Merge origin/zai-dev — integrate operator's tracked .env/.env.ove (3286721)

The operator hand-pushed .env and .env.ove tracked while this task ran,
both with DATABASE_URL="file:./db/custom.db" — the relative form that
Prisma resolves against prisma/schema.prisma's directory, i.e. to
<repo>/prisma/db/custom.db, breaking the CLI (db push would silently
create a fresh empty database there) and the runtime (cannot open);
verified empirically. The merge keeps .env tracked per the operator's
explicit action (gitignore: !.env) and corrects DATABASE_URL in both
files to the portable file:../db/custom.db. The committed .env is held
byte-identical to .env.ove so dev.sh's self-heal copy never leaves a
dirty tree.

.env

@@ -0,0 +1,18 @@
+# OVE — env template (v7.15.3). TRACKED (with .env) in the strictly private,
+# self-hosted Forgejo repo (gitzcreations/openvisengine) by explicit operator
+# authorization, so sandbox reprovisions can never wipe it. .zscripts/dev.sh
+# copies this file over .env whenever .env is missing OVE_DIRECTORY_API_KEY
+# (the sandbox bootstrap rewrites .env to a bare DATABASE_URL line on every
+# reprovision); the committed .env is held byte-identical to this template so
+# the tree stays clean after every heal.
+#
+# NOTE on DATABASE_URL: Prisma resolves relative SQLite paths against
+# prisma/schema.prisma's directory, NOT the project root — so the portable
+# form is ../db/custom.db (= <repo>/db/custom.db). A literal ./db/custom.db
+# (as first committed in 3286721) resolves to <repo>/prisma/db/custom.db and
+# breaks both the Prisma CLI (db push would silently create a fresh empty
+# database there) and the runtime (cannot open) — verified empirically,
+# worklog Task 47.
+DATABASE_URL=file:../db/custom.db
+OVE_DIRECTORY_URL=https://s3374dir.openvisengine.com
+OVE_DIRECTORY_API_KEY=+7MkRB+hkV0UBhPqM1haTQ0f8JGKqkuXwoBTdTSAouU=

.env.ove

@@ -1,15 +1,18 @@
-# OVE — env template (v7.15.3). TRACKED in the strictly private, self-hosted
-# Forgejo repo (gitzcreations/openvisengine) by explicit operator
+# OVE — env template (v7.15.3). TRACKED (with .env) in the strictly private,
+# self-hosted Forgejo repo (gitzcreations/openvisengine) by explicit operator
 # authorization, so sandbox reprovisions can never wipe it. .zscripts/dev.sh
 # copies this file over .env whenever .env is missing OVE_DIRECTORY_API_KEY
 # (the sandbox bootstrap rewrites .env to a bare DATABASE_URL line on every
-# reprovision). The live .env itself stays untracked.
+# reprovision); the committed .env is held byte-identical to this template so
+# the tree stays clean after every heal.
 #
 # NOTE on DATABASE_URL: Prisma resolves relative SQLite paths against
 # prisma/schema.prisma's directory, NOT the project root — so the portable
 # form is ../db/custom.db (= <repo>/db/custom.db). A literal ./db/custom.db
-# would resolve to <repo>/prisma/db/custom.db and break both the Prisma CLI
-# and the runtime (verified empirically — worklog Task 47).
+# (as first committed in 3286721) resolves to <repo>/prisma/db/custom.db and
+# breaks both the Prisma CLI (db push would silently create a fresh empty
+# database there) and the runtime (cannot open) — verified empirically,
+# worklog Task 47.
 DATABASE_URL=file:../db/custom.db
 OVE_DIRECTORY_URL=https://s3374dir.openvisengine.com
 OVE_DIRECTORY_API_KEY=+7MkRB+hkV0UBhPqM1haTQ0f8JGKqkuXwoBTdTSAouU=

.gitignore

@@ -34,8 +34,10 @@ yarn-error.log*
 # env files (can opt-in for committing if needed)
 .env*
 !.env.example
-# .env.ove — tracked env template (operator-authorized, private Forgejo
-# only); dev.sh restores .env from it after sandbox reprovisions (Task 47)
+# .env + .env.ove — TRACKED by operator authorization (strictly private
+# self-hosted Forgejo only); dev.sh restores .env from the template after
+# sandbox reprovisions, and the committed .env stays byte-identical to it
+!.env
 !.env.ove
 
 # databases -- runtime state, regenerated per machine (prisma db push);

worklog.md

@@ -2583,3 +2583,5 @@ E2E VALIDATION (faithful sandbox-reset simulation, ALL PASS):
 
 Stage Summary:
 - v7.15.3 ops hardening shipped: .env.ove (portable env template; DATABASE_URL=file:../db/custom.db — the ./ form provably resolves against prisma/ and breaks CLI+runtime), db/custom.db.seed (106-preset baseline) and secrets/ (README + house-cookie slots) are now tracked in the private Forgejo repo; dev.sh self-heals .env (when OVE_DIRECTORY_API_KEY is missing) and db/custom.db (when absent) before bun install, so every future sandbox boot restores the directory proxy and the preset library automatically. E2E-verified against a faithful reset simulation end-to-end.
+
+Post-merge integration (operator commit 3286721, "Track private .env and .env.ove in self-hosted Forgejo"): while this task ran, the operator hand-pushed both files tracked — each with DATABASE_URL="file:./db/custom.db" (quoted, the broken relative form that resolves to prisma/db/custom.db). The merge honors the operator's explicit action — .env STAYS tracked (gitignore gains !.env so the policy is explicit) — with two corrections: DATABASE_URL in BOTH files is file:../db/custom.db (the empirically verified portable form; see the resolution tests above), and the committed .env is held byte-identical to .env.ove so the dev.sh self-heal (which copies the template over .env on every post-reset boot) never leaves a dirty tree. No other content from 3286721 — it carried no gitignore, seed, dev.sh or secrets/ changes.