Cluster: 608 controlled rebuild — 14-PR replay onto a transactional SQLite substrate

[tobyhede]

Current status — read this first

1. CLOSED, 14 of 14 merged. PR 14 landed as docs: describe the SQLite substrate and prove the offline snapshot (PR 14/14) #723 (9d6a578b0, 2026-08-11), with fix: drop the dead docsUrl, name no phantom recover command, and keep the probe out of production #724 and fix(core,cli): verify the stash bearer in the transaction that writes the slot (#666) #725 as follow-ups.
2. The authoritative record is the closure verification comment — 2026-08-12, audited against source on main @ 223c707d9. It supersedes the residual set and several claims in the 2026-08-10 block below.
3. This issue closed with work outstanding. Residual set: Complete the domain-lock deletion: CompletionLock and DelegationLock survive the single-store cutover #690, lifecycle-command-service.ts measures 59.10% on its dedicated tests — 164 undetected mutants CI has never reported #672, rdpath.ts is unreachable by mutation testing: every mutant survives because its only tests spawn the built binary #698, Cross-process interleave test for the pass/fail --claim-id arm: #706 witnesses routing, not isolation #707, exec_start_id / owner_start_id are declared, CHECK-constrained, and never written — recovery compares PID only #722. (stash --claim-id commits under a rotated bearer: resolve and mutate are separate transactions #666 is closed, via fix(core,cli): verify the stash bearer in the transaction that writes the slot (#666) #725; exec_start_id / owner_start_id are declared, CHECK-constrained, and never written — recovery compares PID only #722 was never added here.)
4. Every table and checklist below is superseded in place, not rewritten. Earlier dated blocks are retained for provenance and several of them are wrong.
5. When two blocks disagree, the newest dated one wins — including over the progress checklist, which has gone stale before.

Execution tracker for the 14-PR controlled rebuild that lands the #608 fix (atomic claim check-then-act) on a transactional SQLite substrate.

Plan: docs/superpowers/plans/2026-07-23-608-controlled-rebuild.md, plus one dated per-PR plan (2026-07-23-608-pr01…pr14).

Standing constraints (from the parent plan — restated because they bind every PR):

• One dependent implementation PR open at a time. Merge before branching the next from freshly fetched origin/main.
• Salvage tag 608-salvage-2026-07-23 (peeled to 5364e3965) is immutable. Salvage commits are evidence, never merge bases.
• Every PR: named tests + pnpm run test:mutate:changed (optionally package-scoped or --related-tests) + pnpm run verify, all exit 0. Manual source scopes use package-relative changed-line ranges with --force. Mutation evidence must report non-zero instrumented sources/mutants and disposition every in-scope survivor or NoCoverage result; unscoped campaigns are forbidden.
• RunbookState.schemaVersion stays 1. No migration, hydration, shim, or dual-read of incompatible persisted JSON.
• Dated plan files are immutable in CI (check:docs:dated-immutable). Deviations get recorded in a new dated addendum, here, and in the PR description; never edit an existing dated plan.

Progress

• PR 1 — SQLite driver substrate (feat(core): add SQLite driver substrate (608 rebuild, PR 1/14) #637)
• PR 2 — Transactional RunbookStore (feat(core): add transactional SQLite runbook repository (608 rebuild, PR 2/14) #640 → relanded feat(core): add transactional SQLite runbook repository #643)
• PR 3 — Execution ownership and XState recovery model (feat(core): add fenced execution ownership and recovery #645)
• PR 4 — Guarded actor commit seam (refactor(core): fence actor computation and persistence #649)
• PR 5 — SQLite persistence staging (not production cutover) (refactor(core): stage run and session persistence on SQLite #651)
• PR 6 — Claim liveness, single-controller rule, typed claim taxonomy (fix(core): enforce delegated claim liveness and one controller #652)
• PR 7 — Transaction-local guarded parent advance (fix(core): make guarded parent advance atomic #655)
• PR 8 — Recovery and storage hardening (fix(core): harden recovery and storage lifecycle #661)
• PR 9 — Typed session ownership refusals (fix(core): type session ownership refusals #667)
• PR 10 — Atomic initial claim and parent link (Make initial delegation claim and parent link atomic #668)
• PR 11 — Route effectful lifecycle commands through execution fencing (Fence lifecycle mutations across execution and recovery #669, mutation gaps closed by Close the mutation gaps from the lifecycle execution fence #671)
• PR 12 — Make delegate, collect, and abort transactional (feat(core): make delegation workflows transactional #673, transactional collect by feat(core)!: make rundown collect transactional #687)
• PR 13 — Single production cutover; delete domain locks (refactor(core): make SQLite the sole state authority #674)
• PR 14 — WebContainer, schemas, docs (docs: describe the SQLite substrate and prove the offline snapshot (PR 14/14) #723; release scope withdrawn 2026-08-10, see below)
  • rdpath.ts is unreachable by mutation testing: every mutant survives because its only tests spawn the built binary #698 (rdpath.ts unreachable by mutation testing) did not block PR 14. See the 2026-08-08 audit below: it poisons only the unscoped pnpm run test:mutate, which the correction ledger already forbids PR 14 from running, and PR 14 touches no plugin source. Carve it out explicitly in the evidence section.

Post-PR7 audit corrections — 2026-07-27

Progress is verified at 7 of 14 merged. The authoritative mainline sequence is #637 → #643 → #645 → #649 → #651 → #652 → #655. #640 merged into PR1's feature branch; #643 is the slot-2 merge that reached main.

New immutable corrections:

• docs/superpowers/plans/2026-07-27-608-pr08-addendum-current-main-adaptations.md — PR8 selective-hunk replay, truthful recovery recording, current site layout, and current mutation gates.
• docs/superpowers/plans/2026-07-27-608-pr09-pr14-correction-ledger.md — architectural, result-contract, build-order, mutation, and seven-path traceability corrections for PR9–14.

Binding audit decisions:

• PR8 remains next, but its twelve salvage commits are hunk-level evidence; exact replay is prohibited.
• PR9 owns uppercase EXECUTION_IN_PROGRESS / RECOVERY_REQUIRED registration and atomic claim-aware stash, including a bearer-rotation interleave.
• PR10 must derive the parent snapshot through XState; storage validates CAS and atomically persists it with the claim. SQLite schema version 3 is allowed when the database shape changes; persisted RunbookState.schemaVersion remains exactly 1.
• PR11 must test the real committed-but-unobserved crash boundary and all pass/fail/goto/complete/stop effect classes, including multi-run terminal behavior.
• PR12 must use typed machine events/actors and machine-derived persistence, reuse acquireAll, and treat refactor(core): return the linkage-cycle trip instead of pushing it through the onLinkageCycle sink #656's linkage-cycle return as already-merged regression coverage.
• PR13 must put legacy refusal in StoreRegistry's sole opener and use precise residual searches that allow plugin locks and output artifacts.
• PR14 verifies the actual built sql.js snapshot and schema/docs parity; it does not assume a missing runtime or run unscoped mutation.
• Unify transaction-local delegation liveness with canonical classification #659 tracks refusal-biased delegation-liveness semantic drift separately and is nonblocking for the seven-path Claim check-then-act is not atomic: unlocked session reads used as mutation authority across 7 paths #608 repair.
• Draft PR SQLite claim-concurrency (#608) — integration (stack merge target) #625 is superseded by this controlled rebuild and must not be used as a merge vehicle.

Implementation PRs remain serial: PR8 → PR9 → PR10 → PR11 → PR12 → PR13 → PR14.

Post-PR8 status verification — 2026-07-30

Supersedes the 2026-07-27 block's progress count and next-PR statement; every other binding decision above stands.

