Repair the ContentRelease contract-digest migration for populated databases

[alexeygrigorev]

PM disposition — re-groomed after independent tester FAIL

This remains a P0, release-blocking data-migration bug. The independent tester found the local migration/service/portable verification green, but the first scope could not complete post-merge deployment and external-environment evidence before the required engineer commit, local merge/push, and on-call sequence. Criterion 4 also lacks one dedicated regression test.

This re-grooming defers only the named post-merge or external gates. It does not waive, downgrade, or convert any local migration, service, replay, handoff, or portability requirement into optional work.

Normative contracts

• docs/PROCESS.md
• Migration, rollout, and roadmap, especially rollback and data-migration controls
• Verification strategy, especially database/service, deployment, content-sync, operations, and deployed-gate scenarios
• Platform architecture — content refresh and release identity
• URL/link/SEO compatibility and release/cache contracts
• Structured content authoring and source ownership, especially editing/provenance and release handoff

Confirmed facts and tester disposition

Inspected against origin/main at e575e1a:

• content/migrations/0001_initial.py creates ContentRelease.public_contracts_sha256 with default and database check constraint 50f875806217865ef35b74f58ed885c4b5c832284391dbea7f84344d3416f66d.
• content/migrations/0004_remove_contentrelease_content_release_contract_sha_ck_and_more.py removes that constraint, changes the default to 31f505350566bfcde0a30109dadcfb3565042fd395b4c1bd151966f94d361332, and adds the same-named check for the new digest without transitioning existing rows.
• The runtime model and checked public-contract artifact use the new 31f… digest. New content candidates must bind to that exact artifact; historical release provenance must remain readable.
• The first independent tester report (report comment) found the local migration graph, idempotence, verification, and portability evidence passing. It found criterion 4 incomplete because content_sync.dtc_content.preparation._existing_release has no dedicated test proving a legacy-digest replay is rejected.
• The tester did not access AWS, shared development, production data, or a deployed release. Therefore the actual non-disposable applied-0004 state, exact-image deployment, failed-migration preservation, classification, readiness, and deployed-smoke evidence remain unavailable until the normal post-merge/on-call sequence.
• The original deployment evidence remains run 32636739682: application verification passed, while the deployment migration path failed before web/worker mutation with the redacted reason contract_contradiction. That reason alone does not classify the cause.

Scope

1. Keep the forward expand/contract migration repair safe for populated databases and preserve every ContentRelease row, primary key, status, source/release sequence, active-source pointer, child document/relation/asset row, checksum, source commit, and provenance.
2. Keep historical rows carrying the old digest readable and unchanged. New service-created, prepared, and activated releases must use the checked 31f… digest.
3. Add the dedicated local regression coverage for content_sync.dtc_content.preparation._existing_release rejecting a legacy-digest replay before activation, with the existing release, active pointer, and child records unchanged.
4. Keep the clean, populated pre-repair, and already-recorded-0004 migration state matrix, idempotence, service invariants, replay behavior, handoff evidence, and portable Django verification required before technical acceptance.
5. Defer only the authorized post-merge exact-image deployment, failed-migration drill, external applied-0004-state check, failure classification, readiness, and deployed-smoke gates to on-call.
6. Preserve the migration-first, readiness-next, web/worker mutation ordering and all redaction/data-safety boundaries.

The old digest remains immutable historical provenance through the deployment and agreed rollback window. Any later cleanup, normalization, or retirement of legacy values requires a separate groomed issue.

Explicit non-goals

• Do not bulk-update old public_contracts_sha256 values to the new digest merely to satisfy a check constraint.
• Do not delete, truncate, recreate, re-import, or destructively reverse ContentRelease history or child records.
• Do not weaken the requirement that new candidates use the checked contract artifact.
• Do not skip local migration, service, replay, handoff, verification-plan, or portability tests because their deployed counterpart is deferred.
• Do not run the unchanged failing migration against the shared development database.
• Do not relax, bypass, or reorder migration, readiness, web/worker, rollback, or redaction controls.
• Do not change editorial source ownership, rendering, routes, SEO, cache policy, public database-read cutover, or unrelated content-sync behavior.
• This PM re-grooming does not access AWS, production data, or deployment state.

