Roadmap: D15 · Workstream D: SQLite and observability
Sequence: PR 15 of 17 (tracking slot; dependencies define execution order)
Roadmap rebaseline: 2026-09-09 · Execution group: W2
Preserve effective runtime policy and reconcile interrupted work across restart
W2 independent execution group
Problem and outcome
Restart needs to preserve durable workflow and QA policy while discarding ephemeral execution authority. Without an explicit reconciliation boundary, an interrupted task can either lose a valid tightened policy or clear newer work when its late result arrives. The outcome of this issue is a single reviewable implementation that makes the stated behavior observable in a supported host and leaves a bounded, operator-understandable result on failure.
Scope and ownership
The planned scope is:
Finish restart semantics atop project ownership: distinguish durable workflow/QA policy from intentionally ephemeral execution authority; reuse shipped plan recovery. Summary ID allocation remains #2576, not this issue.
Implement restart reconciliation on the project-owned state contract from #2667 (Workstream D PR 14 of 17). Distinguish durable workflow state, reviewer/QA policy, and receipts from ephemeral leases, child handles, and in-flight timers. Reuse the shipped plan recovery path and leave summary identity allocation to #2576.
The implementation should preserve existing public identities and contracts unless a criterion below requires a narrowly documented extension. Every changed write, state transition, or host boundary needs a named caller and an owned fixture. Keep unrelated roadmap work out of this PR.
Invariants and delivery contract
- 5 (plan durability): durable policy survives restart while ephemeral authority expires.
- 8 (session state): late generations cannot clear newer state.
One future implementation PR must deliver the production change, focused unit and host tests, the relevant documentation/release fragment, and retained fixture evidence together. No required acceptance criterion may be deferred to a telemetry-only, shared-harness, or separate documentation PR.
Required behavior
The following details make the acceptance testable:
Run a fixture through tightened QA settings, an approved plan, an interrupted execution, a cancelled execution, and an uncertain provider effect. Restart the host, inspect effective settings and plan state, then deliver late old-generation results and a new-generation result. Record the resulting status and receipt links.
Power loss between ledger append and projection update, cancelled children, expired leases, and late provider responses must all remain bounded. Preserve unknowns as unknowns rather than treating absence as success.
Tests and runtime evidence
Assert that durable policy survives restart, expired execution authority does not, and recovery names the owner for each uncertain effect. Verify that a late callback cannot clear a newer task, that repeated restart is idempotent, and that corrupt or partial projections are rebuilt only from the authoritative ledger.
The report must include the exact command or host journey, runtime and host versions, fixture class, start/end status, and bounded logs or manifests needed to reproduce the result. A process exit, a banner, a synthetic response, or a unit-only result is insufficient where a registered host or real handler is named above. Tests must prove the negative and recovery paths as well as the happy path.
Documentation and operational contract
Define durable versus ephemeral fields and the operator-visible reconciliation states. Add restart/inspect commands to the fixture runbook and explain when a human must resolve an external effect.
Add or update the narrowest relevant documentation and release fragment for the behavior this PR introduces. Keep production behavior documentation owned by this PR; consolidation or roadmap documents may link to its evidence after merge.
Dependencies and coordination
Existing issue numbers in the plan retain their meaning. Conditional scenario prerequisites must not block the default path, and a downstream evaluation or documentation consumer must not become an implementation prerequisite. The row is independently implementable with existing identity APIs and its own disposable fixtures; no common new framework or repository-wide CI result is required before review.
Evidence boundary
Source references below are pinned to revision ec76aba5cff2536887a1c90e7bc1dfd8ce04690c. The audit's older executed host/runtime controls were run against the pre-refresh 55/9811 baseline and have not been rerun at this source revision; they are historical evidence only. Re-run the focused controls after implementation and report unavailable historical fields as unknown.
Source anchors:
Non-goals and limits
Do not change summary ID allocation, invent a new ledger, or make restart wait indefinitely for a child or provider.
