# Compass overnight change log

Started 7 September 2026. Local branch `feat/overnight-compass-20260907`, based on `7d64d2ba1`. The reviewed application head `471337daa` passed both full test orders. Its sole actionable review finding is applied in `93e67d028`; final follow-up verification passed **2,609 examples with zero failures**, seed 83719.

| Improvement | Before | Changed behavior | Evidence |
|---|---|---|---|
| Import action totals | Checked Keep/Skip rows were described as imports. | Live summary distinguishes selections, uploaded values, kept rows, exclusions, invalid rows and conflicts. | Mixed-action browser tests assert saved records. |
| Accurate conflict detection | Identical matches inflated conflicts; sell-currency-only and text-case changes could be hidden. | Compare the typed values the importer saves, including sell currencies and exact free text. | Request regressions. |
| Complete comparisons and errors | Long values were truncated; errors depended on tooltips. | Show full uploaded/existing values and visible invalid-row explanations. | Request and browser checks; synthetic screenshots. |
| Accessible row controls | Row inputs lacked useful names. | Named controls, a live summary and a labeled keyboard-scrollable comparison region. | Keyboard browser check. |
| Usable long reviews | Confirmation scrolled out of view; phone containment needed repair. | Sticky wrapping footer, contained table scrolling and a phone scroll hint. | Desktop 1400 and phone 390 checks in normal and replace-all modes. |
| Explicit replace-all scope | Warning omitted existing counts and did not preserve earlier row choices. | Show records removed, selected replacements and omitted-record consequences; restore Keep/Skip choices when toggled off. | Browser persistence and mode-toggle tests. |
| Document currency restrictions | Extraction discarded an explicit allowed sell-currency list; confirmation could clear a saved restriction. | Request, retain and validate the field through extraction and confirmation. | 5 new examples, 4 failed before the fix; extraction group 80/0 afterward. |
| Stable test class identity | Watched-file changes could reload Rails classes during a suite. | Disable test reloading and bypass Spring together. | Real automatic-reloader subprocess fails under old configuration and passes under new. |
| Guarded isolated test command | Environment overrides or concurrent runs could target shared state. | Explicit numeric database suffix, preboot/resolved-config guards, database and checkout locks through process exit, explicit safe preparation and normal RSpec discovery/status. | 31 runner examples plus an automatic-reloader regression; two real repeated database preparations. |
| Accurate setup and documentation | Setup required nonexistent Yarn dependencies and included unwanted seeding/cleanup/restart behavior; docs described the wrong stack. | Setup follows the actual Ruby/Rails asset stack; document real test, extraction and background-worker requirements. | 95 existing request/model/job/browser examples through the guarded raw RSpec path. |
| Pinned URL destination | DNS validation and socket connection resolved separately. | Connect to validated addresses while retaining the original TLS and Host identity; disable environment proxy bypass. | Socket-level regressions and two real local TLS handshake tests, including wrong-host certificate rejection. |
| Special-use address checks | Mapped private addresses and additional special-use ranges escaped checks. | Normalize mapped addresses and reject blocked destinations before HTTP creation. | Blocked/mixed-address regressions. |
| Safe address fallback | Initial pinning could fail a valid dual-stack URL at its first unreachable address. | Try only captured validated addresses under the existing total deadline, including unsupported-address-family failures. | Connection failure, address-family and deadline regressions; 81 existing service examples plus two TLS examples pass in the integrated suite. |

## Verification record

- Unchanged main baseline: **2,537 examples, 0 failures**, seed 10459, dedicated database 201.
- Import worker: **118 examples, 0 failures**, seed 53799; extended normal/replace-all layout check **1/0**, seed 61162.
- Test-workflow compatibility: **95 existing examples, 0 failures**, seed 8421. Final runner regressions: **31 examples, 0 failures**, seed 22946; one additional automatic-reloader regression passes in integration.
- Final application head `471337daa`, guarded `bin/test --seed 10459`: **2,609 examples, 0 failures**. This is 72 more examples than the fixed baseline.
- Post-simplification focused run: **201 examples, 0 failures**, seed 10459.
- Two real repeated `--prepare` runs on isolated database 203: **27 examples, 0 failures each**, seeds64224 and26633, before the five discovery regressions were added. The selected database remained203 and the `postgres` public catalog remained empty before and after both runs.
- Runtime: Ruby 3.3.6, Rails 8.1.2, RSpec Core 3.13.6, installed net-http 0.9.1. Synthetic browser checks at 1400×900 and390×844. TLS checks use an in-memory fixture certificate and a local server; no live model request is used as verification.
- Second full order at the same head: **2,609 examples, 0 failures**, seed 83719. The committed follow-up `93e67d028` subsequently passed **2,609 examples, 0 failures**, seed 83719.
- Complete independent review: **8 of 8 Astra ultra lenses**, plus a separate finding validator. All U1–U4 requirements met; one P2 timing-sensitive test finding, applied in `93e67d028`. See `review.md` and the original `review-receipt.json`.

