[jrf0110]

Summary

Complete pass on the Kilo Wasteland integration.

Product

• Join or create a wasteland via the new /wasteland page (registers your rig with the upstream)
• Connect a town to a wasteland
• View the wanted board, claim work, submit for review, browse rigs/members
• Admin view for wasteland owners (review, approve, reject)

Platform

• Shared settings components at apps/web/src/components/settings/ (SettingsSection, FieldGroup, SettingsStickyHeader, SettingsScrollspyNav, useScrollSpy) — consumed by both gastown and wasteland settings pages.
• Shared DrawerStack primitive (apps/web/src/components/drawer/DrawerStack.tsx) — generic createDrawerStack<T>() factory with ESC handling, body scroll lock, focus-on-mount, AnimatePresence stacking with depth math, hover-peek on background layers. Gastown's DrawerStack becomes a thin typed wrapper; wasteland uses the same primitive. Optional header slot so panels can contribute title/badges inline with the close button.

Verification

• Lots of manual testing

Visual Changes

[kilo-code-bot]

Code Review Summary

Status: 5 Issues Found | Recommendation: Address before merge

Executive Summary

The 5 carried-forward issues from prior reviews remain unresolved; this increment (1 commit: wasteland excluded from auto-deploy CI workflow) introduces no new bugs.

Overview

Severity	Count
CRITICAL	0
WARNING	5
SUGGESTION	0

New Issues — incremental (0d64665 → HEAD 696ff09)

No new issues found in the incremental diff.

Carried-forward Issues (unchanged files)

WARNING — create-upstream.ts: step 3 best-effort _meta write is actually fatal

File: services/wasteland/src/upstream-bootstrap/create-upstream.ts · Line: 222

Step 3 is documented as best-effort, but the catch block re-throws a CreateUpstreamError. A transient _meta.wasteland_name write failure aborts the entire bootstrap even though the upstream DB was already created in step 2. Either catch-and-log (matching the stated intent) or remove the best-effort comment.

---

WARNING — Migration 0125: kilocode_users ADD COLUMN app_store_account_token NOT NULL with volatile default causes full table rewrite

File: packages/db/src/migrations/0125_hesitant_millenium_guard.sql · Line: 58

gen_random_uuid() is a volatile function. Adding a NOT NULL column with a volatile default requires backfilling every existing row under an AccessExclusiveLock. Safer: add nullable, batch-backfill, then SET NOT NULL.

---

WARNING — Migration 0125: UNIQUE constraint on kilocode_users without CONCURRENTLY

File: packages/db/src/migrations/0125_hesitant_millenium_guard.sql · Line: 73

Adding a UNIQUE constraint via ALTER TABLE builds the index synchronously under an AccessExclusiveLock. Safer: CREATE UNIQUE INDEX CONCURRENTLY first, then add the constraint backed by that index.

---

WARNING — softDeleteUser deletes referee reward records when the referrer is deleted

File: apps/web/src/lib/user.ts · Lines: ~876–882

Deleting kiloclaw_referral_conversions WHERE referrer_user_id = userId wipes reward records for non-deleted referees. Remove referrer_user_id = userId from the delete predicate; the FK will null it out automatically.

---

WARNING — awaiting_approval_observed_at overwritten on every poll tick

File: services/gastown/src/dos/town/actions.ts · Line: ~1131

The timestamp is stamped with now() on every alarm tick while nowAwaiting is true (json_set('$.awaiting_approval_observed_at', ?) with no existence guard), so awaitingApprovalDurationMs only reflects one polling interval. Add a WHERE json_extract(metadata, '$.awaiting_approval_observed_at') IS NULL guard to preserve the initial observation time.

Incremental Diff Overview (0d64665 → HEAD 696ff09, 1 commit)

• Wasteland excluded from auto-deploy CI: .github/workflows/deploy-workers.yml adds services/wasteland to the EXCLUDED array, matching the existing pattern for services/gastown and services/kiloclaw.

Files Reviewed — incremental (1 file)

• .github/workflows/deploy-workers.yml — no new issues

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-4.6-sonnet-20260217 · 292,179 tokens}

_{Review guidance: REVIEW.md from base branch main}

[jrf0110]

All four review findings addressed in 5ed0111:

• inline #1 — useScrollSpy suppressRef — resolved. Scroll root is now resolved before flipping suppressRef.current = true so a missing root bails without leaving the observer suppressed.
• summary only — useScrollSpy unmount timer — tracked the setTimeout id in a suppressTimerRef and clearTimeout() in the effect's cleanup function so a pending re-enable can't fire after unmount.
• summary only — SettingsClient setState during render — form-state sync moved from an if (wasteland && !initialized) { setName(...); ... } block in the render body to a useEffect guarded by a ref flag, so the initial mirror happens once after commit.
• inline #2 — setUpstreamRigTrust never reaches main — resolved. Added createPull to dolthub-api.util.ts and the handler now opens + merges a PR from the scratch branch into main. A finally block closes an orphaned PR on failure and deletes the scratch branch unconditionally. The DoltHub REST API has no direct branch→branch merge, so the pulls API is the only path.

