Alloy Lockfile Repair, Live Deploy, and Workspace ID Bug Sweep

Timeline

1. 1

   Start

   Continued from prior session's lockfile repair

   Second missing native binary (@tailwindcss/oxide-linux-x64-gnu) found in Vercel build log

2. 2

   +30m

   Lockfile fix verified and pushed

   Disposable git worktree procedure, same as first fix; committed 969e22c

3. 3

   +45m

   Vercel deploy hit Hobby-plan function cap

   Build succeeded; deploy blocked by 12-function Serverless limit, ~82 real routes

4. 4

   +1h

   Session flailed on local dev startup

   .env.local corruption investigation, self-correction failure caught by Zeb — stopped and reset

5. 5

   +1.5h

   Alloy dev server running clean

   Zeb repaired .env.local manually; server confirmed working end to end

6. 6

   +2h

   Full test suite run at Zeb's request ("I don't trust it")

   446/463 unit tests, 19/19 real-DB integration tests found and run separately, 1 genuine app bug surfaced

7. 7

   +2.5h

   4 workspace_id bugs found and fixed

   executions, execution_commands x2, runner_instances — all raw SQL CTEs missing the tenant column

8. 8

   Close

   Committed, retro, wrap

   7f4b903

What shipped

• Fixed the second and third missing native-binary lockfile entries (@tailwindcss/oxide-linux-x64-gnu, @unrs/resolver-binding-linux-x64-gnu) via the same disposable-git-worktree repair procedure used for the first (lightningcss) fix

• Diagnosed the Vercel Hobby-plan 12-Serverless-Function deployment cap as the real, final blocker — not a code bug — after the build itself started succeeding

• Restarted and verified Alloy's local dev server end-to-end after a .env.local repair (done by Zeb, not by Claude — env files are off-limits to read/edit directly)

• Ran unit tests via npm test, manually ran the 4 real-DB integration test files, and attempted the Playwright e2e suite (which mostly did not execute — 61 of 64 specs never ran because the global auth setup itself failed against a stale legacy route)

• Found and fixed a genuine, live-shipping bug: createControlledExecution's raw SQL INSERT into executions and execution_commands never populated the NOT NULL workspace_id column added by this same multi-tenancy migration

• Found and fixed the same bug class in a second function: the execution-cancel raw SQL CTE's execution_commands INSERT also missing workspace_id

• Found and fixed the same bug class in recordRunnerHeartbeat: the runner_instances INSERT missing workspace_id, surfaced live via a real 500 on /api/runner/register when manually starting the runner

• Threaded workspaceId through recordRunnerHeartbeat's signature and all 5 real call sites (the route, and 3 real-DB proof scripts)

• Swept the entire raw-SQL surface of lib/db/queries.ts and lib/commons/queries.ts (the only 2 files dependency-cruiser permits direct db access) for the same shape — confirmed no further gaps

• Identified (but did not fix — test maintenance, not app bug) 17 unit tests and 1 e2e auth-setup test that assert against legacy bare-route files, now stale after Phase 1c's /w/[slug]/ route migration

• Identified a real test-infrastructure gap: 2 of 4 real-DB integration test files are silently excluded from npm test's own script glob, and 2 more ran with zero output in the combined run despite passing in isolation