The user reported that individual issue dragging remained broken after production candidate 6fbc3938c39bf1e89f1f897863a056af9229085b-4031-1. Authenticated production Chromium inspection confirmed native repository card dragging reaches the native priority endpoint, while TheWell finding #559 has draggable=false and no finding priority-save route. The repair covers the reported finding card type.
The initial temporary Pod autocoder-engine/codex-issue-drag-browser-20260929 was deleted after bounded diagnostic logs were retained. Replaced it with temporary Pod autocoder-engine/codex-finding-drag-validation-20260929, pinned to drg-k8s-worker-01.auth.home.lan, using existing worker image gitea.app.lan/autocoder/autocoder-engine@sha256:c9c14cc44e23db6409d3c324d046991825e630cca72e32a30ccc953ac05300ea.
Validation bounds: 1.5 CPU and 4 GiB memory limits, 512 MiB RAM /tmp, read-only root filesystem, non-root 1240000012:1240000009, dropped capabilities, RuntimeDefault seccomp, no mounted service-account token, 7200-second deadline. Existing registry pull Secret is referenced only. Existing worker NVMe hostPath /mnt/runner-storage/autocoder-engine is mounted at /workspace/repos-rwx per the placement contract. Source/build data belongs only to task directory tasks/codex-finding-drag-20260929, with a 30 GiB maximum, retained only during this repair and removed after evidence is captured. Earlier NVMe check found 548 GiB available, above the 200 GiB admission floor; verify capacity again before compilation.
Authenticated browser requests use the existing authorized actor's PAT via stdin and in-memory same-origin headers. No credential is written to files, environment variables, receipts or logs. Production diagnostic priority writes are intercepted; normal read-only POST detail/release endpoints are allowed. Validation runs on the worker; the controller coordinates lightweight source editing and delivery. No serving workload or runtime flag is changed by these temporary Pods.
External administrator owns cleanup of this named Pod and task directory. Implementation and outcome verification are in progress; append exact delivered revision, acceptance results and cleanup evidence before completion.
Created temporary worker Pod autocoder-engine/codex-finding-priority-postgres-20260929 using the existing pinned PostgreSQL 16 Alpine image docker.io/library/postgres@sha256:cf78e76683b9ca8c5733cbbdce6c9262b45b6767934dd0a95e671f9a0fc20685. It contains only disposable synthetic data in 512 MiB RAM storage, is non-root UID/GID 70, has a read-only root filesystem, no service-account token, 0.25 CPU/768 MiB limits and a 5400-second deadline. Its known synthetic database credential is unrelated to production credentials. It is Ready on the worker node. No production or shared TEST database data is used for this unit regression. The external administrator owns deletion of this exact temporary Pod when evidence is retained.
Worker browser fixture now passes real finding/native drag, same-number identity separation, persisted response refresh, failed-save retention and retry. Real deployed TEST persistence acceptance remains pending.
The standalone disposable database Pod was deleted after the database check timed out under existing namespace network policy. The validation Pod was recreated with the same retained worker NVMe task and a disposable PostgreSQL sidecar listening only on localhost. The sidecar retains the bounded RAM-only data, pinned image, UID/GID 70, dropped capabilities and no token. Combined limits are 1.75 CPU and 4.75 GiB memory. No NetworkPolicy, Service, identity or serving configuration was changed. Both containers and the owned task directory will be removed after validation evidence is retained.
PR #6796 contains exact reviewed head 811c56a145d223f65419de292dd1c1292755c75f, refreshed from dev 7804310a166d661078ac019e04b0de6a1504dea1. Supervised worker formatting, complete native suite, ui-test WASM, Chromium native/finding drops, slash-name and same-number identity, refresh, failure retention/retry passed. Both isolated PostgreSQL priority regressions passed; the finding regression checks scope, audit actor/origin/prior/new, recurring feedback priority and provider/lifecycle preservation. Exact merged-head formatting, identity and finding database test also passed. Independent read-only source review found no material blockers; no paid API or provider calls were used for validation. Branch CI and deployed acceptance are pending.
Repair PR6796 merged dev bc0d92ae103cacb1e6862925829ce595fd83d374. Candidate4070 failed an existing ignored requirements-import test because its hand-created temporary finding table lacked the new priority column. Correction PR6797 head b6d0eb556c6db2a15e8723287c4f8daef8024bb0 adds the priority default and empty event table. Exact ignored regression and worker formatting now pass. Branch CI4073 is registered with host monitor watch9 under current runtime SOP; automatic continuation is not verified because prior watch8 failed on an active-thread writer conflict. No thread/lock/history was changed.
