fix: require exact release proof and durably schedule retained-owner cleanup #801
No reviewers
Labels
No labels
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Reviewed
Confirmed
Reviewed
Duplicate
Reviewed
Invalid
Reviewed
Won't Fix
Status
Abandoned
Status
Blocked
Status
Need More Info
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
toasterson/Anima!801
Loading…
Reference in a new issue
No description provided.
Delete branch "fix/s1-release-proof-reconciliation-20261019"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Cleanup retries now have a stable first-blocked clock, dedicated failure/wait/send counts and durable bounded backoff. Missing or bool-only release evidence retains the exact owner; dispatch attempts, work-item retry budgets and phase/hold decisions are preserved. One database update admits each idempotent cleanup attempt, including retirement retire/observe/control I/O, with a five-minute in-flight deadline. Akh-in-progress/non-exhausted failures are waits; only local mapping/contract conflicts or Akh operator-required escalate. A wait after rearm never re-escalates historical failures.
Release requires the authenticated exact A2 session/principal/profile/workspace proof. Normal interrupted work requires retained files. A released proof with nonempty reconciliation_request_id is the explicit durable operator absence/accepted-loss attestation: preserve_files may remain true without inventing retention; expected binding and any present executor receipt still match exactly. Null workspace is accepted only with a null requested binding. Full proof/attestation provenance is retained in closure/audit. No bool, 404, missing/replaced executor, cancellation or age establishes release.
Required delivery fences apply to configured route paths or existing durable Git/PR rows. Requirements persist additively in migration163 so config removal cannot discard them. Published Git on a no-PR-policy route needs no synthetic pull or SQL rejection. Pending/unknown required delivery retains the original workspace for the existing #748 recovery owner; this PR creates no duplicate snapshot/replay path. Inspector exposes result_count, undelivered_changes and cleanup fields. An audited operator.write exact-clock rearm_session_cleanup also covers natural completion without manufacturing retirement; the existing exact retirement requeue stays supported. Both retain counters and owner until proof. A supported audited Change rejection/supersession verb remains a separate follow-on, never an SQL workaround in this series.
Dependency: deploy Akh #675 at 80464684ecc2b9afb7c9978aab8841d14dc55971 or a descendant with its paired validator relaxation before relying on accepted-loss recovery. Earlier A2 heads alone cannot release cancelled bound allocations after operator absence. Legacy/mixed rollout remains a bounded wait. The paired Akh real manager reconcile -> runtime cleanup/rearm -> durable proof/lifecycle HTTP regression passes and fails with the old validator. Deployment and any live operator sequence are separate human gates; none performed here.
Validation: 3 client +558 server library tests pass (6 explicit existing server tests ignored); cleanup scheduling PostgreSQL passes including concurrent single-flight/restart/12-failure exhaustion, natural-completion operator rearm and wait-after-rearm. Root completion2 +relay1 +retirement2 PostgreSQL pass, including the cancelled bound operator API sequence without SQL recovery and retained executor receipt; original pending partial patch remains stored on a no-PR-policy published route. Client/server all-target Clippy -D warnings passes. Client completion/reconciliation4 also pass. Follow-up head7b777d8659bc28cabce19c1b3382e72ae66f1fcf is pushed normally; a clean/remote-bound exact-head root5 PostgreSQL rerun passes (
s1-review-exact-root-pg.log.receipt.json). Exact-head Solstice CI and independent re-review remain pending. Earlier fixture-only failures were corrected by explicit schema evidence and a real unresolved delivery row. No merge, deploy, claims, acceptance or live recovery.Paired contract pin refreshed to Akh#67580464684ecc2b9afb7c9978aab8841d14dc55971 in the source consumer and contract docs. That head repairs CI4363's older cleanup-worker fixture to consume/validate the typed release-proof request, retaining its active-dispatch starvation assertion. Wire/operator-attestation semantics are unchanged; Anima reader logic is unchanged. Current Anima#a0b2f2fa40d2ba0a1c850315c1509ce8671a3940 has only provenance/doc additions after the previously tested/reviewed7b777d86. Akh exact-head Solstice validation remains pending; no local test pass is asserted for its new fixture. Anima merged-tree remote nightly will validate this updated dependency pin with the series.
Integration refresh (2026-10-19): normal main/dependency merge commits, no force push. Main is
8d3eb5855f. This head also includes refreshed #798 so the agreed merge order cannot repeat the same insertion conflict; its diff narrows as predecessors land. Shell/Rust syntax, diff and predecessor-ancestry checks pass. No fresh local cargo check: available disk headroom above the 31.25 GiB floor was smaller than the last measured owned compile target. Exact new-head CI is the gate; prior receipts remain prior-head evidence.