# Finalize content-model Task 17 from a32d0e56

## Objective

Close only Task 17 from clean commit `a32d0e566b69ca00f76a884ffc1c1f8b14862ee2`: independently review the complete implementation range `33e7a1ba..HEAD`, repair every verified P1/P2 without redesigning the program, prove the truthful D1/PostgreSQL capability split, finish the previously timed-out content-store acceptance with a bounded targeted run, clear or rigorously classify every warning, run the focused Node 22 DB/content/fields/fields-react quality gate, and commit any actual fixes. Do not begin Tasks 2–16 or 18.

The new `specs/ab54f1f4_task-17-finalization.md` is orchestration process state, not evidence that implementation changes were required.

## Sources of truth and fixed constraints

Read before reviewing or editing, in this order:

1. `docs/specs/2026-08-08-content-types-complete-design.md`.
2. `docs/specs/2026-08-08-fields-complete-design.md`, especially the final `FieldGroup`/`FieldDefinitionVersion`, recursive bounds, transaction, storage, extension, and acceptance sections.
3. `docs/specs/2026-08-08-mod-cms-content-model-completion-design.md`.
4. `docs/plans/2026-08-08-mod-cms-content-model-completion.md`, Task 17 and its completion rule, plus the matching JSONL where contract consistency is relevant.
5. `docs/standards/coding-standard.md` §2, §4, R1–R3 and `docs/standards/authz.md`.
6. Prior process records `specs/c48f09a5_task-17-final-review_v2.md` and `specs/dcce95b4_d1-batch-contract.md`; canonical docs above win.

Keep these invariants fixed:

- D1 exposes ordinary query execution and a typed atomic batch backed by one real Cloudflare `binding.batch(...)`; it has no callback transaction and no transaction identity.
- PostgreSQL retains a genuine callback transaction, callback-scoped opaque identity, exact object identity, inactive-capability rejection, independent-transaction rejection, and real rollback.
- Task 17 reads existing flat content/field corpora without registry enforcement or migration. Do not start Tasks 2 or 7 or implement later registry/value services.
- Preserve the package DAG and all established public exports. Core remains host/framework/validator/provider agnostic. No source-app defaults, identity constructors, unbounded memoization, warning suppression, or test-only fake atomicity.
- Never modify `apps/mod-cms`, `../mod-cms`, distro/posts-list work, generated `dist`, or unrelated packages. In particular, never touch `/home/user/Projects/platform/.worktrees/mod-cms` or its sibling source checkout.
- Use Node 22 for every Node/pnpm command: begin each shell with `export PATH="$HOME/.nvm/versions/node/v22.23.1/bin:$PATH"` and confirm `node --version` once. Call tools by bare name and judge commands only by exit status.
- Run expensive real-Postgres commands serially. Do not fan out test runners or recursively spawn agents; the shared build box has prior fork/concurrency failure history.
- Treat a successful command with owned warnings as not clean. Never suppress, filter, redirect, allowlist, or hide warning text.

## 1. Baseline and complete-range inventory

1. Verify `git rev-parse HEAD` is exactly `a32d0e566b69ca00f76a884ffc1c1f8b14862ee2` and inspect `git status --short --branch`. The only expected new path is this planner artifact. Do not reset, amend, squash, or rewrite the seven commits after `33e7a1ba`.
2. Record `git log --oneline 33e7a1ba..HEAD`, `git diff --stat 33e7a1ba..HEAD`, `git diff --name-status 33e7a1ba..HEAD`, and focused diffs for:
   - `packages/db/src/{transaction.ts,sqlite/d1.ts,sqlite/index.ts,adapters.test-d.ts,sqlite/d1.test.ts}` and DB metadata;
   - `packages/content/src/{schema.ts,store.ts,index.ts,conformance.test.ts,pg-harness.ts}` plus all other content files changed in the range;
   - `packages/fields/src/{schema.ts,store.ts,index.ts,conformance.test.ts,definition-version.test.ts,pg-harness.ts}`;
   - changed `packages/fields-react` consumers/tests, package manifests, lockfile, and authoritative docs.
3. Compare `packages/content/src/index.ts`, `packages/fields/src/index.ts`, package export maps, and consumable type names against `33e7a1ba`. Distinguish preserved legacy flat-store types from the authoritative final fields contract; do not widen `FieldDefinitionVersion.definition` away from final `FieldGroup`.
4. Run `git diff --check 33e7a1ba..HEAD` and inspect for forbidden paths, generated output, temporary logs, warning captures, or unrelated edits.

## 2. First independent review

Launch exactly one fresh reviewer using `gpt-5.6-sol` at `low` thinking. Give it the complete `33e7a1ba..HEAD` diff plus current uncommitted implementation repairs (if any) and all sources of truth above. Require actionable P1/P2/P3 findings with file/line evidence; do not ask it to edit.

