[edsaperia]

Closes #232. Implements Ed's Q1604 ruling: reserve the requested address while a link proposal is open.

Protects current/historical aliases and open-proposal reservations across creation, direct rename, voting/assent and concurrent saves. Reservations survive restart, do not route before adoption, and release only when no open proposal or permanent history still needs them. Pending creation shares the same transactional namespace, with atomic founding transfer and protection against stale resends or corrected-email races.

Migration 12 adds durable ownership and cached registry reservations. Existing ambiguous ownership stops startup for review; no history is silently repaired. SPEC v0.150/R-149 records the selected rule. Existing member-facing refusal wording is reused.

Validation on head 4a2345f: all eight exact project gates PASS in Linux CI, the entire server suite PASS over PostgreSQL 17, and artifact startup smoke PASS. Final local focused checks: 65 passed. See FINAL for Windows limitations and the four broader browser checks still pending; the coordinator will merge only after all 11 PR checks pass.

[edsaperia]

REPORT: Address ownership integrity follow-up

Current/historical address protection and atomic PostgreSQL claims are implemented. The initial CI npm test passed with PostgreSQL 17 configured; the serial full server run over PostgreSQL is still running. Locally all seven non-test gates passed. The local full suite reproduces Windows ledger import and CRLF fingerprint failures; the same initial commit passes npm test on Linux CI.

Further regression coverage now verifies three boot paths reject pre-existing duplicate historical ownership: eager replay, rebuilt registry, and fresh registry. Startup names the conflicting address and document IDs, leaves histories untouched, and requires review. Migration risk: an installation already holding ambiguous histories will refuse startup rather than silently route to an arbitrary owner. Persisted ownership-row disagreements also stop startup with an actionable error.

A slow-append regression verifies the address is reserved while its save is pending, cannot be routed before persistence, and is released when that save fails. Unit and demo-store checks pass (44 tests), including demo reset and real-document precedence.

Member-visible text remains the existing refusal: previously a colliding change succeeded; now it says "that address is taken". New operator-only startup errors explain conflicting ownership.

Still DO NOT MERGE. The outstanding product decision is a proposal whose requested address becomes unavailable after it is opened. Recommended: end it explicitly as unavailable and return its proposal credit; retain the document's current address. A final persistence guard alone prevents takeover but can cause repeated settlement failures and block unrelated work, so this PR is not complete until the outcome is ruled and implemented. No historical repair has been attempted.

[edsaperia]

COORDINATOR: Q1604 remains unanswered and this PR must not merge. Pausing follow-up CI run 40981265176 to free shared runner capacity for release-ready fixes. This is scheduling, not a green result: the latest head 4d3fc53 still owes final CI. Initial head 4fe053b passed CI/PostgreSQL, and the follow-up local evidence is in REPORT. After Ed's settlement decision is implemented, rerun all required checks on the final head before considering merge.

[edsaperia]

COORDINATOR: Q1604 answered by Ed in the Codex chat on 2026-10-30: Reserve the address while its proposal is open. This supersedes the coordinator's unavailable/refund recommendation, which Ed did not choose. Implement the selected reservation behavior; do not add an unavailable outcome/refund as the solution.

Reservation must be durable and enforced for other documents' creation, direct renames and proposals, including concurrent requests/connections. Preserve permanent current/historical address ownership. Release an unused reservation when its proposal is no longer open (withdrawal, rejection, supersession or other terminal outcome as existing rules define); on adoption it becomes the document's permanent address claim. Multiple open proposals from one document must not accidentally release each other's live claim. Reopening the server must preserve the same ownership and reservation state. No command/tick may be wedged by a late collision.

Merge current main (menu plus reliable saving, a19d657). Migration10 and11 are now on main; your address migration remains12. Keep one focused PR240; run red-first reservation regressions and the required exact gates plus real PostgreSQL CI. No merge/deploy by builder; coordinator handles final review and deployment. Standing owner permission to ship remains in place.

If a genuine compatibility or product choice is not settled by this ruling, post QUESTION with concrete evidence and continue independent work. Do not silently choose an owner for inconsistent existing data or change unrelated governance rules. Include the precise necessary SPEC/SURFACE changes implementing Ed's selected behavior, bump SPEC as required, and regenerate required bundles. Shared ledgers remain coordinator-owned.

[edsaperia]

REPORT: Q1604 reservation implementation checkpoint 24a08fe

Ed chose to reserve the address while its proposal is open. That ruling is implemented; no unavailable/refund outcome was added. Running proposals and proposals awaiting assent claim their requested address without routing readers there. Adoption preserves the permanent alias; other terminal outcomes release only unused reservations. Existing duplicate proposals remain refused under R-103; a synthetic validly chained legacy duplicate regression verifies that ending one cannot release another's shared claim.

The new reservation regression was run before implementation and failed: slugTaken returned false after an open proposal was saved. After implementation the HTTP and lifecycle checks passed (22 tests before the final creation-visibility correction). The HTTP regression opens competing proposals, refuses competing direct changes and births, checks automatic suffix allocation, adopts via an actual vote, and verifies later edits/ticks continue.

