fix: reconcile CodeRabbit promotion findings

docs/operations/coderabbit-pr-35-disposition.md

@@ -0,0 +1,65 @@
+# CodeRabbit disposition for promotion PR 35
+
+Promotion PR [#35](https://github.com/DatabreezeService/databreeze-platform/pull/35)
+received exactly one automatic CodeRabbit review
+(`9880ed80-ef8e-4545-8823-97499ec88913`) for its promotion range. CodeRabbit
+was not invoked again. The review's ten actionable inline comments, two
+outside-diff claims, and review-body suggestions were reproduced against the
+current `dev`-bound fix branch before disposition.
+
+## Actionable inline comments
+
+| ID | Claim | Disposition | Evidence |
+|---|---|---|---|
+| CR35-01 | The platform-program branch/PR budget still described the old 30–70 policy. | Accepted and fixed. | `ed1e130` aligns the normal 30–50, exceptional-under-79, and 280 hard-stop language. |
+| CR35-02 | The Luna handoff runbook repeated stale 30–70/99/280 limits. | Accepted and fixed. | `ed1e130` aligns the runbook with the same branch and promotion limits. |
+| CR35-03 | Audit event pagination must preserve scope key, chain sequence, and deterministic event identity. | Accepted and fixed. | `f381341`, `66b3548`, and `68632db`; both adapters use the canonical ordering and forged-cursor regressions pass. |
+| CR35-04 | An invalid audit chain must not be reported as a retryable outage. | Accepted and fixed. | `2406de7` and `00e688c`; integrity failures map to a non-retryable 500 problem without the raw chain marker. |
+| CR35-05 | Membership writes could treat a cross-organization identifier collision as a generic uniqueness error. | Accepted and fixed. | `28268b1` and `cf159c7`; identity lookup is organization-independent before the scope guard and P2002 races map to `IAM_REVISION_CONFLICT`. |
+| CR35-06 | Bootstrap could silently discard malformed non-null membership timestamps. | Accepted and fixed. | `f93d44e` and `f8f7747`; invalid `startsAt`/`expiresAt` values are rejected and covered. |
+| CR35-07 | MFA revision conflicts need an explicit HTTP conflict response. | Accepted and fixed. | `1c4ef10` and `3a7bcae`; `IAM_MFA_REVISION_CONFLICT` maps to HTTP 409. |
+| CR35-08 | Request-context resolution was inside the sign-out catch and could hide authentication failures. | Accepted and fixed. | `3197edd` and `b513053`; the HTTP contract preserves `AUTHENTICATION_FAILED`. |
+| CR35-09 | Device problem-message keys were absent from the bilingual catalogs. | Accepted and fixed. | `dd5ad9a` and `6e318ff`; all five device keys now exist in Vietnamese and English and are required by the catalog test. |
+| CR35-10 | The migration test should exercise existing-session migration behavior. | Rejected as an unsafe backfill request; the safe migration contract was strengthened. | The migration explicitly has no legacy-data migration because tenant scope cannot be inferred safely. `366d787` resolves the migration by stable name and asserts that no unsafe backfill is present. Existing sessions must be recreated under the locked no-legacy-migration assumption. |
+
+## Outside-diff claims
+
+| ID | Claim | Disposition | Evidence |
+|---|---|---|---|
+| CR35-OD-01 | `GET /v1/entitlements/usage` should publish a success response schema. | Accepted and fixed. | `1add34b`; the generated OpenAPI now declares the usage page shape. |
+| CR35-OD-02 | `GET /v1/entitlements/snapshots/{snapshotId}` should publish a success response schema. | Accepted and fixed. | `1add34b`; the generated OpenAPI now declares the snapshot success shape. |
+
+## Review-body suggestions
