3.7.0

A task's investigations can be pinned, by anyone on the Quest for everyone on it (#900). 20261128120000_pin_task_investigations.sql adds task_investigations.pinned_at and pinned_by (FK → auth.users, on delete set null, so a deleted pinner leaves the pin in place), a partial index on task_id where pinned, and two CHECKs: only a succeeded row is pinned, and there is no pinner without a pin. The pin is written through the existing investigation UPDATE policies (user_can_access_quest()), so a departed party member or removed guild seat cannot pin or unpin, and a visitor to a public Quest still sees no investigations at all. A new task_investigations_pin trigger makes the stamp the server's — a signed-in pin records now() and the caller, an unpin clears both, a pin that stays keeps its pair (no forward-dating one to the top, no crediting it to someone else), a signed-in insert arrives unpinned — and unpins a row whose status leaves succeeded, so a re-run that fails is not the answer any more. guard_investigation_model_type() now lets an update whose only changed columns are pinned_at, pinned_by and updated_at past the plan check; before, every signed-in update re-checked the row's model, which would have stopped a free member pinning a Pro owner's answer and anyone pinning an answer from a retired persona. Any other change in the same statement is still checked. get_task_investigation_history() is re-created to return pinned_at and list pinned answers first (latest pin first), keyset-paging on the pin as well; its grants are unchanged. The worker's earlier-answers read (get_shared_prior_cycle_answers()) deliberately keeps its newest-cycle-first order (#900).

The dev TUI reads .env for rewriting with a single open (#730). readEnvForUpdate() in scripts/dev-tui/env-file.mjs used to lstat the file and then readFile it, which left a window in which .env could be swapped for a symlink between the check and the read (CodeQL js/file-system-race). It now opens with O_NOFOLLOW (a symlink fails at the open) and O_NONBLOCK (a FIFO cannot hang it) and checks isFile() on the open handle before reading through it. Native Windows has no O_NOFOLLOW, so there the link is lstated and refused first, and the opened file must have the same device and inode as the one lstat saw, so a swap between the two is refused too. Behaviour is unchanged: a symlinked or non-regular .env is refused and a missing one reads as empty. The narrative route's servedModelType also lost an initial value that was always overwritten (#730).

The CodeQL job summary lists findings that were already triaged apart from new ones (#730). .github/codeql-accepted.txt records each accepted finding as <rule id> <path> <flagged source line> with its reason above it, and scripts/codeql-summary.mjs moves the findings an entry matches out of the main table into a collapsed Accepted list with those reasons. It also reports entries that match nothing (fixed, or the flagged line changed and needs triaging again), entries that match more than one finding (which accept none) and malformed lines. Keying on the line's text rather than its number keeps an entry valid when code above it moves. The four seeded entries are the auth callback's onboarding redirect (js/user-controlled-bypass, by design: middleware still enforces onboarding), the feedback screenshot preview (js/xss-through-dom, an object URL of the user's own file) and the two workload identity exchanges (js/file-access-to-http, by design since #726). The nine log-injection and format-string findings are tracked separately and still show in the table. Nothing here can fail the scan (#730).

codeql-summary.test.mjs covers parsing the accepted file (a reason only from the comments directly above, malformed lines), a finding accepted by rule, path and line text together and by no two of them, an entry following its line when it moves and lapsing when it changes, an unreadable source line never accepted, an entry matching two findings accepting neither, staleness reported only in its own language's run, the collapsed list and its warnings, the all-accepted summary, and the CLI reading the file and sources from its working directory. It also checks the real .github/codeql-accepted.txt: every entry has a reason, is a CodeQL rule id, is unique and still names a line in its file, so editing an accepted line fails in that PR. The new env-file.test.mjs covers readEnvForUpdate() with a missing, regular, symlinked, directory and FIFO .env, and runs the no-O_NOFOLLOW path (as on Windows) for the missing, regular, symlinked and directory cases and a file swapped in after the lstat; link-thumbnail.test.tsx covers a javascript:, data: and relative URL never reaching an image. stripe-setup.test.mjs dropped an unused import and checks the Stripe CLI docs link by comparing whole links, since both an unanchored regex and a substring check on a URL are CodeQL findings (#730).

log-safe.test.ts, in both apps/worker and apps/web, covers ordinary text, tabs, quotes and backslashes left alone, line feeds and carriage returns escaped rather than dropped, vertical tab, form feed, NEL and the Unicode separators, NUL, escape sequences and DEL, an error as its one-line stack and one with no stack, a plain error object serialised, a circular or prototype-less object, and other values stringified. achievements/server.test.ts expects the context as its own %s argument (#729).

quest-details-card.test.tsx pins the clock for the row-list case. Its fixture's due date, 2026-10-20 12:00 UTC, was read against the real clock by DueDateBadge, so from that moment the Due row said "Overdue" and the test failed on every run. It now runs at 2026-10-06 and also asserts the row is not overdue (#910).

