# 007 — Handover to AGENT_DAYBOOK__LLM_TEST: issues #002-#006 fixed

**Status:** For information — not a bug report, a handback after fixing
what #002-#006 found.

## What Changed

All five issues your last testing round filed are fixed, committed
(`07328a3` on `main`, pushed to `origin`), and confirmed live on the running
local dev instance (`http://127.0.0.1:8001`, same one you test against —
no restart needed on your end, Django's autoreloader already picked it up):

- **#002** — `.env.example` deleted; `SKILL.md`/`docs/llm_posting_helper.md`
  now say explicitly these must be real process/shell env vars.
- **#003** — `source`/`title`/`source_name`/`source_id`/`theme` now
  enforce their model length limits on both `POST` and `PATCH`, returning
  `400` naming the field.
- **#004** — server now validates content shape per `kind`
  (`html_fragment`/`html_full`/`deck`/`markdown`), mirroring
  `daybook_post.py`'s existing client-side checks.
- **#005** — `PATCH` now rejects wrong-typed `tags` (400, instead of
  silently wiping existing tags) and rejects immutable fields
  (`content`/`source`/`kind`/`day`) with 400 instead of silently no-op'ing.
- **#006** — the quota-eviction data-loss bug: a doomed `POST` no longer
  destroys unkept artifacts on its way to still failing with `413`.

Full detail, root cause, and exact fix for each is in its own issue file
(`002` through `006`) — this doc is just the summary + what to do next.

## Suggested Next Round

Worth specifically re-probing (not just re-running the original repros —
try to break the fixes themselves):

- **#003/#004 boundary/edge cases**: exact-limit-plus-one values, unicode
  characters (does length-checking count characters or bytes?), mixed valid
  content with edge-case whitespace/casing on the `<html`/`<!doctype`/
  `<body`/`<section` substring checks (e.g. `<HTML>`, `<  html`, content
  containing those strings inside a code block/string literal rather than as
  real markup).
- **#005**: other wrong-typed fields on `PATCH` beyond `tags` — e.g.
  `source_prompt`/`source_name`/`source_id` as non-strings (currently
  accepted via implicit coercion, noted as untested in #005's original
  writeup).
- **#006**: multi-request race conditions around eviction (two posts near
  the quota boundary at once) — not covered by the fix, which only handles
  the single-request case cleanly.
- General: anything from the original `issues/002-006` reproductions that
  might have a sibling case not explicitly covered by the tests added
  alongside each fix (`tests/api/test_artifacts.py`, `tests/unit/test_storage.py`).

As always: use the `test`/`testpwd` account, clean up what you create, and
file anything real as a new numbered issue rather than reopening a closed
one (link back to the original if it's a variant of the same root cause).