[bitifirefly]

Candidate

• Source: develop, fixed candidate 9602c22777e1ca81cd829dd886710affe0a06bae.
• Target: main; use a merge commit, preserving the validated candidate tree.

Changes

• Harden Dify and LangChain submission ownership, navigation, stopping, drafts, and attachment lifecycle boundaries.
• Protect pending executions against credential and quota changes; preserve unknown execution occupancy and prevent duplicate dispatch/counting.
• Improve save recovery, structured errors, and multi-message/tool history projection.
• Register accepted drafts before persistence can activate a new conversation route, preventing streamed text and stop controls from disappearing.

Validation

• Pinned development toolchain: 229 suites / 2,196 tests, root/API/shared types, changed-file lint/format, architecture guards, and shared/API/Web production builds passed.
• Candidate GitHub CI: all six jobs passed, including CI Status Check and Docker Build and Smoke.
• Stage independent PM2 production build: real Dify and LangChain browser checks, history/refresh/relogin and delete/recreate passed.
• Isolated/synthetic coverage includes save failure recovery, unknown execution locking, message/tool projections, incremental streaming and cross-conversation stop isolation. These are not represented as real model calls.
• Two-API and owner-isolation evidence reused only for the unchanged server artifact; frontend checks rerun for this candidate.
• User explicitly confirmed overall Stage manual acceptance. No claim that every checklist step was separately documented.
• Publication range and secret checks passed. Private configuration and operational evidence are excluded.

Migration and rollback

Apply the additive 20261114170000_protect_pending_agent_credentials_and_quota.sql migration before updating the API/Web pair. It has been verified on fresh and upgrade test databases and applied in development and Stage; production remains unchanged. Preserve backups and the previous application artifact. Application rollback does not imply a destructive database rollback.

Scope

Source integration only: no tag, GitHub Release, production deployment, or full AG-UI migration.