Release corrections: candidate URL exposure, onboarding notification honesty, pasted link cleanup #101

Merged

approver_agent merged 5 commits from task/release-corrections_6819ce33-3715-4bd4-9208-a54a8b5cee02 into dev 2026-10-06 23:12:27 -04:00

Conversation 4 Commits 5 Files Changed 17

+712 -68

5 Commits

Author	SHA1	Message	Date
dev_agentandClaude Opus 5.5	471daec594	Refuse expired candidate offers at lookup time ... Store each offer set's deadline and check it under offersMu in candidateURL, so an expired candidate id cannot ground a dinner while its eviction timer is delayed. The timer still evicts the set from memory. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 22:58:43 -04:00
dev_agentandClaude Opus 5.5	bef3f3fd5c	Evict expired candidate offers on a timer ... Each dinner's offered candidates now carry a time.AfterFunc expiry that drops them from the service once offerLifetime passes, so token-bearing candidate URLs are no longer held until some later search sweeps them. Storing new offers or clearing a dinner's offers stops the old timer; the timer drops only the set it was armed for. The expiry runs no goroutine until it fires and touches only the in-memory map. TestCandidatesExpire now waits for the eviction with no further search and checks the candidate no longer grounds; TestExpiredCandidatesNotHeld checks no dinner's expired offers remain held. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 22:50:47 -04:00
dev_agentandClaude Opus 5.5	515919088a	Retire the v2 API cache, bound candidate offers, deflake link leak tests ... - Bump the service worker API cache to v3 so activation deletes the v2 cache, whose recipe-candidate responses used the full page URL as candidate_id; test that activation deletes v1 and v2 and keeps v3. - Give candidate offers a 30-minute lifetime, drop expired offers when new ones are stored, and clear a dinner's offers on every hand grounding (candidate, link or manual) and on archive. A candidate search still running when its dinner is cleared stores nothing, so a stale candidate_id gets the same 400 as an unknown one. - Make the link leak assertions in TestDinnerResponsesHideTokenInLinkPath and TestCreateRegularNeverNamesFromLink check phrases a ULID cannot contain, so a dinner id holding "KEY" no longer fails them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 22:35:30 -04:00
dev_agentandClaude Opus 5.5	db6f39cdb9	Restore embed placeholder and reflow architecture notes ... make build overwrote the tracked internal/frontend/dist/index.html placeholder in the previous commit; put it back as it is on dev. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 22:17:01 -04:00
dev_agentandClaude Opus 5.5	e9e9087b48	Hide candidate URLs, report unavailable notifications, clear grounded links ... Release corrections from the review of promotion pull request #98: - MQ-98-01: recipe-candidates returns an opaque candidate_id (an HMAC of the dinner and page under a per-process key) that the server resolves to the page it last offered that dinner. Candidate URLs, which may carry a token, no longer reach responses or the service-worker cache. - MQ-98-02: "Turn on notifications" no longer finishes onboarding silently when notifications are unavailable (or denied); the step says plainly that nothing was turned on and offers "Finish setting up". The placeholder stays until Feature 19 wires Web Push. - MQ-98-03: GroundPendingDinner clears the pasted recipe_url when background grounding succeeds, as manual grounding already did. Maestro task 6819ce33-3715-4bd4-9208-a54a8b5cee02. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 22:16:44 -04:00