive = tabIndex 0, role=link, Enter/Space), sheet.tsx (Base UI Drawer, right side, focus trap, Escape, focus return), tooltip.tsx (Base UI Tooltip, 300 ms), form-field.tsx + label.tsx (Label htmlFor, help, error, aria-describedby, aria-invalid), copy-button.tsx (icon-xs ghost, Copy → Check for 1.5 s, aria-live "Copied"), money.tsx (Intl.NumberFormat currency, approximate → a leading ≥, — for null), relative-time.tsx (formatRelativeTime + the absolute time in a tooltip and <time dateTime>, live re-render every 30 s), page-meta.tsx (document.title = "<title> · <BRAND_NAME>", restored on unmount), route-error.tsx (a React error boundary — the app uses the declarative <BrowserRouter> + <Routes>, so no errorElement — keyed on location.pathname, "Something went wrong on this page.", Reload + Go to Production), lineage-chain.tsx (the GET /api/lineage/chain response as a depth-ordered rail with the root marked, relation connectors, a Show-attributes Collapsible per node, the human reference per node type from the design's §5.4). (2) shell/pages/Forbidden.tsx ("You don't have access to this page" + the permission name + Go to Production) and NotFound.tsx; RequirePermission renders Forbidden in place instead of <Navigate to="/production">; LegacyRedirect keeps the legacy-family rewrite and renders NotFound for the rest. (3) lib/useLoad.ts ({data, error, loading, reload}, an AbortController per call, a sequence number so an older response never overwrites a newer one) and lib/api.ts::describeError ({message, kind: api|session|network}, extracted from Settings.tsx:329-338). (4) The token line: --muted-foreground oklch(0.60 …) → oklch(0.62 …) (index.css:70); no other token moves. (5) ESLint rules scoped to components/ui/** and the files this card adds (shell/pages/{Forbidden,NotFound,DevGallery}.tsx, lib/{useLoad,format,lineageApi}.ts, test/**) — never shell/** as a whole while the login page carries its 18 zinc-*/red-400 classes (V2b's rewrite); each later card widens the list with its own directory: no raw Tailwind palette class (text|bg|border|ring…-<colour>-<number>), no title= on a Button, no alert(. (6) The first web unit-test runner: vitest + @testing-library/react + @testing-library/jest-dom + jsdom, npm test, vitest.config.ts sharing the @ alias, a test step in the CI web job; @axe-core/playwright in e2e/. (7) A gallery route /dev/ui rendering every component in every state — the Playwright screenshot source for this and the later cards — present only when the build sets VITE_UI_GALLERY=1 (amended from import.meta.env.DEV at the implementation co-plan: DEV is false in vite preview and in the skynet-web image, so the acceptance build is VITE_UI_GALLERY=1 npm run build and a production image never carries the route); the route sits outside RequireAuth (it renders static markup and imports no page module that fetches). (8) Docs: apps/web/src/README.md § the shared layer; docs/CI.md (the web job gains npm test); docs/ops/v2a-acceptance.md:13,66 and docs/ops/v6-acceptance.md:28 each gain a dated line ("since V2c the guard renders the Forbidden page in place; the viewer still cannot open /admin"); docs/INTEGRATION_CHECKLIST.md row 9's expectation becomes "refused: the Forbidden page names admin.settings.manage"; docs/ops/v2c-acceptance.md with the contrast table and its script.

Interfaces. Exposes the components, useLoad, describeError, Forbidden/NotFound, the /dev/ui route, npm test. Consumes nothing new from the api.

Steps. The test runner + the CI step → the token + the lint rules → the primitives with unit tests → Forbidden/NotFound + the two guards → /dev/ui → the record lines and docs → the acceptance record.

Acceptance. npm test green (every component has a test; useLoad: two overlapping calls resolving in reverse order leave the second's state; RouteError: a throw, a navigation, the next route renders; RequirePermission: without the permission the page names it, with it the child renders; Money/RelativeTime formatting incl. — for null; Toaster announces through aria-live); npm run build green; npm run lint clean for the scoped directories; the CI web job runs the tests; a Playwright pass over /dev/ui with @axe-core/playwright reporting zero violations and one screenshot per component state in docs/ops/v2c/; the contrast script's table in docs/ops/v2c-acceptance.md shows every text token ≥ 4.5:1 on every surface it is used on; as viewer, /admin shows the Forbidden page naming the permission (an e2e case).

Out of scope. Any of the five pages (V2b, V5, V31, V33, V10a/V10b); converting the imported Production pages to the new components (V10b); a light theme; a storybook.

Waits on / Unblocks. V2a (V), V6 (V) / V2b (V), V5 (V), V31 (V), V33 (V), V10a (V), V10b (V).

V2b · Accept, magic-link and reset pages · M · W6 · feat/v/v2b-accept-pages (discovered by M3; S1-rev 2026-09-07: S → M, designed without Figma)

Context. The emailed invite / magic-link / reset URL is PUBLIC_ORIGIN/api/auth/accept?token=, which Caddy hands to the api: a person who clicks it sees the JSON preview. Completing an invite or reset needs POST /api/auth/accept {token, password} (a magic link: the same POST without a password); nothing in the SPA issues it (shell/routes.tsx has /login only), and /login has no "email me a link" or "forgot password" form.

Read first. apps/api/app/core/auth/router.py (GET /accept preview, POST /accept, POST /reset/confirm, the two 202 request routes and their uniform bodies — ADR-001 §5), auth_tokens.accept_url, apps/web/src/shell/auth/LoginPage.tsx, shell/routes.tsx; M3's templates (what the email says the link does).

Deliverables. /accept?token=: reads the preview; invite/reset → a set-password form; magic → one-click continue; posts; lands signed in; every 410 → one uniform "this link is invalid or expired" state. /login gains "email me a sign-in link" and "forgot password" forms that post the two 202 routes and show ONE uniform "check your email" state (never whether the account exists). auth_tokens.accept_url → the SPA path (+ its test); the emails need no change. The Figma link with the node id comes first.

Acceptance. npm run build green; the browser click-through on staging — the invite from M3's sandbox inbox, the password set, the app open — with a screenshot (the leg M3 hands over); pytest apps/api/app/backend/tests/core/test_users.py green on the new URL.

Depends. S1b, M3.

S1-rev 2026-09-07 (size S → M; the design replaces the Figma link). The design is final/skynet-s1-pages-ux-design.md §3: /login = one card on the design system with three modes (password · link · reset) and ONE sent state identical for known, pending and unknown addresses; every failed login shows two sentences, always ("Invalid email or password." and "If your account recently moved, request a sign-in link and check your inbox." — open item #27, ADR-015); /accept?token= = one card with four bodies by the preview's kind (invite, migrate, reset, magic — the magic body posts only on the person's click), every 410 = one uniform invalid-or-expired state with a way to request a new link, success lands on /production. The api half: auth_tokens.accept_url → ${PUBLIC_ORIGIN}/accept?token= with its test AND every consumer of the old shape — docs/INTEGRATION_CHECKLIST.md rows 13/13b, docs/ops/m3-acceptance.md:21, docs/ops/s1d-acceptance.md, docs/AUTH_SESSION.md §3, docs/GO_LIVE.md 9b / docs/CUTOVER.md 9b where they name it, the auth_tokens.py:189 docstring, the router.py:683 comment, the delivery-link fixtures tests/core/test_mail.py:29 and tests/core/test_migrated_first_contact.py:456,510,514-515 (the direct API-preview tests stay — they test the API); api.login throws ApiError (today a bare Error) so the page tells 401 from 429 from 5xx. Built on V2c's foundations (FormField, Alert, Skeleton, PageMeta, RouteError). Acceptance adds e2e/auth-pages.spec.ts (the design's §3.8: the two sentences; an identical sent DOM for a known and an unknown address; an invite's link opens the SPA /accept, the short-password error is client-side with no POST, the valid password lands on /production; the same link again → the invalid state; a migrate token shows "Your account has moved"; a magic token posts nothing before Continue; axe clean; Tab reaches every control with a visible ring), screenshots in docs/ops/v2b/, docs/ops/v2b-acceptance.md. Waits on V2c as well.

Build note 2026-09-07 (what the card did beyond its text). A defect the card had to fix to be honest: bcrypt refuses a password over 72 BYTES rather than truncating it (bcrypt 5.0), so before this card a long passphrase raised inside EVERY rail that stores one — POST /accept, POST /password (S1e's), and the two legacy admin rails POST /api/auth/users and PUT /api/auth/users/{id}/password, which are live wherever LEGACY_LOGIN_DISABLED is unset (staging included); POST /login was saved only by a ValueError catch already in _password_matches, and the startup admin and the seed scripts would have died on bcrypt's own message naming no variable. V2b ships the first screens where a person chooses a password, so the rule now lives in ONE module, app/core/auth/passwords.py (an 8-character floor counted in characters, a 72-byte ceiling counted in bytes), and every writer in both packages asks it — the legacy rails after their own 410 gate, and the environment-supplied passwords through refuse_unusable, which names the variable. apps/web/src/shell/auth/passwordRule.ts mirrors the rule and also counts bytes, so the page refuses what the api would refuse and never posts it. tests/core/test_password_length.py pins every rail, including the three login legs that were already safe. (The two legacy rails were found by review round 1, not by the build.) Three smaller decisions. formatTimeUntil is new in lib/format.ts — formatRelativeTime computes now − t and reads a future instant as "just now", so the expiry line could not have come from it or from RelativeTime; the line is prose with a <time dateTime> rather than the component, which would add a tab stop and a tooltip to a sentence. Signing in CLEARS the module-level sessionsCache (one signInWith shared by api.login and api.accept): /accept can replace a live session with a different person's without a page load, and those rows belong to whoever loaded them. The accept page owns its preview effect instead of useLoad, which describes an error as one sentence — this page must tell a spent link (410, its own state) from a server that did not answer (a Retry). The e2e shape. Legs 1–4, 6 (magic) and 7–8 run in e2e/auth-pages.spec.ts; the magic token has no HTTP source (/magic-link answers {"ok": true}), so the CI job mints one the way an operator does — the api's own relay-by-hand log line — and passes it as E2E_MAGIC_TOKEN, which the spec REQUIRES under CI so a missing one fails instead of skipping. Leg 5 (migrate) is proven at unit level (the four kind bodies) plus the server tests that mint the kind and the staging click-through of integration-checklist row 13b: minting one in CI would mean seeding a legacy production.users row in SQL from the workflow, which buys one label over the invite leg's identical code path.

V6b · Scraper-admin SSO verifier · S · feat/v/v6b-scraper-sso

DROPPED (S1-rev): the scraper stays standalone until S2.

V6 · Shell with links to the standalone apps · S · W3 · feat/v/v6-shell-links (S1-rev)

Context. Day-14 shell = Production native + links. No mounts, no SSO into the standalones.

Read first. Architecture doc §2 (boundaries), functional design §5; V2a routes.

Deliverables. Nav entries: Intelligence → https://meta-ads.rescale.media (new tab, label "opens the scraper — separate login for now"); Studio → the console URL (same treatment); Workspace → ClickUp Launches list deep link + the pilot placeholder ("native boards come with the Workspace slice"); Strategy, Inbox stubs with one sentence each; Admin → V5. Link targets from env (LINK_SCRAPER_URL, LINK_STUDIO_URL, LINK_CLICKUP_LAUNCHES_URL). docs/INTEGRATION_CHECKLIST.md rows: login, each nav entry, logout, one SSE stream, one upload.

Acceptance. Checklist green on staging (screenshots); viewer cannot open /admin.

Out of scope. Any native Intelligence/Studio page (S2/S3).

M1 · Per-user settings/keys migration · S · feat/v/m1-settings-migration

Context. Each user's encrypted OpenRouter key and generation settings must survive the move and become workspace + user scoped.

Read first. schema.sql L159–174 (settings columns incl. api_key_encrypted, Canva tokens), app/backend/encryption.py, settings_service.py, config.py::load_settings_from_db L189–216.

Deliverables. Migration core/007_user_settings.sql: core.user_settings(workspace_id, user_id, key text, value_encrypted text, updated_at, pk(workspace_id,user_id,key)); data migration in production/002_settings_to_core.sql (copy settings rows for every user → keys openrouter_api_key, claude_model, default_aspect_ratio, images_to_generate, images_to_keep, canva_*; same Fernet ciphertext, same ENCRYPTION_KEY); settings_service.py reads/writes core.user_settings for the current user + workspace; load_settings_from_db(user_id) unchanged in signature, new source. instructions table stays in production (seed for a later slice overlays).

Acceptance. pytest app/backend/tests/test_settings_migration.py (round-trip of a known ciphertext); on staging every imported user's settings page shows their values; a generation uses the user's key (log line masked).

Out of scope. Key rotation; per-workspace provider keys (that is V4 providers).

V7 · Creative code on export + lineage writes · M · feat/v/v7-export-code-lineage

Context. The stamp. Every exported asset carries a creative code from S3; the chain is written to lineage.

Read first. Lock doc §4.2 (stamping rules); S3 routes; S4 API; routes/products.py:213 POST /{product}/export → export_service.export_product L18; routes/video_storyboard.py zip paths L1079/L1170; lib/download.ts (downloadImagesAsZip L17); product_creatives.creative_code (human-typed today, routes/products.py:450).

Deliverables. (1) Export flow: on export of a concept/asset, call POST /api/creative-codes (kind from asset type: image → TM, video → RC; team_made = session mode Explore → true, Expand → false; product_number from the product's naming product number — add products.product_number if absent, editable in product settings) → stamp: filename <code>__<concept-slug>.<ext>, manifest.json {code, product_number, session_id, concept_id, naming_version:'v3', assembled_ad_name?}, the copy-ready ad name from POST <WORKOS_SERVICE_URL>/naming/ad-name when S8 is live (else omitted, logged). (2) Lineage batch to S4: nodes session → concept → asset → export → creative_code, edges in order. (3) product_creatives upload form: creative_code becomes read-only, prefilled from the issued code; existing free-text codes are left as-is and reported by a new script scripts/report_unmatched_creative_codes.py added in this PR (CSV output: product, creative_code, reason). (4) Client zip (download.ts) uses the stamped filenames from the API response.

Acceptance. pytest app/backend/tests/test_export_code.py (mocked S3/S4: filenames + manifest carry the code; lineage batch posted once); manual: export one concept on the local stack, unzip, show manifest; GET /api/lineage/chain?type=creative_code&ref=<code> returns 5 nodes (paste JSON).

Out of scope. Uploading to Meta; winner display (V10).

V8 · Gateway client in production · M · feat/v/v8-gateway-client

Context. Every outbound model call in Production goes through the binding + guard from V4. There are seven choke points.

Read first. V4 gateway.py; call sites: claude_client.py::_call_claude_impl L44 (workflow production.concepts / production.longform chosen by caller — add a workflow_key kwarg with defaults per caller module), analysis_llm.py::chat L53 (production.analysis), openrouter_client.py::generate_image L57 (production.image), embeddings.py::_post_with_retry L43 (production.embeddings), fal_client.py::_request L198 and heygen_client.py::_request L171 (production.video), elevenlabs_client.py::_tts_request L483 (production.tts); render_provider.py (active_provider L49) and config.py::resolve_image_model L141.

Deliverables. Each choke point wrapped with @gated(workflow_key): model slug + base URL + key come from resolve_binding() (fallback to today's env only when no binding exists, with a warning log); usage posted with real token counts where the provider returns them (OpenRouter usage), else the model's price_* × estimate; resolve_image_model reads bindings (production.image default; the UI's model dropdown lists core.models with modality image). Remove the import-time binding of OPENROUTER_API_KEY in claude_client.py L8/L132 (late-bind).

Acceptance. pytest app/backend/tests/test_gateway_client.py (each choke point calls resolve_binding and record_usage; paused → 402 surfaces to the route as a clear error); staging: run one Explore session → Admin → Spend shows usage rows for production.concepts and production.image (screenshot); set pause_usd low → next run blocked with the message.

Out of scope. Sidecar usage posting (later slices), pricing accuracy beyond OpenRouter's usage field.

V27 · Launch-package producer for the existing Launch card (POST /launches/:id/package) · M · W4 · feat/v/v27-launch-package (S1-rev)

Context. S1 exit gate item 5: the export package attached to the existing ClickUp Launch card through the workos bridge. No producer exists (open item #18, ADR-005 §5). The bridge's code-only ad-name path already resolves the linked Launch and withholds with no launch links this creative yet until one exists, so the attach is an eventual reconcile, not an export-time side effect. The producer also makes the package durable from the app side and writes the export node's missing manifest_key.

Read first. docs/decisions/ADR-005-launch-package-contract.md; packages/contracts/launch/README.md + both schemas + fixtures; packages/contracts/lineage/README.md (the export node's manifest_key + additive assembled_ad_name re-post; the reserved launch node type, ref_id = the ClickUp task id, and the launched relation); apps/api/app/backend/services/stamp_service.py (_assembled_ad_name, _issue_or_reuse: the register row's asset_key is the image's R2 key, the storyboard deliverable's is storyboard-delivery); export_service.py and routes/video_storyboard.py (_stamped_manifest, get_manifest, clips.zip, the ChatCut download routes); app/core/readback/job.py + worker.py::_readback_due (the cadence pattern); app/core/lineage/service.py; app/core/auth/service_tokens.py; app/backend/auth.py::get_current_user (cookie → Bearer → ?token=); rescale-workos service/src/modules/skynet-bridge/{routes,auth,routes.test}.ts; task-specs S10, S8a, V7; open-items #15, #18.

Deliverables.

1. Bridge additive delta (rescale-workos, LOCAL branch feat/skynet-bridge-s1, hand-forward row in open-items): on the code-only POST /naming/ad-name success path Assembled gains optional launch_task_id (the Launch the name was assembled from). No new bridge route. Contract: ad-name.schema.json#Assembled.launch_task_id, the fixtures re-copied from the new workos commit, README source commit + hashes, the Python fixture-hash pins, the apps/api consumer test.
2. Durable package URLs: GET /api/creatives/{code}/package/manifest.json and GET /api/creatives/{code}/package/{filename} — stable app routes that redirect to fresh presigned R2 URLs, guarded by the transition verifier (get_current_user: the rs_access cookie first, so a browser click from ClickUp works for a signed-in reader; Bearer and ?token= as today). Cross-workspace → 404.
3. Manifest snapshot + export-node update, at first attach: the manifest object is stored in R2 under a key by the EXPORT identity, exports/<workspace>/<session_id>/<export_ref_id>/manifest.json (the lineage contract keys the manifest by the export, not by the code) — a TM code: the image-export serialisation as a ONE-entry JSON array; an RC code: the storyboard manifest object plus the stamped creative_code block — and the export lineage node is re-posted additively with {manifest_key, assembled_ad_name}.
4. The reconcile job app/core/launch_packages/job.py::run_once() + a worker cadence hook beside the readback (LAUNCH_PACKAGE_INTERVAL_MIN default 15, 0 disables; LAUNCH_PACKAGE_WINDOW_DAYS default 30). One cycle, per workspace: the register's codes issued in the window are the population (rows are created lazily from the register — a code stamped before this card lands is covered, and stamping stays unaware of packages); export_ref_id is read from the lineage stamped edge into the code's node; due rows are CLAIMED with a lease (next_attempt_at moved ahead before the bridge is called), so two workers never post the same code and no database lock is held across the bridge's round trips; rows whose next_attempt_at is in the future are skipped. Per code: the existing code-only ad-name call → withheld = pending with the bridge's reason (never an error) → assembled + launch_task_id: build the full PackageRequestProducer (assets below), validate it against the contract BEFORE the wire (in code — app/core/launch_packages/contract.py, pinned to the schema by test, because the api image carries no packages/contracts), store the manifest snapshot, POST /launches/{launch_task_id}/package, then in ONE core transaction upsert the row (attached, bridge_already), write the launch node + the launched edge, re-post the export node, and emit launch.package_attached to the outbox (audit-only: no consumer before S14). 404 / 409 / 5xx → error with attempts, last_error, next_attempt_at (backoff), retried on later cycles; 401 → _assembled_ad_name's one-fresh-token rule. A workspace's failure is a report line; nothing raises out of run_once.
5. State: db/migrations/unified/core/NNN_launch_packages.sql (next free number) — core.launch_packages(id, workspace_id, code, export_ref_id, launch_task_id, manifest_key, ad_name, assets jsonb, status ∈ pending|attached|error, bridge_already, attempts, last_bridge_reason, last_error, last_attempt_at, next_attempt_at, attached_at, created_at, updated_at, UNIQUE (workspace_id, code)); GET /api/creatives/{code}/package answers the row (the S10 evidence surface and the support answer to "did it attach?") — read-only, no attach-now route, no UI.
6. Assets under the current contract: a TM code → its stamped image (<code>__<concept>.<ext>, kind image, the register row's asset_key); an RC code → the newest ChatCut assembly that produced a file (the newest chatcut_assemblies row with r2_key, the delivery's own rule) when one exists, else each scene's selected clip as one video asset each — the version storyboard_scenes.current_video_version_id points at, its r2_key_voiced when present else r2_key (the delivery's choice; never mute, never assembly), named <code>__scene_01.mp4, <code>__scene_02.mp4, … (the delivery's zero-padded position). clips.zip stays a delivery route, not a package asset, unless ADR-005 and AssetProducer change first.
7. S10 hand-forward: the loop runbook's hop (2) proof becomes the reconcile's evidence — the job's log line, the Launch comment with working links, the lineage chain carrying the launch node — instead of a manual bridge POST.

Interfaces. Consumes: the S3 register, S4 lineage + outbox, both S8a bridge routes, R2, the in-process service-token mint. Exposes: the two package file routes + the read route, core.launch_packages, the cadence, the launch lineage node and the launched relation.

Steps. Bridge field + contract re-copy → migration + state seam → package file routes + manifest snapshot → reconcile job + worker cadence + backoff → lineage re-post + launch node/edge → tests + acceptance record + S10 hand-forward + open-items rows.

Acceptance. pytest apps/api/app/backend/tests/test_launch_package.py (fake bridge) + tests/core/test_launch_packages.py (Postgres) green: withheld → pending row, no package POST, no write beyond the row; assembled + launch_task_id → the manifest object stored, the exact producer body validated, posted once, one row attached, the launch node + launched edge, the export node carrying manifest_key + assembled_ad_name, one outbox event; a repeat cycle posts nothing; already: true → attached; 404 / 409 / 5xx → error with backoff, retried next cycle; 401 retried once only after a cached token; a code outside the window untouched; the file routes redirect in-workspace and 404 cross-workspace; test_migrate carries the new migration in BOTH version lists (the plan orders core/* before production/*, so the head stays production/004_sessions_workspace and its three asserts do not move). pnpm --filter contracts test + pytest packages/contracts green after the fixture re-copy. Live leg (after open item #15 deploys the bridge): on staging export one Explore image, link its Creative to a sandbox Launch, wait one cycle → the Launch comment with working links, GET /api/lineage/chain?type=creative_code&ref=<code> with the launch node, both pasted into docs/ops/v27-acceptance.md.

Out of scope. Creating Launches; any launch list/read API; an attach-now route or UI; the lineage drawer (V10); Meta upload; outbox consumers.

Waits on / Unblocks. V7 (V), S4 (S), S8a (S) / S10 (S).

V29 · Per-run settings and workspace instructions · L · W6 · feat/v/v29-per-run-settings (S1-rev)

Context. Open item #23, surfaced by V8 and left unfixed there. app/pipeline/config.py::load_settings_from_db(user_id=1) does not read a caller's settings — it ASSIGNS MODULE GLOBALS for the whole process (OPENROUTER_API_KEY, CLAUDE_MODEL, DEFAULT_ASPECT_RATIO, IMAGES_TO_GENERATE, IMAGES_TO_KEEP), and eleven pipeline entries call it with no argument, so every run of every workspace executes on legacy user 1's model, aspect ratio and image counts; 13 non-test sites read those globals afterwards. Passing the run's creator instead would turn a benign race into a real one — the image gate runs up to MAX_CONCURRENT_IMAGE_JOBS runs at once, plus the worker, and they share the globals. The same identity defect runs through the storyboard's operator instructions (storyboard_llm.load_instruction reads instructions for user 1; the System routes write them there), and through time: launch_config is documented as the durable snapshot a restart replays, but its nullable image counts send a restart back to whatever the settings table says TODAY, so a rerun is not reproducible. The outcome this card buys: no production run resolves mutable runtime behaviour through a legacy user identity.

Read first. app/pipeline/config.py (load_settings_from_db and every global it assigns); the eleven callers (orchestrator.py, expand.py ×3, expansion.py, longform.py, iv2_runner.py, labs_shared/runner.py); the 13 readers, and steps/step2_copy_qa.py, which imports CLAUDE_MODEL BY VALUE at import time and so cannot be fixed by a context field alone; pipeline/utils/claude_client.py (the fallback to the mutable user key); app/core/user_settings.py (get_values takes a legacy id only and refuses to choose among workspace memberships); services/pipeline_runner.py (launch_config's snapshot claim, the nullable counts, the restart path); pipeline/storyboard_llm.py::load_instruction and services/db_service.py's instruction reads/writes (both default to user 1); db/migrations/unified/production/005_products_workspace.sql (the cross-schema precedent this card follows); ADR-008 (the workspace credential and the bindings win at the gateway), ADR-009 (sessions.workspace_id is the runtime truth); apps/web/src/pages/products/NewSession.tsx (the SPA loads the creator's defaults and submits explicit values).

Deliverables.

1. The two values that leave per-user settings entirely. openrouter_api_key and claude_model are resolved by the session's workspace — the stored credential and the production.* binding (ADR-008) — never from a user row and never from a module global. The by-value import in step2_copy_qa and the mutable-key fallback in claude_client go with them: a caller's model must be an explicit argument or the binding's, never an import-time snapshot of somebody's setting.
2. The three that stay per-user, as CREATION defaults. default_aspect_ratio, images_to_generate and images_to_keep are resolved once, for the request's creator, at session creation, and the CONCRETE values are written into launch_config. Execution and restart read the snapshot and nothing else — which is what launch_config's own docstring already claims and the nullable counts break. A direct API caller omitting a value asks for the server-resolved default; omission is never conflated with an explicit 1:1.
3. An immutable RunScope resolved at the head of every background run, from the session's row, and attached to PipelineContext for the pipeline steps — but not carried by the context alone: the labs runner does paid preparatory work before a context exists, and the storyboard path has no PipelineContext at all, so the scope is passed explicitly through the pre-context work. load_settings_from_db loses its user_id=1 default and its callers; the globals remain as the shipped defaults for a caller with no scope.
4. A workspace-aware settings resolver in core — user_settings gains an explicit (workspace_id, legacy_user_id) read, because today's signature takes a legacy id and refuses to choose among a user's workspace memberships. A small core API addition, not a data-model change; S reviews it.
5. Instructions become workspace configuration. db/migrations/unified/production/006_workspace_instructions.sql on the S13 shape: production.instructions.workspace_id UUID, no cross-schema FK, backfilled from core.workspaces.slug = 'rescale' for the authoritative user_id = 1 rows, with a workspace+step uniqueness index. The other legacy per-user rows are left unmigrated rather than merged into one workspace — no runtime reader uses them, and merging competing prompts would be a silent edit; the migration's comments and the acceptance record say so. storyboard_llm.load_instruction reads by workspace, the System routes read and write by workspace, and the shipped-file fallback survives only for a workspace with no override.

Acceptance. pytest apps/api/app/backend/tests green, including: a static scan — no runtime load_settings_from_db call, no runtime read of the five old globals, no hard-coded instructions.user_id = 1 (bootstrap references such as the binding seed are allowed); a two-workspace concurrency test that synchronises two runs after resolution and proves each model call uses only its own workspace's binding and credential and cannot observe the other's — it fails against today's globals; a snapshot test — create a session with the creator's defaults, change those defaults, restart, and the original persisted values are what replay; a workspace-instruction test — two workspaces resolve different overrides, a workspace with none gets the shipped file and never another workspace's legacy row; a route test — the SPA's existing behaviour (load the creator's defaults, submit explicit values) still holds, and an omitted value asks for the server default. test_migrate.py carries production/006 in both version lists and its head asserts. docs/ops/v29-acceptance.md; open item #23 closed.

Out of scope. Retiring RENDER_PROVIDER (open item #21 — the binding validates the resolved provider rather than selecting it, so that needs capability work first); a per-user settings UI; row-level security; the unbounded background threads (open item #17, card A2e).

Waits on / Unblocks. V8 (V), S13 (S), M1 (V) / an honest per-run identity before the first outside workspace exists.

V8b · The default renderer is the workspace's binding · M · W6 · feat/v/v8b-render-provider-binding (S1-rev)

Context. Open item #21, discovered by V8. The floor of the three-level provider choice (per render → session → floor) was RENDER_PROVIDER: a box-global free-text system setting on the Operations page, read by one function (render_provider.active_provider), validated by nobody at write (a typo rendered on fal through normalise_provider), and read under a "never raise" contract — while every paid call had moved onto the workspace's bindings (ADR-008) and production.video was bound, seeded to fal beside eight active video rows, validating the resolved slug at every submit but choosing nothing. Two homes for one decision, one of them a text box. Two defects sat in the same path: the render worker dispatched any slug it did not recognise to HeyGen through an else (a corrupt job row bought a HeyGen clip) while its own comment claimed it failed closed, and the create route accepted any window-table slug (HeyGen included) and silently defaulted an unknown one, while the per-render override refused both. The outcome this card buys: one admin home for the default renderer, per workspace, validated when written and refused rather than guessed when unusable.

Read first. app/backend/services/render_provider.py (active_provider, PICKER_PROVIDERS, the per-provider tables), app/backend/services/model_gateway.py (bound_model), app/core/bindings/{store,seed,admin_router}.py, app/backend/routes/video_storyboard.py (create, GET /config, the override), app/backend/services/storyboard_runner.py (the dispatch), app/backend/services/system_settings_service.py, db/migrations/unified/production/003_settings_to_core.sql + infra/migrate/production/restore.sh (the restore re-runs 003 from the file — the precedent), ADR-006 §4, ADR-008 §4/§6, ADR-011, ADR-014.

Deliverables. (1) The floor is the workspace's production.video binding: render_provider.bound_provider reads it per call and slug_for_model bridges the bound catalogue row onto a render slug with no table of its own (a kie: row's own slug, else its provider's name; a row outside clip_policy.WINDOWS is refused). (2) The read contract refuses, never guesses: WorkspaceUnresolved (403) without a scope, RenderProviderUnavailable (503) for an unbound key or a model this app cannot render, a database failure propagated; the session levels keep never raising; main.py maps the refusal. (3) A session snapshots the floor at creation (ADR-014's rule): the create route resolves an omitted choice to the binding and stores that slug; an explicit value is canonicalised and must be a picker slug or the workspace's own default, else 400. (4) The worker fails closed: a job-row slug outside the window table fails the job before narration with nothing spent; an explicit HeyGen branch; the dispatch's else raises. (5) The SettingSpec retired (the Operations row disappears with no SPA change); production/008 moves a legacy RENDER_PROVIDER row onto the rescale workspace's binding in SQL without a model-id literal, only when no admin has set it, deletes the row and writes one audit 'clear' row; restore.sh re-runs it inside the copy transaction like 003 and reports it; checksums.py compares system_settings and its audit with exactly that row excluded on both sides. (6) The scope-less callers closed: storyboard_narration takes its window from the caller (required), the voice-clone preview passes the session's, the two fal probes name fal. (7) ADR-018; ADR-008 §6 superseded note; apps/api/CLAUDE.md (the three-level paragraph, the env row, the slug table gains kie:kling-3.0-omni); docs/runbooks/MIGRATION_PRODUCTION.md; docs/ops/v8b-acceptance.md; open item #21 closed, the operator parameter (the old host's .env) and the 006 restore gap recorded as items.

Acceptance. pytest apps/api/app/backend/tests green, including: the seed's video rows bridge onto exactly clip_policy.PROVIDERS; unbound → 503, a chat model bound to the key → 503, no scope → 403, a database error propagates, a session's own choice never touches the binding; GET /config answers each workspace's default (two workspaces, two defaults) and 503 for one that cannot render; an omitted create choice becomes the floor, an explicit one is canonicalised, an unknown one is 400, HeyGen only when it is the floor; the worker fails an unknown job-row slug and an unbound workspace with nothing spent and resolves a NULL-provider row through the floor; production/008 against a seeded binding (the restore's topology): a kie value moves the binding, a provider-named value maps through the provider's video row, an admin's binding is never reverted, an unmappable value moves nothing, the row is cleared with one audit row, a re-run is a no-op; test_migrate pins → 008; the S12 drill carries a legacy RENDER_PROVIDER row through restore.sh and verify.sh passes with the transformed row excluded. npm run build green; gitleaks clean. docs/ops/v8b-acceptance.md; open item #21 closed.

Out of scope. An allow-list on the binding's config or a models.active toggle (the picker stays a code fact; V5's extension); V5's page (the admin home is the existing binding route); the vendor keys (ADR-008 §5, S22); 006's missing restore backfill (its own item).

Waits on / Unblocks. V8 (V), V4 (V), S12 (S) / one admin home for the default renderer.

V5 · Minimal admin page: bindings + spend · M · W6 · feat/v/v5-admin-bindings (S1-rev 2026-09-07: S → M, W5 → W6, designed without Figma)

Read first. V4 endpoints.

Deliverables. Use V4's admin read endpoints only: /admin/bindings (table of workflow keys → model dropdown from GET /api/admin/bindings, save → PUT /api/admin/bindings/:workflow), /admin/spend (totals per provider/workflow for 24 h / 7 d from GET /api/admin/spend, guard thresholds form, pause state, Resume button → POST /api/admin/spend-guard/resume), providers list with masked keys (last 4, from the same endpoint). Role admin only.

Acceptance. Screen recording: change a binding, run a job, see the new model in the usage row; trigger a pause, resume from the UI — no DB access.

Out of scope. Users/roles UI (V11, later slice), charts.

S1-rev 2026-09-07 (size S → M, W5 → W6; the design replaces the Figma link). The design is final/skynet-s1-pages-ux-design.md §4: /admin becomes a module with a left rail (Bindings · Spend; /admin → /admin/bindings); /admin/bindings = one row per workflow key grouped by the bound model's modality, a picker listing only the models the SERVER says fit the key, per-row Save/Cancel (owner decision 2), provenance ("set by <email> · <when>" or "seed default"), the Providers list collapsed above (read-only; the keys stay in system settings until S22, ADR-018 §7), a persistent warning under a row whose save reply says the guard is paused (with a link to Spend); /admin/spend = ?window=24h|7d, the guard card keyed on paused_reason (threshold → Resume spending through a ConfirmDialog; kill switch → no Resume, the operator sentence), the Edit-thresholds dialog with 0 ≤ warn ≤ pause and the immediate-pause warning when the new pause is under today's spend, three KPI cards, two tables in USD (owner decision 3) with ≥ when unknown_events > 0. The api half (core bindings, S reviews): WORKFLOW_MODALITIES (the 15 keys → modality) in store.py; ONE store-level validator called by both set_binding (store.py:296) and ensure_binding (store.py:320-332, the seed's path — it validates only the row it would INSERT and leaves an existing binding untouched, so an idempotent seed never fails on a later catalogue change): 422 "model {slug} is a {modality} model; {key} takes a {expected} model", and for production.video ADR-018's bridge render_provider.slug_for_model imported at call time (the one bridge, never a copy) → 422 "model {slug} of provider {name} cannot render video (one of {PROVIDERS}); bind a renderable video model"; GET /api/admin/bindings gains expected_modality per key and renderable: bool per video model row (additive). Built on V2c. Acceptance adds tests/core/test_bindings.py cases (a chat model on production.image → 422 through set_binding and through ensure_binding on an unbound key; a chat model on production.video → 422; an already bound key is left as it is by ensure_binding whatever the model offered; the deploy regression — seed, make the bound video model non-renderable under the bridge, seed again → success, zero new bindings, the original unchanged; every seeded pair passes the map; renderable false for a video row of an unknown provider), an api parity test pinning apps/web/src/lib/renderSlugs.ts (labels and clip windows only) against clip_policy.PROVIDERS + WINDOWS, vitest for the picker filter and the guard-state mapping (state × paused_reason), the Playwright drive of the design's §4.8 (15 rows in groups; a binding change shows "set by <admin> · just now" and GET /api/bindings/production.concepts returns the new slug; the video picker lists exactly the renderable rows; viewer sees the Forbidden page; a pause below today's spend pauses and Resume restarts the window at $0.00; ?window=7d survives a reload; axe clean; screenshots in docs/ops/v5/); INTEGRATION_CHECKLIST.md rows 8/9; docs/ops/v5-acceptance.md. Waits on V2c as well.

V10a · Production polish — creative code, lineage drawer, performance footer · M · W6 · feat/v/v10a-code-lineage-snapshot (V10 split, S1-rev 2026-09-07)

Context. The first half of V10 (its winners / product-creatives deliverable), split out because it depends on two cards V10's page-by-page pass does not: V31 (the page the code chip links to) and V7b (the codes on the winner rows). The design is final/skynet-s1-pages-ux-design.md §7.2. The original V10 card text is kept under V10b for the record.

Read first. The design's §7.2; pages/winners/WinnersGallery.tsx, pages/products/ProductCreatives.tsx; V2c's LineageChain, Sheet, CopyButton, Money, RelativeTime; V7b's codes[] on GET /api/winners; GET /api/performance?code= (S7; performance.read).

Deliverables. On every winners-gallery card: one chip per code in codes[] (mono + CopyButton, a Link to /creatives/<code>) and a Lineage icon Button (aria-label="Lineage of <code>") opening the Sheet with LineageChain for type=creative_code&ref=<code>; the latest performance snapshot as a footer (€<spend> · ROAS <x> · <date>, the winner chip when creative_hit) fetched lazily when the card enters the viewport, cached per code for the page's life, silent on 403; no chip when codes is empty. On product creatives: the existing creative_code rendered mono + CopyButton + the same Lineage button, link and footer. The parity checklist's "winners gallery + product creatives (code + lineage drawer)" row.

Interfaces. Consumes V7b's codes[], GET /api/lineage/chain, GET /api/performance. Exposes nothing new.