Deleted the named validation Pod and its disposable database sidecar before scheduled waiting. Separate disposable Postgres Pod was previously deleted. Only bounded worker NVMe task tasks/codex-finding-drag-20260929 remains for acceptance (maximum30GiB, cleanup owner external administrator after verification); no serving configuration or network policy changes. Controller checkpoint temp/codecartography-finding-drag-CONTINUE-20260929.md preserves exact delivery/acceptance/cleanup steps and the unavailable prior accumulated-active-runtime accounting gap. Deployed TEST persistence and production #559 drag remain pending; no repair deployment success is claimed.
Watch9 observed CI4073 success but automatic delivery failed with an active writer conflict. Read-only ownership inspection confirms this SSH Codex TUI retains the writer lock; the app-server daemon is a different process. The installed monitor does not have a verified supported queue transport to this owner. No writer, lock or history was interrupted or removed. Automatic continuation for this owner is unavailable, and the external administrator continued interactively.
PR6797 merged dev b11ad829a2d1080c29948965aa48f83e4e8bc3b9. Its candidate4080 was cancelled before execution; successor candidate4087 failed an obsolete exact prompt-text assertion after shared instruction consolidation. Current TEST and production frontend revision is 7804310a166d661078ac019e04b0de6a1504dea1; finding559 still draggable=false. Thus no deployed drag-repair success is claimed.
Recreated the named bounded worker validation Pod with the same RAM PostgreSQL sidecar and retained NVMe task. Current owner remains the external administrator; cleanup is pending acceptance. User instruction for finding559 was recorded as internal note265: externally owned TheWell is managed by the user; production credentials stay in external KeePass; finding stays open waiting for the user. No credentials were accessed. PR6800 implements typed operator blocker projection and import preservation in existing case investigation storage. Independent source review and initial PostgreSQL regression passed. A repeated-import no-op check and candidate prompt-fixture correction are undergoing worker validation. Durable member requirement save was rejected before writing because the Azure writer requires an absolute repository path; no source requirement write succeeded. No paid API calls or new recurring resources were used.
PR6800 head03315d0a8cd3708bb0099e3e88aaaedbc49acd65 incorporates refreshed dev84818cea and the prompt-fixture delivery correction. Worker formatting, isolated blocked-operator/no-op/release database regression and exact formerly failing prompt regression passed. Full native library suite478passed/70ignored and main suite957passed/30ignored passed under the canonical fixture; main was built with native-test-support. Initial missing-feature invocation was a validation configuration error, corrected with the required feature; it did not expose a product regression. CI4095 is queued awaiting a runner. No TEST or production deployment of this head is claimed.
Official App Server documentation now specifies remote CLI terminal UI connection using unix://PATH. A read-only investigation is checking the future SSH wrapper route to the same existing daemon. This does not establish a handoff for the current TUI; its writer/history remains intact. No automatic continuation guarantee is made.
CI4095 passed exact head03315d0a8cd3708bb0099e3e88aaaedbc49acd65. Rechecked PR6800 head, current dev base84818cea, mergeability and commit checks; merged PR6800 as devdb857f5cb9e1e6df014ca9546944bc8022d4f6c2. Exact candidate4097 is queued. This includes the original finding drag repair and both verified delivery-fixture corrections. TEST/prod acceptance, typed operator blocker application and deployed waiting-state verification remain pending; user instruction remains saved in note265 and finding stays open.
The external administrator is removing the named disposable validation Pod during the candidate wait. Worker NVMe task remains bounded at3.8GiB/max30GiB, owner external administrator, cleanup after acceptance. No serving configuration or policy changes. The current SSH TUI cannot be resumed through the separate monitor daemon; repeating the same transport is not a verified continuation route. Checkpoint preserves exact candidate SHA and remaining acceptance steps. Prior accumulated active runtime remains unavailable and is not reset.
Named validation Pod deletion completed successfully; a subsequent exact --ignore-not-found query returned no Pod. Disposable PostgreSQL sidecar and browser processes were removed with it. Only bounded worker NVMe task3.8GiB/max30GiB remains for deployed acceptance.
