phase: 89_source_ignore_paths

All verification complete — TODO.md was already cleared in the roadmap commit; the two extra unit-test diffs are necessary fake-signature adaptations for the new keywords. Everything is green, no fixes were needed.

## Phase 89 — final verification pass: ALL GREEN

**Verified (all 6 task files present in `complete/`):**
- `git_sources.ignore_paths` JSONB column + migration 0013; `alembic downgrade -1 && upgrade head` round-trips (head `0013`)
- Importer: `normalize_ignore_path`/`is_ignored`/`_ignore_for_root`, `ignore` in walk + progress pre-walk, `ignore_by_root` in `import_sources`
- API: GET/POST carry list; admin-only `PATCH` (replace, 404/422 fixed details, anonymous 403)
- Pipelines wired: `_run_sync`, `_run_upload` re-upload, `scripts/import_docs.py`
- Sources-page box: dialog, §7.4 save lifecycle, `N ignored` tag, a11y; env rows get no box

**Test/lint results:**
- `uv run pytest` → 1808 passed
- `uv run pytest --cov=app --cov-report=term-missing` → TOTAL **99%** (>90%)
- `uv run pytest tests/e2e/test_source_ignore_paths.py -v --no-cov` → 6 passed (isolated, DB up)
- Regressions in isolation: `test_git_sources_admin` 6, `test_archive_upload_sources` 5, `test_sync_button` 3, `test_smoke` 3 — all passed
- `uv run ruff check . && uv run pyright` → clean (0 errors)

**Completion criteria:** box→PATCH 200→count+GET round-trip ✅ · sync excludes `ignore/` (no docs/chunks/embeddings/summaries) + prunes newly-ignored (pruned==2) ✅ · no-mid-path rule E2E ✅ · PATCH 404/422/replace/clear/403 ✅ · full gate green ✅ · commit + phase move left to harness per rules.

**Deviations:** none blocking — E2E pins `files == 4` (overview's "5" was an off-by-one vs its own 6-file tree, documented in-test); `tests/unit/test_importer.py` + `test_sync_button.py` test-double fakes extended for the new keywords (needed for the suite to stay green).

**Next pending phase:** none — `todo/` holds only this phase.

frontend/index.html

@@ -647,6 +647,44 @@
               </div>
             </div>
           </div>
+
+          <!-- Phase 89: the per-source ignore-paths editor — the EXACT
+               #remove-confirm-dialog pattern (phase 69): page-local
+               alertdialog, dim backdrop, focus on Cancel (the safe
+               default), Escape/backdrop close as CANCEL, focus returns
+               to the row's trigger button. The box itself: one path
+               per line (prefix semantics — the phase-89 A1 rule,
+               stated in plain words in the helper line); Save runs the
+               §7.4 never-stale lifecycle (git-sources.js: "Saving…"
+               while the PATCH is out). Stored rows only (A3) — the
+               per-row button lives in git-sources.js's makeRow; this
+               is the page-local dialog it opens. -->
+          <div class="ignore-editor" id="ignore-editor-dialog" role="alertdialog"
+               aria-modal="true" aria-labelledby="ignore-editor-title"
+               aria-describedby="ignore-editor-copy" hidden>
+            <div class="ignore-editor-backdrop" aria-hidden="true"></div>
+            <div class="ignore-editor-panel">
+              <h2 class="ignore-editor-title" id="ignore-editor-title">Ignored files and folders</h2>
+              <code class="ignore-editor-source" id="ignore-editor-source"></code>
+              <p class="ignore-editor-copy" id="ignore-editor-copy">
+                One path per line. A file is ignored when its path in the
+                source starts with any of these — <code>/my/files/</code>,
+                <code>my/files/</code> and <code>my/files</code> mean the same
+                thing. No wildcards, no matching in the middle of a path.
+              </p>
+              <label class="ignore-editor-label" for="ignore-editor-textarea">Ignored paths</label>
+              <textarea class="ignore-editor-textarea" id="ignore-editor-textarea"
+                        rows="6" spellcheck="false"
+                        placeholder="my/files/"></textarea>
+              <p class="ignore-editor-error" id="ignore-editor-error" role="alert" hidden></p>
+              <div class="ignore-editor-actions">
+                <button type="button" class="ignore-editor-btn ignore-editor-cancel"
+                        id="ignore-editor-cancel">Cancel</button>
+                <button type="button" class="ignore-editor-btn ignore-editor-save"
+                        id="ignore-editor-save">Save</button>
+              </div>
+            </div>
+          </div>
         </div>
         <!-- Polite live region: the screen-reader confirmation for list
              loads, adds, and removals (git-sources.js owns the text). -->