Qualify interrupted current-version retention restore

docs/plans/lab-workflow-reliability/execution-ledger.md

@@ -1,5 +1,31 @@
 # Lab workflow reliability execution ledger
 
+## 2026-10-21 — Current-version interrupted restore admission
+
+PR115 and PR116 are merged; main is
+`8b1f78eb06c17e3dba2a73dc0acc9568e53ccc7e`. All four applicable PR116 workflows
+passed at exact `9d699cc154e9dde89fe26df16ad57c421e68d734`, with independent
+source/policy review. Main's automatic push workflows are monitored separately;
+no expired CLI credential or denied raw log is retried.
+
+The lead admits only the existing T8 interruption gap on the same combined
+current-version fixture, with three real restore seams and raw independent
+state comparisons. The original clean witness and all measurements stay sealed
+at their original subjects. No benchmark, old-version witness, production cache,
+automatic migration, training or scientific claim is added. PUB-1 and SCI-1
+retain their genuine missing-input boundaries.
+
+The initial source `0bbc6a7` passed one focused test in 17.614621813 seconds.
+Independent review requested stronger backup permission/final-boundary checks,
+then cleared the strengthened source `d02f034` and independently passed one test
+in 17.012795836 seconds. Both runs had zero failures, errors or skips. Raw state
+across 43 tables, sequences, files and modes, three controlled restore
+interruptions, exact SDK/CLI result collection and zero replay passed. Exact
+owned-schema/database cleanup was independently queried; the task PostgreSQL
+container is stopped. See `reports/integrated-interrupted-restore-20261021/`.
+Current published-head hosted checks remain a merge gate; no full T8, performance
+or lab acceptance is inferred.
+
 ## 2026-10-20 — User removes backward-compatibility requirement
 
 The user explicitly states that existing projects must perform their own one-time

docs/plans/lab-workflow-reliability/plan.md

@@ -429,6 +429,31 @@ arguments are not substituted for old source execution. No production, schema,
 workflow or README change is admitted. Actual qualification and independent
 review remain gates; this does not complete unrelated T8 or lab acceptance.
 
+### Current-version interrupted-transfer acceptance admission — 2026-10-21
+
+After PR116 merged as `8b1f78eb06c17e3dba2a73dc0acc9568e53ccc7e`, the
+integration lead selects the remaining interrupted-restore part of T8. Extend
+the existing combined current-version witness, rather than duplicate its real
+neutral attempt. The isolated branch is
+`test/integrated-interrupted-restore-20261021`. Its write set is the existing
+`tests/test_integrated_retention_restore.py`, this plan, execution ledger and
+scoped evidence under `reports/integrated-interrupted-restore-20261021/`.
+
+Inject explicit failures after real catalog population before transaction commit,
+after committed metadata and an actual partial file copy, and after the final
+destination rename before its reply. At every safe checkpoint, reconcile raw
+tables/sequences and the exact transfer marker; prove the source and backup
+remain unchanged and the final destination is absent until publication. Retry
+the same transfer and preserve all bytes, permissions, a nontrivial sequence
+high-water mark, immutable coordinator acknowledgement, timing records and exact
+publication Ref. The existing cold SDK/CLI reads must still launch no compute.
+No production change is admitted without an observed correctness failure.
+
+Original and independent focused qualification, source review and current-head
+hosted checks remain gates. This advances current-version T8 integrity only; it
+does not revive backward-compatibility requirements, qualify preparation reuse,
+close all M2/M3/M5/T8 boundaries, or supply missing PUB-1/SCI-1 lab evidence.
+
 ### Integrated stopped-transfer acceptance admission — 2026-10-20
 
 The fresh integration lead admits one narrow T8 witness from the exact reporting

docs/plans/lab-workflow-reliability/reports/integrated-interrupted-restore-20261021/acceptance.md

