Heimdall
6e705852fb
Settle: live-PG pins (lost race writes no audit row, audit fault rolls back, concurrent settles once); SettleableOutcomes read-only; docs: a settle does not fence an in-flight replay
...
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-14 14:00:59 +00:00
Heimdall
1480883a3b
Test: operator settle of a stuck merge, the admin page and the sweeper's proof prune (red; SettleStuckAsync, PruneExpired and the page are skeletons)
...
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-14 13:25:30 +00:00
Heimdall
a92638511c
Merge notice feed: derived merged/undone/final notices, idempotent acks, bearer-gated pull routes
...
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-14 10:53:40 +00:00
Heimdall
6bd3ce4371
Schema: AddAccountMergeNoticeAcks, the ack row a notice reader adds (notices themselves are derived, nothing stored)
...
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-14 10:42:12 +00:00
Heimdall
757ca2eeab
Account merge saga: plan digest ignores the id of a membership not yet created, pin grace boundary, unique move ids and the confirm write gate, ProofSeal prints no bearer, commit the mutant probe
...
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-14 09:26:27 +00:00
Heimdall
41f4cc3853
Account merge saga: consumer tests through the real host and the fake mover, live-Postgres races, docs
...
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-14 06:48:43 +00:00
Heimdall
f726101207
Account merge ledger: one write gate for every writer, held across the standing read and the save
...
WriteAsAsync takes a shared Postgres advisory lock on the account (the key the chain trigger locks exclusively) across the standing read and the writer's save; CommitAsync takes the exclusive lock before it reduces. Votes, appraisals, sealed commit and reveal, patron events (RecordSupportEventAsync routes and journals in the same save, so the manual Ledger door obeys it too) and the Heimdall sign-in pass through it; SupportTargetAsync, MayWriteAsync and JournalIntakeAsync are deleted. A folded or frozen account's sign-in writes no membership. A retry of an event stranded on the folded account journals nothing. Tests: Down refuses in every merge state, Stripe journal prior owner and undo, the lock racing a freeze and a commit on live Postgres. Docs say what the lock guarantees and what it does not.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-14 06:08:36 +00:00
Heimdall
10fc9803d7
Account merge ledger: test the migration's duplicate current Patron snapshot dedupe
...
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-14 04:59:44 +00:00
Heimdall
537a477dc3
Account merge ledger: roll-forward-only Down guard, standing-at-write through one owner for every writer, one current Patron snapshot per membership, memberless Heimdall sign-in, intake and Stripe routing through one owner
...
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-14 04:58:26 +00:00
Heimdall
aa348d3b43
Account merge ledger: link step refuses a frozen account (test), drop the redundant sync guard, accept a deadlock victim as the racing commit's loser
...
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-14 04:13:54 +00:00
Heimdall
f402eb13cc
Account merge ledger: fix the first Soul pass (suspension carried into a memberless survivor, merged status terminal, standing at the desk door, linked accounts and write time, journalled grace intake, survivor weight on moved votes, one-hop alias, State token and database guards for overlapping merges, live-Postgres tests)
...
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-14 03:37:48 +00:00
