- Enforce RLS on project_members as soon as its write grants exist,
  independent of the experiment rollout switch, and let project readers see
  membership so open-project member counts still work.
- Only let a PI enrol themselves on a project created in the same
  transaction (ingestion-seeded projects cannot be claimed).
- Block non-admin changes to an experiment's owner, project, equipment,
  template or request id (trigger; foreign-key actions exempt).
- Require readable templates for experiment and project attachment writes;
  run process endpoints as the caller and check step templates.
- Fail closed in app_detach_experiment_type for NULL owners.
- Reject a reused client_request_id with a different payload (409); scope
  frontend keys to the generated recipe or unchanged form.
- Keep the migration ledger owner-only; bound migration lock waits and build
  new indexes outside the ALTER TABLE lock.
- Force pytest onto a dead database port unless explicitly opted in.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

- Apply the template visibility rule to direct project attachments,
  process step joins and workflow example seeding.
- Resolve a repeated client_request_id before validating against the
  current template, so retries survive template edits.
- Resend the exact stored save request from the optimization page.
- Limit facility managers' experiment updates to execution status columns.
- Document atomic standalone application and always-enforced membership.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

- Only refresh a workflow example template the caller owns (or as admin),
  independent of row-level security.
- Record an interrupted follow-up generation as failed instead of treating
  it as an initial proposal job.
- Use the configured migration lock timeout for the RLS migration.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

- Create or update api_client with \gexec: psql does not substitute
  variables inside dollar-quoted DO blocks, so fresh installs failed.
- Make init_db.sql policies re-runnable.
- Align three security tests with the project workflow change that made
  project equipment optional and allowed multi-equipment projects.
- Document the tested rollback order for older API images.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Deployed dt-api:rls-b02e9ac to the dt-api Deployment and the dt-api-retrain
CronJob, and enabled DB_RLS_ENFORCEMENT=enforce on the Deployment.

Note: the live dt-api Deployment also carries the DB3 pilot ConfigMap and
uploads volume (geddes/k8s/pilots/db3), which 02-api.yaml does not include;
apply changes with `kubectl set image`/`set env`, not `kubectl apply` of
this file.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

- Record DB_MIGRATE_ON_STARTUP=false (migrations now run as the
  dt-db-migrate Job; the API no longer has owner credentials).
- Match the live env list (the two entries missing live were applied;
  both were functional no-ops).
- Document the DB3 pilot layer that pilots/db3/deploy.sh adds on top of
  this file, and how to change the Deployment without removing it.
  `kubectl diff -f` now shows only that layer.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

- Describe dt-db-migrate as the migration mechanism and require it to
  complete before each rollout; enforcement is switched through
  dt-db-migration-secret.
- Note that the Deployment's DB_RLS_ENFORCEMENT is informational while
  startup migrations are off.
- Replace the pilot restore advice (deploy.sh rejects non-pilot images)
  with a configuration-only patch that keeps the current image.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Tool 3 run 12822 (11 h, 97.6% idle logging) exceeded the connector's value
limit and blocked ingestion from 2026-09-04. Document why it was deferred
rather than ingested whole, the checks made, the procedure used (temporary
initial_run_id floor, restored afterwards) and how to backfill it later.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

- Describe the poll page as including overlap rows, and the initial_run_id
  floor as applying to normal polling with backfill settings unset.
- Replace the run-count estimate with the observed backlog bounds.
- Distinguish computed trace means from persisted features; note the
  backfill needs a value limit that fits the run.
- Record the 05:40 poll after restoring the floor.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>