The existing R-035 pending-creation promise also needed namespace synchronization. PostgreSQL pending-stash writes and document claims now use the same address lock. Genesis claims its stash in the same transaction as its document log and address ownership, revalidating its email and slug. Compare-and-set stash updates prevent old text/resend writes from undoing a claim or restoring a former address. Concurrent verified creation links forward to one document; a concurrent corrected email cannot found a document for the old address. Live pending lookups ignore expired/claimed rows.

Migration12 creates slug_owners and adds reserved_slugs to doc_registry. Existing registry rows are folded once to populate reservation data; future lazy boots retain the fast path. Current/historical/proposed conflicts already present in data fail startup explicitly; nothing silently repairs ownership. Migration10/11 and the atomic engine-save fix are merged from main.

SPEC v0.150, R-149 and the minimal SURFACE rule record the authorized behavior. No shared ledger edits. No new member-facing wording: the existing "that address is taken" and existing changed-email/used-link pages cover refusals. Operator startup errors name ownership conflicts.

All eight exact project gates are running for this checkpoint; seven non-test gates have finished successfully. Real PostgreSQL17 lifecycle, concurrency, stash-transfer and rollback coverage will run in CI on the push. The initial PR checkpoint had already passed all eight gates and the complete PostgreSQL server suite, but that does not substitute for checking this revision. No merge/deploy by this builder.

[edsaperia]

REPORT: Frozen head 4a2345f pushed for final CI

Review corrections are committed: startup reconciles complete address claims only after checking its source log lengths under document locks, so a stale boot cannot resurrect a released reservation. The file backend atomically publishes a recovery journal before a pending-creation transfer, restores an uncommitted transfer and finishes a committed one at restart. A torn recorded birth is quarantined with its bytes/journal/stash untouched; its intended address remains reserved without routing, and healthy documents still start. Existing ambiguous ownership is still refused explicitly, never silently repaired.

Exact final commands passed:

• npm run typecheck
• npm run lint
• npm run spec-check
• npm run copy-check
• npm run clock-check
• npm run demo-check
• npm run build

Focused final check: npm test -w @draft/server -- test/address-reservations.test.ts test/promise-title-link.test.ts test/unit.test.ts --reporter=dot — 65 tests passed.

The exact final npm test was attempted, not passed: constitution783 passed; an unchanged engine random Smith-rank test exceeded its5s timeout under Windows load, and the engine run then produced no new output for more than5minutes. The builder stopped only that verified test process tree. Previous complete checkpoint runs reproduced Windows ledger.test.ts dynamic-import SyntaxError and snapshots.test.ts CRLF fingerprint failure; one loaded checkpoint additionally timed out an unrelated rate-limit test. These are not claimed green locally. No tests were weakened or skipped in the committed tree.

Authoritative final Linux and PostgreSQL17 checks: https://github.com/edsaperia/draft/actions/runs/41082565004 (pending). Earlier green CI does not substitute for this head. Parent and independent read-only review found no remaining scoped code blocker, subject to final gates. No merge/deploy performed by this builder.

[edsaperia]

COORDINATOR: Reviewed exact head 4a2345f, including independent Codex review. No remaining code blockers found.

Ed's Q1604 ruling is implemented: an open address proposal reserves its target until it finishes. Adoption retains permanent ownership; other terminal outcomes release an unused reservation. Reservations do not become routes. Pending document creation uses the same ownership checks, preserving its existing address promise.

Review covered cross-host PostgreSQL ownership and locking, atomic creation claims, resend/email changes, stale stash updates, expiry, startup reconciliation, and file-store crash recovery. A torn recorded creation remains quarantined with its evidence intact and its intended address held; healthy documents can still start. Ambiguous existing ownership causes an explicit startup refusal rather than silently assigning somebody's address.

Migration 12 introduces the ownership table and registry reservation metadata. No member-facing text changed. SPEC v0.150 and reason R-149 record the chosen policy. Coordinator-owned release ledgers will follow after the final Sprint run so a documents-only push does not cancel it.

Local evidence: 65/65 focused tests and the seven non-test gates passed. The full Windows test command did not pass: it stalled in unchanged engine tests after a load-related timeout and was stopped. Linux CI and real PostgreSQL validation on this exact head are required before merge; this review does not count the incomplete local suite as green.

[edsaperia]

FINAL: Address ownership and open-proposal reservations — Q1604 implemented

Reviewed head: 4a2345f. Implementation checkpoint 24a08fe; recovery/boot fixes b2eaf6b, fb6082c and 4a2345f; main's menu and reliable engine saving merged in ad248e8. The branch is clean. No merge/deploy by this builder.

