fix: isolate malformed ProjectData message rows

[simple-agent-manager]

Summary

• Harden ProjectData.getMessages() so one malformed chat_messages row is skipped and warn-logged instead of throwing the whole list read.
• Preserve the existing { messages, hasMore } response contract and existing ordering/pagination behavior.
• Update stale bootstrap TTL wording to describe configurable/default TTL behavior without changing runtime behavior.

Validation

• pnpm --filter @simple-agent-manager/api lint — PASS, existing warnings only
• pnpm --filter @simple-agent-manager/api typecheck — PASS
• pnpm test — FAIL outside touched API area: unrelated monorepo failures/timeouts in packages/shared, packages/providers, packages/ui, packages/terminal, and packages/acp-client
• Additional validation run: pnpm --filter @simple-agent-manager/api exec vitest run tests/unit/durable-objects/project-data-messages.test.ts tests/unit/services/bootstrap.test.ts — PASS, 11 tests
• Additional validation run: pnpm build — PASS
• Candidate sweep/cron/alarm loop candidate-volume note: N/A, no sweep/cron/alarm candidate selection changed

Staging Verification (REQUIRED for all code changes — merge-blocking)

• Staging deployment green — not run before PR; do not merge until resolved
• Live app verified via Playwright — not run before PR; this backend unit fix is covered locally but staging remains a merge gate
• Existing workflows confirmed working — not run before PR
• New feature/fix verified on staging — not run before PR
• Infrastructure verification completed — N/A: no infra changes
• Mobile and desktop verification notes added for UI changes — N/A: no UI changes

Staging Verification Evidence

Not completed. This PR must not be merged until human review decides whether staging is required for this tightly-scoped backend fault-isolation fix.

UI Compliance Checklist (Required for UI changes)

• Mobile-first layout verified — N/A: no UI changes
• Accessibility checks completed — N/A: no UI changes
• Shared UI components used or exception documented — N/A: no UI changes
• Playwright visual audit run locally — N/A: no UI changes

End-to-End Verification (Required for multi-component changes)

• Data flow traced from user input to final outcome with code path citations
• Capability test exercises the complete happy path across system boundaries — N/A: isolated Durable Object list helper; unit tests exercise the relevant parser boundary
• All spec/doc assumptions about existing behavior verified against code
• If any gap exists between automated test coverage and full E2E, manual verification steps documented below

Data Flow Trace

ProjectData.getMessages() queries chat_messages, applies the existing RPC size guard, orders rows, then now parses each row inside an isolated try/catch in apps/api/src/durable-objects/project-data/messages.ts. Malformed rows log messages.list_row_skipped with row/session context and are omitted; valid rows are returned in the same messages array shape with unchanged hasMore computation.

Untested Gaps

No live staging verification was completed. Automated coverage includes normal ordering, good/bad/good malformed rows, compact parser isolation, all-bad empty result, skip logging, and bootstrap TTL wording test updates.

Post-Mortem (Required for bug fix PRs)

What broke

A ProjectData Durable Object message list read could throw if any fetched message row no longer matched the current row schema, breaking retrieval for otherwise valid session history.

Root cause

getMessages() mapped every fetched row through throwing parsers without per-row fault isolation.

Class of bug

Multi-row Durable Object SQLite list read where one malformed row poisons the entire collection response.

Why it wasn't caught

Existing tests covered ordering and pagination but did not seed malformed rows among valid rows for the message list path.

Process fix included in this PR

Regression tests in apps/api/tests/unit/durable-objects/project-data-messages.test.ts now cover good/bad/good, compact-mode bad row, and all-bad cases. Existing process rule .claude/rules/50-list-read-row-fault-isolation.md already documents this bug class.

Post-mortem file

tasks/archive/2026-07-29-project-data-list-row-isolation.md

Specialist Review Evidence (Required for agent-authored PRs)

• All local reviewers completed and findings addressed before merge
• If any reviewer did NOT complete: needs-human-review label added and merge deferred to human

Reviewer	Status	Outcome
task-completion-validator	PASS	Local checklist review: research findings map to checklist items; checked items are present in diff; acceptance criteria covered by targeted unit tests; UI/backend and multi-resource checks N/A; vertical slice N/A for isolated DO list helper.
test-engineer	PASS	Targeted tests cover normal ordering, good/bad/good malformed row, compact-parser malformed row, all-bad empty result, skip logging, and unchanged response shape; targeted API tests pass (11 tests).
cloudflare-specialist	PASS	Durable Object list read now isolates parser failures per row, preserves hasMore calculation from raw fetched rows, avoids RPC contract change, and adds structured warn logs. Bootstrap KV TTL runtime behavior unchanged.
constitution-validator	PASS	No new URLs, timeouts, limits, or deployment identifiers introduced. Bootstrap TTL remains configurable through existing env override; changed wording only.

Note: initial delegated reviewer subagents failed to inspect files because their sandbox read commands hit bwrap: loopback: Failed RTM_NEWADDR; the table above reflects the completed in-session local reviews performed with the same skill checklists after that failure.

Exceptions (If any)

• Scope: Do-not-merge instruction.
• Rationale: User explicitly requested opening the PR, ensuring CI green, and not merging.
• Expiration: Until Raphaël explicitly authorizes merge.

Agent Preflight (Required)

• Preflight completed before code changes

Classification

• external-api-change
• cross-component-change
• business-logic-change
• public-surface-change
• docs-sync-change
• security-sensitive-change
• ui-change
• infra-change

External References

N/A: no external API/library behavior changed.

Codebase Impact Analysis

Affected code paths:

• apps/api/src/durable-objects/project-data/messages.ts — ProjectData Durable Object message list read parsing.
• apps/api/tests/unit/durable-objects/project-data-messages.test.ts — targeted malformed row regression coverage.
• apps/api/src/services/bootstrap.ts and apps/api/tests/unit/services/bootstrap.test.ts — stale TTL wording only.

Documentation & Specs

N/A: no public docs or API contract changes. Task record added at tasks/active/2026-07-29-project-data-list-row-isolation.md.

Constitution & Risk Check

Checked Principle XI: no new configurable business values, URLs, timeouts, or limits were introduced. Bootstrap TTL remains configurable through the existing environment override; wording now reflects that.

[codspeed-hq]

Merging this PR will not alter performance

✅ 6 untouched benchmarks

---

_{Comparing sam/retry-after-failed-startup-p4cycp (5a9c8de) with main (090b237)}

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[simple-agent-manager]

Closing in favor of #1697, which integrates this fix (malformed ProjectData row isolation) and is being completed and merged tonight per Raphaël's backlog-cleanup authorization (SAM task 01KZ9YVKD8FD6JT15FCWRD7TY4). Branch preserved; reopen if #1697 stalls.