fix(mdm): gate copied work until recovery activation

.github/workflows/mdm-clone-activation-preview.yml

@@ -0,0 +1,96 @@
+name: MDM clone activation candidate (not release qualification)
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  clone_activation:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          repository: trickle-labs/pg-mdm
+          ref: e8b1dff81f7375bc0c5a5d4eb1db311bce1c7043
+          path: .producer/mdm
+      - name: Record source and profile identity
+        run: |
+          set -euo pipefail
+          mkdir -p clone-evidence
+          test "$(git -C .producer/mdm rev-parse HEAD)" = "e8b1dff81f7375bc0c5a5d4eb1db311bce1c7043"
+          git rev-parse HEAD > clone-evidence/react-source.txt
+          git -C .producer/mdm rev-parse HEAD > clone-evidence/mdm-source.txt
+          git archive --format=tar HEAD | sha256sum > clone-evidence/react-archive-sha256.txt
+          (cd .producer/mdm && git archive --format=tar HEAD) | sha256sum > clone-evidence/mdm-archive-sha256.txt
+          sha256sum tests/integrations/pg-mdm/time/audit.py tests/integrations/pg-mdm/time/autonomous_recurrence.py \
+            integrations/pg-mdm/sql/intent-worker.sql \
+            sql/current/pgtrickle.sql plans/v0.49-qualification-profile.json > clone-evidence/source-sha256.txt
+      - name: Build exact candidate stack
+        run: |
+          set -euo pipefail
+          docker build -f .producer/mdm/tests/Dockerfile.e2e \
+            --build-arg PG_MDM_SOURCE_REVISION=e8b1dff81f7375bc0c5a5d4eb1db311bce1c7043 \
+            --build-arg PG_TRICKLE_REVISION=c7e257e551d6f6bacb84ecfe6f5daf7637c53673 \
+            --build-arg PG_TRICKLE_SHA256=d6233d49cee80d33ac30626e0af7932a9698279233b8fceef3447275192abc27 \
+            --label pg_trickle.source_revision=c7e257e551d6f6bacb84ecfe6f5daf7637c53673 \
+            --label pg_trickle.source_archive_sha256=d6233d49cee80d33ac30626e0af7932a9698279233b8fceef3447275192abc27 \
+            -t pgreact:mdm-clone-candidate .producer/mdm > clone-evidence/mdm-build.log 2>&1
+          docker build -f tests/integrations/pg-mdm/Dockerfile.v0.48 \
+            --build-arg PG_MDM_IMAGE=pgreact:mdm-clone-candidate \
+            -t pgreact:clone-candidate . > clone-evidence/react-build.log 2>&1
+      - name: Record image and packaged libraries
+        run: |
+          set -euo pipefail
+          docker image inspect pgreact:mdm-clone-candidate pgreact:clone-candidate > clone-evidence/images.json
+          docker run --rm --entrypoint sha256sum pgreact:mdm-clone-candidate \
+            /usr/lib/postgresql/18/lib/pg_mdm.so /usr/lib/postgresql/18/lib/pg_trickle.so > clone-evidence/mdm-libraries.txt
+          docker run --rm --entrypoint sha256sum pgreact:clone-candidate \
+            /usr/lib/postgresql/18/lib/pg_mdm.so /usr/lib/postgresql/18/lib/pg_trickle.so > clone-evidence/joint-libraries.txt
+          cmp clone-evidence/mdm-libraries.txt clone-evidence/joint-libraries.txt
+          docker run --rm --entrypoint sha256sum pgreact:clone-candidate \
+            /usr/lib/postgresql/18/lib/pg_react.so > clone-evidence/react-library.txt
