toga-ai 1.0.440 → 1.0.441

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -0,0 +1,66 @@
1
+ ---
2
+ type: session
3
+ slug: true-79533-pin-depth
4
+ title: TRUE-79533 depth=-1 root-caused to beta-only FE commit — removed, pushed to _beta
5
+ author: tcox
6
+ repos: [toga2-view]
7
+ framework: "2.0"
8
+ client: rate
9
+ status: active
10
+ created: 2026-07-27
11
+ updated: 2026-07-27
12
+ ---
13
+
14
+ # Session: true-79533-pin-depth
15
+ **Date:** 2026-07-27
16
+ **Project/Repo:** toga2-view (2.0, client Rate) — continues mhammontree's 2026-07-27 session of the same slug
17
+ **Task:** Resolve the beta `depth=-1` starvation blocking the WH service-address pin (TRUE-79533): root-caused it to a beta-only FE commit and removed it — committed `e4c0ead` and pushed to `toga2-view` `origin/_beta`. Backend merge + deploys deliberately deferred.
18
+
19
+ ---
20
+
21
+ ## What WORKED
22
+ <!-- Include specific file paths and evidence -->
23
+ - **Root cause of the depth param found**: `depth=-1` in `createService` was added by a SINGLE commit `0b1ed0f` (rgirish97, 2026-02-24, "Send depth:-1 option when creating service") made **directly and only on `_beta`**. Verified three ways: `git log -S "depth" --all -- src/pages/CheckOut/api/checkoutApi.ts` (only that commit), `git branch -r --contains 0b1ed0f` (only `origin/_beta`), and `git show origin/_production:src/pages/CheckOut/api/checkoutApi.ts` (production sends NO depth).
24
+ - **Therefore the starvation is beta-only.** Production FE is already clean — once the backend guard reaches production, production pins as-is with no FE change. Also explains the prior session's evidence: local-FE purchases (built from `rate-active-development`, which never had the commit) always pinned (ET100057), beta-FE purchases starved.
25
+ - **Merge-topology insight**: merges from `rate-active-development` / `_production` into `_beta` can NEVER remove the param (neither source contains a removal change) — it survived merges `ee2f6ab` and `fcb1996`. Only an explicit change on `_beta` kills it.
26
+ - **Fix applied and shipped to git**: removed the third options arg `{ 'depth': -1 }` from `createService` in `toga2-view/src/pages/CheckOut/api/checkoutApi.ts` on `_beta` (fast-forwarded to `fcb1996` first). Commit `e4c0ead` "fix: remove depth=-1 from entitlement create request", pushed `fcb1996..e4c0ead` to `origin/_beta`. Diff: 1 insertion, 3 deletions.
27
+ - **Confirmed the mechanism before editing**: `apiPost`'s third arg is serialized into the query string via `assembleOptions` (`toga2-view/src/api/apiFunctions.ts:21-35`) — removing the arg removes `?depth=-1` entirely, which is exactly the request shape that pinned ET100057. Checkout viewmodel reads only top-level `isSuccess`/`status`/`error` from the create response (`useCheckoutPageViewModel.ts:471-474`), so the deeper ~64KB response is safe for the FE.
28
+ - Session was resumed from mhammontree's same-day save via `/session-resume true-79533-pin-depth` — the handoff worked; all their DO-NOT-RETRY items were honored.
29
+
30
+ ## What did NOT work — DO NOT RETRY THESE
31
+ <!-- Exact failure reasons — do not vague-ify -->
32
+ - **First commit attempt returned "nothing to commit, working tree clean"** — the working-tree edit had been silently reverted back to HEAD (depth restored), almost certainly an IDE source-control discard / editor-buffer overwrite while the developer had `checkoutApi.ts` open in VS Code; the file then flip-flopped again when the editor buffer (holding the fixed version) auto-saved. Resolution: re-read the on-disk file, confirmed it held the fix, staged + committed in the same command. Lesson: when editing a file the developer has open in the IDE, expect buffer/discard races — verify `git diff --stat` is non-empty at commit time and have the developer reload the file after.
33
+ - Carried over from mhammontree's 2026-07-27 session (still binding): do NOT force the write host inside `persistWarrantyServiceAddress` (V2 already disables the read host for the create block, `V2.php:5024`); do NOT use the 3-table JOIN lookup in postPost (0 rows in-request); do NOT merge `_underscore` to `_beta` expecting beta deploy (beta EB env API-Sandbox-Dev clones `_underscore` from `_sandbox-dev` via the api2 prebuild hook); the single-host-vs-multi-host connection theory is DISPROVEN; the payload pin code is CORRECT — its beta nulls were purely the depth starvation, now root-caused here.