Progress is verified at 8 of 14 merged. PR8 is #661, merged 2026-07-29 at merge commit 43d25a231. The authoritative mainline sequence is #637 → #643 → #645 → #649 → #651 → #652 → #655 → #661. PR9 is next.

PR8's landing was verified against code on main (b5ba0c92b), not against its PR description. All six claimed deliverables are present:

Deliverable	Evidence on main
Strict recovery-reason validation	packages/core/src/runbook/execution-recovery-service.ts:148
recoveryRequired hydration + GOTO substep reset	packages/core/src/runbook/actor-service.ts:723, compiler.ts:2467-2531
Atomic recovery-attempt commit	packages/core/src/runbook/storage/runbook-store.ts:1312-1352
Typed sql.js startup failure	packages/core/src/runbook/storage/driver-factory.ts:73
Store close/reopen serialization	packages/core/src/runbook/storage/store-registry.ts:218-245
Extended SQLite BUSY/LOCKED codes	packages/core/src/runbook/storage/native-sqlite-driver.ts:90-104

PR9 base drift since PR8

Four merges landed after #661. Three of them move surfaces PR9's write-once plan assumes are untouched, so the plan's cherry-pick gate cannot hold as written:

• fix: refuse a caller/target bearer divergence under its own code #663 (bearer divergence refusal, runTransition silently ignores a caller/target bearer mismatch, authorizing as the target #613) — inserted CLAIM_BEARER_MISMATCH into CLISymbolicErrorCodeValues at packages/core/src/output/zod-schemas.ts:64, the exact registry PR9 extends with EXECUTION_IN_PROGRESS / RECOVERY_REQUIRED. It also extended the error tables in docs/reference/cli.md and docs/spec/cli-output.md that docs-error-code-drift.repo-asset.test.ts guards — PR9 must add rows in the same shape or that guard fails. lifecycle-command-service.ts gained ClaimBearerMismatchRefusal and a single reconcileClaimTarget() reconciler, which is the seam PR9's typed refusals flow through.
• fix(core): close two defects in the recovery durability path #664 (durability close + epoch branding) — re-typed RecoveryOutcome.epoch from number to branded ExecutionEpoch and removed an unreachable refusal fallback. PR9's result union must adopt the brand, not reintroduce number.
• chore(deps): bump the minor-and-patch group with 8 updates #658 (dependabot + Biome 2.5.4) — reformatted many of the test files inside PR9's planned 42-path cherry-pick of a823892fe, including session-service.test.ts and storage/runbook-store.test.ts. The plan's "git diff --name-only --diff-filter=U must print nothing" gate will not hold without conflict resolution.
• fix(lint): exclude Claude Code worktrees from typed lint (unbreaks verify) #665 (eslint ignores Claude worktrees) — no functional overlap; required in PR9's base for pnpm run verify to pass when worktrees exist.

Untouched since PR8, as the plan assumes: runbook-store.ts, session-service.ts, state.ts, packages/core/src/events/types.ts, packages/core/src/runbook/index.ts, and the CLI stash/pop commands.

No PR9 work exists yet. EXECUTION_IN_PROGRESS and RECOVERY_REQUIRED appear in neither zod-schemas.ts nor errors/codes.ts. origin/608-pr9-remediation and origin/608-pr10-coverage are pre-rebuild salvage evidence from the superseded stack (closed PRs #634/#635) and must not be used as merge bases.

Seven-path atomicity status — what "8 of 14" does not mean

The checklist counts merged PRs, not closed paths. Audited against source on b5ba0c92b: the transactional seam is built but not yet wired into any production path. RunbookStore.captureAuthority / captureRunAuthority / saveState / commitOwnedState, SqliteExecutionLeaseService, CoreEffectfulMutationExecutor, and RunbookStoreActorCommitter have no non-test callers — every reference is under packages/core/__tests__/. Production mutations still route RunbookStateManager → RunbookStore.mutateState → writeStateAtVersion, whose CAS is state_version + exec_token IS NULL only (storage/runbook-store.ts:1233). The claim-generation CAS is reachable only from saveState (:1489). The store's docblock states the consequence at :946: callers "MUST NOT treat a committed result as evidence that their authority was still valid at commit time."

#	Path	Atomic?	Assigned
1	goto	No — separate resolve and write, no claim CAS	PR11
2	collect	No — 3+ transactions; verifyClaimId checks bearer/grants only	PR12
3	pass/fail --claim-id	No — guardOpenChildren is false on the claim arm (lifecycle-command-service.ts:1640)	PR11
4	complete/stop --claim-id	No — force→report→release cascade across three transactions	PR11
5	abort	No — DelegationLock does not exclude claim mutation	PR12
6	delegate fresh/retry	No — narrowed only; source says so at lifecycle-command-service.ts:1026-1029	PR12 (using PR10)
7	bare / --run pass/fail	Partial — open-delegated-children predicate now evaluated in the decisive write's transaction	PR7 ✅ + PR11

Only path 7 has a deterministic interleave test (session-service.test.ts:1790). Paths 1–5 have none; the delegate tests at lifecycle-command-service.test.ts:865/:1515 fire inside the injected lock acquire, i.e. before #revalidatePresentedClaim, so they pin the narrowing rather than the residual window.

SessionLock and RunStateLock now have no production instantiation. DelegationLock and CompletionLock remain wired (packages/cli/src/helpers/lifecycle-seam-factory.ts:75,79; completion-service.ts:492,621,738; packages/cli/src/commands/abort.ts:93), so #608's two-lock-domain root cause survives until PR13 — and deleting them before PR11/PR12 land would remove today's narrowing with nothing replacing it. Several comments still read "SessionLock is not held" (lifecycle-command-service.ts:1027, :2259, collection-service.ts:292); the wording is stale, the claim remains true.

PR9 plan corrections beyond the ledger

Recorded in full in docs/superpowers/plans/2026-07-30-608-pr09-addendum-current-main-adaptations.md (seven deltas plus task order); it lands with PR9's branch. Summary follows.

Trial cherry-pick of a823892fe onto b5ba0c92b: 42 paths touched (the plan's count is correct), 10 conflicted, 32 clean. Every conflict resolves against the salvage — current main is newer in each. The salvage is a shape change (T → SessionMutationResult<T>) that must be re-applied over main's bodies, never a body replacement. Two are outright regression traps:

• session-service.ts:1369 unstashForClaimId — HEAD carries the post-fix(core): make guarded parent advance atomic #655/refactor(core): return the linkage-cycle trip instead of pushing it through the onLinkageCycle sink #656 taxonomy (superseded / missing-child / terminal-child / child-linkage-mismatch / parent-missing, classifyDelegationLiveness, tombstone-aware ctx.claim()). Replaying the salvage body regresses merged behaviour. Change only the wrapper and return type.
• lifecycle-command-service.ts:1901 — the salvage drops code from stale_claim, an RD-825/fix: refuse a caller/target bearer divergence under its own code #663 regression. Keep HEAD's return; apply only the refusal guard.
• session-service.test.ts:1794 asserts 'superseded'/'parent-ended' on main; the salvage asserts 'missing-claim'. Taking the salvage silently regresses the taxonomy.