+      - name: Repeat physical clone, direct delivery, claimed-work and recurrence tests
+        run: |
+          set +e
+          set -uo pipefail
+          status=0
+          for mode in clean-clone clean-clone-direct claimed-work autonomous-recurrence; do
+            for run in first repeat; do
+              command=(python3 tests/integrations/pg-mdm/time/audit.py pgreact:clone-candidate "clone-evidence/$mode-$run" "--$mode")
+              printf '%q ' "${command[@]}" > "clone-evidence/$mode-$run.command"
+              printf '\n' >> "clone-evidence/$mode-$run.command"
+              "${command[@]}" > "clone-evidence/$mode-$run.log" 2>&1
+              result=$?
+              printf '%s\n' "$result" > "clone-evidence/$mode-$run.exit"
+              if [ "$result" -ne 0 ]; then
+                status=1
+              else
+                python3 -c 'import json,sys; o=json.load(open(sys.argv[1])); mode=sys.argv[2]; passed={c["name"] for c in o["checks"] if c["result"]=="passed"}; required={"clean-clone":{"clean-clone-preactivation","pending-recovery-s1_idle-5432"},"clean-clone-direct":{"clean-clone-direct-delivery-blocked"},"claimed-work":{"claimed-pause-barrier","pause-first-runtime-freshness","paused-before-claim","human-edit-claim-orders","binding-replacement-claim-orders","fresh-after-terminal-pause","cross-key-after-human-reduction"},"autonomous-recurrence":{"autonomous-recurrence"}}[mode]; assert required <= passed, o.get("failure"); assert mode != "clean-clone" or o["entry_decision"]=="FOCUSED_CLEAN_CLONE_RECOVERY_QUALIFIED"; assert mode != "claimed-work" or (o["entry_decision"]=="FOCUSED_CLAIMED_PAUSE_QUALIFIED" and not o["claimed_pause"]["pause_acknowledged_before_delivery_release"]); assert mode != "autonomous-recurrence" or (o["entry_decision"]=="FOCUSED_AUTONOMOUS_RECURRENCE_QUALIFIED" and o["autonomous_recurrence"]["old_receipts_unchanged"] and o["autonomous_recurrence"]["no_replay_across_cycles_and_restart"])' "clone-evidence/$mode-$run/observations.json" "$mode" > "clone-evidence/$mode-$run.validation.log" 2>&1
+                validation=$?
+                printf '%s\n' "$validation" > "clone-evidence/$mode-$run.validation.exit"
+                if [ "$validation" -ne 0 ]; then status=1; fi
+              fi
+            done
+          done
+          exit "$status"
+      - name: Run full joint audit on the activation candidate
+        if: ${{ !cancelled() }}
+        run: |
+          set +e
+          set -uo pipefail
+          command=(python3 tests/integrations/pg-mdm/time/audit.py pgreact:clone-candidate clone-evidence/full)
+          printf '%q ' "${command[@]}" > clone-evidence/full.command
+          printf '\n' >> clone-evidence/full.command
+          "${command[@]}" > clone-evidence/full.log 2>&1
+          result=$?
+          printf '%s\n' "$result" > clone-evidence/full.exit
+          exit "$result"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        if: always()
+        with:
+          name: mdm-clone-activation-candidate-evidence
+          path: clone-evidence/