Dependencies and blocked work

• The engineer must first complete the dedicated legacy-digest replay regression and all required local criteria in the uncommitted worktree. The shared development database is not a fixture.
• The exact-image deployment and external applied-0004-state evidence are downstream of technical acceptance and the normal process sequence: engineer commit, local main merge, push, then on-call observation.
• The on-call gate must use the current deployment controller and retain redacted pre-mutation/recovery evidence; it must not use the engineer or tester worktree as a substitute for the merged exact image.
• No product-feature dependency is introduced. The issue is intentionally open until the named human gates pass.

Acceptance criteria

The numbered criteria preserve the first scope for traceability. Criteria tagged [AUTO] are required before technical acceptance and cannot be skipped. Criteria tagged [HUMAN] are deferred gates only; they remain required for final acceptance and closure.

Required automated and pre-merge technical criteria

• 1. [AUTO] A deterministic migration test starts at content.0003 with synthetic active and historical ContentRelease rows using the old digest, related documents/assets/relations, and an active source pointer. Migrating to the repaired leaf succeeds without changing row counts, primary keys, statuses, pointers, child rows, checksums, source commits, or either historical digest value.
• 2. [AUTO] The migration suite covers a clean zero-to-leaf database, the populated pre-repair path, and a database that already has the recorded content.0004 state. All paths converge to the intended schema without duplicate constraints, migration drift, or manual SQL.
• 3. [AUTO] Reapplying the repaired migration path is a no-op. Any data operation is forward, idempotent, provenance-preserving, and limited to an explicitly documented compatibility marker/metadata transition; no content body, asset, relation, release identity, or active pointer is rewritten.
• 4. [AUTO] A dedicated regression test exercises content_sync.dtc_content.preparation._existing_release with a legacy-digest replay and proves the replay is rejected before activation while the existing release, active pointer, and child records remain unchanged. The surrounding service tests must still prove canonical current-digest creation/preparation/activation, safe replay behavior, and legacy rollback selection.
• 5. [AUTO] New service-created, prepared, and activated releases use the exact checked digest 31f505350566bfcde0a30109dadcfb3565042fd395b4c1bd151966f94d361332. A non-canonical new candidate is rejected before activation, while historical old-digest releases remain readable and rollback-selectable.
• 6. [AUTO] Required uv-backed verification passes, including make migrations-check, make test-migrations, the relevant content and content-sync tests, the generated full quality/SQLite change-selective closure, and exact base/head, plan, graph, state, and artifact digests. The migration remains within the portable Django boundary with no PostgreSQL-only application branch or raw vendor SQL.
• 8. [AUTO] Before technical acceptance, the engineer handoff emits the exact migration files/state transitions, fixture provenance, before/after aggregate counts and checksums, active-release identity, and redaction proof. The verification report/check validates this local evidence; this is a required pre-merge handoff criterion, not a [HUMAN] gate.
• 13. [AUTO] Because this issue has no template, route, static-asset, or rendered-content input, the plan and tester report mark the browser screenshot component not_applicable with the required reason. No unrelated screenshot is accepted as migration evidence. If implementation changes rendered behavior, the normal independent desktop/mobile screenshot gate becomes required.

