Skip to content

v0.49.0: Complete managed bounded escalation #11

Open
Open
v0.49.0: Complete managed bounded escalation#11

Description

@grove
grove
opened on Oct 17, 2026

Exact repaired-MDM archive and binary proof — 2026-10-21

The full React–MDM preview #39582414674 passed on earlier MDM fix head 261bb41, while unchanged pinned-MDM #39582414884 failed on the original stale-CAS bug as expected. MDM PR #21 then revealed that expanding Rust lines moves generated SQL source-location comments, violating the frozen v0.14.1 archive byte comparison even with otherwise green Rust tests; main CI #39581225844 passes. Repair head 6ad23ca guards an empty SPI result without changing later exported SQL function line locations. MDM CI #39592063438 pending.

Current React PR #14 head 20f09de runs a separate full-joint-stack preview on exact MDM source 6ad23ca, preserving the historical pg-trickle producer SHA/archive checksum and old MDM pin check, and now records MDM git archive checksum plus packaged pg_mdm/pg_trickle/pg_react shared library digests and confirms exact inherited MDM+producer binary identity. Current preview CI #39592436407 is pending. Neither repaired source nor preview artifacts count as accepted release pin until every exact-head CI and downstream package manifest qualifies. Runtime claims, throughput/sign-offs and production enable remain open.

Current exact-source repair preview — 2026-10-21

The independent preview workflow on draft React PR #14 now pins MDM draft repair head 261bb419447bb2bbebd3bce5be514baa4ed3a1e4 (post-formatting update) from MDM PR #21, retaining the original historical pg-trickle archive. Current React preview CI #39582414674 and MDM E2E CI #39582365065 are queued. The original pinned MDM React compatibility check #39582414884 is separately preserved and not waived. This is still a blocker until exact-source packaging, manifest and complete candidate adoption qualification; no release or production claim.

Isolated stale-CAS candidate integration (not a repin) — 2026-10-21

React draft PR #14 at 7db1bf4 adds a second joint-stack CI workflow pinned to corrected MDM candidate source 1e9986ff01dc6fd2a31b4e31e8df8d6446135316 from draft MDM PR #21. It retains original pinned pg-trickle source/archive, rebuilds the actual candidate MDM/React images, captures source/image manifests and executes the whole test audit including authenticated stale-version negative proof. Preview CI #39582038003 queued. The existing exact-old-MDM pinned compatibility CI #39582037963 remains unchanged and is not waived. No acceptance, artifact adoption or release inference from preview until both upstream MDM E2E and downstream fully identified candidate are qualified.

Blocking pinned-MDM defect revealed by exact stale-version test — 2026-10-21

React PR #14 head 34c06f7 fails pinned-producer CI #39572339881 while core/adapter CI is green. After successful authorized pause→restart→resume and preserved receipts, the stale operator runtime-version test receives XX000 MDM_INTERNAL: … SpiTupleTable positioned before the start or after the end from the pinned MDM 0.14.1 producer. This is an upstream zero-row conditional SPI RETURNING cursor bug, not an acceptable policy-binding stale-version rejection; the test remains red and is not relaxed. See MDM issue #20 and draft repair PR #21 (empty-result guard plus real operator E2E negative tests), with MDM CI #39581517997 pending. React's qualified historic artifact/source checksums remain unchanged. A new exact MDM binary/manifest and complete React joint-stack qualification are required before re-evaluating this gate. All later #11 and release requirements stay open.

Part of #8.

Current dependency status (2026-10-19)

Owner ratification and exact negative MDM fixture prerequisite: SATISFIED. The requester ratified the v0.49 addendum, and MDM PR #19 merged at 06471e647ee54a80973fb5ad6709830f9955dbff. MDM CI #39285572518 passed both test and packaged e2e on final head 03aac7c, including exact non-next-level, paused/replaced-binding, and malformed-level receipts/no-receipt. Fixture source and required React integration handoff.

React draft PR #14 now includes explicit-time routing, a passing real managed idle-case ESCALATE receipt, and a passing full-state quiescence comparison across later managed-worker cycles. The narrowed T49.01, T49.03 and T49.07 proof is pinned to React head 4919a71901cf66c70dcf9c442138c9c03b7e4be4 and pinned-producer CI #39388762423. This does not establish human-change/cross-key races, recurrence, bounded catch-up, restore, diagnostics or workload acceptance. Keep #11 open. Parent #8, throughput dependency pg-trickle #1168, signed numeric operating envelope and full #12 release qualification remain open. The original "Owner decisions and inputs" bullets below are retained as acceptance expectations but the first two are now verified prerequisites, not missing inputs.
Runtime dependency: trickle-labs/pg-trickle#1168. Related dependency candidate: trickle-labs/pg-trickle#1166.

Outcome

Complete the managed deadline-to-escalation feature using the existing React temporal path, ordinary managed worker and transactional MDM adapter. An idle overdue case may receive at most one permitted next level per evaluation and each configured level at most once per MDM occurrence, including across distinct request keys.

The v0.48 adapter already provides typed ESCALATE request construction, submission and delivery inspection. Reuse that machinery and extend the missing scheduling, semantic uniqueness and diagnostic behavior. The candidate in trickle-labs/pg-trickle#1166 fixes dependency behavior; it does not implement or qualify this feature.

Owner decisions and inputs

  • Confirm the evaluation unit, authoritative database-time sample, UTC elapsed-time boundary rule (proposed: equality counts as due), next-level schedule, maximum level and bounded catch-up semantics.
  • Obtain exact MDM-owned decision/receipt fixtures, including the still-pending non-next-level, disabled-binding and malformed-level cases. MDM retains eligibility, protection, recurrence and acceptance authority.
  • Agree where durable per-occurrence applied-level history lives: MDM or approved minimal adapter bookkeeping committed atomically with delivery. Same-key request deduplication and the current level alone do not prove cross-key uniqueness, especially after a human lowers the level.

Implementation

  • Wire the supported temporal registration and managed sampling path to overdue escalation. Use one sample per evaluation unit; sampled time must not salt request keys or reset deadlines. Emit at most one condition row per case_key, with level in the payload.
  • Advance only one next permitted level after observing committed MDM state. Bound per-cycle admissions and backlog catch-up; downtime must not manufacture one action per missed poll.
  • Retain canonical immutable request bytes across retries, atomic control/receipt/completion and bounded fresh reevaluation after stale work. Preserve attempted requests and existing outcome classification.
  • Preserve original deadlines through delivery and feedback. Exclude observation-only updates from action-driving revisions and converge to no-op once the intended permitted state is reached.
  • Block incompatible queued escalation after human changes, binding replacement, disabled bindings and the acknowledged pause barrier. Preserve genuine MDM recurrence while preventing repeat levels in the old occurrence.
  • Extend existing public inspection/explanation outputs with original deadline, configuration, sampled evaluation time, requested/applied levels, protection/no-op reasons, pending work, receipt and stale/rejected outcome. Keep delivered control distinct from case closure and business resolution.
  • Extend adjacent migration and recovery integration for any new temporal configuration or level bookkeeping; preserve existing request codecs and explicit activation behavior.

Focused qualification status (2026-10-20)

MDM row-lock concurrency gate passed: React a673e06 observed two simultaneous authenticated fresh-key MDM requests blocked on one case-row lock; each returned the expected terminal denial and retained the full original case/React/source state. Pinned CI #39421541299 passed. This establishes the MDM locked case-authority order, not concurrent React claimed episodes, human-versus-claim ordering, or release acceptance. MDM authority part passed: human-reduction-crosskey.sql succeeded in pinned-producer CI #39406316972 (two fresh-key denials after human reduction, original applied receipt retained, identical-key replay). React runtime follow-up still pending: 2404ae34 resumes valid managed worker post-human change and asserts durable-state convergence across cycles, CI #39415248547. The current fixture also checks replay of the original applied receipt after the human reduction on bae5b29e, new-head pinned CI #39415705167 pending; do not conflate it with the earlier green denial fixture. This is not yet cross-key/human-race/full #11 completion.