@@ -0,0 +1,92 @@
+# Current-version interrupted retention restore
+
+The existing T8 witness now proves controlled interruption and retry for the
+combined current-version coordinator, timing, publication and client state. No
+production repair was needed. This is an extension of the existing plan, from
+merged main `8b1f78eb06c17e3dba2a73dc0acc9568e53ccc7e`.
+
+## Exact qualification subjects
+
+The initial source `0bbc6a7c4cd58dc0451d6ba6c0983193763e1f91` passed one focused
+test in 17.614621813 seconds, with zero failures, errors or skips. Independent
+review then requested backup permission checks at each checkpoint and the final
+source/backup boundary, plus explicit sequence-fixture provenance. These were
+added without changing a restore owner or fault seam.
+
+The strengthened source `d02f034aa1bba6cd55dfd47ae44ebcb7014200a5`, tree
+`68f147908523a65ce495f47392eada87273cbfaf`, passed independent reproduction:
+one test in 17.012795836 seconds, zero failures, errors or skips. Its test file
+SHA256 is `50ac2975b216052dc0d07248db9f21a8618f9cf096b22214c2c9a317c302d199`.
+The independent source/reproduction review is clear; receipt SHA256 is
+`92cc82aa677eeaca9496fe57af2997c8b45e95da58cba9fdb2778f5cb9df0700`.
+The initial root pass is not relabeled as a run of the strengthened source.
+
+Raw runners, logs, result/domain receipts and the preliminary/final review are
+preserved byte-for-byte under `root/` and `independent/`. The
+[manifest](evidence-manifest.json) seals their sizes, hashes, exact source
+subjects and the small root-to-final assertion diff. Report-only publication
+must preserve the qualified test bytes; current published-head hosted checks
+and final report/source review remain merge gates.
+
+## Real boundaries and independent state oracles
+
+The existing fixture executes one actual neutral Linux custodian attempt,
+drains it, faults original publication copying, obtains a real PostgreSQL
+advisory-lock coordinator fault and performs explicit same-Run recovery. It then
+stops the source, backs up raw schema 10 state and restores it into a separate database.
+
+| Interruption | Observed safe checkpoint | Same-transfer continuation |
+| --- | --- | --- |
+| After real catalog population, before transaction commit | All 43 raw table states roll back to empty staging state; final destination absent; exact private restore marker retained. | Populate and restore original metadata/sequence state. |
+| After metadata commits and the actual coordinator-journal file is copied and renamed | All raw tables/sequences equal source; copied inventory is a strict subset of complete original entries; final destination absent. | Verify existing entries and copy the remaining files. |
+| After the actual final destination directory rename, before function return | Destination is published, staging absent, exact marker/tables/sequences/tree/POSIX modes retained. | Normal retry reconciles the completed result without overwriting it. |
+
+At every checkpoint and after final cold reads, source bytes, source POSIX modes,
+backup bytes, backup/catalog POSIX modes, source raw tables and source sequences
+remain unchanged. The source values and inventories were independently captured
+before restore; expected raw state does not come from a restore result or the
+production timing summarizer.
+
+The sequence high-water mark is explicit authored administrative fixture state:
+`generation_jobs` starts at value 1/not-called and is set to value 20/called with
+empty job-order rows. Its exact retained state survives committed transfer,
+retry and cold reads. This is not a measurement of a real lab workload or proof
+of arbitrary populated-sequence transactional rollback.
+
+After reconciliation, actual application activation preserves the immutable
+completed coordinator acknowledgement, original interrupted Run and events,
+exact recovered publication Ref, and measured/incomplete timing records.
+Authenticated current SDK and separate CLI processes collect identical complete
+artifact bytes into mode 0600 files. All raw tables/sequences remain unchanged;
+the compute-launch tripwire records zero calls during restore and consumption.
+The fixture has one Run, one grant/consumption and zero Study reservations; it
+does not replace the separate populated-Study acceptance evidence.
+
+Both runs leave schema inventory empty and preserve the complete database-name
+inventory. The independent reviewer also queried the exact emitted schema and
+restored database names and confirmed both absent. The task-owned PostgreSQL 17.11
+container was stopped after the serial test windows. No benchmark, broad local
+suite, workflow rerun or old-version witness was launched for this extension.
+
+## Retention decisions and remaining boundaries
+
+The earlier real collection measurements remain the performance evidence. No
+new performance comparison was run or inferred here. Explicit twenty-item batch
+collection retains its scoped benefit; individual collection stays the default,
+including the measured slower single-item batch controls. Preparation reuse,
+installed-runtime mutation, other batch sizes and general workflow speed are
+not qualified by this restore witness.
+
+This qualifies controlled Python exceptions and retries, not host crashes, kill,
+power loss or device/fsync durability. Partial copying here means a subset of
+complete verified files, not a torn payload. POSIX mode bits are compared;
+ownership, ACLs, xattrs and timestamps are not newly qualified. Full M2/M3/M5/T8
+acceptance is not implied by these three boundaries.
+
+The user's revised support policy remains authoritative: older project owners
+perform their own one-time migration; no backward adapters or automatic
+migration framework are added. Current-version schema validation, explicit
+unsupported-version errors, backup/restore integrity and no replay remain
+required. PUB-1 still needs its original real failed Run, custody, profile and
+output inventory. SCI-1 still needs a real comparison pair, criterion authority
+and environment/procedure. Neutral recovery evidence cannot supply those inputs.