Deferred [HUMAN] / on-call gates after merge and push

• 7. [HUMAN] [on-call] In the authorized target environment, record the actual applied-0004 state and migration history outside disposable CI. Redacted evidence must identify the target/environment and show why the local synthetic state matrix is or is not representative, without exposing credentials, production data, or authorization material.
• 9. [HUMAN] [on-call] Run the merged exact image through the migration task and retain redacted VERSION, full source SHA, image digest, migration task identity/stage, exit code or bounded reason, and the pre-mutation web/worker checkpoint. A failed migration must stop before web/worker mutation.
• 10. [HUMAN] [on-call] Produce the required data-versus-runtime/infrastructure classification matrix. A data/contract defect requires the same exact image to reproduce the invariant/constraint failure against the isolated populated fixture and identify the failing migration/state. A runtime/infrastructure defect requires that exact image to pass the equivalent populated migration while the deployed task fails, with redacted task stop reason, database reachability/configuration, resource/timeout/health evidence, and no data rewrite as remediation. contract_contradiction alone is insufficient.
• 11. [HUMAN] [on-call] Deploy the merged exact image through the current controller: migration succeeds before any web/worker update; database-aware readiness reports the expected schema and no unapplied migrations; web and worker stabilize on the same release identity; and recovery/rollback evidence remains available.
• 12. [HUMAN] [on-call] Exercise the failed-migration path with a controlled synthetic failure or equivalent authorized drill and prove the prior web/worker pair remains active, no partial release is reported, and recovery evidence is retained. Do not use the shared development database.
• 14. [HUMAN] [on-call] Run the existing read-only deployed smoke at https://web.dtcdev.click, checking health/readiness, representative public availability, and absence of a new public 5xx, redirect, or canonical regression. Capture no production export, PII, credentials, tokens, or provider payloads.

Technical handoff and exact disposition

• Local technical acceptance is conditional on every [AUTO] criterion above, including the new criterion 4 regression and criterion 8 handoff evidence, being implemented and independently verified. A passing local suite does not imply final issue acceptance.
• After the automated tester gate passes, the engineer commit and local merge/push must use Refs Repair the ContentRelease contract-digest migration for populated databases #219, not Closes Repair the ContentRelease contract-digest migration for populated databases #219, because named human verification remains.
• The issue remains OPEN with the human label while criteria 7, 9, 10, 11, 12, and 14 are pending. On-call owns those post-merge gates and must post the redacted evidence/report to Repair the ContentRelease contract-digest migration for populated databases #219.
• Final PM acceptance and closure require the on-call evidence, all [HUMAN] criteria checked by the owning role, and no unresolved classification or readiness/smoke exception.

[alexeygrigorev]

PM grooming disposition: #219 is a P0 release-blocking ContentRelease migration bug. The fix must preserve historical release rows and old-digest provenance, enforce the checked digest for new releases, and prove the populated migration/readiness/deployment path; no blanket data rewrite or unchanged rerun is authorized. Added the data-vs-runtime evidence gate and marked browser screenshots not applicable for this migration-only scope. Removed the needs grooming label; retained bug, P0, content, operations, testing, and data-migration.

[alexeygrigorev]

Software Engineer Report — #219 — INCOMPLETE TIMEOUT HANDOFF

Status: incomplete. The one-hour completion wait expired. I stopped/check-ed the isolated verification session; no matching long-running process remains. No commit, push, merge, deploy, or pull request was made.

Frozen revision and worktree

• Worktree: /home/alexey/git/dtc-website/.tmp/issue-219-engineer
• Branch: issue-219-engineer
• Base/head: e575e1a73414131b3241a6a029a0839d62090573 / e575e1a73414131b3241a6a029a0839d62090573
• git status --short --branch: branch is clean relative to origin/main except the eight intended uncommitted paths below.
• git diff --check: passed.

