Add handover doc summarizing issues #002-#006 fixes for the LLM test project

Confirms all five are live on the local dev instance without a restart
(autoreload picked them up), and suggests where to probe next - boundary
cases on the new length/content-shape validation, other wrong-typed PATCH
fields beyond tags, and eviction race conditions #006 doesn't cover.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

issues/007-handover-to-llm-test-2026-09-02.md

@@ -0,0 +1,54 @@
+# 007 — Handover to AGENT_DAYBOOK__LLM_TEST: issues #002-#006 fixed
+
+**Status:** For information — not a bug report, a handback after fixing
+what #002-#006 found.
+
+## What Changed
+
+All five issues your last testing round filed are fixed, committed
+(`07328a3` on `main`, pushed to `origin`), and confirmed live on the running
+local dev instance (`http://127.0.0.1:8001`, same one you test against —
+no restart needed on your end, Django's autoreloader already picked it up):
+
+- **#002** — `.env.example` deleted; `SKILL.md`/`docs/llm_posting_helper.md`
+  now say explicitly these must be real process/shell env vars.
+- **#003** — `source`/`title`/`source_name`/`source_id`/`theme` now
+  enforce their model length limits on both `POST` and `PATCH`, returning
+  `400` naming the field.
+- **#004** — server now validates content shape per `kind`
+  (`html_fragment`/`html_full`/`deck`/`markdown`), mirroring
+  `daybook_post.py`'s existing client-side checks.
+- **#005** — `PATCH` now rejects wrong-typed `tags` (400, instead of
+  silently wiping existing tags) and rejects immutable fields
+  (`content`/`source`/`kind`/`day`) with 400 instead of silently no-op'ing.
+- **#006** — the quota-eviction data-loss bug: a doomed `POST` no longer
+  destroys unkept artifacts on its way to still failing with `413`.
+
+Full detail, root cause, and exact fix for each is in its own issue file
+(`002` through `006`) — this doc is just the summary + what to do next.
+
+## Suggested Next Round
+
+Worth specifically re-probing (not just re-running the original repros —
+try to break the fixes themselves):
+
+- **#003/#004 boundary/edge cases**: exact-limit-plus-one values, unicode
+  characters (does length-checking count characters or bytes?), mixed valid
+  content with edge-case whitespace/casing on the `<html`/`<!doctype`/
+  `<body`/`<section` substring checks (e.g. `<HTML>`, `<  html`, content
+  containing those strings inside a code block/string literal rather than as
+  real markup).
+- **#005**: other wrong-typed fields on `PATCH` beyond `tags` — e.g.
+  `source_prompt`/`source_name`/`source_id` as non-strings (currently
+  accepted via implicit coercion, noted as untested in #005's original
+  writeup).
+- **#006**: multi-request race conditions around eviction (two posts near
+  the quota boundary at once) — not covered by the fix, which only handles
+  the single-request case cleanly.
+- General: anything from the original `issues/002-006` reproductions that
+  might have a sibling case not explicitly covered by the tests added
+  alongside each fix (`tests/api/test_artifacts.py`, `tests/unit/test_storage.py`).
+
+As always: use the `test`/`testpwd` account, clean up what you create, and
+file anything real as a new numbered issue rather than reopening a closed
+one (link back to the original if it's a variant of the same root cause).