The review must explicitly verify:

- Task 17’s minimum final stores parse and deeply freeze genuine D1 and embedded real-Postgres rows, preserve arbitrary legacy type/status and exact field lane values, return structural errors for malformed trust-boundary rows, and do not enforce future registries/migrations.
- D1’s public runtime and emitted type surface have query + prepared atomic batch only, no `transaction`/identity claim, no casts or callback shim, no sequential `BEGIN`/`COMMIT`, one binding batch call, heterogeneous result typing, structural cross-copy error guard, and a valid-write/failing-statement rollback proof.
- PostgreSQL uses the real adapter callback and database rollback; same-callback identity works, independently minted and escaped/inactive capabilities fail before effects, and combined-schema identity remains assignable to narrow package transaction contracts without wrappers/casts at consumers.
- Both conformance files mandate and visibly identify real Miniflare D1 and embedded PostgreSQL; neither fixture is optional, skipped, mocked, or able to pass using the other fixture’s values.
- Root/subpath exports, DTS, structural guards, `FieldDefinitionVersion.definition === FieldGroup`, canonical hash verification, whole-graph bytes/depth/1,000-node limits, deep immutability, unsafe-property/accessor/prototype rejection, and Task 7/8 forward compatibility remain correct.
- §2/§4/R1–R3: no speculative layers, leaked internal/provider types, source defaults, identity ceremony, unbounded caches, host dependencies, warning suppression, or missing behavioral/type coverage for changed exports.
- The authoritative Markdown specs, Markdown plan, and JSONL remain mutually truthful about D1 versus PostgreSQL; flag a real contradiction rather than recommending code divergence.
- Warning and timeout behavior is not being hidden by test configuration or overly short local test timeouts.

Independently validate each reported P1/P2 against code/spec before accepting it. Record false positives with evidence. P3 is non-blocking only when genuinely outside Task 17 and not a seam, trust-boundary, atomicity, data-loss, or acceptance defect.

## 3. Fix loop using the requested implementation model

For every verified P1/P2 or project-controlled warning, use `gpt-5.6-terra` at `high` thinking for the fix. Give it one bounded, self-contained defect with the authoritative contract, affected files, and required RED/GREEN command. Wait for it before starting another fix; inspect its diff yourself.

Use TDD for behavioral defects:

1. Add the smallest discriminating failing test/type assertion in the owning package (`*.test.ts`, never `.spec.ts`).
2. Run only that test to establish RED.
3. Make the minimum robust correction and rerun GREEN.
4. Run any directly adjacent regression tests before moving on.

Likely files are limited to the DB D1 capability/tests/barrel, content/fields schema/store/barrel/conformance/PG harness tests, and direct fields-react type consumers/tests. Package manifests/lockfile may change only for a demonstrated direct test/build dependency. If a canonical contract is actually wrong or contradictory, stop code changes, amend all authoritative spec/plan representations consistently first, then resume; never silently diverge. Do not broaden into later task implementations.

## 4. Warning provenance and locale handling

Retain complete unfiltered stdout/stderr for focused receipts while judging exit status separately.

1. Reproduce each warning with its smallest owning command. Pay special attention to embedded-Postgres locale output from `packages/content/src/pg-harness.ts` and `packages/fields/src/pg-harness.ts`; their locale discovery currently invokes `locale -a`, and their `initdb`/server environment and arguments are project-controlled.
2. If repository code/configuration/environment selection triggers the warning, fix the cause through the Terra/high loop. Prefer a deterministic valid locale environment/explicit initdb locale and truthful harness behavior; do not silence stderr or weaken the real-Postgres fixture.
3. Classify a warning as environment-only only after proving it with a minimal direct reproduction outside repository control under explicit `LC_ALL=C`/`LANG=C` (record command, environment, binary/version, exit status, and exact stderr) and showing no repository-owned invocation or option can eliminate it without falsifying acceptance. “It came from an external binary” alone is not proof.
4. Rerun the owning focused receipt after every warning fix. Completion requires zero project-controlled test/build warnings. Handoff any environment-only warning as an explicit evidence-backed exception, not an omission.

## 5. Complete the timed-out content-store acceptance

Do not substitute another suite or silently skip it. Run the exact store file by Vitest path, serially, under the package’s configured `realPg` config:

```bash
export PATH="$HOME/.nvm/versions/node/v22.23.1/bin:$PATH"
pnpm --filter @platform-modules/content exec vitest run --config vitest.config.ts src/store.test.ts
```

Give the shell/tool an explicit bounded wall-clock allowance appropriate to the configured gate (10 minutes is sufficient; Vitest itself retains the repository’s 180-second per-test/300-second hook bounds). Record elapsed time, exit status, test counts, and all warnings. If it times out again, identify the exact hanging test/resource, fix a verified project defect with Terra/high, and rerun this same targeted command; do not raise timeouts indefinitely or replace PGlite/real DB behavior with mocks. If `store.concurrency.test.ts` was part of the prior failed receipt or is touched by a fix, run it separately with the same bounded allowance.

