wip(handoff): restore backend suite to green

Co-Authored-By: Codex <noreply@openai.com>

.ai/HANDOFF.md

@@ -2,60 +2,62 @@
 
 # HANDOFF.md
 
-**Last updated:** 2026-04-25 (America/New_York)
+**Last updated:** 2026-04-25 06:12 EDT
 
-**Active task:** Restore green CI gate on `main` and address the 54 real backend test failures. See [CURRENT_TASK.md](CURRENT_TASK.md).
+**Active task:** Restore green CI gate on `main` and lock it via branch protection. See [CURRENT_TASK.md](CURRENT_TASK.md).
 
-**Branch:** `fix/ci-workflow-config` — a small workflow-only PR (#150) that should turn CI green on the next run. After #150 merges, follow-up work is on a fresh branch off main.
+**Branch:** `fix/ci-workflow-config`
 
-## Where the previous session left off
+## Current state
 
-FlowPilot Phase 1-9 (PR #147) and PSA ticket management (PR #141) are both on main. Two CI-recovery PRs (#148 and #149) followed, fixing 4 real bugs and bringing the backend test suite from `482 passed / 488 errors / 44 failed` → `1018 passed / 4 errors / 54 failed`.
+Previous session fixed the 54 real backend failures left after #149. The default backend suite is now green locally:
 
-CI on main still showed red after #149 because of two workflow-config issues unmasked once the code-side rot was cleared. PR #150 fixes both.
+```bash
+docker exec resolutionflow_backend bash -lc 'pytest --override-ini="addopts=" -q > /tmp/full-backend.log 2>&1; code=$?; tail -n 160 /tmp/full-backend.log; exit $code'
+# 1076 passed, 35 deselected in 1347.41s (0:22:27)
+```
 
-## Currently open
+Targeted validation also passed:
 
-- **PR #150** — `fix/ci-workflow-config` → main. Mergeable. Two changes:
-  1. Add `DATABASE_TEST_URL` env to the backend job. `conftest.py` reads `DATABASE_TEST_URL` only — `DATABASE_URL` is intentionally not consulted (see `dab740d`'s safety hardening). Without this env, conftest falls back to its `localhost:5432` default and every fixture-setup fails with `Connect call failed ('127.0.0.1', 5432)` — observed as 638 errors on the `f27f671` run.
-  2. Pin `actions/upload-artifact` + `actions/download-artifact` to `v3`. Gitea Actions doesn't support v4+ (`GHESNotSupportedError`). Lint itself passes already after #149; the job exited 1 only on the upload step.
+- `tests/test_session_resolutions_api.py tests/test_session_sharing.py tests/test_session_suggested_fixes_api.py tests/test_survey.py tests/test_tenant_isolation_p0.py tests/test_tree_sharing.py tests/test_trees.py::TestTrees::test_delete_tree_cleans_up_folder_and_tag_assignments tests/test_uploads.py::test_delete_upload_forbidden_for_non_owner` → `73 passed`
+- PDF export tests → `3 passed`
+- Prompt/PSA/resolution/script-builder subset → `14 passed`
+- Admin/AI/branch subsets → `11 passed`
+
+## What changed
+
+Production fixes:
+
+- CI/backend dev image now installs WeasyPrint system libraries.
+- Public share-token and survey routes are mounted outside tenant auth; protected share management remains tenant-protected.
+- Folder creation now persists `UserFolder.account_id`.
+- Script Builder save-to-library now persists `ScriptTemplate.account_id`.
+- Resolution output generation eager-loads `AISession.steps` to avoid async lazy-load `MissingGreenlet`.
+- AI session model now declares the generated `search_vector` column already present in Alembic, so `create_all` test schemas match runtime migrations.
+- Direct account-role update now rejects `"owner"`; ownership changes must use the transfer path.
+- Assistant prompt marker examples no longer include a literal executable `create_spin_off_ticket` payload.
+
+Test/harness fixes:
+
+- Test seeds updated for tenant-scoped `account_id` columns on sessions, branches, resolution outputs, script templates, PSA connections, folders, schedules, and categories.
+- Tests aligned with 404-not-403 resource-hiding policy.
+- Disabled-AI tests now restore both Anthropic and Google key settings.
+- Pytest harness closes pytest-asyncio's leftover clean loop and ignores known unclosed asyncio/asyncpg teardown ResourceWarnings that otherwise appear at arbitrary later setup points under `filterwarnings = error`.
 