  • Explicit per-cycle admission and backlog/outage catch-up, restart/restore and clone activation safety, complete diagnostics, signed profile and workload resource measurements.
  • Post-delivery PostgreSQL restart/no-replay regression was added on React PR Qualify pinned producer and direct MDM idle delivery for #11 #14 commit 5c545d8f19240e5a1862a68e8cd972b2c98e7f9e, asserting a new postmaster and repeated resumed managed-worker heartbeats plus exact unchanged case/receipt/intent/work/source vectors. New-head pinned-producer CI is pending; do not mark this passing until it completes.

Producer #1197: The sole project owner authorized the merge of pg-trickle #1197; source was merged as 04391eca2d53e548eafc84e82256df91eec01ea5 after PR-head CI #39387305034 passed. Approval is explicitly recorded as sole-maintainer authorization, not an independent second-person review. No corrected source archive has yet been qualified and adopted by MDM; MDM #5 artifact handoff records the checksum/rebuild requirements. React's passing CI still uses the preexisting pinned producer with an equivalent explicit ON join, and did not adopt the newly merged source. Upstream #1168 throughput and React #12 remain separate release gates.

Human-edit freshness gate — next CI (2026-10-20)

React draft PR #14 commit f81ce2d introduces the pinned joint-stack human-stale-after-concurrency.sql regression. It compares two distinct outcomes after an authorized human revision change: old worker tokens → STALE_CASE / FRESHNESS_TOKEN_MISMATCH; current tokens requesting a level previously automated in this occurrence → ACTION_DENIED / ESCALATION_LEVEL_ALREADY_APPLIED. Same-key stale receipt replay, full case snapshots, exactly one historical application and unchanged immutable React/source data are asserted. Pinned-producer CI #39428111533 is running; this test has not yet passed. It does not cover human-after-worker races, concurrent React claims, clone/restore, or workload/backlog acceptance.

Freshness gate qualified; recurrence candidate pending (2026-10-20)

The human-before-worker freshness gate is qualified on React f81ce2d by pinned-producer CI #39428111533: old worker tokens return STALE_CASE / FRESHNESS_TOKEN_MISMATCH, while current tokens for the retained automated level return ACTION_DENIED / ESCALATION_LEVEL_ALREADY_APPLIED. The case state, complete canonical requests/receipts, original-key replay and React/source unchanged vectors were asserted. This is not inverse ordering or a worker claim-race proof.

The next focused React PR #14 candidate at c837f8f adds a genuine MDM occurrence 1→2 fixture using the MDM E2E's retained issue identity. It requires independent new-case escalation eligibility and exactly one authenticated applied-level-2 receipt with full canonical bytes and same-key replay, while the old resolved case/receipts and React/source work remain unchanged. The new test is pending CI and does not prove autonomous React recurrence discovery. Human-versus-worker concurrent orderings, claimed-episode races, clone/restore/catch-up and numeric release gates remain separate.

Recurrence gate: fixture dependency corrected, qualification pending

Pinned CI #39442250486 and #39442533637 stopped at recurrence setup because public.e2e_policy_vars is intentionally dropped by MDM's packaged e2e_policy.sql; it is not part of the cloned runtime's public interface. The previously qualified managed-idle, human-level, concurrency and stale-token probes passed before this fixture error. No recurrence acceptance claim is made for those runs.

React commit d413f72 removes the discarded fixture-table dependency and instead selects the exact same-issue resolved occurrence 1 and open occurrence 2 directly from retained public MDM cases. It requires a unique authoritative eligible pair, fails closed with the public case vector on mismatch, and keeps exact control/receipt/replay and original occurrence preservation assertions. Pushed-head pinned CI #39451120393 passed, including recurrence-independent; push core CI #39451109531 also passed. The real two-occurrence independent MDM escalation gate is now qualified on this exact prior producer; autonomous React recurrence detection remains unqualified. React worker autonomy, case occurrence after prior automated application and other #11/#12 gates remain open.

Recurrence qualification update

Passed: React d413f72 selected the actual MDM same-issue occurrence 1 (resolved) / occurrence 2 (open) from retained public case rows, applied the new occurrence's permitted level 2 through the authenticated MDM worker API once, returned an identical receipt on replay, and preserved prior-case and React/source vectors. Pinned CI #39451120393 log explicitly records PASS: recurrence-independent. No React worker discovery, multi-case backlog or final release approval is implied.

New upstream producer blocker: pg-trickle #1198 tracks its post-merge Delta V1 chained-inner-USING regression. Draft PR #1199 proposes a guarded fix but is not yet qualified. This does not change React's already-passing original 0.108.3 producer profile; MDM artifact adoption, #1168 and React #12 remain blocked separately.

Post-recurrence worker probe (2026-10-20)

The corrected public MDM recurrence test passed on React d413f72 and pinned CI #39451120393. Next commit d8b7fb6 adds post-recurrence managed worker heartbeat/quiescence assertions over full public/durable case, receipt, intent, work and source vectors, on pinned CI #39454625856, currently pending. This is not an autonomous React recurrence-discovery or bounded backlog qualification.

Recurrence recovery checkpoint — 2026-10-20

React PR #14 head d8b7fb6 now has passing pinned producer #39454625856, core and adapter CI. The genuine MDM occurrence 1/2 fixture applies level 2 independently on the reopened occurrence and checks exact durable receipt/replay, old-case/receipt retention, and post-recurrence managed-worker quiescence. The rule remains scoped to its original selected case; autonomous recurrence enrollment is not yet covered.

New React head 396bdbab tests cold PostgreSQL restart after the recurrence: witness a new postmaster and multiple worker cycles, compare the entire durable state, both occurrence identities, and exactly one new occurrence's applied level-2 receipt. Pinned-producer CI #39465133572 is pending. This is not outage catch-up across a newly missed deadline, clone/restore isolation, or final v0.49 release acceptance.

Recurrence maximum-level candidate (2026-10-20)

React PR #14 prior head 396bdbab passed pinned-producer CI #39465133572 including post-recurrence PostgreSQL restart/no-replay. Latest head 85ec4ddb adds a test of the binding's exact max level 2 after true MDM occurrence 2 received level 2: an authenticated level-3 request must return LIMIT_EXCEEDED / ESCALATION_LIMIT, leave the complete case/adapter/source population unchanged, preserve prior receipt history, and replay the exact denial on a same-key retry. Pending new-head CI; not a completed acceptance gate. React's per-cycle admission cap, multiple concurrent claimed episodes, missed-deadline catch-up and final numeric release limits remain unqualified.

Bounded authority-level convergence checkpoint — 2026-10-20

On prior React head 85ec4ddb, pinned-producer #39484595864, core #39484596006, and adapter CI passed the genuine recurring occurrence's maximum-level LIMIT_EXCEEDED / ESCALATION_LIMIT denial plus exact receipt replay. New candidate 454c205 additionally observes later real worker heartbeats and compares all durable MDM/React/source state to prove no delayed effect after that denial. Pinned-producer CI #39495741221 queued; not yet qualified. This is not React per-cycle admission bounding, autonomous second-case discovery or outage catch-up.

Maximum-level restart recovery — candidate (2026-10-20)

React PR #14 head 454c205 has green pinned-producer CI #39495741221 and core/adapter CI for observation-only convergence after terminal level-3 denial. New head cbe4882 additionally tests a new PostgreSQL postmaster and resumed managed worker after the denied maximum: full durable MDM/React/source vectors must remain unchanged and both the prior level-2 control and limit-denial receipts must remain unique. Pinned CI #39502053389 is pending, not yet qualified. Outage across previously undelivered deadlines, React claim races, clone/restore, autonomous recurrence enrollment and signed operating limits remain open.

Authorized pause-barrier candidate — 2026-10-21

The latest React PR #14 at 8aa8bf8 adds a separate operator pause barrier after the earlier green cold-restart/max-limit tests. MDM's entity-role authority pauses the active binding through pgreact_mdm.pause_intent_binding with an exact expected runtime version. The fixture checks the adapter runtime is removed and MDM runtime is paused; a new worker escalation must produce an immutable BINDING_PAUSED terminal receipt with exact same-key replay and unchanged cases/React/source state. Pinned-producer CI #39548527426 pending; no pass claim. It is not a test of pending React work withdrawal, clone activation or full outage catch-up.

