Contract document types: saving a draft for a published type no longer changes the live type; publishing does (D615, migration 416)

[guillaumelauzier]

S1: Saving a draft can change a published contract document type, with no reason and no step-up. Decision D615. Migration 416. Found by #1165's audit (area 7, registry publish).

What is true on main

• Publishing is guarded. POST /api/admin/contracts/registry/:doc_type/publish (routes/admin_contract_doc_registry.ts) is behind the Super Admin's write bar: a TOTP session, a step-up, and a reason of at least 10 characters. It is audited as registry.type.publish.
• Saving a draft is not. services/contractDocTypeRegistryStore.ts saves a draft with ON CONFLICT(doc_type) DO UPDATE. That overwrites the row's title, layer, party roles and required fields, and keeps status = 'published' when it was published. So a draft save on a published type changes the live type at once:
  • with no reason, no step-up and no audit;
  • and with no pending copy kept.

The work

1. A pending draft beside the live values. Migration 416 adds what the store needs to hold a draft for a published type apart from its published values, for example draft_* columns or a draft row keyed apart. Additive only.
2. Saving a draft never changes a published type's live values. On a type that is only a draft, saving works as it does today.
3. Publishing applies the pending draft to the live values, under the existing bar and audit, then clears the draft.
4. The registry reads (doc-types and the hub) return the live values plus the pending draft, so a page can show both.
5. D615 records the rule. Update the copy on /admin/contracts (frontend/src/pages/hq/ContractsPage.jsx) only if it describes the old behaviour.

Files this task owns

• cloudflare-worker/sql/migrations/416_*.sql
• cloudflare-worker/src/services/contractDocTypeRegistryStore.ts
• cloudflare-worker/src/routes/admin_contract_doc_registry.ts
• new Worker tests
• documentation/architecture/decisions/D615.md

Done when

• Tests cover:
  • a draft save on a published type leaves its live values and status unchanged, and keeps the draft;
  • publishing applies the draft, clears it and is audited;
  • a draft-only type saves as today;
  • the reads return both the live values and the draft.
• Every new assertion is mutation-checked.

---

Generated by Claude Code

[guillaumelauzier]

S1: Moved from S14 to S16, the owner's call (2026-10-06). S14: do not start it; it is S16's now.

• Where it stands. It was state:ready: no STATUS, no branch and no PR, so S16 starts from the latest main.
• The spec, its decision number and any migration number stand as written above.
• S16's queue, oldest first, one at a time: Colleague seats: the invite reaches the colleague, and accepting never turns an admin into an investor (D611) #1311, Identity data: an admin reading a KYC record or a partner profile is audit-logged, as opening the ID document already is (D612) #1312, Contract document types: saving a draft for a published type no longer changes the live type; publishing does (D615, migration 416) #1313, Article review comments: only the author or a Super Admin deletes one, and the delete is logged (D617) #1314, Decision journal: record when a thesis is edited after its outcome (D618, migration 415) #1315, Remove five dead client methods: one has no Worker route, one always fails, three repeat a method in use (D616) #1316.

---

Generated by Claude Code