cycle 26 docs: YOLO_NOTES ledger — cr-osm-match isolation + MEIC dedup decision memo

4f11ad139c58badb33a4d1f0f7f8dd1f4f6d3cec · 2026-09-24 05:09:46 -0700 · Steve

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TouFkmUGKHtwqpZwgReVic

Files touched

M YOLO_NOTES.md

Diff

commit 4f11ad139c58badb33a4d1f0f7f8dd1f4f6d3cec
Author: Steve <steve@designerwallcoverings.com>
Date:   Thu Sep 24 05:09:46 2026 -0700

    cycle 26 docs: YOLO_NOTES ledger — cr-osm-match isolation + MEIC dedup decision memo
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_01TouFkmUGKHtwqpZwgReVic
---
 YOLO_NOTES.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/YOLO_NOTES.md b/YOLO_NOTES.md
index 2455014..ccea837 100644
--- a/YOLO_NOTES.md
+++ b/YOLO_NOTES.md
@@ -562,3 +562,15 @@ Canonical apply order now: `004_marketplace → 005_apple → 006_contacts → 0
 **Cost:** $0 (local + one Cody gate pass that found a real bug in the fix's env-override claim, verified independently before and after the fix with live timing, not just code review).
 
 **Backlog:** still FOUR gated items on Steve's desk (host-claim approval, reconciler cron, payout-visibility, place-xss-DEPLOY — security-urgent). Concrete-deferred code backlog: `cr-osm-match.js` per-record isolation (cheap, same pattern) + the meic-pymes slug-collision dedup (Cody's item #1 — likely warrants its own DECISION memo since it touches ingest identity semantics, not a pure mechanical fix).
+
+---
+
+## Cycle 26 — cr-osm-match isolation + the MEIC dedup DECISION (TK-10346)
+
+**Item (1) — cr-osm-match.js per-record isolation (fixed, reversible, no gate):** the last script with the cycle-24/25 gap. The OSM→places website matcher looped over places doing a `pool.query` UPDATE per record with NO try/catch (one bad UPDATE aborts the whole pass), and the IIFE had NO outer try — the trailing `await pool.end()` was skipped on any throw, leaking a pg connection. Fixed: per-record try/catch (errors++, warn, continue) + wrap the IIFE in try/catch/finally so pool.end() always runs. Structural regression guard added. 215→216 serial. Commit `f12347a`. Mechanical copy of an already-Cody-gated pattern (cycle 25) + a standard try/finally — self-verified (continue still works inside the try; pool.end runs exactly once), NOT re-gated, proportionate to task weight.
+
+**Item (2) — MEIC slug-collision dedup → DECISION memo (NOT auto-fixed):** `meic-pymes.js:124` slugs cedula-less rows as `meic-${name}-${region.slug}`; common CR trade names ("Soda La Familia") collide per canton, and `ON CONFLICT (slug) DO UPDATE ... COALESCE` silently MERGES two different businesses. Verified against dev DB: `places.slug` is UNIQUE, no cedula unique index, and ALL 25,661 dev MEIC rows currently HAVE a cedula → the fallback path is **unexercised today (blast radius 0)**. The amplifier: `iCedula < 0` (a future sheet hiding the cedula column) flips EVERY row to the collision-prone slug at once — 0%→~100% on one upstream schema change. Because this changes ingest IDENTITY semantics (what makes two rows "the same place"), I made NO code change and drafted `2026-09-24-TK-10346-costa-meic-dedup-identity-DECISION.md` (A require-cedula+skip / B collision-proof slug / C flag-for-review / D do-nothing + a fail-loud iCedula<0 guard). Not unilaterally picked.
+
+**Cost:** $0 (local; no Cody spawn this cycle — item 1 was a mechanical pattern-copy self-verified, item 2 is a decision-memo not a fix).
+
+**Backlog:** FIVE gated items now on Steve's desk — host-claim approval, reconciler cron, payout-visibility, place-xss-DEPLOY (security-urgent), and this MEIC dedup decision. Concrete-deferred code backlog is now EMPTY (all 3 of Cody's cycle-24 ingest findings resolved: XSS fixed cycle 24, timeout+isolation cycle 25, cr-osm-match cycle 26; dedup → decision). Next cycle: a FRESH cold Cody audit on a not-yet-audited surface (candidates: lib/apple.js Sign-in-with-Apple token/JWT verification; lib/whatsapp.js + routes/webhooks.js signature verification; routes/admin.js authz; or the money-math in lib/money.js).

← f12347a costa-rica: cr-osm-match.js — per-record isolation + guarant · back to Costa Rica · costa-rica: harden Sign-in-with-Apple verify — JWKS rotation 3114048 →