Answers with
evidence attached.

Date: 5 September 2026. Review state: implementation and available verification are complete.

Are all issues verified as fixed? No. F01–F14 have fixes and passing synthetic regressions. Live source/provider checks, a single browser-to-database workflow, and screen-reader checks remain unverified. The broader suite also has 21 failures reproduced on the original revision.

The final combined Python gate passed 745 tests. The full suite first returned 27,515 passed, 48 failed, 21 skipped. All 27 failures caused by changed test contracts were repaired and passed the combined gate. The remaining 21 also fail on the base revision. Strict type checks, changed-file lint, browser checks, and all three integrated reviews are complete. No full-suite green result is claimed.

What changes for users

• Private conversations stop at one permission boundary. Denied requests do no answer work.
• Equal deal amounts add correctly. Empty groups stay empty. An unsafe merge gives a clear refusal.
• All 600 rows contribute to a complete total. GBP 2 × 600 shows GBP 1,200. Counts and money do not become booleans.
• A saved answer states its query time, source freshness, completeness, and check limits.
• Checked rows appear before optional narration ends. Optional failures keep those rows visible.
• A retry keeps its request identity. Reload restores the pending question and parent. Cancellation and timeout remain terminal.
• Empty results keep SQL inspection. Mobile panels contain focus. Charts have names and a data view.

Scope and authority

Base commit: 6ce7648afa0b69d17b765c1bb20a6fe7c3fa061f. Working branch: fix/insights-verified-correctness.

The team used the three requested gpt-6-astra agents with xhigh reasoning. Each agent had explicit file ownership. The lead owned shared contracts and integration. The same three agents challenged the integrated result. They are separate reviewers, but not different model families.

All edits remain uncommitted. No branch was pushed. No PR, issue, merge, or application deployment was created. The pre-existing review files and screenshots remain intact. Only this report is approved for public Pages publication.

Acceptance tests use synthetic rows and temporary SQLite databases. PostgreSQL 16 and Qdrant run in separate disposable localhost containers. Browser tests use the real static UI with intercepted synthetic API responses. External provider and production data paths are excluded.

Findings F01–F14

“Verified” below means the named synthetic regression passed. It does not mean production verification or proof of every possible natural-language question. Source paths in the table are relative to src/institutional_kb/; test paths are relative to the repository.

The calendar failure was disproved as a runtime defect. It was an old SQL expectation, confirmed against independent London date values. Existing leg parallelism was also retained; it was already present. Connection pooling and batching remain optimization hypotheses. No hypothesis was promoted to a production speed claim.

Before and after evidence

Raw logs and detailed commands are in lead evidence, query evidence, jobs evidence, and UI evidence.

Measured performance

All figures below are measured. Errors and refusals are not counted as successful answers. p95 is a nearest-rank statistic. Results describe the named component and fixture only.

The large fixture's status payload is 385 bytes. Its summary is 470 bytes. Its full history is 10,258,265 bytes. A 1 × 100-row fixture has the same 385-byte status payload.

New HTTP-client runs have p95 27.468 ms on the large fixture. They include client setup and a new TCP connection. They are not cold filesystem-cache runs. Operating-system-cold and production-network latency are unmeasured.

Browser ready-to-visible observations: N=30, median 286.826 ms, p95 292.978 ms, maximum 294.719 ms. Poll interval: 250 ms. The real UI consumes intercepted ready responses while optional work stays pending. This measures polling and rendering, not SQL or provider latency.

The separate worker test injects 20 seconds of narration and measures readiness after 119.394 ms. These two measurements support earlier useful results at their respective boundaries. They are not one measured production end-to-end route.

The final instrumentation pass adds submission_ack_ms and base_persistence_ms to the existing durable job timing and turn trace. The submission span includes handler authorization, reservation, and enqueueing. It excludes ASGI parsing, serialization, timing storage, and network acknowledgement. Persistence includes serialization, transaction admission, audit, and commit. Six create/append × success/error/clarify cases verify separate spans and both writer orders. Replays retain the original sample. Error and clarification outcomes do not set first_useful_ms.

Federation now has a parent trace with its actual wall time and child source trace IDs. required_checks_ms covers source authorization, the CT SQL gate, and key/grain/membership checks. merge_ms excludes its nested check spans. Existing per-source validation and EXPLAIN remain visible in child traces. Four regressions prove distinct known-duration spans, preserved children, refusal metadata, and cancellation cleanup. The tracing/federation/merge gate passed 142 tests in 14.05 seconds.

