Queue: snapshot data-loss revert, three accepted-then-ignored params, and a diff-scoped lint gate

.gitignore

@@ -32,7 +32,8 @@ ui/.svelte-kit/
 ui/build/
 /dashboard/static/spa/*
 !/dashboard/static/spa/.keep
-.beads/
+.beads/*
+!.beads/issues.jsonl
 .gemini/
 .runtime/
 CLAUDE.md

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build ui-install ui-lint ui-check ui-lint-fix ui-fmt ui-fmt-fix ui-test ui-build install-deps install-tofu lint lint-fix test integration-test terraform-test e2e e2e-test total-coverage clean demo all dev-mcp-install dev-mcp-check pgo docs check-pins
+.PHONY: build ui-install ui-lint ui-check ui-lint-fix ui-fmt ui-fmt-fix ui-test ui-build install-deps install-tofu lint lint-changed lint-fix test integration-test terraform-test e2e e2e-test total-coverage clean demo all dev-mcp-install dev-mcp-check pgo docs check-pins
 
 BINARY_NAME=gopherstack
 VERSION_PKG=github.com/blackbirdworks/gopherstack/pkgs/version
@@ -132,6 +132,11 @@ lint: install-deps ui-lint ui-fmt ui-check
 	go vet -vettool=$$(go tool -n mulint-vet) ./...
 	go tool govulncheck ./...
 
+# Lint + vet only the packages touched by the diff (working tree, or
+# branch vs origin/main) instead of the whole repo -- see scripts/lint-changed.sh.
+lint-changed:
+	@bash scripts/lint-changed.sh
+
 lint-fix: install-deps ui-lint-fix ui-fmt-fix
 	@echo "Running fieldalignment..."
 	fieldalignment -fix ./...

cli.go

@@ -99,6 +99,7 @@ import (
 	cloudcontrolbackend "github.com/blackbirdworks/gopherstack/services/cloudcontrol"
 	cfnbackend "github.com/blackbirdworks/gopherstack/services/cloudformation"
 	cloudfrontbackend "github.com/blackbirdworks/gopherstack/services/cloudfront"
+	cfkvsbackend "github.com/blackbirdworks/gopherstack/services/cloudfrontkeyvaluestore"
 	cloudtrailbackend "github.com/blackbirdworks/gopherstack/services/cloudtrail"
 	cwbackend "github.com/blackbirdworks/gopherstack/services/cloudwatch"
 	cwlogsbackend "github.com/blackbirdworks/gopherstack/services/cloudwatchlogs"
@@ -3304,7 +3305,8 @@ func wireAppConfigDeployments(appconfigReg, appconfigdataReg service.Registerabl
 }
 
 // wireAppSyncAndStreamsIntegrations wires AppSync's Lambda and DynamoDB
-// resolvers, and DynamoDB Streams to the DynamoDB backend.
+// resolvers, DynamoDB Streams to the DynamoDB backend, and CloudFront
+// KeyValueStore to the CloudFront backend.
 func wireAppSyncAndStreamsIntegrations(byName map[string]service.Registerable) {
 	// Wire AppSync → Lambda for LAMBDA resolver execution.
 	wireAppSyncLambda(byName["AppSync"], byName["Lambda"])
@@ -3314,6 +3316,11 @@ func wireAppSyncAndStreamsIntegrations(byName map[string]service.Registerable) {
 
 	// Wire DynamoDB Streams → DynamoDB backend so streams share the same in-memory data.
 	wireDynamoDBStreams(byName["DynamoDB"], byName["DynamoDBStreams"])
+
+	// Wire CloudFront KeyValueStore → CloudFront backend so the data-plane ops
+	// (GetKey/PutKey/DeleteKey/ListKeys/UpdateKeys/DescribeKeyValueStore) act on
+	// the same KVS stores the CloudFront control-plane ops manage.
+	wireCloudFrontKeyValueStore(byName["CloudFront"], byName["CloudFront KeyValueStore"])
 }
 
 // wireSchedulerAndPipesIntegrations wires the Scheduler and Pipes runners
@@ -3497,6 +3504,7 @@ func getRemainingServiceProviders() []service.Provider {
 		&cebackend.Provider{},
 		&cloudcontrolbackend.Provider{},
 		&cloudfrontbackend.Provider{},
+		&cfkvsbackend.Provider{},
 		&codeartifactbackend.Provider{},
 		&codebuildbackend.Provider{},
 		&codecommitbackend.Provider{},
@@ -11706,6 +11714,26 @@ func wireFISActionProviders(fisReg service.Registerable, services []service.Regi
 	setter.SetActionProviders(providers)
 }
 
+// wireCloudFrontKeyValueStore connects the CloudFront KeyValueStore data-plane
+// handler to the CloudFront in-memory backend, mirroring wireDynamoDBStreams
+// below: the KVS data-plane ops belong to a separate SDK module/protocol
+// (gopherstack-4ara) but act on the same KeyValueStore state CloudFront's own
+// control-plane ops (CreateKeyValueStore etc.) manage, so the handler is wired
+// directly to CloudFront's backend rather than owning a duplicate store.
+func wireCloudFrontKeyValueStore(cfReg, kvsReg service.Registerable) {
+	kvsH, ok := kvsReg.(*cfkvsbackend.Handler)
+	if !ok {
+		return
+	}
+
+	cfH, cfOk := cfReg.(*cloudfrontbackend.Handler)
+	if !cfOk {
+		return
+	}
+
+	kvsH.Backend = cfH.Backend
+}
+
 // wireDynamoDBStreams connects the DynamoDB Streams handler to the DynamoDB in-memory backend
 // so that both services share the same underlying stream state.
 func wireDynamoDBStreams(ddbReg, streamsReg service.Registerable) {

cmd/gendocs/main.go

@@ -83,6 +83,8 @@ func run(ctx context.Context, log *slog.Logger) error {
 		return badgeErr
 	}
 
+	logParseWarnings(ctx, log, docs)
+
 	log.InfoContext(ctx, "gendocs complete",
 		"services_total", len(entries),
 		"readmes_generated", generated,
@@ -143,6 +145,18 @@ func processService(slug string) (summaryEntry, *ParityDoc, bool, error) {
 	return newSummaryEntry(slug, doc), doc, true, nil
 }
 
+// logParseWarnings surfaces every parsed doc's Warnings via the structured
+// logger, at Warn level. These never fail the build: a PARITY.md line that
+// looks like an entry but doesn't parse should be visible to whoever next
+// touches that file, not silently undercounted (gopherstack-udc7).
+func logParseWarnings(ctx context.Context, log *slog.Logger, docs []*ParityDoc) {
+	for _, doc := range docs {
+		for _, w := range doc.Warnings {
+			log.WarnContext(ctx, "PARITY.md entry did not parse", "detail", w)
+		}
+	}
+}
+
 // guideExists reports whether a hand-written docs/services/<svc>.md guide
 // exists, so renderServiceReadme knows whether to link to it.
 func guideExists(slug string) bool {

cmd/gendocs/model.go

@@ -36,6 +36,10 @@ type ParityDoc struct {
 	Gaps            []string
 	StructuralGaps  []string
 	Deferred        []string
+	// Warnings holds "file:line: ..." diagnostics for ops:/families: lines
+	// that looked like a block entry but didn't parse as one, so a caller
+	// can surface them without failing the build (gopherstack-udc7).
+	Warnings []string
 }
 
 // bucket is the coarse health classification of a single status token (or of