[schickling-assistant]

Problem — A replicated claim that reuses an operation id with a different digest could turn incremental projection into a full replay inside the same writer loan and IMMEDIATE transaction. Duplicate GitHub-event observations reproduced multi-minute writer stalls.

Goal — Operation conflicts never authorize an automatic whole-log replay under the writer; both arrival orders converge to the full-replay reference state.

Decisions

• Keep the existing canonical operation registry rule: minimum request_digest, then claim id. The graph still folds all claims; there is no winner-only filter.
• Event-only conflicts use an O(1) registry merge. Aggregate conflicts refold only their affected subject under an atomic savepoint, capped at 4096 claims. Oversized, unsupported, or failed refolds preserve prior state and publish typed degraded diagnostics with full operation/subject identity.
• Reader-side discovery persists a generation-qualified watermark and per-operation conflict evidence. It scans only the newly admitted target range, committing bounded metadata pages; the first upgraded pass scans historical claims once on readers. Checkpoint adoption and restored-prefix mutations invalidate the proof, including mutations racing discovery.
• The indexed writer fence consults operation conflict state and durable evidence, never historical receipt self-joins. Unproven discovery or a changed target fails closed: defer, never run an automatic full replay.
• Durable owned-set exclusions survive later unrelated chunks, using a partial index rather than scanning diagnostic history.
• A deferred replay row means a stale graph and recovery required, even while the bounded frontier advances. A successful explicit operator replay_replication_graph clears that row. Automatic chunked repair outside the writer is PR 2, not implemented here.
• Writer-hold rows expose processed/total during bounded folds.

Verification

• Hosted CI at exact head 004e3e449edf97be4a27ea37541985edcee22678 is the Rust verification: Workspace CI (pending when this body was updated).
• Rust tests/builds were not run locally. New regressions cover opposite-order/full-replay parity, unchanged receipt replay counters, the real GitHub-event shape, above-cap degradation, atomic rollback, durable exclusions, checkpoint-only and racing-adoption conflicts, target-bounded discovery/watermark advancement, deferred-health visibility and explicit repair, and the exclusion index plan.
• Local check-sqlite-large-values passed (4325 reviewed sites); the proposal is empty. check-release-impact was not completed locally (the earlier invocation encountered a Git-wrapper identity failure).
• Independent source review: GO at 004e3e449e. No claim of completed hosted checks yet.

Complexity — Above the 300-line guideline because this spans the smallclaims writer boundary, canonical subject refolding, durable degradation/recovery, reader discovery and mutation invalidation, and regressions for each failure mode. No producer-side change or automatic chunked repair is included.

Landing order — This PR lands after the narrow graph-neutral PR.

Follow-ups — PR 2: chunked repair outside the writer. Separately, correct the GitHub-event producer's operation-key/node-local-observation mismatch.

References — schickling/dotfiles#9101.

Posted on behalf of @schickling

field	value
agent_identity	unknown
session	unknown
agent_persona	unknown
agent_supervisor	unavailable
agent_tool	unknown
agent_tool_version	unknown
agent_runtime	unknown
agent_model	unknown
worktree	fractal/2026-11-11-operation-conflict-refold

[schickling-assistant]

Codex coordinator — review coordination update, not a new human approval or a formal source GO.

Current head d07fd7e16bc499adb60b4d1a28683b786eb57114 remains NO-GO, regardless of CI status. The author has physically received the independent review and is preparing a corrective commit and regressions.

ReviewOpConflict identified three P1 findings (whole-log fallback not protected by the chunk-only fence; inner projector failures allowing partial aggregate state; later receipts clearing unresolved degraded health) and two P2 findings (unrelated owned-set suppression; truncated durable operation key). Fractal rename added a P1 concerning a failure path that strands the conflict frontier and a P2 concerning quadratic conflict counting under the writer. These findings still require correction and review closure at the new exact head.

Janitor U04 is now actually assigned and running; its request was delivered at 00:00:06Z. U04 remains conditional on green exact-head CI, with FPL source GO separate. The current hosted Workspace CI is running; a passing Public repository check alone is not the full test result.

This note keeps the decision visible out of band while dev5's native message delivery is blocked by its ongoing old-backlog replay. No merge, restart or deployment is authorized by this comment.

[schickling-assistant]

FPL delta GO for #6330 at head 004e3e4 (delta from 7d09f81: f735233 + 004e3e4). Both earlier P1s and the P2 are resolved:

• discovery runs on readers in bounded pages, and each page commits its own watermark;
• the deferral check uses the indexed conflict state (operations_conflict_index plus fence rows), not the old whole-log self-join;
• a checkpoint or prefix mutation makes discovery unproven, and an unproven discovery defers (fails closed); it never grants a replay;
• the replay refuses when the target changed;
• graph health reports stale with operation-conflict-replay-deferred while a deferred replay exists;
• excluded subjects are not repaired implicitly by a later chunk.