Paused binding across postmaster restart — 2026-10-21

Earlier React PR #14 head 8aa8bf8 passed pinned CI #39548527426 and relevant core/adapter CI: authorized operator pause, immutable fresh-key BINDING_PAUSED receipt and same-key replay. Latest React head 6ab404e now requires the binding's paused MDM and React runtime state to survive a new PostgreSQL postmaster, subsequent healthy managed-worker cycles and byte-for-byte matching cases/receipts/immutable adapter+work/source snapshots. Pinned producer #39561580441 is running; new assertion not qualified yet. This remains separate from worker-claim races, overdue catch-up, restore/clone and numeric release acceptance.

Authorized pause→restart→resume candidate — 2026-10-21

The paused-binding durability gate passed on prior React head 6ab404e: pinned-producer CI #39561580441, core #39561580447, and adapter CI were green. New draft PR #14 head a043de1 tests an authorized resume after that restart: exact expected paused-runtime version, active MDM/React runtime-state change, original BINDING_PAUSED receipt unchanged on same-key replay, a fresh key denied by the active maximum-level boundary as LIMIT_EXCEEDED / ESCALATION_LIMIT, and unchanged complete case/React/source state during later managed cycles. Pinned-producer CI #39565839468 is queued; not qualified. No autonomous new-occurrence scheduling, pending claimed-work withdrawal, downtime catch-up, restore/clone or release sign-off is inferred.

Stale operator-runtime-version fence — 2026-10-21

The authorized pause→restart→resume proof passed on PR #14 head a043de1: pinned producer #39565839468, core, adapter and push CI were green. New React head 34c06f7 invokes the real MDM execution login after resume and submits two stale-version operator operations (pause and reconcile using the previous paused runtime version). Both must fail on the binding-version fence without changing binding/runtime state, MDM case/receipt history, immutable React intent/work/attempts or sources. The test stores precise SQLSTATE/error evidence. Pinned-producer CI #39572339881 is queued, so this new check is unqualified. This is not autonomous recurrence admission, live React claimed-work cancellation, pending-deadline catch-up, clone/restore or release acceptance.

Completion criteria

  • Owner decisions and exact MDM negative receipt fixtures are recorded and qualified on the pinned MDM PR test(v0.49): retain two-case backlog progress and drain latency evidence #19 source. No joint-stack or release approval is implied; remaining numeric and runtime gates are still blockers.
  • Real managed-worker idle-case delivery is demonstrated for one selected MDM occurrence, without source edits or manual refresh/time calls, with deterministic before/equal/after/timezone fixtures. React a901acc, pinned-producer CI #39383404414. This is the single-case entry/liveness gate only, not the recurring/admission/recovery or final joint artifact gates.
  • Exact case/request/receipt/state vectors cover repeated polls, distinct request keys, human edits, lifecycle revisions, replacement, genuine recurrence and both relevant concurrency orders. No repeated or unauthorized controls occur.
  • Bounded next-level/catch-up behavior, deadline preservation, feedback convergence and stale/pause/human-change behavior have focused regression coverage.
  • Complete public diagnostic output fixtures cover delivered, pending, protected, stale and rejected cases with existing privilege boundaries intact.
  • Formatting, lint and relevant code/SQL checks pass. Evidence identifies the tested source and exact joint artifacts; full release qualification remains tracked separately under the parent.

Boundaries

The parent specification and referenced release gates remain authoritative: https://github.com/trickle-labs/pg-react/blob/843256fb465de69f172fb61e66c5f76d981f0670/plans/v0.49.0.md (sections 3, 5 and 7).

Reuse existing mechanisms. No new scheduler, generic temporal DSL, business calendars, network alerts or human approval routing. Missing generic temporal capability requires re-estimation. Preserve the 30-person-day parent budget or obtain an explicit revised estimate/split. This issue uses ordinary engineering workflows; it does not invoke Promise-to-Proof workflows or alter historical evidence. Creating this tracker does not approve unresolved policy semantics or enable production escalation.

2026-10-29 evidence update

A focused local recovery-ACL audit on React revision 90c7e17bb060a85166b6830394d1f0f0a7c7089a (image sha256:d477b562b3711c76198b3f03eaa0763f9a578f1519cb294914c3a7cd5b821686, producer pg-trickle 0.108.3 at c7e257e551d6f6bacb84ecfe6f5daf7637c53673) passed restricted React recovery with two rules rebuilt, zero blocked rules and the worker lacking EXECUTE. Producer capture recovery remains blocked with PGT_EXT_GRAPH_INVALID because stored relation OID 41149 no longer exists; the failed recovery left state unchanged. This remains candidate evidence (release_qualified=false) and does not exercise current PR #1232 head. Current-head source review of PR #1232 at 822dd6227f1e7de6e35bea13993163ab738a4f16 confirms recover_capture_instance() still routes through adopt_database_instance(), which reads stored pgt_relid values and passes them to StreamTableMeta::get_by_relid(); the current PR head therefore does not fix the local stale-OID recovery blocker.

The following upstream results are historical, not evidence for the current head. On head 2b9f4fb30847f0a4cbed1ca5e5ea1e4276fb9e18, CI #40789839749 failed test_pause_scheduler_drains_inline_refresh_until_commit; its exact oracle reported inline_pause_control_1 missing (id=2, value=20). On head 822dd6227f1e7de6e35bea13993163ab738a4f16, S1 #40836093714 measured 44.6131296619 cases/minute against a 23.8066196538 corrected control with all 300 admissions/vectors and zero future receipts; due p95/max were 120.882/126.348 seconds. Its workflow qualified a 4-CPU ARM64 profile. CI #40836093812 failed the restore lifecycle oracle (REINITIALIZE, expected DIFFERENTIAL) and test_multi_cycle_stddev_algebraic.

PR #1232 merged into main on 2026-10-29 at 11:01 UTC as merge commit 75f2d1f590ea2aa029b18b8ee91332f719b14057, from head 44d4b33fba3e9ededec24718c02b7b43e0961d9a. Final checks show 28 passed, zero failed, and 18 skipped. Exact-head S1 run #40853118615 completed with PASS_OWNER_APPROVED_FLOOR: 44.883911 cases/minute against a 23.687264/minute corrected control; 300 admissions, 1,200 source rows, 300 case vectors and zero future receipts; due p95/max 87.614/93.084 seconds; conservative storage 3,297,604,592 bytes; peak memory 1,834,786,816 bytes. The raw candidate harness exit 1 against the 60/minute target is retained; the sole candidate observation failure is the 60/minute churn rate. The corrected control completed as BASELINE_COMPLETE.

The run used a 4-CPU ARM64 profile with a 4-CPU minimum, below #12's required 10 CPUs or an approved equivalent. The merged diff from 28321dbceb67d5a4f894792230b5f45651c9302e changes only tests/e2e_wal_receipt_recovery_tests.rs; the recovery/adoption source is unchanged. The stored-OID logical recovery gap and managed-escalation pause, concurrency and completion criteria remain open.

Focused replacement-first candidate evidence — 2026-10-29

The local ARM64 claimed-work retry22 manifest records all 16 focused checks passing on React revision 90c7e17bb060a85166b6830394d1f0f0a7c7089a, MDM source ad2597f72ee657cb946c5bbd7ae5eb2bfd1ac1b3, and pg-trickle 0.108.3 source c7e257e551d6f6bacb84ecfe6f5daf7637c53673. For replacement-first ordering, it holds the replacement transaction open, confirms the old delivery remains blocked, then checks the exact BINDING_REPLACED request/receipt/inspection vector and unchanged control state. The test-source SHA-256 is 830c12199ce6f9e9e518f36f433e10b421309aecf1e4cda24dd790e0ee627671.

This is focused local candidate evidence only: release_qualified=false. It does not qualify the exact packaged release or PR-head artifacts and does not simulate packet-level network failure; the remaining issue #11 completion criteria stay open.

2026-10-29 output-delta restore follow-up

Follow-up pg-trickle PR #1288, at head 030466d8c996e04536f144f356edbb067d618eac, addresses the stored output-delta relation OIDs during logical restore. It re-resolves stream and payload relations by stable names, invalidates existing consumers with DATABASE_INSTANCE_CHANGED, and restores the contract guard's original trigger mode after rebinding.

