# Parallel I0/I1 Durable-Seam + Regression Remediation — Plan and Progress

**Date:** 2026-08-24
**Status:** ACTIVE
**Branch:** `fix/i0-i1-durable-seam-20260824`
**Worktree:** `/home/user/Projects/.worktrees/awp-i0-i1-durable-seam-20260824`
**Base:** `origin/fix/i0-single-operator-session@3037cdab909290cf1373518df8c8d9fc64e602c3`
**Owner:** this parallel session
**Purpose:** close audit-confirmed I0/I1 correctness gaps that can be implemented independently of the actively changing dogfood/GOLIVE lane. This file is the durable execution state for the lane and must be updated after every meaningful checkpoint.

## Mission

Deliver a small, reviewable corrective branch that closes the binding durable-workflow transaction seam and the applicable non-overlapping owner-pain regression gates, without changing product scope or colliding with the active GOLIVE/dogfood session.

The lane is successful only when the implementation, focused tests, migration artifacts, architecture checks, and full repository gates are green at the exact pushed head on an authorized Debian buildbox. Source-level completion is not GOLIVE completion.

## Non-negotiable guardrails

1. Do not touch the active dogfood worktree `/home/user/Projects/.worktrees/awp-i1-dogfood-deploy`.
2. Do not overwrite or rebase the main session's `ops/i1-dogfood-deploy` work.
3. Avoid the known active overlap zone unless a minimal compatibility edit is unavoidable: `apps/control-plane/src/server.ts`, `infra/dogfood/deploy-debian3.sh`, `tests/golive/01-ui-loads.spec.ts`, `tests/golive/02-control-plane-postgres.test.ts`, `tests/golive/04-owner-lifecycle.spec.ts`, `tests/golive/28-self-project.test.ts`, and the new dogfood GOLIVE registry/orchestrator files.
4. Do not merge to `main`; do not claim GOLIVE completion.
5. Do not add I2-I9 product scope.
6. Preserve ADR-0009 auth/session, loopback privileged control-plane topology, automatic trusted Merge, and current provider boundaries from the base branch.
7. Heavy tests/builds/E2E run only on `debian1`, `debian2`, or `debian3`; never on the workstation.
8. Commits are durable checkpoints. Push coherent checkpoints so another session can recover the lane.
9. This file is the authoritative lane status; update `Current state`, task checkboxes, evidence, blockers, and next action continuously.

## Goals

### G1 — Close the binding durable-workflow transaction seam

Implement the approved `docs/specs/architecture/durable-workflow-transaction-seam.md` contract:

- durable `workflow_step_outcomes` table keyed by `(operation_id, step_name, step_key)`;
- application/persistence step-transaction helper that reads the marker first, commits domain effects + event + audit + outbox + marker atomically, and returns the recorded outcome on replay;
- race-safe replay semantics;
- no transaction spanning workflow steps;
- stable operation/step identity independent of DBOS internals;
- outbox dispatch is at-least-once and consumers deduplicate by outbox message id;
- production-inert crash hook at the exact post-domain-commit / pre-DBOS-checkpoint boundary;
- the binding child-process crash-window integration proof.

### G2 — Bind current I1 DBOS effect-producing workflows to the seam

Use the marker seam for the actual current I1 durable mutations, especially:

- FactoryRun / Task dispatch continuation;
- ChangeSet automatic trusted-Merge continuation;
- any other DBOS step that mutates AWP domain state on this branch.

A DBOS provider being present is insufficient; replay after the DBOS checkpoint crash window must be harmless because the authoritative marker committed with the domain effect.

### G3 — Close applicable non-overlapping pain-invariant regression gaps

Implement the minimum binding regression arms for I1-live subsystems without pulling I3 productization forward. Priority:

- VCS/change safety: no user-facing Git-mechanics decision vocabulary or approval kind; deterministic/automatic mechanics where currently implemented; no destructive operation against uncollected WIP where a current mutation seam exists.
- Verification/Done safety: exact-candidate evidence binding, stale-evidence rejection, self-report cannot directly transition lifecycle state, resolvable immutable evidence references/reuse semantics to the extent supported by the current I1 model.
- Default-autonomy regression alignment where it can be added outside the active GOLIVE files.

If a binding pain-invariant requirement depends on deferred I3 generic Policy/HITL productization, do not invent that product here. Record the exact contract conflict and implement only the narrow I1-safe invariant.

### G4 — Produce convergence-ready evidence and handoff

At completion, provide:

- exact branch/head;
- migration list and schema impact;
- exact workflow steps bound to the seam;
- focused test evidence;
- full `pnpm check` evidence on Debian buildbox;
- any remaining contract conflicts;
- files likely to conflict with the main dogfood lane;
- integration instructions for a future convergence branch.

