Prepare shared curriculum source-order import compatibility

[alexeygrigorev]

Goal

Prepare the DTC import boundary for the two reviewed nullable source-order fields in community-base C5.4, preserving the current visible course experience, source positions, stable records, replay metadata and fail-closed field coverage. Keep the existing tagged package dependency.

Read first

• _docs/specs/04-courses-and-cohorts.md: preservation of learner workflows, shared curriculum and stable identities.
• _docs/specs/09-migration-rollout-roadmap.md: atomic, repeatable imports and retained learner data.
• _docs/architecture/course-platform-shared-apps-mapping.md: SharedModule/SharedLesson field decisions and explicit package defaults.
• _docs/runbooks/production-data-migration.md, Step 9 (P6): mapped-family equality, refusal before writes and controlled target access.
• _docs/PROCESS.md, _docs/ci/change-selective-ci.md, coding-standard.md.
• Accepted compatibility precedent #443, including its actual-model evidence and final scope; preserve accepted security remediation Remediate the locked PyJWT advisory blocking required quality checks #444.
• community-base #306, remaining implementation contract, and consumer sequencing clarification.

Current evidence and precise owner

Reviewed DTC commit: cdcd1ca87f0de0a7d19ac8da8f9b744503d1ad73.

scripts/prod/import_shared_course_platform.py owns the compatibility decision:

• _mapping() maps courses.SharedModule to cb_curriculum.Module and courses.SharedLesson to cb_curriculum.Unit (currently lines 529–606).
• Both families copy site position into target sort_order; cohort placement positions have their separate existing owner.
• _refuse_mapping_drift() inspects actual concrete fields and rejects unclassified source or target fields before any family write (currently lines 262–297).
• Existing module/unit import dictionaries omit target-only metadata (currently lines 1252–1323). Do not alter those dictionaries or create an ordinal from site positions.

The package contract proposes nullable internal source_sibling_position on Module and Unit, separate from public/Studio sort_order and cohort placements. These concrete fields/migration are not present in the inspected package default-branch model snapshot at grooming. This issue is anticipated compatibility work, not a claim of a current production failure or future-model test success.

Artifact prerequisite and non-circular delivery sequence

Grooming is complete, but implementation is on hold until the package owner supplies an exact reviewable #306 candidate artifact containing:

1. Module and Unit model definitions for nullable source_sibling_position, an additive migration, and explicit fresh-row None defaults.
2. The real ordering/projection contract showing that null source positions preserve the prior sort-order/tie behavior for non-authored imported rows.
3. An exact package commit SHA, migration name and worktree/artifact reference suitable for a package-owned disposable P16 consumer test. A mutable branch name or design comment alone is insufficient.

The package candidate need not be merged or released. Do not make package #306 merge a dependency of DTC #445: its final consumer gate itself needs this DTC compatibility correction. The sequence is concrete candidate → bounded DTC implementation → pinned DTC gates plus package-owned actual-candidate proof → independent tester and PM → focused DTC commit/integration → package's final P16 against the resulting DTC default branch → package merge/release through its own process.

If the supplied candidate changes field names, null defaults or legacy ordering behavior, stop and amend this contract before implementing. Never broaden the default allowlist or overwrite metadata to conceal that difference.

There is no source-level dependency on development recovery #442 / AWS #58. Those remain separate operational gates; this issue authorizes no workaround, additional reset or deployed import. Site process still governs integration and post-push observation.

Field decisions

DTC source family	Package target field	Fresh row	Replay
SharedModule	Module.source_sibling_position	None; no source ordinal exists	Preserve the existing target value, null or non-null
SharedLesson	Unit.source_sibling_position	None; no source ordinal exists	Preserve the existing target value, null or non-null

DTC's site position continues to copy exactly to sort_order; these values are not reinterpreted as authored source ordinals. Slugs, parent/module relations, cohort placements, copied Markdown/HTML and learner state keep their current import semantics. A site source position edit on replay updates the existing copied sort_order as before while preserving target-only source metadata.

An explicitly named default absent from the older pinned package is inert under the existing guard. Every other unclassified actual concrete source/target field remains an error. Do not add version checks or a general unknown-field exemption.

