State

Lifecycle: build

This file records current state only. Remove an item when it is resolved. Git keeps the history.

Current

Production uses the legacy PHP application. Production replacement is not authorized or rehearsed. The legacy source is in the vektorprogrammet repository; the former apps/server continues there as branch modernize/mono-web-server (908368a8), with the same tree (023b85bd) as mono-web b6438cb2. The removal commit is ea124143; its parent 1277be8b still contains apps/server. Local implementation and acceptance do not authorize production, provider, or source-data actions.

The stable Effect upgrade follows its frozen contract. Local acceptance remains pending. The canonical worktree excludes unpublished dashboard Root and Worker feature sources. Historical RC proof results do not establish stable acceptance. The HTTP union patch and native queue extensions remain necessary. Their stable ports are not retirements. The approved native SQL change uses separate scoped Database and Better Auth pools. SQL migration, cancellation, and cleanup proofs remain gates. The compiler artifact manifest records the actual consumed source and archive hashes. A package build does not establish installed-consumer acceptance. Fresh committed-source checks, generated contracts, native UI/API/PostgreSQL journeys, and the immutable lift snapshot remain required.

Recruitment migration 0029 has operator approval reported by the director; exact words not preserved. This is not verified direct operator approval. Effx commit b88523d2a8ffcbde5c19008d649da653c26ee475 records the report under docs/specs/0029-recruitment-migration.md. The current phase is LOCAL implemented, not accepted. The source descends from the accepted Admissions integration 815a28f8. Canonical declarations cover sixteen Recruitment operations and two Recruitment-owned onboarding operations. The project IR contains 74 operations across eleven generated groups. The complete external native contract retains 111 operations. These eleven groups do not represent every external API group.

Identity owns the handwritten onboarding claim. One mixed onboarding root requires typed claim completion after the generated handlers register readBoard and command. The four Foldkit programs retain handwritten Command bodies over the generated SDK, directly or through the existing bridges. The AOT contracts and raw-handler types do not replace domain authority, transaction locks, receipts, or delivery ownership. The system and architecture documents describe the implemented validator, correction, frozen-outcome, and dialog policies.

The third and final original full R2 diagnostic failed with ProfileContactNotFound during ReadBoard. The unchanged mapper returned recruitment.unavailable/503. The original 30-second button assertion remained red after eighteen correction stages. The diagnostic did not record the missing runtime Person identity. Source establishes an incomplete Returning fixture, not runtime Person attribution.

The local Returning fixture repair seeds the declared primary interviewer's synthetic contact before the appointment in one transaction. Fixture completeness grants no business authority and permits no production fallback or change to the missing-contact refusal. The third diagnostic remains separate, red evidence; it does not identify a missing runtime Person.

The original full R2 regression on 66d2baee91d515d6c0787d6ec4aef85ba2c23e57 reached seven outer gates and nineteen completed stages, then failed. The unchanged tools/acceptance/recommendation-check.ts:3600 assertion required focus on the current Reopen action within 5,000 ms. Close returned 200 and staffing refreshed to Closed, but Reopen remained inactive. This is not migration acceptance or observed Chrome causality. The operator approved a permanent native workflow-focus repair for this next-action transition. It does not reuse the Close opener as Reopen. Ordinary Cancel/Escape retain native opener restoration. The system and architecture documents define the approved ownership and correlation policy.

On source 66d2baee, the native 39-case suite, canonical/parity checks, full check (16/16 tasks), and full test (21/21 tasks) passed. These results and every original 28-row result on that source are historical, source-specific evidence only. Collector omissions and repeats remain explicit external evidence incidents, not product failures.

The original full R2 remains a required regression confirmation, not a fourth diagnostic or a target-only substitute. Its original actions, filters, selectors, 5/30-second click waits, and 5,000-ms focus assertions remain gates. Window privacy, 403 denials, exact no-write snapshots, corrections, mail, and frozen outcome citations remain unchanged.

Acceptance requires a new clean final candidate after workflow-focus, permanent tests, and documentation integration:

• New executions of all 28 original acceptance rows, including the complete original R2 journey.
• The full 39-case HTTP regression suite, canonical contract/handler parity, and serial just check --concurrency=1 and just test --concurrency=1.
• The mounted production workflow and its full permanent focused tests: failure, release, ordinary cancellation, interruption, stale identity, replacement, real navigation, and disposal.
• A held native Close must block replacement open/focus until its actual completion and any pending focus-cancellation completion. Late old-generation completions and duplicate save responses must not arm focus or change a replacement dialog.
• Before/after custody of the exact consumed source, served bundles/runtime, and each job's own environment.
• Source conditions, runners, and build manifests decide which emitted or materialized artifacts each gate consumes.
• A missing SDK dist, OpenAPI binary, or environment inventory is a gap only when evidence proves that the gate consumes it. Labels alone prove neither consumption nor nonconsumption.
• The homepage's existing build stamp is consumed evidence only. The dashboard embeds no Git HEAD stamp; a new dashboard stamp is not a gate.
• All 195 completed outcomes from the existing persistent authority-model run and byte equality with its model source.