Steps. V7b's type in lib/api.ts → the chip + link → the Sheet → the lazy footer → tests → acceptance.

Acceptance. npm run build; vitest for the chip cardinalities (0 / 1 / many) and the footer's 403 silence; a Playwright drive with a seeded chain (the chip text is the code, the copy button announces "Copied", the Sheet lists the chain's rows and returns focus to its opener, the chip links to /creatives/<code>, the footer appears for a code with a snapshot and nothing for an editor); screenshots in docs/ops/v10a/; docs/ops/v10a-acceptance.md.

Out of scope. Every other Production page (V10b); the creative page itself (V31); the api (V7b).

Waits on / Unblocks. V2c (V), V31 (V), V7b (V) / the parity checklist row.

V10b · Production polish — states, navigation, defaults, parity · L · W6 · feat/v/v10b-production-states (V10 split, S1-rev 2026-09-07)

Context. The second half of V10: the regression pass over the imported Production module, done as a rule per idiom rather than page by page. The design is final/skynet-s1-pages-ux-design.md §7.3–§7.7. The original V10 card (W4, M) read: Winners gallery + product creatives show the creative code and a "Lineage" drawer (chain from S4) and the latest snapshot (S7) when present; regression pass over Explore, Expand, Storyboard (scenes/clips/narration/manifest/delivery), Canva polish + callback, Localize, bulk recreate, labs; dead nav removed; error + loading states on every /production/* route; docs/checklists/production-parity.md with these rows explicitly: Explore create/open/regenerate/download; Expand create/open/regenerate/download; Storyboard scenes/clips/narration/render/download; Canva polish callback/download; Localize create/stream/output/download; bulk recreate; labs entry pages; winners gallery + product creatives (code + lineage drawer). Each row has columns owner, expected result, actual result, screenshot link. Acceptance: parity checklist all green with screenshots, run on staging in the W5 parity pass. Out of scope: Lighthouse/UX polish (V21, later slice).

Read first. The design's §7.3–§7.7; the reader reports 01 §5 and 02 §9 (the weak spots with file:line); components/ui/confirm-dialog.tsx:43-46; components/layout/Sidebar.tsx; shell/ShellLayout.tsx:58-67; pages/explore-experiments/ExploreExperimentsPage.tsx:51-53 and pages/products/NewSession.tsx:111-114; docs/checklists/proxy-io.md (the checklist shape); the pages the original card names (SessionView.tsx, the storyboard pages, CanvaPolishedLightbox.tsx, the localize pages, RecreateModal.tsx).

Deliverables. (1) Loading: every page-level Loader2 spinner → a Skeleton matching the page's layout (in-button spinners stay). (2) Errors: every bare error line and every silent .catch(() => []) → Alert error + Retry through useLoad; Settings.tsx:105-114's save gains try/catch + a toast; TeamPage.tsx:70,85,99,109 show ApiError.message; Operations.tsx:184,187 surface their messages; SessionView.tsx:262's approval reverts and shows the error; the four alert() calls → toast.error. (3) Confirms: SystemDocuments.tsx:200 and Operations.tsx:238 gain ConfirmDialogs with consequence-first copy; ConfirmDialog stops swallowing errors (stays open, disables the confirm while awaiting, shows the error line). (4) PageMeta on every page with a PageHeader. (5) Tokens: the raw palette classes in the files this card touches → tokens; the sidebar eyebrows text-sidebar-foreground/40 (3.7:1) and the brand sub-line /50 → /60 (5.1:1); the lint rules extended to the converted directories. (6) Navigation: the shell's workspace chip becomes a non-interactive <span> with a Tooltip; the shell's Admin entry stays (the explanation is the Forbidden page); the admin-only tools and the legacy lab routes stay (working tools and bookmarks are not dead nav). (7) The Explore Experiments defaults load api.getSettings() like NewSession.tsx (a skeleton on the three fields until settled). (8) docs/checklists/production-parity.md in proxy-io.md's shape with the rows the original card names plus: every /production/* page's loading skeleton and error banner, the PageMeta titles, the Explore Experiments defaults; columns owner · expected · actual · screenshot. One directory per commit so review stays readable.

Interfaces. Consumes V2c's components. Exposes nothing new.

Steps. The ConfirmDialog fix → one directory at a time (system, team, products, winners + canva, video-storyboard, localize, scraped-ads, labs) → the navigation items → the Explore defaults → the checklist → the two drives → the acceptance record.

Acceptance. npm run build; npm run lint clean for the converted directories; a Playwright drive over every /production/* route with (a) the API healthy — a screenshot per page, no console error, a document.title per page — and (b) /api/* routed to a 500 — every page shows the Alert error with Retry, none a blank or an endless spinner; the Explore Experiments fields seeded from the settings; the sidebar eyebrows measured ≥ 4.5:1; docs/checklists/production-parity.md filled on staging in the parity pass (the original card's acceptance); docs/ops/v10b-acceptance.md.

Out of scope. Lighthouse / UX polish beyond the states (V21); the code / lineage / footer half (V10a); redesigning any Production flow.

Waits on / Unblocks. V2c (V), V6 (V), V7 (V) / the parity checklist; S13 (S) as the original V10 did.

Built as (2026-09-11, PR #76). One rule per idiom, one directory per commit, each reviewed on its own (49 rounds). Every page-level read goes through useLoad with its abort signal, shown as the server's sentence alone in an Alert with a Retry, one alert per panel; the hook itself ties every answer to a copy of the dependencies it was read for, so a route or selection change reports a fresh load from its first render and never paints the previous request's data or failure (the sidebar reloads the same request per navigation instead of re-keying it). A page that can answer 404 keeps its not-found page. Action failures are toasts with the server's words; a refused delete stays in its ConfirmDialog; every destructive delete asks first. Every control is named by its visible label, every muted line clears AA on an inventoried token pairing, the shared badge palette uses the theme's tokens, the design-system lint covers every page directory, the shell chrome and the shared badge module and refuses a hover title on any interactive element, not only the shared Button; the session rows are a stretched link with a sibling delete control, not a button inside a button. iv2IngestCreative goes through a multipart helper so a refused upload reaches its dialog as the server's sentence; on the api, a stack without object storage answers every media request with a 503 naming the variables to set, and the dev seed writes the product and copy-board session the browser drive reads. The proof set: apps/web/src/shell/production-routes.ts (gate, fixture need, skeleton and request-on-arrival per route), routes.inventory.test.ts (equal to routes.tsx path for path and gate for gate), e2e/production-states.spec.ts (healthy with the answers held and forced-500 with the sign-in bootstrap exempt, scoped to the routed page's <main>, axe and the console on both, the console admitting only a documented list of what a dev stack lacks by design) — 80 of 80 on a seeded dev stack; its first pass found 25 red legs, each fixed and re-driven. Record docs/ops/v10b-acceptance.md; checklist docs/checklists/production-parity.md.

V31 · The creative page /creatives/:code · M · W6 · feat/v/v31-creative-page (discovered by S10, open item #31; S1-rev 2026-09-07)

Context. The workos bridge fills the Launch card's Creative URL with https://app.rescale.media/creatives/<code> and no SPA route exists (open item #31; docs/ops/s10-acceptance.md). The media buyer arriving from ClickUp, the editor tracing an image and the ops floor asking "did it attach?" all need one hub. The design is final/skynet-s1-pages-ux-design.md §5. The workos half (SKYNET_APP_BASE_URL on Railway) stays the operator's row.

Read first. The design's §5; app/core/creative_codes/router.py (GET /api/creative-codes/{code}, 404 for unknown and cross-workspace alike; asset_type is free non-empty text), app/backend/routes/creatives.py + app/core/launch_packages/job.py (the package row, its states, the 307 file routes), app/backend/services/launch_packages.py:95-121 (the package's kind is derived from the source identity — the preview authority), app/core/lineage/router.py (GET /api/lineage/chain), app/core/readback/router.py + job.py (GET /api/performance?code=, performance.read, agree-or-NULL), packages/contracts/creative-code/normalize.ts + roundtrip.json; db/migrations/unified/core/001_core.sql:126-176 (editor lacks performance.read).

Deliverables. A shell route /creatives/:code under RequireAuth (no Production sidebar — owner decision 7). lib/creativeCode.ts = the contract's normalizeCreativeCode copied (apps/web is not a pnpm workspace member, ADR-001 §9) and pinned by a vitest against the contract's live-samples.json (every raw → canonical pair) and schema.json's CreativeCode pattern; the page normalises first and navigates to the register code before fetching — a spelling that does not normalise onto the canonical grammar (the api's own rule, readlayer/queries._canonical) is the not-a-code state, and a hook N suffix is folded off (readback/job.split_hook). The register first; on its 200 the package, the chain and the performance in parallel through useLoad, each panel with its own states (the design's §5.4/§5.5): the register → the header (the subtitle from asset_type, team_made, kind as the code's own prefix, product_number, variant, issued_at; never inferred from TM/RC); the package → the Launch Package panel (pending with last_bridge_reason; attached with ad_name + CopyButton, the ClickUp link, the asset links → 307, the manifest link, attempts; error with last_error and the next try (formatTimeUntil(next_attempt_at)); 404 = the empty state "No launch package yet…", not an error); the chain → LineageChain inline (404 = "No lineage recorded for this code."); the performance → the newest snapshot summarised in EUR with — for null and a tooltip, "Show all N snapshots" as a table, 403 = an Alert info naming performance.read, count: 0 = the empty state. The asset preview from the package's first asset — the package asset's kind alone chooses <img>/<video>; a disagreement with asset_type shows a muted non-blocking line. The Open-in-Production action from the lineage's session node: a video_storyboard session → /production/video-storyboard/<session_id>, else its product → /production/products/<product>/sessions/<session_id>, else omitted. The register's 404 → the page's not-found state with the code in the title and NO further requests; the register's 403 → Forbidden. PageMeta = the code. lib/creativeApi.ts beside videoStoryboardApi.ts. docs/runbooks/LOOP_E2E.md hop 2 names the page; open item #31 narrowed to the workos half.

Interfaces. Consumes the four routes above. Exposes the route V10a's chips link to.

Steps. The normaliser copy + pin → the route + header → the four panels → the preview → tests → the acceptance record.

Acceptance. npm run build; vitest for the normaliser pin, the human-reference map and the panel-state mappings; a Playwright drive on the dev stack with a seeded chain (the register row through POST /api/creative-codes — the dev stack carries the scratch counter, infra/scripts/dev-counter.sh — and the lineage fixture re-keyed to that code through POST /api/lineage/nodes): /creatives/<code lowercased> redirects to /creatives/<code>; the six lineage rows in depth order with the root marked; an unknown code → the not-found state with no further requests (network log); the package panel's states from the V27 wire shape — vitest, plus ONE browser leg whose package answer is stubbed at the browser's network layer (an attached row needs the bridge, R2 and a Production image: the staging loop's hop 2 is the real one, and the leg says so in its name); as the seeded SMOKE_EDITOR_* editor the performance panel shows the permission sentence while the other three render; a service token → the bare Forbidden; axe clean; screenshots in docs/ops/v31/; docs/ops/v31-acceptance.md.

Out of scope. The workos half of #31; issuing or iterating codes from the page; editing anything.

Waits on / Unblocks. V2c (V), V7 (V), V27 (V), S7 (S) / V10a (V), the hop-2 click-through of LOOP_E2E.md.

V33 · The status page /status · M · W6 · feat/v/v33-status-page (discovered by X3, open item #33; S1-rev 2026-09-07)

Context. GET /api/status (ADR-012 §5, docs/runbooks/ALERTS.md §4) is the ops floor's data and the JSON is the page today. The design is final/skynet-s1-pages-ux-design.md §6. Two api gaps decide the card's shape: the response carries no cadence, so no page can say honestly when a cycle is late, and the route runs one query per returned cycle (app/core/synthetic/router.py:50-64 — up to 290 statements at ?cycles=288).

Read first. The design's §6; app/core/synthetic/router.py, checks.py (the statuses ok|fail|warn|skipped, the check names), app/backend/worker.py:61-67 (SYNTHETIC_INTERVAL_MIN, 0 disables); tests/core/test_synthetic_checks.py:402-443 (the exact-body assertion at :443); infra/backup/verify.sh:201-215 (reads checks only); docs/runbooks/ALERTS.md §4, docs/runbooks/INCIDENTS.md; docs/GO_LIVE.md:159.

Deliverables. The api half (core synthetic, S reviews): GET /api/status gains interval_minutes (the api reads SYNTHETIC_INTERVAL_MIN; the containers share the stage env file), next_expected_at (the newest cycle's observed_at + the interval; null when disabled or empty) and retention_days; the history read becomes one statement (WHERE cycle_id IN (SELECT cycle_id … GROUP BY cycle_id ORDER BY min(observed_at) DESC LIMIT %s), grouped in Python) so a request is three statements regardless of N; test_synthetic_checks.py:443 gains the keys. The page: a shell route /status under RequireAuth (any signed-in user — owner decision 1); the overall banner (ok / warn / fail counts, the newest cycle, "next expected <when>"), stale when now > next_expected_at + interval (two cadences missed: "No cycle since <time> — the synthetic worker may be down. The checks below are stale."), the disabled sentence when interval_minutes is 0; the checks table (the API's order; the status chip with the alert state as a second line in the same cell; detail and expected verbatim; latency_ms right-aligned; a row opens a Sheet with the check's fields and its results across the loaded cycles); the history grid (?cycles=12|48|288 as a SegmentedToggle; cycles as columns newest left, checks as rows, one glyph per cell ● ▲ ✕ ○ coloured by token, the detail in a tooltip, an aria-label per cell); auto-refresh every 60 s while the tab is visible for 12 and 48 cycles only (the 288 view refreshes on demand and says so), "updated … ago" live, a manual refresh, a failed refresh keeps the last data with a small warning. PageMeta "Status". docs/runbooks/ALERTS.md §4 gains the page and the three fields; INCIDENTS.md names it as the first look; open item #33 closed.

Interfaces. Consumes GET /api/status. Exposes the three additive fields.

Steps. The api half with its tests → the banner rule + the grid as pure functions with vitest → the page → the Sheet → the refresh policy → docs → the acceptance record.

Acceptance. pytest tests/core/test_synthetic_checks.py: the three fields (incl. null / 0 when disabled), the statement count at cycles=288 (three), a response-equivalence test for the rewrite (the same cycle order, the same result order inside each cycle, the exact existing fields at cycles=288 with seeded rows); vitest for the banner rule (ok/warn/fail × fresh/stale/disabled from API-provided cadence), the alert mapping and the visibility pause/refetch; a Playwright drive on the dev stack with SYNTHETIC_INTERVAL_MIN=1: 11 rows with the API's texts, N grid columns for ?cycles=N, a row opens the Sheet, the worker stopped 3 minutes → the stale banner, axe clean; screenshots in docs/ops/v33/; docs/ops/v33-acceptance.md.

Out of scope. Editing thresholds or probes from the page; alert channels; an ops permission key (ALERTS.md's recorded deviation stands).

Waits on / Unblocks. V2c (V), X3 (A) / the ops floor's first look; INCIDENTS.md.

Built as (2026-09-11, PR #73). Two statements a request, not three: the cycle list folds into the history statement's subquery; a cycle_id tiebreak in the window's limit and the body's order makes two cycles at one instant deterministic (the edge keeps the smaller id). Staleness is judged at the answer's own instant and once more the moment two cadences run out (one timer per answer), so the 24-hour view turns stale while open without another request. The cadence reader checks.interval_minutes() is shared with the worker; a negative value refuses the worker at import and the route answers 500. dev.env.example runs the cycle once a minute so the page and e2e/status.spec.ts have rows; the stale browser leg fixes the browser's clock two cadences ahead, the stopped-worker drive is the staging record's row. Record docs/ops/v33-acceptance.md.

V7b · Winner rows carry their creative codes · S · W6 · feat/v/v7b-winner-codes (discovered by the S1 pages UX design, S1-rev 2026-09-07)

Context. The winners gallery must show each winner's creative code (V10a), but GET /api/winners (routes/winners.py → db_service.get_all_winners, db_service.py:2743-2768) returns session_approvals rows — a concept per session — while the register keys the asset: stamp_session_images issues one code per session_images row, (workspace, session_id, asset_id = str(session_images.id)) (stamp_service.py:13-16, 189-199), and a concept can own several image rows. "The winner's code" is not well-defined from the winner row alone, so the api answers with every code and never guesses. The design is final/skynet-s1-pages-ux-design.md §7.2.

Read first. app/backend/services/db_service.py:2743-2781; app/backend/services/stamp_service.py (the identity, the two-cursor shape); app/core/creative_codes/service.py:124-131 (find_by_source, the single-row lookup by that identity); db/migrations/unified/core/003_creative_codes.sql:23,26 (asset_id, session_id are text); db/migrations/unified/production/001_baseline.sql:243-251 (session_images.id SERIAL); apps/web/src/lib/api.ts:1230-1237 (getWinners).

Deliverables. Every winner row gains codes: [{code, asset_id, filename}] — every register row of the caller's workspace whose session_id is the winner's and whose asset_id is one of that concept's session_images ids, in asset_id order, explicitly zero, one or many; one core query for the whole list after the production read (a bulk sibling of find_by_source), comparing the register's text columns against the production ids stringified on the production side (str(id), as the stamp writes them), never the register's text cast to an integer. The getWinners type in lib/api.ts. docs/ops/v7b-acceptance.md.

Interfaces. Exposes the additive codes field on GET /api/winners and GET /api/winners/{product}. Consumes the register.

Steps. The core lookup → the route's assembly → tests → the type → the acceptance record.

Acceptance. pytest: a winner whose concept has no stamped image → codes: []; one stamped image → one entry with the code, the asset id and the filename; two stamped images → two entries in asset_id order; another workspace's register row for the same session id never appears; the existing winner fields unchanged. npm run build.

Out of scope. Showing the codes (V10a); stamping from the gallery; the product creatives (they carry creative_code already).

Waits on / Unblocks. V7 (V), S3 (S), S13 (S) / V10a (V).

Built as (2026-09-11, PR #74). Every codes[] entry carries product_number from the register row (the product-qualified identity open item #61 makes canonical); GET /api/products/{product}/creatives rows gain a sibling register: {code, product_number, asset_id, issued_at} | null, resolved by (workspace_id, products.product_number, creative_code) in one core statement and never by code alone (null, with no statement, for a product without a number or a code the register does not hold); a partial index core/013_creative_codes_source_idx.sql on (workspace_id, session_id, asset_id) WHERE asset_id IS NOT NULL (the ledger head stays production/008); the entries are ordered by the production image id (an integer, so 10 follows 9) then the register's issue order. Record docs/ops/v7b-acceptance.md.

V34 · The Explore instructions ship with the image · M · W6 · feat/v/v34-explore-instructions-shipped (discovered on staging by the loop plan's Step 4, open item #64; carded 2026-09-11)

Context. A fresh stack cannot run Explore: script-analysis, image-analysis and concept-generation exist only as production.instructions rows, no shipped file backs them and no fallback is registered, so load_spec raises Instruction not found for step: step1 (db_step: script-analysis) (app/pipeline/utils/file_io.py:42) on staging and on every new workspace. V29's "a workspace with no row reads the shipped file" is true only for the keys INSTRUCTION_FALLBACK_PATHS names (db_service.py:2518-2533: iv2-concept-generation, image-review, the storyboard steps, the craft rules). The canonical texts live only in the production app's database; the owner exports them once.

Read first. app/pipeline/utils/file_io.py:10-42 (load_spec(step, workspace_id=None, fallback_path=None), step_map, the DB read, the file fallback, the raise); app/backend/services/db_service.py:2457-2462 (INSTRUCTION_STEPS — display filenames only), :2518-2533 (INSTRUCTION_FALLBACK_PATHS), :2545-2590 (list_instructions, get_instruction, save_instruction); app/pipeline/steps/step1_analysis.py:14,49, steps/step2_concepts.py:95-102 (the iv2 branch passes a fallback, the default branch does not), steps/step4_review.py:27-28 (the pattern to copy); app/backend/routes/system.py:87-107 (GET list / GET one / PUT, require_admin); apps/web/src/pages/system/Instructions.tsx (eight tabs; V10b gives its load failure an error state above a disabled editor — V34 layers provenance on top of that); db/migrations/unified/production/006_workspace_instructions.sql; tests/test_video_storyboard_motion_history.py:1148-1149 (the fallback-file pin); open item #64.

Deliverables. (1) The three canonical texts as versioned files app/pipeline/instructions/script_analysis.md, image_analysis.md, concept_generation.md — exported ONCE by the owner from the production app's System → Instructions page; their sha256 and the export date go in the acceptance record (provenance), and a test pins each file's hash so an unreviewed edit fails. (2) INSTRUCTION_FALLBACK_PATHS gains the three keys; load_spec("step1"), ("step1_image") and the default branch of ("step2") pass fallback_path=INSTRUCTION_FALLBACK_PATHS.get(<db_step>). (3) A coverage test: every load_spec( call under app/pipeline and app/backend/services (found by AST, not grep) names a step whose db_step has a registered fallback file that exists — so the next step added without a shipped text fails the unit run. (4) Provenance on the api: GET /api/system/instructions lists EVERY step in INSTRUCTION_STEPS with source: "workspace" | "shipped" | "missing" (+ last_modified for a workspace row); GET /api/system/instructions/{step} answers 200 {step, content, source, last_modified?} for every known step (missing → content: "") and 404 only for an unknown step; a new admin DELETE /api/system/instructions/{step} removes the workspace row so the shipped text applies again (404 when no row). (5) The admin page shows a "Shipped" / "Edited <RelativeTime>" chip per tab, never presents a missing step as editable working text ("No text — the shipped file is absent"), and offers "Restore the shipped text" behind a ConfirmDialog (consequence-first: the workspace's edited text is discarded); the web client's getInstructions type gains source. Tokens only.

Interfaces. Exposes source on the two GETs and the DELETE. Consumes nothing new.

Steps. The owner's export → files + hashes → the registry + the three call sites + the coverage test → the api source + DELETE → the page → the record.

Acceptance. pytest: a workspace with no rows renders the step1 / step1_image / step2 prompts from the files, byte for byte; the coverage test; the hash pins; the list and the single GET's source for a row-backed, a shipped and a missing step; DELETE restores shipped and a second DELETE is 404; npm test for the chip, the missing state and the restore flow; on staging the loop plan's Step 4 Explore run succeeds with NO pasted rows (the owner's leg); docs/ops/v34-acceptance.md with the three hashes and the export date; open item #64 closed.

Out of scope. Changing any prompt's wording; the storyboard and craft-rule keys (already shipped); prompt layering (S3).

Amended 2026-09-14 (measured; plan round 0). Source of the texts (amended again the same day, plan round 2): the owner pasted Script Analysis, Image Analysis and Concept Generation into the session, copied from the old static-ads app's System → Instructions page; the three files ship byte for byte AS RECEIVED from that paste — not proven byte-identical to the historical database rows — and the record states the paste date, the byte length, the sha256, UTF-8, LF line endings and a Unicode code-point census per file. One ambiguity the owner must confirm BEFORE MERGE: rule 14 of the classic concept prompt lists three identical ASCII " among its "typographic quote characters". The staging-api export is no longer the source. A read-only search of the dev box found the texts nowhere else (open item #64). Never a placeholder. Required outcomes, measured against main 385ca89 (superseded: 32cfffc, see below): (1) apps/api/app/pipeline/instructions/{script_analysis,image_analysis,concept_generation}.md registered in INSTRUCTION_FALLBACK_PATHS; step1_analysis.py (step1, step1_image) and classic step2_concepts.py pass their fallback; concept_gen.md (Intelligence Mode) is NOT reused for classic step 2; the step-alias map in file_io.py is centralised so resolution, fallback lookup, errors and tests use one map. (2) Source per instruction: a non-empty workspace row → workspace ("Edited", even if byte-identical to the shipped text); no usable row and a readable shipped file → shipped; neither → missing; an empty row counts as no override. The list api returns every registered step with its source; unknown step → 404, known but missing → 200 with empty content and source: "missing"; an admin-only DELETE removes a workspace override (restoring the shipped text; a second DELETE → 404). (3) The page shows Shipped / Edited / Missing; a missing instruction never looks runnable; an explicit admin-only "Create workspace override" action (never pre-filled with placeholder text) and a "Restore shipped text" action with confirmation for an edited one. (4) When a step has neither a row nor a shipped file, load_spec fails with an operator sentence naming the instruction and the remedy (e.g. "Explore cannot start because instruction "Script Analysis" (script-analysis) has neither a workspace override nor its shipped file. Add a complete workspace override in System → Instructions or deploy the shipped instruction file."), which reaches the Explore page through session_progress.error. (5) Tests: fixture prompt texts only (never written under the real shipped directory); every alias reads its shipped bytes exactly and a workspace row wins; the api source combinations, unknown vs missing, DELETE; an AST test over literal load_spec calls resolving aliases and requiring a registered, existing fallback (dynamic keys validated separately); a file-existence + sha256-pin test for exactly the three shipped files that FAILS while any is absent, so the PR's CI stays red and it cannot merge short; web tests for the three states, override creation and restore. Merge only with the three real files, their hashes and paste provenance in the record, the owner's rule-14 confirmation, all tests green, and a fresh-staging Explore proof BEFORE merge: the PR's candidate image deployed to staging with no workspace rows for the three steps, Explore step 1 and classic step 2 loading with source: "shipped", recorded in docs/ops/v34-acceptance.md (a post-merge note does not substitute).

Amended again 2026-09-14 (plan round 2, agreed). Source of the three texts: the owner's paste of 2026-09-14 of all eight prompts, copied from the old static-ads app's System → Instructions page. The paste is split byte for byte and preserved under development-processes/skynet/inputs/2026-09-14-owner-paste/ with a manifest. The three files ship exactly as received: script_analysis.md 2,436 bytes sha256 aa613337f00953268975ba93dd925b249195e4cfe47175180c00c835ccb8a635; image_analysis.md 3,440 bytes sha256 82a2b727fba0fd54b16c8094bc5aa1c7c5882e32bb691398d8df114530a79130; concept_generation.md 9,727 bytes sha256 64b8e683734a8659f95f69d4d04b1a19a3dceb5db43d4c83414cb6d861795d51. Provenance in the record = the paste date, UTF-8, LF, the byte length, the sha256 and a Unicode code-point census per file; no staging row and no export time. Two observed source anomalies are retained, not repaired: script_analysis and image_analysis end with two empty - list items; rule 14 of concept_generation lists three repeated ASCII quotation-mark entries among its typographic quote characters. The earlier sentence that required the owner's rule-14 confirmation before merge is withdrawn: the owner stated the paste is exactly the old app's text. The merge gate replaces the pre-merge staging proof, because deploy.yml's deploy-staging job runs only for main and no branch deploys to staging, by design: "Merge only with the three real files, their hashes and paste provenance in the record, and all tests green. Before merge, run the candidate image from the V34 worktree in the dev stack with no workspace rows for the three steps; verify the list reports shipped, run Explore through step 1 and classic step 2, and record the session progress. After merge, repeat those checks on staging after main's automatic deployment, recorded explicitly as the post-merge staging leg. The acceptance record contains no credential values." The dev-stack leg is candidate-image functional proof, not a deployment proof. Required outcomes are measured against main 32cfffc, not 385ca89. The shipped-files test pins the three real hashes and fails on the base checkout because the files are absent, not because of placeholder pins. Tests distinguish an empty workspace row from no row, and a registered fallback path whose file is absent from an unregistered step. The AST test stays, narrowed to literal instruction-loader calls resolved through the shared alias map, with dynamic keys enumerated separately.

Built as (PR #80 → main 21a3547, 2026-09-15; the post-merge staging leg recorded in PR #82 → 1f10ece). Code 1 review round → 1 must-fix (card identifiers in moved comments). The three texts ship as apps/api/app/pipeline/instructions/{script_analysis,image_analysis,concept_generation}.md — the owner's paste byte for byte, 2,436 / 3,440 / 9,727 bytes, carried by the Dockerfile's existing COPY app/ with no Dockerfile change and pinned by test_explore_instructions_shipped.py, which also asserts the directory holds exactly those three files; one instruction_registry.py owns the call-site aliases, the display filenames, a label per step and the shipped file behind each, and db_service re-exports its tables so every existing importer is untouched; run_step1, run_step1_image and the classic run_step2 pass their fallback, while the Intelligence-Mode branch keeps concept_gen.md; workspace / shipped / missing is decided once and read the same way by load_spec and the api, so the page and a run cannot disagree; the list answers for every registered step, the single GET is 404 only for an unknown step and 200 with empty content for a missing one, and a new admin-only DELETE drops the override; a step with neither a usable row nor a readable file fails with an operator sentence naming the instruction and the remedy, which reaches the Explore page through session_progress.error; the page shows Shipped / Edited / Missing, an admin-only "Create workspace override" on an empty editor and a consequence-first "Restore shipped text". The browser drive caught an accessibility regression before merge and it was fixed in the same PR: the read-only instruction box is a fixed-height scroll container that took no tab stop (scrollable-region-focusable, serious — it overflows for the first time now that a step with no row resolves to 2.4–9.7 KB of shipped text instead of a one-line placeholder), and it is now a named region the keyboard can reach, the role before the name because a <pre> is naming-prohibited. 47 new tests; whole api tier 4066 passed / 11 skipped / 3 deselected / 0 failed against 4019 on the base checkout 32cfffc; web tsc -b clean, vitest 103 files / 752 tests. Two legs: the candidate image in the dev stack before merge, 11 checks, 11 ok; the deployed merge on staging after it, 14 checks, 14 ok — the version guard first and blocking on 21a3547, the three steps shipped with the pinned hashes, one classic Explore run on the reserved test product reaching completed_steps [1, 2] with no error, the three instructions byte-identical when re-read after the run, about 0.027 USD of spend, and one Explore session the only row the leg left on staging. Three deviations recorded: the single GET no longer accepts call-site aliases (key-only, as PUT and DELETE already were); a whitespace-only row counts as no override; core/test_settings_migration.py's list assertion reads the sources instead of the rows. Record docs/ops/v34-acceptance.md; open item #64 closed; carded while building: open items #83 and #84.

Waits on / Unblocks. Nothing (the texts arrived 2026-09-14, open item #64) / the staging loop plan's Step 4 on a fresh stack; every new workspace's first Explore run.

V35 · The design system's lint covers the last of the web tree · V · M · W6 · chore/v/v35-design-system-whole-tree (discovered while planning open item #66, open item #70; carded 2026-09-15)

Context. The design-system rules run over a hand-kept file list, not over the tree. apps/web/eslint.config.js:29-56 names src/components/{ui,layout,creative-code}/**, src/shell/auth/**, three shell pages, src/shell/RequirePermission.tsx, src/shell/pages/{admin,creatives,status}/**, eleven src/lib modules, src/test/**, src/pages/** and src/shell/ShellLayout.tsx, and the comment at :24-27 says each later card widens files with its directory. Nobody widened it for src/components/'s own files. Measured at 32cfffc by running design-system/no-raw-palette, design-system/no-title-on-button and no-alert over all 282 files of apps/web/src: every file the list names is clean, and 53 reports sit outside it — 32 raw palette classes, 21 title= on an interactive element, no-alert none. All 53 are under src/components/. components/video-storyboard/ holds 28 (CharacterPanel.tsx 16, FrameSlots.tsx 4, ClipSequence.tsx 3, ImageLightbox.tsx 3, CastChip.tsx 1, RenderHistory.tsx 1) and components/LongFormOutputPanel.tsx 10 — the two the open item names, 38 of the 53. The other 15 are in four files it does not name: DocEditHistory.tsx 7, CanvaPolishedLightbox.tsx 4, expand-actions.tsx 3, ImageModelPicker.tsx 1. So the gap is the whole of src/components/, and the fix is a design migration followed by the end of the list.

Read first. apps/web/eslint.config.js:24-63; apps/web/eslint-rules/design-system.js:1-18 (what each rule promises), :20-21 (the palette pattern), :49-83 (INTERACTIVE, noTitleOnButton); apps/web/src/index.css:45-48,79-82 (--success, --warning and their --color-* aliases — the tokens the amber, green and emerald classes map onto); apps/web/src/components/ui/tooltip.tsx:19-28 (the rule a converted title= follows: aria-label names the control, a Tooltip explains it); components/ui/relative-time.tsx:27-36 (a focusable hint trigger already in the tree); the eleven files above; V10b's conversion of src/pages/** (the sequence to copy); .github/workflows/ci.yml:242-244 (web lint is continue-on-error "until the imported code is lint-clean"); open item #70.

Deliverables. (1) The 38 reports in the two directories the open item names, converted: every raw palette class replaced by the token that carries its meaning — amber → warning at LongFormOutputPanel.tsx:102,108 and CharacterPanel.tsx:1000,1020,1138,1196, green and emerald → success at LongFormOutputPanel.tsx:133 and CharacterPanel.tsx:1385 — and every title= on a control replaced by an aria-label that names it plus, where the text is a hint and not a name, a Tooltip that carries the hint. (2) The 15 reports in DocEditHistory.tsx, CanvaPolishedLightbox.tsx, expand-actions.tsx and ImageModelPicker.tsx converted the same way: the scope gap is the directory, not two of its entries. (3) One design-system block in eslint.config.js over src/**/*.{ts,tsx}: the 26-line files list and its "each later card widens files" comment are deleted, and the scoped block folds into the src-wide block no-nested-interactive arrives in, so every design-system rule — no-raw-palette, no-title-on-button, no-alert, no-nested-interactive and V36's no-tooltip-on-nonfocusable — holds over one scope. A file added after this card is inside the design system by default. (4) Web tests for what the conversion changes, in the files that have none: each control that lost a title= is found by its role and name, and its hint opens on focus. (5) docs/ops/v35-acceptance.md: the per-file report counts before and after, the token mapping, and the config diff.

Interfaces. Exposes the widened lint scope every later web card inherits. Consumes the theme tokens and the shared Tooltip.

Steps. The two named directories → the four unnamed files → the tests → the one block → the record.

Acceptance. A re-run of the design-system rules over all 282 files of apps/web/src reports nothing; cd apps/web && npm run lint green with the single src-wide block and no per-file allowlist; npm test green including the new tests; npm run build green; docs/ops/v35-acceptance.md merged; open item #70 closed.

Out of scope. Changing any component's behaviour or layout; the 14 hover-only tooltips and their rule (V36); flipping web lint to blocking (open item #66(b)); src/pages/**, already converted by V10b; the api.

Built as (PR #91 → main e0ee835, 2026-09-16). Code 1 review round → 2 must-fixes (a FrameSlots hint had started rendering on every slot where it used to exist only with history present; the converted CharacterEditor and history-strip controls had no tests), then confirmed. Measured on the base by widening the block first: 54 reports outside the list (the card's 53 plus ImageOverlayButton.tsx, reported by V36's rule only once in scope), all under src/components/, 32 raw palette classes, 21 title=, one non-focusable tooltip trigger; after: 0 over all 308 files of src. One block over src/**/*.{ts,tsx} carries no-raw-palette, no-title-on-button, no-alert, no-nested-interactive and no-tooltip-on-nonfocusable at error; the 26-entry list and its "each later card widens files" comment are gone. Tokens: amber → warning, green and emerald → success, red → destructive, sky (the file's own muted separators) → muted, purple → chart-4 in a border and a hover fill only with the label on foreground (4.38:1 on a card), the inferred badge keeping warning/80 at 4.74:1; contrast.test.ts gains no row. title= conversions land on V36's shapes: aria-label for a name; a Tooltip for a hint with the control itself as the trigger, ControlHint when the control can be disabled, HintTarget where the hint exists only while it is off; the lightbox zoom bar takes names alone because a hint trigger as the dialog's first focusable element opened an unasked tooltip and took the first Escape (pinned by a test); the sheet tile's name became Use Maya; ImageModelPicker's title= that repeated the visible text is gone. src/test/controls.ts no longer counts a natively disabled control as a control (the browser does not), tested both ways. Tests for every converted control by role and name with the hint on focus as the accessible description, both states under ControlHint; two new test files; 20 legs plus the review's additions fail on the base sources. whole web suite 118 files / 1018 tests green; npx eslint src 0 reports; lint 0; tsc; build; gitleaks. Out of scope, listed: a duplicated disabled "Edit character" button in two CharacterPanel components; LongFormOutputPanel's hand-rolled copy buttons duplicating components/ui/copy-button.tsx. Open item #66(b)'s condition (a lint-clean tree) is met: web lint has been blocking since PR #81 and now holds over the whole tree.

Waits on / Unblocks. V10b (V), V36 (V), the oi66 cleanup branch's no-nested-interactive block (V) / every later web card — and the lint-clean tree open item #66(b) needs before npm run lint can stop being continue-on-error.

V36 · Every tooltip's hint reaches a keyboard · V · M · W6 · fix/v/v36-tooltip-reaches-focus (discovered by open item #66(a)'s fix pass, open item #80; carded 2026-09-15)

Context. apps/web/src/shell/pages/status/StatusPage.tsx:102-111 wraps the history-window SegmentedToggle in a Tooltip whose trigger is a bare <span>. A <span> takes no focus, so "Auto-refresh is off for the 24-hour view" opens on hover and nowhere else: what focus actually lands on is the toggle's own tabs (components/ui/segmented-toggle.tsx:39-52 — role="tab" buttons with a roving tabIndex at :43), and they carry no description. Measured at 32cfffc over all 86 Tooltip elements in apps/web/src: 16 have a trigger that is neither an interactive tag nor carries tabIndex. Read one by one, 14 are defects; StatusPage.tsx:336 is sound (aria-hidden="true", its sentence on the cell's aria-label at :335) and SessionView.tsx:1977 is sound but only to a reader of the source, its trigger being an <a href> held in a local const at :1962-1972 and handed to the Tooltip as an expression at :1977-1980. The 14 sit in seven files: StatusPage.tsx:102,312; shell/pages/admin/SpendPage.tsx:62,270; shell/pages/admin/BindingsPage.tsx:134,139,224; pages/video-storyboard/VideoStoryboardSessionsList.tsx:175,187,201,209; pages/video-storyboard/NewVideoSession.tsx:881; pages/video-storyboard/VideoStoryboardDelivery.tsx:523; pages/video-storyboard/VideoStoryboardScreen.tsx:942. Three carry an aria-label on the trigger, and at exactly one of them (VideoStoryboardScreen.tsx:942) it repeats the tooltip's own sentence; the other two name the control without giving the explanation. So at 13 of the 14 the sentence exists on hover alone. The tree already holds the answer: components/ui/relative-time.tsx:27-36 gives its <time> a tabIndex={0} and a focus ring so the same tooltip opens on focus. The card takes all 14 sites and is sized M for them: the open item could name only the one site its own fix pass walked into, and the measurement is what the scope follows — a rule that holds over one page and 13 known defects beside it is a rule nobody can trust.