Implemented, uncommitted

• Added forward portable migrations content/migrations/0005_repair_content_release_contract_digest.py and 0006_finalize_content_release_contract_digest.py; the applied 0004 file was not rewritten. The replacement handles pre-repair and already-recorded-0004 states while preserving legacy rows.
• content/models.py now represents both the legacy digest 50f875806217865ef35b74f58ed885c4b5c832284391dbea7f84344d3416f66d and current checked digest 31f505350566bfcde0a30109dadcfb3565042fd395b4c1bd151966f94d361332 for persisted releases.
• content/services.py enforces the exact current digest for new, ready, and activated releases while allowing historical legacy releases to remain rollback-selectable.
• content_sync/dtc_content/preparation.py rejects an existing legacy-digest release as a prepared replay candidate.
• Added service coverage, deterministic populated migration seed test_support/migration_seeds/content-contract-digest-v1.json, and migration tests for clean, pre-repair, already-recorded-0004, idempotent, preservation, and service-enforcement paths.
• Deployment gate ordering and browser/render inputs were not changed.

Changed paths are exactly:

M  content/models.py
M  content/services.py
M  content/tests/test_services.py
M  content_sync/dtc_content/preparation.py
M  test_support/tests/test_migrations.py
?? content/migrations/0005_repair_content_release_contract_digest.py
?? content/migrations/0006_finalize_content_release_contract_digest.py
?? test_support/migration_seeds/content-contract-digest-v1.json

Verification completed before the timeout

• make migrations-check: passed; no changes detected.
• make test-migrations: passed, 18 tests.
• Focused migration/content central tests: passed, 12 tests.
• Focused service test: passed, 1 test.
• make test-content: passed, 503 tests, 1 skipped.
• Focused content-sync tests: passed, 13 tests, 6 skipped.
• make test-ci: passed, 601 tests.
• make django-check: passed.
• make database-portability-check: passed.
• make lint: passed.
• make format-check: passed, 616 files checked.
• make typecheck: passed, 448 files checked.
• make test-django-full: passed, 2,474 passed, 9 skipped, 0 failed (2,483 assertions).
• make test-playwright-core: passed, 209 passed, 28 deselected, 0 failed, 1,371.01 seconds. This is existing control-plane coverage; no issue-specific screenshots are required.
• make verification-container: returned success.

The exact long-running command was:

make verification-run VERIFY_ISSUE=219 VERIFY_WORKTREE=issue-219-engineer VERIFY_BASE_SHA=e575e1a73414131b3241a6a029a0839d62090573 VERIFY_HEAD_SHA=e575e1a73414131b3241a6a029a0839d62090573 VERIFY_OUTPUT_DIR=.tmp/verification/issue-219-engineer-final VERIFY_PLAN=.tmp/verification/issue-219-engineer-final/verification-plan.json VERIFY_EVIDENCE_DIR=.tmp/verification/issue-219-engineer-final/evidence VERIFY_REPORT=.tmp/verification/issue-219-engineer-final/verification-report.json VERIFY_CONSUMER=engineer VERIFY_PHASE=engineer

The last observed runner result was exit 0; its report verdict was success, with all rerun components successful and no invalid evidence. The overall handoff is nevertheless incomplete because the wait budget expired and the generated artifacts need reconciliation: the current plan file SHA256 is aa9d5426b86f55c78d35020272655c33d43456e88e2e9b24ba43f78a0838ba66, while verification-report.json embeds plan SHA256 3cee72f3469dad89e165f044ba70315f8991e0a81ac44ce4c7dd92cb369d7326. The report file SHA256 is 9e2f6c8248be2477e786e1fa2ffffd9f0e02cdc40fad57db6732cfd6b0074b83; graph SHA256 is 90dd2c39fb91ce8eba99bddebcdd2462458e5c6bfb53d24513f8fe214354293f.

Artifacts:

• Plan: .tmp/verification/issue-219-engineer-final/verification-plan.json
• Selection: .tmp/verification/issue-219-engineer-final/ci-selection.json (SHA256 cf711de4d0e0c919baff2a8502ec97f15f48fc8c5877d3f824c4b2a10527535)
• Report: .tmp/verification/issue-219-engineer-final/verification-report.json
• Deterministic seed SHA256: 2adba8f1185394f23709b07ed1f56b1ffdc19a07e4a513c5f290f155a41a7345

Tester safety and remaining HUMAN gate

The source diff is safe for independent testing: it is uncommitted, limited to the intended eight paths, passes git diff --check, does not rewrite an applied migration, uses portable Django migration operations, and did not touch shared development, production, AWS, or deployment state. The current verification plan/report pair should not be treated as final evidence until the plan digest mismatch is regenerated or reconciled.