All final-candidate gates run after integration and the new clean source freeze. Earlier focused or historical results cannot replace them. The two baseline and seven prototype HappyDOM tests establish a native mechanism only, not Chrome acceptance.

The single proc://recruitment-authority-model-195 run remains active. Whole-model acceptance and its completed outcomes remain pending. The actual Authority and contexts bytes match source 66d2baee; final-candidate byte equality remains a gate. The model source digest is ca4460362b618320f0c6a200e98be8dc0692ee37f0b1113d94cf0d5c7fc8d4e7. /srv/share/projects/effx-recruitment-0029-evidence/final66-model195-input-and-expected-obligations.json records both actual input hashes and expected obligations. Partial progress does not establish SAT instance counts or completed obligations. The existing run must not receive signals or restart. Migrations 0083–0085 remain registered. Migration 0085 neither rounds nor rewrites historical instants. Historical repaired-baseline and prerequisite results remain external evidence, not final-source acceptance. Evidence stays in /srv/share/projects/effx-recruitment-0029-evidence/. The final manifest and operator approval receipt stay outside the repository. Acceptance requires no evidence-only commit after the source freeze. No generated Recruitment/onboarding cutover is accepted. The operator’s direct instruction was: “Forgoe the heavy job slot in place of checking the machine status for what resources are taken” (2026-10-04, history://Main:253-255). The director supplied the admission procedure: two readings 10 seconds apart, load below nproc, MemAvailable at least 25% of RAM, and no swap growth. Retain top RSS/CPU processes and heavy-job attribution beside each job’s evidence. If admission fails, wait 60 seconds and repeat. After 15 minutes, report the resource holders. Admit each heavy job from its retained resource observations. Measured lead execution skips obsolete exclusive-flock admission under that quoted instruction, without claiming lock ownership. The director dropped the provisional IO-PSI gate after the operator reported a monitoring bug. Admission uses only load, available memory and swap growth. For a suite timeout, retain NVMe io_ticks and elapsed time around the run to distinguish actual disk saturation from a code failure. Staged-only formatting/lint hooks are light work. The existing owned Alloy run stays running.

The director accepted the nine-group re-vendor prerequisite at ac51f9aa for LOCAL implementation only. The installed compiler supports typed completion of the mixed onboarding group. A missing claim remains a compile error. The native recipe generates contracts before handlers, without a root shim or generated-output edit. Prior-group byte identity, the repaired OpenAPI semantics, and SDK parity remain final-source gates. Delivery tests own their migrated database and native queue scope. An Idle result does not establish fixture isolation. Earlier prerequisite receipts and repair chronology remain outside the product tree. They do not establish final acceptance. The retained source-66d2baee aggregate receipt records historical canonical/parity, HTTP39, maintenance, check, and test results. It remains separate from the new final candidate and its required original acceptance rows. The record is /srv/share/projects/effx-recruitment-0029-evidence/final66-aggregate-BeIa6C-receipt.json. Unmerged worktrees remain retained. Cleanup requires a proven merge or explicit disposal authority. The credential-exposure incident is held separately. Raw installer evidence remains private and unpublished; token revocation is recommended but awaits the operator’s decision. No credential or transcript changes are authorized. Stopping verbose installs is the director’s containment order, not a quoted operator instruction. No mono-web main merge, push, publication, provider, or production-cutover authority is granted. Retirement trigger: after Identity migrates claim, the complete generated group replaces the transitional handwritten completion. The retained mixed-onboarding probe is outside the product tree in /srv/share/projects/effx-recruitment-0029-evidence/compiler/mixed-onboarding/.

Attribution correction (2026-10-04)

Earlier Recruitment state and evidence labels credited director decisions to the operator. The continuation, re-vendor conditions and later R2 confirmation came from the director through agent://Main. Rulings 1–7 retain the distinct label: “operator approval reported by the director; exact words not preserved”. Their direct approval is not verified. The operator’s resource instruction is quoted in this record, while its numeric admission thresholds came from the director. Earlier commits and raw evidence remain unchanged. The dated evidence correction at /srv/share/projects/effx-recruitment-0029-evidence/attribution-correction-2026-10-04.md records those distinctions without altering test results or product behavior.