Read first. apps/web/src/components/ui/tooltip.tsx:19-52 (the contract in the doc comment; Trigger render={children}; aria-describedby only while the popup exists); components/ui/relative-time.tsx:13-37; components/ui/segmented-toggle.tsx:10-56; shell/pages/status/StatusPage.tsx:83-112 (the visible auto-refresh line and the sr-only announcement at :96) and :300-341 (the two grid tooltips, one sound and one not); the fourteen sites above; pages/products/SessionView.tsx:1958-1982 (the sound expression trigger this card inlines); apps/web/eslint-rules/design-system.js:49-83 (noTitleOnButton — the rule this one sits beside) and eslint-rules/design-system.test.js; apps/web/eslint.config.js:28-63; e2e/status.spec.ts (the page's axe pass); open item #80.

Deliverables. (1) The status page's own two: the reason moves into the header line a keyboard user already reads — the visible "auto-refresh off" text at :84-94 says why it is off for this window — and the toggle's tabs are described by it, so the explanation arrives at the control instead of over it; the column-header short time at :312 takes the RelativeTime shape (a focusable <time dateTime> with a focus ring) so its full instant opens on focus. (2) The other 12, each by the shape its site calls for. Nine of them are a hint on a word, a count or an icon, and they share one focusable trigger from components/ui/ — one component, not nine hand-written tabIndex attributes; the four VideoStoryboardSessionsList.tsx sites among them use the shared RelativeTime and that trigger instead of formatting a relative time by hand. (3) Two of the 12 already name their control with an aria-label (BindingsPage.tsx:139,224): they keep the name and gain the sentence as a description, so a reader hears both. (4) The twelfth, VideoStoryboardScreen.tsx:942, is a drag handle — a pointer-only affordance. It keeps its aria-label and loses the Tooltip rather than keeping a hint no keyboard can open, and the column-width control says once, in the text beside it, that it is dragged. (5) A new rule design-system/no-tooltip-on-nonfocusable: a Tooltip's trigger must be an interactive tag, carry tabIndex, or be aria-hidden="true"; a trigger the rule cannot read — an expression child among them — is reported rather than skipped. The one sound expression case is answered by the source and not by an escape: SessionView.tsx:1977-1980 inlines its <a href> into BOTH branches of the conditional, so the rule reads an interactive tag at each branch and what the rule reads is what a reader reads. No line in the tree suppresses this rule, and none is asked to. Its cases in eslint-rules/design-system.test.js; the rule turned on in the design-system block of eslint.config.js. (6) docs/ops/v36-acceptance.md.

Interfaces. Exposes the design-system/no-tooltip-on-nonfocusable rule and the shared focusable hint trigger every later page uses. Consumes nothing new.

Steps. The shared trigger → the status page → the other six files → the inlined anchor in SessionView.tsx → the rule and its cases → the record.

Acceptance. npm test: the status page states the reason visibly and the toggle's tabs are described by it, with no hover; the column header's full instant opens on focus; one test per converted file that the trigger takes a tab stop and the hint opens on focus; the rule's own cases (an interactive tag passes, tabIndex passes, aria-hidden passes, a bare <span> fails, an expression child fails); SessionView.tsx's polish rows render the same link in both branches and pass the rule with no suppression. npm run lint green with the new rule on and no eslint-disable for it anywhere under apps/web. npm run build. e2e/status.spec.ts axe pass still clean. docs/ops/v36-acceptance.md merged; open item #80 closed.

Out of scope. The raw-palette and title= conversion of src/components/ and the widening of the lint's files list (V35); redesigning the status page's window control or its refresh policy; StatusPage.tsx:336, which is already sound.

Built as (PR #90 → main 67bf1a4, 2026-09-16). Code 1 review round → 1 must-fix (the new rule accepted anchors without an href and disabled controls by tag name) and 1 note (a non-literal tabIndex was accepted blindly), then four re-check rounds, each finding a way the rule or the wrapper could still leave a keyboard without the hint (a dynamic disabled beside tabIndex={0}; an always-focusable wrapper adding a tab stop beside an enabled control; the enabled child not inheriting the wrapper's aria-describedby; the rule accepting ControlHint by name without reading the wrapped control; off without a matching disabled), each fixed with cases → APPROVE. Measured on the base: 91 Tooltip elements, the rule reports 16 (the card's 14 plus two expression triggers, SessionView known-sound and CreativeInsights new since the card). components/ui/hint-target.tsx (HintTarget, a span with tabIndex={0} and the focus ring on useRender, render= swaps the tag) is the one focusable hint trigger; SegmentedToggle gains ariaDescribedBy on every tab; the status page shows the reason in its header line for the window it applies to and describes the tabs by it, the column heading is a focusable <time dateTime>; BindingsPage's two named icons keep their name and gain the sentence as a description (role="img"); the sessions list formats ages through RelativeTime; the drag handle keeps its label, loses the tooltip, and the control's text says once that it is dragged; the two expression triggers are written out in both branches. components/ui/control-hint.tsx (ControlHint) carries a hint on a control that is sometimes disabled: the control itself is the Tooltip trigger while enabled and the focusable wrapper only while off, so the description is always on the element that has focus and no page gains a tab stop it did not have; the tightened rule found five such sites (IntelView ×2, ScrapedAdsList, AdAnalysisPanel, VideoStoryboardCopyBoard), all converted, with both states asserted (toHaveAccessibleDescription on the control while enabled, on the wrapper while off). design-system/no-tooltip-on-nonfocusable (173 cases in design-system.test.js, in the scoped block, files untouched): an interactive tag that can take focus, a readable non-negative tabIndex (literal, negated literal, conditional or logical of such with a reachable value ≥ 0), or aria-hidden="true"; a ControlHint is read through to the control it wraps, whose disabled source must equal the wrapper's off; anything unreadable is reported by shape, never skipped; zero eslint-disable for it. Discovered and fixed: a hand-written tabIndex={0} wrapper on the new-session page with no focus ring. Discovered, filed: open item #90 (the login page's fake-timer "send again" test failed once under load). Base proof: 11 new tests fail on the base sources. Final tree: whole web suite 116 files / 994 tests green; lint 0/0; tsc clean; build ok. Lesson recorded: a lint rule that accepts a wrapper component by name is a hole; read through to what it renders.

Waits on / Unblocks. V33 (V), V5 (V), V10b (V) / V35 (the single src-wide block carries this rule with it).

V37 · A whole-suite web run under load proves what a single run proves · V · S · W6 · fix/v/v37-settings-seed-race (discovered by open item #66(a)'s verification, open item #81; carded 2026-09-15)

Context. Two web tests each failed once in a whole-suite run that shared the 4-core dev box with other test tiers, and passed alone. The first names a real race, not a flake. apps/web/src/pages/system/labels.test.tsx:124 asserts the "Images to Generate" box holds 8, the fixture's value at :85, and the test's only gate is await screen.findByRole('button', { name: 'Save Settings' }) at :121. pages/system/Settings.tsx:28-32 mounts the form state at imagesToGenerate: 12, imagesToKeep: 10, :55-63 copies the loaded row over it in an effect, and :127's settingsReady = defaults.data !== null gates the Save button (:136-142) and the number boxes (:166) together. So the commit that first paints the button paints the boxes at 12 and 10, and the effect's next commit replaces them with 8 and 6: for one commit the page shows numbers nobody stored, and the run that failed read 12 — the mount value exactly. The second case is on a tree that is not main: at 32cfffc, apps/web/src/pages/admin/CreativeInsights.test.tsx holds five tests and no keyboard test. The failing one lives on chore/v/oi66-tracked-cleanup at 9f85a14, apps/web/src/pages/admin/CreativeInsights.test.tsx:123-166 ("selects a product from its row by keyboard with Enter and with Space, and leaves no click target to the mouse"), whose helper at :49-52 issues up to 20 userEvent.tab() calls and whose close clicks every element of a row in turn, all under TooltipProvider delay={0} (:40-46); it failed with a stack and no assertion message. apps/web/vitest.config.ts:15-20 sets environment, setupFiles, css and include and nothing else, and src/test/setup.ts configures no timeout, so vitest's 5,000 ms per-test limit and Testing Library's 1,000 ms async limit are what a contended box must meet across the suite's 103 test files (102 under src, plus the lint rules' own, vitest.config.ts:19) and 616 literal it(/test( declarations.

Read first. apps/web/src/pages/system/labels.test.tsx:85,102-126; apps/web/src/pages/system/Settings.tsx:27-67,125-170; apps/web/src/lib/useLoad.ts; apps/web/vitest.config.ts; apps/web/src/test/setup.ts; on the branch, chore/v/oi66-tracked-cleanup:apps/web/src/pages/admin/CreativeInsights.test.tsx:40-75,123-166; apps/web/src/pages/admin/CreativeInsights.tsx (the row button and its tooltip); open item #81.

Deliverables. (1) The reproduction first, recorded before any fix: the whole web suite run repeatedly beside a CPU-bound neighbour on the 4-core box, with the run count, the neighbour's shape and the observed failure rate per case — a fix with no reproduction behind it is a guess, and the open item asks for the measurement before the verdict. (2) The page, not only the test: Settings never renders a value it has not loaded — the editable state is seeded at the moment defaults.data becomes readable, not copied in a later commit — so no commit paints 12 over a stored 8. (3) The test's gate names the thing it asserts on, so it can no longer pass or fail on which commit it caught. (4) The second case carried to the same end on its branch: reproduced, its cause named (the tab loop and the click sweep against the 5,000 ms default, or a real ordering the page owns), and the page or the test made deterministic — never a raised timeout over an unexplained failure. (5) Whatever the reproduction proves the suite needs under load is set in vitest.config.ts explicitly, with its measured reason in the record; nothing is set on suspicion. (6) docs/ops/v37-acceptance.md: both reproductions, both causes, both fixes, the re-runs.

Acceptance. npm test green alone; the whole suite green through the recorded repeated runs beside the same CPU-bound neighbour that reproduced each failure, at the run count the record names; a test that fails on the pre-fix Settings page when the seeding commit is delayed and passes after it; npm run build green; docs/ops/v37-acceptance.md merged; open item #81 closed.

Out of scope. Changing the suite's runner or its pool shape beyond what the reproduction proves; the api test tiers; the oi66 cleanup branch's own merge; the other System pages' load gating, unless the reproduction implicates them.

Built as (PR #89 → main 2d97b9f, 2026-09-16). Code 1 review round → 2 must-fixes (the per-test budget was a round number, not a derived one, and the spend-page timeout the reproduction had surfaced was unexplained; both were measured and derived) and two notes on the record (disclose the discarded run sets; reconcile two worst-case figures), then APPROVE. The reproduction came first, on the pre-fix tree, the whole web suite beside N CPU-bound processes on the 4-core box: idle 1 run / 0 failures; 3 busy 5 / 0; 4 busy 5 / 1 (NewVideoSession's findByRole gave up at the 1,000 ms default); 6 busy 5 / 4 (the CreativeInsights keyboard test timed out at 5,000 ms three times, a SpendPage test once, two StatusPage gates twice); 26 whole-suite runs recorded in all, three discarded sets disclosed. Case 1, the settings page, did not reproduce in 16 runs and was fixed by analysis: settingsReady gated the Save button and the number boxes together, so the first commit painted the mount values 12 and 10 and the effect's next commit wrote the stored 8 and 6, a window always one commit wide; Settings.tsx now holds SettingsState | null seeded from the loaded row during render (the SessionView shape), never an effect copy, the Canva panel's identical effect converted the same way; the labels test's gates name the box they read and a new test records the box's whole value history through a MutationObserver, failing on the old page every time. Case 2, the keyboard test, reproduced and is not a race: each userEvent.tab() walks the document through jsdom's style computation at about 170 ms a step, 4.4 to 6.0 s under six busy processes; the per-action pauses were removed with userEvent.setup({ delay: null }), no event, order or assertion changed. Case 3, the spend page, was profiled on review: the one click that mounts the dialog, its portal and focus trap costs 230 to 383 ms idle and 911 to 985 ms under the neighbour; no test cost to remove. The budget is derived by a stated rule, the worst reported test duration anywhere in the 26 runs (7,166 ms at load 10.4 to 11.4) doubled and rounded up to the next second → testTimeout: 15_000; the same rule on the longest measured query wait (1,604 ms) → asyncUtilTimeout: 4_000 in setup.ts; hookTimeout and the pool untouched. Discovered and fixed: StatusPage.test.tsx gated on the page's permanent <h1>, painted before the api answers (case 1's defect class), moved onto the Checks table. Two findings recorded: 51 tests in 12 files set their own 20 or 30 s budgets, so the global budget never governed the worst test; reported durations include the per-test hooks. Final proof on the fixed tree: idle 199 s; beside the same six-process neighbour 481, 482 and 500 s, all green, 114 files / 914 tests, slowest 5,029 / 6,768 / 5,218 ms. tsc, lint and build clean. Filed as open item #89: a successful defaults.reload() re-seeds the form and discards unsaved edits, the behaviour the page always had, undecided.

Waits on / Unblocks. The oi66 cleanup branch merged, for the second case (V) / a blocking web suite whose red means a defect (open item #66(b)).

V38 · The Intelligence prompts a fresh workspace runs are the ones the team runs · V · S · W6 · chore/v/v38-canonical-iv2-prompts (discovered while building V34, open item #83; carded 2026-09-15)

Context. Five of the eight instruction prompts the owner pasted from the old static-ads app's System → Instructions page already ship in apps/api/app/backend/intelligence_v2/prompts/, wired as the empty-row fallbacks at app/backend/services/db_service.py:2535-2550. Three of the five are byte-identical to the paste; two are not. concept_gen.md, the iv2-concept-generation fallback at :2536, is 26,211 bytes, sha256 a56e9a2f18ea785d5331005827b49ed2ccda5f62edf6ec5aefe8faa9380a99e6, against the paste's iv2-concept-generation.md at 26,596 bytes, sha256 b858cc5a7b28c84efbf0f1d76d2afe42b8eb9918d0d379afa0d28e4a240b5b46 (both paste values as development-processes/skynet/inputs/2026-09-14-owner-paste/MANIFEST.md pins them): the paste carries a whole instruction the shipped file lacks (rule 15, "JSON field encoding"), a rewritten "prompt" field description in the OUTPUT FORMAT block, and two trailing residue lines. craft_rules_tofu.md, reached through the craft-rules-{tofu,mofu,bofu} comprehension at :2546-2549, is 7,025 bytes, sha256 dc631f7ef63d0149a6d9840daa9e9addf1b74c3c55617ce633d17e661ea06eb5, against the paste's craft-rules-tofu.md at 7,561 bytes, sha256 263730d528e96876ead5f0e13212db52088d82259c4a1398ee361082d094af3a: 49 lines only in the paste, 46 only in the shipped file — the shipped text assumes TOFU is always Problem-Aware, the paste makes the angle a brief-declared choice of three and rewrites every rule that leaned on that assumption. The owner decided on 2026-09-14 that the paste is canonical (open item #83). So a workspace with no rows runs two prompts the team does not use, and one of them is a different doctrine.

Read first. development-processes/skynet/inputs/2026-09-14-owner-paste/MANIFEST.md — the split rule, the per-file byte lengths, line counts and hashes, the Unicode census, anomaly 4, and Comparison C's line-level reading of exactly these two files — and the two source files iv2-concept-generation.md and craft-rules-tofu.md; apps/api/app/backend/services/db_service.py:2472-2477 (FUNNEL_STAGES, INSTRUCTION_STEPS), :2529-2531 (_INTELLIGENCE_PROMPTS_DIR), :2535-2550, :2577-2583 (get_instruction, which returns the row or the shipped file unchanged); apps/api/app/backend/intelligence_v2/generation/concept_gen.py:461-477 (load_craft_rules, whose body.strip() removes whitespace and nothing else); apps/api/app/backend/tests/test_video_storyboard_motion_history.py:1212-1233 (the existing registered-with-a-shipped-fallback test, the shape to follow); V34's shipped-file hash pin; open item #83.

Deliverables. (1) intelligence_v2/prompts/concept_gen.md and craft_rules_tofu.md replaced byte for byte by the paste's iv2-concept-generation.md and craft-rules-tofu.md — no reflow, no re-typing, no normalisation, so the shipped hashes become b858cc5a… and 263730d5…. (2) The decision on the two trailing lone-quotation-mark lines at the end of iv2-concept-generation.md (MANIFEST anomaly 4), stated in the record: they are KEPT. They do reach the model — get_instruction returns the file body unchanged and load_craft_rules strips whitespace only — and they are kept anyway, because this card's promise is that a fresh workspace runs the text the team runs, and the team's row is the text the owner copied; a repair only this card knew about would make the pinned hash a claim about our edit instead of about the source. V34 made the same call, the same day, on the same paste's two stub bullet lines. Changing a prompt's wording — the residue included — is an instruction edit with a card of its own, never a side effect of a provenance card. (3) A sha256 pin over every shipped prompt whose canonical source is that paste — concept_gen.md, craft_rules_tofu.md, craft_rules_mofu.md, craft_rules_bofu.md, image_review.md — in one table beside V34's pins, so the three that are already correct stay correct and an unreviewed edit fails the unit run; each entry asserts the file exists, is registered in INSTRUCTION_FALLBACK_PATHS, and hashes to its pinned value. (4) docs/ops/v38-acceptance.md: per file, the paste date, the byte length, the line count, the sha256, UTF-8, LF, the Unicode code-point census, the before and after hashes of the two replaced files, and the anomaly of deliverable (2); the paste directory is named as the source and no prompt body is copied into the record. (5) A fresh-workspace proof on the dev stack: with no production.instructions row for either step, an Intelligence Mode concept run and a TOFU craft-rules assembly read the new bytes, recorded.

Steps. The two replacements → the pin table → the record's provenance → the dev-stack proof.

Acceptance. pytest apps/api/app/backend/tests green, the pin table included — and failing on the base checkout, because the two replaced files still hash to the old values there, not because of placeholder pins; a diff of each replaced shipped file against its paste source is empty; the three untouched shipped copies still hash to the manifest's values; the dev-stack run of deliverable (5) recorded with the session progress; docs/ops/v38-acceptance.md merged; open item #83 closed.

Out of scope. Changing any prompt's wording, the residue included; the three steps whose shipped files are V34's and already merged — script-analysis, image-analysis, concept-generation — which this card does not touch; the source provenance api and the admin page's chips (V34); the directory's eval_image.md, eval_script.md and synthesis.md, which are not registered instruction steps and are not in the paste; reading production's live rows.

Built as (PR #85 → main 7d7e497, 2026-09-16). Code 1 review round → 3 must-fixes, all in the dev-stack leg and the record and none in the shipped files (the leg's TOFU proof hashed the local file after a substring match; the leg exited 0 on a FAIL and would have posted the paid session after a failed gate; the record did not say the leg was pending), then one re-check push-back (first-match section finding could pick a wrong block if a brief quoted the preamble; now the assembled user message is split on its section join, exactly one section may start with the craft-rules preamble and its successor must be the FUNNEL STAGE section, ambiguity fails) → APPROVE. concept_gen.md and craft_rules_tofu.md are the paste byte for byte (26,596 B b858cc5a…, 7,561 B 263730d5…; cmp silent; numstat 5/1 and 49/46 = the manifest's Comparison C); the two trailing residue lines are KEPT and the record says why; test_intelligence_instructions_shipped.py pins all five paste-sourced prompts (exists, registered path IS the pinned file, length, sha256, UTF-8, LF, one trailing LF; fails on base on the two real byte lengths; no directory-equality assertion because the directory holds three unregistered files). Whole api tier 4116 passed / 11 skipped / 3 deselected, +15 = the new tests. Dev-stack leg on the candidate image, 16 checks ok: both steps shipped with the new hashes and no last_modified, zero instructions rows, one Intelligence-Mode run (TOFU, one concept) complete through step 4 whose audit bundle carries the system prompt hashing to b858cc5a… and the craft block to 263730d5… extracted at structural boundaries; spend 0.142928 USD over 8 events; 1 min 56 s. Discovered: two callers hardcode prompts/concept_gen.md instead of shipped_path("iv2-concept-generation") (open item #87).

Waits on / Unblocks. V34 (V — the shipped-file pin table this card extends) / every new workspace's first Intelligence Mode concept run and every TOFU brief it assembles.

V13 · Contract/consumer tests + Production module docs · M · W5 · feat/v/v13-contract-consumers (S1-rev)

Context. Production already exists at real module roots, not at apps/api/production/ or apps/web/src/production/: API Production is apps/api/app/backend + apps/api/app/pipeline, distinct from app/core; web Production is the /production subtree mounted from apps/web/src/shell/routes.tsx, distinct from src/shell/. Four of the five contracts already have api-side consumers; auth has none, and a contract change alone never ran the api's consumers in CI.

Read first. AGENTS.md; apps/api/CLAUDE.md; docs/SECURITY.md; .github/workflows/ci.yml; packages/contracts/{auth,bindings,creative-code,lineage,launch}/README.md; the existing api consumers under apps/api/app/backend/tests/ and tests/core/.

Deliverables. (1) apps/api/app/backend/tests/contracts/: the pure contract consumers moved there (test_bindings_contract.py, test_launch_contract.py, test_launch_package.py) + the new test_auth_samples.py (the api's own verifier over the contract's sample tokens against expected.json; an api-minted access token against the access schema; the api's JWKS equals the contract's) + a README.md indexing all contract-consumer coverage. (2) The docker-backed consumer proofs stay in tests/core/; the V13 consumer suite names them: the seeded bindings' shape, the lineage fixture round trip, the creative-code normaliser parity. (3) The CI job contracts-consumers for the api-side consumers, on contract-package, api and workflow changes (its own path-filter key, not the contracts key's apps/** blur), wired into the required ci aggregator. (4) apps/api/app/backend/README.md for the Production backend module with a pointer from apps/api/app/pipeline/README.md. (5) apps/web/src/README.md for the Production frontend subtree mounted at /production.

Acceptance. The auth consumer proves the api agrees with packages/contracts/auth/samples/expected.json and validates an api-minted access token against the access schema; the api-side consumer suite covers auth, bindings, creative-code, lineage and launch from the app's side; contracts-consumers green on main and inside the required ci check; the two module READMEs merged, pointing at the architecture, security and ADR docs instead of duplicating them.

Out of scope. No new apps/api/production/ or apps/web/src/production/ directories; no rewrite of the contract packages, schemas or fixtures; no broad rewrite of apps/api/CLAUDE.md or apps/web/README.md beyond incidental pointer cleanup.

Waits on / Unblocks. S1a, S3, S4, S4b (the launch fixtures are in packages/contracts/launch/ since S8a's follow-up) / —.

X2 · Upload / download / SSE through the proxy · S · W5 (S1-rev)

Deliverables. Four checks on staging, in docs/checklists/proxy-io.md: (1) 400 MB document upload POST /api/products/{product}/documents via the shell; (2) storyboard clip download GET /api/video-storyboard/sessions/{id}/scenes/{scene}/clip/{variant} (signed R2); (3) 20-min Explore SSE GET /api/products/{product}/sessions/{id}/progress/stream stays open; (4) a storyboard render job survives a Caddy restart (queue leases). Pass/fail + timings.

Acceptance. All four pass on staging.

M2 · R2 prefix reconciliation (ADR) · M · W5 · docs/v/m2-r2-prefix (with Agon) (S1-rev)

Context. S13 made sessions.workspace_id and the workspace-scoped resolvers the runtime truth for Production (ADR-009). M2 decides how R2 keys follow the tenancy rule (architecture design §4: "queue rows, outbox and R2 keys carry the workspace") for new tenant-scoped writes without breaking stored keys, the durable Launch-package URLs or the few paths that rebuild a key from ids; existing objects keep their keys and a later card (M2b) moves them.

Read first. services/r2_service.py; pipeline/context.py (r2_session_prefix); services/storyboard_service.py (_r2_session_prefix, the adopt/purge/store sites); services/chatcut_runner.py (execute_assembly_job, _store); services/launch_packages.py (manifest_key, a carve-out); services/workspace_scope.py; ADR-008, ADR-009; the tenancy rule; PRD §6.

Deliverables. (1) docs/decisions/ADR-010-r2-key-prefix.md: new tenant-scoped writes use ws/<workspace_id>/<existing key>, applied at the key-construction seam, never inside r2_service; existing objects keep their keys; the carve-outs (exports/<ws>/…, global/docs/…, iv2/creatives/…, scraped-ads/…, flowkit-test/…) with the slice that owns each; the appendix = the stored-key inventory for the re-point job. (2) services/r2_keys.py — build_key, session_prefix (replacing the two duplicated session-prefix builders), legacy_session_prefix, product_key, staging_key, library_key, is_staging_key_of; every tenant-scoped producer builds its key through it, with the workspace threaded explicitly (request scope at mint time; the create paths' resolved workspace; PipelineContext.workspace_id; the session row in the storyboard service; ChatCut binds the session workspace at job start). (3) Reads of stored keys unchanged; the two audit-bundle rebuilds try prefixed then legacy; the storyboard purge deletes both prefixes. (4) The create/adopt boundary accepts only the caller's ws/<ws>/<staging family>/ keys (400 otherwise). (5) tests/test_r2_prefix.py + the pinned-shape tests updated. (6) apps/api/CLAUDE.md key structure, the STAGING/A6 notes, docs/ops/m2-acceptance.md; the follow-up card M2b · R2 re-point job written before its code exists.

Acceptance. ADR merged; pytest apps/api/app/backend/tests/test_r2_prefix.py green with no live R2 (pure key building, the audit-bundle fallback, the purge of both prefixes, staging-key validation, ChatCut binding, the context's workspace); the full suite green.

Out of scope. The copy/verify/re-point job itself (M2b); deletes of legacy objects; the manifest-key shape; tenancy for Intelligence v2, scraped ads, global docs, FlowKit; the standalone scraper service.

Waits on / Unblocks. S1a, S13 / M2b (needed by M5's retention manifest, the workspace export and S25b's purge).

M2b · R2 re-point job · M · W6 · feat/m/m2b-r2-repoint (with Agon)

Context. ADR-010 put every NEW tenant-scoped object under ws/<workspace_id>/… and left the objects written before it at their old keys. Until they move, a workspace's objects are split across two shapes — invisible to reads (every read follows the stored key) but visible to the purge, to a bucket listing, and to the cards that need one prefix per workspace: M5's retention manifest, the workspace export and S25b's purge. This card moves them.

Read first. ADR-010 (the Appendix is the inventory: 38 stored-key columns and JSON paths, six duplication groups, the RC asset_key sentinel that is not a key); services/r2_keys.py; services/r2_service.py.

Deliverables. r2_service.copy_object (server-side CopyObject — never download-and-reupload for 5–29 MB clips) + head_object (size, ETag, headers) + list_keys; app/core/scripts/r2_repoint.py: per workspace, per row of the inventory, copy → verify (HEAD: size always, ETag when the source is single-part, the streamed MD5 of the source against the copy's ETag when the source was multipart-uploaded — a server-side copy is single-part; Content-Type and Cache-Control carried over) → re-point every reference of that object in ONE transaction (the duplication groups move together; the workspace comes from the owning table's workspace_id, never from the key string; RC rows' asset_key sentinel untouched) → delete the old key only after the verification succeeded, with --dry-run, --workspace, --limit, resumable (a row already under the prefix is skipped), a report per family; the storyboard purge and the two audit-bundle fallbacks lose their legacy branch once every object has moved (a follow-up commit, gated on a bucket listing with zero legacy keys). Acceptance evidence: the dry-run report on staging, then the run, then the listing.

Acceptance. Dry run and run on staging with the report; pytest apps/api/app/backend/tests/core/test_r2_repoint.py green (the docker core tier — the only fixture with both schemas) (a fixture bucket of legacy objects across every family, every duplication group re-pointed atomically, a failed verification leaves the old key and the references untouched); the bucket listing on staging shows no legacy keys.

Out of scope. The carve-out families of ADR-010 §6 (they move with their own slices).

Waits on / Unblocks. M2 / M5 (the retention manifest), the workspace export, S25b.

Lane A — Agon (Platform & Intelligence)

Facts every A card relies on (verified against the repos): meta-ads-scraper — Dockerfile: stages node:20-bookworm-slim (deps, admin-build) → mcr.microsoft.com/playwright:v1.58.1-noble (production), PM2 via ecosystem.config.cjs, EXPOSE 8080 3000, healthcheck curl -f localhost:8080/health, CMD /app/start.sh; admin/middleware.ts (cookie admin_session L9, redirect to /login L46/64, matcher L71); admin/lib/auth.ts exports createToken/verifyToken/getSession/getCurrentUser/loginUser/getAuthCookieOptions/COOKIE_NAME; server.js L40 API_KEY = SCRAPER_API_KEY, auth middleware L111–115 accepts x-api-key or Authorization: Bearer; 10 cron.schedule calls (L1037 /10, L1070 /15, L1157 /5, L1441 /10, L1484 /20, L1516 /30, L1674 hourly, L1691 6-hourly, L1747 quarter-hourly, L1763 daily 03:40); package.json scripts test:unit = node --test test/, admin has build/lint, no test; migrations/ = 30 ad-hoc .sql files (no runner; full-schema.sql + supabase-schema.sql are the base); transcriber/Dockerfile python:3.12-slim, uvicorn app:app --port 9010; .env.example keys SUPABASE_URL/SERVICE_KEY/ANON_KEY/BUCKET, STORAGE_PROVIDER, R2_*, SCRAPING_PROVIDER, DECODO_AUTH_TOKEN, SCRAPER_API_KEY; live deploy = host compose at /opt/meta-ads (service app, external network meta-ads-net, ports 32804/32805 behind Plesk). RescaleOS — console/Dockerfile node:22-bookworm-slim, WORKDIR /workspace/RescaleOS/console, EXPOSE 3000, tini + docker-entrypoint.sh, CMD npm start; docker-compose.yml project name: rescaleos, service console, image ghcr.io/rescale-media/rescaleos:latest, env_file./console/.env.docker, DATA_DIR=/workspace/RescaleOS/console/data, named volumes rescaleos-claude-home, rescaleos-console-data (never touch in Plesk GUI); console/src/server/auth.ts exports SESSION_COOKIE="console_session", getUserFromRequest(req), requireUser/requireAdmin/requireStaff/requireStrategist(req), applySessionCookie, checkOrigin; route guard = console/src/proxy.ts; engine API token check in console/src/server/scripts/engineAuth.ts (x-cron-token); scripts build/start/lint (no test). static-ads-automation — top level app/ (backend, frontend, pipeline) docker/ flowkit/ scripts/ tools/ Dockerfile supervisord.conf schema.sql docker-compose.yml; Dockerfile node:20-alpine (frontend build) → python:3.12-slim, EXPOSE 8000; CI .github/workflows/docker-build.yml (dispatch-only). rescale-workos — top level service/ (src, scripts, package.json, pnpm-lock.yaml, railway.json, nixpacks.toml, vitest.config.ts) migrations/ docs/ scripts/ presentation/ archive/ secrets/ CLAUDE.md.

A2b · Sidecar network aliases · S · box-only

DROPPED (S1-rev): no sidecar mounting — the standalones are links.

A1a · Repo + imports + CODEOWNERS · M · chore/a/a1a-monorepo

Context. One repo with history from four. Runtime bumps ride along so day-1 CI runs on the target versions.

Read first. Technical plan §2.1 (layout); S0a hand-over (scrubbed workos tree path + pattern file); source layouts above; scraper Dockerfile (Node 20 → 24: Playwright base image stays v1.58.1-noble, deps stages become node:24-bookworm-slim), static-ads Dockerfile (python:3.12-slim → 3.13-slim; frontend stage node:24-alpine).

Deliverables. (1) Rescale-Media/skynet created; git subtree add --prefix=<dest> <repo> main for: static-ads-automation → apps/api (paths app/backend, app/pipeline, schema.sql, requirements.txt, Dockerfile, supervisord.conf, docker/, scripts/, tools/, flowkit/) and apps/web (app/frontend) — one subtree into apps/static-ads-import/ then git mv into the two targets in the same PR (history preserved by git log --follow); meta-ads-scraper → services/scraper; its transcriber/ → services/transcriber (git mv); RescaleOS → services/agent-runtime (console/ + workspaces/, engine dirs); the scrubbed workos tree → services/workos (plain copy, not subtree — the old repo's history contains secrets). (2) Root CLAUDE.md + AGENTS.md (package map + the TechDesk task-discipline rules from techdesk-skynet-integration-plan.md §1.4), CODEOWNERS (apps/api/production/* @vince, apps/web/* @vince, apps/api/core/* @sead, packages/contracts/* @sead, services/workos/* @sead, services/scraper/* services/transcriber/* services/agent-runtime/* infra/*.github/* @agon, db/migrations/* @sead @agon), .gitignore union + secrets/, .pre-commit-config.yaml from S0a, Renovate config. (3) Runtime bumps in the same PR: scraper Dockerfile deps stages node:24-bookworm-slim (rebuild sharp, run node --test test/), apps/api/Dockerfile python:3.13-slim (pytest app/backend/tests), frontend stage node:24-alpine (npm run build), console node:24-bookworm-slim (npm run build). (4) Old repos: README.md pointer + archived (GitHub "archive" flag) except rescale-workos (stays live, private, per S0a) and meta-ads-scraper/RescaleOS (stay live until their image ownership flips in a later slice — add the pointer only).

Acceptance. In the monorepo: pytest apps/api/app/backend/tests green on 3.13; cd apps/web && npm run build green on Node 24; cd services/scraper && node --test test/ green on Node 24; cd services/agent-runtime/console && npm run build green; cd services/workos/service && pnpm typecheck && pnpm test green; gitleaks detect on the repo = 0; git log --follow apps/api/app/backend/main.py | wc -l > 1 (history kept). Paste all seven command outputs.

Out of scope. Any behaviour change; CI workflows (A1b).

A1b · CI + governance · M · chore/a/a1b-ci

Read first. Implementation PRD §5; existing workflows (ecomprofits/.github/workflows/docker-build.yml for the SSH/compose pattern, RescaleOS/.github/workflows/docker-build.yml for build/notify); A1a layout.

Deliverables. .github/workflows/ci.yml (PR + main; dorny/paths-filter → jobs contracts (pnpm --filter contracts test + pytest packages/contracts), api (pytest apps/api/app/backend/tests), web (npm run lint && npm run build), scraper (node --test test/), runtime (npm run build), workos (pnpm typecheck && pnpm lint && pnpm test), secrets (gitleaks with infra/secret-scan/gitleaks.toml, always)); .github/workflows/deploy.yml skeleton (build matrix → GHCR for skynet-api, skynet-web only; deploy-staging, smoke-staging, deploy-prod jobs stubbed with if: vars.DEPLOY_STAGING_ENABLED == 'true' etc.; notify Telegram as RescaleOS); branch protection on main via gh api script infra/github/protect-main.sh (required checks = the seven job names, 1 review, linear history, no force push); PR template with Task: <key> / ADR: <n|none>; docs/CI.md.

Acceptance. A PR touching only apps/web runs web + secrets + contracts only (screenshot of the checks list); a PR without green checks cannot merge (screenshot of the blocked merge button); gh api repos/Rescale-Media/skynet/branches/main/protection output pasted.

Out of scope. Real deploys (A6/X7).

A2 · Compose stack + local dev · M · chore/a/a2-compose

Read first. Implementation PRD §4 (services table, ports, staging isolation) and §5; V3 (migrate entrypoint); sidecar compose facts above.

Deliverables. infra/compose/docker-compose.dev.yml (project skynet-dev: postgres:17 with pg_data volume + init SQL creating schemas core, production; migrate (apps/api image, python apps/api/migrate.py); api (uvicorn 8000, env from infra/env/dev.env.example); caddy (infra/caddy/Caddyfile.dev, port 38000) with exactly these dev routes: handle /api/* → api:8000; handle → static apps/web/dist with SPA fallback; unified app only, no mounted legacy UIs or sidecars); infra/compose/compose.prod.yml (project skynet: caddy, api, postgres, migrate [profile ops], backup, synthetic; internal network only; images by digest from .env.release) and compose.staging.yml (project skynet-staging, port 38001, own network and volumes, unified app only); Makefile: make dev (up + migrate + seed workspace/admin via apps/api/core/scripts/seed_dev.py), make dev-down, make logs; docs/runbooks/LOCAL_DEV.md.

Acceptance. Fresh clone: make dev → docker compose -p skynet-dev ps shows every service healthy; curl -s localhost:38000/api/healthz → {"ok":true}; curl -I localhost:38000/production returns 200; runbook merged. Paste ps output.

Out of scope. Real Caddy SSO rules (A3), staging deploy (A6).

A5-lite · Agent runtime reachable + SSO · M · feat/a/a5-runtime-sso

DROPPED (S1-rev): the console stays standalone until S3.

A3 · Caddy for the unified app · S · W2 · feat/a/a3-caddy (S1-rev)

Context. One gateway container for the unified app only. No /scraper, /studio, no aliases, no cross-host proxying — the standalones are links.

Read first. Architecture doc §5 (caddy row), §8 (cookies, CSRF), lock doc §4.1; apps/web build output.

Deliverables. infra/caddy/Caddyfile (env-parameterised): :80; handle /api/* → api:8000 (flush_interval -1, transport http { read_timeout 1h } for SSE); handle → apps/web/dist with SPA fallback; request_body { max_size 512MB }; header X-Request-Id {http.request.uuid} forwarded upstream; rate limit on /api/auth/* (10/min/IP, caddy-ratelimit module built in infra/caddy/Dockerfile); trust X-Forwarded-Proto from 127.0.0.1 only; cookies untouched. skynet-web image = Caddy + built SPA.