Three corrections the plan lacks entirely:

1. GuardedMutationResult<T> already is SessionMutationResult<T>. storage/mutation-result.ts:223-234 defines both refusal arms field-for-field (only status→kind and kebab→snake differ), and ExecutionEpoch is already branded by fix(core): close two defects in the recovery durability path #664. Derive an Extract<> alias; do not create a parallel union. The salvage's lowercase wire values ('execution_in_progress' as an emitted code) must be discarded per ledger line 58.
2. Allowlist is 49, not 42. Seven paths break on tsc or are ledger-mandated: packages/claude-code-plugin/__tests__/helpers/test-utils.ts:306, core/__tests__/runbook/guarded-drain-composition.test.ts:152,183, core/__tests__/runbook/storage/fixtures/session-writer-child.ts:70-81, .../fixtures/child-protocol.ts, core/__tests__/testing/session-fixtures.test.ts:39, plus packages/core/src/output/zod-schemas.ts and docs/spec/cli-output.md. The plan's self-review item "Exactly 42 changed paths" must be amended to 49 or the gate blocks correct work.
3. Build ordering and schema coverage are absent. pnpm run build must run between the core and CLI test steps (CLI resolves core through dist). Registration of the two codes gets zero mutation signal — packages/core/src/output/** is inside core's Stryker exclusion, and OutputEmitter.error takes string, so an unregistered code typechecks and passes verify. The only gate is docs-error-code-drift.repo-asset.test.ts, which requires the docs/spec/cli-output.md fence to land with the registry entry. No intersection with CLI emits at least 10 error codes absent from the closed ErrorCodeSchema enum #662's twelve codes — PR9's two are new.

The plan's §85 whole-file Stryker campaigns are forbidden by current policy (runbook-store.ts alone is ~1450 LOC and has run 17+ minutes without finishing), as is its instruction to delete reports/stryker-incremental.json. Use pnpm run test:mutate:changed.

One retained salvage item is load-bearing: the added driver-contract.test.ts case asserting the trigger-abort message is exactly execution_in_progress across both drivers. mutateSessionGuarded normalizes on exact string equality, and main's only existing assertion is a regex against the store-thrown error, not the SQLite RAISE(ABORT). Land that test before or with the normalizer, or a decorated raise text silently turns the refusal into a crash.

Decided — atomic claim-aware stash is split to #666

Resolved 2026-07-30 under the correction ledger's split clause (lines 60-68). The slice is removed from PR9's scope and tracked in #666, blocked on PR9. #608's closure guarantee has been narrowed in the same action to exclude stash --claim-id and point at #666. PR9's scope is now the typed-refusal slice only: 49 paths, zero behaviour change.

Rationale: PR9's typed-refusal work is a mechanical rewrap across 42 files with no behaviour change, whereas the stash slice is a new authority protocol with new refusal semantics — mixing them makes the diff unreviewable against its own allowlist gate. The stash slice consumes the mutateSessionGuarded primitive PR9 introduces, so it sequences naturally after. And stash --claim-id is an eighth path, not one of #608's seven.

The gap is confirmed real. stash --claim-id resolves the bearer in an unlocked read (stash.ts:30 → session-service.ts:858), then mutates in a separate transaction (stash.ts:70 → session-service.ts:1343) whose only check is targetedByClaim (:1352) — "does some claim control this run", never which one. Since mintRunControlClaim (:489) deletes and re-inserts for the same run, a rotated-out bearer still satisfies it. pop --claim-id is already correct (unstashForClaimId verifies the secret in-transaction at :1396); this brings stash to pop's standard. A second consumer is documented in code at lifecycle-command-service.ts:1025-1028, which names #608.

Full defect analysis, scope, and the required rotation-interleave evidence are in #666.

Post-PR9 status verification — 2026-07-30

Supersedes the 2026-07-30 PR8 block's progress count and next-PR statement; every other binding decision and correction remains in force.

Progress is verified at 9 of 14 merged. PR9 is #667, merged 2026-07-30 at merge commit 03c11cfb3. The authoritative mainline sequence is #637 → #643 → #645 → #649 → #651 → #652 → #655 → #661 → #667. PR10 is next. The remaining implementation order is PR10 → PR11 → PR12 → PR13 → PR14.

PR9 landed the typed-refusal slice only. Atomic claim-aware stash --claim-id remains split to #666; PR9's merge unblocks that follow-up, but it remains outside #608's seven-path closure and does not replace PR10 in the serial chain.

The delegation-retry review finding from #667 does not expand PR10. PR9's ordering fix prevents a refused child release from superseding the pending outcome first, but delegate retry remains a multi-transaction sequence. Its transactional closure remains assigned to PR12 together with delegate, collect, and abort.

Post-PR13 status verification — 2026-08-08

Supersedes the 2026-07-30 PR9 block's progress count and next-PR statement, and replaces the seven-path table in the 2026-07-30 PR8 block above, which is PR8-era and no longer describes main. Every other binding decision and correction remains in force.

Progress is verified at 13 of 14 merged, audited against source on main @ 0a921937c, not against PR descriptions. The authoritative mainline sequence is #637 → #643 → #645 → #649 → #651 → #652 → #655 → #661 → #667 → #668 → #669 (+#671) → #673 (+#687) → #674. PR14 is next, and is the last.

The checklist above went four PRs stale between 2026-07-31 and 2026-08-08. Treat the dated blocks, not the checklist, as authoritative when they disagree.

Seven-path atomicity status — all seven now closed

Atomicity bar: one decisive BEGIN IMMEDIATE transaction whose first act is a claim compare-and-swap, refusal rolling back with nothing written.

#	Path	Atomic?	Closed by
1	goto	Yes	PR11 (#669, f3e94d9ec)
2	collect	Yes	#687 (a9c07a85a)
3	pass/fail --claim-id	Yes	#700 — the last one; see below
4	complete/stop --claim-id	Yes	PR11 (f3e94d9ec) — was three transactions
5	abort	Yes	PR12 (#673, ed461d7a1)
6	delegate fresh/retry	Yes	PR12 (#673, 3f9fa37cf)
7	bare / --run pass/fail	Yes	PR7 (#655, 106b099bc) + PR11

Path 3 was not closed by PR11 as the PR8-era table assigned it, and no document on main recorded that until #700. guardOpenChildren was computed from the resolution shape and excluded claim-shaped resolutions, so the arm took the unguarded branch and no ParentAdvanceGuard reached commitOwnedState. The line was semantically unchanged from the PR8 finding, surviving PR8 through PR13 unremarked.

It was also the arm that matters rather than a residual one: a bare mutation on a delegation-exposed run is refused ACTOR_CONTEXT_REQUIRED and --run cannot carry a bearer, so --claim-id is the only invocation the post-R1 protocol leaves an orchestrator — the guarded shapes were the ones it could not reach. PR11's fence does not cover it transitively, because claimRunbook bumps neither the parent's state_version nor its claim_generation.

PR13 landing verification

All claimed deliverables are present on main:

Deliverable	Evidence
paths.ts free of the six removed symbols	packages/core/src/paths.ts; zero repo-wide hits outside the changeset and dated plans
No production JSON run/session reader or writer	new RunbookStore(...) appears once, storage/store-registry.ts:294
SessionLock / RunStateLock deleted	Source files absent; only plugin-local PluginSessionLock survives
runbook_started.statePath removed	packages/core/src/events/types.ts:37-43; run identity now RunbookMetadata.runId
WAL check + bounded retry	native-sqlite-driver.ts:240-302; 11 attempts, 25→250 ms as claimed
RD-306..309 registered	errors/codes.ts:127,135,150,172
New barrel exports	All seven present in runbook/index.ts / paths.ts

CompletionLock and DelegationLock survive at exactly six production call sites, matching #690. The PR8-era sites cited above (lifecycle-seam-factory.ts, abort.ts) are gone.