Operator decisions:

• The backend is a portable Bun process with PostgreSQL, not a Cloudflare Worker.
• DigitalOcean is the selected host (2026-09-25). Provisioning and deployment stay deferred until cutover preparation.
• No cloud provisioning or source-data upload is authorized.
• The private 2024-08-22 legacy backup is the working source for import rehearsals. Its schema shape is expected to match current production. Its contents are historical, not current.
• The native target is PostgreSQL 17 or 18 (default 18); hosted Supabase runs 17 (operator decision, 2026-09-25). The root manifest declares the set once as engines.postgresql; VEKTOR_POSTGRES_MAJOR selects a major per environment.
• main is pushed to origin (2026-09-25), so hosted CI runs. The SDK is not published (operator decision, 2026-09-25). @vektorprogrammet/sdk is private; the Release SDK workflow and Changesets are removed.
• Migrations are frozen (2026-09-27). Nothing runs in production; every database is disposable; the legacy database is reached only through import commands. The numbered migrations, the checksum registry, just migration-hashes and upgrade proofs will be replaced by one schema declaration we edit directly; the design awaits the operator's approval of its mechanism. No new numbered migration is written and no branch renumbers one.
• The architecture direction is FCIS with DDD (2026-09-27): bounded contexts are a modelling and code-organisation boundary, not a runtime one; the core domain is a stateless library of pure algebraic APIs; the shell is one generic imperative runner; Layer requirements are declared as service interfaces and provided incrementally at composition roots; coalgebraic state only where state bound to operations is a real requirement. See docs/specs/architecture-consolidation.md (draft).
• Interview corrections: the interviewer and the co-interviewer may correct a completed assessment until the admission decision is recorded; after that the department board leader, or a current holder of the delegable staffing delegation, may reopen one window per interview with a reason and an end instant no later than the semester's end; whoever reopens cannot correct under it; a post-decision correction never changes what the recorded decision acts on. In progress on fix/recruitment-review-0926; the specification is not on main yet, so it has no page here.
• The deployment image and hosting are undecided. No image exists. Podman is the operator's preference for building and running one; Podman is not installed on this machine.

Development stays local. just dev starts both frontends and the native Bun backend; PostgreSQL is a separate prerequisite. See local development. External delivery is disabled in local development.

Evidence boundary

Each row is the latest local acceptance of its area. All runs used synthetic or historical data, disposable PostgreSQL, and local or loopback delivery. No row proves production data, a real provider, a deployment, or cutover. Evidence lives outside the repository; temporary storage is not an archive. "Probes" means disposable checks; no maintained root command replays them. The evidence directories under /tmp cited below were deleted on 2026-09-27 during a lead cleanup; the rows record what was observed then. Re-run the named command, or use the latest green hosted Tests run (36268554218 or later), which runs every journey in the just sets.

e3177b24 is a disposable snapshot commit, not a commit on main. The golden fault modes are expected failures that prove cleanup, not successful journeys. Other implemented journeys have local observations without a retained record: identity, OAuth, password recovery, profile, directory, team interest, admission periods, public applications, interview scheduling and conduct, onboarding, placement rosters, content, contact, and social events.

Content repair-first acceptance (2026-10-03)

At clean e87a1c2b18300453fa01595d0fd901cf0b96cae6, three independent real-PostgreSQL/backend regressions went red before their separate source fixes. They preceded every effx Content declaration. The integrated focused suites passed: Content database workspace/slug/public reads, four files and 19 tests; backend public ETags/shared conditional response plus Profile/Schools/SocialEvents, six files and 25 tests; domain slug projection, one test. All three jobs ran under just measure and exited 0.

• Workspace visibility: committed red test 58aae63e observed a foreign department's unpublished working title in a scoped editor workspace. Fix 60b429af applies the same canReviseDraft rule as detail/revision reads; authorized publisher and global administrator retain their rows. Enforced by packages/database/src/content/workspace-visibility-postgres.test.ts with disposable PostgreSQL (postgres.ts:225-239).
• Public validators: committed red test 2aa9f2e8 saw the old 304 and ETag after department links changed. Fix e87a1c2b hashes the strictly encoded public listing/detail bytes and passes them to the one conditional-response helper; its original body path retains lazy 304, 200 and 412 behavior. Real-PG apps/backend/src/content/http-news-etag.postgres.test.ts and deterministic apps/backend/src/http-api/conditional-json.test.ts enforce this. Shared ETag derivation and Profile/Schools/SocialEvents HTTP handler source SHA-256s stayed unchanged; full browser regressions remain a later gate.
• Slug bound: committed red test c396f76d observed a failed insert for a title whose transliteration exceeded 255 characters. Fix 9c92e455 bounds the first slug and reserves room for collision suffixes while preserving short slugs and atomic domain receipt/audit writes. Enforced by packages/database/src/content/slug-postgres.test.ts on disposable PostgreSQL and packages/domain/src/content/projection.test.ts.

