Promote develop to main

[lopugit]

✅ Develop S3 preview ready

• Commit: 29c31f2e
• Environment: Vercel Custom Environment develop
• Preview: https://pr-590.previews.dev.thingtime.com
• Last successfully built: 06/09 00:50 AEST (Australia/Melbourne)
• Immutable deployment: https://thingtime-822usboy5-lopugits-projects.vercel.app
• Vercel status: open deployment

The alias passed the develop bucket CORS preflight and a final live PR/SHA fence.

Generic Vercel Preview deployments use the shared development runtime; this controller adds the stable exact-SHA alias and marker-scoped cleanup.

Standing promotion PR opened by the Promote develop to main workflow. Its head is develop, so every new push or merge to develop shows up here on its own. Merge it whenever main should catch up — the workflow opens the next one after the following push to develop. The Sync main into develop workflow levels develop with main again after each promotion.

📋 What this promotion carries

11 pull requests merged into develop (69 commits) will land in main when this PR merges — newest first:

PR	Title	Author	Source branch	Merged (UTC)
#639	Sync main into develop	lopugit	sync/main-into-develop	2026-09-05
#560	feat: rename Thingtime plugin and add login command	lopugit	codex/thingtime-plugin-accounts	2026-09-05
#554	feat(search): enrich Commander result previews	lopugit	codex/rich-commander-previews	2026-09-05
#645	Fix Graphify writer lock races and pin query snapshots	lopugit	codex/graphify-writer-lock	2026-09-05
#641	Fix passkey cancellation, concurrent challenges and native app association	lopugit	codex/passkey-reliability	2026-09-05
#627	fix(recovery): repair GitHub catalogue sync and archive installation	lopugit	codex/recovery-release-sync	2026-09-05
#630	Show exact preview branch and commit in footer	lopugit	codex/preview-footer-build-identity-product	2026-09-05
#606	fix(ci): publish admin preview capability v2	lopugit	codex/admin-preview-capability-version	2026-09-03
#604	Route admin PR previews through github-actions	lopugit	codex/admin-preview-thin-dispatch	2026-09-03
#601	fix(api): expose upload-blocking storage migration state	lopugit	codex/fix-image-upload-migrations	2026-09-03
#597	Publish multi-environment preview links on PRs	lopugit	codex/preview-pr-environment-links	2026-09-03

Direct commits on `develop` without a merged PR (6)

• 6e18d175 Merge remote-tracking branch 'origin/main' into develop
• 727feab2 chore(graphify): bound snapshot retention after main sync
• 858575f4 Merge remote-tracking branch 'origin/main' into develop
• c3dc3f6f Merge remote-tracking branch 'origin/main' into develop
• 81bce89d Merge remote-tracking branch 'origin/main' into develop
• b8e93ece chore(graphify): bound snapshot retention after main sync

_{Auto-maintained by the Promote develop to main workflow — refreshed from develop @ 29c31f2e (2026-09-06). Delta comments below track when entries enter or leave the promotion window.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
thingtime	Building		Sep 5, 2026 2:49pm UTC
thingtime (develop)	Ready	Preview	Sep 5, 2026 2:49pm UTC

[github-actions]

🩺 Lopu — this PR's red check is reporting a write that succeeded

The failing check here is
control-plane / Lopu maintains the standing develop to main promotion / promotion-pr
(run 33737297962,
job 100590817022, step Open or refresh the promotion PR):

pull request create failed: HTTP 502: 502 Bad Gateway (https://api.github.com/graphql)

The 502 itself was an external GitHub blip — not a repository defect. The
controller defect is what happened next: the write had already landed.

time (UTC)	event
09:10:02	the step starts gh pr create
09:10:18	GitHub creates this PR (created_at on #590)
09:10:28	the GraphQL response comes back 502; gh exits 1; the script throws

So this PR exists, carries exactly the body that "failed" call submitted, and is
flagged red for an operation that completed.

Root cause

.github/scripts/promotion-pr-changelog.mjs treated gh pr create as a single
all-or-nothing call — no retry for a transient status, and no reconciliation read
afterwards. Two consequences beyond the cosmetic red check:

1. Any transient 5xx or timeout fails the promotion lane, though it is trivially
   retryable.
2. A blind retry would be the wrong repair on its own — when the write did
   land, retrying either errors with a pull request already exists for … or
   races a duplicate standing promotion PR. The reconciliation read has to
   come first.

Where the fix went

Root cause is in the protected control plane, so per the controller rules the
repair was made in the trusted checkout — not on develop, which is a target
branch — and the trusted publisher opens it as its own PR against
github-actions. Nothing was committed to this branch.