Open items carried into and past PR14

• RD-306..309 are documented nowhere. Registered in codes.ts but absent from every file under docs/ outside superpowers/. The drift guard is one-way (documented ⊆ registered) so it passes vacuously — this is real PR14 scope.
• PR14's plan has largely dissolved. Of its 22 tasks, 8 are already done and 6 are invalidated by the ledger or by PR13 solving them differently. What remains: docs/internal/architecture.md (980 lines with zero SQLite/lease/transaction/recovery content — the descriptive-doc debt of PRs 1–13), the error-code docs above, docs/spec/language.md:838-839, and cutting an actual 2.0.0 release (four pending changesets, three major, packages already published at 1.0.0). A new dated addendum is mandatory; check:docs:dated-immutable forbids editing the plan.
• Two items PR14's plan mislabels as tests are unimplemented work, and should be carved to linked issues rather than done inline: exec_start_id / owner_start_id are declared and CHECK-constrained but never written, so recovery compares PID only and PID reuse means a dead owner is never recovered; and every typed error emits a rundown.dev/docs/errors/<slug> URL with no such route.
• Cluster: 608 controlled rebuild — 14-PR replay onto a transactional SQLite substrate #648 cannot close on PR14 alone. Residual set: Complete the domain-lock deletion: CompletionLock and DelegationLock survive the single-store cutover #690 (lock deletion, explicitly PR14-excluded), lifecycle-command-service.ts measures 59.10% on its dedicated tests — 164 undetected mutants CI has never reported #672 (lifecycle-command-service.ts mutation coverage), Frame entry has two writers in the wrong order: machine-stamped credential.parentEntry lags committed state #680, Retry idempotency: delegate --retry re-mints unconditionally on replay #681, rdpath.ts is unreachable by mutation testing: every mutant survives because its only tests spawn the built binary #698, stash --claim-id commits under a rotated bearer: resolve and mutate are separate transactions #666 (eighth path, excluded from the closure guarantee by the 2026-07-30 decision above). State this in the closure comment rather than letting the checklist imply completeness.
• Lock-order proof omits the live DelegationLock → SessionLock edge #609 is obsolete — the lock-order proof it describes no longer exists and SessionLock was deleted by refactor(core): make SQLite the sole state authority #674. Close it.
• mutateState's CAS retries 8 times with no backoff (runbook-store.ts:89, loop at :1230-1262), so concurrent_modification now surfaces to the user where the deleted file lock would have blocked and won. Decide before release.

Post-PR13 audit corrections — 2026-08-10

Supersedes the 2026-08-08 block's path-3 attribution, residual set, and release scope. Every other binding decision and correction above remains in force. Audited against source on main @ a7a99c566, with each finding independently re-verified by an adversarial pass instructed to refute it.

Progress is unchanged at 13 of 14 merged. PR14 is still next, and is still the last.

Mainline since the 2026-08-08 baseline

0a921937c is the merge commit of #699 — it is the audit baseline itself, not a PR that landed after it. Five merges followed:

PR	Merge	Closes	What it changed
#701	f4edbeeb6	#680, #681	Machine becomes the single writer of frame entry (removes all 13 external deriveActiveEntry/ensureActiveEntry call sites, incl. two Category-B leaks in packages/cli/src/services/execution.ts); delegate --retry idempotency via resolveRetryIssuance; RD-826/827/828 registered and documented
#705	0b58b0d94	#702	Goto interleave witness; extracts isDelegatedChildClaim; drops the dead guardOpenChildren CLI transition-context field
#706	ff8ce5ad9	#700	The path-3 fix (below)
#708	106421f7d	—	Pins that isDelegatedChildClaim reads linkage, not grants
#709	a7a99c566	#703	Re-lands #704, which merged into an already-merged branch and never reached main

Numbering traps, both of which the 2026-08-08 block fell into: #700 is an issue, closed by PR #706. #704 is a PR that never reached main; the issue it addressed is #703, closed via #709.

Correction — the path-3 row asserted a fix that did not yet exist

The 2026-08-08 seven-path table reads | 3 | pass/fail --claim-id | Yes | **#700** — the last one |. Both halves of that cell are wrong:

• pass/fail --claim-id never arms the in-transaction open-children guard: #608 path 3 is not closed #700 is the issue, not the fix. The correct attribution is PR fix(core): guard the --claim-id arm against a racing child claim #706, merge commit ff8ce5ad9, merged 2026-08-09T02:34:29Z.
• It was not true at the commit the block claims to audit. At 0a921937c the guard read const guardOpenChildren = (ready.kind === 'default' || ready.kind === 'run') && !targeted; — ready.kind === 'claim' is absent from the disjunction. git merge-base --is-ancestor 0a921937c ff8ce5ad9 is true; the fix landed 19½ hours later. The table cell asserted a future state as verified, which is the exact failure mode the block's own methodology note disclaims.

The block's surrounding prose is defensible — "no document on main recorded that until #700" is true of the issue. Only the table cell is wrong.

Current source: packages/core/src/runbook/lifecycle-command-service.ts:2569-2570.

Seven-path atomicity — re-verified, with the bar restated

All seven paths meet the bar on a7a99c566. Paths 2 and 5 were re-verified specifically because they aggregate through runAll/commitOwnedRunSet rather than the single-run path: runbook-store.ts:1159 opens one transaction, :1166-1172 classifies every member before :1174-1176 writes any, and classifyCommitRow (:397) checks claim presence/control/status (:406-412) and generation equality (:413-419) ahead of state_version (:434) and execution identity (:441). Session release is folded into the same transaction (:1177-1181).

The bar as previously phrased overstates two things. Restated:

• "One transaction" applies to the decisive write only. The real shape is one decisive commit behind a three-transaction lease fence — capture (effectful-actor-mutation-runner.ts:354-355), lease.acquireAll (effectful-mutation-executor.ts:336), markEffectStartedAll (:344), then commitOwnedRunSet (:380).
• "Nothing written" should read "nothing authority-bearing written." Every path commits a recordClaimSeen liveness row beforehand, in its own transaction, deliberately — rationale at collection-service.ts:507-525. It is inert for authority because the schema triggers exclude last_seen_at from the generation bump (see the PR4 deviation note above).

The sql.js driver is not a caveat on the bar. sqljs-driver.ts:251 does issue a plain BEGIN rather than BEGIN IMMEDIATE, but exclusion comes from runLocked (:299-309) plus the load→BEGIN→work→COMMIT→persist→close cycle holding the file lock throughout; the CAS-before-write ordering lives in commitOwnedRunSet, not the driver, so it is identical on both. driver-factory.ts:97-105 additionally refuses sql.js off-WebContainer. Do not record this as "the bar holds only on native" — that would misdirect a future WebContainer audit.

Path 1 should also cite #705 (0b58b0d94) as the source of its in-transaction interleave witness (lifecycle-command-service.test.ts:5235).

Path 3 carries a live caveat: its witness proves routing, not isolation, recorded in-code at packages/core/__tests__/runbook/claim-test-helpers.ts:110-121 — "would still pass if SQLite offered no isolation whatsoever." That is #707, a coverage gap, not a defect: runGuardedParentAdvance opens no transaction and performs no CAS (session-service.ts:1489-1490 calls it a "cheap pre-check fast-path"); all authority is in assertParentAdvanceAllowed inside commitOwnedState's transaction.

Correction — the residual set

The 2026-08-08 list (#690, #672, #680, #681, #698, #666) is stale in both directions.

Issue	2026-08-08	Actual
#690	residual	OPEN — still residual
#672	residual	OPEN — still residual, and see CI note below
#680	residual	CLOSED 2026-08-08 by #701
#681	residual	CLOSED 2026-08-08 by #701
#698	residual	OPEN — still residual
#666	residual	OPEN — still residual
#707	not listed	OPEN — add

#609 is not promoted into this set. The 2026-08-08 block already adjudicated it obsolete and instructed "Close it"; that decision stands and is re-confirmed (the proof block at lifecycle-command-service.ts:2312-2343 has zero hits, session-lock.ts/run-state-lock.ts are deleted, all three cited call sites are structurally impossible). One precondition before closing: #690's body names the surviving DelegationLock → CompletionLock edge against #drainSubstepObservations, which has zero hits repo-wide. Its acceptance item is therefore vacuously satisfied and will prompt nobody. Restate it against the live path — completion-service.ts:1175 → :1236 → :1076 — then close #609.