These earlier repair checks alone did not certify Content; the later generated browser result is recorded below. Full serial just check/just test and separate Profile, Schools, and SocialEvents browser regressions remain gates at the final Content revision. The operator's main, production, and providers remain unchanged. The journal and homepage error mapping in fix/content-teams-review-0926 remain excluded (docs/specs/0014-content-migration.md in effx).

Content public-news midnight hydration (2026-10-04)

The original just e2e content-publication on clean generated Content commit ef826549 reached its final browser assertion but exited 1 after 40 seconds (peak RSS 4.5 GiB): four React hydration #418 text mismatches on anonymous news pages. Original mono-web main at f433ea90 already rendered all three news dates with new Date(publishedAt).toLocaleDateString("nb-NO"), without a zone. This behavior predates and is independent of effx.

Commit 52242f8b extracted the unchanged route formatter and committed the focused apps/homepage/test/news.test.ts regression red: 1 failed/7 passed; at 2026-10-03T22:30Z, controlled UTC rendering returned 3.10.2026, while Europe/Oslo returned 4.10.2026. Fix 3d6e37a3 explicitly formats Norwegian dates in Europe/Oslo at all three public route callsites and fixes four other implicit dashboard formatters. The new anti-slop/no-implicit-date-time-zone rule guards both applications; all 15 rule cases pass, including zone and non-date negative controls. The focused homepage regression passed 8/8 and scoped lint passed. On clean 3d6e37a3, the original measured Chromium/Better Auth/disposable PostgreSQL just e2e content-publication passed (exit 0, 79 seconds, peak RSS 4.6 GiB). This repairs a pre-existing UI defect; it does not prove provider or production cutover.

TeamApplications generated parity work (2026-10-04)

The approved local cutover replaces the seven handwritten TeamApplications HTTP declarations and raw bindings with one generated group; original domain authority, PostgreSQL transactions, Foldkit, mail and PersistedQueue/outbox remain application-owned. Vendored effx f3c6bf8 strict five-group contract/handler emits exited 0 with only EFFX0001. Complete OpenAPI 81e7b872178803a3c8bf6ccf86b96b5185ba560e9661b47e98d1d0d4e827b749 and SDK index c4abcca1878171c84fd3c531c3fe5c93f92329818c59d4b73a8bf796bca8aad3 matched the accepted fcc2f3e0 bytes exactly: 107 external operations, the same seven TeamApplications IDs and one excluded internal receipt. The generated DELETE response is the real Effect NoContent 204 with no body and the original no-store/Vary headers. The unmerged service-drain/operation-grant pilot is excluded (effx/docs/specs/0023-team-applications-migration.md).

• Copied intake limit: the source-based declaration test was committed before a clean focused run observed one failure: metadata said 250 active teams while the domain constant required 500. A one-line literal correction first turned 5/5 green; 36158786 removed the copy entirely. The application-owned operation annotator now derives OpenAPI description from TEAM_APPLICATION_INTAKE_LIST_LIMIT. A regenerated whole OpenAPI document stayed byte-identical. The original test now checks rendered OpenAPI against that domain value. No other copied numeric intake limit was found in application, package, tool or documentation source.
• Real migration proof lifetime: at the seven-handler cutover source, the existing queue-migration suite failed 1/22 only because full prior-schema setup inside the PGlite case exceeded Vitest’s default 5-second test timer. Commit 75d8deb8 gives that case a bounded 30-second timer; the PostgreSQL/PGlite historical-row, claim-fence and queue-state assertions are unchanged. The focused real proof then passed 2/2. This is not a delivery retry or a weaker assertion.

The original just golden team-application, both fault modes, four adjacent browser journeys and full just check/just test remain unverified at one final clean TeamApplications commit. Source-focused HTTP/backend/homepage/Foldkit/SDK checks passed during integration; they do not substitute for those gates. No production, credentials, provider, migration schema or operator-owned main changed.