Acceptance. infra/caddy/test.sh on the dev stack: / 200 (SPA), /production/anything 200 (fallback), /api/healthz 200, 11th /api/auth/login in a minute → 429, X-Request-Id visible in the api log, 300 MB upload passes / 600 MB → 413, curl -N /api/products/x/sessions/y/progress/stream streams. Paste the output.

Out of scope. TLS (Plesk); anything for the standalone apps.

A6 · Staging stack on server.rescale.media · M · W3 · chore/a/a6-staging (S1-rev)

Context. Staging is the unified app only, on the rescale box, proving migrations, the read layer, the loop and the deploy itself.

Read first. Architecture doc §6; A2 compose.staging.yml; A3b.

Deliverables. /opt/skynet-staging running project skynet-staging on 127.0.0.1:38001, network skynet-staging-net, own volumes; .env.staging from SKYNET_STAGING_ENV_B64 (read-layer role skynet_readonly, R2 staging prefix, Resend/SMTP sandbox, LEGACY_LOGIN_DISABLED=0); vars.DEPLOY_STAGING_ENABLED=true; nightly pg_dump -Fc into /var/www/vhosts/rescale.media/private/pgdump/skynet-staging-<date>.dump (existing sweep); seeded smoke user.

Acceptance. https://staging.app.rescale.media/ loads with TLS; docker compose -p skynet-staging ps all healthy; the smoke gate passes on the next push (run link); the dump exists the next morning (ls -l).

Out of scope. Production (X7); any standalone app.

Superseded S1 text — the S1 "Scraper data-access spike → Gate G1" card, kept as history; the live card is "Intelligence data-path proof + pressure test → ADR-020" below

MOVED to S2 (S1-rev): "scraper data → unified PG for the Intelligence merge" spike + gate G1; text kept below for S2.

Context. Decide whether the scraper can run against PostgREST over unified Postgres meta_ads with R2 media and the unified JWT — with evidence, not opinion.

Read first. Lock doc §5 (the full spec); scraper facts above (18 .rpc() sites / 17 functions, STORAGE_PROVIDER=r2, SCRAPER_API_KEY, admin_session); migrations/full-schema.sql + supabase-schema.sql; lib/media-storage.cjs; admin/lib/supabase.ts, admin/lib/supabase-service.ts, server.js L130–141 (clients with db: { schema: 'meta_ads' }).

Deliverables. (0) Inventory: rg -n "\.rpc\(|\.from\(|storage\.from\(|createSignedUrl|\.channel\(|createClient\(" --glob '!node_modules' services/scraper services/transcriber → docs/spikes/a4-parity.csv (file, line, kind ∈ rpc|table|storage|signed-url|realtime|client, name, key-type ∈ anon|service|user, result ∈ PASS|FAIL|DEFERRED, note); first line of the report states hit count = row count. (1) Dev: restore the scraper DB dump into unified PG as schema meta_ads; create roles anon, authenticated, service_role; run postgrest/postgrest:v12 with PGRST_DB_SCHEMAS=meta_ads, PGRST_DB_ANON_ROLE=anon, PGRST_JWT_SECRET=<spike HS256 secret>; mint a service JWT (role: service_role) with that secret; point SUPABASE_URL at PostgREST and SUPABASE_SERVICE_KEY at the JWT. (2) Exercise every rpc (ads_browse, ads_browse_meta, brands_browse, teardowns_browse, intel_coverage, intel_label_distributions_v2, gold_next_item, gold_sample_draw, gold_scoring_rows, mi_claim_work, refresh_brand_metrics, enqueue_brand_teardowns, enqueue_missing_classifications, enqueue_missing_transcripts, research_bump_runs_seen, research_product_inputs, research_products_ranked) and every .from() path from the admin pages and the 10 crons (run each cron function once by hand: node -e or the existing manual endpoints) → PASS/FAIL per row. (3) Storage: STORAGE_PROVIDER=r2 against bucket meta-ads-media; admin/app/api/media/signed-url returns a working URL; one upload + one download verified by sha256. (4) Admin auth = the V6b middleware against the unified cookie; rg "auth\." admin/ server.js → each hit mapped or 0. (5) Realtime: rg "\.channel\(" → every subscription unused/polled/replaced. (6) One full cron cycle (all 10 schedules) against PostgREST with no new error lines vs a Supabase baseline log.

Acceptance. docs/decisions/ADR-003-scraper-data-access.md merged at the end of the spike wave with the parity table pasted, screenshot diff of the six admin pages (browse, intel, research, market-intel, gold, teardowns), the migration runbook draft (dump → restore → role map → env swap → smoke), and the verdict: pass (every row PASS or DEFERRED-with-owner for provably unreachable paths; rows 3–6 PASS) → A9 cutover a later slice; fail → scraper keeps Supabase, A7' a later slice, the failed rows listed with a fix estimate.

Out of scope. The cutover itself; fixing the scraper beyond what the spike needs.

X3 · Synthetic checks + backup freshness + status page · S · W5 · feat/a/x3-synthetic (S1-rev)

Deliverables. The ops floor as two producers (ADR-012): the api worker's 5-minute cycle (apps/api/app/core/synthetic/checks.py) records one row per check in core.synthetic_checks — /, /api/healthz, /api/auth/jwks through caddy, the workos bridge's /health, one read-layer query (SMOKE_READBACK_CODE in core.performance_snapshots), backup freshness (the newest dump under the api's read-only mount of the backup directory, prod daily/, < 26 h), the pre-deploy folder size (20 GB), host pressure (load > 24 for three cycles, available RAM < 32 GB, swap > 2 GB as a warn, disk free < 100 GB), external hosts by env (SYNTHETIC_EXTERNAL_PROBES, M4's rows) — and alerts on the second consecutive failure to Discord + Telegram, once per incident, with a recovery line; infra/synthetic/check.sh (the curl sidecar, prod + staging) keeps the outside view of the gateway and the bridge and alerts on its own when the api is down; GET /api/status behind SSO (the SPA page waits for its Figma link — open item #33). docs/runbooks/ALERTS.md, docs/runbooks/INCIDENTS.md.

Acceptance. Repository half: docs/ops/x3-acceptance.md (the tests: 22 api + 3 worker + 33 sidecar checks). Live half: docker stop skynet-staging-api-1 → alert within 10 min (screenshots); rename last night's dump → backup-freshness alert; GET /api/status shows both; containers restored.

Amended 2026-09-19 (the owner's decision: production at the terminal go-live). Under the staging write rule (architecture §6), this card's staging alerts are an explicit, narrow approved destination and nothing more: the Discord incoming webhook named by SYNTHETIC_DISCORD_WEBHOOK_URL (falling back to SPEND_GUARD_DISCORD_WEBHOOK_URL when blank) and the Telegram chat named by the TELEGRAM_BOT_TOKEN + TELEGRAM_CHAT_ID pair, the ops channel of docs/runbooks/ALERTS.md §2 (open item #34). Their purpose is alerts only. They are incoming webhooks and a bot used only to post, with no action-capable webhook or automation behind them. Their protection against staging noise is the rule this card built: the worker's ALERT_AFTER = 2 with core.synthetic_alert_state, and the sidecar's SYNTHETIC_ALERT_AFTER with SYNTHETIC_STATE_FILE, so a check alerts once per incident and says ok again once. This card is merged, so the proof that this endpoint is allowed and every other destination is refused before contact is in S27's acceptance.

X4 · Backup restore drill · S · W5 · chore/a/x4-restore (S1-rev)

Deliverables. infra/backup/restore.sh <dump> <target-container> + infra/backup/compare_rowcounts.py (two Postgres URLs, information_schema.tables, count(*) per table for core + production); drill on staging: restore last night's dump into a scratch postgres:17 container, compare, time it; docs/runbooks/RESTORE.md.

Acceptance. Runbook with output (counts equal, minutes); Sead repeats it from the runbook and comments "reproduced".

X5 · Rollback drill + cutover matrix · M · W4 · chore/a/x5-rollback-cutover (S1-rev)

Deliverables. infra/deploy/rollback.sh <sha> (reset checkout to <sha>, pin skynet-api@<digest> + skynet-web@<digest> from that run, up -d, restore the pre-migrate dump if the ledger head is newer) — drilled on staging; docs/runbooks/ROLLBACK.md; docs/CUTOVER.md matrix: old static-ads host → 301 to app.rescale.media/production/*; scraper and console URLs unchanged (links); workos untouched; DNS + TLS on the ecomprofits box; old-host crons: static-ads scrape_worker stopped at go-live, everything else stays; owner + trigger per row; the 14-day read-only window (M5).

Acceptance. Rollback on staging under 15 min (transcript); matrix acknowledged by Vince and Sead on the task.

X1 · Auth/session policy tests · S · W6 · test/a/x1-auth-policy (S1-rev)

Deliverables. e2e/auth-policy.spec.ts (Playwright): cookie flags and the refresh cookie's path scoping as the browser applies it; refresh rotation (old → 401, reuse revokes family); logout → /api/auth/me 401 on the first request after it, and a static-ads ?token= image URL likewise (the "within 60 s" of the contract is the cross-process cache ceiling, not a grace period); CSRF: mutating request with Origin: https://evil.example → 403. A CI job that brings the dev stack up and runs the spec against it on every change to the auth surface, the gateway or the spec — the staging run is the leg for Secure and the cookie Domain, which exist only over TLS with PUBLIC_HOST set. docs/AUTH_SESSION.md final (Skynet-only scope; the ?token= bridge is ADR-001 §6 — ADR-005 is the launch-package contract, and the two code comments citing it for the bridge are corrected by this card).

Acceptance. Spec green in CI (run link) and green against staging (output in docs/ops/x1-acceptance.md); doc merged.

X7 · Production stack prepared on server.ecomprofits.io + go-live checklist · M · W4 · chore/a/x7-prod (S1-rev)

Read first. A0, A2c, A3b; architecture §5, §7, §12.

Deliverables. SKYNET_ENV_B64 secret (prod values, escrowed); one manual workflow_dispatch deploy to /opt/skynet with DEPLOY_PROD_ENABLED still false in the automatic path: stack healthy on 127.0.0.1:38000, limits visible in docker stats; docs/GO_LIVE.md: T-1 (freeze, staging smoke, S12 dry run repeated, X3b pressure test passed), T-0 (stop old scrape_worker → final pg_dump of the old static-ads DB → migrate → restore into production → checksums → up -d → smoke → DNS flip → old-host redirect → comms), T+1 (synthetic green 24 h, dump on the Storage Box), owners, rollback trigger.

Acceptance. docker compose -p skynet ps all healthy on the production box; curl --resolve app.rescale.media:443:<ip> https://app.rescale.media/api/healthz → ok; checklist signed by Agon + Sead.

Amended 2026-09-19 (the owner's decision: production at the terminal go-live). X7 is the terminal go-live card. It runs after the implementation slices, after S3; S4 and S5 may follow it. The Skynet production stack is deployed only here, and nothing in S1, S2 or S3 waits for it. The repository half (the production deploy step, infra/env/prod.env.example, docs/GO_LIVE.md) is S1's go-live readiness; the live half above, from the secret to the signed checklist, is the go-live. T-1 carries two separate required gates: X3b (the app workload) and P-1 (the Intelligence workload and its effect on the ecomprofits pooler). P-1 runs on the release candidate, before the engine and the transcriber are activated and before the final source switch. In production the engine and the transcriber start disabled and stay disabled until P-1 passes. The release-candidate record, shared by P-1, X3b, the deploy and the final migration, is the commit, the image digests, the compose rendering hash, the cap values and the set of enabled services. A change to any of these after P-1 requires a new P-1 run. P-1's usefulness floor, beyond "no OOM, no restart, no cap breach": the scheduled workload completes within its configured interval; the queue or backlog does not grow across the proof window; the retry and error rate stays below a stated threshold; the proxy and API behaviour stays within the intended rate budget. P-1's runbook is the Intelligence activation pressure run (the planning documents' a4-p1-command-sheet.md), re-checked against the release candidate before use. The P-1 result fields go into the X7 go-live record. ADR-020's fail path for a late P-1: "A production pressure result does not reopen the accepted direct-Postgres data-path decision or invalidate completed A9 work. It decides only whether the Intelligence engine and transcriber may be activated on the proposed production release topology. A PASS permits activation under the tested images, caps, concurrency, neighbour set, and release revision. An INVALID result proves no capacity conclusion. Correct the measurement or run configuration, keep the engine and transcriber disabled, and repeat the run against the release candidate. A FAIL means the proposed activation configuration is not approved. Keep the unified application deployable and keep the legacy scraper authoritative. Select and record one safe remedy: lower caps or workload concurrency; change the host or topology while preserving the required database and security boundaries; or defer Intelligence activation. Any changed configuration requires a new passing pressure run before activation. A production pressure result does not authorize dual writes. The final migration and scheduler switch retain one stated source of truth and one rollback point." This fail path and the authority boundary are recorded as the recommended policy; the owner confirms them, and decides the remedy if a FAIL ever occurs. X7 executes the retirement artefacts A19 prepared: the final delta, the scheduler stop, the redirect, the archive and the removal of the old container. The scheduler is enabled in production after P-1 passes. Until that final switch the old scraper's data is authoritative. Staging output is never a production source and no production-facing workflow consumes it. No dual writes. X7 also executes A20's final console disable, redirect and archive and records them in its go-live record. It does this under its own readiness and rollback decision, separate from P-1. P-1 controls Intelligence activation and the scraper's authority switch only, and it is never the console-retirement gate. The production activation of S3's night-shift jobs is X7 work too. The old console and the old scraper each stay authoritative for their own domain until their own X7 switch. The go-live record lists the authorised production destinations (the staging write rule, architecture §6). The controlled change from sandboxed or disabled staging writes to production writes happens under the console switch's own readiness and rollback decision. The go-live acceptance includes the shutdown of the old standalone scraper and keeps the 47 unmeasured inventory rows visible. The S1 live-ad items (the creative-code loop with one real ad, the readback, SMOKE_READBACK_CODE) are go-live readiness evidence here. After the terminal deploy the automatic production path stays disabled unless it is deliberately re-authorised.

M6 · Comms + training pack · S · W6 (S1-rev)

Deliverables. docs/comms/ one page per audience: Bian (nothing changes for RescaleOS; the console stays where it is; Studio merge comes with S3 and needs his agreement), Cyrus + creative (Production lives at app.rescale.media, one login, exports carry the creative code, the package appears on the Launch card), media buyers (nothing changes in ClickUp; the package on the card), ops/research (scraper unchanged, reachable from the shell link), leadership (S1 exit gate met, the slice sequence). Sessions booked.

Acceptance. Pages merged; invites sent (screenshot).

A8 · Scraper ops soak (passive) · S · reviewed at the end of S1

DROPPED (S1-rev): the scraper is not part of the Skynet S1 runtime. Standalone scraper changes are allowed only through bridge track B.

M4 · Cross-box monitoring runbook · S · W6 (S1-rev)

Deliverables. The external hosts as external:* rows on the ops floor — the worker's cycle, not check.sh: ADR-012 §6 (written for X3, after this card) scopes the sidecar to this stack's own gateway and puts every other box on SYNTHETIC_EXTERNAL_PROBES, which X3 built and tested. So: the SYNTHETIC_EXTERNAL_PROBES entries for meta-ads.rescale.media and the console URL (200 — they stay live as standalones) and for the old static-ads host, whose expected status follows the cutover case (CUTOVER.md row 9: 301 when the old app had its own hostname, 200 when it was served under app.rescale.media and the rule is a proxy — a 301 there would loop). Railway workos /health already has its own workos_bridge row and is not duplicated. docs/runbooks/LEGACY_HOSTS.md: what runs where (production box vs rescale box vs Railway), what is probed by which producer, who is responsible for what, what the old host must answer after go-live, which crons stay, and what each red row means. The three documents that call this runbook "not yet written" are corrected with it.

Acceptance. Runbook merged; the staging and repository proof. At X7, the production external:* validation: the external:* rows on /status once the stack is deployed and the two unknown hosts are known (open items #2/#3, #30). The live-host rows are never an S1–S3 blocker (amended 2026-09-19).

Amended 2026-09-19 (the owner's decision: production at the terminal go-live). The production stack is deployed only at the terminal go-live. The acceptance above splits the staging and repository proof, which is M4's S1 acceptance, from the production external:* validation, which X7 runs. The live-host rows never block S1, S2 or S3.

A0 · Box prep on both boxes · S · W0 · box-only (S1-rev)

Context. Production runs on server.ecomprofits.io (48 cores / 250 GB / 1.2 TB free, Plesk + Portainer, production Supabase on the same box); staging on server.rescale.media. Everything the deploy pipeline assumes about the boxes is created here, once, by hand.

Read first. Architecture doc §5, §6, §9, §10; ecomprofits .github/workflows/docker-build.yml (the SSH/compose pattern already used on the production box); project_rescale_plesk_server notes (never edit containers in the Plesk GUI; Portainer = viewer).

Deliverables. On server.ecomprofits.io: mkdir -p /opt/skynet (git clone of the monorepo, branch main, deploy key read-only); docker login ghcr.io with a read:packages PAT; mkdir -p /var/lib/skynet-backups/{daily,pre-deploy} owned by the backup account, mode 750; Plesk vhost app.rescale.media → proxy 127.0.0.1:38000 with Let's Encrypt, HSTS, client_max_body_size 512m (DNS still points at the old host until go-live — issue the certificate via the staged hostname or DNS challenge); a Plesk Scheduled Task (daily 02:30) syncing /var/lib/skynet-backups/daily to the Hetzner Storage Box prefix skynet/; record a baseline docs/ops/box-baseline-ecomprofits.md (nproc, free -g, df -h, docker stats --no-stream, uptime). On server.rescale.media: /opt/skynet-staging clone, GHCR login, vhost staging.app.rescale.media → 127.0.0.1:38001 with TLS, staging dumps go to the existing Plesk private/pgdump sweep. Both: an SSH deploy user with the GitHub secrets SERVER_HOST_PROD/STAGING, SERVER_USER, SERVER_SSH_KEY, SERVER_DEPLOY_PATH_PROD/STAGING set.

Acceptance. Post in the task: ls -ld /opt/skynet /var/lib/skynet-backups/* on prod; curl -I https://app.rescale.media (with --resolve to the box) → 502 from Plesk (vhost exists, nothing behind it yet) and curl -I https://staging.app.rescale.media → same on staging; docker pull ghcr.io/rescale-media/ecomprofits:latest succeeds on both (login works); the baseline doc merged.

Out of scope. Any container; DNS flip (X7).

Amended 2026-09-19 (the owner's decision: production at the terminal go-live). The server.ecomprofits.io half of the deliverables and of the acceptance is X7-only work at the terminal go-live, with no S1–S3 dependency (open items #2 and #3). The server.rescale.media half is A0's S1 work.

A2c · Compose resource limits + Postgres tuning + concurrency caps · S · W2 · chore/a/a2c-limits (S1-rev)

Context. Skynet is a bounded tenant on the production Supabase box: ≤ 12 cores / ≤ 32 GB in total, enforceable in host-side compose.

Read first. Architecture doc §9 (the table and thresholds — this card implements it exactly); Docker compose fields cpus, mem_limit, mem_reservation, pids_limit, restart (not deploy.resources).

Deliverables. In infra/compose/compose.prod.yml (and the same values in compose.staging.yml): api cpus: 6, mem_limit: 12g, mem_reservation: 8g, pids_limit: 512; postgres cpus: 4, mem_limit: 12g, mem_reservation: 8g, pids_limit: 256, command flags -c shared_buffers=3GB -c effective_cache_size=8GB -c work_mem=16MB -c maintenance_work_mem=512MB -c max_connections=80 -c max_wal_size=4GB; caddy cpus: 1, mem_limit: 1g; backup and synthetic cpus: 0.5, mem_limit: 512m, backup wrapped in nice -n 10 ionice -c2 -n7; every service restart: unless-stopped. App env: MAX_CONCURRENT_IMAGE_JOBS=4, MAX_CONCURRENT_STORYBOARD_JOBS=2, MAX_CONCURRENT_EXPORT_JOBS=4, enforced by the job worker's semaphores (apps/api/core/jobs/limits.py) — no unbounded thread fan-out remains in pipeline_runner.py / storyboard_queue.py. docs/ops/RESOURCE_LIMITS.md = the table + how to change it.

Acceptance. docker compose -f infra/compose/compose.prod.yml config shows the limits; on the dev stack docker stats shows the caps; pytest apps/api/tests/core/test_job_limits.py (a 10-job burst never exceeds 4 concurrent image jobs); SHOW shared_buffers on the stack's Postgres = 3GB.

Out of scope. Limits for scraper/runtime services (S2 re-issue).

A3b · Deploy pipeline on the ecomprofits pattern · M · W3 · chore/a/a3b-deploy (S1-rev)

Context. Push to main → build → deploy staging (server.rescale.media) → smoke gate → deploy prod (server.ecomprofits.io) → Telegram. Same pattern ecomprofits uses on the production box, with digest pinning and a whole-file env secret.

Read first. Architecture doc §7 (the exact steps, guarantees, rollback); ecomprofits/.github/workflows/docker-build.yml (SSH via appleboy/ssh-action, compose pull/up, Telegram curl format); RescaleOS DEPLOY.md §2b (env-from-secret validation, .bak-*); A1b's deploy.yml skeleton.

Deliverables. .github/workflows/deploy.yml: build (GHCR skynet-api, skynet-web, tags main-<sha> + latest, outputs API_DIGEST, WEB_DIGEST, GIT_SHA build arg) → deploy-staging (SSH; git fetch && git reset --hard origin/main; decode SKYNET_STAGING_ENV_B64, validate (non-empty, required keys list in infra/deploy/required-keys.txt, no ANTHROPIC_API_KEY=), .env.staging.bak-<ts>, atomic write; write .env.release with IMAGE_TAG, API_IMAGE_DIGEST, WEB_IMAGE_DIGEST; docker compose run --rm migrate; pull; up -d; wait /api/healthz 60 s) → smoke-staging (infra/smoke/run.sh, architecture §7 step 3) → deploy-prod (same steps on /opt/skynet with SKYNET_ENV_B64, the same digests, gated by vars.DEPLOY_PROD_ENABLED; pre-migrate pg_dump -Fc to /var/lib/skynet-backups/pre-deploy/; abort if df --output=avail / < 20 GB) → notify (Telegram, ecomprofits format). Compose files reference ${API_IMAGE_DIGEST} / ${WEB_IMAGE_DIGEST} (image: ghcr.io/rescale-media/skynet-api@${API_IMAGE_DIGEST}), never latest. infra/deploy/rollback.sh <sha> per architecture §7. docs/runbooks/DEPLOY.md.

Acceptance. A push to main runs green through smoke-staging with deploy-prod skipped (flag off) — run link; .env.release on staging shows the digests from that run's build job; rollback.sh <previous-sha> on staging brings back the previous /api/version sha in under 15 min (transcript).

Out of scope. Production enablement (X7).

S8a · Narrow workos bridge: ad-name assembly + attach export package · M · W3 · old workos repo, branch feat/skynet-bridge-s1, deployed to Railway (S1-rev)

Context. S1 needs two things from workos: the assembled v3 ad name for an export, and the export package attached to the already-existing Launch card. No launch list/read/create/update API — that is S8b (S4).

Read first. Lock doc §4.5 (human-owned vs machine-owned fields); workos service/src/app.ts, index.ts (route mounting before serve), modules/cascade/webhooks.ts (registerWebhookRoute shape), modules/naming/assemble.ts (assembleAdName, AD_REQUIRED), clients/clickup.ts (resolveField, setCustomField, getTask, comments), config.ts (EnvSchema), test pattern apply-names.test.ts.

Deliverables. service/src/modules/skynet-bridge/ with registerSkynetBridgeRoutes(app, deps) mounted in index.ts; auth = Skynet service token (RS256, typ=service, verified with SKYNET_JWT_PUBLIC_KEY_PEM, jose). Endpoints: POST /naming/ad-name (AdNameInput → assembleAdName → {ad_name} or {withheld_reason, missing[]}); POST /launches/:id/package (body {creative_code, ad_name, assets:[{url,kind,filename}], manifest_url, source:"skynet"}; verifies the Launch task exists and its linked Creative's code equals creative_code; writes only Creative URL (durable app URL) if empty, posts one comment "Skynet export package" with the asset links + manifest, adds the skynet-package tag; never touches status, assignee or any machine-owned field; idempotent on (task_id, creative_code) via a comment marker). Config: SKYNET_JWT_PUBLIC_KEY_PEM, SKYNET_BRIDGE_ENABLED (default false). Fixtures in service/src/modules/skynet-bridge/fixtures/ (copied into monorepo packages/contracts/launch/ by V7).

Acceptance. pnpm vitest run src/modules/skynet-bridge green (mocked ClickUp: ad name assembled for a complete input, withheld with missing[] for an incomplete one; package attached once, second call no-op; wrong code → 409; bad token → 401); on a sandbox Launch task: curl both endpoints, screenshot the comment + Creative URL. Deployed to Railway with the flag on.

Out of scope. Creating launches; status changes; the native board (S8b/V9, S4).

X3b · Supabase-protection smoke · S · W5 (S1-rev)

Context. Prove Skynet under its caps cannot degrade the production Supabase.

Deliverables. infra/smoke/pressure.sh (+ pressure_report.py, the verdict and the report writer): on the production box (before the DNS flip, X7 stack up), through the production vhost pinned at the box (PRESSURE_RESOLVE, the smoke gate's shape — the auth cookie is Secure and host-bound, so not http://127.0.0.1:38000): ten idle minutes of baseline, then 4 concurrent Explore sessions kept in flight + 2 storyboard renders re-submitted as they finish + a 400 MB upload (a product document — the only route that carries 400 MB through the box) in a throwaway product for 20 min, sampling every 30 s: docker stats for skynet-* and the Supabase containers named by PRESSURE_NEIGHBOUR_CONTAINERS (a required parameter — the repository knows no names), uptime, each Skynet container's cpu.stat / memory.events / OOM + restart counters, and a pgbench select 1 p95 (1 client, a custom script — -S needs tables the read-only role cannot create) against the ecomprofits pooler from a throwaway postgres:17 container. The run is real and paid (--i-accept-the-spend); everything it made is deleted at the end. Report written by the script: docs/ops/pressure-test-<YYYYMMDD-HHMMSS>.md, never overwritten.

Acceptance. Repository half: docs/ops/x3b-acceptance.md (infra/smoke/test-pressure.sh, 39 checks with docker/curl/uptime mocked). Live half: Skynet containers never exceed their caps (no OOM kill, no restart, mean CPU under cpus); Supabase p95 during the run within 10 % of the 10-min baseline before it; host load < 24 — throttling reported, not judged. If not, A2c limits are lowered and the test repeated — no go-live before it passes.

Amended 2026-09-19 (the owner's decision: production at the terminal go-live). The live half above is a final-deploy gate in X7's T-1, run on the release candidate and recorded against its record. It measures the app workload. It stays a separate required gate, distinct from P-1's profile, which measures the Intelligence workload and its effect on the ecomprofits pooler. The repository half stays X3b's S1 acceptance.

X4b · Backup path + sweep validation on the production box · S · W5 (S1-rev)

Read first. Architecture doc §10; A0 (folders, Scheduled Task).

Deliverables. docs/runbooks/BACKUP.md — the writers (the sidecar's nightly skynet-<YYYYMMDD>-<HHMMSS>.dump at 23:00 UTC into /var/lib/skynet-backups/daily/, mode 640, owner = the backup account, pruned by its own prefix + timestamp glob at 20 days; the deploy's pre-deploy-<ts>-<sha>.dump from the SECOND deploy on — the first finds no running Postgres —, now written atomically at mode 640; S12's archive dump), the sweep (A0's rsync --delete of daily/ to the Storage Box's skynet/ at 02:30 box time; the archive under skynet-archive/ by hand), the routine; infra/backup/verify.sh <prod|staging> — the box-side proof of every leg the repository can prove (the root's owner/mode, the newest dump's shape/age/mode/owner and its pg_restore -l TOC through the pgvector image, the sidecar's own prune predicate, pre-deploy/ + archive/), the Storage Box ls only with --storage-box <user@host> --key <path> (the operator's parameters, never stored) and the GET /api/status freshness row only with --api … --resolve … — SKIP otherwise, saying it does not satisfy the card; infra/backup/test-verify.sh (28 checks with docker/ssh/curl mocked on a real tree) in CI.

Acceptance. Repository half: docs/ops/x4b-acceptance.md. Live half: verify.sh prod --storage-box … --key … --api … --resolve … on the production box with every line pasted; the screenshot/ls of the file on the Storage Box; the freshness row green; the three folders' permissions listed.

Amended 2026-09-19 (the owner's decision: production at the terminal go-live). The production stack is deployed only at the terminal go-live (X7). The live half above runs on the production box then, as X7's go-live checklist records it (open item #36). Nothing in S1, S2 or S3 waits for it. The repository half stays X4b's S1 acceptance.

A2e · Every background job in the api container is bounded · L · W6 · feat/a/a2e-bound-api-background-fanout (S1-rev)

Context. Open item #17, discovered by A2c. The job gate bounded the image-producing runs, the clip renders and the exports and left 33 spawn or submit sites outside it: a daemon thread per request for a Localize Video run, the review-only Expand retry, the bulk-recreate launcher, a saved document's embedding and Supermemory ingest, a creative's Supermemory ingest or delete, the storyboard's voice clone, song transcription, shot-writing, reference-analysis and cast stages, and the Intelligence-v2 T1 eval. Two consequences: the thread count grows with the burst (the api's pids_limit is the only backstop, and it fails thread creation rather than queueing work), and the work vanishes with a redeploy (the embedding a save promised never happens and the document reads as indexed; a bulk recreate's run stays running for ever). The outcome this card buys: no background unit of work in the api container runs outside a cap, and none can be lost with the process.

Read first. app/core/jobs/limits.py (the gate, the box-wide ledger, KINDS); services/pipeline_runner.py (the Localize start and restart, retry_pipeline, retry_expand_pipeline, the restart staleness rule); the five storyboard stage runners and storyboard_service's claims (claim_audit_step, _claim_json_state); services/chatcut_queue.py and backend/worker.py (the lease template and the handler shape); embedding_service, supermemory_ingest, t1_eval, recreate_service (the bodies and their spawn sites); pipeline/localize_video.py (the caption thread, its shutdown) and pipeline/utils/media_ffmpeg.py; ADR-008 (the workspace of a unit of work), ADR-009 (the product boundary), docs/ops/RESOURCE_LIMITS.md (the table this card extends).

Deliverables. (1) Two more box-wide kinds on the gate: localize (MAX_CONCURRENT_LOCALIZE_JOBS, 1) for a Localize Video run and background (MAX_CONCURRENT_BACKGROUND_JOBS, 2), each in its own advisory-lock namespace; the Localize run and the review-only retry go through the session-job submit with their own slot names; every cap validated at boot. (2) The step retries take the session's advisory lock, refuse a live row (RetryConflictError → 409, the restart's staleness rule) and flip the row to starting inside the locked transaction. (3) The storyboard auxiliary stages claim, then submit to the background gate through services/storyboard_stage.py; a waiting stage's record carries queue_position and a moving heartbeat_at, which both claim predicates read before started_at; a stage that can never start is written failed; the cast chain gains its own claim. (4) The work that must not vanish is one leased table, production.background_jobs (migration production/006), and one worker handler dispatching on kind to the existing bodies: enqueued on the caller's cursor so the row commits with its write, key-only payloads (the body re-reads current bytes; one pending row per key; a save during a run queues a second that runs again with the newest bytes), workspace_id NOT NULL bound before the body runs, a background slot taken before a row is claimed, a failed attempt retried with a cooldown and exhaustion writing the kind's own record conditionally in the same transaction. (5) The seams: the re-index is one forced job per document of the workspace, admin-only, with a counts GET; the T1 ingest reply adds eval_job_id + eval_job_status; the bulk recreate resumes from its progress and yields its slot while it drains. (6) Inside a Localize run every ffmpeg / ffprobe goes through one chokepoint with a hard per-call timeout (LOCALIZE_FFMPEG_TIMEOUT_S) and a thread pin (LOCALIZE_FFMPEG_THREADS), pinned by an AST source scan over the pipeline package; the shutdown joins the caption thread with no timeout; the run's caps are refused at boot when unreadable. (7) ADR-016; RESOURCE_LIMITS.md extended (no "not bounded" paragraph remains); the compose literals, the env example, compose-limits.py's cap list, CLAUDE.md, LOCAL_DEV.md.

Acceptance. pytest apps/api/app/backend/tests green, including the source scans (no bare spawn, no bare process start in the pipeline package, every stage through the gate, every family enqueues), the gate tests (kinds, namespaces, box-wide admission through two ledgers), the retry claim tests (a live row refuses, a dead one may be retried, the review retry is a background job), the stage tests (claim then submit, the heartbeat keeps the claim, a failed start is recorded), the queue tests against Postgres (the migration, one pending row per key, the lease, cooldown, the reaper with exhaustion, admission), the runner and body tests, the resumable bulk recreate; docs/ops/a2e-acceptance.md; open item #17 closed.

Out of scope. Any web change (a fourth T1 badge, a queued pill beyond starting + queued: — Figma-gated); retiring the per-product Localize routes; workspace_id on bulk_recreate_runs (S5); the storyboard render's own ffmpeg variant calls (X3b territory).

Waits on / Unblocks. A2c (A) / the honesty of the X3b pressure test; the S2 review's resource table.

A3c · The rollback resolves the images the deploy pushed · S · W6 · fix/a/a3c-rollback-image-tag (S1-rev)

Context. Open item #52, found the first time A3b's rollback path was executed (X5's staging drill, 2026-09-08): infra/deploy/rollback.sh 9e37790621b5… died in 0.9 s with Error response from daemon: manifest unknown and changed nothing. The script resolves a target commit through the main-<sha> TAG, but the workflow tags with type=raw,value=main-{{sha}}, which expands to the SHORT sha — measured from the build jobs' own logs of run 34162947895 (gh api repos/Rescale-Media/skynet/actions/jobs/<id>/logs): skynet-api and skynet-web each pushed :latest, :main and :main-c15a432. Meanwhile the deploy writes IMAGE_TAG=main-<full sha> into .env.release, a tag that was never pushed. Nothing else reads that tag — the deploy pins by digest — so the disagreement stayed invisible until the path ran. It is not a staging annoyance: docs/GO_LIVE.md row 8 tells the operator to prove both images with docker manifest inspect …:main-$TARGET (full sha) before a production rollback, so it would have failed mid-cutover.

Read first. infra/deploy/rollback.sh:36-46 (the only reader of the tag) and :54 (the IMAGE_TAG it writes); .github/workflows/deploy.yml:66-70,105-110 (the metadata-action tags) and :222-230,374-380 (the IMAGE_TAG the deploy writes); infra/compose/compose.staging.yml:14,32,107 + compose.prod.yml (images by digest — why the tag has no other reader); docs/runbooks/ROLLBACK.md § 3 table row "Images", § 6 drill, the troubleshooting row; docs/GO_LIVE.md row 8; docs/runbooks/DEPLOY.md (the tags column).

Deliverables. (1) rollback.sh resolves a target given EITHER form: try main-$SHA, then main-${SHA:0:7}, and when both fail say which two references were tried. (2) The workflow's tag set carries the FULL sha so the registry and .env.release state the same thing, without dropping the short one that every image built so far carries. (3) One check that fails without the fix, in CI rather than in prose. (4) The documents that instruct an operator are corrected together — ROLLBACK.md § 3 / § 6 / troubleshooting, GO_LIVE.md row 8, DEPLOY.md's tags column — and none of them may keep saying main-<full sha> while only the short tag exists.

Acceptance. A rollback resolves with a full sha AND with a seven-character one; IMAGE_TAG in a rendered .env.release names a tag that exists in the registry; the new check fails against the pre-fix workflow and passes after it; shellcheck clean; every runbook line that names a tag matches what the build jobs push, quoted from a job log in docs/ops/a3c-acceptance.md.

Out of scope. Running X5's drill itself (the operator's, and its transcript belongs to x5-acceptance.md); the production --restore-db branch, which only go-live can exercise; retiring latest and main as tags (they move on every default-branch build, so the card only records that neither is a rollback target).

Waits on / Unblocks. A3b (A) / X5's staging leg and GO_LIVE.md row 8 — both drill exactly this path.

A3d · The address a rate limit may key on · M · W6 · fix/a/a3d-forwarded-client-address (S1-rev)

Context. Open item #53, measured against the deployed staging stack on 2026-09-08 through the Plesk vhost: with no X-Forwarded-For, twelve POST /api/auth/login gave ten 401 then 429; with X-Forwarded-For: 203.0.113.$i differing per request, twelve gave 401 and no refusal at all. Anyone on the internet had unlimited credential attempts against every account, for the price of one header. Two settings made it so and neither was wrong alone: the vhost APPENDED ($proxy_add_x_forwarded_for), so the caller's value led the chain, and infra/caddy/Caddyfile set trusted_proxies without trusted_proxies_strict, so Caddy's non-strict traversal took the first untrusted address FROM THE LEFT — the forged one. The api's own 20/min backstop read the leftmost value too, so it could not have caught it either. The repository already held the right rule, written for the OTHER edge: docs/CUTOVER.md row 9 tells the old host to replace the header and says why, while docs/runbooks/STAGING.md § 1 step 4 told the operator to append at the edge that faces the internet. The operator corrected the live vhost the same day and the bypass is closed there; this card is everything that stops it returning, on staging and on the production box X7 has not built yet.

Read first. infra/caddy/Caddyfile:16-19,33-41 (the trust boundary and the credential zone); apps/api/app/core/auth/router.py:44-80 (the backstop and _client_key); docs/runbooks/STAGING.md § 1 step 4; docs/CUTOVER.md row 9 and docs/GO_LIVE.md row 9 (the old-host rule, already correct); infra/caddy/test.sh:56-80 (the friendly half, asserted since A3 and run by no CI job); .github/workflows/ci.yml the gateway job (build + caddy validate, no behaviour); infra/smoke/run.sh:48-53.