Explicitly out of the residual set, and why. #684, #685, #675, #676, #677, #659, #662 are all open and all self-identify as deferred from or surfaced by this cluster. They are not blockers on closing #648: none is one of the seven paths, and each is independently tracked. Enumerating the residual set without saying this is what let the previous list go stale.

Release scope — deprioritised by maintainer decision, 2026-08-10

The 2026-08-08 block lists "cutting an actual 2.0.0 release" as PR14 scope. That is withdrawn. Rundown is not near release; treating changesets as a gate generates noise rather than signal.

Recorded for whenever the release track resumes, so it is not rediscovered: .changeset/ holds five changesets (not four — #706 added claim-arm-open-children-guard.md on 08-09), all five packages are in one fixed group so everything lands on 2.0.0, and release PR #636 already contains the generated output. Coverage is 5 changesets against 372 merge PRs since @rundown-org/core@1.0.0 (e2dbb00cc, 2026-01-20), with 14 of 15 breaking-marked commits uncovered. Also note #701's ! marker was erased by the squash-merge (branch commit aedbf2d50 carries it; the merged PR title does not), so conventional-commit breaking markers are not durable in this repo's merge flow. Do not merge #636 until the release track is deliberately resumed.

PR14 scope, re-derived against source

Of PR14's ~22 decomposed tasks: 7 done, 7 invalidated by the correction ledger, 8 remaining. In priority order, what actually remains:

1. Rewrite docs/internal/architecture.md — the descriptive-doc debt of the entire rebuild, and by far the largest item. Now 1130 lines (the 2026-08-08 block's "980" is stale; it grew via fix(core): make the machine the single writer of frame entry, and make delegate --retry idempotent #701 without gaining storage content), with zero occurrences of SQLite, rundown.db, BEGIN IMMEDIATE, CAS, state_version, exec_token, mutateState, lease, or any domain lock. It is not merely silent but actively false: :20 states | **Persistence** | JSON files | and :30 diagrams [CLI Commands] <---- [Persisted JSON], both falsified by refactor(core): make SQLite the sole state authority #674. No qualifying or historical context surrounds either. docs/reference/runtime.md is already correctly cut over, so this is single-file debt.
2. Document RD-306..309. Still zero hits under docs/ outside superpowers/. The drift guard is one-way by design (docs-error-code-drift.repo-asset.test.ts:12-16), reads only docs/spec/cli-output.md, and parses only ```json fences — so the prose table in docs/reference/cli.md:1238-1244 is ungoverned in both directions. Adding them to `cli-output.md` is what arms the guard.
3. Fix docs/spec/language.md:872-874 (was :838-839; shifted +34). The no-migration MUST NOT is scoped to .rundown/runs/, which post-cutover holds only captured outputs — the normative rule binds the wrong directory and does not bind the database at all.
4. Add a real offline snapshot proof. site/tests/sqlite-substrate.spec.ts:13-15 states outright that it mounts its own files rather than loading public/rundown-snapshot.bin; runbook-runner.spec.ts is unchanged since 2026-01 and asserts one scenario reaching COMPLETE with no sql.js assertion and no pass/fail/goto. This is the ledger's :144 requirement, unmet. Also git mv the probe to site/src/pages/dev/.
5. WebContainer/sql.js bundling needs no work. The ledger was right: sql.js is a hard dependency of core and site/scripts/prune-sqljs.mjs:148-171 throws if a declared entry point or a retained loader's .wasm is missing.

A new dated addendum under docs/superpowers/plans/ is mandatory before PR14 starts — check:docs:dated-immutable forbids editing the PR14 plan. Note that check runs only in CI, not in the verify fan-out, so a local verify will not catch an edit to it.

Carved to linked issues

Per this issue's own instruction that such items "should be carved to linked issues rather than done inline":

• exec_start_id / owner_start_id declared and CHECK-constrained (storage/schema.ts:106,200,113-116) but every production write is NULL. Confirmed not redundant: recoverDeadOwner returns {kind:'alive'} at execution-lease.ts:577 and never reaches the token/epoch CAS at :660-666, so epoch and token do not disambiguate the liveness decision. Worse, isProcessAlive fails toward alive on any non-ESRCH error (file-lock.ts:106). Failure mode is a permanent stall, not a safety break.
• The typed-error documentation URL. Correction to the 2026-08-08 wording: the problem is not a missing route. site/astro.config.mjs:20 sets site: 'https://rundown.cool'; rundown.dev does not resolve at all. rundown-error.ts:88 emits it, and wrapper.ts:178 puts it in the default JSON error envelope, so every typed error ships a dead link. The fix is the URL, not a site route.
• docs/reference/cli.md:1241 instructs operators to "resolve the interrupted attempt through recovery", but no rundown recover command exists and recovery is automatic, performed by the command that emits the error (effectful-actor-mutation-runner.ts:300-315). Documentation-parity defect.

Note on #672 and CI

#672 persists partly because CI structurally cannot report it. The Mutation Testing producer has never uploaded a baseline since it was sharded on 2026-07-02: 8 scheduled runs, 5 cancelled, 3 failed, zero successes. The cause is scope, not time — scripts/mutation-shard-plan.mjs:261-275 emits whole-file scopes (the failing matrix entry was lifecycle-command-service.ts, 4068 lines) at a flat STRYKER_CONCURRENCY: 4, while the repo's own local policy drops to 1 above 1000 lines. Raising the timeout is a no-op: mutation.yml:96 is a step-level 60-minute timeout beside the job's at :69. Tracked under #670, whose scope needs extending from mutation-pr.yml to this producer.

Recorded deviations

PR 4 — required adaptations to current main

Verified by a full trial replay of 64f840ded a39701d6e 785a3eabb e203ec905 onto 464e94ee1. Three deviations from the plan as written; all three are adaptations to work PR 2/PR 3 already landed, not changes to PR 4's intent.

1. schema.ts conflict in 785a3eabb — resolve in favour of HEAD.

785a3eabb narrows claims_guard_update / claims_bump_gen_update to resolution-affecting columns so a last_seen_at refresh (#519 liveness) is neither refused under ownership nor bumps claim_generation. Current main already does this: 9080c1849 (PR 2) landed BEFORE UPDATE OF key, controlled_run, secret_hash, issued_generation, status, parent_run_id, parent_linkage_version, delegation_json, grants_json, which already excludes last_seen_at and updated_at.

The incoming list is a strict narrowing of main's — it additionally drops key and issued_generation. Taking the incoming side would silently weaken a guard main deliberately holds: rotating a claim's lookup key or issued generation under an active execution owner would stop being refused and stop bumping claim_generation.

Resolution: keep HEAD's column list on both triggers. Keep the commit's two explanatory comments if desired. Keep the commit's tests — they pass against main's schema unchanged, and they are the thing that actually pins the last_seen_at behaviour.

2. Three cherry-picked tests violate PR 3's execution-identity CHECK.

785a3eabb and e203ec905 add tests that simulate an owner with UPDATE runs SET exec_token = 'sha256:live'. PR 3 made the identity columns all-or-nothing (exec_epoch/exec_pid/exec_token together, epoch naming a real execution_attempts row), so those three fail with CHECK constraint failed:

• mutateState … › refuses immediately while an execution owns the run
• session persistence and run listing › refuses to delete a run with an active execution owner
• tombstone preservation (#519 lastSeenAt survives) › records claim activity even while the run has an active execution owner

Fix: use the takeOwnership(txn.tx, state.id) helper already in runbook-store.test.ts (added by PR 3 with a docblock warning against exactly this). Mechanical — three call sites.