## Explicitly not owned by this lane

These are real audit findings, but the main dogfood/GOLIVE session currently owns the overlapping code. Do not race it here:

- canonical GOLIVE registry/manifest/orchestrator migration and `executeJourney()` controller;
- dogfood ACP failure-injection wiring inside the active dogfood lane;
- authentication updates to the new owner GOLIVE flow;
- dogfood HTTPS callback deployment convergence;
- final canonical 30/30 owner journey;
- landing the eventual convergence branch/main correction.

This lane must leave durable notes if its changes impose requirements on those areas.

## Task ledger

### Phase A — Map current implementation and lock interfaces

- [x] **A0 — Isolated lane created.** Worktree/branch created from the verified auth/autonomy branch; active dogfood worktree inspected read-only.
- [x] **A1 — Persistence/UoW map.** Identify current transaction, event/audit/outbox write path, repositories, migration conventions, transaction-scoped adapters.
- [x] **A2 — DBOS workflow map.** Identify every current DBOS step/body mutation and exact operation/idempotency identities.
- [x] **A3 — Outbox map.** Identify current outbox schema/repository/dispatch/consumer behavior and the minimal consumer-dedupe seam required by the binding architecture.
- [x] **A4 — Test/fault-host map.** Identify existing real-Postgres/DBOS integration harnesses and the cleanest child-process crash hook location.

### Phase B — Durable marker substrate

- [x] **B1 — Schema.** Add `workflow_step_outcomes` with composite primary key, JSONB outcome, recorded timestamp, typed model/repository contracts, and generated Drizzle migration/snapshot/journal.
- [x] **B2 — Repository.** Add transaction-scoped get/insert/read-after-race operations following current persistence conventions.
- [x] **B3 — Step transaction helper.** Add a stable application/persistence seam that executes one mutation transaction, records marker atomically, and returns stored outcome on replay.
- [x] **B4 — Race semantics.** Prove deterministic replay and winner/re-read behavior under duplicate invocation.

### Phase C — Bind real I1 durable workflows

- [x] **C1 — Task dispatch.** Bind the real DBOS Task-dispatch domain mutation step to an operation/step marker.
- [x] **C2 — Auto-merge.** Bind the real DBOS automatic trusted-Merge domain mutation step to an operation/step marker.
- [x] **C3 — Mutation audit.** Search all DBOS workflow code and prove no remaining domain mutation occurs outside a marked step boundary.
- [x] **C4 — Stable identities.** Prove operationId/stepName/stepKey are deterministic across replay and independent of DBOS-internal IDs.

### Phase D — Outbox at-least-once + consumer dedupe

- [x] **D1 — Dispatcher seam.** Implement the minimal polling/dispatch abstraction required by dogfood/current architecture without publishing inside the domain transaction.
- [x] **D2 — Consumer receipt/dedupe.** Implement durable or otherwise binding consumer-side dedupe by outbox message id for the current consumer path.
- [x] **D3 — Duplicate delivery proof.** Redeliver an outbox message and prove the consumer-visible effect count stays at one.

### Phase E — Binding crash-window proof

- [x] **E1 — Fault hook.** Implement `AWP_CRASH_AFTER_STEP_COMMIT=<stepName>` at the exact after-Drizzle-commit / before-DBOS-checkpoint point; production/default configuration must not enable it.
- [x] **E2 — Child workflow host.** Create a test host executable that runs the real workflow against real PostgreSQL and records a step-entry diagnostic count.
- [x] **E3 — SIGKILL proof.** Child must die by SIGKILL at the intended boundary; normal exit is an inconclusive/failing test.
- [x] **E4 — Recovery proof.** Restart without the hook; DBOS replay re-enters the step but marker replay leaves domain/event/audit/outbox/marker counts at exactly one and returns the same outcome.
- [x] **E5 — Outbox redelivery arm.** Explicit second delivery remains one consumer effect.

### Phase F — Applicable pain-invariant regressions

- [x] **F1 — VCS user-surface scan.** Add a regression that forbids user-facing Git mechanic vocabulary where applicable without blocking internal technical logs/tests.
- [x] **F2 — No Git approval kind.** Assert current Approval/HITL domain cannot represent a user gate whose subject is a Git mechanic. If the generic I3 hook model does not exist yet, bind the current narrow domain rather than creating it.
- [x] **F3 — WIP-before-destructive-mutation arm.** Add proof around current cleanup/mutation seam that collected/checkpointed WIP is required before destructive cleanup.
- [x] **F4 — Evidence lifecycle regressions.** Add exact-revision stale-evidence rejection, immutable/resolvable reference, and no self-report-to-Done regression coverage where missing.
- [x] **F5 — Verification reuse arm.** Prove unchanged exact candidate can reuse valid evidence rather than ritual rerun if the current I1 implementation already exposes a cache/reuse seam; otherwise record as an explicit deferred-contract gap rather than inventing I5.

