feat(session): persist created sessions and rebaseline shipped truth - #100
feat(session): persist created sessions and rebaseline shipped truth#100cursor[bot] wants to merge 7 commits into
Conversation
Record protected-main a763735 so item-delivery, response/result snapshots, deterministic narrative fallback, dual-proof account linking, data-rights processing-start, scoring-dispatch persist, and inbox claim-expiry are no longer described as Target or later-than-baseline history. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Store participant, release, version, digest, locale, created state, and creation time. Exact replay is idempotent; rebinding any stored field or inserting a non-created session fails closed under READ COMMITTED. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Health PRs already claim migrations/0020_backlog_health_indexes.sql and 0021_scoring_job_health_indexes.sql. Keep created-session persistence on 0022 so directory-order recovery and the product apply APIs do not collide when those heads integrate. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
There was a problem hiding this comment.
Verdict
Do not merge draft #100 at b982c73. The persist slice is a competing writer. The shipped-truth rebaseline is the unique work and should land without a session table.
What is sound
- TRACEABILITY / AS_BUILT_SCHEMA / DOCUMENTATION_ASSESSMENT now name exact protected-main
a7637351. That is the correct successor to #96, which still evaluates62524a3e/085ef4bafter merging current main. - Shipped persist and narrative claims match the tree: item-delivery (#48), response snapshot (#55), result snapshot (#51), deterministic narrative (#73), dual-proof account link (#85), data-rights processing-start (#76), scoring-dispatch (#68), inbox claim-expiry (#81), scoring-job retry/cancel/expiry on
postgres_scoring_job.rs. - Created-only insert,
ON CONFLICT DO NOTHING, READ COMMITTED classify, and fail-closed rebinding of participant / release / version / digest / locale / state /created_atare internally consistent. - Recovery fixture now seeds
claim_deadline_atso a processingintegration_consumptionrow survives COPY restore under the #81 UPDATE-only deadline trigger. Protected main still omits that seed. - Renumbering
0020→0022avoids the health-index filenames claimed by #82 / #113. It does not make this the session landing vehicle.
Why this head must not land
- Prefer #125 for session durability. #125 already persists created identity at
migrations/0014_assessment_session.sql, loads it without re-checking publication, and replaysmigrations/0016_assessment_session_command.sqlso Activate / Pause / Resume survive restart. Landing #100 first would ship Created-only rows with no load path. A purchaser still loses the session on process restart. 0022is a third numbering scheme. #61 / #106 / #109 / #125 occupy the existing0014gap between0012and0015. Reserving0022for unmerged health indexes creates a colliding physical history if both families integrate.- Do not couple the rebaseline to persist. #96 should close after a TRACEABILITY-only successor lands. #100 should close or retarget after that split. Do not land #61, persist-only #106, load-only #109, or coverage-only #121 over #125.
Next buyer action
- Review and land #125 for session persist + load + command history.
- Land a TRACEABILITY / recovery-fixture rebaseline that does not add
assessment_session. - Keep HTTP session-start behind #87 (RFC 9457) plus a loaded session.
- Do not self-approve. Do not merge until exact-head checks and an independent last-push approval exist.
Sent by Cursor Automation: Fix Issues
| @@ -0,0 +1,66 @@ | |||
| CREATE TABLE IF NOT EXISTS assessment_session ( | |||
There was a problem hiding this comment.
Do not land this table from #100. The session persist lineage already uses migrations/0014_assessment_session.sql on #106 / #109 / #125. #125 is the landing vehicle because it also loads Created identity without accepts_new_sessions() and persists command history so Activate survives restart.
0022 only avoids unmerged health-index filenames. It does not justify a third physical history. Close or retarget this persist slice after #125.
| use std::fmt::{Display, Formatter}; | ||
|
|
||
| const ASSESSMENT_SESSION_MIGRATION: &str = | ||
| include_str!("../migrations/0022_assessment_session.sql"); |
There was a problem hiding this comment.
This adapter includes 0022 and persist-only Created rows. A purchaser still cannot resume after restart: there is no from_persisted_created / load_assessment_session, and later states are rejected.