3. readRunWithVersion parameter type.

e203ec905's mutateState calls this.readRunWithVersion(tx, runId) inside driver.read(...), but declares the parameter as SqlTransaction. PR 1/3 introduced the narrower SqlReadTransaction that driver.read supplies, so this is a hard tsc error (TS2345: Property 'exec' is missing). Widen the parameter to SqlReadTransaction, matching every other read helper in the file.

Trial-replay evidence (after the three fixes, on 464e94ee1):

• Named tests: 121 passed, 4 suites.
• tsc --noEmit on @rundown-org/core: clean.
• Full core suite: 4525 passed, 2 skipped, 198 suites.
• Workspace build: clean. Full CLI suite: 3112 passed, 143 suites.
• Changed paths: exactly the 12 in the plan's ownership block; no CLI lifecycle dispatch.

Not yet run in trial: the scoped Stryker command and full corepack pnpm run verify. Both remain required gates on the real PR.

[tobyhede]

PR 4's deviations are now also recorded as a plan addendum: docs/superpowers/plans/2026-07-24-608-pr04-addendum-current-main-adaptations.md. It amends (does not replace) the write-once 2026-07-23-608-pr04-guarded-actor-commit-seam.md and carries the revised step list, including the tsc --noEmit step the original plan lacks. Implement from the addendum.

[tobyhede]

PR 5 — recorded deviations (#651)

Branched from freshly fetched origin/main at 2500d1f4acb498596ad0fa65991f1663c6b082b7 (the #649 merge commit). Eight owned commits replayed in the plan's exact order; all three 4859a9c08 paths excluded.

saveSession collisions with PR 4 — all resolved toward main

PR 4's 4eeaca0ec landed claim reconciliation that postdates and contradicts the salvage-era saveSession in e5f0b2154 / 1e0c67cb7. Taking the incoming side would have undone three separate behaviours — staleness computed from active claims only (resurrecting tombstones), updateChangedClaimColumns writing the exact columns claims_guard_update / claims_bump_gen_update fire on, and a ?? 0 generation fallback inserting claims against deleted runs. HEAD kept in all three cases; the orphaned updateChangedClaimColumns helper deleted. Full detail in the PR description.

Adaptations beyond a pure replay

1. SyncWork<T> propagation. PR 1/3's SyncWork<T> structurally rejects promise-returning transaction callbacks; the salvage-era mutateSession<T> predates it and does not compile. Propagated through RunbookStore.mutateSession → RunbookStateManager.mutateSession → SessionService.mutate. Turns the commit's own stated invariant into a compile-time contract.

2. resolveControllingClaim widened to SqlReadTransaction — called inside driver.read. Same class as PR 4's recorded item 3.

3. Site probe rename dropped. 1e0c67cb7's move to site/src/pages/dev/ is a pure path move (0/0). Neither salvage path exists on main; PR 1 landed the probe at site/src/pages/sqlite-substrate-probe.astro with the correction already applied, including a comment warning against the _-prefixed form. The dev/ destination is also an excluded 4859a9c08 path.

4. driver-contract.test.ts fixture rename. 279bd599f narrows orphan reclamation to <dbname>.export-<uuid>.tmp. Main's "surfaces a reclaim failure" test (which postdates the salvage baseline) staged stuck.db.wedged.tmp, which the narrowed predicate no longer matches, so the test could not observe the failure it pins. Fixture renamed to the new minted shape; the property is unchanged.

5. Claim-column writes routed to lifecycle seams. Main's applySession leaves an already-persisted claim untouched by design, so two PR 5 paths that mutated the session snapshot and relied on the wholesale reconciler became silent no-ops. SessionService.recordClaimSeen now calls ctx.recordClaimSeen; unstashForClaimId uses a new RunbookStoreTxn.touchClaimUpdatedAt, kept deliberately distinct from recordClaimSeen (an unstash is a record write, not proof the holder is alive — Parent-side detection for abandoned/idle delegation claims (liveness or lease) #519). Both columns sit outside the claim triggers, so neither write is refused under an execution owner nor bumps claim_generation.

6. Duplicate FK pragma removed. fb2619d4d adds withConnectionPragmas() on both branches of SqljsDriver.open(); main already applies PRAGMA foreign_keys = ON in load() and keeps open() pragma-free by design. Git merged both cleanly (different locations) and the pragma was applied twice — which made the protection untestable: neutering either left the other firing, so five FK tests and a direct pragma readback all passed against broken code, and the mutation gate flagged it as a survivor. Premise verified before removing anything (this sql.js build reports foreign_keys = 0 by default and the cascade genuinely does not fire without it), then resolved as in PR 4's adaptation 1: keep main's, drop the duplicate, keep the commit's tests. Neutering the single remaining pragma now fails 7 tests.

7. patchPersistedClaim test fixture. The pre-SQLite loadSession → edit → saveSession pattern no-ops for existing claims. Added to the PR-introduced session-fixtures.ts, in the spirit of PR 3's takeOwnership. Converted 2 sites in claim-seen.test.ts, 9 in lifecycle-command-service.test.ts, and the CLI's shared backdateClaimSeen helper.

8. Dead helpers removed. 2de7837d5 leaves childExit, collect, waitForFile with no callers (park() and race() inline the equivalent logic) — dead in the salvage commit itself, since the branch's lint gate ran at c3e9a38c1. @typescript-eslint/no-unused-vars fails verify on them. park, race, expectOverlap untouched.

Mutation gate

Line-scoped per CLAUDE.md (123 changed ranges, not whole files). Instrumented 4 source file(s) with 309 mutant(s) — 170 killed, 0 timeout, 77 survived, 62 no coverage, 0 errors. The zero error/timeout counts matter: the run hit repeated Jest OOM restarts (issue #485), and they confirm nothing was miscounted as detected. The 55.02% aggregate and its break: 70 exit 1 are not the gate — that threshold is project-wide and meaningless under line-scoping.

All three named classes verified by hand-mutation: FK was a real survivor (deviation 6), now fails 7 tests; session transaction was a Stryker false negative (type-only import erases the module edge that enableFindRelatedTests needs), and removing the applySession call fails 42 tests; guarded-state is outside this PR's changed lines (applyStateUpdate unchanged from main) but verified anyway at 8 failures. Two further genuine survivors in isExportTempName — the reclamation safety boundary — closed with one new test; the ||→&& mutant there is not equivalent, since it deletes a neighbour file the original skips.

Allowlist expansion (one)

packages/core/__tests__/runbook/actor-service-compute-commit-equivalence.test.ts — added by PR 4 (4eeaca0ec), after the salvage commits were written, and its writeStateFileVerbatim helper hand-writes .rundown/runs/<id>.json, the path PR 5 removes. Repointed at seedRawRunState, the raw-store fixture PR 5 adds for exactly that purpose. Leaving it would land a failing test on main.

Three allowlisted paths are untouched: packages/core/src/runbook/actor-service.ts (its only incoming change was a TSDoc rewording resolved toward main, so the file is unchanged) and both site/src/pages/*sqlite-substrate-probe.astro paths (deviation 3).

Note for later PRs

claims has no seam for a bulk claim-column rewrite by design. Any future path that needs to change grants, delegation, or secret_hash on an existing claim must add an explicit lifecycle operation — saveSession will not carry it, and the failure is silent rather than an error. Worth keeping in view for PR 9 (typed session ownership refusals) and PR 13 (cutover).

[tobyhede]

PR 6 — recorded deviations

Branched from freshly fetched origin/main at d1a8433c6 (the #651 merge commit). Five owned commits replayed in the plan's exact order: 6e9ff79f3, 2d0656b24, eec5246d3, 6cf18277c, 68bdbf62c.

Verified by a full trial replay before implementation: 5 merge conflicts and 13 failing tests across both packages. Deviations are also recorded as a plan addendum, docs/superpowers/plans/2026-07-25-608-pr06-addendum-current-main-adaptations.md, which amends (does not replace) the write-once 2026-07-23-608-pr06-claim-liveness-single-controller.md and carries the revised step list. Implement from the addendum.

