worklog: Task 55 — v7.20.0 delivery: persistence stack re-verified + fixture-proven; push staged on main+zai-dev, awaits operator credentials

worklog.md

@@ -2778,3 +2778,29 @@ BROWSER E2E (agent-browser, ALL PASS):
 
 Stage Summary:
 - v7.20.0 shipped: share strings now decode the moment they are pasted into the Script editor (the hash never appears -- the script lands at the paste point, with the dialog's full import semantics); Directory cards are a quarter shorter with Get at the top right beside its date; version bumped with matching release note. The Hash⇢Script toolbar button remains for the preview-first flow.
+
+---
+Task ID: 55
+Agent: main (Z.ai Code)
+Task: v7.20.0 git delivery (user request): "if needed, read this file from my Google Drive [https://drive.google.com/file/d/1XI7m5mDj54jVstQMtM0AADmEzLb_LDws/view] and push v7.20.0 to my git."
+
+Drive file (fetched via the uc?export=download endpoint, 1,074 bytes ASCII): restates the Task 47 persistence authorization for the strictly private self-hosted Forgejo remote (isMEq09mXh1FyzL9hEL9ht4d.zcreations.dev → gitzcreations/openvisengine) -- track .env.ove (DATABASE_URL + OVE_DIRECTORY_URL + OVE_DIRECTORY_API_KEY), db/custom.db.seed and secrets/ in the repo; write the three variables into both .env and .env.ove; copy db/custom.db to db/custom.db.seed; self-healing at the very top of dev.sh (before bun install) restoring .env from .env.ove when OVE_DIRECTORY_API_KEY is missing and db/custom.db from db/custom.db.seed when missing; commit and push to origin zai-dev so every future sandbox boot restores .env and the database automatically.
+
+Persistence stack re-verified (nothing needed re-doing -- Task 47 / commit 621bbc6 shipped all of it):
+- .gitignore authorizations intact: !.env, !.env.ove, !db/custom.db.seed tracked; secrets/ not ignored (secrets/README.md tracked). git ls-files confirms .env, .env.ove, db/custom.db.seed, secrets/README.md all in the index.
+- .env and .env.ove byte-identical (diff clean), both carrying DATABASE_URL + OVE_DIRECTORY_URL + OVE_DIRECTORY_API_KEY. One standing deviation from the Drive file's literal text, shipped and documented since Task 47: DATABASE_URL=file:../db/custom.db, NOT the requested file:./db/custom.db -- Prisma resolves relative SQLite paths against prisma/schema.prisma's directory, so the ./ form silently creates prisma/db/custom.db (empty library) and the runtime cannot open it; ../ reaches <repo>/db/custom.db. Empirically verified twice (Tasks 47 and 49); .env.ove's header documents this so nobody "fixes" it back.
+- db/custom.db == db/custom.db.seed (cmp clean, 307,200 bytes) -- Task 53's re-sync still holds; v7.20.0 touched no DB content.
+- .zscripts/dev.sh (the sandbox boot script; unchanged since 621bbc6): selfheal_restore_env + selfheal_restore_db run immediately after PROJECT_DIR resolution, before bun install and everything else. Fixture re-proof today on the shipped file in a temp dir: .env wiped to a bare DATABASE_URL line + db/custom.db deleted → both [SELF-HEAL] restores fired, ENV-RESTORE-OK, DB-RESTORE-OK, restored db byte-identical to the seed, bash -n SYNTAX_OK.
+- secrets/ still carries only README.md -- the house-account cookie re-export remains an operator TODO (lost in the 2026-11-06 reprovision; nothing I can restore from here).
+
+v7.20.0 delivery state:
+- All Task 54 work committed in 06db8b9 (paste-to-decode + compact Directory cards + version bump + release note + Task 54 worklog entry); working tree clean; bun run lint clean; dev server healthy (GET / 200, GET /api/presets 200, log clean of errors); seed in sync.
+- local zai-dev fast-forwarded 2f0ed4f → 06db8b9 (= local main), per the standing convention that both branches carry everything and fast-forward cleanly.
+
+Push (blocked, unchanged from Tasks 49/50):
+- git fetch works anonymously (origin/main = origin/zai-dev = bbbee3c, v7.17.0 -- the operator-side push of v7.17.0 landed). Push attempted once with GIT_TERMINAL_PROMPT=0 (main:zai-dev + main:main): fails LOCALLY pre-auth ("fatal: could not read Username ... terminal prompts disabled") -- it never contacts the Forgejo server, so no lockout exposure; repeated only for this final commit, same result.
+- No credentials exist in this sandbox: no credential helper, no ~/.git-credentials, no ~/.ssh, no env token, upload/ empty, and the OVE_DIRECTORY_API_KEY authenticates the directory VPS, not the git remote (401, tested once in Task 49 -- not retried, lockout risk). The Drive file carries no git token either (only the directory API key).
+- Local main / local zai-dev carry 6 commits past origin (597f442 worklog Task 50, 2f0ed4f v7.18.0, 60a7d40 v7.19.0 trueblack, 5f46fb7 v7.19.0 embedded curation + this Task 55 worklog commit, 06db8b9 v7.20.0, all fast-forwardable). The operator's next authenticated push from their own machine (as with 3286721 and bbbee3c) or a supplied Forgejo token delivers everything at once; nothing further is staged on my side.
+
+Stage Summary:
+- v7.20.0 is fully built, verified, committed and staged on both local branches (main + zai-dev at 06db8b9); the Drive file's persistence stack was re-verified item by item and re-proven by fixture (env + db self-heal on the shipped dev.sh). The push itself cannot leave this sandbox -- no Forgejo credentials exist here by design (Task 49/50 finding, unchanged); the operator's next authenticated push (or a token dropped into the sandbox) ships v7.18.0 + v7.19.0 + v7.20.0 together in one fast-forward.