The targeted logical-restore E2E passed after a clean image rebuild (1 passed, 3 skipped), and just lint passed. As of 2026-10-29, PR #1288 remains open at the recorded head with 25 checks passed, 0 failed and 18 skipped; its merge state is clean, and GitHub reports no review decision. This candidate evidence addresses the specific stale-OID recovery gap above, but does not complete issue #11 or qualify a release. Managed-escalation and parent release criteria remain open.

2026-10-29 source review: temporal-key pass limit

The current source declares max_temporal_keys_per_pass (default 100,000), but checks it only in reconcile_temporal_frontier() against already-persisted temporal_state rows. author_temporal_rule() calls pgreact.create_rule(... bootstrap_policy => 'SEED_CURRENT') before temporal reconciliation; that path inserts one generic activation row for every match key, then the temporal reconciler unions current match, stored-state and recovery-view keys and loops without checking the cap. The public reconcile_temporal_rule() and resume_temporal_rule() APIs also call that uncapped reconciler directly. With the cap set to 1 and a valid two-key condition, authoring can do both unbounded scans, persist two temporal state rows, and return; the next managed run then raises M23_TEMPORAL_LIMIT at the frontier check. This is a source-level suspected bound bypass, not a reproduced runtime failure. The only test file found for this M23 API, tests/m23.sql, seeds one key and is run by tests/m23.sh against pg-react:v0.20.0 (PG_REACT_INIT_VERSION=0.20.0), so it does not qualify the current 0.46.1 SQL. No current regression assertion for this cap was found.

The fix needs to reject or bound oversized authoring before pgreact.create_rule() bootstraps the generic activation state, and keep direct reconcile/resume passes within the configured limit. Test the two-key/cap-one case and verify that a following managed run remains healthy. Also cover adding keys to a temporal rule when existing temporal state already consumes the global limit.

Activity

  1. grove commented on Oct 19, 2026

    @grove
    grove
    on Oct 19, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    Requester ratification — v0.49 escalation addendum (2026-10-19)

    The requesting owner has explicitly replied "I ratify it!" to the request to ratify the merged React–MDM escalation contract. This records ratification of the identical addenda merged via pg-react PR #13 and pg-mdm PR #18:

    • contracts/MDM-STEWARDSHIP-1-escalation-v049.md in pg-react and pg-mdm.
    • MDM owns the durable once-per-(case_key, level) applied-control decision and existing typed request/receipt interface.
    • One authoritative per-case evaluation-time sample, UTC elapsed time with equality counting as due; one next permitted level per evaluation; bounded catch-up without replaying missed polls; deadline preservation; same-key replay and cross-key safety.
    • An approved next-level attempt previously applied in that occurrence remains denied after a human lowers the visible level. Genuine MDM recurrence has a new case key.

    Scope of ratification: the existing engineering addendum and its stated behavior. This is not a claim that the numerical operating envelope, exact remaining receipt fixtures, pg-trickle throughput gate, end-to-end runtime implementation, independent release qualification, or production activation has been approved or passed. Track those separately under pg-react #11, #12, and pg-trickle #1168.

    Source of approval: the requester's explicit statement in the project follow-up conversation on 2026-10-19.

  2. grove commented on Oct 19, 2026

    @grove
    grove
    on Oct 19, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    MDM negative receipt fixtures for v0.49 are now proposed in draft pg-mdm PR #19, head 05c906b357bd5d3a889318b00ce0bd33cf856d71.

    • Source: tests/e2e_policy.sql and contracts/MDM-STEWARDSHIP-1-v049-receipt-fixtures.md.
    • Expected: next-level violation STALE_CASE/ESCALATION_NOT_NEXT; paused binding BINDING_PAUSED; replaced binding BINDING_REPLACED; malformed level raises MDM_POLICY_INTENT with no receipt. SQL asserts full-case equality, complete canonical request bodies, complete controls, role/binding context, and same-key replay.
    • GitHub CI: PR run 39276265129 currently in progress. No qualification is claimed yet. Do not treat the draft or its commit as a passed dependency gate until final test and packaged e2e jobs pass, and independent review/owner approval requirements are satisfied.

    This is the MDM fixture dependency for React PR #14 and #11; React managed delivery and #12 release qualification remain separate work.

  3. grove commented on Oct 19, 2026

    @grove
    grove
    on Oct 19, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    MDM fixture gate now satisfied — exact qualified source (2026-10-19)

    The owner-ratified negative MDM ESCALATE fixture follow-up pg-mdm PR #19 is merged. This supersedes the earlier comment on #11 describing draft/unqualified fixtures.

    Qualified negative semantics at the public MDM boundary: non-next level → STALE_CASE / ESCALATION_NOT_NEXT durable receipt; paused binding → BINDING_PAUSED durable receipt; replaced binding → BINDING_REPLACED durable receipt; malformed level → MDM_POLICY_INTENT exception without any receipt. Tests assert canonical request bodies, exact case/control/receipt snapshots and same-key replay. The previously merged PR #18 independently proves once-per-(case_key,level) cross-key dedup after human lowering.

    Implementation handoff: The MDM negative-fixture gate is no longer blocking dependent integration. Proceed with real managed-worker idle-time delivery and tests under #11: map installed public temporal registration/cadence, prove a future due time becomes eligible with no source mutation, use one DB time sample per case evaluation, one next level per evaluation, bounded admissions/catch-up, keep existing immutable request keys and transactional MDM intent/receipt delivery, and expose public diagnostics. Reuse React PR #14 for explicit-time evaluation. Keep React #11 open and release activation disabled pending runtime/recovery qualification, React #12, signed workload bounds, and pg-trickle #1168 ≥60 admissions/min throughput.

    Important: This does not retroactively qualify frozen v0.48 source hashes or replace the v0.49 exact final joint-artifact run. Do not edit signed historical evidence to make a legacy release check pass.

  4. grove commented on Oct 21, 2026

    @grove
    grove
    on Oct 21, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    2026-10-21 v0.49 implementation continuation — exact remaining gates

    Dependency repair: MDM #21 merged as 5fdee89 with reviewed fix 6ad23ca. React #15 merged into the unmerged #14 feature branch as 7a95232; original pinned-MDM and repaired-preview CI #39628593830 / #39628593800 passed, with remaining adapter/core qualification tracked separately. The old source failure stays in the historical evidence.

    New focused runtime work (not yet accepted): draft React #16 at c9c5403 adds a real PostgreSQL-stop-before-due → deadline passes while down → restart managed worker → exact one level-2 applied MDM receipt and full durable state → later quiescence and second cold-restart/no-replay test. The original full audit remains alongside this second focused run; pinned CI #39630983337 is pending. One-case outage correctness alone does not close T49.06/T49.12; multi-case per-cycle cap, bounded backlog/catch-up, recovery budget, restore/clone safety, diagnostics and signed numeric envelope remain.

    Independent throughput blocker: pg-trickle #1168 remains open. PR #1191 has archived ARM64 >60/min evidence on an older image, but current head 8e37412 is not qualified: PR correctness CI failed because test_refresh_picks_up_inserts saw 2 vs 4 rows, with ASan cancelled; latest five-case diagnostics are not a 300-admission proof. Never transfer performance results to changed source/artifact.

    Keep #11, #12 and parent #8 open, and do not activate production escalation or merge #14 into main before the agreed gates.

  5. grove commented on Oct 21, 2026

    @grove
    grove
    on Oct 21, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    2026-10-21 progression — real outage merged; three-case sampled frontier candidate

    Merged proof: React PR #16 merged into the unmerged #14 feature branch as b8902a1. Exact PR-head pinned producer CI #39637540053, MDM repaired preview #39637540088, core and adapter CI all passed. The full ordinary integration audit remained intact. Added separate --outage proof: PostgreSQL stopped before future due time, restarted after it became overdue, ordinary managed worker delivered one exact MDM level-2 applied receipt; complete state and subsequent cycles/new postmaster showed no replay. Feature-merge-head CI #39650060106 is still being qualified independently.