Scope

1. Add only source_sibling_position to the existing package-default sets for the two named mappings. Leave import writes, identity matching, transaction boundaries, permission/target checks and drift detection unchanged.
2. Extend the existing bounded scripts/tests/test_import_shared_course_platform_defaults.py owner with cohesive curriculum guard/default/replay tests. Reuse the existing synthetic family graph and helpers; retain Declare authored-homework defaults in the shared-course import mapping #443 homework tests. This module is already in PRODUCTION_IMPORT_PYTHON and strict mypy, so no new registry, pyproject, seal or lock change is needed for this scope. If a separate test owner becomes necessary, return to PM for a justified bounded amendment before editing registrations.
3. Add the two decisions to _docs/architecture/course-platform-shared-apps-mapping.md, recording absent-field compatibility, null creation values, unchanged copied positions/ordering, and replay preservation.
4. Work in a new isolated DTC worktree at an explicitly recorded committed main revision. Shared dirty main and other agents' worktrees remain read-only. Announce exact ownership before source edits.

Coding standard: new functions at most 30 lines and the existing bounded test module at most 300 lines; no prohibited control flow. The importer and _mapping() are already oversized (2,178 and 690 lines at the reviewed baseline). A narrow cohesion exception permits only the formatter-required declaration-line growth caused by adding the two exact set members (at most nine lines across the existing importer/function). Record measured before/after file and function line counts and demonstrate unchanged executable write/guard logic in both engineer and tester reports. No executable control flow or write function may grow. Do not compress unrelated code to offset formatting, split the large importer arbitrarily, or introduce an unrelated refactor.

Non-goals

No package pin/dependency/lock change, model/migration in DTC, UI/template/view/route/API change, package source-order implementation, mixed-source adoption, new schema inference, source conversion, project-reference mapping, general compatibility shim, guard weakening, deployed import, database reset, production-data access or manual deployment. There is no analogous AISL field-default issue in this scope.

Acceptance criteria

• AC1: The exact concrete package candidate/model/migration and null-ordering contract are recorded before implementation, matching the artifact prerequisite above. No candidate-merge prerequisite is introduced.
• AC2: Only the two named Module/Unit target defaults are added; existing write dictionaries, identity matching, transaction and target/access logic are unchanged. No ordinal is synthesized from a DTC position, title or slug.
• AC3: Against the unchanged tagged dependency, anticipated absent fields are inert and the existing dry-run/apply/count/replay/refusal suites pass. Dependency declarations, lock bytes and dependency seals remain unchanged from the recorded baseline.
• AC4: In the package-owned disposable test using actual migrated candidate models, fresh imported Modules and Units have source_sibling_position=None. Nontrivial site positions remain exact target sort_order values; legacy order/tie behavior, copied slugs/content/HTML/relationships and mapped-family equality remain correct.
• AC5: In that same real-model context, replay preserves Module, Unit, CohortModule and UnitProgress primary keys and relationships; deliberately set non-null source ordinals on both Module and Unit survive replay. A site position change still updates only its historically copied sort_order while target metadata and learner progress remain intact. Family counts stay equal with no duplicate rows.
• AC6: An unrelated concrete target field on each of Module and Unit raises named MappingCoverageDrift before the first family write. Existing unknown-source-field refusal and Declare authored-homework defaults in the shared-course import mapping #443's reviewed homework defaults/retention continue to pass. No blanket allowlist or guard change is made.
• AC7: Documentation explains both exact defaults and their source gaps, old-tag compatibility, unchanged public position/order and replay semantics. No UI, route, access, schema, pin or deployed-data change exists.
• AC8: The existing registered test owner remains within coding-standard limits and passes unchanged adoption-coverage/lint/format/strict-type gates. Importer growth is limited to the documented declaration-only exception; all other source owners remain untouched.
• AC9: Final engineer and independent tester reports bind exact DTC base/head/patch, package candidate SHA/migration, relevant input hashes, plan/graph digests and exhaustive component dispositions. Candidate-only tests skipped on the old tag demonstrably execute and pass on real candidate models. No required failed, skipped or pending evidence remains before separate PM acceptance.