## 6. Final focused Node 22 quality gate

Run commands separately and serially so every exit status and warning source is attributable. The four package-level test runs are focused to the requested subsystem set and include the targeted Task 17/conformance coverage; retain the explicit store receipt above even though content’s package test overlaps it.

```bash
export PATH="$HOME/.nvm/versions/node/v22.23.1/bin:$PATH"
node --version
pnpm --filter @platform-modules/db test
pnpm --filter @platform-modules/content test
pnpm --filter @platform-modules/fields test
pnpm --filter @platform-modules/fields-react test
pnpm --filter @platform-modules/db typecheck
pnpm --filter @platform-modules/content typecheck
pnpm --filter @platform-modules/fields typecheck
pnpm --filter @platform-modules/fields-react typecheck
pnpm --filter @platform-modules/db build
pnpm --filter @platform-modules/content build
pnpm --filter @platform-modules/fields build
pnpm --filter @platform-modules/fields-react build
git diff --check
```

Use a bounded allowance of up to 10 minutes per package test/build command, not one unbounded chained shell. Also retain explicit focused receipts for the core Task 17 files so both mandatory fixtures and immutable-definition checks are easy to audit:

```bash
pnpm --filter @platform-modules/content exec vitest run --config vitest.config.ts src/index.test.ts src/conformance.test.ts
pnpm --filter @platform-modules/fields exec vitest run --config vitest.config.ts src/definition-version.test.ts src/index.test.ts src/conformance.test.ts
pnpm --filter @platform-modules/db exec vitest run --config vitest.config.ts src/transaction.test.ts src/sqlite/d1.test.ts
```

Inspect successful build output for warnings and emitted DTS/public exports; zero exit alone is insufficient. If a repair touches another co-located behavior, run that exact test too. Do not broaden to the monorepo-wide gate unless a shared file outside these four packages becomes legitimately necessary.

## 7. Repeat review until closed

After fixes and all gates are clean, run a new independent `gpt-5.6-sol/low` review over the entire updated `33e7a1ba..HEAD` range including uncommitted repairs. Require the same checklist and an explicit `P1/P2: none` conclusion.

If it reports a verified P1/P2, send the bounded fix to `gpt-5.6-terra/high`, rerun the narrow RED/GREEN test, rerun the complete focused gate in §6, and request another fresh Sol/low review. Continue until one final review reports no P1/P2. Wait for every spawned reviewer/fixer; never claim a background result early.

## 8. Scope audit, commit, and handoff

1. Inspect `git diff --name-only 33e7a1ba..HEAD`, `git diff --stat`, the uncommitted diff, and `git status --short`. Reject forbidden/unrelated files and remove generated `dist`, DB state, caches, logs, and scratch review output.
2. Confirm docs remain spec-first consistent, D1 has no callback/identity claim, PostgreSQL retains exact callback identity, and no Task 2–16/18 work entered the diff.
3. If actual fixes exist, commit only the scoped fixes (and the planner artifact if repository process requires carrying it) with normal hooks and an imperative subject such as `Finalize content-model Task 17`. Do not bypass hooks. Verify the commit and a clean implementation status.
4. If review finds no implementation changes necessary, do not manufacture a code change or treat no product diff as failure. Return a review-and-acceptance receipt; identify the planner artifact separately as orchestration state and do not misrepresent it as a Task 17 fix.
5. Handoff:
   - final commit SHA, or explicit “no implementation changes”;
   - every command, elapsed time, exit status, passed test count, and warning status;
   - completed targeted content-store receipt;
   - identified D1 and embedded real-Postgres execution/rollback evidence;
   - D1 public runtime/DTS no-transaction result and PostgreSQL identity result;
   - warning fixes or evidence-backed environment-only classifications;
   - final Sol/low review text showing P1/P2 none;
   - final `git status --porcelain` and any orchestration-only artifact disposition.

## Definition of done

Task 17 alone is closed when the complete diff has a final independent `gpt-5.6-sol/low` P1/P2-none review; every verified fix was produced through `gpt-5.6-terra/high`; D1 truthfully proves one-shot binding-batch rollback without callback identity; PostgreSQL proves genuine callback rollback and exact identity; real D1/Postgres content and fields fixtures execute; the timed-out content store command completes under a bounded run; all requested DB/content/fields/fields-react tests, typechecks, and builds pass on Node 22 with no project-controlled warnings; spec-first consistency and public contracts hold; no later task or forbidden checkout was touched; and actual fixes are committed, or a no-change review/acceptance receipt is returned.