Remaining risk/HUMAN gate: an independent tester must re-run the frozen plan/report validation and verify the populated migration against the authorized deployment’s actual applied-migration state, including migration-first/readiness-next/web-worker ordering. No AWS, shared development database, production data, or deployed release state was accessed by this engineer.

[alexeygrigorev]

Orchestrator artifact reconciliation

The engineer handoff's reported digest mismatch was a false alarm. The raw selector artifact SHA is aa9d5426b86f55c78d35020272655c33d43456e88e2e9b24ba43f78a0838ba66, while the verification contract's canonical JSON plan digest is 3cee72f3469dad89e165f044ba70315f8991e0a81ac44ce4c7dd92cb369d7326.

Recomputing the canonical digest with uv run --frozen python matched the report, and the candidate worktree's make verification-report-check passed against the frozen evidence. The source worktree remains uncommitted; this is still not tester or PM acceptance.

[alexeygrigorev]

Independent Tester Report — #219 — FAIL

Role: independent tester (VERIFY_CONSUMER=tester, VERIFY_PHASE=tester, producer role tester). This is a technical QA result only; I do not claim PM acceptance.

Frozen candidate and exact diff

• Repository/worktree: /home/alexey/git/dtc-website/.tmp/issue-219-engineer

• Branch: issue-219-engineer

• Observed HEAD: e575e1a73414131b3241a6a029a0839d62090573

• Observed origin/main: e575e1a73414131b3241a6a029a0839d62090573

• Requested base/head: e575e1a73414131b3241a6a029a0839d62090573 / e575e1a73414131b3241a6a029a0839d62090573

• git status --short --branch: ## issue-219-engineer...origin/main, with exactly these eight candidate paths:

  M  content/models.py
  M  content/services.py
  M  content/tests/test_services.py
  M  content_sync/dtc_content/preparation.py
  M  test_support/tests/test_migrations.py
  ?? content/migrations/0005_repair_content_release_contract_digest.py
  ?? content/migrations/0006_finalize_content_release_contract_digest.py
  ?? test_support/migration_seeds/content-contract-digest-v1.json
  

• git status --porcelain=v2 --untracked-files=all confirmed five worktree modifications, a clean index, and three untracked additions; no other candidate paths were present.

• git diff --check e575e1a73414131b3241a6a029a0839d62090573 -- passed. Independent no-index whitespace checks passed for each of the three untracked files.

• No tracked source was edited by this tester. No commit, push, merge, deploy, AWS access, shared-development access, or production-data access occurred.

Independent plan and engineer-evidence reconciliation

Fresh plan command:

make verification-plan VERIFY_CONSUMER=tester VERIFY_PHASE=tester VERIFY_PRODUCER_ROLE=tester VERIFY_ISSUE=219 VERIFY_WORKTREE=issue-219-engineer VERIFY_BASE_SHA=e575e1a73414131b3241a6a029a0839d62090573 VERIFY_HEAD_SHA=e575e1a73414131b3241a6a029a0839d62090573 VERIFY_OUTPUT_DIR=.tmp/verification/issue-219-tester-final VERIFY_PLAN=.tmp/verification/issue-219-tester-final/verification-plan.json VERIFY_EVIDENCE_DIR=.tmp/verification/issue-219-tester-final/evidence VERIFY_REPORT=.tmp/verification/issue-219-tester-final/verification-report.json