Verification scenarios

Pinned site environment

• Run existing scripts.tests.test_import_shared_course_platform and extended scripts.tests.test_import_shared_course_platform_defaults through the maintained uv-backed Django test environment.
• Guard tests may simulate concrete metadata to prove recognized-versus-unknown field handling. Metadata mocks do not satisfy real creation/replay AC4–AC5.
• Exercise unrelated fields separately on Module and Unit and assert the model/field diagnostic and zero family writes. Retain the existing source-field refusal tests.
• Run unchanged ci/tests/test_adoption_gate_coverage.py, source/dependency guards and exact byte seals; independently confirm pyproject/lock are unchanged.
• Generate the final versioned plan from frozen source and follow its selected gates without manual narrowing. Backend browser minimum is smoke; obey any broader generated tier. No render impact means screenshots are explicitly not applicable, not pending.

Actual candidate models under package-owned P16

• The package owner creates a disposable DTC checkout at the recorded base, overlays the exact frozen DTC patch and links the exact Redirect legacy /podwiki/* URLs to the canonical /wiki/* routes #306 package candidate under community-base D15/P16. Never link the original site worktree or commit branch/path sources.
• Apply the real candidate migration in an owned synthetic test database. Execute both importer modules; all new candidate-only tests must run, not skip.
• Include more than one published module/unit with distinctive noncontiguous positions and permitted ties so a default-order assertion cannot pass accidentally on a one-row fixture. Use the candidate's actual legacy/null ordering owner to prove the fallback contract; do not invent a second sorter in the site importer.
• Cover fresh defaults, unchanged copied values/order/counts, replay with deliberately changed target ordinals, source position updates, stable IDs/placement/progress links, and refusal before writes.
• Record exact package SHA, DTC base/patch and relevant file hashes, migration, commands/counts, zero candidate-only skips and retained log digests. Restore the disposable tagged dependency afterward. Use synthetic data only.
• This focused candidate proof enables DTC acceptance. It does not replace the package's later full consumer comparison against DTC default main after integration, nor any real-data adoption/rehearsal gate.

Required handoffs

SWE implements only after the candidate artifact prerequisite is met, then freezes uncommitted source and posts evidence. Separate tester independently verifies final source/plan and real-model proof. Separate PM accepts. Original SWE commits; orchestrator performs isolated no-ff integration and assigns sole site on-call. Package on-call separately owns final P16. No DTC pull request is created.

[alexeygrigorev]

Grooming Complete — awaiting concrete package candidate

Issue #445 is groomed with nine testable acceptance criteria, exact field decisions, ownership, non-goals and verification/handoff requirements. Removed needs grooming; retained P1/courses/integration and added enhancement. This is not permission to implement while the model artifact is absent.

Reviewed accepted DTC cdcd1ca87f0de0a7d19ac8da8f9b744503d1ad73, the strict guard, both SharedModule/SharedLesson target mappings, import write owners, existing bounded defaults-test module and quality registration, the course/migration specifications and P6 decisions, accepted #443, and package #306's latest contract. The planned new fields are not in the inspected package default-branch model snapshot.

Decisions:

• Add only Module.source_sibling_position and Unit.source_sibling_position to their existing package-default sets. Fresh value is null; replay preserves target metadata. DTC source position still copies exactly to sort_order; do not synthesize source ordinals.
• Extend the existing 109-line registered defaults-test owner when implementing. No pyproject, seal, dependency, lock or registry changes are needed for the groomed scope.
• A narrow, orchestrator-acknowledged cohesion exception covers only formatter-required set declaration growth, at most nine lines. Baseline importer/function counts are 2,178/690; reports must measure before/after and prove executable writes/guards unchanged. It is not permission for general importer growth.
• Unknown target fields on both models and unknown source fields remain fatal before family writes. Actual candidate-model proof must cover non-null replay metadata, stable Module/Unit/placement/progress IDs and relations, unchanged copied sort positions/legacy order, equal counts and no duplicates.

The prerequisite is an exact reviewable package candidate SHA with both nullable model fields, real additive migration and null-ordering fallback contract. A package merge/release is not required before DTC compatibility can land. Sequence: candidate artifact, bounded site work, pinned gates plus package-owned disposable real-model proof, independent tester and PM, DTC integration, then package final default-branch P16. This avoids a circular merge prerequisite while preserving the site's existing tagged-source guards.