Historical backup rehearsal

The rehearsal used the private 2024-08-22 backup through a SELECT-only MariaDB account and a separate PostgreSQL target. The backup reader reads users, departments, semesters, schools, school-department links, and assistant history. It left Organization and current assignments unimported. Its census facts drive the import decisions:

• People: 2,893 of 2,923 reconciled; 30 quarantined.
• References: 5 departments, 28 semesters, 44 schools, 43 school-department links.
• Assistant service: 1,690 of 1,815 rows imported; 125 quarantined (105 invalid, 10 unmapped, 10 duplicate targets). 1,681 distinct historical affiliations.
• Accounts: 1,482 supported hashes imported unchanged; 1,410 passwordless identities without credentials, sessions, or mail; 31 quarantined (13 inactive, 5 invalid, 13 without an accepted Person).
• One accepted Person has an account email without a domain dot. The login schema rejects it, so that Person has no login identity. Correct the address with verified evidence before cutover. Do not relax login validation or invent an address.
• Assignments: 0 for 2024 Høst; 92 for 2024 Vår, historical when the backup was made. The backup cannot prove current placements.
• Receipts: 2,206 rows (2,169 refunded, 32 rejected, 5 pending). 2,142 owners resolve to accepted People; 64 owners are inactive. The backup has SQL only, not the 2,206 files. Account numbers are plaintext; native receipts require encrypted account custody. A legacy refunded status proves neither payment nor native settlement. Do not import file-less receipts or mark them settled.
• Messages: 702 admission-opening notices and 18 accept-interview reminders were sent in 2024 by a scheduler outside the repository.

Legacy usernames and company emails are not supported as login aliases. No import infers current affiliation, placement, or authority from history.

Known gaps

Fix an instance when a change touches it (see AGENTS.md).

