# Finalize content-model Task 17 from `35595bce`

## Objective

Close Task 17 only from clean commit `35595bce692bd23701f2f1abcf94653a67f567d3`. Review the complete implementation range `33e7a1ba..HEAD` against the current content, fields, and integration contracts; fix every independently verified P1/P2 with the `gpt-5.6-terra/high` builder; prove the truthful D1/PostgreSQL capability split; run the focused Node 22 gates without owned warnings; and obtain a final independent `gpt-5.6-sol/low` report stating `P1/P2: none`.

The Factory run `8aae5cd5` receipt is accepted as current-tree evidence: under Node 22, `packages/content/src/store.test.ts` passed 52/52 in 211.30s with `EXIT=0` after reusing and closing one PGlite handle. Do not rerun that broad store test while the code it covers remains unchanged.

## Sources of truth

Read before editing, in this order:

1. `docs/specs/2026-08-08-content-types-complete-design.md`.
2. `docs/specs/2026-08-08-fields-complete-design.md`, especially the final `FieldGroup`/`FieldDefinitionVersion`, recursive bounds, storage, transaction, extension, and acceptance sections.
3. `docs/specs/2026-08-08-mod-cms-content-model-completion-design.md`, especially Wave A, combined transactions, and equivalent adapter atomicity.
4. `docs/plans/2026-08-08-mod-cms-content-model-completion.md`, Task 17 and completion requirements, plus the matching JSONL task record.
5. `docs/standards/coding-standard.md` §2, §4, and R1–R3; consult `docs/standards/authz.md` for trusted whole-corpus/non-enumerating seams.
6. Prior process records `specs/dcce95b4_d1-batch-contract.md`, `specs/ab54f1f4_task-17-finalization_v2.md`, and `specs/8aae5cd5_content-test-hang.md` only as history. Canonical docs above win.

## Fixed constraints

- The builder is `gpt-5.6-terra/high`. Do not delegate implementation to another model.
- Every independent review must explicitly use model `openai-codex/gpt-5.6-sol` with `low` thinking, must not edit, and must report actionable P1/P2/P3 findings with file/line evidence.
- D1 exposes ordinary queries plus typed prepared items submitted by one genuine Cloudflare `binding.batch(...)`. It has no callback transaction, `TransactionIdentity`, callback shim, casted transaction, or sequential `BEGIN`/`COMMIT` emulation.
- PostgreSQL exposes a genuine callback transaction with one callback-scoped opaque identity, exact object identity, rollback, inactive-capability rejection, and independent-transaction rejection. One combined-schema transaction remains assignable to narrower package transaction seams without consumer casts/wrappers.
- Task 17 freezes minimum final contracts and reads the existing flat corpus without enforcing future registries. Do not start Tasks 2–16 or 18, migrations, recursive writes, registry lifecycle, coordinators, admin UI, publication, or deployment.
- Never modify `apps/mod-cms`, `../mod-cms`, another worktree, Posts-list/distro work, generated `dist`, or unrelated packages.
- Prefix every Node/pnpm command with `PATH=$HOME/.nvm/versions/node/v22.23.1/bin:$PATH`. Run real-database commands serially and with bounded timeouts. Judge commands by exit status, then inspect successful output separately for warnings.
- Project-controlled warnings are blocking. Never suppress, filter, redirect, allowlist, force-exit, skip a fixture, weaken tree-shaking, or hide warning text.
- Preserve existing public exports and package topology. Vitest files use `.test.ts`; no unsupported `node:` imports in module/test code and no runtime environment reads in host-agnostic client/React source.
- If a canonical contract is genuinely wrong, ambiguous, or incomplete, stop and amend the authoritative spec and plan before changing code. Otherwise do not edit canonical docs.