No site source edits, tests, commits, CI observation, package pin change, deployed import, database reset, cloud operation or UI change occurred during grooming. No future-model proof or current deployed recovery is claimed. #442/AWS #58 remains separate; no analogous AISL defaults issue is introduced.

[alexeygrigorev]

Engineering prerequisite receipt (AC1)

Before source edits: exact immutable community-base candidate c9b47791731a7ecd55d16d1fe71138d542751b22, tree f380829dfb696a87680e23394300a7ecb832d661, read from /data/agents/community-base/worktrees/c5-4-mixed-snapshot-445. Real additive cb_curriculum.0005_module_unit_source_sibling_position defines both fields as nullable, blank, non-editable positive integers with fresh None. Actual CourseTree preserves pure/null sort_order/primary-key ordering. Model SHA-256 45ab5d1acdb0d1383a6592d268e6e6cf97d0f7624b8e0cd2fc38e683b2d3f42f; migration c0e8292371aaaff90fcb03e50543b7f4d2e816efe0dabc725c3c15f76d7cbaca; projection 5e514955ef593f8358d7f7ac8341dd0d00de492aba63ef84408865cf2caa56c8.

Candidate is unaccepted and unmerged; its merge is not a prerequisite. DTC worktree /data/agents/dtc-website/worktrees/c5-source-order-compat-445, branch c5-source-order-compat-445, base cdcd1ca87f0de0a7d19ac8da8f9b744503d1ad73. Ownership remains only importer default declarations, existing defaults tests, and mapping documentation. Tagged dependency/lock remain unchanged; package-owned disposable real-model proof follows frozen source.

[alexeygrigorev]

DTC 445 package-owned actual-candidate proof

Result: PASS for the focused concrete-model acceptance evidence. This is not final site tester/PM acceptance or the package's later full comparison against site main.

Exact subjects

• DTC base: cdcd1ca.
• Frozen three-path site patch: 6e4d6dd7ee0b6b06524f50bd2950efb563c93eea73f741ee8063cf65b6d1a07f.
• Package snapshot: c9b47791731a7ecd55d16d1fe71138d542751b22, clean detached source in /data/agents/community-base/worktrees/c5-4-mixed-snapshot-445; explicitly unaccepted and unmerged.
• Real migration: cb_curriculum.0005_module_unit_source_sibling_position.
• Package-owned disposable site: /data/agents/community-base/worktrees/p16-dtc-445-candidate.
• Exact per-file hashes, including unchanged dependency files, are retained in .tmp/445/fingerprints.json.

Verification

The original unpatched site importer was first linked to the exact package snapshot. Calling its strict field guard under the maintained isolated test environment raised MappingCoverageDrift for exactly cb_curriculum.Module.source_sibling_position and cb_curriculum.Unit.source_sibling_position. No database import ran. Evidence: .tmp/445/prepatch-real-model-refusal.log.

After verifying and applying the frozen patch, the maintained site runner applied the actual candidate migration and executed both importer modules:

uv run --frozen python scripts/community_base_link.py link --sibling /data/agents/community-base/worktrees/c5-4-mixed-snapshot-445
uv run --frozen python -c 'from scripts import ci; ci._run(ci._python("manage.py", "test", "scripts.tests.test_import_shared_course_platform", "scripts.tests.test_import_shared_course_platform_defaults", "--noinput", "--verbosity", "2"), environment=ci._test_environment())'

Test handle 82841 exited 0: 26 tests passed, zero skipped, 1.670 seconds. All three new curriculum cases and both existing authored-homework candidate cases executed on real migrated models.

The checks demonstrate fresh null metadata; exact noncontiguous source positions copied to sort_order; stable slugs, body/overview Markdown and HTML; actual CourseTree legacy ordering and permitted target-only ties; replay preservation of non-null metadata, Module/Unit/CohortModule/UnitProgress primary keys and relationships; unchanged progress timestamps; source position edits updating the copied sort_order; equal family counts and no duplicates. Unknown concrete source and target fields remain refused before writes. Source position uniqueness is respected; tie checks modify only package rows where ties are permitted.