• Flat copies of the outcome problem lists, under "Construction over trust": packages/http-api/src/admission-outcomes-effx-adapters.ts repeats the three spread-composed lists of packages/http-api/src/admission-outcomes.ts (17, 24 and 18 codes) as flat literal tuples, because the effx frontend resolves a literal tuple but not a spread of a const tuple in Http.problems codes. packages/http-api/test/admission-outcomes-effx-adapters.test.ts compares each copy with its source element for element and at the type level, so neither side can drift. Retire the copies when the effx frontend resolves spreads of const tuples.
• Typed endpoint problems: every backend group fails with declared Problem values; the raw problem path is gone. Defects found and left open: packages/database/src/content/postgres.ts never recognizes a department foreign-key violation (503, not 422); Schema.Struct({}) request bodies accept excess members; a sanitizer rejection of article HTML answers 500; a lost serialization race inside the content, school, or recruitment-maintenance domain answers 503, not 409 (content errors keep only the cause's text); the dashboard maps a command's transaction.conflict to its unknown-error branch (receipt-view.ts).
• apps/homepage/src/lib/public-application.ts lists its problem codes by hand and omits header.malformed. The homepage problem mappers (mapPublicApplicationError, publicTeamApplicationPageFailure, failedPublicTeamApplication) still accept a plain problem-shaped object besides the SDK's Problem; the dashboard reads problems only through nativeProblemFrom.
• Instants: domain fields still use Rfc3339InstantSchema, not Instant (packages/domain/src/time.ts). The authority instant (M2), per-slice cutovers (M3), and deletion of the string helpers such as compareRfc3339Instants (M4) remain.
• Receipt keyset cursors carry microsecond text (packages/database/src/receipt/cursor.ts). They stay exact because storage is millisecond; M3 moves them to Instant.
• packages/database/runtime/schema-boundary-postgres-proof-main.ts (proof:schema-boundary-postgres) is run by no just set or hosted job, so it stayed red unnoticed: migration 0037 and the migrations after it broke its fresh seed and its comparison of the moved tables at the head. Host it as a just proof name and in the Tests workflow.
• Parameters bound through raw pg query calls, sql.in, or sql.unsafe are not typed. Only the Database template rejects a DateTime argument. Raw calls include the identity and OAuth adapters, packages/database/src/service-principal-grants-live.ts, the cohort importers in packages/database/src, and packages/database/src/placements/current-assignment-cohort.ts.
• Raw pg files still write advisory-lock SQL and copy lock keys by hand. The exceptions of anti-slop/no-raw-advisory-lock-sql in oxlint.config.ts list them; each leaves that list when it moves to Effect SQL and lockAdvisory. The rule does not cover tools/, where tools/e2e/legacy-cutover-references.ts and tools/verification/organization-import-rehearsal.test.ts also write advisory-lock SQL.
• The raw pg identity adapters packages/database/src/auth-engine.ts and packages/database/src/password-recovery.ts read NOT access_disabled by hand instead of accountAccessEnabled in packages/database/src/identity-access.ts.
• Team.email (packages/domain/src/organization/schema.ts) accepts text that is not a mailbox. Open team intake requires a deliverable mailbox; the write boundary does not check it.
• Hand-written operation ids outside content, hand-written dashboard navigation paths, a fixed admissions retry-after, and fixed ports in older browser runners.
• Twenty test files of the dashboard and homepage answer API and provider calls with a stubbed global fetch (vi.stubGlobal("fetch", …)) or a recording fetch, not a contract-served boundary: the *.test.ts files that stub fetch under apps/dashboard/app, apps/dashboard/test, and apps/homepage/test, and apps/dashboard/app/foldkit/team-applications/update.test.ts. packages/sdk/src/__tests__/generated-native-client.test.ts shows the replacement for native API calls: it serves the contract's endpoints with HttpApiBuilder and records what the server decoded.
• PR previews (operator decision, 2026-09-25): Cloudflare Worker Previews of the homepage and dashboard only, as vektor-preview-homepage and vektor-preview-dashboard, which wrangler preview creates on first use (contract). Their Cloudflare token (Workers Editor on the two preview Workers only) and account id live in Bitwarden Secrets Manager; secretspec.toml profile preview gives them to the deploy and delete steps, and GitHub holds only the read-only BWS_ACCESS_TOKEN. The parent Workers were created on 2026-09-26 and hold no version. Draft PR #24 proved the path on 2026-09-26: run 36242120400 read both secrets from Bitwarden (US cloud) through secretspec, deployed both previews, passed the document and asset probes, and posted the review comment; closing the PR ran the cleanup, and the Cloudflare API then listed no previews or versions on either Worker. The homepage preview hostname answered 404 at once, but pr-24-vektor-preview-dashboard still served the app 7 minutes later. wrangler preview delete is an open beta; recheck a closed PR's dashboard hostname and report upstream if it keeps serving. They have no backend, so pages that read the API show the unavailable state. A native backend preview host is the planned follow-up: full-stack per-PR previews on DigitalOcean App Platform (digitalocean/app_action with deploy_pr_preview) so previews rehearse the production platform.
• The dev-main stage was torn down on 2026-09-26: its Workers, custom domain, route, tunnel, tunnel DNS records, and workstation units are gone. vektor.phibkro.org is free for a future staging deployment of main. The retired Workers (p20 homepage, dashboard and preview worker; p001 homepage and dashboard; the superseded development backend; vektor-migration-docs), their routes vektor.phibkro.org/api/* and /health, and the custom domains p001, p001-dashboard, p20.vektor.phibkro.org and vector-docs.phibkro.org were deleted on 2026-09-26 (operator decision).
• Hosted Tests run 36191536836 passed every job at 6c812703, including the PostgreSQL 17 lane. The Browser journeys matrix runs every just golden, just e2e, just proof, and just rehearsal name that no other hosted job runs; just layout write generates its legs from the justfile, and just layout fails on a Playwright spec or acceptance probe that no name runs and no exclusion lists (hosted journeys). Hosted run 36219552428 passed 16 of its first 17 legs; e2e contact failed because it served a homepage build it did not make, and its runner now builds one. Hosted run 36233895862 at 74e165ef passed 37 of 39 jobs, including every leg added since. The two hosted-only failures are fixed at their cause: rehearsal organization-import no longer reads Git history (anti-slop/no-git-history), and e2e recommendation-returning asserts the revision that won the person lock. Journey ports come from reserveLoopbackPorts (anti-slop/no-port-probe). just proof authorization-rules, just e2e recommendation, and just e2e recommendation-report are back in the hosted set and pass locally; no hosted run has run them yet. The proof asserts that a replay after rule removal is denied (InactiveActor), because a replay rechecks current authority. Only e2e recommendation-returning runs the returning assistant journey and its report population. No name hosts recommendation-check.ts --returning-login-probe (it records a login diagnostic and asserts nothing) or bun run --cwd tools/e2e rehearsal:legacy-person (it reads a private backup). apps/dashboard/app/foldkit/organization keeps Team catalog view and load branches that no element mounts since 62a7b94c.
• The golden CI gate once failed at ae5928fe after a dashboard GET returned HTTP 503; a later diagnostic run passed and the cause is unproven. Evidence: /tmp/golden-ci-success-ae5928fe.
• devenv shell is the toolchain entry: Bun, Node, PostgreSQL, openssl, Chromium, and prek Git hooks; --profile legacy-data adds MariaDB and the PHP 8.4 CLI for the legacy data rehearsals. CI runs in the same shell; its hosted cost is unmeasured.
• Placement drafts take a new applicant's application availability once the interview is conducted, as the legacy scheduler took every interviewed applicant (packages/database/src/placements/draft.ts). Admission outcomes are now recorded. Decide whether supply follows the Admitted outcome; the system document announces outcomes after allocation.
• Drafts show school wishes but do not use them to choose a school (follow-up: use wishes in scoring). Scoring needs one teaching-language registry first: applications and returning registrations use AssistantLanguageSchema (packages/domain/src/application/availability.ts), and schools SchoolLanguageSchema (packages/domain/src/schools/schema.ts).
• The application asks for no school level, and a new applicant names no preferred school: the legacy application asked neither, and the school directory records no level. A level wish needs a school level in Schools first; the operator decides whether to add one.
• Admission outcomes: an interview's Ja derives Admitted and Nei derives Rejected; Rekruttering decides a Kanskje or returning application in /dashboard/opptaksutfall through an admissions.outcomes delegation (O8-17), and the department's delegated school coordinator announces each outcome once, which queues one immutable mail from the editable templates. The mail is delivered through the configured HTTP mail transport; no deployed provider has accepted its HTML.
• Receipt approval and settlement still also accept the person-keyed Economy grants (economy_receipt_approval_grants, economy_receipt_settlement_grants, read by packages/database/src/receipt/authority-postgres.ts). The model makes them delegations, not grants (O8-15). Retire the grants after the receipt seeds and the golden reimbursement journey issue the Økonomi delegations instead.
• Membership still gives department-wide reach where the model names no action: content editing (ContentEditor in packages/domain/src/content/actor.ts), social-event creation (packages/domain/src/social-events/authority.ts), the schools directory (packages/domain/src/schools/authority.ts), the receipt approver relationship requirement (packages/domain/src/receipt/approval-list.ts), and the recruitment Member actor. Decide each case; none gives administration.
• Derived board seats (a team leader's seat on Styret or Hovedstyret) are specified, not stored or listed; the certificates slice adds the seat list. A seat confers no administration (Q2) and no global-administrator grant (K3).
• Routes without a department (admission periods, the recruitment board, the interview report) act in the single department of the person's active memberships. Hovedstyret's leader and an organization-wide delegation must name a department there; the requests fail closed.
• The dashboard profile role is a coarse projection with four values; ROLE_DEPARTMENT_ADMINISTRATOR means reach beyond one team for some capability, not for every page it shows.