 ## Immediate next steps
 
-1. Watch PR #150's CI run on its head sha. Both `CI / backend (pull_request)` and `CI / frontend (pull_request)` should now succeed. If they do, merge it.
-2. After #150 merges, add `CI / backend (pull_request)` to required status checks on main:
-   ```
+1. Commit current working tree if not already committed with trailer:
+   `Co-Authored-By: Codex <noreply@openai.com>`.
+2. Check PR #150 status on Gitea. If both `CI / backend (pull_request)` and `CI / frontend (pull_request)` are green, merge it.
+3. After #150 merges, add `CI / backend (pull_request)` to required status checks on main:
+   ```bash
    PATCH /repos/chihlasm/resolutionflow/branch_protections/main
    { "status_check_contexts": ["CI / frontend (pull_request)", "CI / backend (pull_request)"] }
    ```
-   ($GITEA_TOKEN is in `.claude/settings.local.json`.)
-3. Start on the 54 real backend test failures. Suggested approach: read 3-5 failing tests, find the dominant root cause (likely fixture-scoping or DB-cleanup leak — one sample seen this session was `test_psa_writeback_phase4` failing with `duplicate key value violates unique constraint "ix_users_email"`, which points at the `test_user` fixture being called twice in a test path). Fix categories in atomic commits.
-
-## Uncommitted state
-
-Working tree clean (after this handoff commit).
-
-## Branch protection on main
-
-Enabled in this session:
-- PR-only merges
-- `CI / frontend (pull_request)` required
-- Force-push blocked
-- No review required (solo repo)
-
-## Recently merged on main (in order)
-
-- `f27f671` — PR #149: fix(ci): frontend lint to zero errors + test-DB schema fix + dev-deps installable
-- `06593a4` — PR #148: fix(tests): repair two pre-existing bugs blocking backend CI
-- `32fae2c` — PR #147: feat: FlowPilot migration — Phase 1-9 + Phase 9 bug fixes + QA fixture harness
-- `16060d2` — PR #141: feat: PSA ticket management — /tickets page, detail panel, AI ticket creation
+   `$GITEA_TOKEN` is in `.claude/settings.local.json`.
+4. Run/confirm frontend lint if needed for the final DoD item (`npm run lint` was already green after #149, but this session did not rerun it).
 
 ## Open questions
 
-- The 54 real backend failures haven't been root-caused yet. One sample (the unique-email violation) suggests a test-fixture leak. Need to read more failing tests before writing the cleanup PR — don't assume one root cause.
-
-## Useful breadcrumbs
-
-- `backend/scripts/seed_phase9_qa_fixtures.py` (new) pre-bakes 4 ai_sessions × 4 suggested_fixes covering the four backend states the AI orchestrator must produce. Use it for any future Phase 9 QA pass instead of hoping the AI emits a `SUGGEST_FIX`.
-- `.gstack/qa-reports/phase9-20260424-232700/REPORT.md` — full QA report from this session, with screenshots showing the four Phase 9 layout/state bugs that were fixed.
-- `gstack` is now in team mode for this repo (`.claude/settings.json` + `.claude/hooks/check-gstack.sh`); the `/browse` Chromium needs `CONTAINER=1` env var to add `--no-sandbox` (see `~/.claude/skills/gstack/browse/src/browser-manager.ts:188`).
+- PR #150 was not rechecked or merged in this session.
+- Branch protection was not updated in this session.