# Acceptance reconciliation — 2026-10-12 Baseline: `c1ef2ee`. This review compares the live Gitea acceptance criteria with source, tests, and recorded runtime evidence. Implementation is not milestone acceptance. The earlier assessment understated remaining M2/M3 work. ## Catalog-core Task 4 evidence — 2026-10-13 Tasks 1–3 were approved at handoff (371 tests / 2032 assertions / 22 skips, local lint clean). Task 4 adds six PostgreSQL cases using independent sessions, generated schemas, 250ms lock timeouts and 5s statement timeouts. Execution-time parameter recording establishes ascending file locks for reversed input; FOR SHARE contention establishes same-owner no-op locking. Tests also establish stale-owner rejection, rollback/retry, nested transaction survival, lower-lock release after savepoint rollback, and explicit/legacy root creation contention including disjoint folders. No deadlock was induced and no automatic retry added. - Fresh Windows PHP 8.3.35: foundation checks pass; full PHPUnit **377 tests, 2032 assertions, 28 skips**, exit 0; standard PHPCS lint exit 0. These are the Composer script commands invoked directly with the required PHP executable. - Fresh isolated Docker PostgreSQL 17 / PHP 8.4.26: `sh bin/test-postgres.sh` ran full Composer tests and lint successfully: **377 tests, 2160 assertions, 7 skips**. Final log: `keith@192.168.2.23:/tmp/meshvault-catalog-tests-Ov96uNzU/pg-run-3.log`. - Initial PG run (`pg-run-1.log` in the same directory): 377 tests / 2140 assertions / 4 errors / 7 skips. All four errors were SQLite-only trigger DDL in the later-update rollback fixture. A PostgreSQL trigger function now tests the same earlier-write condition; `pg-run-2.log` first confirmed the fix. New concurrency cases passed against the approved implementation; no production locking gap or new-case red/mutation run is claimed. - Transfer included current uncommitted source, excluding vendor, node_modules, .git, .superpowers, environment files, secrets and key files. Dockerfile.test installs dependencies. Dedicated disposable containers/network used no host DB ports or persistent volumes; test containers were gone after final cleanup. Neither `/tmp/MeshVault`, the historical PG workspace nor development data was modified. SSH calls exceeded the tool's 30s wait; subsequent log reads verified completion and the script's tests-and-lint success marker. Independent whole-slice review approved the bounded implementation with no blocking findings, reran local tests/lint and checked the PostgreSQL log and matching source hashes. The user authorized local integration into main, not a push. No issue closure is implied; broader #28 metadata/lifecycle contracts and the M2/M3 gaps remain open. ## Historical evidence - Fresh Windows run: `composer test` — 291 tests, 1801 assertions, 22 skips; exit 0. `composer lint` — exit 0. Expected HTTP failure-path logs are not test failures. - Recorded isolated Linux/PostgreSQL 17 run: 291 tests, 1863 assertions, 7 skips; tests and lint exit 0. Not rerun for this review. See `postgres-tests.md`. - M1 runtime evidence is historical: local task reports document HTTP/FPM behavior, database volume survival across down/up, runtime-user permission checks, and asset watch/build delivery. Those ignored reports are not public repository artifacts. - Source-derived recovery risks below need executable regression tests; they are not claims that a new crash experiment was run. ## Issue disposition Tracker reconciliation completed: #6, #7, #8, #9, #11 and #23 were closed with evidence comments. All other reviewed issues remain open with gap comments. The closure-candidate labels below describe the audit recommendation that led to those changes; issue states were rechecked through the live API afterward. | Issues | Assessment and outstanding acceptance | | --- | --- | | #6–9, #11 | Closure candidates: Compose, application skeleton, config, assets and logging have implementation, tests and historical runtime evidence. Preserve that evidence in issue comments. | | #10 | Wrappers implemented; complete migration/seed command smoke coverage remains to be reconciled. | | #12 | Phinx runs production migrations through PG fixtures; direct migration rollback/clean-start acceptance remains separate from fixture teardown. | | #13 | Folder schema exists; review root representation, hierarchy invariants and deletion behavior against the issue before closing. | | #14 | Models exist; full specified metadata and timestamp semantics need reconciliation. | | #15 | Multipart files and indexed hashes exist; source mtime and explicit format metadata are missing, and lifecycle naming needs reconciliation. | | #16 | Tags/join table exist; model category assignment is absent and root category name uniqueness is not guaranteed by nullable-parent uniqueness. | | #17 | Thumbnail rows exist; exactly-one-primary invariant and demonstrated separate storage remain missing. | | #18 | Jobs/items/counters/claims exist; confirmed manifest, attempts, resulting-file reference, duplicate decisions and relationships remain incomplete. | | #19 | Backup intent exists; executable consistent backup/restore guidance and clean-environment restore drill are missing. | | #20 | Scanner exists; configured source mounts, destination exclusion, immutable manifest and explicit grouping preview/confirmation are incomplete. | | #21 | Space check exists; required/available byte reporting and production safety-margin configuration remain incomplete. | | #22 | STL validator is covered; one combined extension allowlist does not implement the requested separate supplementary-file policies. | | #23 | Closure candidate: streaming hashing, mutation checks and persisted indexed hashes are implemented and covered. | | #24 | Verified copier exists; nested hierarchy and crash-safe collision publication/reconciliation remain incomplete in worker integration. | | #25 | Queue/worker/locking exist; confirmed grouping and full replay/retry guarantees remain incomplete. | | #26 | Repository progress exists; caller-facing polling, full state distinctions and worker handling of empty jobs remain incomplete. | | #27 | Failures persist; supported retry with attempt history and persisted-message redaction remain incomplete. | | #28 | Bounded identity, explicit expected-owner reassignment and catalog-owned savepoint transactions are implemented with local/PG evidence above; whole-slice review approved, but broader metadata/lifecycle contracts remain open. Not complete. | ## Important implementation findings - `ImportService::group()` guesses associations from the first directory component. `ensureModel()` reuses folder/name identities. Neither is user confirmation. The M3 ledger's directory-grouping decision does not supersede live #20 criteria. - The scanner retains relative paths, but job creation discards them. The worker constructs destinations from a model folder and basename, flattening deeper paths. - The worker persists a planned name before copying, but saves a collision suffix only after publication. A crash in between can lead to a second suffixed copy on replay. Existing successful-collision tests do not establish this crash boundary. - A catalog failure after publication can leave a file on disk and a terminal failed item. Source validation also precedes adoption of an already published copy. - Item size can be replaced during planning while scanned job byte totals remain unchanged. Failure text is persisted from exception messages without general redaction. Progress and retry need workflow-level contracts, not just counters. ## Proposed next delivery order 1. Complete issue/evidence reconciliation without closing partial milestones. 2. Design a bounded #28 catalog contract with explicit grouping/reassignment and stable model/file identities; retain PHP/PDO/Phinx and the existing repositories. 3. Extend #18/#20 with immutable, confirmed manifests and safe source selection. 4. Resolve #24/#25 publication recovery before calling imports restart-safe. 5. Add progress and retry contracts (#26/#27), then M4 CRUD/removal/downloads and serialized folder/model moves. Complete schema prerequisites as their contracts are settled, using new migrations rather than rewriting applied migrations. M5 metadata, M6 browse/search, M7 lifecycle/duplicate review and M8 hardening/release remain ahead. No production readiness or percentage-complete claim is implied.