Next

Full migration needs implementation, operational decisions, current-data reconciliation, provider acceptance, and an authorized cutover. The testing roadmap owns journey sequencing: generated sequences and measured execution scaling come next. PGlite performance and full native composition are unmeasured.

Lead handoff

Updated 2026-09-26 at d9f6afca. A new lead resumes from this section, AGENTS.md, and docs/specs/, not from chat or session files. Agents follow the effect-house overlay (.agents/skills/effect-house/SKILL.md); the homelab projects-tier extension injects it and the instruction chain on first touch. spike/persisted-queue-outbox-0925 (worktree mono-web-pq-spike-0925) is the starting point of the team-application PersistedQueue pilot the operator chose on 2026-09-26; its landing conditions are in infrastructure ports.

How work runs: one writer per worktree and branch; heavy commands go through just measure, whose machine-wide lock serialises every agent; the lead lands with just land <branch> and pushes main; hosted CI runs every journey named in the just sets.

Next, in this order:

1. Keep hosted CI green; fix any red leg at its cause. Hosted Tests run 36268554218 at 165aa3ea passed all 42 jobs, including the returned proof authorization-rules, e2e recommendation, and e2e recommendation-report legs; the Effect lint wiring passed Checks run 36267629067 at cdfd81b4.
2. Certificates for days served (O8-16), frozen in certificates and days served. It adds the derived Styret and Hovedstyret seat list that the delegation slice specified.
3. Retire the receipt person grants: the receipt seeds and the golden reimbursement journey issue the Økonomi delegations instead (O8-15).
4. Formatter scope for the frontends; per-domain typed problems and instants; the remaining phases of repository conventions: boundary and reuse rules and the migration onto them, the duplication check after the public-surface slice, then agent docs.
5. A reusable migration upgrade-proof recipe. The 72 to 75 proof was a throwaway harness.