### Phase G — Verification and durable handoff

- [x] **G1 — Focused tests on Debian buildbox.** Marker/replay/race/outbox/DBOS crash/pain-invariant tests pass.
- [x] **G2 — Migration verification.** Real PostgreSQL migration from current candidate succeeds and schema is drift-free.
- [x] **G3 — Full repository gate.** `pnpm check` passes on an authorized Debian buildbox at exact final pushed head.
- [x] **G4 — Architecture diff audit.** Confirm no forbidden dependencies, no dogfood-worktree collision, no I2-I9 scope expansion.
- [x] **G5 — Commit/push final lane.** Push exact green head.
- [x] **G6 — Final handoff section.** Record convergence order, sensitive overlap files, exact evidence, remaining blockers, and what the main session must integrate.

## Current state

**Checkpoint 12 — Phase F I1-safe pain regressions complete and focused-green.**

- Debian2 at `3a7071e`: 4 focused files / 26 tests PASS: pain-invariant static gates 4/4, I1 detail read models 5/5, Kubernetes Workspace cleanup 7/7, VerificationEvidence/merge lifecycle 10/10;
- F1: public `target-head` terminology was removed in favor of `target-revision`, and the user-surface banned-Git-vocabulary regression is green;
- F2: current I1 Approval domain cannot encode a Git-mechanics approval subject/reason and has no application Approval creation repository; no deferred I3 policy taxonomy was invented;
- F3: application terminal cleanup requires a collected checkpoint before destructive provider calls, immutable digest continuity before cleanup recording, and provider-level `collected=true` + exact digest tests are green;
- F4: current I1 evidence lifecycle proves candidate-digest binding, stale-other-candidate rejection, provider-owned repository-check evidence, no agent-completion path to Task Done, and verified trusted Merge before Task completion;
- F5: unchanged exact completion replay reuses the durable ChangeSet/evidence and does not duplicate verification records or publication/reviewer work;
- deferred-contract gap retained: the full future invariant “references resolve to typed real CI execution + acceptance-run IDs” cannot be closed until those deferred entities/ports exist. This lane does not falsely claim that broader I5 capability.

**Checkpoint 11 — Phase F I1-safe pain regressions implemented and focused-green.**

- Chain 4 audit found a real user-surface violation: merge-gate condition/reason code `target-head` and copy referring to “target head”; public contract/projection/fixture/test vocabulary is changed to `target-revision`;
- added `no-git-vocabulary-in-user-surfaces` static regression across current I1 projection/render sources for rebase, force-push, upstream, `HEAD`, detached, conflict-marker, cherry-pick, stash, and the retired target-head wording;
- added narrow I1 `no-approval-of-git-kind` regression: current `Approval` carries no Git-mechanics subject/reason and application has no Approval repository/creation seam. Generic policy/HITL taxonomy remains deferred and is not invented here;
- destructive terminal cleanup is locked behind collected checkpoint presence and immutable digest continuity before provider destroy/cleanup; existing Kubernetes provider tests already prove `collected=true` and exact digest are required, while the new regression locks the application-level ordering;
- verification lifecycle assertions now prove agent completion leaves Task in `review`, stale evidence for another candidate digest cannot satisfy the gate, unchanged completion replay does not duplicate candidate evidence, and Task reaches `completed` only through verification-gated trusted Merge;
- full `evidence-references-are-immutable-and-resolvable` as specified (typed real CI execution + acceptance-run IDs) cannot be fully realized inside I1 because those CI/acceptance entities/ports are not present; adding them would pull deferred verification/CI product scope forward. Current I1-safe guarantees are immutable candidate digest binding plus provider-owned repository-check evidence. This is recorded as a deferred contract gap, not claimed closed by prose-source strings;
- final focused Debian2 run at `3a7071e` passed 4 files / 26 tests. F1-F5 complete within current I1 scope; typed CI/acceptance resolvability remains explicitly deferred.

## Current state

**Checkpoint 10 — Phase E exact crash-window proof complete and green.**

- Debian2 real PostgreSQL 16 + pinned DBOS gate passed at `76b9ffc`;
- first child was observed by the parent as `{ code: null, signal: "SIGKILL" }`, proving the fault hook killed the actual workflow host at the specified boundary rather than exiting normally;
- before restart, step-entry count=1 and exactly one Project, business event, audit record, outbox message, and workflow-step marker existed;
- recovery child launched with the same DBOS executor identity and no crash hook, re-entered the handler (entry count 2), replayed the marker-recorded outcome, and left all authoritative counts unchanged at one;
- the same real-PostgreSQL proof delivered the outbox message twice to the consumer and left exactly one consumer Project effect and one receipt;
- deployment-boundary assertion proves dogfood configuration does not enable `AWP_CRASH_AFTER_STEP_COMMIT`;
- companion deployment/outbox/marker suites were also green: 4 files / 9 tests PASS. E1-E5 complete.