• Fresh plan profile/reason: full / schema_migration.
• Direct nodes: app.content, shared.content_sync, surface.test_support; downstream nodes: django.accounts, django.api, django.content, django.content_sync, django.core.
• Risk flags: schema_migration, shared_runtime, test_infrastructure.
• render.impact=false, required_captures=[], browser_profile=core.
• Graph SHA-256: 90dd2c39fb91ce8eba99bddebcdd2462458e5c6bfb53d24513f8fe214354293f; policy version 5.
• Source manifest SHA-256: 7a81c99ff270efa4ee8d3aa3d64933e517ddd3e44133dc1dfcc95fd4e7140359.
• Tester raw plan file SHA-256: 63e6e441c17fca2076b67f1708ae03f83b02bfc7f1f21fbd37599ab4687566ab.
• Tester canonical plan digest in the report: a790c01225371082d16a29fb73a9cce3a559bef2a0920f4cf4d6b600b8f51fd5.
• Engineer raw plan file SHA-256: aa9d5426b86f55c78d35020272655c33d43456e88e2e9b24ba43f78a0838ba66; engineer canonical plan digest: 3cee72f3469dad89e165f044ba70315f8991e0a81ac44ce4c7dd92cb369d7326.
• Structural comparison of the engineer and tester plans found exactly one difference: created_at. The source tree, eight changed paths, graph, policy, selection, impact, inputs, risk flags, and every disposition matched. The digest drift is therefore explained by plan creation time, not source or graph drift.
• Engineer plan, evidence directory, and report were independently validated with repository tools. Engineer report raw SHA-256: 9e2f6c8248be2477e786e1fa2ffffd9f0e02cdc40fad57db6732cfd6b0074b83. Engineer local evidence was not promoted or reused as tester evidence.

Fresh plan dispositions were: rerun selector, quality, django, evidence_validation, playwright, and container; not_applicable compatibility, content_invariants, and screenshots; no reused and no skipped components. The tester report's render digest is d24529bd5c1e5b3553c968376cafe86970820720a58e073f74be7c57e7f1041e, and its verification-state digest is ca61926db4258238c0fe8d0cce96facf4d67abbda0535d7ebe63fa7a9c8d6b61.

Fresh verification commands and results

• make migrations-check: PASS — No changes detected.
• make test-migrations: PASS — 18 tests, 18 passed, 0 failed.
• Focused Django command covering content.tests.test_services, content.tests.test_models, content.tests.test_migrations, and content_sync.tests.test_dtc_content_preparation: PASS — 27 tests, 27 passed, 0 failed.
• DJANGO_SETTINGS_MODULE=website.settings.test uv run --frozen python manage.py showmigrations content: PASS; graph shows 0001, 0002, 0003, replacement 0005_repair_content_release_contract_digest (1 squashed migrations), and 0006_finalize_content_release_contract_digest.
• Read-only manage.py migrate --plan content: PASS; leaf operations include the state-only 0005 transition and 0006 remove/add of the stable constraint. No raw SQL or PostgreSQL-only branch is present.
• Fresh make verification-run ... using the tester plan and the separate .tmp/verification/issue-219-tester-final/evidence directory: PASS at the component level. verification-report.json, all envelopes, artifact files, and report were validated with uv run --frozen python -m ci.verification validate-plan, validate-evidence-directory --consumer tester, and validate-report.

