Wave 1 — stop the bleeding: three CRITICALs, the cost cap, and ADR-0073/0074 - #81

Merged

cemililik merged 114 commits into

mainfrom

Aug 9, 2026

Commits on Jul 29, 2026

docs(roadmap): close Wave 0 — finish its markdown items and mark the phase tasks done

cemililik
and
claude
committed
5294aa3
fix(cli): sanitize workflow terminal projections

cemililik
and
claude
committed
4e2a18b
test(cli): correct terminal hardening traceability

cemililik
and
claude
committed
d71ebf0
fix(cli): keep final-summary errors on one row

cemililik
and
claude
committed
9c85537
style(cli): format terminal hardening boundaries

cemililik
and
claude
committed
062a1c5
fix(cli): sanitize human-gate timeout actions

cemililik
and
claude
committed
94e96f5
fix(cli): make POSIX job control terminal-safe

cemililik
and
claude
committed
15ecfe0
fix(core): redact the tool-approval preview like sanitizeInput() already does (#91)

cemililik
and
claude
committed
51d0a8e
docs(decisions): add ADR-0073 — history.db migration lock (Proposed)

cemililik
and
claude
committed
f12b71c
fix(db): retry SQLITE_BUSY_SNAPSHOT and add the async retry twin (#100, #226)

cemililik
and
claude
committed
ba9478c
fix(cli,db): stop a transient history.db write from killing the chat session (#228)

cemililik
and
claude
committed
0f0b387
fix(core): scrub the approval path per segment; fold the #91 Opus review

cemililik
and
claude
committed
31b4cd4
fix(db): give createClient a typed error and document all four PRAGMAs (#104, #105)

cemililik
and
claude
committed
8bf965a
fix(core,cli): classify from an unredacted copy, not the redacted preview (#91)

cemililik
and
claude
committed
c2ece5a
fix(cli): harden job-control handoff

cemililik
and
claude
committed
1c0dd5b
fix(db,cli): write each chat turn in one transaction (#228 B2)

cemililik
and
claude
committed
ec1d1cb
fix(cli): recover onboarding terminal ownership

cemililik
and
claude
committed
f3b729a
fix(core): enforce parallel budget admissions

cemililik
and
claude
committed
c0ce389
fix(core): harden budget admission accounting
cemililik
committed
e4c5d9a
fix(cli): wire the listener sink for real; test and sanitize the process net (#228 B1, H1-H3)

cemililik
and
claude
committed
e39402d
fix(db): add SQLITE_BUSY_RECOVERY, bound the loop structurally, pin the async twin

cemililik
and
claude
committed
8bc9467
docs(decisions): revise ADR-0073 against the maintainer review (still Proposed)

cemililik
and
claude
committed
d3a09d5
fix(cli): guard the deprecationDate conversion so one bad row cannot kill /models (G1)

cemililik
and
claude
committed
90f3219

Commits on Jul 30, 2026

fix(db,cli): serialize runMigrations across processes; unconditional 0600 (#99, #28, #33)

cemililik
and
claude
committed
2652e1c
test(db): document what the two-process race actually proves

cemililik
and
claude
committed
02cb65f
revert(db): restore writeTurn's withBusyRetry wrapper

cemililik
and
claude
committed
77028b7
fix(cli,db): stop a failed turn's tokens leaking into the totals; pin BEGIN IMMEDIATE

cemililik
and
claude
committed
114aa28
test(cli): stop the new tests leaking unhandled rejections (CI was RED)

cemililik
and
claude
committed
31d78bb
Merge branch 'fix/cli-terminal-projection-pr' into development
cemililik
committed
9668afa
Merge branch 'fix/cli-job-control' into development
cemililik
committed
0a2323c
Merge branch 'fix/core-budget-governor-pr' into development
cemililik
committed
642b7d6
Merge branch 'wave1/lanes-a-c' into development
cemililik
committed
cf3a5d0
style: format the five files the required gate flagged after consolidation

cemililik
and
claude
committed
3805010
docs(decisions): land the budget-commitment ADR as 0074 (was an uncommitted 0073 draft)

cemililik
and
claude
committed
a59800f
fix(db,cli,docs): replace the unsound migration lock; fold the PR #81 review

cemililik
and
claude
committed
b685f2d
docs(decisions): make ADR-0073's current decision normative; fix two weak tests

cemililik
and
claude
committed
a82b7ac
docs(decisions): review ADR-0074 — correct a false premise, add the four missing amendment notes

cemililik
and
claude
committed
2b52961
fix(llm): disable the vendor SDK's own retry in production (#276)