    New dependent draft React PR #17 at 03a9ea4: three distinct MDM fixture case identities whose due times are one second before, exactly at, and one second after one explicit sampled UTC time. Uses literal exact full-row independent oracles across pre/equal/after samples and compares complete unchanged source populations. This is deterministic multi-case evaluation, not real multi-case managed admission, an outage backlog, progress/fairness, resource measurements or T49.06/T49.12 completion. Current-head CI is queued; keep draft until exact validation.

    Still open: per-cycle admission budget under concurrent overdue episodes, multi-case outage/backlog progress, restore/clone activation boundaries, public diagnostics, signed numeric envelope, React #12 and pg-trickle #1168 (where current upstream PR #1191 still has an unqualified source/CI and throughput profile). #8/#11/#12 remain open, and no production activation, tag, or main merge is authorized by these slices.

  6. grove commented on Oct 21, 2026

    @grove
    grove
    on Oct 21, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    2026-10-21 — deterministic three-case routing merged (focused milestone)

    React PR #17 merged into React draft PR #14's feature branch as 2ee3f6e. Exact pre-merge head b9285a5 passed pinned producer #39653229584, MDM preview #39653229550, core/adapter and other CI.

    The three-case explicit UTC time-frontier test asserts independently authored complete canonical output/explanation JSONB for three distinct cases (already due, equality due, not yet due), no duplicate case rows, immutable case-source population and samples around the boundary. The initially red producer gate exposed a JSONB operator-precedence bug in the test itself, fixed at b9285a5 (parenthesized JSONB key removal without changed expected vectors). Post-merge 2ee3f6e CI is queued and is not yet called green.

    Remaining implementation/release gates are real multi-case managed admissions and bounded fair backlog/catch-up, simultaneous due cases, retries around crash/commit, coherent restore/clone startup, public diagnostics and signed numeric resource/time envelope. Upstream pg-trickle #1168/#1191 still lacks qualified current-source throughput. This deterministic fixture is not T49.06/T49.12 completion; #11/#12 and parent #8 remain open.

  7. grove commented on Oct 21, 2026

    @grove
    grove
    on Oct 21, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    2026-10-21 — exact-head CI verified; two-case overdue runtime candidate in progress

    React draft PR #14 remains at 2ee3f6e703709ca3370493c652ef016e286aa314. All its latest normal workflows passed, including pinned-producer #39657333569, MDM repaired preview #39657333761, adapter #39657334090 and core/push CI. These validate dependency adoption, single-case overdue-after-outage/no-replay and deterministic three-case explicit-time routing together.

    New dependent draft PR #18, current head 8bb57b223c4ae99a54a8586a852a492b6a4a1b92, adds a separate real two-case overdue-while-down managed-worker run against exact pinned MDM, a configured pg_react.batch_size=1, complete MDM case/receipt/request/attempt/work/source comparisons, post-drain idle cycles and a second restart/no-replay. Pinned joint-stack CI #39664877710 remains in progress; the original full audit succeeded on this head, while the single-case and added two-case steps have not both completed yet. Core, adapter, repaired-MDM preview and independent CI on this head have passed. No real two-case acceptance claim before its pinned gate succeeds.

    This focused experiment is not a measured per-cycle cap, 300-case S1 backlog/drain/throughput qualification, mixed fairness, coherent restore/clone isolation, signed resource envelope or final T49.06/T49.12. Keep #11, #12 and #8 open; do not merge #14 to main or activate production.

  8. grove commented on Oct 21, 2026

    @grove
    grove
    on Oct 21, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    2026-10-21 — two-case real managed downtime drain merged

    React #18 merged into the unmerged React #14 feature branch as 1d44dfd. All exact source-head CI was green at 8bb57b2: pinned full+single-case+two-case outage #39664877710, repaired MDM preview #39664877641, core/adapter and CI. The new test prepares two genuine MDM cases with authorized controls, configured worker batch_size=1, stops the postmaster across both due times, requires two unique applied MDM next-level receipts and complete durable-source/case/work/request/attempt vectors, then checks post-drain managed quiescence and another restart/no-replay. Post-merge CI #39669372341 is pending.

    Remaining: this focused correct two-case drain does not prove a numeric per-cycle admission bound, mixed backlog fairness, a signed throughput/recovery envelope, coherent restore/clone guards, or #1168's 300-case 60/min and paired control. Keep React #11/#12/#8 open, PR #14 draft, no production activation or release.

  9. grove commented on Oct 21, 2026

    @grove
    grove
    on Oct 21, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    2026-10-21 — backlog timeline integrated on feature branch

    React PR #19 merged into the unmerged PR #14 feature branch, not main, as d70a73d. All final PR-head workflows passed on feb85b2d509ada846127999490cd28c356302e62: pinned producer #39677913209, MDM preview #39677913220, and core/adapter #39677913391. The earlier failed attempt remains historical evidence.

    The two-case real outage test now retains sampled completion timestamps, per-case receipt sets, managed status, and an observed drain interval, asserting no duplicates, disappearing receipts, unrelated cases or incomplete recovery. It does not establish a hard per-cycle admission limit, mixed-backlog fairness, the signed 300-case throughput/recovery envelope or 60-cases/minute S1 qualification. Coherent restore/clone, operator sign-off and T49.06/T49.12 release gates remain open.

    Post-merge head d70a73d has newly queued pinned producer #39681815208 and preview #39681815435, which must complete before exact merged-head qualification. Keep PR #14 draft, issues #8/#11/#12 open, and production inactive.

  10. grove commented on Oct 21, 2026

    @grove
    grove
    on Oct 21, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    2026-10-21 — numeric claim admission work and release-boundary clarification

    The exact merged React #14 feature head d70a73d8d37494db9a5d4910e1ef02931aff8d01 is still running current-head GitHub CI. The previous merged head 1d44dfd passed all normal gates, including real two-case outage and no-replay.

    New dependent draft React #20 at 7cff86e adds an executable numeric public claim per-invocation regression: two eligible pending episodes, pgreact.claim(max_items=1) leases exactly one and retains the second, then a later claim leases a distinct episode and both execute exactly once with durable action vectors. Current-head CI is pending.

    Important contract distinction discovered from the actual installed runtime: pg_react.batch_size=1 bounds maintenance work, not necessarily a managed-worker per-cycle claim. The generic claim limit is separately governed by max_items and the operational max_claims setting; don't label the two-case outage test as proof of a one-admission-per-cycle global limit. A dedicated managed-cycle instrumentation/qualification remains necessary. Mixed-backlog fairness under churn, coherent restore/clone preactivation, the signed numeric operating profile and upstream pg-trickle 300-case 60/min throughput also remain blockers. This PR is not release approval or production activation; keep #11/#12/#8 open and #14 draft.

  11. grove commented on Oct 22, 2026

    @grove
    grove
    on Oct 22, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    v0.49 remaining-gate progress — 2026-10-22

    • React PR #20 merged only into Qualify pinned producer and direct MDM idle delivery for #11 #14 feature branch at 6a55008. Its public pgreact.claim(max_items=1) regression shows that one call leases just one of two independently pending episodes and preserves the second for a later claim. This is a numeric public claim invocation bound, not yet a real managed-cycle cap qualification. The new feature-branch head still has its own fresh CI in progress.
    • The actual installed pgreact_internal.managed_cycle(integer) SQL reads pg_react.batch_size and passes that as max_items to pgreact_api.claim, which applies the operational max_claims ceiling. Earlier GUC description claiming maintenance-only batching was inaccurate. New dependent draft React #21 at 24fbee3 checks deployed function bodies and hashes on the exact pinned stack and records bounded worker heartbeat/processed counter observations during the real two-case outage. CI pending, not yet merged or accepted. Note pg_react.batch_size also must be compatible with operational_settings.max_claims; oversized values require explicit config/behavior qualification.
    • For the independent pg-trickle #1168 throughput blocker, the current PR #1191 remains open with prior failing native E2E test_refresh_picks_up_inserts (observed 2 versus expected 4 rows); a diagnostic rerun of its exact-head failed E2E job was triggered on 2026-10-22. A retry outcome will not substitute for reviewed root cause, matching artifact identity, exact 300-admission >=60/min run and complete paired control.