Component	Command/result and counts	Evidence ID	Output artifact SHA-256
selector	make verification-plan; 1 assertion, 8 changed paths	85436235c3d126e3d7bbb128bdf883b44c7239b9529ba11658ac94439dfb5e9e	selector-plan.json: 63e6e441c17fca2076b67f1708ae03f83b02bfc7f1f21fbd37599ab4687566ab
quality	quality-contract-v1; 601/601 passed, 0 skipped	df4e473f3ba1024887b52f5bf43f6505878ac15cce19474e2892d0e8c78e9cc2	quality-output.log: dac6ad4e716772aba2ebea6fe1b0d19c6ee621f808420b1f60693693271c9193
django	make test-django-full; 2,474 passed, 9 skipped, 0 failed, 2,483 assertions	12586d778ceeb9fa852fefe2068c9aa93bd89f32f31021aa6d662df37a6f8a90	django-output.log: 01cb5b9eedf3fce4b3a4200b23478c5149ffe0443f08bf51f239cc355240d171
evidence_validation	make test-ci; 601/601 passed	f68e68375b957f08cb3b9307ca156df2fa23929a78e72c3cc86ce45d5262d05e	evidence_validation-output.log: bdbe01530f71b6ab96fce9a3567e9109aa706438a0745acd4dc2a4d70548ac74
playwright	make test-playwright-core; 209/209 passed, 28 deselected, 0 skipped/quarantined; 1366.86s	fb9da16a933d51586a43f2de7d8ad3c2b64e6a3feb1f7e481b80e6a5e04e625c	playwright-output.log: 782161f746488059906226ff1b59e06ae6a9b43594c26cd48e340886da0a200c
container	make verification-container; 13 assertions, 0 failed	4aa7bda487a6a266d42aac9a955f614eaa3ee96568b8ad65534340a9912d9eb9	container-check.json: 104c5ee3fdca97d5c380d04e32d2f5972e661bb7b681d45bc8d7a9bd71126b29

Bound artifact SHA-256 records also validated: container environment aa04a26ae0015d11648d94db51a924baba211d3d5874a05289453e5dea96838a, result ad12d86adccab1e9a872bcc47839c8b90c6a7a9d538be1b7c587dc1a7f3bb633; Django environment 3cbccf811a787a06330ea4c9d821c267a92da8ad2948e712d2beb2569fdb9a6a, result ed53550eee3dd66d4ce9c9a83bf2ec76582b91db8c83ebd7cefc822149a94dde; evidence-validation environment aa04a26ae0015d11648d94db51a924baba211d3d5874a05289453e5dea96838a, result ffb962baff35d10211f2bc59b3e4285d670cbf38c0d4cc779ea2833a3f6448e7; Playwright environment ceeb29d3be531df8c7fd19008ea96aa1893a2b0fbe76151e88dee39e7843193d, result 7a0816d0040c0885d3643c61e4a6ce96d6ec97e0888d2f4114edc4ab26ef6f2b; quality environment aa04a26ae0015d11648d94db51a924baba211d3d5874a05289453e5dea96838a, result e7b34da4c6a66715fb92fbd793fc9442a94a1be0ae8016e6092ad6f31af8796e; selector result 2e8bf1353b36df91c9e3658f14599a2e74325bc8473095ef55bb736353ee4af2. Tester report raw SHA-256: f352793602d93b20b7e6a6a55d4bfacf8963aed8acf38cc621297cb7f45eb73e. Tester selection artifact SHA-256: cf711de4d0e0c919baff2a8502ec97f15f48fc8c5877d3f824c4b2a10527535.

