Preregister bounded SQLite and Git receiver recovery checks

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e738-9e15-7600-87e6-90dec3a7beef

research/evolution/cycles/2026-09-28-storage-receiver.md

@@ -0,0 +1,51 @@
+# LEARN-0018 — Durable pending intent and a concrete receiver
+
+Status: preregistered before execution. Owner/reviewer: Codex, author-model.
+Date: 2026-09-28. Existing work: FEP-WP-0003 T04; no new work item.
+Stream D; new comparison group D-sqlite-git-recovery-v1. Do not pool this
+runtime protocol with source inspection or the Matrix synthetic receiver.
+
+Question: which recovery obligations can SQLite 3.45.1 plus Git 2.43.0
+receive-pack satisfy, and where does object identity fail to supply an operation
+receipt? Affects CAND-0002/0003/0006/0007, without changing their contracts.
+
+Expected: atomic local intent/outbox updates survive process restart; uncommitted
+changes roll back. Replaying the same Git commit is harmless while its identity
+is retained. A stale base must not replace a newer branch. Contradictions include
+partial local supersession, duplicate accepted history, accepted stale replacement,
+or inability to distinguish accepted intent after loss of the local acknowledgement.
+
+Use only temporary local databases and bare Git repositories. Execute real SQLite
+and git receive-pack, not an authored receiver simulation. Pin engine versions,
+binary hashes, SQLite source ID, settings and experiment hash in the receipt.
+SQLite uses WAL + synchronous FULL. Git uses a bare receiver with non-fast-forward
+updates denied. No production repositories, network service, credentials or paid calls.
+
+Registered checks:
+1. Kill a writer after draft/outbox writes but before commit: neither survives.
+2. Kill after commit and before local acknowledgement: both survive reopening.
+3. Kill between superseding old pending intent and inserting its replacement:
+   old state remains intact. A committed replacement changes both atomically.
+4. Kill the sender after real receive-pack accepts but before SQLite acknowledges;
+   reopen the outbox, replay the same immutable commit, check one accepted history.
+5. After a concurrent newer commit, reject stale ancestry at the real receiver;
+   retain the rejected local pending operation for explicit reconciliation.
+6. Reopen receiver processes and run garbage collection while accepted ancestry
+   remains reachable; confirm original identity remains inspectable.
+7. Negative controls: deliberately split local supersession across transactions
+   exposes a partial state; replay with a fresh commit identity creates a second
+   history entry. These are limitations, not successful deduplication.
+
+Budget: 30 minutes active single-agent implementation/review, at most 5 minutes
+experiment execution. Record elapsed active session time minus subprocess duration;
+no overlap, no inferred historical effort. Retain failed development receipts.
+Accept a bounded mechanism finding, including negative results. Power loss,
+physical device failure, remote durability, authentication, HTTP transport, UI/AT,
+production recurrence, device-loss backup and indefinite identity retention are
+outside scope. Do not claim Git is an arbitrary application operation-ID service.
+A full frontend storage/receiver contract remains unknown; stronger claims stay in
+existing T01/T02 and WP-0002 T03. No new follow-up task is needed for exclusions.
+
+## Outcome
+
+Pending execution.

workplans/FEP-WP-0003-contrasting-schools.md

@@ -8,7 +8,7 @@ status: blocked
 owner: codex
 topic_slug: canon
 created: "2026-09-24"
-updated: "2026-09-27"
+updated: "2026-09-28"
 state_hub_workstream_id: "13c123f1-a470-560e-ab8e-b270c387930a"
 ---
 
@@ -290,7 +290,7 @@ T02/T03 gates and WP-0006 T03 review dates/comparable measurement remain open.
 
 ```task
 id: FEP-WP-0003-T04
-status: todo
+status: progress
 priority: medium
 state_hub_task_id: "7cbb845d-0e13-5356-8da0-41aa8495de2a"
 ```