processor.test.ts covers the fallback's hold after a partial settlement (#740): the spend less a settlement refund pointing at it, a refund that does not point at it netting the reference to zero, an earlier attempt's settlement leaving this attempt's hold alone, the partial settlement still subtracted when earlier attempts lift the net above it, and a newer platform-funded spend neither read as the payer nor counted in the net. One case runs the real loadFallbackModels() price filter from the ledger read and shows a substitute whose hold sits between what is left and what was charged is no longer offered. The fake ledger now serves the whole reference rather than one pre-filtered row (#740).

list-filters.test.ts covers the taskPinned param read, written and round-tripped, the pinned-answer search (a phrase only in a pinned answer, the summary of one with no recorded text, unpinned and failed answers ignored, the task's own text preferred, words split across both, an answer with no text) and the Pinned and status counts composing; the new task-list-toolbar.test.tsx the chip's count, toggle, pressed state beside a status, zero count, absence on a Quest with no pins and presence when on from a link; task-manager.test.tsx the chip filtering and opening panels, composing with Done, a finished task's group opened by the chip and by a search hit without being remembered, a new search revealing its hits again while Pinned stays on, the next Quest's finished hits revealed after a switch, the URL round trip, a closed panel staying closed, a search hit in a pinned answer opening its panel (and not in an unpinned one), Clear filters, j and the bulk bar with the chip on, and the Quest list's badges, dimming and phone picker; task-quest-list.test.tsx pinned mode and the live count; pinned-answers.test.ts countPinnedTasksByQuest()'s ids-only select and per-task counting; tasks/page.test.tsx the counts passed and an unreadable read left unknown. The live Playwright spec tasks-pinned-filter.spec.ts seeds two Quests with pinned and unpinned answers and covers the chip (filtering, open panels, the finished task's group, the URL across a reload), the Quest list's count, a switch revealing the next Quest's finished hit, and the search finding a phrase only in a pinned answer but not one in an unpinned answer. Three #900/#901 assertions on the Pinned badge now name the badge's element, since the chip carries the same word (#902).

page.render.test.tsx covers the Pinned answers section present (task, question, date, model, card link), absent with no pins, with no tasks (no query) and on a failed read, absent with no query for a visitor to a public Quest, and earlier-cycle rows with their cycle number and link, not read on a first cycle or with recurring Quests off; pinned-answers.test.ts the two reads' filters and narrowed select, the model fallback and the mapping from the task list's state; task-deep-link.test.ts building and reading the link; the new task-manager-deep-link.test.tsx a link revealing a finished task's group and clearing a hiding search, a link to another Quest's task ignored, a handled link not reopening on a filter change, a rail row opening the card (twice) without a navigation, a closed panel staying closed when its row remounts, the rail following a pin and an unpin on the card and dropping a deleted task's pins, and the server's pins holding until the list loads; server-reads.test.ts the pinned rows added once each, newest first, when the newest-first page missed them; the deep-link tests also cover a link naming one of a task's several pins, focused once. The live Playwright spec pinned-answers.spec.ts pins on a card, sees the section, reloads and opens the card from the row and from a fresh visit to the link (#901).

pinned_investigations.sql (29 assertions) covers the partial index; a free party member pinning a Pro answer and an answer from a retired persona, while a pin combined with a re-queue or any other change is still refused by the plan guard; the server-side stamp (no re-crediting, no forward-dating, now() and the caller on a new pin, both cleared on unpin, a signed-in insert arriving unpinned); the succeeded-only CHECKs, the unpin when a pinned row is re-queued, and no pin coming back when it succeeds again; a visitor, a departed member and a deleted pinner; and the pinned-first earlier-cycle history with paging inside and after the pinned rows. rls.sql adds a member pinning, a visitor and a departed member refused, and the owner unpinning; account_deletion_cascade.sql adds task_investigations.pinned_by to its SET NULL fixtures; task_investigation_history.sql expects the new pinned_at column. The new [investigationId]/route.test.ts covers 200 pin and unpin, 400, 401, 403 (filtered or refused write), 404 (malformed ids, inaccessible task, investigation not on the task), 409 (pending, running, failed, or a status change before the write) and a plain 500; task-investigations.test.tsx the order, badge, control (succeeded only, read-only without a handler, pin, unpin, a refused pin explained on the row) and the earlier-cycle badge; task-footer.test.tsx the chip glyph and its label; task-manager.test.tsx a pin from the card end to end, and a pin that survives an investigation poll which started before it; investigation-prompt-dialog.test.tsx the "Pinned answer from Cycle N" note; and types.test.ts / investigation-history.test.ts the ordering helper and row mapping. The apps/web coverage floors rise to 95.65 / 91.85 / 95.4 / 95.65 (#900).

docs/cicd.md adds "Accepted CodeQL findings": what .github/codeql-accepted.txt is for, the entry format, why it is keyed on the flagged line's text, and what happens when that line changes (#730).

docs/ai-investigations.md adds "Pinned answers on the Quest page": the two RLS-filtered reads and who they run for, the live hand-off from the task list, and the ?panel=investigations#task-<id> link and what it undoes to reveal a card (#901).

docs/schema.md describes the pin columns, the stamping trigger, the plan-guard exemption and the pinned-first history, with the migration-order row and the RLS coverage line; docs/api-endpoints.md adds the pin route and its 409/403; docs/ai-investigations.md notes the pin-only exemption to the model-type guard (#900).