Deliverables. (1) The rule, written down once: ADR-019, naming the three mechanisms and the single cutover exception. (2) trusted_proxies_strict in the Caddyfile, so an appending edge cannot poison the key even where the edge is not ours. (3) The gateway SETS X-Verified-Client-IP from the address it resolved, replacing any inbound copy, and the api's _client_key reads that or the socket peer and never X-Forwarded-For again. (4) infra/caddy/test-trusted-proxies.sh — the built image, a stub upstream, one trusted and two untrusted sources on a pinned network — in the gateway CI job, which until now proved only that the config parses. (5) The documents that instruct an operator, corrected together: the staging runbook's block (which also carries open item #50 — Plesk REFUSES the current block, since Proxy mode already provides a location / and its own client_max_body_size, and location ^~ / does not avoid the duplicate), and the two cutover rows whose stated mechanism no longer matches the gateway. (6) An opt-in destructive probe in the smoke gate (SMOKE_TRUSTED_PROXY_PROBE=1) that proves it through the real vhost and drains its own bucket before it exits.

Acceptance. The gateway suite passes on the built image and its forged-prefix case FAILS with trusted_proxies_strict removed; the api test fails the moment _client_key reads X-Forwarded-For again; the live probe answers 429 after ten events with Retry-After and an empty body, then 401 once the window passes; the runbook's own two-burst acceptance is stated in the step that configures the vhost; shellcheck clean; the evidence, including the before-and-after bursts, in docs/ops/a3d-acceptance.md.

Out of scope. Retiring the api backstop (it stays a load backstop, above the gateway's 10/min); mTLS, PROXY protocol or a dedicated ingress for the cutover bridge (ADR-019 records why a TTL-scoped trusted address is preferred and when to revisit); running the probe on every deploy — it spends the deploy egress's bucket, so it is opt-in by design.

Waits on / Unblocks. A3 (A) / X7's production vhost, which must inherit the corrected block rather than the one that was measured to be bypassable.

A3e · The wait's clock belongs to the runner · S · W6 · fix/a/a3e-chatcut-clock (S1-rev)

Context. Open item #51. test_chatcut_runner.py failed intermittently in CI only, assert 92 == 91, on five runs across four different cards and in TWO different tests of the file — including one whose entire diff was a markdown file. It was recorded as "a poll-count flake under CI load" and cleared with gh run rerun --failed, which was wrong twice over: the wait's clock is faked, so wall-clock pressure cannot move it, and a rerun hid the cause. THE CAUSE: the fixture patched sleep and monotonic ON THE time MODULE, and chatcut_runner imports that module, so the wait's clock was the whole PROCESS's clock. Two writers then shared it. subprocess.run(timeout=…) waits for a real ffprobe with CPython's own exponential backoff (0.001, 0.002 … 0.05) — measured in this file's own instrumented run — and any thread an earlier test left running sleeps whenever it likes. Worse, now += seconds from two threads can lose an update outright, dropping a whole 20-second lap, which moves the agent-ceiling shortcut one poll LATER — the exact direction and size of the observed failure. The test that failed was never the test at fault.

Read first. apps/api/app/backend/tests/test_chatcut_runner.py (the world fixture's clock, and the two assertions on the ceiling poll); apps/api/app/backend/services/chatcut_runner.py:663-726 (_poll, one sleep per lap) and :826-853 (the watcher's elapsed_s < AGENT_CEILING_S); apps/api/app/pipeline/utils/media_ffmpeg.py (run_tool → subprocess.run(timeout=…), the other writer).

Deliverables. (1) The runner is given its OWN clock object (monkeypatch.setattr(runner, "time", …)) rather than two attributes on the shared module; anything the runner reads from time that the wait does not fake falls through to the real module, so a new call site cannot be silently swallowed. (2) A test that pins the isolation itself — the wait's clock is not the process's clock, an outside sleeper does not move it, and only the runner's own sleep does. (3) The two ceiling assertions state what they mean: one interval per lap (named, so a polluted clock says so in words instead of an off-by-one), the endpoint never read BEFORE the ceiling (the safety property, an inequality), and the exact ceiling poll computed with CEILING division so a future interval that does not divide the ceiling cannot invent a phantom off-by-one.

Acceptance. The isolation test fails with the module-level patch restored and passes with the card's; the file passes; the full api suite passes with the same count as main; the CI api job stops needing a rerun. Evidence in docs/ops/a3e-acceptance.md.

Out of scope. The pre-existing ENCRYPTION_KEY environment failure of test_the_caption_pass_is_on_unless_it_is_turned_off when the file is run standalone on a developer box (identical on main; open item #6's territory).

Waits on / Unblocks. — / a green main that means something, and every card whose CI no longer costs a rerun.

A3g · The worker keeps the group Docker granted · S · W6 · fix/a/a3g-worker-backup-group (discovered on the staging box 2026-09-17 with the owner, open item #62)

Context. Staging's backup_freshness check has written fail with the detail no dump matches every five minutes since the stack went up, and open item #62 read that as a sidecar that never dumps. Measured on the box on 2026-09-17: the sidecar is fine. pgdump/ holds a skynet-staging-<date>-010000.dump for every night since 2026-09-04 (about 2 MB, mode 640, owned by the subscription's 10004:1002), and the one FAILED line (2026-09-15 13:31) is the minute the stack was down and postgres did not resolve. The api container mounts the same directory read-only and Docker adds group_add: ${BACKUP_GID} (1002): PID 1 shows Groups: 0 1002, the ACL mask is r-x, and root or docker exec -u 1000 lists the dumps. But PID 1 is supervisord (apps/api/supervisord.conf, [program:uvicorn] and [program:scrape_worker] both user=user), and when supervisord switches to uid 1000 it rebuilds the supplementary groups from the image's /etc/group, where 1002 does not exist: both processes read Uid: 1000, Groups: 999. The worker that runs the synthetic cycle therefore cannot list a 750 directory owned by that group, glob swallows the permission error into an empty list, and check_backup_freshness reports no dump matches — a sentence about a missing file for a permission it does not have. compose.prod.yml carries the same group_add, so production would alert the same way after go-live. verify.sh never saw it because it runs as the deploy user, not as the worker.

Read first. apps/api/Dockerfile (CMD ["supervisord", …], no ENTRYPOINT; the $HOME note about supervisord's user= at :86-105); apps/api/supervisord.conf:17-35; infra/compose/compose.staging.yml:30-56 (the api service: SYNTHETIC_BACKUP_*, group_add, the :ro mount) and the same block in compose.prod.yml; infra/compose/docker-compose.dev.yml (no BACKUP_GID, must keep starting); infra/backup/pg-backup.sh:34-48 (the stance on a malformed BACKUP_OWNER); infra/backup/test-pg-ready.sh (the shell-test pattern: fake commands on PATH, one case per line); apps/api/app/core/synthetic/checks.py:180-206 (check_backup_freshness: glob.glob returns an empty list on PermissionError) and its tests; .github/workflows/ci.yml (the infra job's change filter, and the shellcheck every infra script step at :406-407); docs/runbooks/BACKUP.md:14-26,72-96; open item #62.

Deliverables. (1) apps/api/docker-entrypoint.sh, run as root before supervisord: when BACKUP_GID is set and numeric, a group with that gid exists inside the container (getent group <gid>, else groupadd -g <gid> under a plain name) and user user is added to it by the name the gid resolves to; when it is unset, nothing is touched; a malformed value exits 1 with a sentence before anything starts; the script ends with exec "$@", so the Dockerfile's CMD is what runs and a command override still works. (2) The Dockerfile gains ENTRYPOINT ["/docker-entrypoint.sh"] and keeps its CMD; no USER line (supervisord still drops to user). (3) compose.staging.yml and compose.prod.yml pass - BACKUP_GID=${BACKUP_GID:?set by the deploy from BACKUP_OWNER} into the api's environment, the same required interpolation group_add uses, so an empty value cannot reach the entrypoint; group_add stays (it still covers PID 1 and docker exec). (4) check_backup_freshness probes os.listdir(backup_dir) before the glob and reports cannot list <dir>: <exception> when it cannot, so the next permission fault is named as one; a unit test that fails on the base. (5) A shell test of the entrypoint with fake getent, groupadd, usermod and a fake command on PATH, one case per outcome; CI runs it on any pull request that touches the entrypoint or the test, and the shellcheck step covers both files (extend the infra job's filter and its find, or wire the test into the api job — name which in the record). (6) docs/runbooks/BACKUP.md: the api's worker needs the group at the PROCESS level, how to read it on the box (/proc/<pid>/status, the Groups: line carries BACKUP_GID), and verify.sh's blind spot. (7) docs/ops/a3g-acceptance.md with the measurements above.

Acceptance. The shell test: unset → no group command runs and the command is exec'd; set → the group is ensured, then the user added, then the command exec'd, in that order; a gid that already exists under another name → that name is used and no groupadd runs; malformed → exit 1 and nothing exec'd. pytest: an unlistable backup directory reports cannot list, not no dump matches (fails on the base); the whole api tier green. docker build -f apps/api/Dockerfile . builds, and docker run --rm -e BACKUP_GID=4242 <image> su -s /bin/sh user -c 'id -G' prints 4242 among the groups (a user switch that rebuilds the groups, as supervisord's does, now finds it), while the same run without BACKUP_GID prints the groups it prints today. shellcheck clean on both new files; the dev stack still starts with no BACKUP_GID. After the merge, on staging: the next synthetic cycles write backup_freshness ok with the dump's age, and the worker's /proc/<pid>/status lists 1002; open item #62 closes on that row.

Out of scope. The sidecar, the directory's ACL and the staging env, all measured correct. Production's env value. The pre-deploy dump path (compose run --rm --entrypoint sh backup runs the sidecar's image, not this one). Any other supervisord change.

Built as (PR #92 → main 0c31f5a, 2026-09-17). Co-plan 1 round → agreed with four changes (keep the Dockerfile's CMD and end the entrypoint with exec "$@"; the :? interpolation in compose; the listdir probe in scope; the CI filter must name the new files). Code 1 review round → 2 must-fixes (a card key in a workflow comment; INCIDENTS.md still told the operator to read the mount as root through exec api, the exact blind spot) and 2 notes (guard an empty command before exec; single-valued group resolution), then confirmed. apps/api/docker-entrypoint.sh runs as root before supervisord: a numeric BACKUP_GID gets a group of that gid inside the container (getent, else groupadd) and user user is added to it by the name the gid resolves to; unset or empty touches nothing; a malformed value, a multi-record gid or an empty command stops the container with a sentence; exec "$@" runs the image's CMD. The Dockerfile gains the ENTRYPOINT and keeps CMD; compose.staging.yml and compose.prod.yml pass BACKUP_GID=${BACKUP_GID:?…} into the api's environment (dev passes its own default); check_backup_freshness lists the directory before it globs and reports cannot list <dir>: <error>; the shell test (15 cases with fake getent/groupadd/usermod and command) runs in the infra CI job with shellcheck over both files; BACKUP.md and INCIDENTS.md say the group is needed at the process level and how to read it as the worker. Proven on the built image: -e BACKUP_GID=4242 … su -s /bin/sh user -c 'id -G' → 999 4242, without → 999; end to end against a real 750 mount owned by gid 4242 the worker's Groups: line carries it and the dump lists where it was Permission denied before. Whole api tier 4317 passed / 11 skipped / 3 deselected, +1 (the cannot list case, which fails on the base with the old sentence). Proven on staging after the deploy (2026-09-17 08:50Z onwards): uvicorn and the worker run as uid 1000 with Groups: 999 1002, and the synthetic cycles write backup_freshness ok, skynet-staging-20260917-010000.dump is 7.8 h old and counting. Open item #62 closed on that row.

Waits on / Unblocks. — / an honest backup_freshness on staging and on production before go-live; open item #62.

S1e · Self-service password change · M · W6 · feat/s/s1e-password-change (S1-rev)

Context. Open item #43, discovered by M6. The Settings page's Change Password control called the legacy PUT /api/auth/me/password: 410 wherever LEGACY_LOGIN_DISABLED=1 (the production template), and where the flag was off it verified and rewrote production.users.password_hash — a hash the core login never reads for an active account, and a random sentinel for every account created by an SSO login — so even its success changed nothing the user could sign in with, and the page showed "Current password is incorrect" for every status. No core route changed a signed-in user's password; the card's two named options (the reset rail; hide) both left the slice with no self-service change. The outcome this card buys: a signed-in member changes — or first sets — their own password, honestly, and every other device is signed out.

Read first. app/core/auth/router.py (_accept, _sign_in, the limiter, _password_matches), app/core/auth/auth_tokens.py (the pending-kind revocation), app/core/auth/deps.py (current_user), app/backend/routes/auth.py (the legacy rails, _refuse_when_legacy_disabled), apps/web/src/pages/system/Settings.tsx + src/lib/api.ts (ApiError, primeCurrentUser), ADR-001 §5, ADR-015 §3/§8, docs/AUTH_SESSION.md §3.

Deliverables. (1) POST /api/auth/password in the core issuer: {current_password?, new_password}, current_user (service tokens 403), same-origin, throttled per USER (5/min keyed on the subject; the limiter generalised to a key + limit); new ≥ 8 → new ≠ current → one core transaction under the row's lock: a row with a hash requires the current password ("Enter your current password" / "Current password is incorrect"), a row without one sets its first (the session is the proof, as a magic link's acceptance is); then token_version + 1, every refresh family revoked, every pending magic and reset link revoked (auth_tokens.revoke_pending_credentials), the token-version cache cleared, and _sign_in — this browser stays in, every other device is out; Cache-Control: no-store. GET /me gains has_password. (2) The SPA control re-pointed: api.changePassword posts to the new route and re-primes the identity; the current-password field is shown only for an account that has one; the catch shows the server's own detail (an ApiError), sends a lost session to /login, and names a network failure; the subtitle states the true session rule. (3) The legacy PUT /api/auth/me/password retired outright (its model, the client), POST /users gated by _refuse_when_legacy_disabled() like the other credential writers, the dead per-address limiter removed. (4) ADR-017 (amends ADR-001 §5); docs/AUTH_SESSION.md §3 + §7; docs/SECURITY.md core routes; apps/api/CLAUDE.md; docs/ops/v1-acceptance.md + m6-acceptance.md notes; docs/runbooks/LOCAL_DEV.md; docs/ops/s1e-acceptance.md.

Acceptance. pytest apps/api/app/backend/tests green, including tests/core/test_password_change.py: the change (hash replaced, tv+1, fresh cookies, no-store, the fresh session live at once, the old access token and every other refresh family dead, the caller's fresh family live, the new password signs in and the old does not), the four current-password cases, the refusal order (a short new password before any bcrypt), the NULL-hash first password through a magic link, the pending magic and reset links dead after the change (410), the credential kinds disjoint from the onboarding family, the per-user throttle (the sixth call 429, another user unaffected, the login budget unspent), the anonymous / service / inactive callers refused, a foreign origin refused, the control's source; test_auth_sso.py: the legacy rail gone, the admin rails 410 under the flag. cd apps/web && npm run build green. docs/ops/s1e-acceptance.md; open item #43 closed.

Out of scope. The login page's collapse of 429/403/5xx into "Invalid email or password" (open item #27 owns the login copy); the admin rails' TeamPage copy (V11); a "password changed" notice mail; the bcrypt cost pinned in one place; the flag's exact-'1' match; the email-case split of the legacy bridge.

Waits on / Unblocks. S1b (S), S1d (S — the same router file; stacked on PR #52 as S1d is on S1c) / an honest settings surface before real users arrive.

Slices S2–S5 — executable specs

Same standard as S1. Waves are per slice (S2-W1 …). A slice's W0 cards depend on the previous slice's exit gate (delivery plan §2), not on a card. Discovery (D) cards are real work: an interview or confirmation with a named role, a written artefact, and a sign-off comment; their output is the input of the build cards that list them.

Discovery cards (all slices)

D21 · Research operator workflow confirmation · A · S · S2-W0

Context. W1–W3 in the workflow map are mixed: the tooling is code-backed, the operator rules are not. S2 builds the native Intelligence pages on those rules.

Deliverables. docs/discovery/s2-operator-rules.md: what makes a competitor worth tracking; cadence per brand/lens; keep/discard rules for ads and families; when a finding becomes a brief; the evidence required before a product is promoted; who seeds research keywords; who approves Promote to product; the rework loop when a ranked opportunity is rejected or deferred; where the loop breaks today. Interview: Agon + the weekly research operator (45 min), plus one screen-share of a real weekly pass.

Acceptance. Doc merged; Agon and the operator comment "confirmed" on the task; A13/A14/A15 cite the rules they implement.

Amended at D21 (2026-09-24). The owner interview took place and the owner confirmed the rules in docs/discovery/s2-operator-rules.md. That confirmation closes the decision gate. The weekly research operator role is not filled, and no weekly pass exists today; the operator's "confirmed" and the screen-share of a real weekly pass are open item #187 and do not block D21.

D22 · Product bridge field confirmation · S · S · S2-W0

Deliverables. docs/discovery/s2-product-bridge-fields.md with Sven + Cyrus: the exact ClickUp Product card fields (LISTS.products: Product ID = naming product number, market economics, status) that Promote to product must create/link, the mapping to the static-ads product model (routes/products.py:43 product, :151 brand identity, :248 looks, :282 documents), and who owns each field afterwards. Table: source · target · owner.

Acceptance. Doc merged; Sven and Cyrus confirmed; A15 cites it.

Amended at D22's draft (2026-09-24). The document is drafted from the code so that Sven and Cyrus confirm it instead of writing it: the two models as they are today (the Skynet product row and routes; the ClickUp Product card's 39 custom fields, its statuses, the counter rescale_service.next_product_number, the bridge's three routes), a mapping table that accounts for every card field and the task status with source, direction at promotion and owner afterwards, nine rules, and eleven decision questions with bounded options and one default each. Until the confirmation, the defaults stand for A15's brief: the Product ID is drawn at Testing by workos and read back (A15's card says "at approval"; question 1 decides and amends A15 if Testing wins); one Skynet product with one card per chosen market; a link record per product and market; promotion writes the card name, Market, Niche, Ad library link, Evidence, Source, Research tool, the assignee and the description, never a machine field, and not Competitor Shop URL (it fires workos intake) unless question 4 says yes; create-or-link by an explicit task id with an idempotency key; the client-file fields and a readiness checklist by role live in Skynet; the lineage edge is research → product. Questions 1, 2, 3, 4, 8, 9 and 10 block A15's build. The card's products.py anchors are :103 (brand identity), :258 (looks) and :312 (documents); A15's tests live under apps/api/app/backend/tests/core/. The implementation details the document does not decide (the link table, the bridge route bodies, the readiness table, the lineage migration) are held for A15's brief.

D23 · Reddit VOC seed confirmation · A · S · S2-W0

Deliverables. docs/discovery/s2-reddit-voc-seed.md with Mathew: the first keyword groups (cravings, blood sugar — confirm wording and subreddits/search scopes), collection cadence, retention (never truncated per group), export columns (post/comment id, subreddit, date, score, text, group, keyword hit), who consumes the export.

Acceptance. Doc merged with Mathew's confirmation; A18 cites it.

Amended at D23 (2026-09-24). Owner-confirmed seed, exact values in docs/discovery/s2-reddit-voc-seed.md: the two groups cravings (17 terms) and blood_sugar (13 terms) with their current descriptions and term lists; the nine enabled subreddit scopes r/loseit, r/WeightLossAdvice, r/EatCheapAndHealthy, r/intuitiveeating, r/diabetes, r/diabetes_t2, r/prediabetes, r/Supplements, r/nutrition (daily, 90-day lookback); the three search scopes reddit:search:cravings, reddit:search:blood_sugar, reddit:search:combined seeded paused; the ten PMS/perimenopause scopes stay disabled; the postpartum group and the run-time postpartum scopes are outside the seed and kept unchanged. Collection stays on public pages through the residential exit. Management (add, pause, resume, soft remove of scopes, groups and terms) is in the Skynet UI under intelligence.voc.manage. Mathew is not a build gate; later edits happen in the managed UI. Acceptance: the doc merged on the owner's answers and delegation.

D23b · Evidence lens seed confirmation · A · S · S2-W0

Deliverables. docs/discovery/s2-evidence-lens-seed.md with Mathew: for each VOC keyword group (first: cravings, blood sugar) the six-lens terms — mechanism, concern, ingredient(s), common solutions — plus the first RescaleOS product the evidence layer is proved on; collection cadence and the monthly re-walk; export columns (PMID, title, journal, year, evidence class, lens, group, plain-language finding, citation); who consumes the export; the claims-policy sign-off (evidence class never authorizes disease copy).

Acceptance. Doc merged with Mathew's confirmation; A18b cites it.

Amended at D23 (2026-09-24). The owner delegated D23b; the lens seed, the verified MeSH descriptors, the per-lens hit counts and the Triphala-first proof are in docs/discovery/s2-evidence-lens-seed.md. First proof product: Aleniva Triphala (blood-sugar and weight evidence match the VOC groups); Aleniva Dandelion second, as the form-mismatch test; Triphala Guggul studies are the combination-mismatch test. Claims policy adds route-mismatch, combination-mismatch and disease-population beside form-mismatch; a disease-population row never authorizes disease copy and cannot by itself substantiate a healthy-population efficacy statement. No Mathew confirmation blocks the build; he may revise the UI-managed seed later.

D31 · Bian coexistence + migration-window agreement · A · S · S3-W0

Context. RescaleOS is Bian's live production loop (NPT/BPT). S3 moves the engine, the loops and the skills onto the stack. Nothing starts without his explicit agreement.

Deliverables. docs/decisions/D31-bian-coexistence.md: the cutover order (runtime on Postgres → loops on the stack → skills in-app → console retired), the coexistence period (both run, which is authoritative), the migration window, the failure path (back to the Mac), what must never be automated, and what changes for Bian day to day.

Acceptance. Signed (comment) by Bian and Agon; A10/A11/A20 cite it.

D32 · Hook + strategy expectations · V · S · S3-W0

Deliverables. docs/discovery/s3-hook-and-strategy.md with Mathew + Cyrus: hook-session gate semantics (who approves, evidence packet, per-asset vs per-batch), what makes the coverage map actionable (which decisions, which existing artefacts they trust, what stays human), the brand-tone band and claim-validation rules for hook seeds; the exact rule for "validated learning" vs "personal taste" and what qualifies as a human-rated output for shared memory; and the six accelerator questions (claude-code-accelerator-digest.md §6): which three artefacts he touches daily; what crosses from personal instinct into shared memory and who approves; losers/dead angles first-class or implied; swipe bank shared or personal; whether "third time = workflow" deserves a productised capture flow; whether "one format first, LFS, blood sugar" is a pilot tactic or the general rule.

Acceptance. Doc merged with both confirmations; V14/V16/V18 cite it.

D33 · Script-card bridge + demand semantics · S · S · S3-W0

Deliverables. docs/discovery/s3-script-bridge.md with Sven + the ops owner: the Script card lifecycle (statuses, who flips), Demand Line provenance rules (demand-week.ts, spawn.ts), QA-gate ownership (qa-gates/*), what the bridge must preserve while ClickUp owns the Scripts list, the failure rules; Friday-call outcome ownership, manual exception paths, and the workaround rules that must survive until ClickUp is read-only.

Acceptance. Doc merged; S16 cites the state map.

D41 · Launch pilot confirmation · S · S · S4-W0

Deliverables. docs/discovery/s4-launch-pilot-confirmation.md with Cyrus + one active media buyer: the exact launch package, the proof-of-launch loop, which ClickUp fields they actually read, what they still rewrite by hand, what delays launches.

Acceptance. Doc merged; S6 and S8b cite it.

D42 · Board authority + mirror-failure confirmation · S · S · S4-W0

Deliverables. docs/discovery/s4-board-authority.md with Sven + the ops owner: authoritative states per list (from the status templates in fields-manifest.json), the field definition for ugcCreators (none exists today), acceptable mirror lag, failure handling (reconcile-cron.ts, qa-gates/*), machine- vs human-owned fields per list (from domain/ids.ts), and the ordered list of the remaining 12 boards after the launch board.

Acceptance. Doc merged with the ordered board list; S6, S26, S18, S19 cite it.

D51 · Billing + retention confirmation · S · S · S5-W0

Deliverables. docs/discovery/s5-billing-retention.md with the ops owner: the manual-invoicing process, meter granularity (model calls, scraper/runtime jobs, bridge operations), invoice-export shape, retention windows per data class, deletion approvals, who may request export/deletion.

Acceptance. Doc merged; S24, S25 cite it.

D52 · Roles + onboarding confirmation · V · S · S5-W0

Deliverables. docs/discovery/s5-roles-onboarding.md with Sven + Mathew: role matrix across Production, Intelligence, Studio, Workspace; admin boundaries; workspace-creation flow (Rescale admin only); invite rules.

Acceptance. Doc merged; S21, S23, V21 cite it.

D53 · Security review scope confirmation · A · S · S5-W0

Deliverables. docs/discovery/s5-security-scope.md: review scope (tenancy, credentials, deletion safety, abuse cases, load envelopes), external vs internal reviewer, sign-off format.

Acceptance. Doc merged; A17, S20 cite it.

S5 — SaaS hardening (specs)

S21 · RLS rollout + tenancy CI for core, production, meta_ads, studio · S · L · S5-W1

Context. Every table already carries workspace_id (S1 rule). S5 turns that into enforced isolation at the database.

Read first. db/migrations/unified/* (all schemas), apps/api/core/auth/deps.py (how the request's workspace is known), apps/api/tests/core/test_isolation.py (S13), Postgres RLS docs; the ecomprofits pattern has_role_on_account() in apps/web/supabase/schemas/03-accounts.sql as prior art.

Deliverables. Migration core/0NN_rls.sql + one per schema: alter table … enable row level security, policies workspace_isolation using current_setting('app.workspace_id')::uuid; the API sets set local app.workspace_id per request/transaction (apps/api/core/db/session.py), jobs set it per workspace loop; a bypass_rls role only for migrate/backup; pytest apps/api/tests/security/test_rls.py (cross-workspace fixtures for all four schemas, direct SQL as the app role → 0 rows); CI required.

Acceptance. Tests green; select count(*) from production.sessions as the app role with a foreign workspace id = 0; existing S13 tests still green.

Out of scope. Billing; UI.

S22 · Per-workspace credentials, keys, quotas + admin APIs · S · L · S5-W2

Read first. core.integration_credentials (S5a), core.providers (V4), core.spend_guards; D51.

Deliverables. core.workspace_quotas(workspace_id, key, limit, window, action ∈ warn|pause) for model spend, scraper jobs, runtime sessions, storage GB; provider keys and residential/R2 settings per workspace (encrypted); admin APIs GET/PUT /api/admin/workspaces/:id/credentials, /quotas; resolver resolve_credentials(workspace, provider) used by every caller; pytest apps/api/tests/core/test_workspace_credentials_and_quotas.py.

Acceptance. Tests green; a workspace with no key of its own cannot use the platform default unless flagged inherit_platform_keys.

A22 · Sidecar + runtime quota enforcement · A · M · S5-W2

Read first. S22 resolver; scraper settings reads, transcriber, agent runtime accounts.ts, workos config, production gateway.py (V8).

Deliverables. Every service resolves workspace-scoped credentials and checks quotas before work: scraper crons per workspace, transcriber batches, runtime sessions, workos bridge calls, production model calls; pause → 402/skip with a logged reason; pnpm --filter scraper test && pnpm --filter agent-runtime test extended; a staged quota-breach transcript for two services.

Acceptance. Transcript attached; no service reads a global key when a workspace key exists.

S23 · Audit log + admin provenance · S · M · S5-W3

Context. Multi-tenant operation needs an unforgeable record of who did what in which workspace; S1–S4 only log locally.

Deliverables. core.audit_log(id, workspace_id, actor_id, actor_kind ∈ user|service|system, action, target_type, target_id, evidence jsonb, created_at); writers for admin actions, gate decisions, bridge mutations, membership changes, impersonation (if any), and the role lifecycle (role.created, role.updated, role.deleted, member.role_granted, member.role_revoked) with evidence holding the previous and new role definition and the previous and new effective permissions; GET /api/admin/audit?…; retention per D51; pytest apps/api/tests/security/test_audit_log.py with an end-to-end chain for a role change.

Acceptance. Tests green; the chain artefact attached.

Out of scope. Impersonation features themselves; external SIEM export.

V21 · Admin / users / roles parity + invite-only onboarding + workspace creation · V · L · S5-W3

Read first. D52; V5 admin; S1b invites; S22/S23 APIs.

Deliverables. Admin area: workspaces (create — Rescale admin only — with name, slug, plan notes); members screen with multi-role assignment; role editor (admin only): system roles read-only, custom roles per workspace — create / clone a system role / edit permissions / delete (blocked while assigned); effective-permissions drawer per member; no direct per-user permission editing; invites assign one or more roles at invite time; credentials + quotas per workspace (masked), audit viewer, invoice exports (S24). Onboarding: invite → accept → first login → workspace switcher. pnpm --filter web test -- admin-users-roles-onboarding.

Acceptance. Walkthrough: create workspace → invite user → assign roles → user sees only their workspace; recording attached.

S24 · Usage metering ledger + invoice export · S · L · S5-W4

Context. Manual invoicing is in scope, so usage must be metered in a stable ledger and exported as invoice-ready monthly totals without Stripe self-serve flows.

Read first. core.usage_events (V4), scraper/runtime job tables, D51.

Deliverables. core.usage_ledger rollups per workspace per day (model spend, scraper jobs, transcriber minutes, runtime sessions, storage GB, bridge ops); GET /api/admin/usage?workspace&month; export CSV/JSON per workspace-month for manual invoicing; pytest apps/api/tests/billing/test_usage_metering.py. No Stripe.

Acceptance. Tests green; one export for a fixture month attached.

Out of scope. Payment collection, subscription checkout, customer-facing billing portals, plan-pricing automation.

A17 · Hardening: load tests, abuse cases, security-review remediation · A · L · S5-W4

Deliverables. Load test of the full stack under S5 quotas (infra/smoke/load.sh); abuse cases (cross-workspace ids in every mutating route, token replay, oversized uploads, runaway jobs); dependency + image scanning in CI; secrets audit; findings → fixes; docs/security/S5-security-review.md (findings, status, evidence).

Acceptance. Review doc merged with every finding closed or explicitly accepted by Agon; load summary attached.

S25a · Workspace export + retention jobs · S · M · S5-W5

Context. Tenants need their data back on request and stale data must age out by policy before deletion is meaningful.

Deliverables. Workspace export (all schemas + R2 prefix manifest) as a signed download; retention jobs per data class (D51) with audit entries; pytest apps/api/tests/security/test_export_retention.py.

Acceptance. Test green; one export bundle for a fixture workspace attached.

Out of scope. Deletion itself (S25b).

S25b · Deletion queue, dry-run, purge across Postgres / R2 / lineage · S · M · S5-W6

Context. Deletion must be complete across Postgres, R2 and lineage, approved, and provable — the last SaaS-hardening control.

Deliverables. Deletion request queue with approval, legal-hold override, dry-run report, purge across every schema + R2 prefixes + lineage nodes, audit entries; pytest apps/api/tests/security/test_delete_purge.py.

Acceptance. Test green; one dry-run deletion report attached.

Out of scope. Legal review of retention law; backups purge (handled by retention policy on the Storage Box).

S20 · SaaS readiness review → 100 % · S · S · S5-W6

Context. The single go/no-go that defines 100 %: every control above verified, every workflow native, nothing pending.

Deliverables. docs/decisions/S20-saas-readiness-review.md: checklist over tenancy (S21), credentials/quotas (S22, A22), audit (S23), admin/onboarding (V21), metering/invoicing (S24), hardening (A17), retention/deletion (S25); every workflow in the source map native; standalones retired; company-ops lists still in ClickUp by design.

Acceptance. Review merged with pass on every line and an empty follow-up list — the definition of delivered.

Out of scope. New scope; anything not already carded.

S2 — Intelligence merge (specs)

Facts every S2 card relies on (verified against meta-ads-scraper): one container, ecosystem.config.cjs runs server.js (Express :8080, all node-cron jobs) + admin/ (Next.js 14, :3000); DB = Supabase schema meta_ads via supabase-js clients with db: { schema } (server.js:130–141, admin/lib/supabase.ts, admin/lib/supabase-service.ts); 18 .rpc() sites / 17 functions (ads_browse, ads_browse_meta, brands_browse, teardowns_browse, intel_coverage, intel_label_distributions_v2, gold_next_item, gold_sample_draw, gold_scoring_rows, mi_claim_work, refresh_brand_metrics, enqueue_brand_teardowns, enqueue_missing_classifications, enqueue_missing_transcripts, research_bump_runs_seen, research_product_inputs, research_products_ranked); tables brands, ads, ad_tags, tags, ad_classifications, ad_transcripts, ad_teardowns, ad_rank_snapshots, admin_users, brand_metrics, brand_label_shares, scrape_jobs, scrape_job_ads, scrape_job_windows, settings, proxies, creative_gold_labels, gold_evaluations, gold_sample_batches, gold_sample_items, mi_scopes, mi_documents, mi_document_scopes, mi_brand_aliases, mi_business_snapshots, mi_fetch_queue, research_niches, research_keywords, research_runs, research_run_queries, research_products, research_product_ads, research_product_scores; media lib/media-storage.cjs (STORAGE_PROVIDER=r2, bucket meta-ads-media, signed URLs via admin/app/api/media/signed-url); crons in server.js: scheduler */30, reaper */10, brand metrics */20, transcription */10, classification */15, teardown */5, Reddit 5,20,35,50 * * * *, Trustpilot hourly, Amazon 6-hourly, retention 40 3 * * *; engines scraper.js (Playwright quick scrape), lib/deep-crawl/*, lib/research/{runner,cluster,score}.cjs, lib/teardown/{worker,prompts}.cjs, lib/market-intel/*, lib/analysis/{worker,taxonomy,gold-eval}.cjs, lib/creative-family.cjs, lib/transcription/*; admin pages (19): / (brands index), /brands/[brandId], /brands/new, /ads, /breakdowns, /intel, /intel/gold, /rank, /research, /research/keywords, /runs, /market-intel, /market-intel/{amazon,trustpilot,reddit,scopes}, /settings, /users, /login; 40 admin API routes under admin/app/api/* (ads tags, auth, brands + schedule + teardowns, crawl, gold, intel, jobs + retry, market-intel aliases/documents/thread/reddit-stats/scopes/run + amazon/trustpilot reviews/run/scopes/stats, media/signed-url, rank + history, research + keywords, scrape, settings, tags, teardowns, users); Express routes in server.js: /health, /jobs*, /scrape, /crawl, /jobs/:id/cancel, /transcripts/{run,stats}, /analysis/{run,stats}, /teardowns/*, /gold/batches*, /research/*, /market-intel/{trustpilot,amazon,ingest}/{run,stats}; env: PORT, SCRAPER_API_KEY, SUPABASE_URL/ANON_KEY/SERVICE_KEY/BUCKET, STORAGE_PROVIDER, R2_ACCOUNT_ID/ACCESS_KEY_ID/SECRET_ACCESS_KEY/BUCKET_NAME/PUBLIC_URL, TRANSCRIBER_URL, DEFAULT_PROXY_GEO, MARKET_INTEL_ENABLED, MARKET_INTEL_AMAZON_ENABLED, MARKET_INTEL_TRUSTPILOT_ENABLED, MARKET_INTEL_AUTHOR_SALT; RPC signatures (for the pg layer): ads_browse(17 filter args, sort_key_arg text='newest', limit_arg int=144, offset_arg int=0) → 33-col table, ads_browse_meta(same 17) → (total_count, undated_in_scope), brands_browse(15 args) → 28-col table, teardowns_browse(brand, status, version, limit=25, offset=0), enqueue_brand_teardowns(brand, version, limit=50, requested_by) → int, enqueue_missing_transcripts(batch_limit=500), enqueue_missing_classifications(version, batch_limit=500), current_analysis_version(), refresh_brand_metrics(), gold_sample_draw(batch), gold_next_item(batch, labeller, lease_minutes=30), gold_scoring_rows(batch), intel_label_distributions(version), intel_label_distributions_v2(version, brand_ids[], start, end, media_type, min_confidence, include_fallback=true), intel_coverage(same 7), mi_claim_work(kind, limit=10, lease_seconds=900) → setof mi_fetch_queue, research_bump_runs_seen(run), research_product_inputs(run), research_products_ranked(run, niche, trend, min_score, search, limit=100, offset=0) → 25-col table; triggers gold_release_claim, preserve_ad_owner_brand, set_updated_at; helpers parse_ad_date, progress_heartbeat; static-ads' duplicate scraper app/backend/routes/scraped_ads.py, services/decodo_client.py, scrape_runner.py, ad_collections.

A27 · A read-only MCP server for external agents · A · M · S5-W6

Context. The old Intelligence database on Supabase carries a llm_reporting schema of nine read-only views and a cluster-wide llm_reader login, built so an external stakeholder's LLM agent could read the ads data; no code of ours calls it, and A4's local legs (2026-09-15) found no call site in the mirror. Open item #75 asked where that pair lives on the unified cluster. The owner decided on 2026-09-17 that it does not: the views and the login are DROPPED at A9's cutover, and external agents are served instead by an MCP server built at the end of the plan. A raw Postgres login for a third party has no credential lifecycle, no audit and no way to say which party sees what; an MCP server puts the same questions behind typed read-only tools, per-party credentials and the app's own permission layer. Consequence, stated on purpose: between A9's cutover and this card no external agent has access to the Intelligence data; the stakeholder is told before the cutover.

Read first. Open item #75 and A4's records (docs/ops/a4-acceptance.md, docs/decisions/ADR-020-intelligence-data-path.md) for what the nine views answered; the scraper mirror's llm_reporting migration for their definitions; A9a (the admin's access rules in the app layer) and S22 (per-workspace credentials, keys, quotas) for the permission and credential seams this card builds on; A19 (the scraper retirement) for the moment the unified data becomes the only source; the api's existing auth (app/core/auth) and the rate-limit posture at the gateway (A3, A3d).