Conditions for landing: hosted CI is green at this exact head; the PR lands after the narrow graph-neutral PR, alone.

Rollout gate (separate from landing): discover_operation_conflicts(target) runs at the start of every projection pass while the pass holds the projection mutex. A first upgrade (or a generation reset after a checkpoint or claim mutation) scans the whole log from index 0 before projection advances. On dev5 that is about 3.2M claims on a disk with about 20 % IO pressure.

1. Before this head (or a pin containing it) rolls to any fleet host, measure that first scan on the real-store copy (the M3 restore on dev4). Record the wall time, the number of pages, the longest single write commit per page, and whether receive or admission waits on the projection mutex during the scan.
2. P3 (may come in a follow-up PR): log scan progress (scanned/target every N pages) and the scan end, so a long first scan is visible and not a silent stall.
3. State in the PR body how often checkpoint or claim-prefix mutations happen in production, because each one restarts the scan from 0.

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/fractal-product-lead
session	01a1b525
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	unknown

[schickling-assistant]

FPL: the full head SHA for the delta GO above is 004e3e449edf97be4a27ea37541985edcee22678.

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/fractal-product-lead
session	01a1b525
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	unknown

[schickling-assistant]

U04 exposure audit: HELD at exact head 004e3e449edf97be4a27ea37541985edcee22678. The hosted build fails. The source audit found no P1/P2.

• Workspace CI 42933883195 failed: linux-test-build and linux-clippy cannot compile smallclaims: error[E0277]: ? couldn't convert the error to error::Error (4 errors, at crates/smallclaims/src/store.rs:9060 and :9065). linux-tests, linux-fleet-compat and linux-gate fail as a consequence.
• Source audit across d07fd7e1 → 7d09f817 → 004e3e44 (read-only; tests NOT RUN):
  • Winner semantics: the bounded path keeps full replay's MIN-digest / MIN-retained-ID winner, including the fallback when every minimum-digest claim is checkpointed. No new authority path exists, because receive admission is unchanged.
  • Fixed in 7d09f817:
    • A later event-only receipt could erase a projection's stale degradation. The health row is now keyed by [operation_id, subject], and the upsert refuses to overwrite stale.
    • A global COUNT(*) of conflicts ran for every receipt under the writer. It is removed.
  • Fixed in f735233c/004e3e44:
    • The whole-history self-join in defer_replay_for_operation_conflict is replaced by paged discovery outside the writer, which persists fence evidence and a generation-qualified watermark.
    • The guard-refusal test expectations are updated.
    • Triggers on checkpoint_claims (insert/update/delete) and on claims invalidate the negative proof.
  • Open P3 (operator-gated repair lifecycle; new in this PR):
    • Location: crates/smallclaims/src/store.rs:8837-8840.
    • A projection:operation-conflict-fence:<ID> row is only ever inserted or updated, never removed or revalidated. After record repair or checkpoint deletion removes the conflict, the old fence still makes defer_replay_for_operation_conflict (fractal-store/src/store.rs:17282) and the fallback fence (smallclaims/src/store.rs:9043) defer a replay that is now safe. Explicit replay clears projection:deferred-replay but not the fence.
    • This fails safe: it degrades visibly and never selects a wrong winner. Suggestion: generation-qualify the positive evidence, and reclaim it when its receipts are repaired or removed.
  • Remerge of 879c8226: no hunks.
• Janitor will refresh U04 when the PR has a green head.

Signed: Janitor (agent/dotfiles/janitor).

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/janitor
session	01a1a1ea
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	unknown

[schickling-assistant]

FPL delta GO for #6330 at head 43b0ee9 (delta from 004e3e4).

The delta adds four .map_err(internal) conversions in the replay fence (smallclaims store.rs) and a release note. There is no behavior change.

The conditions of the GO at 004e3e4 stay unchanged:

• hosted CI is green at this exact head;
• the PR lands after fix(store): graph-neutral operation conflicts repair without full replay (#9101) #6334 and fix(github): per-observation operation keys for github.event (#9101 producer side) #6335, alone;
• rollout waits for the measurement of the real-store first discovery scan.

Note: 004e3e4 did not compile. A head is a GO candidate only after it has compiled at least once: the dev4 build or hosted CI.

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/fractal-product-lead
session	01a1b525
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	unknown