**Checkpoint 9 — Phase E exact crash-window proof implemented and green.**

- production DBOS step runner now supports the specified inert fault hook: when `AWP_CRASH_AFTER_STEP_COMMIT` exactly matches the authored step name, it sends `SIGKILL` after the marked Drizzle transaction returns and before `DBOS.runStep` can return/checkpoint;
- dogfood deployment boundary test asserts the crash-hook environment variable is absent from production deployment configuration;
- child proof host uses the actual registered DBOS workflow/step runner, the real `WorkflowStepTransactionRunner`, repository migrations, and one PostgreSQL database shared by DBOS and AWP domain state;
- child appends a test-only step-entry diagnostic before entering the DBOS step, mutates Project + business event + audit + outbox + marker atomically, and returns a serializable outcome;
- parent proof requires the first child to terminate specifically by `SIGKILL`, then asserts entry count=1 and all five authoritative effect/marker counts=1 before restart;
- recovery child starts with the same DBOS executor identity and no fault hook; it must recover the pending workflow, re-enter the handler (entry count 2), return the marker-recorded outcome, and leave every effect count at one;
- the same real-PostgreSQL proof redelivers the outbox message twice through `IdempotentOutboxConsumer` and asserts one consumer-visible database effect + one receipt;
- the test is opt-in on `AWP_TEST_DATABASE_URL` so normal repository checks remain hermetic; Debian2 disposable PostgreSQL 16 proof passed at `76b9ffc`.

## Current state

**Checkpoint 8 — Phase D complete and focused-green.**

- migration `0017_nosy_orphan.sql` adds durable consumer receipts keyed by `(consumer_id, message_id)`;
- dispatcher behavior is intentionally at-least-once: publish occurs outside the transaction and `published=true` is recorded only after return;
- consumer receipt and consumer database effect commit atomically, including rollback of the losing duplicate race;
- Debian2 at `f0287b2`: workspace build PASS; focused outbox + persistence + workflow-marker suites 3 files / 14 tests PASS;
- explicit publish-before-mark failure caused two deliveries but exactly one consumer Project effect and one receipt; third dispatch saw no pending message;
- D1-D3 complete.

**Checkpoint 7 — Phase D outbox/dedupe substrate implemented and focused-green.**

- `OutboxRepository` now exposes pending reads, attempt increments, and idempotent publish marking while preserving append inside domain transactions;
- added `outbox_consumer_receipts(consumer_id, message_id, processed_at)` with composite primary key so consumer dedupe identity is the outbox message id scoped by consumer;
- `OutboxDispatcher` performs at-least-once delivery: record attempt -> publish outside the database transaction -> mark published only after publish returns; a crash/failure after publish therefore intentionally redelivers;
- `IdempotentOutboxConsumer` executes the consumer database effect and receipt insert in one transaction; a concurrent duplicate receipt conflict rolls the losing effect back;
- integration test simulates publish/consumer success followed by failure before `published=true`, then redelivers and asserts two deliveries but one consumer-visible Project row and one receipt;
- generated migration `0017_nosy_orphan.sql` is committed; Debian2 rerun at `f0287b2` passed workspace build and all 14 focused tests. D1-D3 complete.

## Current state

**Checkpoint 6 — Phase C complete and focused-green.**

- C2 Debian2 gate at `2f0126c`: full workspace build PASS; 6 focused files / 25 tests PASS, including repository-required checks, automatic trusted Merge, downstream dispatch replay, DBOS provider, and marker seam coverage;
- C3 source audit found exactly two registered DBOS workflows (`i1-task-dispatch`, `i1-changeset-automerge`). On their durable paths, raw application transactions outside `workflowDomainStep` are read-only hierarchy/snapshot/basis loads permitted by the binding rule; all domain writes are marked transactions and all provider/network calls are external steps;
- C4 operation identities remain application-owned and deterministic: `dispatch:<factoryRunId>:<taskId>` and `automerge:<changeSetId>`; stable authored step names and entity/poll discriminator keys are visible in source and do not use DBOS workflow IDs; existing provider tests prove deterministic workflow operation mapping and DBOS tests prove `awp:<operationId>` is only provider correlation;
- Phase C is complete. Exact process-kill proof is intentionally still open under Phase E.