## 1. Freeze the baseline and inventory the complete range

1. Confirm `git rev-parse HEAD` is exactly `35595bce692bd23701f2f1abcf94653a67f567d3`. Inspect `git status --short --branch`; only this new planner artifact is expected process state. Do not reset, amend, squash, or rewrite the eight Task 17 commits after `33e7a1ba`.
2. Record `git log --oneline 33e7a1ba..HEAD`, `git diff --stat 33e7a1ba..HEAD`, `git diff --name-status 33e7a1ba..HEAD`, and `git diff --check 33e7a1ba..HEAD`.
3. Inspect the full focused diffs and current source for:
   - `packages/db/src/transaction.ts`, `packages/db/src/sqlite/{d1.ts,d1.test.ts,index.ts}`, `packages/db/src/adapters.test-d.ts`, and DB metadata;
   - every changed `packages/content/**` file, especially `schema.ts`, `store.ts`, `index.ts`, `conformance.test.ts`, `pg-harness.ts`, warning-related source modules, and the final `store.test.ts` handle cleanup;
   - every changed `packages/fields/**` file, especially `schema.ts`, `store.ts`, `index.ts`, `definition-version.test.ts`, `conformance.test.ts`, and `pg-harness.ts`;
   - changed `packages/fields-react` consumers, package manifests, lockfile, and the five authoritative spec/plan files changed to make D1 atomicity truthful.
4. Compare content/fields root barrels, subpath export maps, runtime exports, and consumable type names with `33e7a1ba`. Preserve the legacy flat-store compatibility surface while keeping `FieldDefinitionVersion['definition']` exactly the final bounded `FieldGroup`.
5. Reject forbidden paths, generated output, DB state, caches, logs, and review scratch files. Do not interpret the existing committed specs/plans as permission to implement later tasks.

## 2. First independent complete-range review

Launch a fresh read-only subagent with `model: "openai-codex/gpt-5.6-sol"` and `thinking: "low"`. Give it the repository path, current SHA, complete `33e7a1ba..HEAD` diff plus any current uncommitted implementation changes, and all sources above. Require an explicit P1/P2/P3 report and these checks:

- D1 public runtime, public subpath, type assertions, and emitted DTS expose query/prepare/atomic batch but no transaction or identity; exactly one binding batch is used; empty/failed batches return structural cross-copy errors; a valid first write plus failing second statement proves real rollback.
- PostgreSQL harnesses use genuine database callbacks and rollback; same-callback identity succeeds; independent and escaped/inactive identities reject before effects; no participant or fixture fakes callback atomicity.
- Both package conformance suites visibly require distinct real Miniflare D1 and embedded real-Postgres fixtures. Neither may skip, mock, use static substitute rows, or accidentally compare one fixture with itself.
- Content final-store reads preserve arbitrary legacy type/status/date/value data, deterministic order, detached deep immutability, structural malformed-row errors, and non-enforcing trusted-corpus scope.
- Fields final-store reads preserve exact numeric digits (including beyond `Number.MAX_SAFE_INTEGER`, high precision, and extreme legal decimals), boolean/date/text/reference/JSON lanes, exactly-one-lane invariants, deterministic order, detached deep immutability, and structural rejection of malformed/unsafe rows.
- `FieldDefinitionVersion.definition`, normalized registry records, and future Task 7 rows share exactly final `FieldGroup`; parsing verifies canonical SHA-256 bytes, stable object-key ordering, group identity, required/optional field-specific rules, whole-graph 12-depth/1,000-field/byte limits, duplicate identities, accessors/symbols/cycles/unsafe prototypes/prototype-pollution keys, and deeply frozen detached plain output. Extension dispatch remains explicit and Task 7/8-forward without a global registry.
- Public export preservation, structural guards rather than cross-copy `instanceof`, fields-react compatibility, and §2/§4/R1–R3 compliance: no source defaults, identity ceremony, unbounded cache, provider/framework leak, speculative layer, warning suppression, or missing changed-export coverage.
- The Markdown specs, Markdown plan, and JSONL consistently describe equivalent observable atomicity via different adapter capabilities.
- The `35595bce` PGlite lifecycle fix truly reuses one handle, resets state between tests, closes it deterministically, and does not weaken test isolation.

Independently validate every proposed P1/P2 against the source and canonical contract before accepting it. Record false positives with evidence. A trust-boundary, atomicity, data-loss, public-seam, or mandatory-acceptance defect cannot be downgraded to P3.