+
+The following suggestions were also considered. Accepted suggestions are
+implemented in the cited commits; suggestions that conflict with the locked
+architecture are explicitly rejected rather than implemented speculatively.
+
+| Suggestion | Disposition |
+|---|---|
+| Do not cite reconciliation evidence for planned traceability rows. | Accepted: `ca2df3d` separates planned entries from reconciled evidence. |
+| Resolve migrations by stable name rather than an inventory index. | Accepted: `366d787`. |
+| Centralize the BUA reservation transition invariant. | Accepted: `bbe0723` and `67790d2`; both adapters call one application policy and a direct policy test protects it. |
+| Add forged audit-cursor coverage. | Accepted: `68632db`. |
+| Add an audit-seal descendant scheduler and alerting loop. | Rejected for this slice: the current AUD contract has no active-scope scheduler port or alert ownership; inventing one would bypass the ordered audit/sealing plan. Deferred to the AUD sealing task. |
+| Add a page response schema to the audit controller. | Accepted: `89002da`; generated OpenAPI includes the bounded page envelope. |
+| Share the audit page-offset validator and maximum. | Accepted: `e640373`. |
+| Document the audit ordering contract. | Accepted: `66b3548` and `89002da`; the port and API docs state the chain ordering. |
+| Remove unused transaction-level audit list methods. | Accepted: `66b3548`; the transaction port no longer exposes unrelated enumeration methods. |
+| Share the canonical tenant scope-key helper. | Accepted: `f381341` and `3412961`. |
+| Flatten inherited BUA usage reads and avoid one query per scope. | Accepted: `fa42a5f`; one `scopeKey IN (...)` query is issued per record family. |
+| Add query-count/performance regression coverage for inherited usage. | Accepted: `e9f0f90`. |
+| Share the IAM session-revocation lifecycle. | Accepted: `e33ad17` and `9888494`; repeated revocation preserves the original timestamp. |
+| Add safe malformed-membership diagnostics. | Accepted: `663fdbc`, `aab57cb`, and `f7fa8d3`; malformed rows are skipped, diagnostics are best-effort, and the fixture remains visible to the scoped query. |
+| Push IAM membership visibility into the database query and preserve scoped reads. | Accepted: `56df707` and `0e13e95`; the adapter emits organization/workspace/project predicates and tests inspect them. |
+| Share membership-authority selection across adapters. | Accepted: `f54976d` and `d8a2f13`. |
+| Test two personal organizations and reject ambiguity. | Accepted: `f93d44e` and `f8f7747`. |
+| Batch bootstrap organization lookup. | Accepted: `f93d44e` and `f8f7747`; candidates are selected with one bounded `findMany`. |
+| Export cookie parser limits for fixtures and test exact boundaries. | Accepted: `25f9017` and `3a94fb5`. |
+| Backfill existing sessions in the scope-binding migration. | Rejected: inferring organization/workspace from a legacy session is unsafe and contradicts the repository's explicit no-legacy-data assumption. `366d787` tests that the migration preserves this guard. |
+| Change audit ordering to created-at/ID ordering. | Rejected: chain pagination must follow the persisted per-scope sequence and deterministic event ID so cursor pages reconstruct the verified chain. |
+
+The accepted changes are collected on
+`fix/coderabbit-pr-35-reconciliation` and will enter `dev` through its focused
+fix PR. Promotion PR 35 remains a single-review, immutable review packet; no
+second CodeRabbit run will be requested for it.

