tegwick
9baf6f1829
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e738-9e15-7600-87e6-90dec3a7beef
60 lines
3.9 KiB
Markdown
60 lines
3.9 KiB
Markdown
# LEARN-0018 — Durable pending intent and a concrete receiver
|
|
|
|
Status: complete; preregistered before execution at `aea9796`. Owner/reviewer: Codex, author-model.
|
|
Date: 2026-09-28. Existing work: FEP-WP-0003 T04; no new work item.
|
|
Stream D; new comparison group D-sqlite-git-recovery-v1. Do not pool this
|
|
runtime protocol with source inspection or the Matrix synthetic receiver.
|
|
|
|
Question: which recovery obligations can SQLite 3.45.1 plus Git 2.43.0
|
|
receive-pack satisfy, and where does object identity fail to supply an operation
|
|
receipt? Affects CAND-0002/0003/0006/0007, without changing their contracts.
|
|
|
|
Expected: atomic local intent/outbox updates survive process restart; uncommitted
|
|
changes roll back. Replaying the same Git commit is harmless while its identity
|
|
is retained. A stale base must not replace a newer branch. Contradictions include
|
|
partial local supersession, duplicate accepted history, accepted stale replacement,
|
|
or inability to distinguish accepted intent after loss of the local acknowledgement.
|
|
|
|
Use only temporary local databases and bare Git repositories. Execute real SQLite
|
|
and git receive-pack, not an authored receiver simulation. Pin engine versions,
|
|
binary hashes, SQLite source ID, settings and experiment hash in the receipt.
|
|
SQLite uses WAL + synchronous FULL. Git uses a bare receiver with non-fast-forward
|
|
updates denied. No production repositories, network service, credentials or paid calls.
|
|
|
|
Registered checks:
|
|
1. Kill a writer after draft/outbox writes but before commit: neither survives.
|
|
2. Kill after commit and before local acknowledgement: both survive reopening.
|
|
3. Kill between superseding old pending intent and inserting its replacement:
|
|
old state remains intact. A committed replacement changes both atomically.
|
|
4. Kill the sender after real receive-pack accepts but before SQLite acknowledges;
|
|
reopen the outbox, replay the same immutable commit, check one accepted history.
|
|
5. After a concurrent newer commit, reject stale ancestry at the real receiver;
|
|
retain the rejected local pending operation for explicit reconciliation.
|
|
6. Reopen receiver processes and run garbage collection while accepted ancestry
|
|
remains reachable; confirm original identity remains inspectable.
|
|
7. Negative controls: deliberately split local supersession across transactions
|
|
exposes a partial state; replay with a fresh commit identity creates a second
|
|
history entry. These are limitations, not successful deduplication.
|
|
|
|
Budget: 30 minutes active single-agent implementation/review, at most 5 minutes
|
|
experiment execution. Record elapsed active session time minus subprocess duration;
|
|
no overlap, no inferred historical effort. Retain failed development receipts.
|
|
Accept a bounded mechanism finding, including negative results. Power loss,
|
|
physical device failure, remote durability, authentication, HTTP transport, UI/AT,
|
|
production recurrence, device-loss backup and indefinite identity retention are
|
|
outside scope. Do not claim Git is an arbitrary application operation-ID service.
|
|
A full frontend storage/receiver contract remains unknown; stronger claims stay in
|
|
existing T01/T02 and WP-0002 T03. No new follow-up task is needed for exclusions.
|
|
|
|
## Outcome
|
|
|
|
Corroboration: nine checks pass, including two negative controls. Evidence:
|
|
[review](../../reviews/StorageReceiverRecovery.md),
|
|
[result](../../experiments/storage-receiver/result.json), and
|
|
[effort receipt](2026-09-28-storage-receiver-effort.json).
|
|
One question/outcome; nine assertions are not nine independent uses. No failed
|
|
development run, independent review, new inference call or maturity promotion.
|
|
T04 completes for this bounded pair; full frontend recurrence remains T01,
|
|
validated/human cases T02 and WP-0002 T03. Supersedes no prior ledger entry.
|
|
Active research and execution times are recorded separately in the effort receipt;
|
|
provider tokens/cost are unmeasured. Review: Codex, author-model, not independent.
|