    User says they reviewed and approved PR #14, but this chat statement is not a submitted GitHub review or a signed quantitative release envelope. Do not conflate review approval with completion of v0.49 #11/#12. Keep PR #14 draft, no main merge, release or production activation until outstanding S1 throughput, mixed-backlog resource/fairness, clone/restore/recovery, concrete owner-signed numeric bounds, complete T49/C qualification and exact final-head CI are met.

  12. grove
    added 2 commits that reference this issue on Oct 25, 2026

    Qualify pinned producer and direct MDM idle delivery for #11 (#14)

    5559a5c

    test(v0.49): qualify bounded admission and recovery (#24)

    6ca2e02

  13. grove commented on Oct 26, 2026

    @grove
    grove
    on Oct 26, 2026
    ContributorAuthor

    Implemented a focused autonomous-enrollment repair in PR #26, commit 2e36f59453c33b5d52828c801dbaa4d8d68dde29, based on latest main 0a16c652.

    Already implemented: MDM occurrence identity and retained occurrence/level receipts, typed immutable delivery, deadline sampling and the ordinary managed worker. Genuinely missing: the worker never called the existing identity sync, so the deployer projection excluded new MDM occurrences indefinitely.

    The pre-repair integration regression delivered and resolved occurrence 1, then observed healthy worker cycles while the real MDM successor (case 3, occurrence 2) stayed unenrolled at level 1. The repair synchronizes authorized identities before existing managed refresh/time evaluation under the coordinator lock, requiring the local activated binding runtime and avoiding sequence churn for existing mappings. It adds no scheduler, receipt ledger, runtime grant or activation default.

    Fresh-database repaired runs passed, including complete canonical requests/receipts, cases, work/attempts, non-superuser public delivery/deadline diagnostics, unchanged historical receipts, later healthy cycles, stable identity sequence and cold restart. Pins and all approved profile/workload limits are unchanged. The new lane is required by pinned-producer CI; that PR's CI is still pending.

    Gap matrix and exact source/image/library identities, commands, full passing vectors and retained failures are committed.

    Keep #11 open. Both React-claim/human/pause/replacement transaction orders, uncertain commits and complete diagnostic/recovery coverage remain. Source inspection also leaves a specific MDM pause-barrier question: delivery locks the binding before waiting for the case, while persist_set_policy_binding_state updates runtime without that binding lock. This needs deterministic characterization and any necessary shared repair; the current recurrence test does not establish it. Remaining work is not established as qualification-only. No release, merge or production activation claim.

  14. grove commented on Oct 26, 2026

    @grove
    grove
    on Oct 26, 2026
    ContributorAuthor

    Two confirmed implementation defects are addressed by reviewable linked PRs:

    • MDM #22, 40e9cb7b9018627e2ecb17ca387017950d438c31: original MDM acknowledged an authorized pause while a real claimed React delivery waited on its case row, then applied ESCALATE after that acknowledgment. The shared repair serializes state transitions on the binding and takes delivery's binding lock before its separate fresh eligibility read. The independent SQL regression fails on the original binary and passes on the repair; frozen generated SQL remains byte-identical.
    • React #27, 1f9f39254e12bb07721e9e42918c9f993a93ef4d: an isolated current-main checkout with fixed MDM reproduced a retained BINDING_PAUSED hold blocking genuinely fresh work after authorized resumption. The repair keeps old request/receipt/attempt/hold bytes intact, permits only fresh work passing current eligibility, and distinguishes the old held pause from the new application in public inspection.

    The real native typed-callback regression passes seven named gates: delivery-first pause barrier, pause-first runtime freshness, committed pause before claim, human deadline/level edits in both claim orders, binding replacement lowering limits in both claim orders, fresh resumption and cross-key applied-level denial. Complete canonical request/receipt and case/source/work/attempt vectors, authorized reader diagnostics and healthy later managed cycles are asserted. Independent fresh-database repeats passed. The merged autonomous-recurrence/cold-restart lane still passes.

    MDM formatting, all-target clippy/Rust tests, cargo-pgrx test command, security/upgrade checks and frozen SQL comparison passed locally; React's 8 Rust tests, formatting/clippy, documentation/workflow audits and actionlint passed. The unchanged full local joint audit again stopped at upstream /tests/e2e.sql:3544, with a backend killed by signal 9. Its raw failure and both failing-before defects are retained in the React evidence manifest and MDM evidence.

    Native packaged CI remains pending. The new preview pins the exact MDM repair but does not adopt it as the release pin; the original pinned compatibility workflow, workload/profile limits and activation defaults are unchanged. Keep #11/#12/#8 open. Exact merged dependency adoption, broader uncertain-commit/overlapping replacement and privilege-revocation cases, logical/clean physical clone and same-OID activation guarantees, remaining diagnostics, paired workload/resource/recovery/retention qualification and independent review remain. No release, merge or production activation claim; remaining work is not established as qualification-only.

  15. 9 remaining items

  16. grove commented on Oct 27, 2026

    @grove
    grove
    on Oct 27, 2026
    ContributorAuthor

    React PR #29 now at c39d378b176f07046e8efe7cc06fd4faf0725011 retains the full diagnostic and prior failures. A local core-only compatibility run passed with pg_mdm.so removed. A local full joint run passed the human-edit, recurrence, pause, restart and physical-restore reconciliation/replay checks after the restored postmaster received its required preloads. Its test-source SHA, image and all observations are archived. The local producer was d8bb8eb5d45c5c9982e173e88914037433a1ee05, not the release pin, so this is diagnostic evidence only; exact-head pinned-stack CI remains required. Original-pin and earlier preview lanes remain separate and fail closed without the activation epoch. The MDM local incremental qualification deadlock and logical-restore defect remain open.

  17. grove commented on Oct 27, 2026

    @grove
    grove
    on Oct 27, 2026
    ContributorAuthor

    Candidate CI run 40523163879 on React PR head c39d378b176f07046e8efe7cc06fd4faf0725011 and MDM e8b1dff81f7375bc0c5a5d4eb1db311bce1c7043 passed both repetitions of physical clone, direct delivery, claimed-work and autonomous recurrence. The full audit exited 1 because it read the previous blocked worker status immediately after authorized reconciliation. PR #29 now waits for ready and a heartbeat, checks complete state, and retains the raw CI failure at head 83209c211393326f01eacc180781e1146bc728da. Current-head CI remains required; old MDM lanes without the epoch remain separately visible and unwaived. No release or throughput acceptance is claimed.

  18. grove commented on Oct 27, 2026

    @grove
    grove
    on Oct 27, 2026
    ContributorAuthor

    PR #29 now at e5bce01e2f0982832d5a8d264a7e2da5e5e28f30 retains a full local diagnostic pass on test revision 83209c211393326f01eacc180781e1146bc728da. It passed the revised readiness wait, pause/resume, recurrence and physical restore/reconciliation/replay. The raw observation and image identities are archived; its producer was d8bb8eb5d45c5c9982e173e88914037433a1ee05, not the release pin, and its decision remains QUALIFICATION_INCOMPLETE. Exact-current pinned CI is required. Historical older-MDM lanes remain separate and unwaived; logical restore and performance/release gates remain open.

  19. grove commented on Oct 27, 2026

    @grove
    grove
    on Oct 27, 2026
    ContributorAuthor

    React candidate CI 40542347021 passed on PR head e5bce01e2f0982832d5a8d264a7e2da5e5e28f30, tested merge eff60ff261e11bca49cedcee065aa3aca133afdc, MDM e8b1dff81f7375bc0c5a5d4eb1db311bce1c7043 and pg-trickle c7e257e551d6f6bacb84ecfe6f5daf7637c53673. The full audit exited 0 with 51 passed checks, and each physical-clone, direct-delivery, claimed-work and autonomous-recurrence test passed twice. Its decision explicitly remains QUALIFICATION_INCOMPLETE; the artifact retains archive/image/library hashes, commands, exits and observations.

    Four historical/compatibility workflows remain red because their MDM revisions lack the activation epoch; the original-pin lane and raw evidence remain separate and unwaived. PR #30 records unresolved logical-restore loss. Full joint qualification, paired performance, recovery, operating envelope and independent review remain open; no production or release acceptance is claimed.