Acceptance criteria

1. PASS (local migration evidence). Fresh test_content_contract_digest_populated_pre_repair_path_preserves_rows_and_is_idempotent starts at content.0003 with the seed's active/historical releases, documents, relations, assets, active pointer, and old digest. Snapshot equality and the single-constraint assertion pass. Seed payload SHA-256 is 2adba8f1185394f23709b07ed1f56b1ffdc19a07e4a513c5f290f155a41a7345; expected synthetic counts are two active paths, two assets, two documents, two relations, and two releases.
2. PASS (local migration graph). Fresh migration tests cover clean zero-to-leaf, populated pre-repair, and already-recorded published 0004 paths; 0005 is not an in-place edit of 0004, and makemigrations --check passes with exactly one final contract constraint.
3. PASS (local idempotence). The populated pre-repair test reapplies the target and asserts identical snapshots. 0005 has no database operation; 0006 only removes/re-adds the named portable Django check constraint.
4. FAIL — incomplete contract evidence. Service creation, readiness/activation rejection of a legacy digest, current-digest activation, and legacy rollback are covered by the fresh 27-test focused set. However, the changed _existing_release preparation guard in content_sync/dtc_content/preparation.py:110-111 has no dedicated legacy-digest replay test; the existing preparation tests exercise canonical candidates only. The complete service-created/prepared/activated criterion is therefore not fully evidenced.
5. PASS (local verification). Required focused targets and the fresh tester full plan passed; exact base/head, plan/report, graph, state, selection, envelope, and artifact digests are recorded above.
6. PASS (portability). Quality/database-portability checks pass; migrations use Django operations only and introduce no vendor SQL or PostgreSQL application branch.
7. FAIL — HUMAN/deployment evidence missing. The local synthetic graph covers both pre-0004 and already-recorded-0004 states, but neither the engineer nor tester accessed an authorized non-disposable environment, so the actual outside-disposable applied state of 0004 is not documented. The safe local upgrade path is not a substitute for that required provenance.
8. FAIL — engineer handoff evidence incomplete. The handoff records the seed payload digest and migration names, but does not record the required before/after aggregate checksums, active-release identity, and complete aggregate evidence. The migration test asserts these values in memory but does not emit the required handoff record.
9. FAIL — deployment failure evidence absent. No authorized exact-image migration task was run, so there is no redacted VERSION/full-source-SHA/image-digest/task-stage/exit-code or pre-mutation web/worker checkpoint proving mutation stops before migration success.
10. FAIL — no valid classification matrix/evidence. The tester makes no data-vs-runtime classification: the isolated populated fixture passes, but there is no exact-image deployed task result, task stop reason, database reachability/configuration result, resource/timeout/health evidence, or pre-mutation checkpoint. contract_contradiction alone is expressly insufficient.
11. FAIL — successful deployment gate not run. No evidence proves migration-first, readiness-next, same-identity web/worker stabilization, or read-only https://web.dtcdev.click smoke.
12. FAIL — failed-migration drill not run. No controlled synthetic deployment failure or equivalent authorized gate evidence proves the prior service pair remains active and no partial release is reported.
13. PASS (explicitly not applicable). No template, route, static asset, or rendered-content input changed. The independently recomputed plan and tester report both set screenshots to not_applicable with reason render_inputs_unchanged_without_reusable_visual; no screenshots were captured or used as migration evidence.
14. FAIL — deployed smoke evidence absent. No authorized read-only health/readiness/public-availability/5xx/redirect/canonical smoke was run.

Classification and remaining gate

Local automated verification is green, but the issue-level result is FAIL because required acceptance evidence is missing and criterion 4 has a preparation-test coverage gap. No data/contract or runtime/infrastructure defect classification is claimed. The remaining HUMAN/deployment gate must, in an authorized isolated/synthetic environment, determine the applied 0004 state and retain redacted exact-image evidence for successful migration/readiness/web-worker ordering, the controlled failed-migration preservation path, classification inputs, and read-only deployed smoke. PM acceptance remains pending and must not be claimed until the tester gate is resolved.

Tester artifacts:

• Plan: .tmp/verification/issue-219-tester-final/verification-plan.json
• Evidence: .tmp/verification/issue-219-tester-final/evidence/
• Report: .tmp/verification/issue-219-tester-final/verification-report.json
• Human report source used for this comment: .tmp/verification/issue-219-tester-final/independent-tester-report.md

[alexeygrigorev]

PM re-grooming disposition: the tester FAIL is split without weakening safety. Criteria 1-6, 8, and 13 remain required automated/pre-merge gates; criterion 4 now explicitly requires a dedicated content_sync.dtc_content.preparation._existing_release legacy-digest replay rejection test. Only criteria 7, 9-12, and 14 are deferred HUMAN/on-call gates for external applied-0004 state, merged exact-image deployment, failed-migration drill, classification, readiness, and smoke. After every AUTO criterion passes, technical acceptance uses Refs #219; the issue stays OPEN with human until on-call evidence is posted and PM final acceptance is complete.