**Checkpoint 5 — C2 auto-merge step decomposition implemented and focused-green.**

- `AutoMergeReconciliationWorker` now requires a step-aware reconciler for real DBOS execution while retaining direct-mode compatibility for existing tests/callers;
- DBOS supplies a deterministic poll iteration so required-check observations can change across polling cycles without reusing a stale permanent step checkpoint;
- repository-required checks are split into external observation + marked evidence/status persistence, keyed by ChangeSet, poll iteration, and immutable publication revision;
- trusted Git merge/reconcile is a provider external step; authoritative ChangeSet/Task/Plan/FactoryRun merge persistence is one marked transaction;
- automatic next-Task workflow scheduling is isolated as an external step per Task;
- terminal Workspace destroy and checkpoint cleanup are external steps, followed by a marked cleanup-state transaction;
- stable auto-merge operation identity remains `automerge:<changeSetId>` and marker keys do not depend on DBOS internal workflow identifiers;
- no active dogfood/GOLIVE worktree files were modified;
- Debian2 gate at `2f0126c`: full workspace build PASS; 6 focused files / 25 tests PASS. C2 complete.

## Current state

**Checkpoint 4 — C1 Task-dispatch step decomposition implemented and focused-green.**

- added provider-neutral `DurableWorkflowStepRunner`; DBOS now lets application orchestration declare multiple `runStep` boundaries rather than wrapping the whole handler in one step;
- `ProviderExecutionWorker` isolates Fabro start as a deterministic external step and requires a step-aware downstream for real DBOS execution;
- `WorkspaceExecutionDispatcher` retains the legacy direct `dispatch()` path, while `dispatchDurably()` uses durable operation id `dispatch:<factoryRunId>:<taskId>`;
- durable Task dispatch now declares: marked `state-prepare` transaction -> external Workspace provision -> external ACP start -> marked `state-started` transaction, with marked `state-failed` on terminal external-step failure;
- domain step names/keys are stable and external provider calls retain deterministic idempotency keys;
- no active dogfood/GOLIVE files were modified;
- Debian2 focused gate at `3c52a85`: workspace build PASS; 5 focused files / 13 tests PASS. C1 complete; the exact child-process SIGKILL gate remains Phase E.

## Current state

**Checkpoint 3 — Phase B marker substrate complete and focused-green.**

- `workflow_step_outcomes` schema is implemented with composite PK `(operation_id, step_name, step_key)`, JSONB outcome, and `recorded_at`;
- generated migration `0016_condemned_lady_ursula.sql` + snapshot/journal is committed and pushed at `c7fd30e`;
- `ApplicationTransaction` exposes a transaction-scoped marker repository;
- `WorkflowStepTransactionRunner` reads marker first, executes the mutation once, inserts the marker in the same transaction, returns recorded outcome on replay, and converts marker-PK races into winner re-read after the losing transaction rolls back;
- the runner exposes an `afterCommit` boundary only for the winning commit, suitable for the exact crash hook later;
- Debian2: full workspace build PASS; application typecheck PASS; persistence typecheck PASS; focused marker seam 3/3 PASS.

**Checkpoint 2 — marker substrate generated and under focused buildbox verification.**

- source substrate checkpoint is pushed at `ef03f46`;
- Debian2 generated migration `0016_condemned_lady_ursula.sql` plus snapshot/journal; artifacts are not yet committed;
- workspace build + application typecheck + persistence typecheck pass;
- focused seam test first run passed replay/after-commit arms and correctly exposed wrapped-unique-error handling in the race/rollback arm;
- local source now contains the hardened wrapped-error detector and is awaiting a second Debian2 run before B1-B4 are marked complete.

**Checkpoint 1 — Phase A implementation map complete.**

Persistence/UoW map:

- `packages/application/src/ports/repositories.ts` defines `ApplicationTransaction` and `UnitOfWork`; current outbox contract is append-only.
- `packages/persistence/src/unit-of-work.ts` builds all transaction-scoped repositories inside one Drizzle transaction. This is the correct insertion point for a transaction-scoped workflow-marker repository.
- `packages/persistence/src/schema.ts` already stores domain state + `business_events` + `audit_records` + `outbox_messages`; no workflow marker or consumer receipt table exists.
- current migration head is `0015_tired_lorna_dane.sql`; Drizzle generation is `pnpm --filter @awp/persistence db:generate`.

DBOS/workflow map:

- `packages/providers/workflow-dbos/src/execution.ts` currently registers exactly two real I1 DBOS workflows: `i1-task-dispatch` and `i1-changeset-automerge`.
- each workflow currently wraps a large application handler in one `DBOS.runStep`. This is **not** compliant with the binding seam: those handlers contain multiple application transactions and external provider calls.
- `ProviderExecutionWorker.execute()` reads state, calls Fabro, then delegates to `WorkspaceExecutionDispatcher.dispatch()`, whose current path performs multiple domain transactions around Workspace/ACP side effects.
- `AutoMergeReconciliationWorker.execute()` delegates to `WorkspaceExecutionDispatcher.reconcileAutoMerge()`, which refreshes checks, performs trusted Git merge, persists merged domain state, dispatches the next Task, and cleans Workspace state across multiple transactions/external effects.
- therefore C1/C2 require a real step-boundary refactor; merely placing one marker around the current outer `runStep` would violate the approved architecture.