  20. grove commented on Oct 27, 2026

    @grove
    grove
    on Oct 27, 2026
    ContributorAuthor

    At the requester’s explicit direction, React PR #29 now at 1f058b4984154e95dfa53ffe193ea62ed3033eb6 makes the four old-MDM historical test lanes nonblocking and labels them accordingly. Original source pins, commands and historical artifacts are retained; each test records its actual exit and outcome, and failures emit a warning. Build and evidence-collection failures remain blocking. This does not change the activation guard, waive an incompatibility or count historical results as release qualification.

    The earlier candidate CI passed its full audit and focused repetitions on PR head e5bce01e2f0982832d5a8d264a7e2da5e5e28f30; exact-current-head CI remains required. Logical restore, the approved paired workload and remaining release gates remain open. No production activation or merge is authorized.

  21. grove commented on Oct 27, 2026

    @grove
    grove
    on Oct 27, 2026
    ContributorAuthor

    The requester authorized merging the dependency and physical-clone repair. MDM #23 merged as ad2597f72ee657cb946c5bbd7ae5eb2bfd1ac1b3; React #29 merged as f19397a6a96ea563dd0b63ac556031a98aca47c7. The MDM merge and previously tested head e8b1dff81f7375bc0c5a5d4eb1db311bce1c7043 both report tree dbf14d8c362551eb6eb53379b2e029e58cc8f924. Tree identity is not merged-artifact qualification: the candidate workflow still pins the previous head and must be updated and rerun against the merge commit.

    The old-MDM historical test lanes are explicitly nonblocking by owner direction; their failures and raw evidence remain visible and do not qualify compatibility. Logical restore remains unrepaired in React #30. Paired workload, release artifact gates, recovery, operating envelope and independent review remain open. No production activation or release was performed.

  22. grove commented on Oct 27, 2026

    @grove
    grove
    on Oct 27, 2026
    ContributorAuthor

    React PR #30 now merges current main f19397a6a96ea563dd0b63ac556031a98aca47c7 and is conflict-free at head e31d9fee3165faa9c8bf839a980ebdafc248e704. A local diagnostic with a separately identified non-pinned producer passed the physical-clone test and reached the intended logical-restore state-loss assertion after successful dump and restore. Raw observations and the earlier setup failure are retained. GitHub CI and exact-artifact qualification remain open; logical restore is not repaired.

  23. grove commented on Oct 28, 2026

    @grove
    grove
    on Oct 28, 2026
    ContributorAuthor

    React #30 merged as 45a6ae77e7b8e555acf532240e14a1da5956a49e. Its real logical dump/restore regression fails on the separately identified local diagnostic stack: React extension config is empty and the complete React recovery state is lost, even while MDM history survives. The test stops at the state equality assertion; preactivation, authorized rebind and bounded resumption are therefore not proven for logical restore. This remains a correctness/implementation blocker, not qualification-only work. A direct config-dump registration alone is insufficient evidence of a repair: durable React records contain environment-local role and object OIDs and must be safely rebound and validated, alongside retained identities and history. The prior failure and exit remain recorded in #30.

    React #31, head 6eb4a2c09e5d0fff6846d9b41467de500d83a900, selects the actual merged MDM source ad2597f72ee657cb946c5bbd7ae5eb2bfd1ac1b3 for the focused candidate workflow. The merged MDM tree matches the earlier tested head, but its git archive digest differs: d5ef46335ac1e3a1c8255548f388e3b6949dbe8bfb7377fa8c790788754544aa. The pg-trickle source c7e257e551d6f6bacb84ecfe6f5daf7637c53673 and archive d6233d49cee80d33ac30626e0af7932a9698279233b8fceef3447275192abc27 remain unchanged. Candidate CI 40655163798 is queued; no current-source runtime or release qualification is claimed. Historical nonblocking lanes retain their original failures and do not establish compatibility.

    Remaining: safe logical restore implementation and complete before/after regression; exact-final-artifact fresh/upgrade, permissions, race, recovery and release-gate evidence; unchanged paired workload and signed operating envelope; public diagnostics, documentation and independent review. No throughput acceptance or production activation has been granted.

  24. grove commented on Oct 28, 2026

    @grove
    grove
    on Oct 28, 2026
    ContributorAuthor

    PR #31 candidate CI 40655163798 passed at PR head 6eb4a2c09e5d0fff6846d9b41467de500d83a900; the actual React checkout was synthetic merge 4dc89c3af891017b1e89df7c42bf5f1a4fa03f25 (archive SHA-256 31b012981093d5f59433cab7aef3a000a693a6af1eb129f60a1659087892db7f). It used merged MDM ad2597f72ee657cb946c5bbd7ae5eb2bfd1ac1b3 (archive d5ef46335ac1e3a1c8255548f388e3b6949dbe8bfb7377fa8c790788754544aa) and unchanged pg-trickle source c7e257e551d6f6bacb84ecfe6f5daf7637c53673 (archive d6233d49cee80d33ac30626e0af7932a9698279233b8fceef3447275192abc27).

    Producer image sha256:05577a553f4f25fcbfad3ea68df3c373069b8bd3af8d7b54db49e113aa84de75, joint image sha256:17b52a0e70e191ec43d4c9ba75e57431c35c18c00215bc8b8243b4c7f9cd78a9; packaged SHA-256s: MDM 98b55d51d05e11bbdc26b240165c93f1a6e5dc2908ff11c1a14f339cd75e7ebb, pg-trickle 3f83ffdc01756e81b04785d173c7e8307327fc6bf09e019f8cc521dcb234fa58, React 34a46bbf37c3dcc327d156ae24663af44ca89f8bec0d634dd65f357b7711a4f5. Both repeated physical clone, direct-delivery, claimed-work and recurrence modes and their validation commands exited 0. The full audit exited 0 with 51 recorded passing checks and explicitly reported QUALIFICATION_INCOMPLETE. The downloadable CI artifact includes configuration, commands, exits, full observations and build logs. Historical nonblocking lanes do not qualify their underlying failures.

    The logical-restore defect in merged #30 remains unrepaired; the logical mode was not run in this CI. This is a correctness blocker, not qualification-only work. A future merged React artifact and all remaining #11/#12 gates need their own evidence; green PR checks do not accept performance or authorize production.

  25. grove commented on Oct 28, 2026

    @grove
    grove
    on Oct 28, 2026
    ContributorAuthor

    Repeated real logical-restore regression on the selected sources: React 6eb4a2c09e5d0fff6846d9b41467de500d83a900 (archive SHA-256 2db2f22446b0cbb7972a81e9ddf39e1ee7465ea179a65f263faef6ffcf766225), merged MDM ad2597f72ee657cb946c5bbd7ae5eb2bfd1ac1b3 (archive d5ef46335ac1e3a1c8255548f388e3b6949dbe8bfb7377fa8c790788754544aa), unchanged pg-trickle c7e257e551d6f6bacb84ecfe6f5daf7637c53673 (archive d6233d49cee80d33ac30626e0af7932a9698279233b8fceef3447275192abc27). Both fresh-container executions of audit.py IMAGE OUTPUT --logical-restore exited 1 with logical restore did not preserve the complete recovery state. Each completed actual pg_dump/pg_restore, with empty React extension dump configuration: two source rules, rule versions, activations, lifecycle events, and work items restored as zero, and one React attempt restored as zero. Complete MDM case, receipt, adapter request and attempt vectors matched. The assertion stops before the preactivation and subsequent activation/resumption checks; those remain unproven for logical restore.