The correction that matters — R2 terminal retention

The plan names this in one clause — "invalidation retains claims for completed/stopped controlled children" — gives no mechanism, and a pure cherry-pick does not perform it. It accounts for 10 of the 13 failures.

6e9ff79f3's invalidateClosedDelegatedClaims classifies every active delegated claim against the committed parent state and supersedes each one that reads closed, never consulting the controlled child's lifecycle. Completing a child sets its parent-side substep to done, so classifyDelegationLiveness returns { kind: 'closed', reason: 'resolved' }, the claim is tombstoned, and loadSession (which surfaces only active claims) drops it. That breaks the plan's own shared constraint — "a completed or stopped child remains resolvable as terminal evidence" — and collapses terminal-child into CLAIMED_RUNBOOK_UNAVAILABLE.

Fix: join runs on claims.controlled_run, select runs.lifecycle, and skip any claim whose child is completed/stopped before classification — every terminal child also reads closed on the parent side, so a check placed after the classifier never fires. Four lines in an already-allowlisted file; no CLI test edits, no allowlist expansion.

Three of the five owned commits actively rewrite main's assertions to match the uncorrected behaviour. These land silently in allowlisted files and were restored to main's:

• claim-seen.test.ts (AC5) — 6e9ff79f3 replaces expect(after.claims[B].lastSeenAt).toBe(recordB.lastSeenAt) with expect(after.claims[B]).toBeUndefined(). Main's is also the stronger assertion: toBeUndefined() passes just as well if B had been refreshed and then dropped, which is the exact failure AC5 exists to catch.
• claim.test.ts — 6e9ff79f3 inverts toContainEqual → not.toContainEqual, against main's comment "retained as a terminal tombstone (not deleted) so rd pass/fail --claim-id can confirm-or-conflict and rd prune can later GC it."
• status.test.ts — 2d0656b24 performs the same inversion against main's "Item 4: the terminal claim is RETAINED as a tombstone."

The five CLI command suites that fail on this cause (pass, fail, stop, prune, delegate) are not in the allowlist and needed no edits — they pass once the latch is fixed. Their return to the exact 248-test baseline is the signal the correction is right.

Other deviations

1. Three import-block conflicts (6e9ff79f3) — claim-seen.test.ts, lifecycle-command-service.test.ts, runbook-store.ts. Pure unions: HEAD carries PR 3/PR 5 imports, incoming adds PR 6's.
2. resolveControllingClaim widened to SqlReadTransaction — the incoming side reverts PR 5's adaptation B while adding the LIMIT 2 two-controller guard. Kept both: main's parameter type, the incoming body. Taking the incoming signature is a hard tsc error. Same class as PR 4's item 3.
3. applySession — the one conflict where neither side is correct alone. The incoming two-phase ordering (tombstone stale before inserting) is load-bearing: this same commit adds claims_one_active_per_run, so a rotated claim collides with its still-active predecessor without it. But the incoming side also reintroduces the ?? 0 generation fallback PR 5 rejected on merits. Merged: incoming structure, main's warn-and-skip. The generation is read in phase 3 after the tombstones — each tombstone fires claims_bump_gen_update, so reading earlier records an issuance generation the same transaction already superseded.
4. Two main-era tests collide with claims_one_active_per_run (same class as PR 4's item 2), both in runbook-store.test.ts. surfaces active claim records… inserts two active claims on one run — reordered to tombstone before inserting, mirroring the production rule in item 3. inserts a genuinely new session claim… saves a session with two active claims on one run — split across two runs, with the target run's generation churned first so the non-zero-generation property it exists for survives.

Allowlist expansions (three)

• cli/__tests__/helpers/runbook-pipeline.test.ts — mocks @rundown-org/core with an explicit factory, so the new classifyDelegationLiveness import in runbook-pipeline.ts fails the whole suite to load. Needs a second edit too: the file's beforeEach calls jest.resetAllMocks(), so the mock must also be re-stubbed there or 16 tests die on Cannot read properties of undefined. 6e9ff79f3 applies exactly this two-part fix to the sibling suite claim-and-launch.test.ts and simply missed this one; the pattern was copied verbatim. Not a coverage loss — claim-and-launch.test.ts overrides the default per-test to exercise the superseded path.
• cli/__tests__/integration/delegation-propagation.test.ts — handles propagation when parent is already completed asserts rd claim exits 0 against a completed parent. That is precisely what PR 6 exists to refuse (the plan lists "parent deletion/terminalization" among the supersession events). Now exits 1 with DELEGATION_SUPERSEDED; rewritten to assert the refusal and that details.parentRunId names the parent, since the plan forbids collapsing it into missing.
• cspell-dictionary.txt — the owned commits introduce upserts, terminalization, and disambiguator, none known to check:spell, which is part of verify. Plus terminalized from the rewrite above.

Allowlist notes

• storage/mutation-result.ts is untouched. The plan's Files section names it a "required implementation path", but no owned commit modifies it and the replay needed no change. The derived allowlist is authoritative, as the plan itself says.
• driver-contract.test.ts is allowlisted but nets to zero — 2d0656b24 moves its user_version assertion 1→2 and 68bdbf62c moves it back. SCHEMA_VERSION ends at 1.

Procedural note for later PRs

CLI suites resolve @rundown-org/core to its built dist, so pnpm run build must run after the replay and before any CLI test command. Building only at branch time hides new core exports behind a module-resolution error that reads as a missing export rather than a stale artifact. The PR 6 plan's step list does not mention this; the addendum's does.

Known flake, not a regression

session-service.process.test.ts › converges with no duplicate or resurrected entries when releases and pops race failed its expectOverlap barrier once under full-suite load, then passed 5/5 across three isolated runs and again on the next full run. The witness asserts at least two child processes' mutation windows were genuinely in flight together; it starves when the whole suite competes for cores.

[tobyhede]

PR 6 is open: #652 (branch 608-rebuild-claim-liveness, based on d1a8433c6).

Four further defects were found by review after the trial replay, none caught by the test suites, all in code the owned commits introduce. Recorded as Delta 8 in the addendum and in the PR description:

1. An executing child aborted its parent's unrelated commit (critical). Supersession writes claims.status, which is inside claims_guard_update's column list, so the trigger raised execution_in_progress whenever the controlled child held an exec_token — rolling back the parent's own commit. Confirmed by an executable probe before fixing. Owned children are now skipped; the claim-side half of the same latch (SessionService.claimRunbook) already refuses a closed delegation without consulting the row's status, so nothing goes unenforced.
2. delegation-superseded was reported as CLAIM_INVARIANT_VIOLATED on the fresh-launch path — blaming Rundown for a real supersession and dropping the no-retry signal. Same "no silent mapping" rule the plan applies to missing vs terminal-child.
3. Two unvalidated raw-row reads bypassed the store's own assertLifecycle / deserializeDelegation validators, against its "no unvalidated row escapes the store" contract.
4. The two-controller guard was unfalsifiable — killed by no test anywhere; both full suites passed with the throw removed. Closed with a test that drops the partial index to stage the corrupt state.

Gates: verify exit 0; core 4602 passed / 1 skipped / 202 suites; CLI 3110 / 143; scoped Stryker Instrumented 3 source file(s) with 65 mutant(s) — 37 killed, 0 errors, 0 timeouts. All four of the plan's named mutation classes settled by hand-mutation (terminal retention and supersession are killed from the CLI, which the plan's --testFiles do not reach; controller uniqueness was a genuine survivor, now closed).

One amendment for the plan's mutation command: add __tests__/runbook/storage/runbook-store.properties.test.ts to --testFiles. It carries the uniqueness property and the new guard test; without it the same run reports 29 killed instead of 37.