Restoration

The maintained unlink command exited 0 and git diff --exit-code -- pyproject.toml uv.lock passed. The disposable checkout again uses its exact tagged dependency; only the three reviewed source/test/doc paths remain modified. The test runner destroyed its owned synthetic test database. The final source diff still hashes to the frozen patch above. No real site environment was linked, and no deployed import, database reset, cloud operation, commit or push occurred.

Test log: .tmp/445/candidate-importer-tests.log.
Test log SHA256: d3f1ca0141b0f06c8236a089747bf62cb3c1ed0353f7140746c83974fe0d1a1d.

[alexeygrigorev]

Engineering complete — frozen for independent tester and PM

Implemented AC1–AC8; AC9 engineering evidence is complete, with independent tester and PM acceptance still required. Source remains uncommitted and frozen.

Exact subjects

• Worktree /data/agents/dtc-website/worktrees/c5-source-order-compat-445, branch c5-source-order-compat-445; base/HEAD cdcd1ca87f0de0a7d19ac8da8f9b744503d1ad73.
• Frozen patch .tmp/445/candidate.patch, SHA-256 6e4d6dd7ee0b6b06524f50bd2950efb563c93eea73f741ee8063cf65b6d1a07f; exact three source hashes in .tmp/445/frozen-inputs.json and the package-owned candidate report.
• Package artifact recorded before source edits in AC1 receipt: immutable, unaccepted/unmerged c9b47791731a7ecd55d16d1fe71138d542751b22, real migration cb_curriculum.0005_module_unit_source_sibling_position.
• Tagged site dependency remains v0.5.10 / 4c692db461f4c7cbbc2f60afaa05162987a640f6. Pyproject SHA 0b03fff8636e8bc8e27b78b92e5c7ebb62f1b5798386112101ec84788c62ab08; lock SHA d634452d31e2dd7fde510713c1866bf01a092ec98a293f9dd310c0312d8a5b78, both byte-identical to baseline. No seal or registry change.

Behavior and scope

Only the two exact target-default set members were added. Fresh ordinals remain null; replay leaves existing target ordinals intact. Copied site positions, import writes, guards, identity matching, transactions and target authorization are unchanged. Every importer function except _mapping has the identical source SHA as baseline (.tmp/445/scope-audit.json). Unknown Module/Unit target fields and SharedModule/SharedLesson source fields are explicitly refused before _import_courses can write.

The existing registered defaults-test owner now contains 235 lines; all functions stay at most 30 lines. Importer 2,178 → 2,187 and _mapping 690 → 699 use precisely the approved nine declaration-line exception. Runtime diff is 10 additions/1 deletion (net +9), tests 127 additions/1 deletion, docs +15; this compatibility correction is not a net code deletion. No UI, route, API, site migration, pin or feature change.

Verification

• Red-before guard: expected failure for the two unclassified fields; unrelated-field refusal passed (.tmp/445/red-before.log). Package owner independently reproduced the exact real-model prepatch refusal before writes.
• Pinned focused importer modules: 26 total, 21 passes, five candidate-only skips (two existing homework and three new curriculum cases), .tmp/445/focused-pinned.log.
• Package-owned actual-model proof: exact frozen patch and immutable candidate; real migration applied; both modules 26/26 passed, zero skips. Fresh defaults/copied values, real CourseTree sort/tie ordering, non-null replay metadata, PKs/relationships/progress, source position edits, equal counts and refusal-before-writes all executed. Distinct source positions obey site uniqueness; permitted ties are a separate target-only stage. Test log SHA d3f1ca0141b0f06c8236a089747bf62cb3c1ed0353f7140746c83974fe0d1a1d; report SHA 5b747fe2b3d7ffdf84717df6c34350c913f2efd9b08214cbb4e87576cfc28a3d. Disposable dependency restored and synthetic test database destroyed.
• Final generated runner 46353 exited 0. Commands: VERIFY_ISSUE=445 uv run --frozen python scripts/ci.py verification-plan, then VERIFY_ISSUE=445 uv run --frozen python scripts/ci.py verification-run.
• Full Django: 4,159 total = 4,147 ordinary passes + one expected failure + 11 skips. The report's passed=4148 includes the expected failure; it is not an additional ordinary pass.
• Playwright smoke: 30/30, zero failures/skips/retries/quarantines. Container: 13 assertions. Quality and CI/evidence suites: each 716 total (711 passed, five existing skips), including adoption coverage, source/seal guards; lint/format/type checks passed (655 type-checked source files). Selector: one assertion.
• All six required automated components rerun successfully; reused and skipped component buckets empty. Screenshots explicitly not applicable because render inputs are unchanged. Evidence/report validation passed in the maintained runner.

