[sebyx07]

Plan 101 (v31) — wave F: scale & enterprise features, fast boot, verify --changed

Wave F of docs/plans/2026/11/09/101-final-hardening-before-v31. 12 agents in one checkout (path-disjoint), one replacement worker after a stall. ~510 changed paths — over CodeRabbit's 150-file limit, so the replacement review ran (bug-hunter ×2, concurrency-auditor, security-auditor); every confirmed finding is fixed below.

What lands

Area	Change
Boot	Batched app scan with a hook module per app module (serial order kept, incl. top-level await; 5k modules 2.19 s → 1.39 s); prebuilt registry for web/sync/replicator (X_PREBUILT_REGISTRY_STALE, format 2); x g skips the app load when nothing it writes needs the manifest
Monorepo	x g app / x g package, --app, X_APP_ROOT_NESTED, X_WORKSPACE_NAME_TAKEN, cross-app boundaries (site→sibling app refused; admin app→web api allowed as a projection), surfaces under apps/<name>/; CI scaffold-smoke multiapp row
x verify --changed	Runs only reached steps/tests (docs-only 2.7–15 s, entity diff ~23 s vs 28 s full); unmapped tests kept; doc-selected suites run whole
Islands	modulepreload for island chunks, weighed by budgets
Cache	Redis pub/sub invalidation bus when no NATS (dedicated publisher, serialized resubscribe)
Entity / db	partitionBy + partitions() (from for backfills, lock_timeout, detach concurrently; X_MIGRATION_PARTITION_CHANGE, X_PARTITIONS_UNMAINTAINED); .personalData() marks with GDPR coverage enforcement; SearchIndex port with versioned documents, tombstones and a post-commit write path
Jobs	withLock (server-assigned fencing token, renewal lapse → X_LOCK_LOST), double-entry ledger() (X_LEDGER_UNBALANCED, X_LEDGER_POSTING_CONFLICT, tenant-scoped), reindex(), audited subjectErase; worker re-polls on backlog: 1 worker on defaults 31 → 799 claims/s
Storage	UploadScanner port (per-attempt scan copy, X_STORAGE_UPLOAD_INFECTED, X_STORAGE_SCAN_UNAVAILABLE), variant() image variants
Notify / scraping	SMS transport + smsChannel(); pdf() factory (≤2 browsers, X_SCRAPE_PDF_BUSY, same-origin header fence, sandbox on); CDP launcher moved to @ultimat3/scraping/cdp with a lifetime cap
Auth	SAML 2.0 SP built in-house (no dependency; c14n checked against real xmlsec vectors) behind an IdentityProvider port beside OIDC; oauthLogin now a front door over the same routes
AI / realtime	embedder + semanticCache ports; replicator reconnect curve
Docs	4 new benches with committed results, measured scale-ladder table, scheduler failover live test, wiki for every feature

Breaking (CHANGELOG + wiki/Upgrading.md)

• docs: nine claims the last three PRs made false #50 ai embedder/semanticCache are ports · feat: encrypted secrets, a served /_storage, and a boot that says what it needs #51 metric exporters are metric.export subscribers
• fix: make a deployed Ultimate app render, and stop answering a browser with JSON #52 OAuth routes move /auth/oauth/<p> → /auth/sso/<p> — adopters add /auth/sso/<p>/callback at each IdP before deploying
• feat: make login work, and make the demo look like a product #53 the CDP launcher is imported from @ultimat3/scraping/cdp, not @ultimat3/testing

Review findings fixed (replacement review)

• Security: SAML namespace-scope DoS (one 334 KB POST → 5.3 GB RSS; now < 100 ms, ≤ 64 declarations); cross-tenant takeover via trustEmail (emailDomains now required); ACS blocked by CSRF on the real pipeline; OIDC replay window was ~30 s (now issue time + 10 min); pdf() token leaked cross-origin; ledger posting dropped across tenants; GDPR audit carried the subject key.
• Concurrency: withLock blind to a hung renew; clock-based fencing token; Redis restart stranded deferred busts; double confirm deleted a sibling's scanned file; reindex could resurrect stale/deleted docs; unbounded Chrome per pdf(); partition DDL with no lock timeout.
• Correctness: snapshot sidecar dropped partition fields, so every check was a no-op; backfill recipe unrunnable; scan stream outside the try; re-used ledger key wrote half a posting; batched scan broke evaluation order (MCP include, top-level await); --changed dropped unmapped tests and the doc unit run.

Deferred to wave G

setLogSink→installLogSink sweep; D-series deletions; worker/scheduler prebuilt registry; deleteWhere search-index mirroring + reindex sweep; core AuditPrimitive 'job'; shared DER walk in core; x g app refusing slice flags.

Gate

bun run verify and scripts/reference-app-gate.ts (three apps) green on this exact tree. developerz.ai review never posts (known); CodeRabbit skips > 150 files.

🤖 Generated with Claude Code

[developerz-ai]

Fix failing CI on #1043

• Picked up
• Surveying the repo
• Working
• Pull request opened — feat(v31): plan 101 wave F — SAML SSO, partitions, ledger, locks, search index, upload scan, pdf(), fast boot, verify --changed #1043
• Done

Queued — waiting for a free box.

---

🤖 developerz.ai, an automated agent, not a human — developerz-ai[bot]