.github/workflows/mdm-pause-barrier-preview.yml

@@ -1,4 +1,4 @@
-name: MDM pause barrier repair preview (not pinned release)
+name: MDM pause barrier preview (historical, nonblocking)
 
 on:
   pull_request:
@@ -9,6 +9,7 @@ permissions:
 
 jobs:
   mdm_pause_barrier_preview:
+    name: Pause-barrier preview history (nonblocking)
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
@@ -42,23 +43,44 @@ jobs:
             --build-arg PG_MDM_IMAGE=pgreact:mdm-pause-preview \
             -t pgreact:pause-preview . > pause-evidence/react-build.log 2>&1
       - name: Repeat deterministic claimed-work matrix
+        id: legacy_1
+        continue-on-error: true
         run: |
           set -euo pipefail
+          trap 'status=$?; printf "%s\n" "$status" > pause-evidence/historical-1.exit' EXIT
           for run in first repeat; do
             python3 tests/integrations/pg-mdm/time/audit.py \
               pgreact:pause-preview "pause-evidence/$run" --claimed-work
             python3 -c 'import json,sys; o=json.load(open(sys.argv[1])); required={"claimed-pause-barrier","pause-first-runtime-freshness","paused-before-claim","human-edit-claim-orders","binding-replacement-claim-orders","fresh-after-terminal-pause","cross-key-after-human-reduction"}; passed={x["name"] for x in o["checks"] if x["result"]=="passed"}; assert required<=passed, o.get("failure"); assert o["entry_decision"]=="FOCUSED_CLAIMED_PAUSE_QUALIFIED"; assert not o["claimed_pause"]["pause_acknowledged_before_delivery_release"]' "pause-evidence/$run/observations.json"
           done
       - name: Preserve real autonomous recurrence
+        id: legacy_2
+        if: steps.legacy_1.outcome == 'success'
+        continue-on-error: true
         run: |
+          set -euo pipefail
+          trap 'status=$?; printf "%s\n" "$status" > pause-evidence/historical-2.exit' EXIT
           python3 tests/integrations/pg-mdm/time/audit.py \
             pgreact:pause-preview pause-evidence/recurrence --autonomous-recurrence
       - name: Run unchanged full joint audit and pending recovery
+        id: legacy_3
+        if: steps.legacy_2.outcome == 'success'
+        continue-on-error: true
         run: |
           set -euo pipefail
+          trap 'status=$?; printf "%s\n" "$status" > pause-evidence/historical-3.exit' EXIT
           python3 tests/integrations/pg-mdm/time/audit.py pgreact:pause-preview pause-evidence/full
           python3 tests/integrations/pg-mdm/time/audit.py \
             pgreact:pause-preview pause-evidence/pending --pending-recovery
+      - name: Record nonblocking historical outcomes
+        if: ${{ !cancelled() && steps.legacy_1.outcome != '' }}
+        run: |
+          printf 'Historical old-MDM tests are nonblocking and are not release qualification.\n' > pause-evidence/historical-outcomes.txt
+          printf 'claimed=%s recurrence=%s full-and-pending=%s\n' '${{ steps.legacy_1.outcome }}' '${{ steps.legacy_2.outcome }}' '${{ steps.legacy_3.outcome }}' >> pause-evidence/historical-outcomes.txt
+          cat pause-evidence/historical-outcomes.txt >> "$GITHUB_STEP_SUMMARY"
+          if grep -q '=failure' pause-evidence/historical-outcomes.txt; then
+            printf '::warning::Historical compatibility failed; see the artifact and raw exits. This is not release qualification.\n'
+          fi
       - name: Retain image and inherited binary identities
         if: always()
         run: |

.github/workflows/mdm-stale-cas-preview.yml

@@ -1,4 +1,4 @@
-name: MDM stale-runtime repair preview (not pinned release)
+name: MDM stale-runtime preview (historical, nonblocking)
 
 on:
   pull_request:
@@ -9,6 +9,7 @@ permissions:
 
 jobs:
   mdm_stale_cas_preview:
+    name: Stale-runtime preview history (nonblocking)
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
@@ -47,8 +48,11 @@ jobs:
             -t pgreact:stale-cas-preview . \
             > preview-evidence/react-build.log 2>&1
       - name: Run full qualified integration audit on provisional artifact
+        id: legacy_1
+        continue-on-error: true
         run: |
           set -euo pipefail
+          trap 'status=$?; printf "%s\n" "$status" > preview-evidence/historical-1.exit' EXIT
           python3 tests/integrations/pg-mdm/time/audit.py \
             pgreact:stale-cas-preview preview-evidence/runtime
           python3 - <<'PY'
@@ -70,6 +74,15 @@ jobs:
           assert o['stale_operator_runtime_version']['complete_state_unchanged']
           print('PASS: repaired exact-source MDM preview; no release-pin adoption')
           PY
+      - name: Record nonblocking historical outcome
+        if: ${{ !cancelled() && steps.legacy_1.outcome != '' }}
+        run: |
+          printf 'Historical old-MDM test is nonblocking and is not release qualification.\n' > preview-evidence/historical-outcomes.txt
+          printf 'full=%s\n' '${{ steps.legacy_1.outcome }}' >> preview-evidence/historical-outcomes.txt
+          cat preview-evidence/historical-outcomes.txt >> "$GITHUB_STEP_SUMMARY"
+          if grep -q '=failure' preview-evidence/historical-outcomes.txt; then
+            printf '::warning::Historical compatibility failed; see the artifact and raw exits. This is not release qualification.\n'
+          fi
       - name: Retain exact image and executable identities
         if: always()
         run: |