In promotion-pr-changelog.mjs only:

• the open-PR lookup is extracted to findOpenPromotionPr() so the
  open-vs-refresh decision and the post-failure reconciliation read share one query;
• createPromotionPr() re-reads the PR list first on failure. If GitHub now
  has the standing promotion PR, it is adopted — labels re-asserted, URL logged,
  success reported — instead of failing or duplicating;
• otherwise the failure is classified. Transient (HTTP 408/425/429/5xx, bad
  gateway, timeouts, connection resets, …) → bounded retry with backoff.
  Anything else (422, 403, No commits between main and develop) → rethrown
  immediately, so a genuine rejection still fails fast and loudly.

The classifier is allowlist-shaped on purpose: only recognisably transient
failures retry, so it cannot mask a real create rejection.

Validation

Stubbed gh on PATH plus a real local git repo one commit ahead of
origin/main; the stub reproduces this exact failure mode — records the create,
marks the PR as existing server-side, then prints the verbatim 502 and exits 1.

scenario	before	after
502 after the write landed (this incident)	exit 1, red check, PR exists	exit 0, adopts #590, 1 create call, no duplicate
502, write never landed, GitHub recovers	exit 1	exit 0 after 3 create calls
502 on every attempt	exit 1 after 1 call	exit 1 after exactly 3 calls
HTTP 422: Validation Failed	exit 1	exit 1 after 1 call (no retry)
clean create	exit 0	exit 0, 1 call

Also: --self-test OK (with the verbatim stderr from this run added as a case),
workflow-control-plane-contract --self-test OK, node --check over every
.github/scripts/*.mjs, git diff --check clean, DRY_RUN=1 end-to-end
unchanged.

On the PR itself

main is an ancestor of develop, so this is a fast-forwardable 165-file
delta — mostly the Graphify snapshot retention prune plus the ChatGPT
Thingtime-SSO plugin auth work. Nothing in it that I would gate. CodeQL: 0 open
alerts, nothing dismissed.

Once the controller fix lands, the right disposition for this red check is a
re-run — the underlying operation already succeeded.

— Lopu 🌸

[github-actions]

Lopu repository review

Lopu reviewed this PR against main as Thingtime's principal PR and repository manager. Using Claude Opus 5.

Lopu found no justified local change to publish from this review pass.

The model did not leave a detailed report; inspect this workflow run for the Lopu session log.

View Lopu workflow run

[github-actions]

🤖 Lopu live PR update

Status: ✅ Lopu finished — this PR is mergeable

Current phase: GitHub verified the published branch result

Estimated completion: Done — no further active-work ETA.

Time conversion (UTC source)

Moment	UTC	Los Angeles	Melbourne
Updated	2026-09-05 15:19 UTC (UTC+00:00)	2026-09-05 08:19 PDT (UTC-07:00)	2026-09-06 01:19 AEST (UTC+10:00)

Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically.

Lopu queue and PR pulse

Scope	Metric	Count
Repository	Open PRs	25
Repository	Conflicting	13
Repository	Out-of-date with target	0
Repository	GitHub state unknown	4
Repository	Part of an open stack	4
Repository	Touch files changed by another open PR	18
Repository	Target a non-root branch without an open parent PR	0
This resolver batch	Admitted snapshots	11
This resolver batch	Currently resolving	1
This resolver batch	Waiting	0
This resolver batch	Finished	10

Related PR context

• Stack: No open parent or child PR currently links to this branch.
• Target: main is a repository root/integration branch.
• Changed-file overlap: No changed paths overlap another open PR in this snapshot.

Exact branch pair: main → develop.

Timeline

• 14:14 UTC — Detected conflicts between main and develop; assigning the exact snapshot to the resolver queue.
• 14:18 UTC — Still safely queued behind earlier admitted Lopu work; no duplicate resolver was spawned.
• 14:29 UTC — 10-minute check-in: still working — Waiting in Lopu's serialized PR-management lane.
• 14:39 UTC — 10-minute check-in: still working — Waiting in Lopu's serialized PR-management lane.
• 14:50 UTC — 10-minute check-in: still working — Waiting in Lopu's serialized PR-management lane.
• 15:01 UTC — 10-minute check-in: still working — Waiting in Lopu's serialized PR-management lane.
• 15:07 UTC — Still safely queued behind earlier admitted Lopu work; no duplicate resolver was spawned.
• 15:08 UTC — The resolver worker completed successfully and GitHub now reports this PR as mergeable.
• 15:19 UTC — The resolver worker completed successfully and GitHub now reports this PR as mergeable.

Technical run details — optional; this comment is the human-facing source of truth.

[github-actions]

📋 Promotion changelog updated — now carrying 11 PRs (69 commits).

Added:

• Sync main into develop #639 — Sync main into develop (lopugit)

The full changelog lives in the PR description.