Existing model-attempt traces remain in llm_trace; query timings retain parse, validation, EXPLAIN, admission, connection, SQL execution, and retrieval. Job timings retain queue, required-to-ready, optional work, and full completion. Required-to-ready encloses child stages. Do not sum it with its child durations.

A separate browser request observation records one synthetic submission: one conversation POST, four status polls, two selected-turn reads, and zero full-history reads. Each selected turn is 5,867 bytes of fixture JSON. Ready-to-response-complete was 238.68 ms; response-complete-to-observed-visible was 52.94 ms. Their combined 291.62 ms uses one clock. The browser's own submit-event-to-render mark was 832.5 ms. This diagnostic includes deliberately held queue/running states. N=1 is not a latency percentile. Fixture JSON sizes are not compressed wire bytes.

Hypotheses: Connection pooling, batching, cached answers, and smaller worker context may help other workloads. No full-feature speedup is claimed. No plausible-estimate figure is used as acceptance evidence.

Final checks

The sole full-suite run completed with 27,515 passed, 48 failed, 21 skipped, and 1,534 warnings in 649.13 seconds. It used eight workers with file scheduling. No full suites overlapped. The functional fixes were stable for this run. The 27 compatibility repairs changed test fixtures only. A later additive instrumentation pass and browser-fixture repair have separate final gates below. The full suite was not rerun after those additions.

The three owners repaired 27 stale test contracts across 12 files. The repairs supply scoped source authorization, real validation contexts, exact qualified grants, or the new dispatch result. Existing behavior assertions remain. Three new denial cases and behavioral host/wildcard checks strengthen coverage. After the final timing additions, the union of all 36 changed Python test files passed 745 tests, with 100 existing timestamp warnings, in 71.87 seconds. No tests in this union were skipped.

The remaining 21 failures also reproduce at base commit 6ce7648a. The first isolated baseline run returned 19 failed, 178 passed, and 4 skipped in 124.72 seconds. After making the same Node dependency available, the evaluation-harness file returned 2 failed and 22 passed in 17.33 seconds. The exact failure IDs match the broader run. See the failure comparison, full run, and final 745-test run.

These failures remain unresolved. Their reproduction shows they were not introduced by this change. It does not prove their underlying behavior is correct.

env PYTHONPATH=src LORE_DB_PATH=/tmp/lore-insights-full-suite-20260905.db \
  QDRANT_HOST=127.0.0.1 QDRANT_PORT=32784 \
  LORE_LLM_LIVE=0 LORE_BI_LIVE=0 LORE_WP_LIVE_TEST=0 LORE_CONTENT_FIXER_LIVE=0 \
  .venv/bin/python -m pytest tests/ -n 8 --dist loadfile -q \
  -m 'not live and not live_db and not live_gh and not live_gh_thisrepo and not live_gh_thisrepo_recovery and not llm_live and not compose_guide_live and not blueprint_live and not blueprint_distill_live and not content_fixer_live and not wp_live and not bi_live and not deck_pptx_live and not bi_datasources_live and not bi_tablebind_live' \
  --tb=short

INSIGHTS_TEST_PG_DSN and LORE_INSIGHTS_TEST_DSN point to the disposable PostgreSQL fixture on localhost port 32783. Credentials are supplied through the test process environment. The excluded markers require live providers, privileged external infrastructure, or external write actions. Their exclusion is intentional and recorded.

env PYTHONPATH=src .venv/bin/python -m mypy src/ --strict
# Success: no issues found in 1159 source files.

# Ruff receives all 64 changed/new Python files from the saved git inventory.
xargs .venv/bin/ruff check < docs/evidence/insights-fixes-2026-09-05/changed-python-files.txt
# All checks passed.

npm run build:css
# Passed in 4.214 seconds. Existing caniuse metadata warning remains.

./node_modules/.bin/playwright test --config=playwright.insights-fixes.config.js --reporter=line
# 23 passed in 1.2 minutes. One worker. No retries.

The final combined Python command uses the same isolated PostgreSQL DSN environment as the full run:

env PYTHONPATH=src LORE_DB_PATH=/tmp/lore-insights-final-tracing.db \
  QDRANT_HOST=127.0.0.1 QDRANT_PORT=32784 LORE_LLM_LIVE=0 LORE_BI_LIVE=0 \
  xargs .venv/bin/python -m pytest -n 8 --dist loadfile -q --tb=short \
  < docs/evidence/insights-fixes-2026-09-05/final-focused-test-files.txt
# 745 passed, 100 warnings in 71.87 seconds.