docs/plans/000-platform-program.md

@@ -50,9 +50,9 @@ docs/plans/requirement-traceability.json records all 611 IDs with requested trac
 - `main` contains stable releases. `dev` is the integration branch.
 - New capabilities use `feat/<name>`; corrections use `fix/<name>`; operational and documentation work use conventional prefixes when more accurate.
 - Commit one coherent tested unit at a time. Do not combine unrelated applications or domains merely to reduce commit count.
-- Feature/fix pull requests target `dev`, normally contain 30–70 commits, and must remain under 100 commits. Run local and hosted checks, but do not invoke CodeRabbit on these integration pull requests. Focused review-gate fixes are the only intentional small-PR exception.
+- Feature/fix pull requests target `dev`, normally contain 30–50 commits; an exceptional completed-task boundary may reach 79 but must remain below 100 commits. Run local and hosted checks, but do not invoke CodeRabbit on these integration pull requests. Focused review-gate fixes are the only intentional small-PR exception.
 - Merge a green integration pull request while preserving its atomic rollback commits, then immediately open a separate `dev` → `main` promotion pull request for that completed batch.
-- Invoke CodeRabbit exactly once on the otherwise-ready promotion pull request and request a full review. Do not invoke it if the promotion exceeds 280 changed files; split or revert the batch first.
+- Invoke CodeRabbit exactly once on the otherwise-ready promotion pull request and request a full review. Keep the packet at or below 260 changed files; 280 is the hard review-stop threshold and must never be crossed before splitting or reverting the batch.
 - Reproduce every CodeRabbit claim against the reviewed commit. Fix valid findings in focused commits, document rejected findings with evidence, rerun all affected gates, and never request a second CodeRabbit review on that pull request.
 - Do not merge a promotion when the single review was skipped, timed out, has unresolved valid findings, or required hosted checks are not green.
 

docs/plans/003-luna-handoff-runbook.md

@@ -91,15 +91,15 @@ For each `#### TASK-ID —` item in `002-complete-execution-orchestration.md`:
 
 10. Inspect generated/runtime debris before commit. Do not commit `.venv`, `node_modules`, Gradle state, build output, logs, caches, secrets, local databases, Terraform state, or test reports unless the repository explicitly tracks a sanitized fixture.
 11. Commit one independently reversible outcome with a semantic message. Do not combine contracts, an unrelated fix, and a different feature just to increase commit count.
-12. Recount the active PR slice against its base. Do not open below 30 commits; target 30–50, stop accepting new tasks at 50, and split at the next completed-task boundary. An exceptional boundary must never exceed 79 commits, preserving margin below CodeRabbit's 100-commit limit. Split before the promotion diff reaches 280 changed files; the packet target is 260.
+12. Recount the active PR slice against its base. Do not open below 30 commits; target 30–50, stop accepting new tasks at 50, and split at the next completed-task boundary. An exceptional boundary must never exceed 79 commits, preserving margin below CodeRabbit's 100-commit limit. Keep the promotion packet at or below 260 changed files; 280 is the hard review-stop threshold, so split before crossing it.
 13. Push after each stable task boundary. Update the ledger/checkpoint only with verified facts and leave a handoff record if stopping.
 