Deliverables. (1) An MCP server in the api, served over hosted HTTP (stdio optional, for a local integration) and behind the gateway, that exposes the questions the nine views answered as typed READ-ONLY tools over the unified Intelligence data, every tool going through the app's permission layer under a dedicated per-party policy (an external principal is not an ordinary app user). (2) Per-party credentials with rotation and revocation, an audit row per tool call (party, tool, arguments' shape, row count, latency), and rate and row caps per party. (3) A registry of which party sees which tools, editable by an admin without a deploy. (4) A short guide for the external party: how to connect, what each tool answers, the caps. (5) docs/ops/a27-acceptance.md.

Acceptance. A test party connects over HTTP with its credential, lists only its tools, and every call returns rows the permission layer allows and nothing else; a revoked credential is refused on the next call; the caps refuse the call past them with a sentence; every call has its audit row; no tool can write; the server exposes no database login of any kind. Whole api tier green.

Out of scope. Write tools of any kind. Any direct database login for a third party. Recreating the llm_reporting views or the llm_reader role on the unified cluster (dropped by decision).

Amended 2026-09-19 (the owner's decision: production at the terminal go-live). The unified cluster never creates llm_reporting or llm_reader. The old standalone copies remain available until X7's source switch and are then retired with the old project. The no-access interval for external agents begins at that X7 switch, not at A9, and ends when this card is accepted. The stakeholder is told before the X7 switch. A19's "the unified data is the only source" holds from that switch.

Waits on / Unblocks. A19 (the unified data is the only source), S22 (the credential seam), A9a (the permission layer) / external agents' access to the Intelligence data; the stakeholder behind open item #75.

A4a · The S2 mirrors refresh to a pinned upstream SHA · A · M · S2-W1 · chore/a/a4a-refresh-s2-mirrors

Context. AGENTS.md:22 promises that services/scraper and services/transcriber are refreshed at slice start with skynet-w0/a1a-import.sh, but that script is a one-shot assembly: it pins SRC_SCRAPER=d842453, exits when its branch exists and reads its rewritten clones from another session's scratchpad. The mirrors at c0ac54a equal the standalone repository at d842453 plus Skynet's own deltas, and the standalone repository has moved on. A4 must prove the port against the current scraper with exact provenance (open item #73).

Read first. skynet-w0/a1a-import.sh; docs/ops/a1a-acceptance.md; git log of services/scraper and services/transcriber after the import (the A1a runtime bumps, the nested CI removal); the 2026-09-09 history rewrite in the session handoff (commit-message and comment scrub); infra/secret-scan/gitleaks.toml.

Deliverables. (1) infra/import/mirrors/: a re-runnable refresh (refresh-s2.sh, a transform specification, the lock s2-mirrors.json — source repository, target SHA, the old boundary and its rewritten counterpart, path mappings, transform and overlay digests, the git-filter-repo version and interpreter), the Skynet overlays as ordered patches, and a test over a synthetic fixture for every stop. (2) The rewrite reproduces the existing import exactly (the rewritten d842453 is the imported boundary commit; old rewritten IDs unchanged), including any content or message scrub the import and the 2026-09-09 rewrite applied, with no secret value committed (run-time inputs by digest). (3) Imported commit messages carry no tool attribution. (4) The refreshed tree equals the pinned upstream after the rewrite plus exactly the declared overlays; the merge is built with --no-ff --no-commit, compared by path/blob manifest and committed only on equality, as one merge commit pinning the source SHA and the manifest digests. (5) Every stop — SHA absent, boundary mismatch, tool or spec mismatch, overlay conflict, manifest mismatch, a secret finding over the tree or the imported range, an attribution hit — leaves no commit and no changed tree. (6) docs/runbooks/MIRROR_REFRESH.md; AGENTS.md:22 names the procedure. (7) Both mirrors refreshed on the branch; docs/ops/a4a-mirror-refresh-acceptance.md with provenance and the measured proofs.

Acceptance. The procedure's test green; the refresh run's proofs in the record (boundary identity, commits added, manifest equality, both scans clean, git log --follow continuity); CI green. The PR merges with a merge commit, not a squash — a squash would flatten the imported history; this exception to the house squash rule is the owner's decision.

Out of scope. Porting anything (A4, A9); the services/agent-runtime and services/workos mirrors.

Built as (PR #79 → main merge commit 32cfffc, 2026-09-14). Plan 2 review rounds; code 6 concerns with re-checks (the core with merge ownership, transform + attribution, overlays + test, docs, generated test inputs, exact stop assertions). infra/import/mirrors/ — refresh-s2.sh + mirror_refresh.py, the lock, the spec, two overlays, the pinned rewrite tool, a 62-case test; the runbook docs/runbooks/MIRROR_REFRESH.md; AGENTS.md names the procedure. The real refresh ran on the branch: meta-ads-scraper@e818b711 (10 commits) → merge f1b8494; boundary d842453 → 92a6d55 identical (122 ids), attribution 43/43 reviewed occurrences / 0 hits, three leak scans clean, manifests equal, git log --follow continuous. Merged with a merge commit (owner decision). Record docs/ops/a4a-mirror-refresh-acceptance.md; follow-ups open items #78, #79, #82.

Waits on / Unblocks. The owner's merge-method decision / A4.

A4b · The mirror-refresh test runs in CI · A · S · S2-W0 · chore/a/a4b-mirror-refresh-ci (surfaced by A4a on 2026-09-14, open item #78)

Context. infra/import/mirrors/test-refresh-s2.sh is what proves A4a's procedure: measured at 32cfffc, 1,358 lines that build 54 fixture clones with no network and report 60 results (45 expect_stop, 4 stops after the branch has moved, 2 stops when another process owns the state, 9 aggregate checks). Nothing runs it. CI only reads it: the infra job's find infra -name '*.sh' -print0 | xargs -0 shellcheck (.github/workflows/ci.yml:407-408) shellchecks the file, and the infra filter key already fires on every infra/** change. Running it needs the lock's exact tools, and mirror_refresh.py cmd_check_tools (:738-774) refuses anything else — Python 3.13.15 by platform.python_version(), git-filter-repo 2.47.0 by package version and module sha256, git 2.43.0 by git version, gitleaks 8.30.1 by gitleaks version. The A4a record says it plainly under "Notes": the test is not in CI yet and the job is a follow-up. Until it runs, a later change to the procedure breaks it unseen until the next slice-start refresh — which is A4c's.

Read first. infra/import/mirrors/test-refresh-s2.sh:1-45 (what the fixture is, the invocation, the tool check it makes first); infra/import/mirrors/mirror_refresh.py:738-774; infra/import/mirrors/requirements.txt (the hash-pinned wheel and the install line); infra/import/mirrors/s2-mirrors.json (tools); docs/runbooks/MIRROR_REFRESH.md §2; .github/workflows/ci.yml — the changes job and its filter keys (:28-136), the infra job (:386-477), the gitleaks install of the secrets job (:636-640), the ci aggregator (:653-669); docs/CI.md (the job table and the aggregator paragraph).

Deliverables. (1) A filter key mirrors in the changes job on infra/import/mirrors/** and the workflow itself — its own key, never the infra key, which fires on every infra/** change and would run the test for an unrelated script. (2) A job mirrors that installs the locked tools and proves them with check-tools before it runs anything: the interpreter at the locked patch version, the wheel with --require-hashes from requirements.txt, gitleaks at the pinned version installed the way the secrets job installs it, and git at the locked version — when the runner image ships another git the job installs the locked one; the lock is never relaxed to match a runner. (3) The job runs bash infra/import/mirrors/test-refresh-s2.sh --python <pinned> --gitleaks <pinned> and fails on any non-zero exit; the four versions and the run's last line (N passed, M failed) stay in the log. (4) The job joins the ci aggregator in both places — the needs list and the result loop — so the one required check covers it and a path-filtered skip still counts as green. (5) docs/CI.md gains the job's row: its filter, what it proves, and why the pins are the lock's and not the workflow's. (6) docs/runbooks/MIRROR_REFRESH.md §2 says CI proves the procedure on every change to infra/import/mirrors/**, so a change there is reviewed against a green run.

Interfaces. Exposes the job name mirrors to the ci aggregator's needs list and result loop. Consumes the lock's tool pins; the job declares no version of its own beyond what it must install.

Acceptance. On a pull request that touches infra/import/mirrors/** the job runs green, and the log carries check-tools' four versions and the test's final count with 0 failed; on a pull request that touches nothing there the job is skipped and ci is green; one deliberate one-line break of the procedure on a scratch branch turns the job red with the test's own FAIL line, recorded and not merged; docs/ops/a4b-acceptance.md with the four versions, the case count and the measured wall-clock time of one run.

Out of scope. Running a real refresh in CI — it needs a full clone of the source and a clean branch, and stays an owner-run procedure; the agent-runtime lock (A4c); the driver's summary wording (A4d); any change to the procedure itself.

Waits on / Unblocks. Nothing / every later change to the refresh procedure, A4c first.

Built as (PR #94 → main 9f74f1c, 2026-09-17). Co-plan 1 round → agreed with one correction (an explicit apt-get update and an exact, fail-closed resolution of one noble build, git and git-man installed together). Code 1 review round → 2 must-fixes, 2 re-checks, then APPROVE; a third change after the first CI run, re-checked. The filter key mirrors names infra/import/mirrors/**, the workflow, and infra/secret-scan/gitleaks.toml (must-fix 1: the test copies that config into every fixture and the procedure reads it for every scan, so a change to it must run the job; a sweep found no other file read from outside the directory). The job runs on ubuntu-24.04 by name, reads the four pins from s2-mirrors.json in its first step and declares no version of its own: the interpreter through uv python install and a seeded venv with the hash-pinned wheel and an assertion on platform.python_version(); gitleaks the way the secrets job installs it, at the lock's version; git from a build that apt itself attributes to the Ubuntu noble archive. Must-fix 2 was that selection: first it keyed on the version's text, which a PPA can imitate (a PPA publishes under the suite name noble too, and a revision shape is only a convention); it now joins each candidate version's own source lines in apt-cache policy git to the release records of the global apt-cache policy and accepts only o=Ubuntu, n=noble, installs git and git-man at that exact build with --allow-downgrades, wraps an apt failure in one sentence that names both versions and says the lock is never relaxed, checks dpkg-query against the selected build, and proves the INSTALLED version's provenance again. check-tools prints its four lines unredirected before the test runs unpiped. Measured on GitHub: the runner carried git 2.55.0 and the step installed 1:2.43.0-1ubuntu7.3 over it; python=3.13.15, git-filter-repo=2.47.0 with the locked module digest, git=2.43.0, gitleaks=8.30.1; 62 passed, 0 failed; the whole job 1 min 37 s (3 min 36 s locally on the shared 4-core box). The test prints 62 results, not the 60 this card's context states: 47 stop cases, 3 helper stops, 4 stops after the branch moved, 2 when another process owns the state, 2 pass cases, 4 aggregate checks, on a script byte-identical to 32cfffc. The deliberate break ran on draft PR #95 against the card's branch (one STOP sentence of refresh-s2.sh reworded; the lock pins no digest of that file and the fixture copies it verbatim): mirrors failed with the test's own line FAIL stop: dirty-tree: … and 61 passed, 1 failed, and the ci aggregator went red with it, which proves the one required check covers the job; the skip ran on draft PR #96 (one sentence in a record file): mirrors skipped, ci green. Both closed unmerged, branches deleted. Found by the first CI run and fixed: infra/scripts/test-image-frontend-gate.py breaks a copy of ci.yml through exact text and fails loudly when a line it edits no longer reads as expected; the new job had been inserted inside three such lines, so infra went red while mirrors was green; the filter key moved ahead of the infra filter and mirrors ahead of gateway in the aggregator's needs list and result loop (list order carries no meaning), the gate's test unchanged with all 19 cases passing. It was not caught before the push because the build box had no yq; the pinned yq v4.53.6 is now in the build scratch path and a change to ci.yml runs the gate's test locally first. The shape-based rewrite of that test sits on A4's branch and reaches main with A4's pull request. The merge commit's own CI and deploy runs were green. Record docs/ops/a4b-acceptance.md; open item #78 closed.

V39 · Every box that scrolls takes a tab stop · V · M · S2-W0 · fix/v/v39-scrollable-regions (surfaced by V34's browser drive, open item #84; carded 2026-09-18)

Context. A box with a height ceiling and a scroll utility, holding nothing focusable, takes no tab stop: text taller than the box moves by mouse or by wheel and by nothing else, and axe reports it as scrollable-region-focusable at serious impact under wcag2a. V34 met one on System → Instructions and fixed it, and that fix stands in the tree at apps/web/src/pages/system/Instructions.tsx:420-426: a <pre> carrying role="region", then tabIndex={0}, then an aria-label naming the tab's template, then the app's own focus ring outline-none focus-visible:ring-2 focus-visible:ring-ring/50, with the reason written above it from :414. It is the only role="region" anywhere under apps/web/src. Measured on main at ba66058: 46 elements in the web tree carry a scroll utility; 25 of those carry a real height ceiling (an h- or max-h- utility); 2 carry a min-h floor and no ceiling (pages/products/ProductMemory.tsx:118 and components/ui/sheet.tsx:44); the remaining 19 carry no height utility at all. Of the 25, three are the Instructions page itself: the two textareas at :385 and :394, which are controls and focus themselves, and V34's box at :424. Fourteen hold their own controls and axe accepts them: the dialog bodies (pages/products/ProductList.tsx:163, pages/products/ProductCreatives.tsx:317, pages/scraped-ads/ScrapedAdsList.tsx:956, pages/scraped-ads/RunScrapeForm.tsx:296, pages/camera-moves/CameraMovesPage.tsx:362), the menus and the select popup (pages/products/SessionsList.tsx:455, pages/localize-video/LocalizeVideoSessionsList.tsx:234, components/ui/select.tsx:84), the two sidebars of nav links (components/layout/Sidebar.tsx:108, shell/pages/admin/AdminLayout.tsx:24), the tile pickers (components/video-storyboard/CharacterPanel.tsx:592 and :1569, pages/intelligence/SourceAdPicker.tsx:102) and the keyword chips, each with its own remove button (pages/scraped-ads/DiscoveryView.tsx:444). The other eight hold text or a picture and nothing else. Each is V34's defect in a different place, and two of the eight are worse than the box V34 fixed: the session panel holds the analysis, the pipeline log and the cost report, so it scrolls on ordinary sessions rather than on long ones; and the lightbox box is built to scroll, its own zoom control reaching 400%, so above fit it scrolls in both axes with no tab stop at all. Two of the eight reach the rule sideways and are no weaker for it: BriefViewer.tsx:239 and FlowKitTestPage.tsx:280 are written overflow-x-auto max-h-…, and an element whose overflow is not visible on one axis computes the other axis to auto, so a ceiling full of pretty-printed JSON scrolls up and down as well as across.

Context, continued. One branch of the session panel is not text: activePanel === 'expand_audit' at :1396 can render MultiAdExpandAuditPanel, which is components/ExpandAuditPanel.tsx:595 and draws a <button> per ad at :617, so in that one state the box holds a control and axe would accept it. One element cannot carry different markup per panel, the other seven branches are text (MultiAdInputPanel, MarkdownContent, ConceptsContent at :2024 and ReviewContent at :2070 hold no button, Button, anchor or onClick), and a scroll region that also holds a control is the shape WCAG asks for rather than a fault, so the region goes on unconditionally and the source says why. Two boxes carry a floor and not a ceiling and are recorded rather than fixed: pages/products/ProductMemory.tsx:118 reads min-h-[700px] overflow-auto and components/ui/sheet.tsx:44 reads min-h-0 flex-1 overflow-y-auto, so each grows to its content instead of scrolling. Neither needs a tab stop today, and giving a box that never scrolls one would be a tab order nobody asked for. The sweep in deliverable (4) reads ceilings, so neither is in it today; the day a max-h replaces a min-h the box enters the sweep unclassified and fails there instead of shipping, which is the whole reason the sweep exists. Two boxes that look the same are sound and stay untouched: pages/system/SystemDocuments.tsx:370 and pages/products/ProductDocuments.tsx:674, both flex-1 overflow-auto mt-2, each holding DocEditHistory, whose CollapsibleTrigger is a real tab stop. One trap, measured in a real browser by V34's fix across four markup variants and carried here because it is the whole reason the markup has three attributes and not two: a <pre>, and every other element whose role prohibits a name, needs role="region" BEFORE the name, or axe trades the serious report for aria-prohibited-attr and the box announces nothing at all.

Read first. apps/web/src/pages/system/Instructions.tsx:414-427 (V34's fixed box: the comment stating why the role comes before the name, and the four attributes this card copies) and apps/web/src/pages/system/Instructions.test.tsx:57-69 (the test shape: findByRole('region', { name }), the tabindex assertion, focus landing); apps/web/src/components/ui/hint-target.tsx (the whole file: useRender, mergeProps, defaultTagName, the render prop that swaps the tag, the ring class, and the doc comment's rule against a tab stop a page does not need) as the shape the new component copies; the eight sites, components/DocEditHistory.tsx:45-73 (DiffBlock) and :158-186 (the entry that must name it, who at :159 and when at :160), pages/system/SystemDocuments.tsx:370-398 (both branches, and the textarea's name at :386), pages/products/ProductDocuments.tsx:674-702 (the same pair, and the textarea's bare name at :688), pages/products/SessionView.tsx:1176-1230 (the button row that names each panel) and :1258-1403 (the box and all eight branches) with components/ExpandAuditPanel.tsx:595-625 (the one branch that draws its own controls), components/LongFormOutputPanel.tsx:173-191 (the Copy button outside the box and ad.cid in scope), components/video-storyboard/ImageLightbox.tsx:12 (ZOOM_STEPS) and :96-182 (the zoom row, the box, the buttons below, and the comment on why the box exists), pages/intelligence/BriefViewer.tsx:50 (showRawPatterns) and :215-243 (the toggle and the raw box), pages/flowkit-test/FlowKitTestPage.tsx:247-286 (SmokeTest, its label prop and the result box) with shell/production-routes.ts:128 (the route the drive already walks); pages/products/ProductMemory.tsx:108-121 and components/ui/sheet.tsx:38-48; apps/web/src/pages/products/a11y.test.tsx:247-320 (the source sweep's shape: SOURCES, findAll, one reviewed inventory per rule with its reason written down, on the stated principle that a property of the class string a file ships is checked on the source, and note that its SOURCES is a flat readdirSync of one folder); apps/web/src/test/controls.ts and apps/web/src/test/controls.test.tsx:1-40 (where a shared test helper lives and how it is proven); the eight test files the sites already own (components/DocEditHistory.test.tsx, components/LongFormOutputPanel.test.tsx, components/video-storyboard/ImageLightbox.test.tsx, pages/system/SystemDocuments.test.tsx, pages/products/ProductDocuments.test.tsx, pages/products/SessionView.test.tsx, pages/intelligence/BriefViewer.test.tsx, pages/flowkit-test/FlowKitTestPage.test.tsx); e2e/production-states.spec.ts:9-62 (what the arrival drive does and does not claim), :65 (AXE_TAGS, defined once and read by noViolations at :222-235) and :416-440; open item #84.

Deliverables. (1) apps/web/src/components/ui/scroll-region.tsx exports ScrollRegion, the one focusable scroll region in the tree, built in HintTarget's shape on useRender with defaultTagName: 'div' and a render prop that swaps the tag where a site needs a pre; it sets role="region" before any name, tabIndex={0}, and the app's focus ring, and its props type REQUIRES aria-label or aria-labelledby, so a region with no name does not compile and the aria-prohibited-attr trap cannot be re-entered by hand; its doc comment states the order and why, and states that it belongs on a box with a height ceiling whose content is text or a picture, never on one that IS a control and never on one that exists to hold its own controls. (2) The eight sites are converted to it, each named for the text it holds and not for itself: DiffBlock takes the entry's actor and instant as a prop and names its panel for that edit, because one panel per entry with one shared name announces eight identical regions; the two document viewers name the document, and ProductDocuments's editing textarea at :688 gains the same name its viewer does so the two branches agree, as they already do on the system page; the session panel names the open panel with the label its own button carries, unconditionally, with a source line saying that the expand-audit branch draws its own buttons and that one element cannot change shape per panel; the long-form box names the ad's body copy by the ad it belongs to; the lightbox box says the picture is scrollable rather than repeating the caption the image inside already carries as its alt; the brief viewer names the raw pattern data its toggle revealed; the smoke row names its result by the label its own SmokeTest already holds. (3) ProductMemory.tsx:118 and sheet.tsx:44 keep their markup and each gain one source line saying the box has a floor and no ceiling, therefore does not scroll, therefore takes no tab stop, and that a ceiling added later puts it into the sweep below, where it fails until somebody classifies it. (4) apps/web/src/test/scroll-regions.test.ts, a source sweep over every .tsx under apps/web/src that is not a .test.tsx, in the shape of the colour sweep in pages/products/a11y.test.tsx:247-320 but walking the tree recursively rather than reading one folder: it finds every element whose class string carries a scroll utility together with a height ceiling, and holds the result equal to one reviewed inventory of 25 entries in which every entry says focusable region (the element carries a tab stop), is itself a control (a textarea, select or input, which focuses itself), or holds its own controls with the control it holds named; a scroll box added anywhere in the web tree fails this test until somebody classifies it, and the inventory is the document that says which of the 25 is which. (5) One test per converted site, in the file that site already owns, in the shape of Instructions.test.tsx:57-69: the box is found by its role and its name, carries tabindex="0", and takes focus. (6) docs/ops/v39-acceptance.md, carrying the before and after counts, the browser check below, and the horizontal family this card measured and did not fix.

Interfaces. Exposes ScrollRegion, which every later scrollable box in the web tree uses instead of a hand-written role and tabIndex, and the scroll inventory in scroll-regions.test.ts, which every later scrollable box joins. Consumes useRender and mergeProps from Base UI and the app's focus-ring tokens, which the tree already carries; nothing new.

Acceptance. npm test in apps/web: the eight new per-site tests, each failing on the base sources and the record saying so by name; the sweep test passing over the real tree with all 25 ceilinged boxes classified, failing when any one classification is removed, and failing on a scratch copy of the tree in which a min-h on ProductMemory.tsx:118 is changed to a max-h. npm run lint, tsc and npm run build clean. A browser check, run once and written into the record, in V34's own method: each of the eight boxes opened with content past its ceiling, the lightbox at a zoom step above fit, the brief viewer's raw toggle pressed, the smoke row run, axe run with the tags production-states.spec.ts:65 defines, and scrollable-region-focusable reported for all eight before the change and for none after; the same check on ProductMemory shows the box growing and never scrolling. e2e/production-states.spec.ts still passes its axe drive, and the record states plainly that the drive does not prove this card: the rule fires only on a box that actually scrolls, six of the eight open only after a click, and the one route the drive does walk with the box on it, flowkit-test, renders that box only after Run is pressed, which the drive never presses.

Out of scope. The horizontal-only family, measured here and not fixed: 19 elements carry a scroll utility with no height utility at all, and axe fires the same rule on a region that scrolls sideways, but whether each one actually scrolls depends on content width at a viewport, which no reading of the source can answer; the bare ones among them are components/ui/markdown-content.tsx:83 (the code block) and :108 (the table wrapper), the same pair inlined at pages/products/SessionView.tsx:2224 and :2242, and the table wrappers at components/ui/table.tsx:13, pages/scraped-ads/BrandsView.tsx:126, pages/scraped-ads/CollectionsView.tsx:76 and :113, pages/scraped-ads/RunsView.tsx:106, pages/scraped-ads/DiscoveryView.tsx:243 and pages/system/Operations.tsx:234. The two sound flex-1 overflow-auto mt-2 wrappers at SystemDocuments.tsx:370 and ProductDocuments.tsx:674. The fourteen ceilinged boxes that hold their own controls and the two Instructions textareas, which the inventory records and the card does not touch. Redesigning any panel, viewer, lightbox or smoke row, and changing what any of them shows. V35's palette and title= work and V36's tooltip work, both merged. Converting the four hand-written focus-ring spans V36 left behind (shell/ShellLayout.tsx:63-64, components/ui/lineage-chain.tsx:113, shell/pages/creatives/CreativePage.tsx:441, pages/products/ProductCreatives.tsx:265) to HintTarget. An eslint rule for this family: whether a scroll box holds a focusable descendant is a property of the rendered tree and not of the JSX a rule reads, 14 of the 25 ceilinged boxes are sound only because of children a rule cannot see, so a rule would report all fourteen and the tree would need fourteen suppressions; the sweep test with its reviewed inventory is what this family gets instead, and the reason belongs in the record.

Waits on / Unblocks. V42: both cards edit the same body block of apps/web/src/components/LongFormOutputPanel.tsx and its test file, and V42's deletions shift the lines this card's sweep lists, so one builder takes V42 first and then this card, as two pull requests; this card is cut from main after V42 merges and reads those lines again there. Nothing else: V34's shape is in the tree at Instructions.tsx:420-426, V35 (e0ee835) and V36 (67bf1a4) have both merged, and V35's own edits to DocEditHistory.tsx are already in main, so this card's edit to that file conflicts with nothing / ScrollRegion and the scroll inventory, which every page that adds a scrollable box after this card joins instead of writing the four attributes again.

Built as (PR #107 → main 16dd547, 2026-09-18). Code 1 review round → three must-fixes (a render element could override the region's role and tab stop; the Status page's sheet body scrolls with only text in it; two diff regions could share a name) and one should, folded in (the lightbox zoom stopped at the box width); re-check → two must-fixes (a custom render component could still override; a sheet could omit its body's classification); second re-check → APPROVE. components/ui/scroll-region.tsx: ScrollRegion in HintTarget's shape, rendering role="region" before a required name (exactly one of aria-label or aria-labelledby), tabindex="0" and the focus ring; render is a tag name, div or pre, and any other value at run time falls back to a safe div, so no caller can drop the role, the tab stop or the name. The eight boxes use it, named for what they hold: each edit's diff (Changes by <who>, <when>, entry N of M), both document viewers (<file> content, and the product page's editing textarea gained the same name), the session panel (named by its button's label from one PANEL_LABEL record, with the expand-audit exception in the source), the long-form body copy, the lightbox picture, the brief viewer's raw data and the smoke row's result. V34's box uses it too, its markup byte-identical to main. Two premises of the card did not hold. sheet.tsx's body does scroll, from the flex layout rather than a class (8054 of 720 px on the Status page), so every Sheet now states its body as { kind: 'region', label } or { kind: 'controls' }; the Status page's check history is a region and the lineage sheets declare controls. The lightbox picture was shrunk to the box by its flex row (1008 px at 400% for a 900 px picture); its width is now set in the scroll box's own container units, 1260 px at 400%, so above fit the box scrolls sideways as well. ProductMemory.tsx gained its comment. src/test/scroll-regions.test.ts parses every .tsx with the TypeScript compiler and holds the 25 ceilinged scroll boxes to one reviewed inventory (9 focusable regions, 2 controls, 14 that hold their own controls); the counts on d1fd3c9 matched the card (46 / 25 / 2 / 19). Each per-site test fails on the base; the sweep fails when a classification is removed and when a min-h becomes a max-h. Browser check in Chromium with the spec's axe tags: scrollable-region-focusable for all eight boxes on the base and none on the branch; the Status sheet was not flagged by axe on the base because the Observed time near its top is a tab stop, and the region adds a named target for the whole body. production-states 80/80. Whole web suite 120 files / 1057 tests (+26); lint, tsc -p tsconfig.app.json, build and eslint src clean. Record docs/ops/v39-acceptance.md; open item #84 closed. Found: the sweep cannot see ceilings set by an inline style or by the layout (open item #102). make dev failed on the old dev volume's password, so the browser check ran the same compose file under its own project name with a fresh env and volume, both removed afterwards.

V40 · A shipped prompt's path comes from the registry · V · S · S2-W0 · fix/v/v40-prompt-path-through-registry (surfaced by V38's review on 2026-09-16, open item #87; carded 2026-09-18)

Context. The Intelligence-Mode concept prompt ships as one file and four readers outside the registry name it. The registry names it once: apps/api/app/backend/services/instruction_registry.py:129 maps iv2-concept-generation to _INTELLIGENCE_PROMPTS_DIR / "concept_gen.md", the directory is built off the app package at :119-121, and shipped_path() (:164-166) is the accessor that resolves a call-site alias on the way in. Two callers build the same path from their own module location instead of asking: apps/api/app/backend/intelligence_v2/generation/concept_gen.py:18-20 and apps/api/app/backend/intelligence_v2/labs_shared/prompt_assembly.py:31-33 each hold a private _PROMPT_FALLBACK_PATH = Path(__file__).resolve().parent.parent / "prompts" / "concept_gen.md" and hand it to load_spec at concept_gen.py:41-42 and prompt_assembly.py:299-300. All three expressions resolve to the same file today and the file is pinned by hash, so nothing is wrong on a running stack. What is wrong is what the pin PROVES: apps/api/app/backend/tests/test_intelligence_instructions_shipped.py:88-101 asserts that the REGISTRY's path is the pinned file and says nothing about the two callers, so a move or a rename would be made in the registry, the pin would follow it, the whole suite would stay green, and both callers would fall through load_spec's swallowed read (apps/api/app/pipeline/utils/file_io.py:41-49) to the operator's missing-instruction sentence (instruction_registry.py:192-202) for every workspace that has never edited the prompt. Two more sites make the same point from the other side: apps/api/app/pipeline/steps/step2_concepts.py:97-101 and apps/api/app/pipeline/steps/step4_review.py:3,27-28 do read the registry, but through the raw INSTRUCTION_FALLBACK_PATHS map with .get(...), which answers None for a key nobody registered rather than failing, and step4_review.py translates the alias step4 into image-review by hand (the alias map is instruction_registry.py:21-26), so the row lookup and the file lookup are two independent spellings of one step that a change to the alias map would split in silence. The house shape already exists and V34 left it at apps/api/app/pipeline/steps/step1_analysis.py:17 and :52 and at step2_concepts.py:105: load_spec("<step>", fallback_path=shipped_path("<the same step>")). One reader sits outside the package: the dev harness apps/api/scripts/run_lab_concept_gen.py:170-171 passes pa._PROMPT_FALLBACK_PATH, a private attribute of another module, so removing the constant without touching the harness breaks it, and the harness is outside the sweep that would have said so.

Read first. apps/api/app/backend/services/instruction_registry.py:1-10 (the module's own statement of why one map exists), :21-26 (STEP_ALIASES, including step4 to image-review), :112-143 (the three shipped directories and INSTRUCTION_FALLBACK_PATHS, the iv2 entry at :129), :146-166 (resolve_step, is_registered, label_for, shipped_path), :192-202 (the sentence an operator reads when neither a row nor a file serves the step); apps/api/app/pipeline/utils/file_io.py:13-50 (load_spec: the registry check, the workspace row, the fallback read whose failures are swallowed at :41-49, and the refusal at :50); the four call sites as they stand, apps/api/app/backend/intelligence_v2/generation/concept_gen.py:1-22 and :40-43, apps/api/app/backend/intelligence_v2/labs_shared/prompt_assembly.py:1-33 and :296-302, apps/api/app/pipeline/steps/step2_concepts.py:1-4 and :94-105, apps/api/app/pipeline/steps/step4_review.py:1-28; the shape to copy, apps/api/app/pipeline/steps/step1_analysis.py:1-4, :17 and :50-53; apps/api/app/backend/services/db_service.py:11-14 (the registry names this module re-exports) with the comment at :2474-2479 that says why, and :2550-2561 (get_instruction, the one dynamic loader call and the only site the AST cannot check); the AST sweep and its three tests, apps/api/app/backend/tests/test_explore_instructions.py:527-610, its root at :529, _literal_loader_calls at :533-554 where passes_fallback is captured at :552 and the expression is thrown away, and the enumerating tests beside it at :482-525; the pin, apps/api/app/backend/tests/test_intelligence_instructions_shipped.py:1-36, :47-69 and :88-101; the harness, apps/api/scripts/run_lab_concept_gen.py:34-64 (the sys.path insert and the # noqa: E402 import block it forces), :73-96 (its disk-only load_spec, patched onto file_io.load_spec at :95 and pa.load_spec at :96) and :168-172; docs/ops/v38-acceptance.md:41-55 (what the pin was built to say, and what it was not); open item #87.

Deliverables. (1) concept_gen.py and prompt_assembly.py take the path from instruction_registry.shipped_path("iv2-concept-generation") at the load_spec call; both _PROMPT_FALLBACK_PATH constants go, and with each one the from pathlib import Path line the module no longer uses (concept_gen.py:7, prompt_assembly.py:11; neither module uses Path for anything else, and prompt_assembly's other occurrences of the word are prose about "Path A" and "Path B"). (2) The two half-corrected sites take the same shape: step2_concepts.py uses the shipped_path it already imports at :1 and drops the function-local INSTRUCTION_FALLBACK_PATHS import at :97, and step4_review.py passes shipped_path("step4"), so the alias is resolved once by the registry, the db_service import at :3 becomes from app.backend.services.instruction_registry import shipped_path as in step1_analysis.py:3, and the comment at :25-26 explaining the hand translation goes with it. After this, every load_spec call under apps/api/app that names a literal step passes shipped_path(<that same literal>), and the one dynamic call at db_service.py:2557-2558 already does. (3) The harness apps/api/scripts/run_lab_concept_gen.py:170-171 reads shipped_path("iv2-concept-generation") and no longer reaches into another module's private attribute, with the accessor imported in the file's post-sys.path block under the same # noqa: E402 as its neighbours; the call itself stays pa.load_spec, which is the binding _patch_load_spec_to_disk replaces at :96, so the disk-only patch still covers it. (4) The rule is enforced by the sweep, not by review: _literal_loader_calls also returns the fallback_path expression, and a new test refuses any literal load_spec call whose fallback_path is not shipped_path (in either spelling, bare or through the registry module) called with the SAME literal the loader was given, naming the file, the line, the step and what the call passes instead; test_the_sweep_finds_the_calls_it_is_meant_to_check (:557-563) is extended so that the expression is captured for every literal call it finds, and the new rule therefore cannot pass by matching nothing. (5) A negative proof that the rule catches what it is for: the checker is exercised over source text holding a hardcoded Path(...) fallback, a raw-map .get("…") fallback and a shipped_path call naming a DIFFERENT literal from the loader's, and refuses all three, so the sweep is proven on text rather than only on a tree that happens to be clean. (6) docs/ops/v40-acceptance.md: the call-site inventory before and after, the file each one resolves to in both states, and the sweep's output on the base sources and on the branch.

Interfaces. Exposes nothing new. Consumes instruction_registry.shipped_path, which becomes the only way a call site under apps/api/app names a shipped instruction file, and the rule that says so lives in the sweep. Unchanged: the registry's map and its entries, the step keys, the aliases, the labels, load_spec's signature and its refusal sentence, the prompt bytes and their pins, and db_service's re-exports.

Acceptance. pytest apps/api/app/backend/tests green on the branch, and the new sweep test FAILS on the base sources naming concept_gen.py:41, prompt_assembly.py:299, step2_concepts.py:98 and step4_review.py:27 by file and line, which is what says the rule reads the tree and not a list; the sweep finds seven literal calls on both the base and the branch, so the rule is proven to be checking the calls that exist rather than an empty set; the three fixture cases in deliverable 5 each refused, with the mismatched-literal case refused for a different stated reason from the hardcoded one; test_intelligence_instructions_shipped.py untouched and still green, which is what says the prompt bytes did not move; a test that the path each of the four call sites now hands load_spec is the same file the pin asserts, so the item's "the three agree" is proven by equality and not by inspection; rg "_PROMPT_FALLBACK_PATH" apps/api returns only storyboard_delivery.py's two ChatCut constants and their tests; rg "INSTRUCTION_FALLBACK_PATHS\.get" apps/api --glob '!**/tests/**' returns nothing, and the remaining non-test mentions of the map are its definition at instruction_registry.py:125, its use inside shipped_path at :166, the db_service re-export at :12 with its comment at :2478, and the docstring line storyboard_llm.py:18, none of them a call site; python -m py_compile apps/api/scripts/run_lab_concept_gen.py clean and the harness imports, so the private reach is gone and nothing replaced it; importing concept_gen and prompt_assembly from a bare interpreter succeeds. Record docs/ops/v40-acceptance.md; open item #87 closed.

Out of scope. The prompt bytes and the hashes pinned over them. The registry's map, keys, aliases and labels. load_spec's signature and the operator's sentence. apps/api/app/pipeline/storyboard_llm.py:68-77, whose INSTRUCTION_FILES names eight registered steps' shipped files a second time off its own ASSETS_DIR (:45), and :204-242, which is a second copy of load_spec's row-then-file logic and never calls load_spec at all: the same defect at eight times the size, in a module with its own loader contract, and its own card; its docstring at :18 names the map in prose and stays. apps/api/app/backend/intelligence_v2/services/_shared.py:19, apps/api/app/backend/services/storyboard_delivery.py:82-84,88-90 and apps/api/app/backend/services/creative_strategist.py:42-44, which name files that are not registered steps or whose disk fallback the registry deliberately does not carry (instruction_registry.py:65-77). apps/api/scripts/render_comparison_concepts.py:30-32, a lineage table that records the fallback in prose and reads nothing. Widening the sweep's root past apps/api/app. The harness's stale user_id parameter at run_lab_concept_gen.py:85, and its patch covering file_io.load_spec and pa.load_spec but not concept_gen's own module-level binding from concept_gen.py:14, which the harness does not reach.

Waits on / Unblocks. Nothing: the registry, the accessor and the sweep all exist on main and this needs no new mechanism to prove / any future move or rename of a shipped prompt, which afterwards is one line in the registry instead of four lines in four modules, and every later card that registers a step or adds a loader call, which the sweep now holds to one shape.