The UI evidence file records the exact four-file Node command: 41 passed. The browser fixture now obtains Chart.js 4.4.7 through a pinned URL and SHA-256 check. It verifies cached bytes and rejects a bad digest. No session-specific temporary file is required. Nine affected browser cases passed in 10.5 seconds; two cases passed from an empty cache in 4.0 seconds. The suite now contains 24 cases, with the new diagnostic covered by these focused runs. After final confidence wording and faithful snapshot fixtures changed, four affected browser cases passed in 4.3 seconds. Both JavaScript syntax checks and git diff --check pass.

The HTML report also passed desktop/mobile browser QA. All images and local links load. The workload selector correctly shows the small concurrent p95 regression. There is no page-wide horizontal overflow or JavaScript error.

Review findings and resolutions

The three requested reviewers inspected the combined working tree, including new files. The review uses correctness, authorization, API, testing, lifecycle, migration, accessibility, and measurement lenses. Simplification checks cover reuse, quality, and efficiency. The lead validates concrete findings before applying fixes.

Confirmed integration findings include approved CT request settings lost at dispatch, actual-source permission gaps in alternate entry points, ambiguous browser submit recovery, cancellation propagation across API processes, and follow-up readiness after reload. Each has a passing focused regression. The final 745-test gate includes the Python changes. The review receipt records all three reviewers and the independent validation batch. Four formal findings were validated and fixed. Additional review-driven corrections are listed below.

Migration and rollout

Refresh-source permission now applies to every auxiliary lookup. An unavailable or unapproved refresh-status table leaves freshness unknown. This must be checked in rollout configuration.

Apply migrations/bic_035_durable_turn_jobs.sql through the normal migration runner. It adds durable request identity and job lifecycle metadata. It keeps legacy jobs, including duplicate old request keys. A retry of a matching old key returns 409, because the old full payload cannot be safely reconstructed; use the saved answer or an intentional new request. Additional answer metadata uses existing JSON columns.

Stop or drain old workers before migration. Back up the metadata database. Start updated workers only after the migration succeeds. A legacy active job without a process identity is reconciled as an orphan. A new live sibling is preserved. A remote-host owner remains until its deadline.

The migration regression verifies old duplicate rows, injected DDL failure rollback, and old-code compatibility rollback. migrations/rollback/bic_035_durable_turn_jobs.sql retains answers and maps statuses to the old domain. Stop workers before rollback. Reverting the app restores its old behavioral limits.

Sessions pin search_path=public and read-only transactions. Qualify operator SQL for other schemas. Empty ordinary allowlists deny physical queries. The server-pinned CT source map is the explicit no-policy exception. Unsupported merge grain or cohort shapes refuse instead of silently broadening the answer.

No rollout was performed. A future authorized rollout must check live membership revocation, source grants, tunnels, watermarks, provider timeouts, and worker restart behavior. Watch denied dispatch count, queued/running age, terminal-state reversals, optional failure rate, and first-useful/full-completion spans. A denied dispatch or terminal reversal is a rollback trigger.

Unavailable checks and impact

• Production data sources, grants, tunnels, and refresh watermarks were not queried. Tests use disposable databases. Source-specific production correctness remains unverified.
• Live model generation and each production provider were not exercised. There is no isolated, credentialed live evaluation fixture in this run. Natural-language quality and provider-specific cancellation remain unverified. A real local HTTP provider fixture does verify a stalled socket deadline.
• No screen reader was run. Browser focus, accessible names, contrast, and data alternatives are verified. Spoken output and screen-reader navigation remain unverified.
• The browser API is intercepted. Backend HTTP, real PostgreSQL, workers, persistence, and browser rendering are tested in separate fixtures. A single live browser-to-model-to-database workflow is not verified.
• N≥30 exists for status HTTP, database connection strategies, and browser ready rendering. It does not exist for every full conversational, dashboard, Compose, and export route. The missing live source/provider fixture prevents a representative matched production-route comparison.
• Source admission is process-wide. Multiple application processes need a divided budget or external admission. Arbitrary stuck native code cannot be safely killed in a Python thread. Durable state prevents late answer publication.

The 21 existing broader-suite failures above also remain open. They limit repository-wide assurance. They were reproduced independently, and their assertions were not removed or relaxed.

These limits are not passed checks. No application rollout was performed.

Observed in the browser

The real UI renders synthetic API responses. Open an image for its full size.