feat: undo and recovery (ADR-016/017/018)

CLAUDE.md

@@ -63,7 +63,7 @@ Capability directories (`.filter`, `.order`, `.first`, `.last`, `.export`, `.col
 
 ### Synth Apps
 
-Tables whose names start with `_` (e.g., `_blog`, `_docs`) can be exposed as synthesized views -- markdown files, task lists, or plain text snippets. The synth layer (`fs/synth/`) maps filesystem operations to table rows using format-specific conventions. See `docs/markdown-app.md` and `docs/tasks-app.md`.
+Tables whose names start with `_` (e.g., `_blog`, `_docs`) can be exposed as synthesized views -- markdown files, task lists, or plain text snippets. The synth layer (`fs/synth/`) maps filesystem operations to table rows using format-specific conventions. See `docs/file-first.md`.
 
 ### SQL Identifier Quoting
 
@@ -109,6 +109,7 @@ Multiple TigerFS mounts may connect to the same database concurrently. This mean
 - **Cache metadata only:** Sizes, permissions, directory entries, column names/types, primary keys, table lists. These change rarely and have short TTLs.
 - **Stat cache keys must be unique per path:** Different pipeline paths (e.g., `.export/json` vs `.filter/active/true/.export/json`) must not share cache entries, even on the same table.
 - **Pattern:** `Stat` may use caches. `ReadFile` must always hit the DB.
+- **Audit invalidation on every new write path:** any write must call `statCache.invalidate(schema, table)` and `pathCache.invalidate(schema, table)` with the *user* schema (not `synth.TigerFSSchema`); a schema-key mismatch silently leaves stale entries cached for up to 2 seconds and surfaces as cross-mount read inconsistencies.
 
 ## Logging
 
@@ -154,6 +155,10 @@ For each implementation task:
 
 Integration tests use testcontainers-go for PostgreSQL. See `test/integration/` for examples.
 
+### Stress-test monotonicity warnings
+
+Stress runs (`bin/tigerfs-stress start`) may emit `[warn iter ...] readLatestLogID regressed after ...` lines. These are **expected** — they indicate the macOS NFS layer (go-nfs library or kernel client, ruled out at every TigerFS layer) returned a stale `.log/.last/N/.export/json` snapshot after a heavy commit. The runner's monotonic helper retries up to 2.5s and falls back to the prior known-good `lastLogID`; the run continues correctly. The end-of-run "Monotonicity Warnings" section summarizes rate, recovery distribution, and op kinds preceding regressions. Do not treat these as bugs to fix in TigerFS; see the iter-107 investigation arc on `feat/undo` (commits `85a2495` → `f59cfcf`) for context.
+
 ### Test Naming Convention
 
 Integration tests that mount the filesystem work with **both** FUSE (Linux) and NFS (macOS) — the mount method is auto-detected. Name tests by what they test, not the mount method:

docs/adr/005-capability-directory-taxonomy.md

@@ -170,12 +170,9 @@ Considered alternatives:
 ├── .columns/         # capability: column projection (pipeline query)
 │   └── id,name,price/
 │       └── .export/
-├── .first/           # capability: first N rows
-│   └── 100/
-├── .last/            # capability: last N rows
-│   └── 100/
-├── .sample/          # capability: random sample
-│   └── 100/
+├── .first/N/         # capability: first N rows (navigate directly, e.g. .first/100/)
+├── .last/N/          # capability: last N rows (navigate directly, e.g. .last/100/)
+├── .sample/N/        # capability: random sample (navigate directly, e.g. .sample/100/)
 ├── .order/           # capability: specify row ordering (see ADR-006)
 │   └── price/        # (dynamic: any column name)
 ├── .export/          # capability: bulk read (see ADR-006)
@@ -190,7 +187,7 @@ Considered alternatives:
 │   │   └── csv, tsv, json, yaml
 │   └── .append/
 │       └── csv, tsv, json, yaml
-├── .all/             # capability: all rows iterator
+├── .all/             # capability: all rows (hidden from ls to prevent infinite recursion)
 ├── .indexes/         # capability: index DDL management
 │   └── .create/
 ├── .delete/          # capability: table delete staging

docs/adr/006-bulk-export-capability.md

@@ -189,7 +189,7 @@ email: bob@example.com
 ### Read Semantics (Export)
 
 **Size limits:**
-- Limited to `DirListingLimit` rows (default 10,000)
+- Limited to `DirListingLimit` rows (default 1,000)
 - For larger exports, use explicit pagination: `.first/10000/.export/csv`
 - Error message suggests pagination if limit exceeded
 

docs/adr/011-directory-hierarchies.md

@@ -1,6 +1,6 @@
 # ADR-011: Directory Hierarchies in Synthesized Apps
 
-**Status:** Accepted
+**Status:** Superseded by [ADR-017](017-relational-directory-structure.md)
 **Date:** 2026-02-12
 **Author:** Mike Freedman