 ## Pull-request and CodeRabbit protocol
 
-1. Branch from current `origin/dev` using `feat/<scope>` or `fix/<scope>`. Keep atomic commits; preferred PR size is 30–70 commits and hard maximum is 99. Cut earlier only for a coherent boundary, a mandatory promotion-gate fix, or a safety constraint.
+1. Branch from current `origin/dev` using `feat/<scope>` or `fix/<scope>`. Keep atomic commits; preferred PR size is 30–50 commits and an exceptional completed-task boundary may reach 79, always remaining below CodeRabbit's 100-commit limit. Cut earlier only for a coherent boundary, a mandatory promotion-gate fix, or a safety constraint.
 2. Before a feature PR, ensure it targets `dev`, has no unrelated commits, and passes local gates. Open it with requirement/task/evidence/rollback notes. CodeRabbit must not be invoked on this PR.
 3. Wait for hosted checks. Diagnose failures; do not merge red or missing required checks. Merge with history that preserves the atomic rollback units, normally `--no-ff`/merge commit rather than squash.
-4. Immediately compare `dev` and `main`. If `dev` contains the reviewed batch and no incompatible promotion is open, create `dev` → `main`. If the diff exceeds 280 changed files, do not invoke CodeRabbit: split/revert the feature batch or request user direction first.
+4. Immediately compare `dev` and `main`. If `dev` contains the reviewed batch and no incompatible promotion is open, create `dev` → `main`. Keep the promotion packet at or below 260 changed files; if the diff would cross the hard 280-file review stop, split/revert the feature batch or request user direction before invoking CodeRabbit.
 5. When the promotion PR is otherwise ready, invoke CodeRabbit exactly once with a full review request. Record the invocation URL/time. Do not invoke it on the feature PR and do not ask twice on the promotion PR.
 6. Wait for the review. For each comment, reproduce the claimed behavior against the exact PR commit, classify it as valid/invalid/uncertain, and save the evidence. Use `superpowers:receiving-code-review` or the repository's CodeRabbit review skill when available.
 7. Fix valid findings in focused `fix/*` commits or a focused promotion branch that is safely merged back through `dev`; ensure the promotion diff remains exactly `dev` → `main`. Document rejected comments with concise technical evidence. Do not request a second CodeRabbit pass.
@@ -133,7 +133,7 @@ For each `#### TASK-ID —` item in `002-complete-execution-orchestration.md`:
 | Windows/Android signing key missing or compromised | Release signing/verification gate fails | Halt release, rotate/revoke via runbook, rebuild from provenance, and never ship an unsigned stable artifact |
 | CodeRabbit comment conflicts with specs/tests | Reproduction disproves claim | Document rejection with paths/tests; do not change code merely to satisfy the comment |
 | CodeRabbit uncovers a systemic issue late in promotion | Reproduction shows issue spans prior commits | Block promotion, create focused fix tasks, preserve the one review record, and obtain user direction if a fresh PR/review is necessary |
-| Commit or changed-file budget would be exceeded | Preflight count reaches threshold | Cut a coherent PR before the hard limit; if over 280 files before promotion review, split/revert the batch before invoking CodeRabbit |
+| Commit or changed-file budget would be exceeded | Preflight count reaches threshold | Cut a coherent PR before the hard limit; keep the packet at or below 260 files and split/revert before crossing the 280-file review stop |
 | User sends stop/override instruction | New message replaces or pauses active scope | Reach a safe boundary, preserve work, record exact state, and stop; do not continue autonomously |
 
 ## End-of-session handoff record
@@ -175,7 +175,7 @@ Live verified checkpoint: branch [BRANCH], HEAD [HEAD], origin/dev [DEV], origin
 
 Resume batch [BATCH_ID] and task [TASK_ID] only after proving their dependency/entry gates, branch ownership, and commit/file budgets. Follow test-first atomic delivery: canonical contracts when the interface changes, failing domain/state tests, PostgreSQL migration/tenant/transaction/outbox tests when durable state changes, implementation through ports, vertical client/adapter coverage when the task involves client behavior, safe telemetry/recovery, traceability evidence, scoped checks, repo:check, repo:build, diff review, and one reversible commit. For documentation-only or other non-durable/non-client tasks, record why those conditional tests do not apply. Do not mark merged code verified without all evidence. Run pnpm installation/check/test/build commands sequentially within one worktree.
 
-Git flow is fixed: feat/* or fix/* → PR to dev with hosted checks and no CodeRabbit; merge preserving atomic commits; immediately open dev→main; request exactly one CodeRabbit full review there; reproduce every comment, fix only valid findings, document rejected ones, never request a second review on that PR. Prefer 30–70 commits, hard cap 99, and do not invoke the promotion review over 280 changed files.
+Git flow is fixed: feat/* or fix/* → PR to dev with hosted checks and no CodeRabbit; merge preserving atomic commits; immediately open dev→main; request exactly one CodeRabbit full review there; reproduce every comment, fix only valid findings, document rejected ones, never request a second review on that PR. Prefer 30–50 commits, exceptional ceiling 79, and keep the promotion packet at or below 260 changed files without crossing the 280-file review stop.
 
 Keep PostgreSQL authoritative, Redis ephemeral, tenant scope explicit, originals/versions immutable, Hybrid default, Local content/path out of cloud, workers without database credentials, Desktop/sidecar allowlisted, Android background payloads content-free, Vietnamese and English complete, and external providers replaceable. Stop and record state for destructive migration risk, unknown overlapping changes, privacy/security fail-open behavior, missing production/signing authority, or a spec conflict. End with the exact handoff record from the runbook.
 ```