## 3. Repair loop with narrow RED/GREEN evidence

For each verified P1/P2, the Terra/high builder makes the smallest robust in-scope fix:

1. Add or strengthen the smallest owning co-located test/type assertion that fails for the defect. Use `packages/db/src/sqlite/d1.test.ts` or `adapters.test-d.ts` for D1 surface issues; package conformance tests for adapter/store defects; `packages/fields/src/definition-version.test.ts` for immutable definition parsing; root `index.test.ts` files for export regressions; and the directly affected fields-react test for consumer behavior.
2. Run that narrow test once to establish RED, fix the cause, and rerun it for GREEN. Do not repeatedly rerun an unchanged deterministic failure.
3. Keep changes inside DB D1/transaction contracts, Task 17 content/fields schema/store/barrel/conformance/harness files, direct fields-react consumers, and demonstrated metadata/lockfile needs. A warning-only source refactor may touch the owning content module and its co-located test. Do not create service/repository/controller layers or expose parser internals merely for tests.
4. If a fix changes `packages/content/src/store.ts`, `store.test.ts`, its schema, or another source transitively exercised by `store.test.ts`, invalidate the Factory receipt and rerun the exact store command once after stabilization with a 10-minute bound. Otherwise retain the 52/52, 211.30s, `EXIT=0` receipt and do not run either `src/store.test.ts` or broad `pnpm --filter @platform-modules/content test`.
5. If a fix touches feed/search/search-sqlite/revisions/taxonomy/settings behavior, run its exact co-located test. If a public fields-react type changes, run the exact affected fields-react test in addition to typecheck/build.
6. Reinspect every fix for scope, truthful capabilities, no warning suppression, and no later-task implementation before broad verification.

## 4. Locale and warning provenance

1. Keep complete, unfiltered stdout/stderr for focused conformance and builds. Confirm the current mirrored `bestLocale()` changes in `packages/content/src/pg-harness.ts` and `packages/fields/src/pg-harness.ts` use truthful locale precedence across discovery, `initdbCached`, explicit `--lc-messages`, and the spawned server.
2. Run `env LC_ALL=C LANG=C locale -a` directly and record environment, binary/version where available, exit status, and stderr. This is diagnostic evidence, not permission to ignore repository warnings.
3. The content and fields conformance runs below must be free of locale warnings. If a repository-owned invocation or environment selection causes one, fix the cause in both mirrored harnesses where applicable and rerun both conformance files.
4. Classify a warning as environment-only only when the same warning reproduces in the minimal direct external command under explicit `LC_ALL=C LANG=C`, repository code/options cannot eliminate it without falsifying the fixture, and the exact evidence is included in the handoff. “External binary emitted it” is insufficient.
5. Inspect every successful DB/content/fields/fields-react build phase, including DTS, for warnings/notices. Zero exit with owned warning text is red.

## 5. Focused Node 22 quality gate

Run serially, with each command in its own shell, an explicit bounded allowance (up to 10 minutes where real DB/build work requires it), and the exact Node 22 PATH prefix:

```bash
PATH=$HOME/.nvm/versions/node/v22.23.1/bin:$PATH node --version
PATH=$HOME/.nvm/versions/node/v22.23.1/bin:$PATH pnpm --filter @platform-modules/db exec vitest run --config vitest.config.ts src/transaction.test.ts src/sqlite/d1.test.ts
PATH=$HOME/.nvm/versions/node/v22.23.1/bin:$PATH pnpm --filter @platform-modules/content exec vitest run --config vitest.config.ts src/index.test.ts src/conformance.test.ts
PATH=$HOME/.nvm/versions/node/v22.23.1/bin:$PATH pnpm --filter @platform-modules/fields exec vitest run --config vitest.config.ts src/definition-version.test.ts src/index.test.ts src/conformance.test.ts
PATH=$HOME/.nvm/versions/node/v22.23.1/bin:$PATH pnpm --filter @platform-modules/fields-react test
PATH=$HOME/.nvm/versions/node/v22.23.1/bin:$PATH pnpm --filter @platform-modules/db typecheck
PATH=$HOME/.nvm/versions/node/v22.23.1/bin:$PATH pnpm --filter @platform-modules/content typecheck
PATH=$HOME/.nvm/versions/node/v22.23.1/bin:$PATH pnpm --filter @platform-modules/fields typecheck
PATH=$HOME/.nvm/versions/node/v22.23.1/bin:$PATH pnpm --filter @platform-modules/fields-react typecheck
PATH=$HOME/.nvm/versions/node/v22.23.1/bin:$PATH pnpm --filter @platform-modules/db build
PATH=$HOME/.nvm/versions/node/v22.23.1/bin:$PATH pnpm --filter @platform-modules/content build
PATH=$HOME/.nvm/versions/node/v22.23.1/bin:$PATH pnpm --filter @platform-modules/fields build
PATH=$HOME/.nvm/versions/node/v22.23.1/bin:$PATH pnpm --filter @platform-modules/fields-react build
PATH=$HOME/.nvm/versions/node/v22.23.1/bin:$PATH git diff --check 33e7a1ba..HEAD
```