Monitor watch9 dry-run now connects successfully to managed daemon3756153 but reads this thread as notLoaded. The actual SSH TUI980932 still owns its writer lock. Installed root-owned SSH wrapper launches a local TUI after serialized automatic update, without --remote. Official App Server documentation describes a future client connection via the existing private Unix socket, but the current writer cannot be safely handed off in place. No SSH wrapper, session owner, lock or history was changed. Candidate4097's exact run/SHA is preserved in the checkpoint; an automatic continuation into this owner is not claimed or guaranteed.
The user confirmed individual issue dragging now works, and reported the Important/Urgent containers can appear to drag. Source inspection found native dragenter/dragover accepted unrelated browser drags. Branchfix/issue-quadrants-not-draggable-20260929 from refreshed devc9b808013cac1fbfe97a9a13fa9c2f6a9d4ff93d records REQ0151 checkpoint369dc44f: quadrant containers/headings remain fixed targets and only issue cards initiate priority changes.
Recreated the same bounded worker validation Pod, now browser-only with no database sidecar; retained worker NVMe task and previous limits/deadline/pinned image apply. Capacity522GiB available above200GiB admission floor. Patch adds an actual-card dragstart guard, explicit non-draggable quadrants/headings, nonselectable heading text, and active-card guards for native enter/over/drop. Pointer fallback remains on individual summaries. Worker formatting and ui-test WASM compiled; Chromium fixture passed visible mouse gestures from all five headings with no priority write/target activation, plus real native/finding card saves, refresh, failure recovery and identity separation. Initial fixture gesture had stale coordinates caused by target scrolling and submitted an issue move; corrected test asserts the start is on the visible heading. Independent source review found no blocker. Native focused source tests are running on the worker; CI and deployed acceptance remain pending.
Sourceheadb47c2bb62a73f43adfbb166f698a007d77f60b69 passed worker formatting, ui-testWASM/Chromium gesture suite, focused native40passed4environmentignored, independent review and CI4114. PR6806 merged verifieddevc9b808 as f9e6b3cbf37cb2aaecb83278badb75f04d03b125. Exactcandidate4116 is registered under monitorwatch15/deadline180min per the runtime SOP. Automatic delivery into this SSH owner remains unresolved; registration does not prove continuation. Deployed TEST and production fixed-container acceptance remain pending.
Namedbrowser-onlyvalidationPoddeletionrequested for the scheduled wait; no database sidecar was created this turn. WorkerNVMetask retained bounded atapproximately4GiB/max30GiB untilacceptance; externaladministratorownscleanup. Read-only live acceptance script temp/verify-live-fixed-quadrants-20260929.cjs is prepared: allmutationroutesintercepted, exactfiveheadinggestures,noPOST/targetactivation/orderchange,finding559remainsdraggable. User priority choices and externalKeePass untouched. Checkpoint records remaining delivery/acceptance plus prior unresolved operatorhandoff/SSHcontinuation and cumulative-runtime accountinggap.
User reported issue-card drags still move their quadrant up/down. Both TEST and production currentlyserve f9e6b3cbf37cb2aaecb83278badb75f04d03b125, so the previous non-draggable-container patch is deployed. Read-only authenticated worker Chromium proved the remaining cause: .issue-quadrant.is-drag-target applies scale1.012. The actual TheWell target height96296 moved top458.3125 to-119.4609375 (-577.7734375px) during feedback and returned afterward, while scrollY stayed0 and no priority write occurred. Thus the earlier container-source guard missed geometric feedback movement.
Branchfix/issue-quadrants-stable-during-drag-20260929 extends REQ0151 in checkpoint1f63f83f, removes scale and transform transition, retains colors/fixed border widths/shadow. Reviewed implementation head9c73eb9f9fcc155549ba4f0f4fe7c5bbd08dc329 under PR6808. Worker Chromium fixture passed every-quadrant geometry equality before/during/after feedback plus the unchanged real native/finding save/refresh/failure/identity suite. Browser replacement of the exact production CSS response with the proposed file proved actual TheWell DOM top458.3125,height96296,transformnone,scrollY0 unchanged throughout, with zero priority writes. An earlier additive stylesheet overlay was invalid because removing a declaration does not override the old stylesheet's declaration; replacing the requested CSS response corrected the preview. No production mutation occurred. Preview is not deployment acceptance.