The legacy-data devenv profile needs the home binary cache; since the homelab rebuild of 2026-09-26 a dead cache is non-fatal. Changing a root file such as oxlint.config.ts runs no package test in the pre-commit hook (Turbo maps changed files to packages); just check and CI still run them.

Operator steps pending

• Staging deploys run docker compose down without --remove-orphans. After the PostgreSQL 18 change reaches the staging branch, run docker compose down --remove-orphans once on the staging host to remove the orphaned receipt-postgres container.
• BWS_ACCESS_TOKEN (the only preview secret in GitHub) holds the access token of the machine account vektorprogrammet-ci, which reads Bitwarden project 2ddfeed1-59d8-4139-b6b0-b4d1001edcfc in the US cloud; the Cloudflare token is its key WORKERS_EDIT_CLOUDFLARE_API_TOKEN. Rotate both before they expire.
• Before any production use of reach and delegation: classify the Styret and national teams, recognize independent departments, and issue the Økonomi delegations, each by explicit command (see Production gates).

Remaining migration work

The recruitment, password-reset, and receipt delivery workers run under Bun supervision. The delivery guide defines their configuration and recovery. The Bun composition applies migrations and starts configured workers. Deployment acceptance must verify that composition and every required delivery path.

Operational scope decisions

The operator decided these on 2026-09-25. Each becomes one design specification under docs/specs/ before implementation. A decision is scope, not acceptance.

The parity map is at (deleted 2026-09-27) (84 capability rows: 27 evidenced, 16 native without evidence, 9 missing, 17 policy). Changelogs, articles, generic events and surveys, certificates, and nonessential statistics are not default cutover gates. An active core obligation cannot disappear under that exclusion. Retained data still needs an explicit archive or migration disposition. Recruitment keeps recommendation, invitation, account claim, affiliation, and placement separate. The admission outcome is a separate recorded decision.

Reconciliation prerequisites

• Obtain an authorized consistent current snapshot and its watermark. Browser observations do not substitute for it.
• Reconcile current identity and mailbox ownership. Correct the known invalid login email with verified evidence.
• Resolve unsupported credentials and legacy aliases. Preserve post-import credentials on replay.
• Reconcile active authority separately from Accounts, historical membership, and volunteer affiliation.
• Obtain receipt file bytes and digests. Apply encrypted account custody with reviewed owner, department, and account evidence.
• Reconcile settlement references separately. A legacy refunded flag is not evidence of payment.
• Inventory external schedules, open cases, active chapters, and pending notifications. Empty screens do not prove an empty workload.
• Reconcile combined teaching blocks and ambiguous membership groups before imposing legacy uniqueness assumptions.
• Define a final-delta strategy. Exact replay refuses changed source; rerunning the initial importer is not incremental migration.

Architecture work

Close remaining service boundaries through a concrete operational journey, not a repository-wide rewrite. The Economy boundary is the precedent for a complete command and a schema-derived query. For each new journey, create one active contract under docs/specs/. Remove it after acceptance.

Production gates

Before cutover:

• classify the legacy Styret teams and the national teams, and recognize independent departments, by explicit command (O8-11). Until then no imported team leader reaches a department. Compared with legacy, a leader of an ordinary team in department D without a board leadership or delegation loses: admission periods and outcome decisions of D; interview assignment, staffing, the full board, and the report of D; placement coordination and applicant account invitations of D; school administration of D; appointments and team-interest registrations of D's other teams; D's people directory and mailing recipients; publishing, unpublishing, pinning, and revising others' articles in D; and the pages "Fullførte intervjuer", "Intervjubemanning", "Søkerkontoer", "Attester", "Linjer", and the applicants board. Tell department leaders before cutover;
• close required operational outcomes or obtain an approved, owned transition process;
• reconcile identities, credentials, authority, recruitment, placements, claims, private files, and pending effects against the current source;
• resolve or explicitly disposition each quarantine, unsupported credential, alias, and missing evidence item;
• verify the Bun deployment, PostgreSQL locks, required delivery providers, private storage, and separately authorized settlement evidence;
• qualify sustained operation, worker supervision, failure alerts, backup, restore, and credential hashing limits on the selected host;
• choose and rehearse a final-delta method;
• fence legacy writers and external schedules before native ownership starts;
• verify rollback after native writes, including native-only facts and pending external effects;
• obtain explicit operator authority for production transfer and each external or destructive action.

After transfer, verify that all required readers and writers use the native system. Retire PHP and obsolete provider composition only after those dependencies and required archives have an accepted disposition. Team membership never stands in for volunteer affiliation. A recommendation never stands in for an explicit coordinator outcome.