P0-1 migration: detect the same-named stage-3 execution_stage CHECK by sqltext (must contain rework + manager_review), SQLite rebuild / PG-MySQL drop+add, PG boolean default TRUE, validate_schema checks constraint content + seat_tasks status CHECK/unique/FKs; tests start from a real stage-3 schema.
P0-2: a missing/invalid manager review (timeout/exception/empty/invalid JSON/missing per-seat decision) is never an acceptance - system rework under the cap, contract fallback (reassign/controlled_gap/ask_user) afterwards, source=system events.
P0-3: unaccepted deliveries are isolated from the fact ledger, cross-review and final report (deferred merge, delivery_json envelope, accepted_task_results in checkpoint, accepted-only synthesis, no turn_results fallback).
P0-4: seat-task init is atomic get-or-create over the full expected set; recovery fills missing tasks without overwriting frozen contracts; quality gate blocks missing required tasks.
P1: zero config values honoured; duplicate detection persists SHA-256 conclusion digests in history (survives restarts); findings never satisfy evidence, evidence_refs must resolve to trusted ledger refs (unverified_evidence_ref); conversation SSE projection tests added and manager/finalizer messages are no longer mislabelled as seat.delivery.submitted.
Re-enter clarification recovery even when manager_dispatch is already completed, and expand V2 runner tests for group_chat seat filtering and recover().
Co-authored-by: Cursor <cursoragent@cursor.com>
Make ensure_participants concurrent-safe, restore clarification checkpoints without re-planning, and only create threads for validated seats.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stage-6 MAF frontend foundation plus P1 approval safety hardening:
- Add lib/safe-display.ts: single-source safeDisplayJson that deletes
sensitive keys (never renders as ***), recurses with depth/array/field/
string caps, returns hiddenCount + truncated.
- MafApprovalCard & MafActionAuditPanel both use safeDisplayJson; remove
private sanitize duplicates. Panels hide entirely when nothing is left.
- Lock the card on both approve AND reject (resuming state) since the
backend advances the workflow on either decision; add a decisionLockRef
sync guard so a double-click before React re-render cannot fire a second
mutate. Status text becomes '正在同步工作流…'.
- Stage-6 base shipped here as prerequisite: self-contained maf-flow-graph
(no roundtable-planning dep), MafFlowGraphDialog/MafFactLedgerPanel/
MafActionAuditPanel, shared risk-theme/action-audit/approval-state/
run-resume libs, mergeBySeq export, canResume wiring, TButton icon fixes.
- Tests import real functions only; 48 pass (adds 8 safeDisplayJson cases).
Skip post-commit ORM refresh on threads_meta creates so concurrent MySQL
read/write-split deployments no longer fail with Could not refresh instance;
clean up partial roundtable threads on checkpoint failure, and ship related
position-roundtable/frontend build fixes.
Co-authored-by: Cursor <cursoragent@cursor.com>
The iframe login used a fixed queryless redirect and called setTheme, which both dropped the iframe theme and persisted it into the normal site's shared theme storage.
董宏凯