Handoff artifacts

• Graph SHA 557fbababfd8ff983fa88aa29cdef88833c52667878ee72ff3493ae9c66d0ed1.
• Plan .tmp/verification/verification-plan.json; file SHA 75e5f27f4a36aa36b7d4df20ab8a5274084b5b55d373c6bf5a4fb95c9f6fc74f; canonical plan digest 08900d30016b4f1fcbe8df305ef56a760cd97cb1837585148dbc9e68ba209411.
• Report .tmp/verification/verification-report.json; SHA ff341264501de6b091ff35da1cab322650db9fb513e79396ed4e084a20481cac.
• Evidence .tmp/verification/evidence/; combined runner log .tmp/445/verification-run.log; pre/post scope audit .tmp/445/scope-audit.json.

No active runners remain. Independent tester owns the next verification window. No commit, push, deployed import, reset or cloud operation occurred. This does not mark broader course adoption or development recovery #442 / AWS #58 complete.

[alexeygrigorev]

QA Review

PASS — independent tester verification of the frozen, uncommitted #445 patch. No source edits, commit, push, dependency link in the site worktree, database reset, production access, or deployment.

Exact inputs

• Site worktree: /data/agents/dtc-website/worktrees/c5-source-order-compat-445; base and HEAD cdcd1ca87f0de0a7d19ac8da8f9b744503d1ad73.
• Exactly three modified paths; patch .tmp/445/candidate.patch SHA-256 6e4d6dd7ee0b6b06524f50bd2950efb563c93eea73f741ee8063cf65b6d1a07f remained identical after testing.
• Source SHA-256: importer c95633316b0f7dfae88bee9412f6c2c49af72faa716c4fa53136e21eccc001be; test 2bc56aaab6106913cb51b83dc0f8dfe5f8a6581a13b5a34c4b39e73cec52b210; mapping documentation d7bb124a0ff58941fdb4eb665b3f37abd41b99b4915d9f2dbc5195f8ad86a77e.
• pyproject.toml SHA-256 0b03fff8636e8bc8e27b78b92e5c7ebb62f1b5798386112101ec84788c62ab08 and uv.lock SHA-256 d634452d31e2dd7fde510713c1866bf01a092ec98a293f9dd310c0312d8a5b78 equal HEAD; tagged package dependency remains unchanged.
• Actual package candidate is clean immutable snapshot c9b47791731a7ecd55d16d1fe71138d542751b22, migration cb_curriculum.0005_module_unit_source_sibling_position; package model/migration/projection SHA-256 respectively 45ab5d1acdb0d1383a6592d268e6e6cf97d0f7624b8e0cd2fc38e683b2d3f42f, c0e8292371aaaff90fcb03e50543b7f4d2e816efe0dabc725c3c15f76d7cbaca, 5e514955ef593f8358d7f7ac8341dd0d00de492aba63ef84408865cf2caa56c8.