cemililik
and
claude
committed
67f982d
fix(core): give the session's primary chain entry a retry budget (#276 regression)

cemililik
and
claude
committed
970bb02
fix(cli): dispose removes the SIGTSTP listener too, not just SIGCONT (lane c, G0)

cemililik
and
claude
committed
4742dcb
fix(llm,docs): give the off-chain paths their retry back; fold the rest of the #276 review

cemililik
and
claude
committed
e330f3e
feat(llm): honour the provider's Retry-After in the chain's backoff (#279)

cemililik
and
claude
committed
67a8487
fix(llm): narrow the cost-recording catch and bound Usage at the money call site (#194, #198)

cemililik
and
claude
committed
7633713
fix(llm,cli): revert the off-chain SDK retry (it opened a DoS) and sanitize two command sinks

cemililik
and
claude
committed
5873a9d
fix(core,llm): close the #276 regression on unauthored workflow nodes; pin the Retry-After wire

cemililik
and
claude
committed
99f79ca
docs(decisions): accept ADR-0074 — settle forward-compatibility; sanitize the third render leaf

cemililik
and
claude
committed
cd0a3bb
fix(cli): restore the cursor on Ctrl-Z during a run (G0's residue on the run/gate path)

cemililik
and
claude
committed
001686a
feat(shared,db): tolerate an unknown event type on the stored-event READ

cemililik
and
claude
committed
e1c9df9
docs(reference): name the seam that keeps the ignore-unknown-types promise

cemililik
and
claude
committed
8ebd5ec
fix(db,cli): stop the tolerant read from destroying a run's resumability

cemililik
and
claude
committed
e73267e
fix(cli): bound one damaged run's blast radius to that run

cemililik
and
claude
committed
d76e916
feat(shared): add budget:estimate_committed, the durable conservative commitment

cemililik
and
claude
committed
855c199
fix(shared): make the conservative-commitment contract order-independent

cemililik
and
claude
committed
90dc914
docs(reference): fix the spec table the restore note broke, and settle the release shape

cemililik
and
claude
committed
782f493
feat(core): make conservative budget commitments durable

cemililik
and
claude
committed
2b451da
fix(core): stop a sync-throwing sink bricking the governor, and wire the resume restore

cemililik
and
claude
committed
4d5649d
docs(core): correct the fold comparison — Math.max is order-independent too

cemililik
and
claude
committed
751c21c
feat(cli,core): render the conservative estimate, and test the mechanism end to end

cemililik
and
claude
committed
84bca4a

Commits on Aug 7, 2026

feat(core): adopt .code on the cap errors (D10), and cover the last untested money path

cemililik
and
claude
committed
790b341
feat(core,shared): freeze an async media job's money basis at submit time (ADR-0074 §3)

cemililik
and
claude
committed
a55d68a
fix(core): stop the §3 hold from FAILING a node it only meant to hold

cemililik
and
claude
committed
47870af
docs(core): make the §3 choke-point claim true

cemililik
and
claude
committed
4f6b04f
fix(core,shared): make the §3 hold actually hold, and stop it losing a paid job

cemililik
and
claude
committed
e54488a
fix(core,cli): make the §3 hold observable, which my own fold had removed

cemililik
and
claude
committed
1e44291
fix(core): stop the §3 hold from making a run unkillable

cemililik
and
claude
committed
af7f131
docs(core): record the untested composition gap at the abort listener

cemililik
and
claude
committed
c3192fa
feat(db,shared): give a session its own conservative money columns (ADR-0074 §4)

cemililik
and
claude
committed
40ce109
feat(cli): make a chat's conservative commitments durable, and give §1 its release

cemililik
and
claude
committed
c69c859
feat(core,cli): restore a resumed session's conservative total (ADR-0074 §4)

cemililik
and
claude
committed
a7528b1
fix(cli): wire the conservative sink at every session site, not one of five

cemililik
and
claude
committed
5ae64b1
fix(cli,db,docs): fold the §4 Opus round — surfaces, canonical home, and a bad harness

cemililik
and
claude
committed
67e4a55
test(cli,docs): fold the §4 Sonnet round — cover the self-attach and the /cost render

cemililik
and
claude
committed
48a31bb
docs(roadmap): close Wave 1, with every lane verified against the code

cemililik
and
claude
committed
099dbfb
docs(roadmap): mark every Wave 1 task in the phase doc, each with its evidence

cemililik
and
claude
committed
4d894cf
docs(roadmap): stop calling Wave 1 "next" now that it is done

cemililik
and
claude
committed
0583234
refactor(core,cli,db): clear the seven Sonar smells, without changing behaviour