.github/workflows/original-producer-compatibility.yml

@@ -1,4 +1,4 @@
-name: Original-pin producer compatibility (historical lane)
+name: Original-pin producer compatibility (historical, nonblocking)
 
 on:
   pull_request:
@@ -9,6 +9,7 @@ permissions:
 
 jobs:
   mdm_pinned_producer:
+    name: Original-pin history (nonblocking)
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
@@ -45,35 +46,64 @@ jobs:
             --build-arg PG_MDM_IMAGE=pgreact:mdm-pinned \
             -t pgreact:producer-compatibility . > producer-evidence/react-build.log 2>&1
       - name: Qualify autonomous MDM recurrence and cold restart
+        id: legacy_1
+        continue-on-error: true
         run: |
           set -euo pipefail
+          trap 'status=$?; printf "%s\n" "$status" > producer-evidence/historical-1.exit' EXIT
           python3 tests/integrations/pg-mdm/time/audit.py \
             pgreact:producer-compatibility producer-evidence/autonomous-recurrence --autonomous-recurrence
           python3 -c 'import json; o=json.load(open("producer-evidence/autonomous-recurrence/observations.json")); assert o["entry_decision"]=="FOCUSED_AUTONOMOUS_RECURRENCE_QUALIFIED", o.get("failure"); e=o["autonomous_recurrence"]; assert e["exact"] and e["old_receipts_unchanged"] and e["no_replay_across_cycles_and_restart"]'
       - name: Qualify admission, refresh permissions and actual idle delivery
+        id: legacy_2
+        if: steps.legacy_1.outcome == 'success'
+        continue-on-error: true
         run: |
+          set -euo pipefail
+          trap 'status=$?; printf "%s\n" "$status" > producer-evidence/historical-2.exit' EXIT
           python3 tests/integrations/pg-mdm/time/audit.py pgreact:producer-compatibility producer-evidence/runtime
           python3 -c 'import json; o=json.load(open("producer-evidence/runtime/observations.json")); passed={c["name"] for c in o["checks"] if c["result"]=="passed"}; assert {"future-idle-mdm-receipt","stale-operator-runtime-version"} <= passed, {"passed":passed,"failure":o.get("failure")}; assert o["stale_operator_runtime_version"]["exact"] and o["stale_operator_runtime_version"]["complete_state_unchanged"]'
           python3 -c 'import json; o=json.load(open("producer-evidence/runtime/observations.json")); passed={c["name"] for c in o["checks"] if c["result"]=="passed"}; assert {"managed-cycle-admission-bound","active-template-clone-guard","physical-restore-guard","physical-restore-reconcile-replay"} <= passed, o.get("failure"); assert o["active_template_clone"]["unchanged_before_activation"] and o["physical_recovery"]["unchanged_before_and_after_explicit_reconciliation"]'
           python3 -c 'import json; o=json.load(open("producer-evidence/runtime/observations.json")); assert o["entry_decision"]=="QUALIFICATION_INCOMPLETE"; assert o["core_upgrade_rollback"]["sqlstate"]==o["mdm_upgrade_rollback"]["sqlstate"]=="P0001"; assert o["post_resume_activation"]["denied_once"] and o["post_resume_activation"]["controls_unchanged"]'
       - name: Qualify copied pending escalation and explicit recovery
+        id: legacy_3
+        if: steps.legacy_2.outcome == 'success'
+        continue-on-error: true
         run: |
           set -euo pipefail
+          trap 'status=$?; printf "%s\n" "$status" > producer-evidence/historical-3.exit' EXIT
           python3 tests/integrations/pg-mdm/time/audit.py \
             pgreact:producer-compatibility producer-evidence/pending-recovery --pending-recovery