    This is a local ARM64 diagnostic, not the earlier x86 CI image: joint image sha256:cc8d28e763b7ad5687b2038e5c87c9ffa649e4413c40386afc84add5ff8370d1; libraries SHA-256 MDM 02d7cb4db49051c588b1cabb220b63fb8fd28260e5ed0041b6acf0b533a50573, pg-trickle 9113108b8fc2eb1f68373c194c74763d008df6d22deba4f45f9c90044bb6b327, React 80f43edcd4d14bac6ad6e910652094bf8cfbfb835ba8515f98967972926894b1. The stock React builder has no ARM64 manifest (build exit 1); the local build used a separately identified ARM64 builder. An earlier emulated producer build was stopped (exit 130); the native producer and alternative React builds exited 0. The raw logs, complete observations, diagnostic Dockerfile and identity/command/exit manifest are retained locally in /private/tmp/pgreact-pr31-logical-arm64-evidence.tar.gz (SHA-256 e26aff27cdab4bb7d08155d197140bbf4bd531b71a391feaa240c42f2b81e6a1); this temporary path is not a durable GitHub artifact.

    No repair is claimed. The existing pgreact.rebuild_transient_metadata() validates and rebuilds some object references but cannot recreate omitted state; portable identity and ownership revalidation must also be addressed before activation. All exact-final-artifact qualification, workload and operating-envelope gates remain open.

  26. grove commented on Oct 28, 2026

    @grove
    grove
    on Oct 28, 2026
    ContributorAuthor

    PR #31 merged at c07e9d650c60977372236745c95e08cb300a728e; its green preview tested a synthetic merge, not this merge artifact.

    Draft PR #32, test commit 39e56203b1c53a4913b1c6ad29c2a0be757a526a, strengthens the logical-restore regression without weakening its full-state assertion. On two fresh local ARM64 source-matched diagnostic runs, complete MDM/adapter history matched, the binding guard passed, and two restricted managed cycles each returned {state: blocked, reason: MDM activation required, pending_jobs: 0, processed_jobs: 0} without changing the observed restored state. Both runs exited 1 at the original complete React recovery-state comparison because the dump lost pending React work. These empty-agenda cycles do not prove safety with retained overdue work, automatic worker startup, or authorized recovery/resumption.

    Complete local logs and observations, including intermediate failures, are retained at /private/tmp/pgreact-logical-guard-evidence.tar.gz (SHA-256 14e89c474ea6f06d694f18e242e2307021ad8539f03e6bdb41be6e573ef30728). This temporary path is not a durable GitHub artifact. Python compile initially exited 1 due to the protected default cache; the temporary-cache retry and diff check passed. The diagnostic image and source identities are recorded in the archive and previous issue update. No logical-restore fix, exact-merged-artifact qualification, performance acceptance or production activation is claimed.

  27. grove commented on Oct 28, 2026

    @grove
    grove
    on Oct 28, 2026
    ContributorAuthor

    PR #32 head 39e56203b1c53a4913b1c6ad29c2a0be757a526a is green. Its candidate run 40662881399 actually checked out synthetic React merge af0fbbe42f1c00426659b15cd93b9ed3fb84d5c8, archive SHA-256 0beb257fd50ae04c56979579de8a3ee3737d3c5203842037dcaf8b2199b5cb52, MDM ad2597f72ee657cb946c5bbd7ae5eb2bfd1ac1b3, and unchanged pinned pg-trickle. Joint image sha256:030b599faa1b82b74fa3adc4b888f08c389ae8eb7e6f7c951b15243def224102; packaged libraries MDM 98b55d51d05e11bbdc26b240165c93f1a6e5dc2908ff11c1a14f339cd75e7ebb, pg-trickle 3f83ffdc01756e81b04785d173c7e8307327fc6bf09e019f8cc521dcb234fa58, React 34a46bbf37c3dcc327d156ae24663af44ca89f8bec0d634dd65f357b7711a4f5. Repeated focused tests and the full audit exited 0; full audit recorded 51 checks and QUALIFICATION_INCOMPLETE. It did not run logical restore.

    An exact-merged-main candidate run 40684900145 is queued at c07e9d650c60977372236745c95e08cb300a728e. A separate logical activation diagnostic 40685124814 is queued at probe commit f95eabba7f1dafeb9cbf3467e6628c0e3de04086 on probe/v049-logical-activation; it attempts authorized reconciliation after actual logical restore, retains the full state comparison, exits nonzero on failure, and uploads logs and observations. It is an investigation, not a proposed repair.

    An initial local activation probe exited 1 before the test started because Docker reported its internal metadata filesystem read-only; raw log /private/tmp/pgreact-logical-activation-probe-first.log. No other containers or volumes were changed. Logical restore remains unrepaired, and activation/resumption with retained work remains unproven. Green CI does not mean performance or release acceptance.

  28. grove commented on Oct 28, 2026

    @grove
    grove
    on Oct 28, 2026
    ContributorAuthor

    PR #32 merged at 90c7e17bb060a85166b6830394d1f0f0a7c7089a. The focused candidate workflow passed on prior merged main c07e9d650c60977372236745c95e08cb300a728e in run 40684900145, React archive SHA-256 dafd8e9c99078003af67756bfc8f80d02f6501fa712ce840b2a00c8c1727547d, MDM merge ad2597f72ee657cb946c5bbd7ae5eb2bfd1ac1b3, MDM archive d5ef46335ac1e3a1c8255548f388e3b6949dbe8bfb7377fa8c790788754544aa, unchanged pg-trickle source c7e257e551d6f6bacb84ecfe6f5daf7637c53673 and archive d6233d49cee80d33ac30626e0af7932a9698279233b8fceef3447275192abc27. Producer image sha256:4553efcc15e7c77330b9cee4e0ce0e4d6901f762b94d4169fd0aedfeafa98ff4, joint image sha256:1465d62f46549e6cba60154320ee19a928fd0a38047ba05a8388f4a6eefbc9e0. Packaged SHA-256: MDM 98b55d51d05e11bbdc26b240165c93f1a6e5dc2908ff11c1a14f339cd75e7ebb, pg-trickle 3f83ffdc01756e81b04785d173c7e8307327fc6bf09e019f8cc521dcb234fa58, React 34a46bbf37c3dcc327d156ae24663af44ca89f8bec0d634dd65f357b7711a4f5. All repeated focused executions and validation exits and full-audit exit were 0; full audit recorded 51 passing checks and QUALIFICATION_INCOMPLETE. Logical restore and release-scale qualification were not part of this candidate run.

    A candidate run on new main 40689383405 is queued; the separate logical activation probe 40685124814 remains in progress. The logical-restore state-loss defect is still open. No performance acceptance or production activation is claimed.

  29. grove commented on Oct 29, 2026

    @grove
    grove
    on Oct 29, 2026
    ContributorAuthor

    On 2026-10-29, a focused local regression confirmed the max_temporal_keys_per_pass bypass and the local fix. temporal-limit.sql passed through audit.py --temporal-limit on fresh pg-react 0.46.1 and 0.46.0→0.46.1 upgrade paths. With cap 1, two keys are rejected before author/reconcile/resume changes state; exact state vectors remain unchanged on rejection. The fixture also asserts the seeded one-key overlap, successful resume after removing the extra key, and exact healthy managed-run output. These changes and evidence are local and uncommitted; this does not qualify a release or complete #11.

  30. grove commented on Oct 30, 2026

    @grove
    grove
    on Oct 30, 2026
    ContributorAuthor

    2026-10-30 local follow-up: the temporal-key cap coverage now includes direct pgreact.refresh_rule(uuid) and pgreact.resume_rule(uuid) with two keys and cap 1; both return the exact M23_TEMPORAL_LIMIT error and preserve the complete captured state vector. A barrier-controlled concurrent generic-refresh case across two rules at cap 5 admits one new key; the second call returns M23_TEMPORAL_LIMIT: 6 temporal keys exceed max_temporal_keys_per_pass 5, with per-rule match/state vectors checked. Fresh 0.46.1 install and 0.46.0→0.46.1 upgrade paths pass. Reassembled SQL also passes the temporal-cap and missing-dispatcher recovery regressions on fresh and upgrade paths. Evidence is local and uncommitted in tests/integrations/pg-mdm/evidence/v0.49-temporal-limit-generic-entrypoints-verified-local-20261030/, v0.49-temporal-limit-serialized-verified-local-20261030/, v0.49-assembly-owner-recovery-local-20261030/, and v0.49-dispatcher-recovery-assembled-local-20261030/. These checks close only the focused cap and dispatcher defects; release_qualified=false, and the remaining recurrence, recovery, fairness, exact-package and release gates keep #11 open.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions