Venue closure and release handoff

Status: Active Last reviewed: 2026-09-07

This is the bounded closeout of the venue work in /home/sungkyu08/Dev/twomore-v2-venue-pipeline, branch codex/venue-pipeline-20260906, starting from a024d5b4. It does not reopen payments, push delivery, or the wider backend audit.

Product decisions and surviving implementation

• Reliable venue information does not require ownership certification or two independent source families. One supported contribution can be accepted.
• Ordinary venues have no public unverified badge. 인증됨 denotes a current, independently reviewed owner claim; source lookup success cannot grant it.
• Users can propose a venue, correct facts, add/update/retire courts, and report closure or reopening. Review keeps the submission, evidence and decision history. A report alone does not close a venue.
• Court edits preserve UUIDs and history. Provider updates protect manual facts and pause on identity ambiguity, stale baselines or unsupported source data.
• The maintenance server, bounded client and recoverable operator journal are implemented. Preparing a target or acknowledging a request does not prove that provider facts were refreshed.

See venue implementation evidence, ownership evidence, and the maintenance runbook.

Closeout plan and ownership

1. Codex evidence worker: retry only the missing frozen Naver Place record, preserving the existing manifest and terminal rules. At most two bounded provider requests; stop on access denial.
2. Codex reviewer: make at most two bounded government API probes to establish the real response envelope. Never log credentials or treat a failed fetch as empty source data.
3. Codex primary: connect the verified government collector to the existing journal, retire its legacy writer, test recovery and bounded failure behavior, and record concrete release prerequisites. A separate Codex worker reviews this connection without editing it. Do not relax completeness to claim done.
4. Claude: independently review and integrate the isolated branch, verify the merged result, then own migration/Edge/app release and hosted/device proof under the repository's two-agent operating model.

Current evidence and unresolved work

The frozen Naver cohort remains at 2,324/2,325 after one exact retry at 2026-09-07 03:16 UTC. Place 1080516232 (테니스스트링개러지) returned HTTP 200 with exact_place_base_missing. That establishes unavailable source evidence, not closure or a missing business. The unchanged manifest and all original checkpoint records were preserved, and only this one ID was requested. The refresh preparer still rejects the incomplete cohort and creates no executable output. The historical 2,021-row preview remains non-executable. Receipt: .audit/venue-closure-20260907/naver/receipt.json, SHA-256 180d0015f48efb37a43587a15881a09b4325d354a1a42b9f5205f53fee298b5d.

The government envelope is now verified by one bounded live request: HTTP 200, 970 bytes, header.resultCode = "00", rows at body.items.item, numeric body.pageNo, body.numOfRows and body.totalCount. The reported total was 7,329; only one row was requested. The official dataset documentation supplies the field/endpoint contract; the live probe establishes the nesting. Credential-free structure evidence is .audit/venue-closure-20260907/government/response-structure-1.json, SHA-256 3bbbc6f0860e5852d95e26d1e578eab7f65e90b49015c9318dbca817d10c535a.

The new venue:maintenance collect --target-id UUID command uses only an existing run's prepared target, scans bounded government pages, and submits its immutable capture through the protected client/journal. It reserves a write within the existing ten-call/90-second budget. It never creates an apply request. Interrupted saved captures replay their original bytes and timestamps, without fetching again. Incomplete/error/held results remain visible and immutable; a later attempt needs a newly prepared target. The old enrich-gov-std-hours.mjs command now stops before credentials, network or SQL generation and points to the replacement.

No database schema, Edge function, app screen or scheduler changed in this closeout. The separate government discovery source in ingest-venues is not converted into this hours-maintenance command. Its regional discovery role and source-failure receipts remain as previously implemented.

The existing full repository acceptance at a024d5b4 is recorded in .audit/backend-pipelines-20260906/queue-integration/repository-check-2/receipt.json. It covers the surviving venue code and later account-owned queue integration. It is local acceptance; no claim of hosted deployment or device validation is made from that receipt.

The current connection's targeted tests cover positive captures, explicit target scope, lost replies, interruption after saving, missing keys, denied provider access and shared call-budget exhaustion. The final current-source check and independent review are recorded under .audit/venue-closure-20260907/.

Final yarn check passes with all 17 changed files stable during the run: 786 script cases passed (two existing skips), all 205 queue cases passed, and 393 Jest suites / 5,614 cases passed. Focused strict lint passes. The independent review accepts 27 collector/runner cases and six additional identity, eight-page budget and deadline/recovery probes; no source blocker remains in this connection. The receipts are final-check-receipt.json, final-check-source.json and review.md under that directory. These close local implementation acceptance, not the Naver completeness hold or released-environment proof.

The first closeout yarn check stopped at documentation status lint because this new document used In progress instead of a supported status. It ran no runtime checks and is not acceptance evidence. The status was corrected before the final gate. Initial new runner tests also exposed two fixture mistakes (microsecond preparation time and a Response factory argument); both were corrected without weakening the production clock or response-shape guards.

Release boundary

Do not replay the historical metadata preview against today's hosted data. Once the exact-source gate passes, bind a fresh repair proposal to the current database baseline and independently review its held and eligible rows.

Claude's integration must reconcile all branch commits and current migration numbers against main; it must not cherry-pick only a terminal app commit and assume the preceding schema and client contracts exist. Inspect the current hosted ledger before applying migrations. The recovery-era ledger is historical.

A read-only merge preview of a024d5b4 against main 511c6e69 found overlaps in venue-finder-browse-list.tsx, venue-search-results-list.tsx, and directory-venue-detail-screen.tsx. Keep the current owner-certification and account-lifetime behavior while resolving Claude's UI changes. The other four conflicts are docs/README.md, both generated state pages and the rebuild log; retain authored history and regenerate the indexes/state after integration. The complete paths are in .audit/venue-closure-20260907/integration-preview.json. No merge was performed. The main checkout's only Codex edit remains the shared coordination notice; the implementation and local acceptance are in the isolated worktree.

After integration, verify submission/review/restart, court identity retention, closure/reopening decisions, owner certification and revocation, and the operator prepare/capture/apply/retry path on the released environment. Browser, native device, real authentication and live provider results remain distinct from synthetic local fixtures.