Do not include private workspace paths, live session identifiers, raw provider payloads, or unrelated trace content in the public issue. Keep fixtures disposable and keep any model or host limitation explicit in the evidence. Closure requires the measurable criteria above and the retained artifacts, not a restatement that the original acceptance was preserved.
Roadmap: D15 · Workstream D: SQLite and observability
Sequence: PR 15 of 17 (tracking slot; dependencies define execution order)
Roadmap rebaseline: 2026-09-09 · Execution group: W2
Preserve effective runtime policy and reconcile interrupted work across restart
W2 independent execution group
Problem and outcome
Restart needs to preserve durable workflow and QA policy while discarding ephemeral execution authority. Without an explicit reconciliation boundary, an interrupted task can either lose a valid tightened policy or clear newer work when its late result arrives. The outcome of this issue is a single reviewable implementation that makes the stated behavior observable in a supported host and leaves a bounded, operator-understandable result on failure.
Scope and ownership
The planned scope is:
Implement restart reconciliation on the project-owned state contract from #2667 (Workstream D PR 14 of 17). Distinguish durable workflow state, reviewer/QA policy, and receipts from ephemeral leases, child handles, and in-flight timers. Reuse the shipped plan recovery path and leave summary identity allocation to #2576.
The implementation should preserve existing public identities and contracts unless a criterion below requires a narrowly documented extension. Every changed write, state transition, or host boundary needs a named caller and an owned fixture. Keep unrelated roadmap work out of this PR.
Invariants and delivery contract
One future implementation PR must deliver the production change, focused unit and host tests, the relevant documentation/release fragment, and retained fixture evidence together. No required acceptance criterion may be deferred to a telemetry-only, shared-harness, or separate documentation PR.
Required behavior
The following details make the acceptance testable:
Run a fixture through tightened QA settings, an approved plan, an interrupted execution, a cancelled execution, and an uncertain provider effect. Restart the host, inspect effective settings and plan state, then deliver late old-generation results and a new-generation result. Record the resulting status and receipt links.
Power loss between ledger append and projection update, cancelled children, expired leases, and late provider responses must all remain bounded. Preserve unknowns as unknowns rather than treating absence as success.
Tests and runtime evidence
Assert that durable policy survives restart, expired execution authority does not, and recovery names the owner for each uncertain effect. Verify that a late callback cannot clear a newer task, that repeated restart is idempotent, and that corrupt or partial projections are rebuilt only from the authoritative ledger.
The report must include the exact command or host journey, runtime and host versions, fixture class, start/end status, and bounded logs or manifests needed to reproduce the result. A process exit, a banner, a synthetic response, or a unit-only result is insufficient where a registered host or real handler is named above. Tests must prove the negative and recovery paths as well as the happy path.
Documentation and operational contract
Define durable versus ephemeral fields and the operator-visible reconciliation states. Add restart/inspect commands to the fixture runbook and explain when a human must resolve an external effect.
Add or update the narrowest relevant documentation and release fragment for the behavior this PR introduces. Keep production behavior documentation owned by this PR; consolidation or roadmap documents may link to its evidence after merge.
Dependencies and coordination
#2667.Existing issue numbers in the plan retain their meaning. Conditional scenario prerequisites must not block the default path, and a downstream evaluation or documentation consumer must not become an implementation prerequisite. The row is independently implementable with existing identity APIs and its own disposable fixtures; no common new framework or repository-wide CI result is required before review.
Evidence boundary
Source references below are pinned to revision
ec76aba5cff2536887a1c90e7bc1dfd8ce04690c. The audit's older executed host/runtime controls were run against the pre-refresh55/9811baseline and have not been rerun at this source revision; they are historical evidence only. Re-run the focused controls after implementation and report unavailable historical fields as unknown.Source anchors:
Non-goals and limits
Do not change summary ID allocation, invent a new ledger, or make restart wait indefinitely for a child or provider.
Do not include private workspace paths, live session identifiers, raw provider payloads, or unrelated trace content in the public issue. Keep fixtures disposable and keep any model or host limitation explicit in the evidence. Closure requires the measurable criteria above and the retained artifacts, not a restatement that the original acceptance was preserved.