34
+
35
+ ## Not tried yet (candidates for next session)
36
+ - **Beta FE rebuild/deploy from `_beta`** (now at `e4c0ead`) — until deployed, the live beta site still sends `depth=-1`.
37
+ - **Merge `_underscore` `TRUE-79533` → `_sandbox-dev` + redeploy API-Sandbox-Dev** — ships the pin + `_Exception_Validation` 400 code; beta currently has neither. Developer explicitly deferred ("wait on 2 and 3").
38
+ - **End-to-end verification purchase on beta** (after BOTH deploys): fresh WH purchase → check new entitlement `serviceAddressId` set, its `Addresses.isValidated=1`, card renders the address, duplicate purchase gets the 400 toaster. Note: the TOGa DB MCP connector was not authenticated this session — authorize it (claude.ai connector settings) or verify via other means.
39
+ - Merge `dbchanges2` `TRUE-79533` to its deploy branch for prod parity (beta already patched manually).
40
+ - The `minDepth=10` interceptor UPDATE experiment is now MOOT for this ticket (FE no longer sends -1) — keep only as input to the framework side ticket.
41
+ - Side tickets to file: (1) framework `minDepth` clamp appears to be a no-op for the `depth=-1` sentinel (starves ALL payload interceptors, including the AIG contract block, for any -1 caller); (2) SECURITY: plaintext GitHub PAT committed in `api2/.ebextensions/git.*.json` — rotate + move to env config.
42
+ - Optional cleanup on `_beta` `checkoutApi.ts`: unused `Options` import + missing trailing newline (left deliberately for a minimal diff).
43
+ - Run `/capture` (not yet run this session).
44
+
45
+ ## Current file state
46
+ | File | Status | Notes |
47
+ |------|--------|-------|
48
+ | `toga2-view/src/pages/CheckOut/api/checkoutApi.ts` | Committed `e4c0ead` on `_beta`, PUSHED to `origin/_beta` | depth option removed; unused `Options` import intentionally left |
49
+ | `toga2-view` local checkout | On `_beta` (clean, in sync with origin) | was on `rate-active-development` at session start — switch back if needed |
50
+ | `_underscore` `Model/Rate/Entitlement.php` etc. | UNTOUCHED this session | still on branch `TRUE-79533` (HEAD `41a5dc1a`), NOT on `_sandbox-dev` |
51
+ | `dbchanges2` TRUE-79533 migrations | UNTOUCHED this session | applied on beta manually; branch merge for prod still pending |
52
+
53
+ ## Decisions made
54
+ - **Fix the FE (remove `depth=-1`) instead of the interceptor `minDepth` DB experiment** — developer's explicit choice ("start with the FE fix… we will see about the database afterwards"). Rationale: fully local, no beta DB write needed, and — decisive, discovered this session — production already behaves this way, so the removal merely restores prod parity on beta. Rejected/deferred: `UPDATE ApiPayloadInterceptors SET minDepth=10 WHERE id=2` beta test (now moot for the ticket).
55
+ - **Direct edit + commit on `_beta`, no ticket branch, no `git revert`** — developer chose "edit only, no commit" for review first, then approved the commit. Justified because `0b1ed0f` was itself a beta-only direct commit and neither `_production` nor `rate-active-development` needs any change.
56
+ - **Minimal diff discipline** — did not remove the pre-existing unused `Options` import or add the missing trailing newline, so the commit is purely the depth removal.
57
+
58
+ ## Blockers
59
+ - Pin still cannot fire on beta until BOTH: (a) beta FE is rebuilt/deployed from `_beta@e4c0ead`, and (b) `_underscore` `TRUE-79533` is merged to `_sandbox-dev` and the API-Sandbox-Dev env redeployed. Developer explicitly said to wait on these.
60
+ - TOGa DB MCP connector unauthenticated in this session — needed for the eventual beta DB verification queries (or run them another way).
61
+
62
+ ## Exact next step
63
+ > Merge `_underscore` branch `TRUE-79533` (HEAD `41a5dc1a`) into `_sandbox-dev` and redeploy the API-Sandbox-Dev EB environment; confirm the beta FE has been rebuilt from `_beta@e4c0ead`. Then make ONE fresh WH purchase on beta and verify: response `meta.calcDepth` is deep, the new entitlement's `serviceAddressId` is set, its address has `isValidated=1`, and the card shows the address. (Both deploys are prerequisites — either alone changes nothing.)
64
+
65
+ ---
66
+ _Saved by /session-save on 2026-07-27_
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "toga-ai",
3
- "version": "1.0.440",
3
+ "version": "1.0.441",
4
4
  "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
5
5
  "keywords": [
6
6
  "claude",