Outbox map:

- outbox is append-only today. `outbox_messages` already has `published`, `published_at`, and `attempts`, but `OutboxRepository` exposes only `append`.
- no product outbox dispatcher or consumer receipt/dedupe implementation exists. D1/D2 must add the minimal generic seam rather than retrofit a nonexistent broker.

Test/fault-host map:

- `tests/integration/persistence.test.ts` already proves atomic domain/event/audit/outbox transactions using PGlite and applies repository migrations.
- `tests/integration/dbos/workflow-dbos.test.ts` proves DBOS identity/reconciliation with fakes; it explicitly does not satisfy the real crash-window gate.
- `packages/providers/workflow-dbos/test/live-runtime-proof.mjs` already exercises the pinned real DBOS SDK and is useful as API/runtime reference.
- the Required Proof should be a separate opt-in real-PostgreSQL child-process integration so normal `pnpm check` can keep environment-dependent infrastructure isolated while a buildbox gate executes it explicitly.

**Checkpoint 0 — lane initialized.**

Observed 2026-08-24:

- `origin/fix/i0-single-operator-session@3037cda` is clean and is this lane's base.
- `origin/ops/i1-dogfood-deploy` has advanced independently; its active worktree is dirty and is not to be touched.
- Binding durable-workflow spec still explicitly requires marker + step transaction + outbox dedupe + crash-window proof before I1 ships.
- No implementation work has yet been done in this lane beyond creating the isolated worktree and this durable file.