Also fixed the CI lint job that was failing on pre-existing unsafe-access errors in services/wasteland/src/wasteland.worker.ts (85 violations) and services/wasteland/src/util/crypto.util.test.ts (75 violations). The worker fix is a real improvement — per services/wasteland/AGENTS.md every debug route now validates its request body through a shared parseJsonBody<T>() helper with a Zod schema instead of reading untyped c.req.json(). The test-file fix was a stale pnpm symlink that pnpm install resolved; I also aligned the wasteland tsconfig types array with kilo-chat's pattern so future installs stay consistent.

[jrf0110]

Picked this up to triage the open feedback. State of the PR right now:

Inline review threads: all 6 threads on the PR are already resolved (the most recent is the merge-pull state-casing fix in services/wasteland/src/trpc/router.ts:1735, resolved May 6 in 1e9980a). Nothing left to action there.

"Issues Outside Diff" in the bot's review summary (4 WARNINGs): I checked each of these against the current branch tip (222bf22) vs origin/main:

#	Finding	Verified against branch
1	0125_hesitant_millenium_guard.sql — ADD COLUMN ... gen_random_uuid() NOT NULL table rewrite	File is identical to origin/main — came from #3079 (Apple Kilo Pass) which is already merged to main.
2	0125_hesitant_millenium_guard.sql — UNIQUE constraint without CONCURRENTLY	Same — file is identical to origin/main, originated in #3079.
3	apps/web/src/lib/user.ts — softDeleteUser deletes referee reward records via referrer FK	File is identical to origin/main. The bug is real and reproducible in the current code, but it lives on main, not this branch.
4	services/gastown/src/dos/town/actions.ts:~1044 — awaiting_approval_observed_at overwritten on every poll tick	The +41 lines this branch adds to that file are unrelated (a new ReportWastelandDone action, around line 1459). The flagged code at line 1044 is identical to origin/main.

git diff origin/main..HEAD --stat against those four paths confirms it: the migration files and user.ts are byte-for-byte the same as main, and the gastown delta on this branch doesn't touch the awaiting-approval block.

So the bot is correctly identifying real issues, but they all originated on main (#3079 for items 1-3, and a pre-existing gastown bug for item 4). The bot's summary picks them up here because the merge base for this long-running staging branch includes those PRs in its scan range. They belong in their own follow-up PRs targeting main, not this staging branch — fixing them here would put schema/GDPR changes into an unrelated wasteland feature PR.

Closing this comment thread out unless someone disagrees with the scoping. Happy to file the four follow-ups against main if that's the preferred path.

[kilo-code-bot]

WARNING: org and db are not encodeURIComponent-encoded in the probe URL

The shared dolthub-api.util.ts counterpart uses encodeURIComponent(owner) and encodeURIComponent(db) (line 94 of that file). This local copy omits the encoding. DoltHub org/repo names are typically ASCII-safe, but the inconsistency is a latent bug for any name containing characters that need escaping (e.g. a future org name with a . or %). The same issue applies to the authenticated probe URL on line 451.

Suggestion: either reuse upstreamExistsOnDolthub from dolthub-api.util.ts (which is already exported and has a matching signature) or apply the same encoding here:

`${DOLTHUB_API_BASE}/${encodeURIComponent(org)}/${encodeURIComponent(db)}?q=${encodeURIComponent('SELECT 1')}`

[kilo-code-bot]

WARNING: as Record<string, unknown> cast violates the repo coding standard

The coding standards explicitly say "AVOID typescript's as operator" and "Never use as to cast IO data. If the shape is known, define a Zod schema". The shared dolthub-api.util.ts version avoids this with UpstreamProbeResponse.safeParse. The same pattern applies to the data as Record<string, unknown> cast on line 460.

This is a local duplicate of logic that already exists (with proper Zod validation) in dolthub-api.util.ts::upstreamExistsOnDolthub. Reusing that export would fix both the cast and the encoding issue above simultaneously.

[kilo-code-bot]

WARNING: staleTime: 5 * 60_000 is unsafe for the create card

Both cards share this hook. For the connect card (wants exists=true) a stale "exists" result is fine — repos rarely disappear. But for the create card (wants exists=false) a stale "missing" result is actively incorrect: if the user submits the form, the repo gets created, then they navigate back and retry (e.g. after a failure), the 5-minute cache will still report "Available" when the repo now exists, allowing a second wl create that will fail on DoltHub.

Suggestion: override staleTime to 0 for the create card, or accept an staleTime prop so callers can differentiate:

const query = useQuery({
  ...trpc.dolthub.verifyUpstream.queryOptions({ organizationId, upstream: debounced }),
  enabled: enabled && validShape && debounced === trimmed && trimmed.length > 0,
  staleTime: 0, // create-mode: always re-verify; repos can be created during the session
  retry: false,
});

or pass staleTime as a parameter to useUpstreamVerification.

[kilo-code-bot]

WARNING: Step 3 is documented as "best-effort" but this catch block rethrows, making a _meta write failure fatal to the whole bootstrap.

If INSERT IGNORE INTO _meta fails (e.g. the _meta table doesn't exist in this commons schema version, or a transient DoltHub error), the entire createUpstream call will fail and the caller receives a CreateUpstreamError even though the schema was applied and the rig was already registered on the bootstrap branch in step 4 (which hasn't run yet, but steps 1–2 completed successfully).

Consider making this actually best-effort:

    } catch (err) {
      logger.warn('createUpstream: wasteland_name write failed (non-fatal)', {
        upstream: opts.upstream,
        wastelandName: opts.wastelandName,
        error: formatError(err),
      });
    }