For members:

• Current and historical addresses remain with their document. An open link proposal reserves its requested address, including while awaiting assent, without routing readers there early.
• Other documents' births, direct renames and proposals cannot claim that address. Automatic birth-name allocation avoids it. Adoption retains it permanently; withdrawal, rejection, closure and other existing terminal outcomes release only unused reservations. Another open proposal or historical alias keeps its claim.
• Pending creation uses the same namespace lock. Verified creation atomically transfers its reservation to its document, checks the latest email/address, and concurrent valid links forward to one document. Stale resend/text writes cannot undo a claim.

Migration 12 creates slug_owners and adds doc_registry.reserved_slugs. Existing registry rows are folded once; subsequent lazy boots retain cached reservations. Startup reconciliation verifies source log counts under document locks before changing claims, so an overlapping boot cannot revive a released reservation. Existing ambiguous historical/proposed ownership refuses startup with an actionable conflict; no history is silently repaired. The file backend journals only an in-flight creation transfer; a torn recorded birth is quarantined, its address held without routing until repair, and healthy documents still start.

SPEC v0.150/R-149 and SURFACE record Ed's selected reservation behavior. No unavailable/refund alternative was introduced. No new or edited member-facing text: a competing rename previously succeeded and now uses the existing "that address is taken" refusal; a raced correction uses the existing used-link/changed-Founder-address page. Operator-only startup errors now explain ownership conflicts.

Exact required checks on this head, all PASS in Linux CI job 124155214364, run 41082565004:

• npm test
• npm run lint
• npm run typecheck
• npm run spec-check
• npm run demo-check
• npm run copy-check
• npm run clock-check
• npm run build

Also PASS: DRAFT_TEST_STORE=pg npm test -w @draft/server -- --no-file-parallelism, against PostgreSQL 17; production artifact startup smoke over file and PostgreSQL. Required gate: https://github.com/edsaperia/draft/actions/runs/41082565004/job/124155214364

Local final focused command: npm test -w @draft/server -- test/address-reservations.test.ts test/promise-title-link.test.ts test/unit.test.ts --reporter=dot — 65 tests passed. The reservation regression was demonstrated red before implementation. Coverage includes competing connections, rollback, reserved births/direct changes/proposals, real HTTP voting and later edits/ticks, restart, own aliases, duplicate legacy proposal sharing, pending-creation expiry/transfer/corrections, stale boot reconciliation and file recovery.

Windows limitation, reported rather than called green: all seven non-test gates passed locally. The exact final npm test passed 783 constitution tests, then an unchanged random Smith-rank engine case exceeded its 5 s timeout under load and the engine run stopped producing output for over 5 minutes; only that verified test process tree was stopped. Earlier complete checkpoint runs reproduced the Windows ledger import SyntaxError and CRLF fingerprint failure, plus one unrelated rate-limit timeout under load. No test was weakened or skipped in the source. Final Linux CI and the complete PostgreSQL run are green.

Broader checks still pending at this FINAL: journey, raw-values probe, redesign checks at 1600 and 390. The coordinator is waiting for all 11 PR checks before merging and will read their results. Boot guard, ordinary probes, both repro groups, door walks and motion walks already pass.

No product decision remains open and no implementation is deferred. Shared ledger/version-display edits remain coordinator-owned. Suggested changelog: "Document addresses stay with their document, including earlier addresses and addresses reserved by open proposals."

[edsaperia]

COORDINATOR: Verified live at 16:00 UTC, 2026-10-30.

PR #240 merged as 53c5971 after all 11 checks passed on reviewed head 4a2345f. docs.vote/healthz now reports that exact merge build, zero request/tick/outbox errors, zero quarantined documents and zero stalled documents.

Ed's Q1604 reservation policy is deployed, including pending creation protection and migration 12. No ownership conflict prevented startup. Existing addresses stay with their documents; open proposal targets are reserved without becoming routes until adoption.

The merged commit's eight gates, PostgreSQL server suite and production-artifact startup smoke passed before deployment. The broader Sprint run 41084858285 is still in progress, with no failures observed; final completion evidence will follow. Coordinator release ledgers are prepared locally and their push is held until that run finishes so it is not cancelled by a documents-only update.

[edsaperia]

COORDINATOR: Final release validation is complete, 2026-10-30 16:19 UTC.

Deployed code: 53c5971. The exact production build was verified with zero errors, stalled documents or quarantined documents.

• All 11 standard checks passed on the reviewed PR head and again on the merged release: https://github.com/edsaperia/draft/actions/runs/41084858275
• The full broader Sprint suite passed, including both role matrices, proposal/door/page scenarios, founding golden, desktop and phone card audits, and accessibility audit: https://github.com/edsaperia/draft/actions/runs/41084858285
• The full Linux test suite, real PostgreSQL server suite, eight release gates and artifact startup checks passed. The incomplete Windows full-suite run was reported as incomplete, not green.

Queue #236 items 1–5 are complete: address protection, shared email limits, atomic engine saving, closing summary/documents-menu review and release, and backlog reconciliation. The backlog pass closed 23 stale completed items and narrowed six partial items.

Item 6 (#235) remains open for the actual supervised beta sitting. Its script is ready; Ed's date, participants and real devices are still needed. No invitations were sent and no human sitting or beta acceptance is claimed.