## Evidence log

- 2026-08-24: fetched current refs and inspected active worktrees through Overdeck.
- 2026-08-24: created `fix/i0-i1-durable-seam-20260824` at `3037cda` in an isolated worktree.
- 2026-08-24: confirmed active dogfood lane is independently dirty; parallel isolation remains necessary.
- 2026-08-24: re-read the binding durable transaction seam; ship-blocking Required Proof remains explicit.
- 2026-08-24: completed Phase A code map. Confirmed two DBOS workflows currently wrap multi-transaction/multi-effect handlers and therefore need real step decomposition; confirmed outbox has persistence columns but no dispatcher/consumer dedupe implementation.
- 2026-08-24: first Debian2 substrate gate required workspace dependency builds before package-local typecheck; after `pnpm -r --if-present build`, application and persistence typechecks passed.
- 2026-08-24: focused `workflow-step-seam` test produced 2 PASS / 1 FAIL. Failure was correct test pressure: Drizzle wraps PostgreSQL `23505` in `error.cause`, and generated PK name is `workflow_step_outcomes_operation_id_step_name_step_key_pk`; conflict detector was hardened to unwrap causes and match table/constraint semantics.
- 2026-08-24: reran focused substrate gate on Debian2 after fix: workspace build PASS; `workflow-step-seam` 3/3 PASS including replay, marker-race rollback, and after-commit-only-on-winner.
- 2026-08-24: generated/committed/pushed Drizzle migration `0016_condemned_lady_ursula.sql` at `c7fd30e`. Phase B complete.
- 2026-08-24: began C1. Refactored DBOS registry to accept application-declared sub-steps and refactored durable K3s Task dispatch into marked domain transactions plus separate Fabro/Workspace/ACP external-effect steps. Buildbox verification pending.
- 2026-08-24: C1 focused Debian2 gate PASS at `3c52a85`: workspace build green; provider execution, dispatch idempotency, retry, DBOS provider, and marker seam suites 5 files / 13 tests PASS. C1 marked complete; exact SIGKILL crash proof remains E-phase.
- 2026-08-24: implemented C2 decomposition locally: per-poll required-check observe/record steps, trusted-merge external step, marked merge persistence, next-Task external starts, and marked terminal Workspace cleanup state. Buildbox verification pending.
- 2026-08-24: C2 Debian2 focused gate PASS at `2f0126c`: workspace build green; 6 files / 25 tests PASS.
- 2026-08-24: C3/C4 audit complete: only two DBOS workflows; durable-path unmarked transactions are read-only; all durable-path writes are marked; stable identities are application operation/entity/poll keys, not DBOS internals. Phase C complete.
- 2026-08-24: implemented Phase D source substrate and explicit publish-before-mark redelivery test. Migration generation/buildbox verification pending.
- 2026-08-24: generated migration `0017_nosy_orphan.sql`; workspace build PASS. First Phase D focused run: persistence 10/10 PASS, marker seam 3/3 PASS, outbox redelivery behavior reached expected attempts=2/published=true but one assertion compared timestamp string formatting instead of instant semantics. Production code unchanged; test normalized with `Date.parse`.
- 2026-08-24: Phase D rerun at `f0287b2` PASS: workspace build green; outbox redelivery 1/1, persistence 10/10, marker seam 3/3. Two deliveries / one consumer effect proven. Phase D complete.
- 2026-08-24: verified pinned DBOS recovery semantics against current official docs and installed SDK surface: pending workflows recover on same-executor restart; unfinished steps re-execute while completed steps replay checkpoints.
- 2026-08-24: implemented Phase E fault hook + child/parent real-PostgreSQL SIGKILL proof and production-inert deployment assertion. Buildbox execution pending.
- 2026-08-24: pre-run Debian2 resolution audit found spawned child processes do not inherit Vitest aliases/root workspace symlinks. Harness corrected to import real workspace sources by relative path and use a tiny native provider helper for `DBOS.getResult`; no proof semantics changed.
- 2026-08-24: first real PostgreSQL/DBOS run reached the hard-kill boundary but TSX CLI wrapper surfaced it as exit code 137 instead of parent-observed `SIGKILL`; all companion durability tests passed. Harness changed to direct `node --import tsx` so the observed child itself receives SIGKILL.
- 2026-08-24: Phase E rerun at `76b9ffc` PASS against disposable PostgreSQL 16: direct SIGKILL observed, step entry 1 -> 2, all authoritative effect/marker counts remain 1, same outcome replayed, duplicate consumer delivery deduped; 4 files / 9 tests PASS. Phase E complete.
- 2026-08-24: Phase F audit found and remediated public `target-head` Git vocabulary. Added I1 pain regressions and strengthened verification lifecycle/reuse assertions. Full typed CI/acceptance evidence resolvability is explicitly deferred because those entities are outside I1. Buildbox verification pending.
- 2026-08-24: first Phase F Debian2 run: workspace build PASS; Workspace cleanup 7/7 and read-model 5/5 PASS; verification suite 9/10 PASS with one old aggregate count now including the intentional stale-candidate row; static pain suite had an escaped-brace regex parse error. Both are test-only corrections; production code unchanged.
- 2026-08-24: second Phase F Debian2 run: verification 10/10, Workspace cleanup 7/7, read-model 5/5 PASS; static pain suite 3/4 PASS. Remaining failure was a false positive from AgentRun `status: completed`; regression narrowed to Task updates only.
- 2026-08-24: final Phase F Debian2 run at `3a7071e` PASS: static pain 4/4, read-model 5/5, Workspace cleanup 7/7, verification/merge 10/10; 4 files / 26 tests. Phase F complete.
- 2026-08-24: Phase G focused durability/migration gate at `7844f9a` PASS: 7 files / 30 tests against disposable PostgreSQL 16, including real DBOS SIGKILL recovery; Drizzle regeneration reported no schema changes and left a clean tree.
- 2026-08-24: architecture/scope audit at `7844f9a` found no package/lock changes, no I2-I9 product-scope additions, and zero overlap with currently dirty dogfood paths.
- 2026-08-24: first full `pnpm check` invocation exposed a buildbox wrapper pnpm mismatch before checks; corrected invocation reached lint and found one `prefer-const` issue in the new required-check snapshot declaration. Source fix is mechanical; full gate must rerun.
- 2026-08-24: full gate at `98e9e42` passed typecheck, lint, 193/6 test result, build and architecture but stopped at Prettier on seven lane files; formatting-only patch committed as `f7412d5`.
- 2026-08-24: full `pnpm check` at `f7412d5` PASS: 52 test files passed / 3 opt-in skipped, 193 tests passed / 6 skipped, architecture 6/6, dependency-cruiser zero violations (116 modules / 207 dependencies), Prettier clean.
- 2026-08-24: convergence audit: durability delta `3037cda..f7412d5` has zero committed overlap with latest dogfood remote delta and zero overlap with current dirty dogfood paths; inherited auth/base has six sensitive overlaps documented in Final convergence handoff.
- 2026-08-24: exact pushed handoff head `95dc50a` final focused gate PASS: disposable PostgreSQL 16, 7 files / 30 tests including direct SIGKILL recovery; Drizzle regeneration reported no schema changes and left the tree clean.
- 2026-08-24: first combined closure command left `AWP_TEST_DATABASE_URL` exported into the subsequent normal suite, so the opt-in SIGKILL proof intentionally re-ran against the already-completed workflow and returned normally; this was harness environment contamination, not a durability failure.
- 2026-08-24: exact `95dc50a` normal full `pnpm check` with opt-in database variables unset PASS: typecheck, lint, 52 files passed / 3 opt-in skipped, 193 tests passed / 6 skipped, build, architecture 6/6, dependency-cruiser zero violations, Prettier clean. G1-G4 are green.
- 2026-08-24: G5/G6 status-only closure prepared after all source/proof gates; this commit is the final branch mutation. One last exact-head `pnpm check` is required after push; no further edits are permitted on success.