[tobyhede]

Note for later PRs — observability of the deferred supersession window

PR 6 (#652) makes the parent-side R2 latch conditional: invalidateClosedDelegatedClaims skips a claim whose controlled child holds an exec_token, because status is inside claims_guard_update's column list and the UPDATE would abort the parent's own commit with execution_in_progress.

That skip is correct — the claim-side half of the latch (SessionService.claimRunbook) refuses a closed delegation without consulting the row's status, so nothing goes unenforced — but it is completely invisible. The branch returns nothing, writes nothing, and logs nothing. The observable result is a claim that stays active long after its parent moved past the delegation, with no record of why.

Worth adding a debug-level log on the deferral, not on the supersession. A supersession already leaves evidence (the row changed status and the generation bumped); the deferral is the path that leaves none. Natural home is PR 11 (lifecycle execution fencing) or PR 12 (transactional delegation workflows), where the deferred window is actually exercised rather than incidental.

A CodeRabbit review of #652 suggested logging the superseded keys instead. Skipped there deliberately: it manufactures a consumer for a value nothing reads, and a bare log call is an unpinned mutation surface unless a test asserts on it (and asserting on debug logs is brittle).

Related, and a separate decision: invalidateClosedDelegatedClaims is declared on the public RunbookStoreTxn interface returning ClaimLookupKey[], and every call site discards it. It appears in exactly one file across core, the CLI, and the tests, and no plan for PRs 7–14 names it. Either give it a consumer or drop the return type — but that is a call about the RunbookStoreTxn surface, not a drive-by inside a replay PR.

[tobyhede]

PR 7 — required adaptations to current main

Verified by a full trial replay of 0f896b8b6 03d9144a1 63f469945 e21dab179 ee650ce7c 70a7082ec onto #652's head (97c124d98). Full detail in docs/superpowers/plans/2026-07-26-608-pr07-addendum-current-main-adaptations.md (added by PR 7).

The replay itself is easy — six conflict hunks across five files, all mechanical unions, and zero failing tests. tsc --noEmit on core is clean with no adaptation; PR 4's and PR 6's SqlReadTransaction widening problem does not recur. The 13 changed paths are exactly the derived allowlist.

The substance is not in the replay. It is a coverage hole that every suite passes straight through.

1. cspell-dictionary.txt allowlist expansion (stop-and-review). e21dab179's two production-path regression tests mint child run ids rd_a{31}c / rd_a{31}d, and check:spell — part of verify — rejects both. The file already carries aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaab from an earlier PR that hit the same wall. Same class as PR 6's Delta 6.

2. The plan's scoped Stryker command must be replaced. Two independent problems. Whole-file --mutate on runbook-store.ts (now 2006 lines) is what CLAUDE.md — updated after this plan was written — documents as "17+ minutes without finishing"; line ranges are required. And the scope covers two of the seven changed production files, omitting session-service.ts (which holds runGuardedParentAdvance's OpenDelegatedChildrenError → open_delegated_children conversion, the PR's headline behaviour) and the entire actor-service / completion-service / lifecycle-command-service forwarding chain that e21dab179's regression tests exist to pin. --testFiles likewise omits session-service.test.ts and lifecycle-command-service.test.ts, where the killing tests live — the same selection trap PR 6 documented as Ran 0.00 tests per mutant.

3. PR 6's "restore main's assertion" heuristic must NOT be applied here. e21dab179 inverts session-service.test.ts › does not let a claim that interleaves with the guarded advance wedge the parent from { kind: 'advanced' } to open_delegated_children. Unlike PR 6's three inversions, this one is the point of the PR — main's assertion encodes the pre-atomic contract. Keep the rewrite. It does drop one property deliberately (the next bare advance is no longer un-wedged); that belongs in the PR description as intent.

4. The guard's filter chain is almost entirely unpinned — the substantive finding. The plan's own gate criterion is met: deleting the in-transaction guard block fails 7 tests across 5 suites, and deleting the substep-done skip fails 2. One level down, in which claims the predicate counts, four skips are pinned by nothing:

Mutation	Core (4,635)	CLI (3,116)
Terminal-child skip (completed/stopped) removed	passes	passes
linkageMatchesClaim skip removed	passes	—
!claim.delegation run-control-claim skip removed	passes	—
guard.parentRunId !== runId misapplication throw removed	passes	—

The terminal-child skip is the one PR 6 changed the meaning of. R2 terminal-retention keeps a completed child's claim active rather than tombstoning it, so post-PR 6 that skip is the only thing preventing a parent from being permanently blocked behind a finished child. 0f896b8b6 predates that correction. guarded-parent-advance.test.ts looks like it covers this, but its second case leaves the child non-terminal and short-circuits at the substep-done check first — the same "adjacent to what its name claims" pattern PR 6's mutation pass caught in supersededStashedClaim.

Independently confirmed by the replacement Stryker run at Ran 12.93 tests per mutant (a trustworthy run): 9 survivors on the terminal-child line alone, 3 on the misapplication throw, 2 each on the other two skips.

5. A fifth gap the Stryker run found and hand-mutation missed. session-service.ts — if (isOpenDelegatedChildrenError(error)) mutated to if (true) survives. Nothing pins the rethrow the line below, whose own comment reads throw error; // never mask a non-guard failure. With that condition always true, any failure inside the decisive advance write — a Zod rejection on corrupt state, a driver error, a bug in sendAndSync — is reported as open_delegated_children: a refusal naming a cause that did not occur, with a claim list read off an unrelated error object. That is the RD-102 masking class. It surfaced only because the replacement command adds session-service.ts to the scope.

6. Two predicates now answer "is this delegated child in flight" (recorded, not blocking). openDelegatedChildrenFor mirrors listOpenClaimsForParent; PR 6 introduced classifyDelegationLiveness as "the single source of truth", used by invalidateClosedDelegatedClaims ~50 lines below it in the same file. The two disagree on cursor-advanced, token-reissued, and cancelled delegations, which PR 7's predicate treats as open. Not a regression — faithful to existing semantics, self-healing except while a child holds an execution lease, and erring toward refusal. Natural cleanup for a later PR.

7. expectOverlap can fail verify, and it is not PR 7's doing. The sensitivity witness in session-service.process.test.ts failed twice during the trial on two different tests, once under verify's --maxWorkers=2 (failing the gate). Same flake PR 6's addendum records. Interleaved A/B using verify's exact invocation: 3/3 clean with the change, 3/3 clean at base. A concurrent full test run in another worktree held the machine at load 20–35 throughout. Re-run the file in isolation before treating it as a finding.

Trial-replay evidence (on 97c124d98, after the resolutions and the dictionary entries):

• Conflicts: 6 hunks / 5 files. --diff-filter=U empty; git diff --check exit 0; comm -3 reports only cspell-dictionary.txt.
• tsc --noEmit on core: clean.
• Plan-named tests: 229 passed, 4 suites. Other touched suites: 220 passed, 3 suites.
• Full core: 4,635 passed / 1 skipped / 203 suites (base 4,627 / 202). Full CLI: 3,116 passed, 143 suites.
• corepack pnpm run verify: every stage green except the item-7 flake.
• Replacement Stryker: 3m42s, Ran 12.93 tests per mutant, 75 killed / 1 timeout / 22 survived / 5 no-coverage.

Base note. The trial used 97c124d98; #652 has since advanced to 0374d6b91. Those two commits touch claimRunbook and getActiveForClaimId, not runGuardedParentAdvance or the import block — item 1's resolutions hold unchanged, and only item 5's line number shifts. One of them reinforces item 4: its comment states the terminal-skip in invalidateClosedDelegatedClaims and the claim-read ordering "must stay tied together".