Built as (PR #100 → main 0a69129, 2026-09-18). Code 1 review round → one must-fix (the sweep identified a loader call only by the name load_spec, so an aliased import escaped both the count and the rule), then a re-check → APPROVE. The four call sites pass shipped_path(<the same step>), the shape step1_analysis.py already used: concept_gen.py and prompt_assembly.py lose their private _PROMPT_FALLBACK_PATH and its unused import, step2_concepts.py stops reading the raw map with .get(), and step4_review.py passes shipped_path("step4") so the registry resolves the alias once instead of a hand translation. The dev harness takes shipped_path instead of another module's private attribute and still calls pa.load_spec, so its disk-only patch still covers the call. The AST sweep identifies a loader call by what its callee resolves to through the module's imports and a tree-wide index of re-exports, so an aliased import, pa.load_spec and a keyword step= are all caught (the last was a second gap found while fixing the first), and it refuses any fallback that is not the registry's shipped_path for the loader's own step, with its own sentence for a mismatched step. A negative proof on source text, a positive control, and a move test beyond the card's ask, which points a registry entry at a temporary path and checks each call site follows it at run time. On the base sources the rule named the four call sites; the sweep finds the same seven literal calls on base and branch, so it checks the calls that exist. The review ruled that refusing shipped_path through db_service's re-export is correctly strict. Whole api tier 4355 passed / 11 skipped / 3 deselected on the built tree, and the PR's api job was the tier on the actual base after it was rebased onto A4c's merge. Record docs/ops/v40-acceptance.md; open item #87 closed. The same defect at eight times the size, the storyboard module's own copy of the registry and loader, is open item #95.

V41 · The login page's countdown tests wait for the state they read · V · XS · S2-W0 · fix/v/v41-login-countdown-gate (surfaced by V36's whole-suite run on 2026-09-16, open item #90; carded 2026-09-18)

Context. Three tests in apps/web/src/shell/auth/LoginPage.test.tsx advance a fake clock past a 60 s hold and read the DOM in the very next statement, and nothing waits for the state they assert: :159-162 (the password form's throttle: 30,000 ms, then 31,000 ms, then Sign in must be enabled), :235-236 (the link form's throttle: 61,000 ms, then Send link must be enabled) and :299-301 (send again: 60,500 ms, then enabled). Each starts the clock with vi.useFakeTimers({ shouldAdvanceTime: true }) and advances it with a bare await vi.advanceTimersByTimeAsync(...). The last one failed once. docs/ops/v36-acceptance.md:282-286 records one failure "in the send-again countdown" in V36's first whole-suite run, on a box where nothing else was running, then 21 of 21 for the file alone and a clean second whole run. The record names no assertion and no message; open item #90 is the only source for the button reading disabled at :301. V36's branch sat on main at 2d97b9f (v36-acceptance.md:3), which is V37's merge, so V37's budgets were already in force (testTimeout: 15_000 at apps/web/vitest.config.ts:41, asyncUtilTimeout: 4_000 at src/test/setup.ts:21), and the three tests take about 1 s on an idle box. V37's 26 whole-suite runs on a tree that held this same file never showed the failure (docs/ops/v37-acceptance.md:30-65), and six runs of the file alone beside six busy processes, at a load average of 10.23, passed 21 of 21 each time. The page is not the cause. useCountdown (apps/web/src/shell/auth/LoginPage.tsx:71-101) sets until in the handler (:95-99) and installs its one-second interval in an effect one commit later (:84-92), so the tick that reaches until always lands at or after it, and the seconds left are derived at render (:94). The test is where the order is left to chance. The suite runs without vitest globals (vitest.config.ts:15-42), so Testing Library never registers the global beforeAll hook that turns React's act environment on (@testing-library/react 16.3.3, dist/index.js:41-51). An update from the fake interval is therefore outside act, React prints no warning for it, and it renders later through React's own scheduler, on the real setImmediate that the scheduler captured when it loaded. advanceTimersByTimeAsync (the fake timers bundled in vitest 4.1.11, tickAsync) fires each due timer, waits one real setTimeout, and resolves in that same real turn once no timer is left. Two more things move under it. With shouldAdvanceTime the auto-advance runs in its interval mode, which pauseAutoTickUntilFinished does not pause, so a real 20 ms interval keeps moving the fake clock during the advance. And performance is faked on its prototype, so React's scheduler reads the fake clock. Read from that code, the render that the last tick asks for normally runs before the advance resolves. A stale read needs React to hold that render behind other queued work (the scheduler yields after any commit and after 5 ms of work, shouldYieldToHost in scheduler 0.27.0), and this page's per-tick commits leave no such work, because every effect on the sent page keeps its dependencies from tick to tick. So the one failure is not explained, and this card does not claim to explain it. What is certain is the hazard: each read is right only if an ordering between two libraries holds, and nothing in the test states or waits for that ordering. The rest of the suite already reads through a gate: 43 advance calls live in 13 files under apps/web/src, and every one outside this file that then reads the DOM runs inside act(...) (shell/pages/status/StatusPage.test.tsx:164 and :292-302, components/ui/copy-button.test.tsx:40-43, components/ui/relative-time.test.tsx:47-50, pages/products/ProductCreatives.test.tsx:115-122, and the scraped-ads and storyboard lists), while the rest assert on a mock. A findBy query is not a gate here. ByRoleOptions has no disabled filter, and the button exists, disabled, before and after the hold, so findByRole resolves at once on the stale page. A fourth read is weak for a different reason: :303-305 waits for magicLink to be called twice and then reads the button as disabled, which the in-flight send also makes true (LoginPage.tsx:219 disables on busy || resendIn > 0), so whether it catches a missing second hold depends on which render has landed.

Read first. apps/web/src/shell/auth/LoginPage.test.tsx:57-68 (the reset and the vi.useRealTimers() teardown), :140-163, :224-237 and :256-306 (the three fake-timer tests and the sendALink helper at :257-263); apps/web/src/shell/auth/LoginPage.tsx:34-38 (the two 60 s holds), :71-101 (useCountdown, and its note on why the seconds are derived and not stored), :179-193 (sendLink, which starts the hold after the send returns) and :213-225 (send again, its disabled binding and the "(in N s)" hint at :224); the shapes to copy, apps/web/src/shell/pages/status/StatusPage.test.tsx:286-305 (an async advance inside act under shouldAdvanceTime) and apps/web/src/components/ui/copy-button.test.tsx:29-44 (a waitFor on the asserted state under the same clock); apps/web/vitest.config.ts:15-42 and apps/web/src/test/setup.ts:1-25; docs/ops/v36-acceptance.md:3 and :282-286; docs/ops/v37-acceptance.md:15-65 (the box, the neighbour recipe and what each load shape reproduced); in the installed packages, Testing Library's act-environment hook (@testing-library/react/dist/index.js:41-51), tickAsync and pauseAutoTickUntilFinished in the fake timers vitest 4.1.11 bundles, and shouldYieldToHost in scheduler 0.27.0; open item #90.

Deliverables. (1) Each advance in the three tests runs inside act, in the shape of StatusPage.test.tsx:292 (await act(() => vi.advanceTimersByTimeAsync(...))), the two advances at :159 and :161 included. (2) Each of the three enabled checks waits for the state it asserts through waitFor, in the shape of copy-button.test.tsx:39 and this file's own :304, so the read no longer depends on which library runs first. After this, no read in the file follows a bare advance. (3) The second half of the send-again test proves the second hold. It waits for the "(in N s)" hint (LoginPage.tsx:224) to come back, which renders only while resendIn > 0 and never for a send that is only in flight, and then reads the button as disabled. (4) A bite proof, run on scratch copies, recorded and never committed. With each advance replaced by the synchronous vi.advanceTimersByTime(...), which fires every tick before React renders any of them, the three reads as they stand on main fail on every run, and the reads from deliverables (1) and (2) pass on every run. With the page changed so that only the first send starts a hold, the check from deliverable (3) fails on every run. (5) docs/ops/v41-acceptance.md: each site before and after, the bite proof, the load runs, and a plain statement that V36's one failure was not reproduced and its cause is not established.

Acceptance. cd apps/web && npx vitest run src/shell/auth/LoginPage.test.tsx green at 21 tests. The bite proof in the record, as deliverable (4) states it. The whole web suite green once idle, and in 3 runs of 3 beside the six-process neighbour of docs/ops/v37-acceptance.md:21-28 (V37's final-proof shape), with each run's file and test counts, load average and wall time recorded and not pinned. grep -n "advanceTimersByTime" apps/web/src/shell/auth/LoginPage.test.tsx shows every advance inside act(. npm run lint, npm run typecheck and npm run build clean. testTimeout at vitest.config.ts:41 and asyncUtilTimeout at src/test/setup.ts:21 unchanged, and no test in the file carries a timeout argument of its own. Record docs/ops/v41-acceptance.md; open item #90 closed.

Out of scope. LoginPage.tsx: the page leaves no second on the clock, both holds stay 60 s, and its bindings and copy are untouched. Raising either budget. A further attempt to reproduce V36's failure: V37's 26 whole-suite runs and six file-alone runs beside six busy processes never showed it, so another set that shows nothing proves nothing. The other twelve fake-timer files, which already read through act. Turning React's act environment on for the whole suite in src/test/setup.ts, which would make React warn on every update outside act in every file: how many warnings it raises is not measured, and it is its own item. A lint rule for this shape. e2e/ and the api tiers.

Waits on / Unblocks. Nothing: the tests are on main, no other open card edits them, and this card gates no other card / a web suite whose red means a defect (open item #66(b)), with the last bare advance-then-read gone from it.

Built as (PR #104 → main 28e76e6, 2026-09-18). Code 1 review round → one must-fix (a card key in the file's opening comment), then a re-check → APPROVE. The four advances in the three countdown tests run inside act in the shape await act(() => vi.advanceTimersByTimeAsync(...)), and each enabled check waits for its state through waitFor, so no read in the file follows a bare advance. The send-again test proves the second hold in order: the "(in N s)" hint is on the page after the first send, gone once the hold ends, back after the second send (matched as /^\(in \d+ s\)$/ after Testing Library's normaliser trims the leading space), and only then is the button read as disabled. LoginPage.tsx, both budgets and every other file are untouched, and no test carries a timeout argument. Bite proof on scratch copies, 10 runs per copy with the same result every run: with synchronous advances, the three reads as they stand on main fail and the gated reads pass; with only the advance at :161 synchronous, :162 fails alone; against a page where only the first send starts a hold, the new check fails, and so did main's weaker check on this box. The file: 21 passed. The whole web suite 118 files / 1031 tests idle in 279 s, and 3 of 3 beside the six-process neighbour at load 8.4 to 13.4 in 566, 513 and 507 s. npm run lint, tsc -p tsconfig.app.json --noEmit and npm run build clean; the npx tsc --noEmit this card names checks no file, because apps/web/tsconfig.json is a solution file (open item #100). V36's one failure was not reproduced and its cause is not established. Record docs/ops/v41-acceptance.md; open item #90 closed. Found: 24 source files still carry a card key in a comment, LoginPage.tsx:16 among them (open item #99).

V42 · One copy of each control, and no branch nothing can reach · V · S · S2-W0 · chore/v/v42-one-copy-of-each-control (surfaced by V35, open item #91; carded 2026-09-18)

Context. Two defects under apps/web/src/components/. V35 (PR #91, main e0ee835) converted both files to the design system and left both defects in place. Both are re-measured at ba66058. (a) video-storyboard/CharacterPanel.tsx:940 computes const editUnbuilt = !exists && !skipped inside CharacterEditor (:758), where exists is isBuilt(character) (:911, the helper at :73-77) and skipped is character.status === 'skipped' (:908). It does two things. It sets the Edit button's disabled at :943, and at :1088-1092 it chooses between the bare button and the button wrapped in a Tooltip on a HintTarget that carries the build-first sentence. No render of CharacterEditor can be in that state. The component is private to the module and is rendered from three places, each behind a guard: :2096-2099 returns the unbuilt placeholder unless the character is built or skipped, before the solo editor at :2100-2113; :2120-2124 does the same before the primary editor at :2125-2132; :2156-2158 returns the placeholder unless isBuilt(shown.character), before the member editor at :2160-2183. So exists || skipped holds wherever the editor renders, and editUnbuilt is always false. The disabled at :943 never fires, the hint at :1089-1091 never mounts, and HintTarget (imported at :12) has no other use in the file. The item says four call sites. There are three. The "four places" in the withLightbox comment at :1826-1829 counts return shapes, and it is out of date too: the wrapper now returns from seven places (three placeholders, three editors, and the loading card at :2145). The dead state is older than V35. Before e0ee835 it was inline as disabled={!exists && !skipped} with a title=, and V35 named it and moved its sentence onto a HintTarget. The live version of the control is UnbuiltCharacter's at :713-723: the same Edit character label over a ChevronDown, disabled, with the same sentence on ControlHint, which components/ui/hint-target.tsx:18-21 names as the shape for a control the page switches off. The suite covers the live control and cannot tell the two apart. CharacterPanel.test.tsx:167-178 asserts a disabled Edit button inside a tab stop that carries the sentence, which the dead branch would also satisfy. Both render helpers (:60-76) pass a cast with roster: [] (:17-20), so only the solo route is ever rendered, and the primary and member guards have no test at all. Inside the editor, !skipped && exists at :1098 and :1110 reduces to !skipped under the same guards. Those two conditions are correct and stay. (b) LongFormOutputPanel.tsx builds its copy control by hand twice, at :155-166 for the headline and :174-187 for the body: a Tooltip around a bare <button> (:158-164, :179-185) with an aria-label, a lucide Copy/Check swap, and one panel-wide copied key in state (:67) that copyText (:84-92) sets on a 1,500 ms timer. components/ui/copy-button.tsx:16-48 is the shared control. It does the same job on the design system's Button variant="ghost" size="icon-xs", with the same 1,500 ms revert (:34), and it adds a polite live region that says "Copied" (:43-45), which the panel has never had. The panel does one thing the shared control does not. copyText writes withRtlMarkIfNeeded(text) (:86, the helper at :37-41), which puts U+200F in front of a text that holds more right-to-left letters than left-to-right ones, so a Hebrew ad pastes right to left. CopyButton writes its value as given (:28). No test covers the mark today, so a plain swap would drop it and the suite would stay green. One other card edits this block: V39 (open item #84) converts the body's scroll box at :188, directly under the body's copy button, and adds a test to LongFormOutputPanel.test.tsx.

Read first. apps/web/src/components/video-storyboard/CharacterPanel.tsx:73-77 (isBuilt), :662-731 (UnbuiltCharacter, with the live disabled control at :706-724), :736-756 (CharacterEditorProps), :900-949 (skipped, exists, the comment at :934-939 and the button at :941-949), :1063-1120 (the control strip, its note that edit is gated on existing, the branch at :1088-1092, and the two !skipped && exists conditions), :1670-1760 (the slug state, roster, isPrimary and loadMember, which decide the three routes), :1826-1829 (the withLightbox comment), :2059-2085 (unbuiltView) and :2087-2184 (the three guards and the three renders); apps/web/src/components/ui/hint-target.tsx:6-21 and components/ui/control-hint.tsx; apps/web/src/components/video-storyboard/CharacterPanel.test.tsx:11-20 (the unbuilt fixture and the cast with no roster), :33-43, :60-76 and :167-193; apps/web/src/components/LongFormOutputPanel.tsx:1-6, :17-41, :60-92 and :151-190; apps/web/src/components/ui/copy-button.tsx and copy-button.test.tsx:1-45 (the clipboard stub at :10); apps/web/src/components/creative-code/CodeChips.tsx:28-44 (the shared button in an inline flex row); apps/web/src/components/LongFormOutputPanel.test.tsx; apps/web/eslint.config.js:30-45; open item #91.

Deliverables. (1) CharacterEditor no longer carries a state it cannot be in. editUnbuilt and its comment at :934-939 go. The Edit button renders once at :1088, with no disabled and no hint wrapper. The skipped label at :945 stays, because a skipped primary reaches it. (2) HintTarget's import at :12 goes with the branch. ControlHint and its four uses at :717, :1386, :1474 and :1602 stay. (3) The rule that makes the branch impossible is written where a reader meets it, in the control-strip comment at :1063-1073: this editor renders only for a character that is built or skipped, and the three guards in the wrapper hold it. The withLightbox comment at :1826-1829 states the returns as they are. (4) Tests that pin the rule on every route, in CharacterPanel.test.tsx: the solo route (no roster), the primary route (a roster of two, the primary selected) and the member route (a roster of two, the member's chip pressed, videoStoryboardApi.getCharacter stubbed). On each route an unbuilt character renders the placeholder, known by its "Not built yet" sentence (:695, :698), and no editor, and a built one renders the editor with a live Edit control. A later change that sends an unbuilt character into CharacterEditor on any route fails one of them. (5) LongFormOutputPanel renders CopyButton for the headline and the body with label headline and body, so the names stay "Copy headline" and "Copy body", and with value={withRtlMarkIfNeeded(c.headline || '')} and value={withRtlMarkIfNeeded(c.body_markdown || '')}, so the clipboard gets exactly what copyText wrote. (6) copied (:67), copyText (:84-92) and the imports that fall with them, Copy and Check at :2 and Tooltip at :4, go. withRtlMarkIfNeeded, its two character classes and the note at :17-32 stay. (7) A test on the payload, with the clipboard stubbed as copy-button.test.tsx stubs it: a mostly Hebrew body reaches the clipboard with U+200F in front, and an English body reaches it unchanged. (8) docs/ops/v42-acceptance.md: the reachability argument with the three guards quoted; the copy control before and after, including the payload, the live region, and the check state that is now per button where it was one key for the whole panel; and the bite proofs below.

Interfaces. Exposes nothing new. Consumes CopyButton as the one copy control in the web tree, which takes its call sites from four (CodeChips.tsx:36, DevGallery.tsx:218, CreativePage.tsx:205 and :375) to six.

Acceptance. cd apps/web && npm test green. The route tests and the payload test pin behaviour that main already has, so they also pass on the base sources. Their bite is shown on scratch copies, and the record states each result: with any one of the three guards (:2096, :2120, :2156) removed, the unbuilt case for that route fails; with value={c.body_markdown || ''} in place of the marked value, the payload test fails. The two existing tests in LongFormOutputPanel.test.tsx pass unchanged: the names, the tooltip text, the descriptions on focus, the tab from the headline's control to the body's, and nestedControls(container) empty. CharacterPanel.test.tsx:167-178 still passes, on the placeholder's control. rg "editUnbuilt|HintTarget" apps/web/src/components/video-storyboard/CharacterPanel.tsx returns nothing. rg "copyText|navigator\.clipboard|Tooltip" apps/web/src/components/LongFormOutputPanel.tsx returns nothing, and so does rg "import \{[^}]*\b(Copy|Check)\b[^}]*\} from 'lucide-react'" apps/web/src/components/LongFormOutputPanel.tsx. npx eslint src reports nothing, and no line suppresses a design-system rule. npm run lint, npm run typecheck and npm run build clean. The whole web suite green, with its file and test counts recorded. Record docs/ops/v42-acceptance.md; open item #91 closed.

Out of scope. The placeholder's own control at CharacterPanel.tsx:713-723, which is the live one and stays word for word. The three guards, and which view an unbuilt character gets. The two !skipped && exists conditions at :1098 and :1110, which are correct as written. The rest of CharacterEditor, including the hints at :1386, :1474 and :1602. The approval, download and image-prompt controls in LongFormOutputPanel, and the body's scroll box at :188, which is V39's. The RTL rule itself. Any other hand-built copy of a shared control elsewhere under apps/web.

Waits on / Unblocks. Nothing: V35 is merged, and no open card is ahead of this one in either file / V39, which edits the same Body block of LongFormOutputPanel.tsx and its test file, and whose scroll-box sweep lists two boxes in CharacterPanel.tsx (:592, :1569) below the lines this card deletes. V39 is therefore cut from main after this card merges.

Built as (PR #101 → main 5696d6d, 2026-09-18). Code 1 review round → one must-fix (an item number left in a source comment), then a re-check → APPROVE; the review ruled the per-button check state an acceptable consequence of using the shared control. CharacterEditor loses editUnbuilt, its comment and the HintTarget import: the Edit button is built once and placed once in the control strip, with no disabled and no hint wrapper, and the Edit label for a skipped character stays. The control-strip comment now says the gate is not in the editor: the editor renders only for a character that is built or skipped, the three guards in the wrapper hold that, and an unbuilt character gets UnbuiltCharacter, whose strip carries the switched-off Edit and its reason. The withLightbox comment names the kinds of view it returns instead of a count; the wrapper returns from seven places (three placeholders, three editors and the member's loading card). ControlHint and its uses, the placeholder's own control and the two !skipped && exists conditions are unchanged. LongFormOutputPanel renders CopyButton for the headline and the body, named "Copy headline" and "Copy body", with the right-to-left mark applied to the value at the call site, so the clipboard gets byte for byte what copyText wrote; copied, copyText, the Copy and Check icons and the Tooltip import are gone, and CopyButton has six call sites, up from four. Each button now holds its own check state on its own timer, where one panel-wide key let a copy in one place clear the tick in another, and each announces "Copied" in a polite live region, which the panel never had. Six route tests cover the solo, primary and member routes, an unbuilt and a built character on each; they know the placeholder by its "Not built yet" sentence and the editor by the sentence under its identity lock, and the member route presses the member's chip with videoStoryboardApi.getCharacter stubbed. Two copy tests pin the payload and the announcement. The announcement fails on the base sources. The behaviour main already had is proven by scratch mutations: each of the three guards removed fails its own route's unbuilt case and no other route test, and either value without the mark fails the payload test. The card's three rg checks return nothing on the branch and 5, 10 and 1 lines on main. Whole web suite 118 files / 1031 tests (+8); lint, eslint src (308 files, 0 reports), tsc and build clean. Record docs/ops/v42-acceptance.md; open item #91 closed. Found and filed as open item #96: the cast chip and the build-everyone count decide "not built" from the identity lock alone, against isBuilt's own rule.

S36 · A character build claims before it spends · S · M · S2-W0 · fix/s/s36-claim-before-spend (discovered by S32's build on 2026-09-16, pre-existing on main, open item #88; carded 2026-09-18)

Context. Two presses of Build on the same character both pay for the design text call. apps/api/app/backend/services/storyboard_image_runner.py:1314 asks _refuse_if_sheet_in_flight (defined :1608-1623) before the paid images.design_character at :1321-1327, while the real claim, the pending version row written by svc.create_character_version(..., status="pending"), does not exist until :1733-1742 inside _render_character_sheet. The guard is a read of storyboard_service.pending_character_version_count (:3277-3293: a pending row for that slug younger than PENDING_CLAIM_SECONDS = 300 at :2736), so two requests that arrive together both read zero, both reach the text call, both record its spend at :1328 under stage character (storyboard_service.record_spend:3931-3954), and only the second is refused at :1677 on its way into the render. The comment at :1309-1313 calls the first check the cheap early exit and the second the real claim, and the window between them holds one paid call to production.storyboard.llm (app/pipeline/storyboard_images.py:436, through _character_model_call:123-155). Nothing serialises the two presses: POST /sessions/{id}/character?force=true (app/backend/routes/video_storyboard.py:941-962) is a sync def, so FastAPI runs it on the request threadpool and two presses are genuinely concurrent, it calls ensure_character inline, and it takes no job slot (the only slots in that file are the export lease at :2024 and the two image jobs at :2806 and :2850). The claim's own read then insert is not atomic either, so two presses can also pass :1677 and both INSERT at :1733: no unique index exists on storyboard_character_versions, whose only index is (session_id, id DESC) (db/migrations/unified/production/001_baseline.sql:2239-2292). S32 made every exit between the claim and the settle release the row (:1744-1850, _release_sheet_claim:1626-1652) and deliberately left the claim where it was. The refine path is the same defect one step worse, with no early guard at all: refine_character:1979 reaches _instruct_fields:1900, which pays images.instruct_character at :1936 and records the spend at :1938 under stage character_instruct, and meets its first and only guard at :1677. So two simultaneous refinements also both write the character's fields through update_character_text (:1951-1953) and the second overwrites the first. Redraw (:2073-2123) and the supplied-sheet build paths buy no text call ahead of the render.

Read first. apps/api/app/backend/services/storyboard_image_runner.py:1285-1335 (_invent_character: the early guard, the style read, the text call, the hand-off), :1281, :1412-1413 and :1516-1519 (the three callers that reach it: a cast member, the forced build, the first unforced invent of an invent session), :693-727 (_upload_root, the other version row this module writes, created ready with its key), :1574-1605 (_current_version and its lazy root write), :1608-1623 (the guard and the sentence it raises, images.StoryboardImageError, which _image_guard answers 400), :1626-1652 (_release_sheet_claim), :1655-1742 (_render_character_sheet down to the row it writes), :1744-1850 (S32's window and every settle), :1871-1897 (_no_render_needed), :1900-1965 (_instruct_fields, its paid call and the field write) and :1968-1976 (_is_uploaded_sheet), :1979-2070 (refine_character: the two cheap refusals :2003-2012, the lazy root write :2014, the instruction :2019, the no-render exit :2022-2027, the tweak's reference fetch :2040-2042, the two renders :2043 and :2063), :2073-2123 (redraw, the caller that keeps claiming inside the render path); apps/api/app/backend/services/storyboard_service.py:2736 (PENDING_CLAIM_SECONDS), :3139-3191 (create_character_version and what a row is for), :3193-3221 (set_character_version_status, release_character_claim and why it is conditional), :3224-3247 (the two setters that fill a row after the fact), :3277-3293 (the guard's query), :3395-3397 (starting_points, which lists every parentless row whatever its status, so a claim is already visible in the picker while it is pending), :3735-3775 (adopt_saved_character's claim-then-copy, the one path that already claims before it acts), :3931-3954 (record_spend), and :27-40 with :232 (the module imports no image layer and owns StoryboardError, which is what decides where the refusal is raised); apps/api/app/backend/services/pipeline_runner.py:32-41 and :895-917 (the house shape for this: a namespace constant of its own, an advisory transaction lock, and the read and the write inside one transaction with a typed refusal); apps/api/app/backend/db.py:70-93 (get_conn and get_cursor: one connection committing on exit, which is what makes a transaction-scoped lock right here); apps/api/app/pipeline/storyboard_images.py:123-155 (_character_model_call, which lets the gateway refusals through as themselves), :363-455 (design_character), :526-599 (instruct_character); apps/api/app/backend/routes/video_storyboard.py:910-938 (_image_guard and its 502), :941-962, :1280-1292, :1322-1335 (the three routes); apps/api/app/backend/tests/test_character_claim_release.py:94-236 (the fake service the claim tests drive, which patches create_character_version and pending_character_version_count BY NAME), :237-260 (the four entry helpers) and :567-618 (how the real statement is pinned through a captured cursor); apps/api/app/backend/tests/core/test_background_queue_db.py:1-20 (the imports, threading included), :177-200 (a claim proven against the real database with a second thread) and :204-213 (_storyboard_session, the product and session rows a character claim needs); apps/api/app/backend/tests/core/conftest.py:100-141 (core_pg, the migrated container) and :158-186 (auth_env, which points app.backend.db at it); db/migrations/unified/production/001_baseline.sql:2239-2292 and :2562 (the character_slug column the guard scopes on); open item #88; S32's record.

Deliverables. (1) One atomic claim in storyboard_service: a function that in a single transaction takes pg_advisory_xact_lock on a namespace constant of its own and the session id, re-reads the pending count for that slug, and either inserts the pending row and returns its id or returns nothing. It BLOCKS rather than tries, because the lock is held only for the read and the insert and a waiter must be answered by the count rather than by the lock. It takes the same fields create_character_version takes, so a caller already holding them writes them at the claim and only a caller that does not fills them afterwards. It raises no image-layer error: that module imports none, and the operator's sentence stays where it is raised today. The lock is per session and the re-read is per slug, so two cast members still build at once while two presses at one member cannot both claim. No migration, no new column and no unique index. (2) _invent_character claims BEFORE svc.resolve_style and images.design_character and hands the claim to _render_character_sheet, so the second press is refused with the sentence and the type it is refused with today, raised in the runner through the existing guard helper, and never reaches the text call. (3) _render_character_sheet takes an optional claim. Handed one, it does NOT ask the guard at :1677 again, because the caller's own pending row would otherwise refuse the caller; handed none, it claims through the same function at the point where it creates a row today (:1733-1742), which is where that guard call goes. So the claim is the only place the question is asked, on either path. The row carries the sheet prompt, the identity lock, the identity and the wardrobe the page is about to be drawn with, written at the claim for a caller that has them and filled by one statement that touches the row only while it is still pending for a caller that does not, so redraw, tweak and rework are unchanged in what they write and when. (4) The release window starts at the claim, not at the render: a failure of the style read, the text call, the instruction, the reference fetch or the fill hands the claim back before the exception propagates, through S32's helper. A claim released before any render is REMOVED, conditionally in SQL on that id, the row still being pending and its r2_key still NULL, because the row describes nobody, holding no prompt, no identity and no picture, and starting_points would stand it in the picker as a sheet; a claim released from inside S32's existing window (:1753-1850) keeps S32's behaviour exactly, failed with the failure's own sentence, because that row does describe the person a render was attempted for. (5) refine_character claims after its two cheap refusals (:2003-2012) and after _current_version (:2014), and before _instruct_fields, and hands the claim to both renders; every exit that draws nothing releases it: the short circuit at :2022-2027, any raise from the instruction, and a failure of the tweak's reference fetch at :2040-2042. So a refinement that only moved the fields leaves no attempt behind. (6) _refuse_if_sheet_in_flight's docstring at :1615-1618 says where the question is asked now, which is once per path, at the claim. (7) Tests: a database-backed concurrency proof and unit cases over the fake service for every ordering above. (8) docs/ops/s36-acceptance.md with the measured before and after: what a second simultaneous press pays on main and what it pays on the branch, for build and for refine.

Interfaces. Exposes one claim function that every character path takes before it spends, and the rule that a claim is either filled or released and is never left blank. Consumes the existing guard and its sentence, PENDING_CLAIM_SECONDS, S32's release helper, and the advisory-lock pattern pipeline_runner already uses. No route, payload, schema or operator-facing sentence changes.

Acceptance. pytest against the real database, where core_pg and auth_env live: two threads pressing the build for one session and one slug leave exactly one pending row and one refusal carrying the guard's sentence, and the design text call is entered once, counted through a fake that increments under a lock; the same two threads on two different slugs both claim and both design; the same two threads through refine_character enter the instruction once and write the fields once. Each of those three cases fails on the base sources, the first and the third with two paid calls and the first with two rows. A text call that raises leaves pending_character_version_count at zero and no row at all for that attempt, and an immediate second press is answered on its merits; a gateway refusal raised from the text call keeps its own type and status through _image_guard, and a CharacterModelError still answers 502 with the provider's sentence. Over the fake service, whose patch map gains the claim function: a second build press never reaches images.design_character; a refine press that short circuits at _no_render_needed leaves no version row and no pending count; a refine whose instruction raises leaves neither; a tweak whose reference fetch raises leaves neither; redraw writes exactly what it writes today, one row with its prompt, its lock and its parent. Every case in test_character_claim_release.py still holds with its assertions unchanged, the settled row that is never rewritten included. The whole api tier green. Record docs/ops/s36-acceptance.md; open item #88 closed.

Out of scope. The 300-second claim window and the guard's sentence, both unchanged. The scene-frame path, which claims before it spends already. adopt_saved_character's claim-then-copy (storyboard_service.py:3735-3775), which claims before it acts and buys nothing. That a pending claim stands in the picker as a sheet while it is being drawn, which is today's behaviour and only lengthens by one text call. The supplied-sheet vision read (:850-872, :1206-1232): the reading is stored on the pool entry so a later build reuses it, but two simultaneous presses of the free ensure fan-out on a sheet nobody has read yet do both still pay for it. That is a cheaper call on a different path, and claiming there would put a lock on the one press every session makes; it is stated here rather than folded in and belongs in its own item. The route error contract, which is S33 and merged. Any web change, including whether the panel disables Build while one is in flight. Any schema change, any unique index, and putting the character build behind a job slot.

Waits on / Unblocks. Nothing: S32 and S33, whose release window and error boundary this card extends, have both merged / a cast pressed by several people at once, and any later work that puts another paid call on the character path.

Built as (PR #103 → main d1fd3c9, 2026-09-18). Code 1 review round → two must-fixes (a fill that missed still paid for the render; the claim windows and get_conn did not release on a BaseException) and one should, ruled no change (claim parity with every field of create_character_version: a claim is pending with no page and no outcome by definition, so it takes no status, no r2_key and no provider message, and it takes every descriptive field a caller holds); re-check → APPROVE. claim_character_version in storyboard_service takes pg_advisory_xact_lock on its own namespace constant and the session id, re-reads the per-slug pending count and inserts the pending row or refuses, in one transaction; it blocks rather than tries. fill_character_claim fills a claim only while it is still pending, and withdraw_character_claim removes one handed back before any render, only while it is pending with no r2_key. _refuse_if_sheet_in_flight keeps its name and now takes the claim and returns its id, so the question is asked once per path. Build claims before the style read and the design text call; tweak and rework claim after their two free refusals and _current_version, before the instruction; redraw claims at the render where the row was written before, and writes what it wrote. Every exit that draws nothing removes the claim: the style read, the text call, the instruction or the trait floor, the tweak's reference fetch, the read or the fill, and the refinement that moved only the fields. A fill that matches no row, because the row was settled or removed after the claim, stops before the render with the in-flight sentence and type and leaves that row as it stands. Inside the render window S32's failed settle is unchanged. Every window releases on any BaseException and re-raises the same object, and get_conn rolls back on any BaseException, so the helper ends its own transaction before the connection goes back to the pool (psycopg2's own hand-back rollback was the only thing that had closed it). Measured, two simultaneous presses at one character: on main 2 design calls, 2 renders, 2 rows and 2 spend rows with no refusal; on the branch 1 of each and 1 refusal with the guard's sentence; the same for rework with the instruction call and the field write. Tests: 69 cases over the fake service, 5 against Postgres with real threads (two builds at one character, two builds at two characters, two refinements, and through the route a paused guard answering 402 and a failed call answering 502 with the provider's sentence, each leaving no row and no claim) and 1 for get_conn; every one fails on the base sources, and five existing fakes gained the new statements with no assertion changed. Whole api tier 4441 passed / 11 skipped / 3 failed, the 3 being exactly ci-known-failures.txt; the PR's api job was the tier on the actual base after a rebase onto V42's merge. Record docs/ops/s36-acceptance.md; open item #88 closed.

V43 · One command type-checks the whole web app · V · S · S2-W0 · chore/v/v43-web-typecheck (surfaced while building V41 on 2026-09-18, pre-existing on main, open item #100; carded 2026-09-19)

Context. apps/web/tsconfig.json:1-12 is a solution file: "files": [] at :2 and two project references at :3-6, tsconfig.app.json and tsconfig.node.json. npx tsc --noEmit in apps/web reads that file and checks no file. Measured at main 16dd547 with the TypeScript apps/web installs (5.9.3): npx tsc --noEmit --listFilesOnly lists 0 files and exits 0, while npx tsc -p tsconfig.app.json --noEmit --listFilesOnly lists the 311 files under src (tsconfig.app.json:26, the tests included) and eslint-rules/control-set.d.ts, which src imports, and npx tsc -p tsconfig.node.json --noEmit --listFilesOnly lists vite.config.ts alone (tsconfig.node.json:25). On a scratch solution of the same shape holding one type error, tsc --noEmit exits 0, tsc -p <the project> --noEmit exits 2 and tsc -b exits 1, both naming the error; tsc -b --noEmit behaves as tsc -b, because both real projects already set "noEmit": true (tsconfig.app.json:14, tsconfig.node.json:15). One TypeScript file is in no project at all, apps/web/vitest.config.ts, so no command checks it today; checked once in a scratch project that extends tsconfig.node.json, it type-checks clean together with vite.config.ts. CI already type-checks the rest, through the build and never by name: package.json:8 is "build": "tsc -b && vite build", the web job runs it (.github/workflows/ci.yml:261-262), the e2e job builds the SPA (:728-732), and both images' SPA stage runs npm run build (apps/api/Dockerfile:10, infra/caddy/Dockerfile:10) under the image-frontend job (:836-855), as docs/CI.md:44 states. So a type error already fails CI, but it reads as a failed build, and no script is named for the check (package.json:6-12). The workos mirror already names its script typecheck (services/workos/service/package.json:14) and CI runs it by that name (ci.yml:362). Where the empty command is cited: in the card set, V41's and V42's acceptance text (skynet-task-specs.md:908, :918), both merged, with V41's Built-as noting the gap (:911), and the two import objects that carry them (appendix-b-import.json objects 158 and 159, keys V41 and V42); the builder briefs of 2026-09-16 for V35, V36 and V37; and four records in the repository whose types row is npx tsc --noEmit with exit 0 (docs/ops/v35-acceptance.md:236, v36-acceptance.md:243, v37-acceptance.md:445, v41-acceptance.md:202), each of which also ran npm run build on its next row, so the types those cards claimed clean were checked by the build's tsc -b. No open card cites it. The repository's own guidance steers away from it without naming a replacement: AGENTS.md:27 lists npm run lint && npm run build for apps/web; apps/web/src/README.md:30 says "use it, not tsc --noEmit" and in the same paragraph calls CI's lint non-blocking, which is stale (the step blocks, ci.yml:259-260, docs/CI.md:34); apps/api/CLAUDE.md:185-186 still names the imported path app/frontend. Two places spell out the build's current recipe and go stale when it changes: the comment above the image-frontend job (ci.yml:828, "runs tsc -b && vite build there") and docs/CI.md:44.

Read first. apps/web/tsconfig.json, apps/web/tsconfig.app.json, apps/web/tsconfig.node.json, apps/web/package.json:6-12 and apps/web/vitest.config.ts:1-20; .github/workflows/ci.yml:243-264 (the web job), :726-733 (the e2e job's build), :818-855 (image-frontend and why it exists) and :342-366 (the workos job's pnpm typecheck); apps/api/Dockerfile:1-12 and infra/caddy/Dockerfile:1-12; docs/CI.md:12, :24, :32-34 and :44; AGENTS.md:24-31; apps/web/src/README.md:28-31; apps/api/CLAUDE.md:180-190; docs/ops/v41-acceptance.md:198-210 and docs/ops/v39-acceptance.md:304-307 (the two records that name the gap); open item #100.