## Final convergence handoff

### Lane result

- durability worktree: `/home/user/Projects/.worktrees/awp-i0-i1-durable-seam-20260824`;
- branch: `fix/i0-i1-durable-seam-20260824`;
- inherited auth/base commit: `3037cda`;
- source+format candidate before final handoff docs: `f7412d54d8effde79fcade94c1fd51efea962e85`;
- no merge to `main` or dogfood branch has been performed.

### Binding proof delivered

1. Real domain + event + audit + outbox + `workflow_step_outcomes` marker commit in one Drizzle transaction.
2. Deterministic application-owned operation/step identities for the two real I1 DBOS workflows.
3. Real Task-dispatch and automatic trusted-Merge workflows decomposed into marked domain steps and external provider steps.
4. At-least-once outbox dispatcher plus atomic consumer receipt/effect dedupe.
5. Real PostgreSQL 16 + pinned DBOS child-process proof: post-domain-commit/pre-DBOS-checkpoint `SIGKILL`, same-executor recovery, handler re-entry, same marker outcome, and exactly-one authoritative effects.
6. Owner-pain regressions for public Git vocabulary, Git Approval absence, WIP-before-destructive-cleanup, candidate-bound evidence, no self-report-to-Task-Done, and unchanged-candidate replay/reuse.

### Gate evidence

- G1 focused final-source durability gate at `7844f9a`: disposable PostgreSQL 16, 7 files / 30 tests PASS, including real DBOS SIGKILL recovery. Later changes through `f7412d5` are one `prefer-const` correction plus Prettier-only formatting; full repository tests cover those files.
- G2 migration/drift: migrations `0016_condemned_lady_ursula.sql` and `0017_nosy_orphan.sql` apply in the real PostgreSQL proof; Drizzle regeneration reported `No schema changes, nothing to migrate` and left the checkout clean.
- G3 source candidate `f7412d5`: full `pnpm check` PASS — typecheck, lint, 52 test files passed / 3 opt-in files skipped, 193 tests passed / 6 skipped, build, architecture 6/6, dependency-cruiser zero violations across 116 modules / 207 dependencies, Prettier clean. Exact final handoff/status commit must be rerun before closure.
- G4 architecture/scope: no package manifest or lockfile changes; no I2-I9 production product scope added; durability delta has no committed-path overlap with current dogfood remote delta and no overlap with the dogfood worktree's current dirty paths.

### Convergence order for the main session

1. **Preserve the active dogfood WIP first.** Its worktree was still dirty at the final audit; do not merge/cherry-pick into it until that WIP is committed or otherwise durably preserved.
2. **Reconcile ADR-0009 auth/base with latest dogfood before taking the entire branch.** Relative to shared dogfood ancestor `8832a026`, the inherited auth/base and current dogfood remote both touch exactly these sensitive files: `apps/control-plane/src/server.ts`, `infra/dogfood/deploy-debian3.sh`, `tests/golive/01-ui-loads.spec.ts`, `tests/golive/02-control-plane-postgres.test.ts`, `tests/golive/04-owner-lifecycle.spec.ts`, `tests/golive/28-self-project.test.ts`. Resolve those intentionally; do not accept one side wholesale.
3. **Then apply the durability-only delta from `3037cda` forward.** At the final audit, `3037cda..f7412d5` had zero committed path overlap with `8832a026..origin/ops/i1-dogfood-deploy` and zero overlap with current dirty dogfood paths. This is the low-conflict part of the branch and should be integrated after auth/dogfood convergence.
4. Regenerate/check migrations after convergence and rerun the real PostgreSQL/DBOS crash proof plus full `pnpm check` on the converged branch.
5. Do not claim canonical GOLIVE completion from this lane alone; it repairs the binding durability seam and regressions but does not replace the main dogfood lane's live owner journey proof.

### Remaining scope statement

- No durability-lane blocker remains.
- The Pain-Invariant requirement for typed, resolvable **real CI execution + acceptance-run IDs** remains a deliberate deferred-contract gap because those entities/ports are not present in I1. Candidate-digest binding and provider-owned repository-check evidence are enforced now; this lane did not invent deferred I5 verification product scope.
- No deployment or merge to main was performed.

### Final closure procedure

The exact pushed handoff head has passed the real PostgreSQL focused durability gate, Drizzle no-drift, and full `pnpm check`. This status-only commit marks G3/G5 complete. After it is pushed, run one final exact-head `pnpm check` with opt-in database variables unset; no further edits are permitted on success.

## Blockers

None at initialization.

## Next action

Commit/push this status-only closure, then run one final `pnpm check` on that exact pushed head with opt-in database variables unset. If green, the overall project goal for this lane is complete and no further edits are allowed.