           python3 -c 'import json; o=json.load(open("producer-evidence/pending-recovery/observations.json")); passed={c["name"] for c in o["checks"] if c["result"]=="passed"}; assert o["entry_decision"]=="FOCUSED_PENDING_RECOVERY_QUALIFIED", o.get("failure"); assert {"pending-recovery-s1_clone-5432","pending-recovery-s1_idle-55432"} <= passed; assert all(o[n]["no_replay"] for n in ("pending-recovery-s1_clone-5432","pending-recovery-s1_idle-55432")); assert o["pending-recovery-s1_idle-55432"]["background_worker"]'
       - name: Qualify real downtime crossing an undelivered deadline
+        id: legacy_4
+        if: steps.legacy_3.outcome == 'success'
+        continue-on-error: true
         run: |
           set -euo pipefail
+          trap 'status=$?; printf "%s\n" "$status" > producer-evidence/historical-4.exit' EXIT
           python3 tests/integrations/pg-mdm/time/audit.py \
             pgreact:producer-compatibility producer-evidence/outage-runtime --outage
           python3 -c 'import json; o=json.load(open("producer-evidence/outage-runtime/observations.json")); names={c["name"] for c in o["checks"] if c["result"]=="passed"}; assert o["entry_decision"]=="FOCUSED_OUTAGE_QUALIFIED"; assert {"outage-deadline-catchup-single-case","future-idle-mdm-receipt","post-delivery-idle-quiescence","post-delivery-restart-no-replay"} <= names, names; assert o["outage_across_deadline"]["one_case_caught_up"]'
       - name: Qualify two-case managed catch-up after a real outage
+        id: legacy_5
+        if: steps.legacy_4.outcome == 'success'
+        continue-on-error: true
         run: |
           set -euo pipefail
+          trap 'status=$?; printf "%s\n" "$status" > producer-evidence/historical-5.exit' EXIT
           python3 tests/integrations/pg-mdm/time/audit.py \
             pgreact:producer-compatibility producer-evidence/two-case-outage --multi-outage
           python3 -c 'import json; o=json.load(open("producer-evidence/two-case-outage/observations.json")); checks={c["name"] for c in o["checks"] if c["result"]=="passed"}; assert o["entry_decision"]=="FOCUSED_TWO_CASE_OUTAGE_QUALIFIED", o.get("failure"); assert "two-case-real-outage-drain-and-no-replay" in checks, checks; e=o["multi_outage"]; assert e["exact"] and e["no_replay_across_cycles_and_restart"] and len(e["two_receipts"])==2 and e["configured_limits"]["pg_react.batch_size"]=="1"; assert 0 < e["two_case_drain_seconds"] <= 150 and e["observed_receipt_progress"][-1]["receipt_count"]==2; assert e["per_cycle_claim_bound"]["managed_to_claim_bound_verified"] and e["per_cycle_claim_bound"]["per_cycle_configured_claim_limit"]==1'
+      - name: Record nonblocking historical outcomes
+        if: ${{ !cancelled() && steps.legacy_1.outcome != '' }}
+        run: |
+          printf 'Historical old-MDM tests are nonblocking and are not release qualification.\n' > producer-evidence/historical-outcomes.txt
+          printf 'recurrence=%s full=%s pending=%s outage=%s multi-outage=%s\n' '${{ steps.legacy_1.outcome }}' '${{ steps.legacy_2.outcome }}' '${{ steps.legacy_3.outcome }}' '${{ steps.legacy_4.outcome }}' '${{ steps.legacy_5.outcome }}' >> producer-evidence/historical-outcomes.txt
+          cat producer-evidence/historical-outcomes.txt >> "$GITHUB_STEP_SUMMARY"
+          if grep -q '=failure' producer-evidence/historical-outcomes.txt; then
+            printf '::warning::Historical compatibility failed; see the artifact and raw exits. This is not release qualification.\n'
+          fi
       - name: Record and compare inherited packaged shared libraries
         run: |
           set -euo pipefail