Independent plan and evidence

• Generated with VERIFY_ISSUE=445 VERIFY_CONSUMER=tester ... uv run --frozen python scripts/ci.py verification-plan. Tester plan .tmp/445/tester-verification/verification-plan.json: file SHA-256 8f9d546509cbae31e725a6db9a97529d7a332548d400019feebf3f7402f36718, canonical SHA-256 60a6877e25c81bdc83ff2ed5e63494d024c920f0e9440d049deebf5770c920e9, graph SHA-256 557fbababfd8ff983fa88aa29cdef88833c52667878ee72ff3493ae9c66d0ed1, source-manifest SHA-256 af3cc1de93e41b13ae4e15d2956e88be85ab1ffdcaea9e38ce2922df5f64cdb0. Its substantive fields match the engineer plan exactly; only created_at differs. Engineer plan file/canonical SHA-256: 75e5f27f4a36aa36b7d4df20ab8a5274084b5b55d373c6bf5a4fb95c9f6fc74f / 08900d30016b4f1fcbe8df305ef56a760cd97cb1837585148dbc9e68ba209411.
• Ran VERIFY_ISSUE=445 VERIFY_CONSUMER=tester VERIFY_PRODUCER_ROLE=tester VERIFY_PHASE=tester VERIFY_OUTPUT_DIR=.tmp/445/tester-verification VERIFY_EVIDENCE_DIR=.tmp/445/tester-verification/evidence VERIFY_PLAN=.tmp/445/tester-verification/verification-plan.json VERIFY_REPORT=.tmp/445/tester-verification/verification-report.json uv run --frozen python scripts/ci.py verification-run. Runner session 21796 exited 0; .tmp/445/tester-verification/runner.log SHA-256 95f0196493df93d941dec1dd3cf64b4e16729ad10571ad0a923335b6bf4dc0e9.
• Final four-bucket report .tmp/445/tester-verification/verification-report.json SHA-256 6744a76cd7ceefd5b391f1ac79d638f4660609c4211870dbb7384a55f763cd9f, verdict success; evidence in .tmp/445/tester-verification/evidence/. I separately ran verification-evidence-check and verification-report-check, both exit 0, and recomputed all 18 bound artifact SHA-256 values and sizes. No invalid evidence.

Disposition	Component	Exact result
Rerun	selector	PASS; 3 changed paths, 2 direct nodes, no downstream nodes
Rerun	evidence validation	PASS; 716 tests, 711 passed, 5 existing skips
Rerun	quality	PASS; 716 tests, 711 passed, 5 existing skips; lint/format/types/adoption gates included
Rerun	Django full	PASS; 4,159 total = 4,147 ordinary passes + 1 expected failure + 11 existing skips; no failures
Rerun	Playwright smoke	PASS; 30/30, no skip, retry, quarantine, or failure
Rerun	container	PASS; 13 assertions, no failures; local migration graph and route health included
Not applicable	screenshots	No render impact: only importer mapping defaults, bounded tests, and documentation changed

Reused components: none. Required skipped components: none. Pending components: none. The five candidate-only importer tests skip under the unchanged old tagged package, as intended; the package-owned actual-candidate proof executes all of them on real migrated models with zero skips.

Acceptance criteria

• AC1: The exact unmerged package commit, migration, nullable defaults and null-ordering projection were recorded and independently hash-checked before site verification; the package candidate was not required to merge.
• AC2: Diff adds only source_sibling_position to the two exact _mapping() target-default sets, SharedModule→Module and SharedLesson→Unit. Removing those two constants from the current importer AST yields the base AST: executable guard, writes, identity, transaction, target-access behavior and position mapping are unchanged. Importer 2,178→2,187 lines and _mapping() 690→699, the approved nine-line declaration-only formatting exception.
• AC3: Pinned-tag dry-run/apply/count/replay/refusal coverage passed in the full Django suite; dependency and lock bytes match HEAD. No general field exemption was added.
• AC4–AC5: The package-owned disposable actual-candidate test applied the real migration and ran both focused importer modules: 26/26 passed, zero skips, 1.670 seconds. It checked fresh null metadata, distinctive noncontiguous site positions copied exactly to sort_order, real CourseTree null/tie ordering, content and relationships, family equality, replayed non-null metadata, unchanged Module/Unit/CohortModule/UnitProgress identities and learner progress, and site position edits changing only copied sort order. Proof: package-owned report; local .tmp/445/candidate-verification-report.md in /data/agents/community-base/worktrees/p16-dtc-445-candidate SHA-256 5b747fe2b3d7ffdf84717df6c34350c913f2efd9b08214cbb4e87576cfc28a3d; test log SHA-256 d3f1ca0141b0f06c8236a089747bf62cb3c1ed0353f7140746c83974fe0d1a1d.
• AC6: The actual-model proof first showed the original guard refusing both newly concrete fields. The final tests accept only those reviewed defaults; separate Module/Unit and existing source-field unknowns raise named MappingCoverageDrift before writes. Existing Declare authored-homework defaults in the shared-course import mapping #443 homework defaults and retention still pass.
• AC7: Documentation states absent fields are inert on v0.5.10, fresh null, replay preservation and unchanged site position→sort_order; no UI, route, access, schema, pin or deployed-data edit appears in the patch.
• AC8: The registered test owner is 235 lines (under 300); new methods/functions remain within the 30-line standard. Full quality/CI and adoption-coverage checks passed; no pyproject seal or registry edit.
• AC9: Exact site/package inputs, plan/graph/source and artifact digests, all component dispositions, zero required skip/pending evidence, and real candidate 26/26 execution are bound above. Separate PM review is next.