CI4121 passed. This CSS/script-only fix reuses the unchanged frontend WASM from the reviewed predecessor; no Rust/API/schema changes or new toolchains. Same named browser-only bounded worker Pod recreated with retained taskNVMe; cleanup remains externaladministratorowned after delivery evidence. Production delivery and normal-site geometry verification remain pending. Runtime accounting retains the prior accumulated-active-runtime gap; no paid API calls or new capacity.
CI4121 succeeded at exacthead9c73eb9f9fcc155549ba4f0f4fe7c5bbd08dc329. Rechecked PR6808 unchangedhead/basef9e6b3, mergeability and checks; merged dev18e0be36d26a91f96878c63745088fbad458af03. Exactcandidate4122registeredmonitorwatch16/deadline180minutes for the current thread under the runtime SOP. Current SSH automatic continuation remains unresolved; registration proves provider monitoring, not delivery of a turn. Normal deployed TEST/prod geometry acceptance remains pending.
Named browser-only validation Pod deletion requested during the candidate wait; no database sidecar or serving configuration changes. WorkerNVMe remains bounded~4GiB/max30GiB, cleanupownerexternaladministratorafteracceptance. Checkpoint and temp/measure-live-quadrant-motion-20260929.cjs retain exact remaining verification: QUADRANT_ASSERT_STABLE=1 against TESTthenprod, WITHOUT the previewCSS override, authenticated via stdin/RAM and allprioritywritesintercepted. Verify actualgeometrybefore/during/afterequal after exactfrontend/backenddeliveryprovenance. Preserve user priority and externalKeePass decisions; typedoperatorhandoff and SSHtransport repair remain separateunfinishedbranches.
Candidate 4122 / watch 16 supplied terminal success for candidate, finalize_candidate, integrate_main and deploy_elected at dev SHA 18e0be36d26a91f96878c63745088fbad458af03. The completed run was not polled. Both normal sites served that exact frontend build revision. Production release identity was healthy; deployment provenance recorded candidate 18e0be36d26a91f96878c63745088fbad458af03-4122-1, backend digest 2009a9ddaeb917bfc5b1a052536c73b04f422e7b2a8b7a8264e44089db68294e and frontend digest 6ce2ebea4802dd0073ca2a7b74b5b9aea12eec35af5dadfc0bd0c9e0d72b0e61. Current TEST and production deployment images matched.
Normal deployed Chromium acceptance ran on the designated worker without CSS substitution. TEST contained only synthetic project test-fixture:sample; its target top443.3125/height240/transformnone stayed identical before/during/after feedback. Production TheWell target top458.3125/height96296/transformnone also stayed identical. Actual mouse gestures on all five headings in both environments created no target state, no priority writes and no JavaScript errors; cards remained draggable. A real production #559 mouse drag reached the correct priority-override endpoint exactly once, intercepted with409 to preserve the user's priority. Before/during target top-3022.6875/height96296/transformnone/scrollY3481 remained identical. This proves gesture routing and stable geometry, not a new production priority save. Existing browser fixture covers successful save and persistence.
Independent bounded follow-up: TEST provenance reported “responding; release identity mismatch” despite matching deployment images/frontend revision. The exact TEST ledger reason is unverified. Scope is TEST release identity/receipt lookup, not the repaired quadrant behavior; production exact receipt was healthy.
TheWell #559 operator handoff remains unfinished: current finding is open, authenticated instruction note265 is saved, but workflow still shows generic requirement_action_required/blocked. Planned typed operator_action_required blocker names ax_bechju1 and preserves external KeePass handling. Supported case investigation event POST returned401 before mutation: global operator middleware expects a Gitea bearer/session, while the case handler expects its integration bearer. Source inspection confirmed cases/events is absent from the token-only path exemptions. No unchanged retry, direct SQL write, credential access or rotation was performed. Follow-up scope: reconcile endpoint authentication without broadening access, apply idempotent event to exact case80397, then verify open/waiting_for_human/owner/reason through API and normal UI.
Temporary worker validation Pod was recreated with the same previously documented bounds for this acceptance. Exact task directory /workspace/repos-rwx/tasks/codex-finding-drag-20260929 was removed through that worker Pod and absence verified. Pod deletion requested; final absence verification follows. No paid capacity added. Prior cumulative active-runtime accounting gap is preserved.
Final cleanup: exact ignore-not-found Pod query returned no Pod; worker task directory and temporary validation Pod are removed.