Deliverables. (1) apps/web/package.json gains "typecheck": "tsc -b", and build becomes npm run typecheck && vite build, so the type check the build runs and the one a card names are one definition; both Dockerfiles keep RUN npm run build and so keep checking types. (2) apps/web/tsconfig.node.json's include names vitest.config.ts beside vite.config.ts, so every tracked TypeScript file under apps/web sits in a project that tsc -b checks. (3) The web job runs npm run typecheck as its own step, named for types, after npm ci and before the build (ci.yml:258-262), so a type error fails a step that says so. (4) The repository names the web type check one way wherever it names it: AGENTS.md:27 lists npm run typecheck between lint and build; apps/web/src/README.md:30 names npm run typecheck in place of "not tsc --noEmit", and the same paragraph says CI's lint blocks; docs/CI.md:12 (the web row) lists the step, and :44 names the build's type check as npm run typecheck; the comment at ci.yml:828 describes the build as it now reads; apps/api/CLAUDE.md:185-186 points at apps/web and names the script. (5) Outside the repository, applied at merge with the card's own bookkeeping: V41's and V42's acceptance text (skynet-task-specs.md:908, :918) and their two import objects name npm run typecheck in place of npx tsc --noEmit, so no card in the set cites the empty command; their Built-as notes stay as the record of what was run. (6) docs/ops/v43-acceptance.md: what each command checks before and after (the file lists), the bite proofs below, and the new step's first run.

Interfaces. Exposes npm run typecheck in apps/web: the one type-check command, which every card names from this card on and which the build and both images run through npm run build. Consumes nothing new. Unchanged: both projects' compiler options, tsconfig.json, the lint, the test runner, the Dockerfiles and every source file.

Acceptance. cd apps/web && npm run typecheck exits 0 on the branch, and npx tsc -p tsconfig.node.json --noEmit --listFilesOnly lists vite.config.ts and vitest.config.ts. Bite proofs on scratch copies, recorded and never committed, each failing on the base sources for its own reason: on the base, npm run typecheck fails with a missing script; a type error put in a file under src/ leaves npx tsc --noEmit at exit 0 with no output (the solution file lists no files), while the branch's npm run typecheck fails naming the file and line; a type error put in vitest.config.ts leaves the base's npm run build passing its type stage (no project includes the file), while the branch's npm run typecheck and npm run build fail naming vitest.config.ts. npm run lint, npm run build and npm test green. The pull request edits ci.yml, so every job runs (docs/CI.md:24): its web job shows the new step green, and its image-frontend and e2e jobs are green, which is what says the images still build and still check types. rg -n "tsc --noEmit" AGENTS.md apps/web/src/README.md apps/api/CLAUDE.md docs/CI.md and rg -n "tsc -b && vite build" .github/workflows/ci.yml docs/CI.md return nothing. gitleaks detect --no-git --source . --config infra/secret-scan/gitleaks.toml --redact clean. Record docs/ops/v43-acceptance.md; open item #100 closed.

Out of scope. The compiler options of either project, and type-aware lint. e2e/, which has no tsconfig and whose specs Playwright runs without a type check: a real gap, and its own item. apps/web/eslint.config.js and apps/web/eslint-rules/*.js, which are JavaScript that the lint reads. The four records under docs/ops/ that list the empty command, which record what was run, and each of which ran the build as well. The builder briefs of 2026-09-16, which are dated dispatch notes. The workos mirror's own typecheck. The mention of the web's own tsc -b at apps/web/src/shell/production-routes.ts:4, which stays true. The card key in the comment at apps/web/vitest.config.ts:5 and the other keys in apps/web comments, which A35 sweeps.

Waits on / Unblocks. Nothing: every file it edits is on main. A4's pull request #83 edits ci.yml only outside the web job (its filter key, its spike-a4 job, a step in infra and the ci aggregate) and docs/CI.md only in the infra row and a new spike-a4 row, so the two merge in either order, with #83 re-run against main after this merges. A33 and A34 edit docs/CI.md only in its mirrors row. A35 edits .github/workflows/ci.yml, AGENTS.md and docs/CI.md too: the merge order puts this card first, and A35 is rebased after this card if this card merges first. That is a merge order, not a dependency: A35 waits only on A4. / Every later web card, which names one command that checks the code.

Built as (PR #108 → main 1bbf419, 2026-09-19). Code 1 review round → APPROVE; the record's follow-up, the first CI run's numbers, was confirmed. apps/web/package.json gains "typecheck": "tsc -b" and build becomes npm run typecheck && vite build, so the build runs the one check a card names; both Dockerfiles keep RUN npm run build. tsconfig.node.json's include names vitest.config.ts beside vite.config.ts, so every tracked TypeScript file under apps/web sits in a project that tsc -b checks. The web job runs a type-check step (npm run typecheck) after lint and before the build. AGENTS.md, apps/web/src/README.md, docs/CI.md, the comment on the image stage in ci.yml and apps/api/CLAUDE.md now name the check one way. Measured with --listFilesOnly: npx tsc --noEmit checks 0 files on main and on the branch, and npm run typecheck checks 314 (312 in the app project, 2 in the node project). Three bite proofs, each on its own scratch copy: a type error in src/lib/utils.ts passes npx tsc --noEmit on main and fails npm run typecheck on the branch; the same error in vitest.config.ts passes npm run build on main and fails npm run typecheck on the branch; and on the branch it fails npm run build before vite build starts. Lint, build and the whole web suite (120 files, 1057 tests) clean. The first CI run, 35457505373, was green: the type-check step 16 s, the web job 5 min 57 s, and e2e and both image-frontend legs passed. One deviation: the dev command beside the build command in apps/api/CLAUDE.md named the imported app/frontend path too, and it now reads cd ../web. Record docs/ops/v43-acceptance.md; open item #100 closed. Found and filed as open item #109: the check now runs three times in the web job (the step, the build and the gallery build), about 16 s each on the runner.

V44 · A web test that leaves an update outside act fails · V · M · S2-W0 · test/v/v44-act-environment (surfaced while challenging the card for open item #90 on 2026-09-18, open item #94; carded 2026-09-19)

Context. React warns "An update to X inside a test was not wrapped in act(...)" only while the global IS_REACT_ACT_ENVIRONMENT is true. In the installed react-dom 19.2.4 the flag is read only by isConcurrentActEnvironment (apps/web/node_modules/react-dom/cjs/react-dom-client.development.js:16322-16332), and that function has two callers, both warnings: a suspended resource that resolved outside act (:18598, message at :18601) and an update outside act (:18755, message at :18759). The function itself prints "The current testing environment is not configured to support act(...)" (:16330) when the flag is off while an act queue is open. So the flag changes no scheduling. It changes only what React reports. Testing Library 16.3.3 turns the flag on in @testing-library/react/dist/index.js:41-51 only when beforeAll and afterAll exist as globals, and it registers its own cleanup at :26-29 only when afterEach does. At main 16dd547, apps/web/vitest.config.ts:15-42 sets no globals, so vitest 4.1.11 puts none of its test APIs on the global object and both checks are false. apps/web/src/test/setup.ts:2-3 imports cleanup and afterEach and runs the cleanup by hand at :23-25, which is why the missing cleanup was noticed and the missing flag was not. Testing Library's own act (dist/act-compat.js:39-78) sets the flag true for the length of each call and then restores the previous value, which here is undefined. So in all 120 test files the suite runs today (119 under src and one under eslint-rules, vitest.config.ts:19; the item says 118), an update that a test leaves outside act renders later and nothing is printed. That is the defect class behind open items #81 (V37) and #90 (V41): a read that runs before the render it expects. V41's record leaves turning the flag on to this item (docs/ops/v41-acceptance.md:217-218). Measured for this card, lightly: a node probe with the installed React, react-dom and jsdom made one state update from a timer after an act-wrapped render, and printed nothing with the flag unset and one "An update to Counter inside a test was not wrapped in act(...)" with the flag true, with the same DOM both times. src/components/ui/copy-button.test.tsx (2 tests) and src/pages/products/ProductList.test.tsx (4 tests), each run alone as configured and with --globals, printed no act warning in any of the four runs. The library explains why: dist/pure.js:84-104 (asyncWrapper) sets the flag false for the length of every waitFor, findBy and user-event call, and drains with one setTimeout(0) before it restores the flag, so a read gated through those utilities raises nothing. The warning is for what escapes them: a timer or a promise that settles between two synchronous reads, or after the last one. The count across the suite has not been measured; it is this card's first measurement. There are two ways to turn the flag on, and this card takes the first. (a) setup.ts sets the flag, the way the library would. (b) globals: true goes into vitest.config.ts and the hand-written cleanup is removed. Option (b) changes more than the flag: it puts 19 names on the global object in every file (apps/web/node_modules/vitest/dist/chunks/constants.CPYnjOGj.js:16-36), although all 120 files already import what they use from vitest; it turns on the library's cleanup beside the hand-written one; and it makes the type check disagree with the runner, because apps/web/tsconfig.app.json:8 gives the whole of src (:26) only the vite/client types, so a test that forgot an import would run and then fail only tsc -b, and the fix for that, vitest/globals in those types, would also let page code name describe and vi. No other installed dependency looks for test globals, and Testing Library's fake-timer check (dist/pure.js:62-74) reads jest, which vitest does not define. Option (a) keeps the intent in the one file every test loads and stops the flag from depending on the library detecting a global again. Three things in the tree bear on a check that fails a test on the warning. First, 65 test files call vi.restoreAllMocks(), 64 of them inside a beforeEach and one inside an afterEach (src/components/ui/toast.test.tsx:8), which restores any vi.spyOn(console, 'error') a setup file installs. Second, src/components/ui/route-error.test.tsx:15-21 mutes console.error for every test in its file and src/components/ui/form-field.test.tsx:40 mutes it for one test, and a mock implementation never calls what sits beneath it, so no run-time guard can see a warning a blanket mute swallows. Third, src/shell/pages/creatives/CreativePage.test.tsx:234 and :286 spy on console.error with no implementation, pass everything through, and read the calls.

Read first. apps/web/vitest.config.ts:15-42 and apps/web/src/test/setup.ts:1-25. In apps/web/node_modules: @testing-library/react/dist/index.js:18-52 (the cleanup and act-environment hooks and the checks that guard them), @testing-library/react/dist/act-compat.js:33-78 (the setter and getter for the flag, and how act saves and restores it), @testing-library/react/dist/pure.js:62-119 (the fake-timer check, asyncWrapper, which turns the flag off for every wait and drains, and eventWrapper), react-dom/cjs/react-dom-client.development.js:16322-16332, :18592-18603 and :18754-18763, and vitest/dist/chunks/constants.CPYnjOGj.js:16-36. apps/web/tsconfig.app.json. The gate shapes the suite already uses: src/shell/pages/status/StatusPage.test.tsx:303-325 (advances inside act at :309, :311 and :319), src/components/ui/copy-button.test.tsx:29-44 (a waitFor on the asserted state, then an advance inside act) and src/shell/auth/LoginPage.test.tsx (V41's four gated advances at :163, :165, :239 and :307). The console spies: src/components/ui/route-error.test.tsx:13-21 with the test at :54-57 that asserts the boundary logs, src/components/ui/form-field.test.tsx:39-60, and src/shell/pages/creatives/CreativePage.test.tsx:228-245 and :278-290. src/test/controls.ts with src/test/controls.test.tsx (where a shared test helper lives and how it is proven). docs/ops/v37-acceptance.md:15-28 (the box, the six-process neighbour and the shape of a whole-suite run) and docs/ops/v41-acceptance.md. Open items #81, #90 and #94.

Deliverables. (1) apps/web/src/test/setup.ts turns React's act environment on for every test file, the way Testing Library does when it finds the globals (index.js:41-51): true before the file's first test, and the previous value restored after its last test, with beforeAll and afterAll imported from vitest as the file already imports afterEach. The global is declared with its type, so tsc -p tsconfig.app.json checks the assignment and sees no any. A comment above it says why the flag is set by hand: the suite runs without globals, the library sets the flag only when it finds them, and without the flag React is silent about an update outside act. The hand-written cleanup at :23-25 stays, and vitest.config.ts does not get globals. (2) The count comes first and is recorded before any fix. The whole web suite runs once with only deliverable (1) applied, and every act warning it prints is listed by file, test, component and message. The messages counted are the three React prints about act (:18759, :18601, :16330). The count on the base sources is recorded with its reason, not as a measurement: the two "not wrapped" messages need the flag on, so they cannot print; the "not configured" message could print from an act imported from react, and none is imported (the 27 files that import act take it from Testing Library, which sets the flag for the call). (3) Every warning in that count is fixed at its cause, in the test or in the page. In a test: the read waits for the state it asserts (findBy, waitFor, or an advance inside act in the shape of StatusPage.test.tsx:309), or the test awaits the work the page started before it ends. In a page: a page that updates state after it has nothing left to show stops doing so, and gets a test in its own file that fails on the base page. Nothing is silenced: no console.error mock that swallows the message, no onConsoleLog filter, no file that sets the flag back to false, no import from @testing-library/react/pure, and no RTL_SKIP_AUTO_CLEANUP. (4) From then on, an act warning fails the test that raised it, and the failure names the component and the message. The builder chooses the mechanism, and it holds through the three things the context names. A vi.restoreAllMocks() in any hook of any test file does not remove it. A test that expects a console error mutes only the message it expects, through one shared helper under src/test/ that forwards every other message to the guard and keeps the muted calls readable, and a check that runs in npm test refuses any other mute of console.error in a test file (a mock implementation on a console.error spy, or an assignment to console.error) and names its file and line. route-error.test.tsx and form-field.test.tsx:40 move to the helper, and route-error.test.tsx:54-57 still proves the boundary logs its error. A spy with no implementation, as in CreativePage.test.tsx, still passes messages through to the guard. A warning raised after a test's last statement but before its cleanup belongs to that test. (5) docs/ops/v44-acceptance.md: the reading of both libraries and why (a) and not (b); the count on the base sources and its reason, the count with the flag alone (per file and test), and the count on the branch (0); the cause and fix of each warning; the bite proofs; and the whole-suite runs.

Interfaces. Exposes one rule: every web test runs with React's act environment on, an act warning is a failing test, and a test that expects a console error mutes that message and nothing else through the shared helper. The tests of every later web card meet it from their first run. Consumes vitest's hooks, Testing Library's act, waitFor and findBy, and the gate shapes V37 and V41 use. Unchanged: vitest.config.ts, the per-test budget at :41, asyncUtilTimeout at setup.ts:21, the pool, and every test that raises no warning and mutes no console.

Acceptance. npm test in apps/web green. A test proves the flag is set inside a test body, outside any act and any wait: globalThis.IS_REACT_ACT_ENVIRONMENT is true; it fails on the base sources, where it reads undefined. A test proves the guard: a probe component whose state changes from a timer after its render, with no gate, is reported as an update outside act, and the report names the probe; it fails on the base sources, where React prints nothing and no report exists. A test proves the helper: a message it was told to expect is muted and readable, and an act warning raised under it is still reported and names the probe. The check that refuses a blanket mute fails on the base sources and names route-error.test.tsx:16 and form-field.test.tsx:40. Bite proofs on scratch copies, recorded and never committed: each fixed test with its fix reverted fails on the branch with the warning named, and passes in silence on the base; a scratch test that calls vi.restoreAllMocks() and then raises an update outside act still fails; a scratch test that mutes console.error with mockImplementation(() => {}) is refused by the check at its file and line. The whole web suite is green idle once, and then 3 of 3 beside the six-process neighbour of docs/ops/v37-acceptance.md:21-28. Each run's file and test counts, load average, wall time and act-warning count are recorded and not pinned. A warning that shows only under load is a finding under deliverable (3), not a reason to rerun. grep -rn "IS_REACT_ACT_ENVIRONMENT" apps/web/src shows only setup.ts and the proving tests. npm run lint, npx tsc -p tsconfig.app.json --noEmit and npm run build clean (npx tsc --noEmit checks no file in apps/web; see V43). The web job is green on the pull request, which runs npm test. No comment that the card adds names a card, an item or a phase. Record docs/ops/v44-acceptance.md; open item #94 closed.

Out of scope. globals: true and any other change to vitest.config.ts. Raising either budget. Tests that raise no warning and mute no console, including the 27 files that already import act from Testing Library. React development warnings that are not about act, such as a missing key, and all other console output except the two blanket mutes the guard needs narrowed. Mutes of console.warn or console.log. The e2e/ browser specs, which render no React test tree. The api tiers. Reopening V41's unexplained failure: if a warning in LoginPage.test.tsx bears on it, the record says so, and nothing more is done.

Waits on / Unblocks. Nothing: V37 and V41, whose gates this card generalises, have merged, and no open card edits setup.ts or the two muting test files / V45, which builds after this card by build order only and shares no file with it, so its tests run under the flag; V22 and V15, whose native Intelligence pages then have their tests written with the warning on and failing; and every later web card.

Built as (PR #109 → main 7083fd5, 2026-09-19). Code 1 review round → APPROVE, then the CI finding below. React's act environment is on for every web test file from setup.ts, a guard in front of console.error fails the test that raises an act warning, and a test that expects a console error mutes that message alone through one shared helper, muteConsoleError; an act warning is never muted whatever the patterns match, and a source check in npm test refuses any other mute of console.error in a test file. With the flag alone the suite printed 138 act warnings in 42 tests across 24 files, every one an update outside act. All 138 are fixed at their causes, and no page changed. The whole suite after the fix: 122 files, 1063 tests, all passed, 0 act warnings, 284 s. On the way it fixed a focus race in ImageLightbox.test.tsx that this card did not write: the dialog's popup hands the focus to the focus manager, which queues a microtask and then focuses the first reachable control inside an animation frame, so the test read the focus before the frame ran. A scratch run of the test's body at 61 animation-frame delays, 0 to 300 ms in steps of 5, failed 12 to 15 times of 61 as it was and 0 of 61 with the fix, on this branch and on main's setup alike; the same test failed the same way on A4's pull request, whose setup.ts has no flag, so the race is main's and not this card's. The test now waits for the focus. The merge commit's CI and the staging deploy were both green. Record docs/ops/v44-acceptance.md; open item #94 closed.

V45 · Every scroll box is classified, whatever sets its ceiling · V · M · S2-W0 · test/v/v45-style-and-layout-ceilings (surfaced while building V39 on 2026-09-18, open item #102; carded 2026-09-19)

Context. apps/web/src/test/scroll-regions.test.ts (V39, main 16dd547) parses every non-test .tsx under apps/web/src and finds a scroll box by its className alone (:77-80): a scroll utility (SCROLL, :32) together with a height ceiling (CEILING, :36). It holds what it finds to one reviewed inventory of 25 (:112-138, the count at :155), and its header says that a ceiling set by a style or by a parent's layout is not read (:17-19). Re-measured at 16dd547 with the sweep's own rules over the same 151 files: 46 elements carry a scroll utility. 25 carry a class ceiling, as V39 recorded. 2 carry only a min-h floor: components/ui/sheet.tsx:68 and pages/products/ProductMemory.tsx:122 (V39's card had them at :44 and :118). 19 carry no height utility. Two of the 19 set their ceiling in a style, at the lines the item gives. pages/video-storyboard/VideoStoryboardScreen.tsx:912 is the scene rail: overflow-y-auto with style={{ width: railWidth, maxHeight: 'calc(100vh - 16rem)' }} at :913, and a <button> per scene from :915. :973 is the focused scene: overflow-y-auto with style={{ maxHeight: 'calc(100vh - 16rem)' }} at :974, and the scene's own buttons from :1008. Both hold controls, so neither is a defect today. No other element under src sets height or maxHeight in a style next to a scroll utility, and none sets overflow in a style, so a sweep that also reads styles holds 27. Five elements pass a style the sweep cannot read as one object literal: components/video-storyboard/ImageLightbox.tsx:178 (a conditional of two object literals), components/video-storyboard/SavedCharacterThumb.tsx:39 and :47 (a local constant, :36) and components/video-storyboard/StoryboardImage.tsx:82 and :95 (a style prop passed through from its callers). None of them carries a scroll utility today, but a style held in a variable or a prop can carry an overflow or a ceiling that no reading of the element sees. Of the 19 with no ceiling of their own, 14 carry only overflow-x-auto, the family V39 measured and left out (docs/ops/v39-acceptance.md:418-440). An element whose overflow is not visible on one axis computes the other axis to auto (the sweep's own note at :29-31), so any of the 14 inside a bounded column would scroll up and down too. Five more scroll up and down, or would, with no ceiling of their own, and an ancestor decides whether they scroll. (i) The sheet body at sheet.tsx:68: min-h-0 flex-1 overflow-y-auto, inside the popup's flex h-full flex-col at :47, inside a fixed viewport at :43. V39 measured it at 8054 of 720 px on the Status page and answered with SheetBody (:9-22), a required prop with no default that each caller fills (components/creative-code/LineageSheet.tsx:27, shell/pages/status/StatusPage.tsx:133, shell/pages/DevGallery.tsx:177). (ii and iii) The bodies of the two document viewers, pages/system/SystemDocuments.tsx:374 and pages/products/ProductDocuments.tsx:677: flex-1 overflow-auto mt-2, bounded by the max-h-[90vh] flex flex-col of DialogContent at SystemDocuments.tsx:331 and ProductDocuments.tsx:634. V39 found them sound because the trigger of DocEditHistory is a tab stop (v39-acceptance.md:438-440). (iv) components/layout/AppLayout.tsx:10: <main className="flex-1 overflow-y-auto"> under the min-h-screen flex flex-col of shell/ShellLayout.tsx:36, which is a floor, so the main should grow with the page and leave the scrolling to the document. (v) ProductMemory.tsx:122: min-h-[700px] overflow-auto, which V39 measured growing to 17958 px and never scrolling up and down (v39-acceptance.md:345-346), but which is whitespace-pre-wrap, so one long unbroken token makes it scroll sideways while it holds only text (v39-acceptance.md:451-452). None of these 19 is in any inventory. So a third inline-style ceiling, a scroll or ceiling hidden in a style variable, or a new flex-1 overflow-y-auto or overflow-x-auto box in a bounded column, that holds only text would ship without a tab stop and without a failing test. Three comments state the old limit to the next author: sheet.tsx:19-21 and :62-67 say the sweep cannot see the sheet body, and components/ui/scroll-region.tsx:76-77 says every box with a class ceiling is listed "with which of the three it is". What the repo already has for a browser check: e2e/ holds Playwright 1.58.1 and @axe-core/playwright 4.13.0 over axe-core 4.13.0, whose scrollable-region-focusable rule carries the wcag2a tag. e2e/playwright.config.ts has two projects: chromium drives a whole running stack, and gallery (testMatch: '**/ui-gallery.spec.ts') drives a vite preview of a build made with VITE_UI_GALLERY=1, with no login and no api (e2e/ui-gallery.spec.ts:9-10), both at Playwright's Desktop Chrome viewport of 1280 by 720. CI's web job, filtered on apps/web/** and e2e/** (.github/workflows/ci.yml:92-99), builds, serves and runs the gallery project (:265-293), so a leg in ui-gallery.spec.ts is a browser check on every web pull request without a stack. The gallery already opens a Sheet (ui-gallery.spec.ts:67-76, the fixture at DevGallery.tsx:171-181, a controls body over the seven-row chain at :31-48), but no leg measures that a body scrolls. Axe reports scrollable-region-focusable only on a box that actually scrolls, and it reads the markup. V39's record found that Chromium makes a bare scroll container focusable by itself (v39-acceptance.md:366-371), so a keyboard probe in Chromium passes where axe fails, and a browser check measures that the box scrolls (scrollHeight above clientHeight, or scrollWidth above clientWidth) before it trusts axe's silence, and takes its verdict from axe, not from Tab. For page-level boxes, V39's re-check drove the built app under vite preview, answered every api call with page.route, and used no stack (v39-acceptance.md:378-386).

Read first. apps/web/src/test/scroll-regions.test.ts (whole file) and apps/web/eslint-rules/control-set.js (the control names the sweep imports). apps/web/src/components/ui/scroll-region.tsx (the named region and its rules, the inventory sentence at :76-77). apps/web/src/components/ui/sheet.tsx (whole file: SheetBody with its comment at :9-21, the popup, and the body with its comment at :62-67). apps/web/src/pages/video-storyboard/VideoStoryboardScreen.tsx:905-1010. apps/web/src/components/video-storyboard/ImageLightbox.tsx:170-185, SavedCharacterThumb.tsx:30-55 and StoryboardImage.tsx:30-100 (the styles the sweep cannot read as one literal). apps/web/src/pages/system/SystemDocuments.tsx:331-411 and apps/web/src/pages/products/ProductDocuments.tsx:634-718. apps/web/src/components/layout/AppLayout.tsx and apps/web/src/shell/ShellLayout.tsx:33-40. apps/web/src/pages/products/ProductMemory.tsx:108-126, with the comment at :118-121. apps/web/src/shell/pages/DevGallery.tsx:31-48 (the chain fixture) and :165-181 (the Sheet section), with apps/web/src/shell/gallery-route.test.tsx (the unit test that renders the whole gallery). e2e/ui-gallery.spec.ts (whole file), e2e/playwright.config.ts, and e2e/README.md:164 onward ("Two suites, two servers"). .github/workflows/ci.yml:92-99 and :243-305. docs/ops/v39-acceptance.md:305-410 (the browser check, the floors, what Chromium does by itself, the re-check) and :418-454 (the family V39 left out, and this item as V39 filed it). Open item #102.

Deliverables. (1) The sweep reads a ceiling and a scroll from an inline style the same way it reads them from the class string, in any mix of the two. A ceiling is a height, maxHeight, blockSize or maxBlockSize key whose value is not a content-sized keyword (auto, fit-content, min-content, max-content, none), whether the value is a number, a string, a calc() or an expression. A scroll is an overflow, overflowY, overflowX, overflowBlock or overflowInline of auto or scroll. A conditional or logical whose branches are object literals is read branch by branch. VideoStoryboardScreen.tsx:912 and :973 join the ceiling inventory as boxes that hold their own controls, with the controls named (a button per scene; the scene's own buttons), and the count becomes 27. (2) The sweep fails closed on a style it cannot read. Any element whose style is not an object literal or a conditional or logical of object literals (a variable, a prop, a call, a spread) is reported until a reviewed list in the same file names it and says where the value comes from and why it sets no scroll; the builder may instead resolve a same-file constant object literal, and must then prove that reading. Today that is the four sites SavedCharacterThumb.tsx:39 and :47 and StoryboardImage.tsx:82 and :95, or the two StoryboardImage sites alone if the constant is resolved. So moving a style into a constant or a prop cannot take a box out of the sweep. (3) Every element with a scroll (class or style) and no ceiling of its own is held to a second reviewed inventory in the same file: 19 entries today, in source order per file. Each entry says one of four things. grows with its content names the floor or the container that lets it grow (AppLayout.tsx:10, ProductMemory.tsx:122), and says which axis it claims. bounded by the layout names the ancestor that sets the ceiling, and then classifies what the box holds exactly as for a ceilinged box (the two document viewers' bodies, which hold their own controls). its caller says what it holds is for a component whose props require that statement and have no default (the sheet body, through SheetBody). the horizontal family names what the box wraps (a table, a code block) and covers the 14 sideways boxes, whose height follows their content. After this, every element with a scroll is in exactly one inventory (46 today), and a new scroll box anywhere in the tree fails the sweep until somebody classifies it, whatever sets its ceiling. (4) The rule is written where the next author meets it. The sweep's header, in place of :17-19, states the two inventories, the unreadable-style rule, and that the browser checks below prove the layout entries' claims. The comments at sheet.tsx:19-21 and :62-67 and at scroll-region.tsx:76-77 are changed to say what is now true. The comment at ProductMemory.tsx:118-121 is kept if it is still true, or corrected. (5) A committed browser check where no stack is needed. The gallery gets a Sheet whose body is text declared as a region, with content taller than the viewport, and its controls fixture gets content taller than the viewport. e2e/ui-gallery.spec.ts gets a leg that opens each sheet, measures that the body scrolls, runs axe with the spec's tags (:20) and finds no violation, and finds the text body by its role and name with tabindex="0". The measurement comes before the axe run, so the leg cannot pass on a body that stopped scrolling. (6) A browser check that is run once and recorded, never a per-push test, for the page-level entries, in the method of V39's re-check: the branch's build under vite preview, every api call answered by page.route, no stack, at 1280 by 720. Each document viewer opened on a long document, and each storyboard box with enough scenes and frames to pass its ceiling, is measured scrolling, with axe clean. AppLayout's <main> under a page far taller than the viewport, and ProductMemory's box with 300 lines, are measured not scrolling up and down (scrollHeight equal to clientHeight). ProductMemory's box is also driven with one unbroken token wider than the box and measured on the sideways axis. If the check finds a box that scrolls where its entry says it grows, or that holds only text where its entry says controls, the page is fixed and gets a test in its own file that fails on the base page. The box is not reclassified to make the check pass. (7) docs/ops/v45-acceptance.md: the counts before and after, both rules, the two browser checks with the heights, widths and verdict of every box, the bite proofs, and the horizontal family named as listed and not proven, with open item #105 named as where it is fixed.

Interfaces. Exposes the second inventory and the unreadable-style list beside the ceiling inventory in scroll-regions.test.ts, which every later scroll box joins whatever sets its ceiling. Also exposes a gallery leg that proves a layout-bounded body scrolls and passes axe, which every later shared component with such a body copies. Consumes ScrollRegion, SheetBody, the control set, the gallery build and its CI step, and @axe-core/playwright, all of which are in the tree. No page's markup changes unless the one-off check finds that an entry's claim is false.

Acceptance. npm test in apps/web green, with the sweep passing over the real tree at 27 ceilinged boxes and 19 entries in the second inventory, 46 in all. Run with the base file's inventory of 25 and no second inventory, the new sweep fails and names VideoStoryboardScreen.tsx:912, :973 and the 19 boxes with no ceiling of their own, and run with no unreadable-style list it fails and names the unreadable sites, which shows it reads the tree and not a list. Bite proofs on scratch copies of the tree, recorded and never committed. Each of these fails on the branch and passes on the base: a new <div className="overflow-y-auto" style={{ maxHeight: 200 }}> holding text; a new <div style={{ overflowY: 'auto', maxHeight: 200 }}> holding text; a new <div className="min-h-0 flex-1 overflow-y-auto"> holding text; a new <pre className="overflow-x-auto"> holding text; a new element with no scroll utility whose style is a variable; a new element with a scroll utility whose style is a prop. On the branch alone, removing any one classification from either inventory or the list fails. The sweep's own unit test reads a style ceiling written as a number, as a string and as a calc(), reads height: 'auto' as no ceiling, reads both branches of a conditional style, and reads both mixes: a style scroll with a class ceiling, and a class scroll with a style ceiling. npm run test:gallery in e2e green against a preview of the branch's gallery build. The new leg fails on two scratch copies, each for its own reason: with the text fixture's body declared controls, axe reports scrollable-region-focusable; with the text fixture's content cut to one line, the scroll measurement fails before axe runs. The existing whole-page axe leg, the sheet focus leg and gallery-route.test.tsx still pass. The one-off page-level check is in the record as deliverable (6) states it. npm run lint, npx tsc -p tsconfig.app.json --noEmit, npm run build and VITE_UI_GALLERY=1 npm run build clean (npx tsc --noEmit checks no file here; see V43). The web job is green on the pull request, which is where the sweep and the gallery leg run on every push. No comment that the card adds names a card, an item or a phase. Record docs/ops/v45-acceptance.md; open item #102 closed.

Out of scope. Fixing the horizontal family, which is open item #105 and not a condition of this card's acceptance: whether each of the 14 scrolls sideways depends on content width at a viewport. This card lists them so a new one is seen, proves nothing about them, and changes none of them. Changing any box whose claim the browser confirms, including the two storyboard boxes, which hold buttons and take no ScrollRegion. A crawl of every route for scroll boxes, and new legs in the stack-driven chromium project. An eslint rule, for the reason V39 recorded: whether a box is sound depends on what it renders. The shape of SheetBody and its callers. The act environment in the web suite (V44) and card keys in comments (A35).

Waits on / Unblocks. Nothing: V39's sweep, ScrollRegion and SheetBody are on main at 16dd547, and no open card edits scroll-regions.test.ts, DevGallery.tsx or ui-gallery.spec.ts; V44 builds first where both are open, so this card's tests run under the act flag, and whichever merges second re-runs its checks on the first one's merge / V22 and V15, whose native Intelligence pages add scroll boxes that the sweep then holds from their first commit whatever sets their ceiling, and every later shared component whose body takes its ceiling from the layout.

Built as (PR #117 → main e94c298, 2026-09-20). The scroll sweep in apps/web/src/test/scroll-regions.test.ts now reads a ceiling and a scroll from an inline style as well as from the class string, holds every element that can scroll in one of two reviewed inventories, and reports any style it cannot read until a third list accounts for it. A style written as a conditional or a logical is read branch by branch, and everything the file cannot resolve fails closed, so moving a style into a variable or a prop cannot take a box out of the sweep. Over the same 151 non-test files the sweep sees 46 scrolling elements against 25 on the base: 27 with a ceiling of their own, 19 with none, and 4 styles it cannot read, each named with where its value comes from and why it sets no scroll. A hole in the logical reader was found and closed during the build: it read only the right operand of a ||, so a name on the left went through, and the seventh bite proof is that hole before the fix and after it. Six other bite proofs fail on the branch and pass on the base, and three scratch runs prove the sweep reads the tree and not a list. A new gallery leg proves in a browser that a sheet body bounded by the layout scrolls and that axe is silent on it, and a one-off browser run measured every page-level entry of the second inventory against the claim it makes. The gallery suite passed 5 of 5, and lint, both type checks, both builds and the secret scan were clean. Record docs/ops/v45-acceptance.md; open item #102 closed. The fourteen sideways boxes are listed and not proven here, which is open item #105.

V46 · The cast and the Build button share the built rule; the frame gate gives its own readiness reason · V · M · S2-W0 · fix/v/v46-shared-built-rule (surfaced while building V42 on 2026-09-18, pre-existing on main, open item #96; carded 2026-09-19)

Context. Two questions are asked about a character. Built: is there a character to edit, which the cast chips and the Build button answer. Ready: can it be drawn into a scene now, which the frame gate answers, and more strictly. Three readers on the web answer the first from the identity lock alone, against the rule the panel states for itself, and the server's whole-board frame gate, which asks the second, gives every character it refuses a reason that belongs to the first. Measured at main 16dd547, which is after S36 (PR #103) moved the build's claim. isBuilt (apps/web/src/components/video-storyboard/CharacterPanel.tsx:63-76, the item's :66-76) counts a character as built when it is not skipped and has a sheet (r2_key), a lock or any identity field, and its comment says why the lock alone is wrong: a build from a page that could not be read comes back with an empty lock. That state is real: _save_supplied (apps/api/app/backend/services/storyboard_image_runner.py:617-690) stores the sheet's key with whatever lock the read returned (:663-666). The panel uses the rule in four places (the editor's exists at :910, and the three view guards at :2086, :2110, :2146). Three readers do not: the cast chip's unbuilt={!recordFor(m.slug)?.identity_lock} (CharacterPanel.tsx:2003, was :2013), which CastChip draws italic (CastChip.tsx:39, :63); unbuiltMembers (apps/web/src/pages/video-storyboard/VideoStoryboardScreen.tsx:115-120, the filter at :118), which plans the fan-out and counts the button; and buildEveryone's first check, if (!character?.identity_lock) (:480), with the count's primary term at :517-518 (was :517). So a character whose page could not be read opens in the editor as built while its chip is italic, the button counts it (:528-532: "Build 1 character", never "All characters built"), and pressing it sends that character again. The item left one question open, whether that press spends. It does not, read from the code. The fan-out never forces: buildCharacter(slug, false, false) at :493-494 and :501, and buildCharacter() at :481 with force = false by default (:313), which the client sends as ?force=false (apps/web/src/lib/videoStoryboardApi.ts:1421-1424), and the route (apps/api/app/backend/routes/video_storyboard.py:941-962) calls ensure_character(force=False). For a member, ensure_character takes the member path (storyboard_image_runner.py:1396-1400), ensure_cast returns the stored roster at once (:161-163), and ensure_cast_member returns the stored record untouched whenever it is non-empty (:1264-1266), which a sheet with an empty lock is; the function's two paid exits, the supplied-sheet read at :1279 (a vision call at :1230 when the pool entry holds no reading) and _invent_character at :1281 (S36's claim at :1319, a text call at :1334, then a render), both come after that return. For the primary, svc.get_character returns the stored record (storyboard_service.py:4852-4861) and :1402-1404 returns it before ensure_cast, the mode switch or either paid path. A skipped primary is the same: the none-mode write (storyboard_image_runner.py:1456-1459) is a stored record, so its press returns it too. So the press is a wasted request and its reads, a chip and a count that disagree with the editor, and a button that stays enabled and does nothing; it is not a spend. Nothing pins that at the state that matters: the leave-alone test (apps/api/app/backend/tests/test_video_storyboard_e2e.py:1890-1917) covers a primary with a full lock only, and V42's six route tests (CharacterPanel.test.tsx:286-324) cover an unbuilt and a fully built character, never a sheet with an empty lock. The frame gate is right to be stricter, and wrong in what it says. The generate-all preflight (storyboard_image_runner.py:2892-2951) refuses a character that has no record, is skipped, or has no lock (:2930-2931), so it refuses characters that isBuilt counts as built: a sheet with an empty lock, and identity fields with no lock. That stricter refusal stays: which characters the frame gate refuses is not this card's question. But it tells every refused character that it "has not been built yet" and to build it first (:2933-2943), which sends the operator to the fix that works only for a character with no record. For a character whose page could not be read, the per-scene gate already gives the true reason, too little description, fill it in on the character panel (_require_cast_ready, :2698-2704, through character_identity.blocking_reason, apps/api/app/pipeline/character_identity.py:817-849, which answers "it has no identity lock at all." for a record with no identity and no lock), and for a skipped primary it says the session has no character (:2683-2688); but the preflight speaks first (routes/video_storyboard.py:2833), so the operator is sent to a Build button that, for both states, does nothing. One state is refused by the preflight and passed by blocking_reason: a record with identity fields at or above the floor (MIN_TRAITS, character_identity.py:250) and an empty lock. What makes that character ready is saving its fields on the character panel, which derives the lock from them (update_character_text, apps/api/app/backend/services/storyboard_service.py:4792-4808), not a Build press, which returns it untouched. No writer leaves that state today, because every writer derives the lock from the identity (apps/api/app/pipeline/storyboard_images.py:686, :747), but the preflight still refuses it, and with the not-built sentence.