No findings. Source remains frozen and uncommitted for PM acceptance.

[alexeygrigorev]

Product Acceptance

ACCEPT — exact frozen source for #445, after independent tester PASS. Development recovery remains a separate operational gate.

Reviewed the issue's nine acceptance criteria, three-file uncommitted diff, independent tester report, exhaustive verification report, and package-owned actual-model proof. Base/HEAD cdcd1ca87f0de0a7d19ac8da8f9b744503d1ad73; patch SHA-256 6e4d6dd7ee0b6b06524f50bd2950efb563c93eea73f741ee8063cf65b6d1a07f. I independently recomputed that patch and final report hash 6744a76cd7ceefd5b391f1ac79d638f4660609c4211870dbb7384a55f763cd9f.

• AC1: The concrete immutable package candidate and real additive migration were recorded before implementation. No dependency cycle was introduced.
• AC2–AC3: Only two exact internal target defaults are accepted. Import writes, positions, identity matching, drift refusal, access and transaction behavior remain unchanged. The tagged dependency, lock and seals remain unchanged.
• AC4–AC6: All 26 actual-candidate importer tests executed with zero skips. Fresh null metadata, existing source order, stable records/progress, replay retention and unknown-field refusal are verified on migrated models. Candidate-only skips under the old tag are explicitly covered by that separate proof.
• AC7–AC8: Documentation states the exact preservation contract. No page, template, route, public API, permission or schema changes exist. The test owner stays bounded; importer growth is the approved nine declaration-only formatting lines.
• AC9: Six required components were freshly rerun and passed; none reused, skipped or pending. Full Django executed 4,159 cases, selected browser smoke passed 30/30 and container checks passed all 13 assertions. Quality and evidence validation each reported 711 passes and five existing skips. Screenshots are not applicable because no render inputs changed; no pending visual evidence is waived.

From the learner and operator perspective, this enables the shared package's next fields while retaining the current course experience and fail-closed import safety. It authorizes the original engineer's focused commit and isolated integration through the normal process. It does not authorize a package dependency change, deployed import, further database reset or infrastructure workaround. Keep #445 open with Refs #445 until development deploy/recovery requirements can be completed; record on-call results separately.

[alexeygrigorev]

P18 integration decision

Freshly fetched origin/main is cdcd1ca87f0de0a7d19ac8da8f9b744503d1ad73. Original engineer committed the independently tested and PM-accepted three-file patch as 002b7a3c8e488f229fde527001ba9ccb450e7fe9 (Refs #445).

git merge-tree --write-tree cdcd1ca87f0de0a7d19ac8da8f9b744503d1ad73 002b7a3c8e488f229fde527001ba9ccb450e7fe9 exits 0, with no conflicts and tree 78d9735c4354fdfc9f74f964d884bd2096e034cd, identical to the accepted source tree. The computed importer blob matches accepted SHA-256 c95633316b0f7dfae88bee9412f6c2c49af72faa716c4fa53136e21eccc001be. Both computed dependency blobs match the unchanged accepted baseline.

Decision: integrate with one no-fast-forward merge in a new isolated worktree, preserving all accepted source bytes and prior #443/#444 work. Shared main and foreign worktrees remain read-only. Push this resulting main once and dispatch one site on-call. Development recovery #442 / AWS #58 remains external; no reset, deployed import or manual infrastructure mutation is included.