## Review catches

- First-address pinning needed fallback for valid multi-address hosts. Added captured-address fallback; ultra review additionally found unsupported-family socket errors, now covered by the same bounded fallback.
- Phone browser checks found horizontal page overflow. Contained the table and verified both body width and clickable confirmation.
- Rails primary-database URL overrides require guarding alongside DATABASE_URL. Included in the test runner.
- Preparing an existing database can leave Rails connected to `postgres`. Explicitly restore the selected test configuration and verify the real current database before schema loading; lifecycle regressions and real repeated preparation verify the repair.
- An early exit hook could release test locks before older RSpec exit hooks finished. Hold lock descriptors until operating-system process teardown, with subprocess checks for both the database and checkout locks.
- The first pathless `bin/test` run reported zero examples and exit0. This was failed verification. RSpec relies on its program name to discover the default spec directory; the launcher now preserves that name. Four real CLI cases failed before the fix, then passed; help behavior is also covered.
- The first complete integrated suite ran 2,604 examples with one stale VCR header expectation after adding sell-currency restrictions. Updated that expectation without recording an external request. The later full suite includes the five additional discovery examples and passes.
- Simplification removed a redundant database COUNT from import preview, reusing the already-loaded association, and reused the parser's currency-corridor header definition while preserving independently mutable strings.
- New restriction-spec naming and style offenses were corrected. The final follow-up removes four introduced offenses in existing URL files too. Repository-wide RuboCop ends at **407 offenses in 277 files**, versus **414 in 272 baseline files**; all five wholly new Ruby files are clean. The remaining lint debt is reported, not treated as a passing lint check.
- Final review found a test that depended on a real 10 ms scheduling window. A controlled monotonic clock now advances only inside the first failed connection attempt, and the test explicitly forbids the second address. Applied in `93e67d028`; the focused extraction/TLS/restriction group passed **88 examples, 0 failures**, seed 20137.
- Initial ultra reviewers could not inspect source because the nested read-only sandbox failed before execution. Those attempts provide no review evidence; replacement runs use working host execution with read-only instructions.

## Isolation and delivery

Authentication/email and lookup/evaluation work remain reserved for other sessions. A separate local Claude authentication/email session was confirmed; active ownership of the earlier lookup goal could not be established, so that area was also reserved. This work improves the already-merged baseline; it does not claim a new line-by-line re-verification of the earlier 35 findings.

Canonical checkout: `/home/stevan/dev/compass-overnight-20260907`. Worker checkouts: `compass-overnight-import-ui`, `compass-overnight-dev-workflow`, `compass-overnight-url-fetch`. Only newly reserved test databases 201–204 were used. Worktrees and databases remain for inspection. No migration or dependency was added.

All application changes stay on local worktrees/branches. No application deployment or push is part of this run. The HTML review uses its own Cloudflare Pages project with only report sources and synthetic screenshots: https://compass-overnight-20260907.pages.dev. No customer data, API credentials or raw session transcripts are included.

## Advisory test coverage opportunities

The review identified three useful extensions without a confirmed production defect: a committed successful first-time database preparation case, comparison parity across other upload types, and a controller reconnect with replace-all already checked. These are recorded in `review.md`; no new feature or broader refactor was started during final verification.

## Final isolation checks

Main remains at `7d64d2ba1329e06400446d1c755750b1ea5f033b`. Its tracked diff and the hashes of all three original untracked files match the initial snapshot. The `postgres` public catalog also matches its initial empty state. The temporary review configuration was removed.

## Commit trail

- `9e75e046b` — [COMPASS] Scope isolated overnight improvements
- `1087133c9` — [COMPASS] Pin document URL connections to validated addresses
- `fbbd58daa` — [COMPASS] Preserve document currency restrictions through import
- `3220ae402` — [COMPASS] Clarify upload review decisions and replacement scope
- `f81e5645b` — [SPEC] Run stable tests in guarded isolated databases (U2)
- `ea0e25d8a` — [SPEC] Keep preparation and exit hooks isolated (U2)
- `2afbf0aba` — [COMPASS] Prove pinned document fetches preserve TLS verification
- `a0d3e31f7` — [COMPASS] Retry validated URL addresses within one deadline
- `f6f2bfc45` — [COMPASS] Record extraction preservation acceptance criteria
- `ec4a3eb59` — [SPEC] Discover examples in pathless test runs (U2)
- `5ff30c094` — [COMPASS] Share corridor columns and reuse preview records
- `471337daa` — [SPEC] Align extraction restriction regressions with conventions
- `93e67d028` — [SPEC] Make URL deadline coverage deterministic (U3)