Keep this file off the TRACEABILITY rebaseline. Use #125 (0014 + 0016 + load + command replay) as the session writer.
| ### Active implementation work that is not protected-main truth | ||
|
|
||
| **Active PR** #76 data-rights processing-start persistence is not protected-main truth until an unchanged reviewed/check-clean head is integrated. Identity-verified requests persist an immutable operation identity and processing-start time under `FOR UPDATE` so later lifecycle composition cannot race the classified row. Dependent-system execution remains outside this slice. | ||
| **Active PR** remaining PostgreSQL persist and operator-health HTTP slices are not protected-main truth until unchanged reviewed/check-clean heads are integrated. This baseline records item-delivery ledger persistence (#48), immutable response snapshots (#55), immutable result snapshots (#51), deterministic narrative fallback (#73), dual-proof account linking (#85), data-rights processing-start (#76), atomic scoring-dispatch persist (#68), inbox claim-expiry fencing (#81), and recovery invariants (#72). Created assessment-session persistence on this branch (`migrations/0022_assessment_session.sql`, after health-index `0020`/`0021`), plus identity-link history, response-event, research-release, data-rights completion, and HTTP health-probe work, remain Active PR only. |
There was a problem hiding this comment.
The a7637351 rebaseline is the unique value of this PR and should not mention migrations/0022_assessment_session.sql or “this branch.” Split it: ship the named-SHA module/migration map without a session table, and leave created-session persistence as Active PR on #125.
|
|
||
| The slice does **not** persist publication-event history, bound scientific evidence records, HTTP publication transport, or session-creation integration. Those remain Target unless separately evidenced on protected main. | ||
|
|
||
| ## Active PR assessment-session physical schema |
There was a problem hiding this comment.
Drop this Active PR session section from the shipped-truth rebaseline. Protected-main as-built evidence should not carry a competing 0022 pointer while #125 already documents 0014 / 0016.
|
|
||
| ### Added | ||
| - Traceability and as-built schema rebaseline to protected-main `a7637351`, recording item-delivery ledger persistence (#48), immutable response snapshots (#55), immutable result snapshots (#51), deterministic narrative fallback (#73), dual-proof account linking (#85), data-rights processing-start (#76), atomic scoring-dispatch persist (#68), inbox claim-expiry fencing (#81), and recovery invariants (#72). Remaining session, identity-link, response-event, research, data-rights-completion persist and operator-health HTTP stay Active PR, not shipped truth. | ||
| - PostgreSQL persistence for created assessment sessions bound to one published locale-specific release: exact replay is idempotent, and rebinding participant, release, version, digest, locale, state, or creation time fails closed. The physical file is `migrations/0022_assessment_session.sql` so it does not collide with health-index `0020`/`0021`. |


Superseded / split into bounded landing lanes
Close this competing mixed-scope draft without merge. Its three useful concerns now have separate bounded vehicles, while its
0022_assessment_session.sqlline is explicitly rejected by current review.Fresh evidence immediately before closure:
b982c73ad0a63992e08be639ac6bc35e886ae50040a7dad17be5afbf6514976bfb554fbceec5a8e18a0db4611a684285185f9edadf086a1808444ab9c7b45145c9b693951fae498e0779d58cbe170f86, carrying the repaired fix(session): replay exact persist after first-insert seal miss #218 persist/load/command-history/start-lock linemain:a7637351be8f0f90c12651d3bcafd959bc52ac81Current #100 review identifies five unresolved reasons not to land this head: it introduces a third/colliding session migration history, persists Created-only rows without a restart load path, couples protected-main TRACEABILITY rebaseline to unmerged persistence, advertises that competing table in the as-built map/changelog, and should keep the recovery deadline repair separate.
Those concerns are now separated:
a7637351shipped-truth rebaseline and explicitly forbids a session table on that branch;claim_deadline_atCOPY/restore acceptance without coupling it to session persistence;Leave #100's review threads unresolved because they are still valid on this exact head and explain the closure. None of the successor behavior is protected-main truth until its own unchanged exact head passes live gates and required independent review.