cemililik
and
claude
committed
6701b49
fix(cli,db,llm,docs): fold the review batch — eight valid, one declined, rest already fixed

cemililik
and
claude
committed
ad60b20
fix(cli): stop a repeated SIGCONT stacking a second suspend listener

cemililik
and
claude
committed
d99251d
fix(core,cli): make a chat turn wait for its commitment durability (ADR-0074 §2)

cemililik
and
claude
committed
3f9173d
docs(roadmap): retract the Wave 1 completion claim, and track all 24 findings

cemililik
and
claude
committed
96b364a
fix(cli,docs): close #W15-11's line forgery, and correct where these findings belong

cemililik
and
claude
committed
b0645c5
fix(cli,llm): redact secrets on the failure paths, which only sanitized terminal bytes

cemililik
and
claude
committed
40b7b97
fix(cli): stop a fully-redacted preview from earning a blanket approval

cemililik
and
claude
committed
487e102
fix(cli): escape what JSON.stringify leaves raw on the --json paths

cemililik
and
claude
committed
343f09a
fix(llm): surface a stream-path accounting throw as an error chunk

cemililik
and
claude
committed
ae6037e
fix(cli): scope the config 0600 self-heal to the canonical global file

cemililik
and
claude
committed
2cd5a5f
fix(llm,cli): make the Retry-After backoff wait breakable by a cancel

cemililik
and
claude
committed
41e50f8
fix(llm): replace the two unsafe casts with runtime narrowing

cemililik
and
claude
committed
3c1d360
fix(db): issue the run-event fold through the transaction handle

cemililik
and
claude
committed
19cc355
fix(cli): say a run is unreadable instead of answering "nothing here"

cemililik
and
claude
committed
cd64466
docs(reference): correct two claims that describe code we do not ship

cemililik
and
claude
committed
5915ce1
fix(shared,docs): require a frozen basis under a frozen media-job cost

cemililik
and
claude
committed
1aea8d0
fix(db): reject a stored event that disagrees with its own columns

cemililik
and
claude
committed
a73f381
fix(db,core,cli): fold the durable fail-cost snapshots that were dropped

cemililik
and
claude
committed
0a43201
test(cli): close two of the six knowingly-shipped coverage gaps

cemililik
and
claude
committed
010c373
feat(db,cli,docs): make ADR-0074 §1's release reachable and durable

cemililik
and
claude
committed
c4d9ad6
fix(cli): stop a session that cannot save itself from spending further

cemililik
and
claude
committed
6241d97
docs(roadmap): mark the 18 closed findings and state what is left

cemililik
and
claude
committed
65b7845

Commits on Aug 8, 2026

test(db): cover the modelCatalogId coalesce on a conservative upsert

cemililik
and
claude
committed
5f5c9c0
test(core): pin that the turn terminal waits for the durability barrier

cemililik
and
claude
committed
15bd058
test(core): pin the H3 approved-bypass acceptedCostMicrocents omission

cemililik
and
claude
committed
703c258
test(core): close the composition gap that let the unkillable run ship

cemililik
and
claude
committed
4a512df
docs(roadmap): §B–§F of PR #81's list are closed — 22 of 24

cemililik
and
claude
committed
d13fa22
fix(core): wire the dead hold notice, and fold the Opus review

cemililik
and
claude
committed
b0af9f3

Commits on Aug 9, 2026

fix(cli,core): sanitize and pin the hold notice the wiring just made live

cemililik
and
claude
committed
f59bf5e
feat(db,cli,docs): fail closed on a resume that cannot read its own log

cemililik
and
claude
committed
f1b7773
fix(cli,db,docs): make ADR-0075's refusal actually reach the user

cemililik
and
claude
committed
4bd00ba
fix(cli,db,docs): fold the Sonnet round on ADR-0075

cemililik
and
claude
committed
90f3270
docs(decisions): add ADR-0076 — a durable per-attempt realized-cost ledger

cemililik
and
claude
committed
4cd5885
docs(roadmap): record ADR-0076 and where its implementation starts

cemililik
and
claude
committed
a276314
docs(decisions): fold the ADR-0076 review — name, scope, and the barrier

cemililik
and
claude
committed
86c4b9f
fix(cli,core,docs): fold the review batch — one real credential leak

cemililik
and
claude
committed
ed7ba64
fix(cli,docs): correct two ADR-0076 claims, and clear the deferred smells

cemililik
and
claude
committed
c3ef943
fix(cli,docs): close the newline-split credential leak instead of documenting it

cemililik
and
claude
committed
356705d