Resolve VERSION → 0.41.0.0 (master shipped v0.40.x cathedral).
Resolve package.json verify script (keep both check:source-config-leak + check:no-pii-agent-voice).
Resolve CHANGELOG (renumber wave entry from 0.40.0.0 → 0.41.0.0; preserve all master entries).
Resolve migrate.ts (renumber sources_github_repo_index migration v87 → v89; master added v87+v88).
Rename skills/migrations/v0.40.0.md → v0.41.0.md.
Refresh bun.lock + llms-full.txt.
Bump beforeAll timeouts to 30s on 9 new PGLite-using test files
(89 migrations now exceed the 5s default cold-start budget).

Auto-merged cleanly: autopilot.ts (D17 freshness gate coexists with
master's v0.39.2 per-source fanout; different job names + idempotency-
key prefixes), doctor.ts, jobs.ts, serve-http.ts, sync.ts.

…per-source health

Bump VERSION + package.json + CHANGELOG header + migration walkthrough filename
to v0.40.5.0 (claiming the next free slot in the v0.40.x patch series after
master's v0.40.1.0).

What ships (6 components, all behind sync.federated_v2 feature flag default-on):
1. Per-source sync lock — syncLockId(sourceId), phantom-redirect parity
2. Parallel sync --all — pMapAllSettled fan-out, --max-sources N cap
3. embed-backfill minion handler — D2 per-source lock + D6 $10/job budget + D15.1
   fire-and-forget submission + D19 source-level cooldown + 24h $25 rolling cap
4. sync trigger CLI + POST /webhooks/github — HMAC-verified (60 req/min/IP),
   X-GitHub-Event=push + ref filter against tracked_branch
5. sources status + federation_health doctor — batched GROUP BY pipeline
   (4 queries instead of 6×N per-source roundtrips)
6. sources federate/unfederate hook — auto-submit embed-backfill on flip

Correctness fixes (unconditional):
- D21: sync.ts:959 facts backstop now passes sourceId to engine.getPage
- D15.4: redactSourceConfig + CI guard prevent webhook_secret leak
- D15.5: safeHexEqual extracted to src/core/timing-safe.ts

Schema:
- Migration v89 (sources_github_repo_index): partial expression index on
  config->>'github_repo' for fast webhook source-lookup

Tests:
- 14 new test files, 112 cases. 4 IRON-RULE regressions pinned (SYNC_LOCK_ID
  back-compat, phantom per-source lock, embed-backfill kill+resume,
  webhook HMAC prefix-strip). All 9449 unit tests pass.

Caught at test-write time: the webhook handler had a Buffer.from('sha256=...',
'hex') truncation bug — without the prefix-strip, every signature would have
"matched" empty buffers. Pinned by a test/sources-webhook.test.ts IRON-RULE.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Resolve VERSION → 0.40.5.0 (master shipped v0.40.2.0 trajectory routing).
Resolve package.json verify script — no-op (master's verify line unchanged).
Resolve CHANGELOG (preserve all entries; my v0.40.5.0 stays on top).
Resolve src/core/migrate.ts: master claimed v89 (facts_event_type_column);
renumber my sources_github_repo_index v89 → v90.

Update CHANGELOG + skills/migrations/v0.40.5.md migration version refs from
v89 to v90.

Refresh llms.txt + llms-full.txt against the merged tree.

All wave tests still green (23/23 across db-lock-per-source +
embed-backfill-submit + doctor-federation-health smoke).

The v0.40.5.0 wave added scripts/check-source-config-leak.sh with a
too-broad pattern (JSON\.stringify\(.*config) that flagged any variable
named 'config' — catching the GLOBAL gbrain config.json serializers in
src/commands/init.ts (status envelopes) and src/core/config.ts (the
config-file write site). On the CI runner without rg installed, the
grep -rE fallback fired correctly and produced 4 false positives that
broke the `verify` script.

Tightened the patterns to specifically match `(source|src|row|s).config`
property access — the actual risk shape (a sources-table row being
serialized whole). The global gbrain config has a different shape and
threat model (file-mode 0o600 at the write site), so it's safe to
exempt at the regex level rather than per-file whitelist.

Also fixed a latent bug: the rg branch used `--include='*.ts'` (grep's
flag, not rg's). rg silently rejected it and CANDIDATES came back empty,
so the local-dev runs (which have rg) would never have caught a real
leak. Now branches on tool availability: `-g '*.ts'` for rg, `--include`
for grep -rE. Both branches verified against a synthetic leak fixture.

Also added init.ts + config.ts to the whitelist as a belt-and-suspenders
since they handle gbrain-global config (not source rows) and could
otherwise reflect-back via regex iteration.

CI: `bun run verify` exit 0 locally with both the original false-positive
fixture (clean repo) and a synthetic leak fixture (correctly caught,
exit 1).

Master shipped v0.40.3.0 (contextual retrieval + cache invalidation gate)
claiming migrations v90 (contextual_retrieval_columns) + v91
(pages_generation_trigger_and_bookmark) + a new doctor check
(contextual_retrieval_coverage) + a new sources subcommand (set-cr-mode).

Resolved conflicts:
- VERSION: kept 0.40.5.0 (mine higher than master's 0.40.3.0)
- package.json: kept 0.40.5.0
- CHANGELOG.md: preserved both entries (mine on top + master's v0.40.3.0)
- src/core/migrate.ts: renumbered sources_github_repo_index from v90 → v92
  (v90 + v91 now taken by master's contextual retrieval work)
- src/commands/doctor.ts: kept BOTH check pushes —
  contextual_retrieval_coverage (master, #11) + federation_health (mine, #12)
- src/commands/sources.ts: kept BOTH subcommands —
  status/webhook/tracked-branch (mine) + set-cr-mode (master)

Bumped migration version refs from v90 → v92 in CHANGELOG, migration
walkthrough (skills/migrations/v0.40.5.md), and pglite-schema.ts comment.

Refreshed llms.txt + llms-full.txt against the merged tree.

Verification:
- bun run typecheck: clean
- bun run verify: clean (all 19 checks pass including the leak-guard fix
  from the previous push)
- Wave smoke tests (db-lock-per-source + embed-backfill-submit +
  doctor-federation-health): 23/23 pass; migration v92 lands as expected

Master shipped v0.40.4.0 (selective graph signals + per-stage attribution
+ audit-writer unification). No migration collision this time — my v92
remains the highest.

Resolved conflicts:
- VERSION: kept 0.40.5.0 (still higher than master's 0.40.4.0)
- package.json: kept 0.40.5.0
- CHANGELOG.md: preserved both entries (mine on top + master's v0.40.4.0)
- src/commands/doctor.ts: auto-merged cleanly

Refreshed llms.txt + llms-full.txt against the merged tree.

Verification:
- bun run typecheck: clean
- bun run verify: clean (all 19 checks pass)
- Wave smoke tests (db-lock-per-source + embed-backfill-submit +
  doctor-federation-health): 23/23 pass; migration v92 lands cleanly