Feature plan: Step 1 · Step 2 · Step 3 · Step 4

Debug mode: enabled

Planning commit: 6c6683f2. Step 3 approved; seven sequential stages.

Stage 1 - Operator preview and coverage

• Changes: shared validated preview, CLI entry and bounded exchange classification; explicit coverage/exclusions inventory.

• Verification: passed php tests/run.php RetractionSweepTest (1 test); mutation hash and absent-state assertions. Artifact enumeration is implemented and tested in Stage 4; preview currently reports store coverage and exchange counts.

• Notes: canonical validation reused fail-closed; no read-model schema change. Writer inventory found full/shared release builders, activation, direct builders, snapshot publishers, and three exchange-recorder factories. Existing private analysis/cache and read-model candidate/recovery stores excluded explicitly.

Stage 2 - Immediate exchange cleanup

• Changes: manual bounded run, atomic private progress, restart cursor, allowlisted scrub markers; known affected payloads and diagnostic strings removed while uncertain/unaffected rows remain exact. Visibility always withholds scrubbed rows.

• Verification: passed php tests/run.php RetractionSweepTest (3 tests), including bounded continuation, repeated runs, raw database/WAL sentinel absence, and invalid evidence failure status.

• Notes: secure_delete is enabled for updates; WAL truncation must succeed before clean status. Run failures reset progress conservatively for retry. No read-model schema changes; private progress uses JSON. Stage 1 commit: 445203be.

Stage 3 - Late exchange writes

• Changes: all three production recorder factories supply canonical repository context; known affected results scrub before insertion. Status rechecks canonical generation and exchange high-water mark so racing/older writers expose pending work rather than stale completion.

• Verification: passed php tests/run.php RetractionSweepTest LlmExchangeRecorderTest SqliteLlmExchangeStoreTest (10 tests); includes late success/error payload policy and uncoordinated late insertion recovery. Existing exact-recording behavior remains for unaffected/uncertain records.

• Notes: canonical uncertainty preserves recording and withholding; current status fails closed. SQLite write transactions serialize sweep updates against inserts; later inserts invalidate observed completion. Stage 2 commit: 6aa88468.

Stage 4 - Artifact cleanup and publication safety

• Changes: resumable bounded artifact traversal covers legacy files, active/inactive releases, build candidates, offline copies/manifests and temporary payload files; fresh generation-stamped artifacts survive repeat runs. Publication generation checks reject stale render/snapshot/activation; canonical writes share a narrow publication lock with final publication and retirement.

• Verification: passed 16 focused sweep/offline tests; PlatformDocsStaticTest passed (1); ImportedContentPublicationTest passed (2) after fixing lock placement outside canonical tracked files. Resumption, stale publication, directory-symlink rejection and repeat-clean retention verified.

• Notes: render/provider work is outside publication lock; lock order is read-model write lock then publication lock. Stale models reject publication until ordinary refresh/rebuild. Legacy shared releases require one full rebuild to establish generation evidence. Stage 3 commit: 7ebd5166.

Stage 5 - Automatic queue and cron recovery

• Changes: acceptance/retry enqueue callback, coalesced sweep task and bounded continuation; existing worker discovers missing/imported work and reconciles completed coverage every five minutes. Private state defaults are instance/configuration-specific. Explicit enqueue/manual run retries terminal failures.

• Verification: passed 31 focused sweep/queue-command/worker tests. An isolated fixture executes the actual generated cron command and verifies missed-enqueue discovery, two payload scrubs and completed queue status. Coalescing, bounded continuation and terminal failure visibility tested. Empty-worker test now names an isolated no-retraction repository rather than discovering real local retractions.

• Notes: queue failure cannot undo acceptance; failed sweep status blocks automatic rediscovery to avoid endless terminal retries. Existing queued attempts still retry normally. Stage 4 commit: 98c3dd47.

Stage 6 - Retraction feedback and recovery

• Changes: cleanup status passes through browser signing; enqueue failure retains visible retry; successful acceptance preserves a one-time queued acknowledgment across reload. Shared notice carries target identity for that acknowledgment, without adding navigation or internal explanations.

• Verification: passed PostRetractionScriptTest (2), real enqueue-failure/no-signature retry API test (1), existing author/operator API retraction flows (2), all four real-browser retraction scenarios, and keyboard/Escape/touch menu browser checks.

• Notes: browser fixture now authenticates before interacting: automatic session restoration previously navigated during mocks/actions. The queued acknowledgment describes acceptance of work, not current completion; operator CLI provides current status. Stage 5 commit: dd1f393a.

Stage 7 - Release verification and operator handoff

• Changes: CLI/help, coverage/privacy references and deployment/recovery runbooks completed. Final verification tightened residual-marker validation, cumulative counts, configuration-bound progress, resumed symlink checks and per-directory enumeration caching. Release finalization and shared-release copying now check generation under publication lock; HTML temporary payload writes and bounded snapshot assembly cannot recreate stale retained copies after retirement. Non-Git coordination locks are ignored as runtime files.

• Verification: passed final focused backend/queue/script suite (55 tests, including 16 sweep tests), final offline/static publication group (14 tests), additional release/profile group (4 tests), four real-browser retraction scenarios, exchange-privacy browser scenarios, and keyboard/Escape/touch menu checks. Immediate CLI preview/run/status and the actual generated cron command run against isolated instances. Killed transactions, WAL-reader contention, independent publication locking, stale generations, resumed symlink replacement, periodic discovery and repeated clean runs have regression coverage. Changed PHP syntax, local documentation links and git diff --check passed.

• Full-suite result: failed, reproduced baseline failures only — final php tests/run.php: 1,334 run, 1,331 passed, 3 failed. Each failed identically in an isolated checkout of unchanged base bea781e3be7ca60df97e93519616ff370354236d: AgentIdentityServiceTest::testReplyAgentBootstrapCreatesApprovedIdentityAndPrivateKeyOutsidePublicArtifacts (existing username-copy assertion), ReadModelBuilderTimingTest::testProgressSeparatesParsingDerivationAndWritingWithBoundedCounts (existing timing/progress assertion), and WriteApiSmokeTest::testPreparedFeatureFlagChangeVerifiesSignatureAndCommitsActionEvidence (missing post_id in existing test flow). Final race-closure refinements were followed by focused publication/sweep reruns. One queue-progress assertion failed during concurrent test processes sharing /tmp worker locks; the final isolated focused run passed all 55 checks.

• Deployment: inapplicable to this local implementation handoff — no production deployment, cron installation, merge or history purge performed. Live rollout checks remain with the operator using the documented runbook. Read-model migration and navigation-icon checks are inapplicable: no disposable read-model schema or navigation changes.

• Notes: all seven approved stages are complete; existing full-suite failures are reported, not presented as a green suite. Canonical/history, backups and other documented stores remain excluded; unknown exchange payloads remain withheld but retained. No new enhancement requests or deferred scope were introduced. Stage 6 commit: 9fa6156a.

CLI output follow-up

• Request: preview and status return JSON. Disposition: small presentation refinement; readable defaults with explicit --json for automation, consistently across preview/run/status. Authorized by the user follow-up; no cleanup policy changes.

• Outcome: readable counts, remaining work, last-run time and failure recovery; --json preserves the complete structured response. Verification passed: existing CLI preview/run/status integration test now checks both formats; git diff --check passed.