The existing external-administrator request to resolve the reported production search failures authorized this scoped repair. Development and TEST delivery were included. The existing CHF5 total inference-verification ceiling remained in force. General production promotion stops, user data preservation, no permission expansion and no Gitea issue mutations remained effective.
Enabled document search remains eligible in the bounded tool candidate set; semantic selection requires internal evidence for company-dependent questions and contextual follow-ups. Answer grounding rejects unsupported internal procedures, platforms and prior assistant assertions. Candidate/selection/routing logs retain privacy-safe metadata. DEV PR6687 merged reviewed code 72d35a8ae00c91c86737227a71a1d80b410df125 at a806ad3e9067456bf16581f71fcaf004edfd65fc;57 focused worker tests passed. PR6691 integrated the six-case production acceptance record into DEV at 9f5a023fb2c56d8c3bfeeab76f0390b34f1b8aa2; DEV worker27 succeeded. DEV is the configured agent/local-validation branch, rather than a new persistent DEV deployment.
Azure339 run26233, build20260930.9, succeeded at16:42:50 UTC. Deployment source ce0974f1c57d67fe99c2457894fb88d781324911; application source 71a5e9d7eea90789c890cf22aa2c7cbaac63c3bb. Archive SHA256 64a7f2b236c4d341f7ad056c6000d751345e990f9e4d1a6e3ee7de69357188c6; running DLL SHA256 1ced21f227add62e7b1a3783047a330e828dc3641a7eae546863bb5bd7463e38.
The existing deployment UID 0eb790ff-1005-460c-b005-3e4c29cd7c89 switched only the owned backend command/working directory and source annotation to immutable sibling /opt/app/search-releases/71a5e9d7eea90789c890cf22aa2c7cbaac63c3bb. The deployment script verified unchanged live appsettings hashes and the running DLL, then readiness HTTP200. Previous binaries and /opt/app/document-storage remain preserved. Failure handling was fenced to the owned UID/spec/run and would restore the prior command/spec. No rollback was needed. Temporary definition339 YAML coordination was restored to the original YAML, queue and triggers at verified revision23.
Six actual signed-in normal-user production GLM POST /api/chat checks completed HTTP200: unscoped and original-workspace company vehicle questions retrieve real Corporate CarSharing documents; original ICT AD-role and AD-Sync follow-up (including the earlier incorrect assistant context) retrieve grounded ICT evidence; an empty workspace reports the evidence gap; a general Python list/set question executes no document retrieval. Original-workspace sources stayed authorized. Unauthenticated chat returned401.
PR6692 narrowly promoted REQ-0008 and the five reviewed source/test files; their blobs exactly match DEV and unrelated infrastructure/credential changes were excluded. Reviewed candidate cc0adfeecde88f14d8be3037e82073c4ebaf386d merged into TEST at 157ad86a023dba5122993c5be68178fea4a826d2, unchanged tree. Blocking policy was approved without bypass.
Gitea worker28 (provider-wide ID9306) succeeded. Immutable app archive SHA256 03079ac90d2975980b1370fd307c7566e11c887a9523adcb5df4018f4fc03703; k8s archive fa7f08b6c66cd578124f204319294982399791a6e79a92a67b72f1364c5c5635. Existing relay attached and read back the worker artifact to Azure TEST394 run26234.
Azure26234, build20260930.4, succeeded at17:41:39 UTC. Deployment d03849-skan-ag-test/thewell-backend rolled out generation758 and release 157ad86a023dba5122993c5be68178fea4a826d2-26234. Application tree SHA256 2408065c0c8aaac94ccc2bc20d783f2c190de51df321f864cb444a736d4f81e7; k8s tree 3aa4d03cdb57cb59a6dda5113693cc428848bb4e8ebf0a8eb28fb84087b98521; runtime config 7e37d93fbee4b4f3bd78222b546019c46fee75f8155d83bff337a53fc8402ab0. Recovery receipt outcome succeeded, rollback not_needed. Active TEST database and Entra settings matched the preserved isolated runtime configuration. The exact release pod passed namespace readiness; the synthetic document fixture persisted.
Public strict-TLS TEST index/version returned200. Actual normal-user sign-in reused the preserved Microsoft profile; authenticated GET /api/projects returned200 and three workspaces. Unauthenticated POST /api/chat returned401. Public /health/ready serves the frontend fallback, so its200 was explicitly excluded as backend readiness evidence. No paid TEST semantic replay was run; the repaired semantic behavior is proven by the six production cases, with source identity and runtime/access checks for TEST. Frontend remained the existing 697da69-2026-09-28T08:26:39.974Z.
Both task-owned verification WebDriver sessions were closed; their renderer verification memory was cleared. Existing browser profiles/containers remain preserved. The unused untracked component-probe experiment was removed. Encrypted diagnostic/key copies are task-scoped and are removed after this canonical reconciliation; original feedback and user documents are retained.
Six application verification requests were submitted. Application contract allocation was conservatively bounded by the entire UTC-day UserChat aggregate after verification: CHF4.159366129032258, including unrelated concurrent activity. Exact first-request attribution and provider invoice attribution are unavailable. This is application allocated-cost evidence, not a billed-cost claim. No further model calls are planned.
The precise historical planner selection was not retained. The original lite path skipped retrieval and generated unsupported company specifics; new routing logs support recurrence diagnosis. Low-urgency follow-up: phrase empty-workspace responses as missing evidence rather than calling a specific question too unspecific.
The production code is retained in the narrow release branch; general MAIN promotion remains stopped. A future broader release must include this reviewed search fix and preserve the immutable sibling release and documents. The legacy overwrite deployment route is unsuitable for that promotion. This separate future integration/release action is not executed here.
Full incident and acceptance history.
PR6693 merged the final REQ-0008 completion state and exact TEST evidence into DEV at fd373989cd7a0f3376f68b52ab187ee085c35a59; the remote tree exactly matches reviewed source f51a218c454524aa261372e7c2968c06425d2384. Only the existing requirement's status/evidence changed. The source mirror admitted this commit, and the documentation-only skip-ci commit created no Actions run or deployment. No additional model calls were submitted.
Temporary diagnostic recipient-key and ciphertext copies and the browser helper were removed after canonical evidence read-back. Restricted source/artifact evidence remains bounded for task retention; all user feedback, documents, preserved sign-in profiles and production rollback binaries remain intact. Incident scope is complete with the explicit semantic-verification limit described above.