Also run `git diff --check` for uncommitted repairs. Verify built D1 subpath/DTS has no `transaction` member and preserves typed heterogeneous batch results; do not commit `dist`.

Do not run the full content package suite on an unchanged store path. If §3 invalidated the accepted store receipt, run only:

```bash
PATH=$HOME/.nvm/versions/node/v22.23.1/bin:$PATH pnpm --filter @platform-modules/content exec vitest run --config vitest.config.ts src/store.test.ts
```

Record elapsed time, test count, exit status, and warnings. A timeout or completed tests followed by a stuck process is red; do not raise timeouts or force exit.

## 6. Final independent review and closure loop

After the candidate diff and all gates are clean, launch a fresh read-only reviewer using `model: "openai-codex/gpt-5.6-sol"`, `thinking: "low"`, over the entire updated `33e7a1ba..HEAD` range including uncommitted repairs. Give it the same checklist and quality receipts. Require the report to end with an explicit `P1/P2: none` when clean.

If it reports a verified P1/P2, repair it with the Terra/high builder, run narrow RED/GREEN coverage, rerun the complete focused gate in §5 (plus the conditional store/adjacent tests), and request another fresh Sol/low review. Continue until the current candidate has a final P1/P2-none report. Wait for every spawned reviewer before claiming completion.

## 7. Scope audit, commit disposition, and handoff

1. Inspect `git diff --name-only 33e7a1ba..HEAD`, `git diff --stat 33e7a1ba..HEAD`, the complete uncommitted diff, and `git status --short`. Remove generated `dist`, PostgreSQL/Miniflare/PGlite state, caches, logs, and scratch output. Reject Tasks 2–16/18 and forbidden checkout changes.
2. Confirm D1 remains one-shot batch-only, PostgreSQL remains genuine callback identity/rollback, both mandatory fixtures execute distinctly, canonical docs remain consistent, and locale/build output is warning-clean or has rigorous environment-only evidence.
3. If actual implementation/spec fixes exist, commit the scoped repair and this planner artifact with normal hooks and an imperative subject such as `Finalize content-model Task 17`; do not bypass hooks. Verify the commit and report final porcelain.
4. If no code/spec fix is needed, do not manufacture a product change and do not fail because there is no implementation commit. Treat the planner artifact as orchestration state and return the complete review/quality receipt without misrepresenting it as a Task 17 fix.
5. Handoff must include:
   - starting SHA and final SHA, or explicit “no implementation changes”;
   - final Sol/low review text with `P1/P2: none` and disposition of any P3;
   - every final command, candidate SHA, elapsed time, exit status, passed counts, and warning status;
   - retained Factory store receipt, or the replacement exact store receipt if invalidated;
   - real D1 binding-batch rollback evidence and public runtime/DTS no-transaction result;
   - real PostgreSQL callback rollback, same/independent/inactive identity evidence;
   - identified content/fields fixture names and proof both executed;
   - locale direct reproduction and warning classification;
   - files changed and why, scope confirmation, and final `git status --porcelain` (distinguishing any orchestration-only plan file).

## Definition of done

Task 17 is closed only when the complete diff has a final independent `gpt-5.6-sol/low` P1/P2-none review; every verified P1/P2 was fixed by the Terra/high builder; D1 truthfully proves one real atomic binding batch without callback identity; PostgreSQL proves genuine callback rollback and exact identity; content/fields real D1 and embedded-Postgres fixtures pass distinctly; the accepted store receipt remains valid or is replaced after relevant code changes; all focused Node 22 tests, typechecks, and builds exit zero with no project-controlled warnings; locale warnings are absent or rigorously proven environment-only; no later task or forbidden checkout was touched; and either scoped fixes are committed or a no-change review/quality receipt is returned.