docs/plans/lab-workflow-reliability/reports/integrated-interrupted-restore-20261021/evidence-manifest.json

@@ -0,0 +1,50 @@
+{
+  "baseline": "8b1f78eb06c17e3dba2a73dc0acc9568e53ccc7e",
+  "original_root_source": "0bbc6a7c4cd58dc0451d6ba6c0983193763e1f91",
+  "reviewed_source": "d02f034aa1bba6cd55dfd47ae44ebcb7014200a5",
+  "reviewed_tree": "68f147908523a65ce495f47392eada87273cbfaf",
+  "test_sha256": "50ac2975b216052dc0d07248db9f21a8618f9cf096b22214c2c9a317c302d199",
+  "root_to_final_diff": "diff --git a/tests/test_integrated_retention_restore.py b/tests/test_integrated_retention_restore.py\nindex 62d81d8..d0023dd 100644\n--- a/tests/test_integrated_retention_restore.py\n+++ b/tests/test_integrated_retention_restore.py\n@@ -147,6 +147,7 @@ class IntegratedRetentionRestoreTests(unittest.TestCase):\n             self.assertEqual(tree_manifest(source.path), original_tree)\n             self.assertEqual(tree_modes(source.path, original_tree), original_modes)\n             self.assertEqual(tree_manifest(backup), backup_tree)\n+            self.assertEqual(tree_modes(backup/'catalog', original_tree), original_modes)\n             original = Metadata(source.path, dsn=original_dsn, create=False)\n             try:\n                 self.assertEqual(read_catalog(original), original_tables)\n@@ -320,14 +321,7 @@ class IntegratedRetentionRestoreTests(unittest.TestCase):\n             launch.assert_not_called()\n             restored.close()\n \n-        self.assertEqual(tree_manifest(source.path), original_tree)\n-        self.assertEqual(tree_manifest(backup), backup_tree)\n-        original = Metadata(source.path, dsn=original_dsn, create=False)\n-        try:\n-            self.assertEqual(read_catalog(original), original_tables)\n-            self.assertEqual(read_sequences(original), original_sequences)\n-        finally:\n-            original.close()\n+        unchanged_originals()\n         drop_restored_database()\n         drop_source()\n         if report_path := os.environ.get('TULDOK_RETENTION_ACCEPTANCE_REPORT'):\n@@ -342,6 +336,8 @@ class IntegratedRetentionRestoreTests(unittest.TestCase):\n                 'artifact_sha256': hashlib.sha256(fixture.input).hexdigest(), 'artifact_bytes': len(fixture.input),\n                 'raw_transfer_equal': True, 'source_and_backup_unchanged': True,\n                 'restore_interruptions': interruptions, 'raw_permissions_equal': True,\n+                'authored_sequence_fixture': {'table': 'generation_jobs', 'before': sequence,\n+                    'retained': original_sequences['generation_jobs']},\n                 'cold_reads_and_collection_preserve_all_tables_and_sequences': True,\n                 'compute_replay_calls': launch.call_count, 'cleanup': cleanup}\n             with Path(report_path).open('x') as stream:\n",
+  "evidence": {
+    "root/runner.py": {
+      "bytes": 2768,
+      "sha256": "f68a94afd7be2985d2175fc65619933d387449b93dbd233901f39cd476128c21"
+    },
+    "independent/runner.py": {
+      "bytes": 4159,
+      "sha256": "1f8ccc36f96c8e56857cfe1ac73891a7910f3d50c563ae93f247edc175df8618"
+    },
+    "independent/preliminary-source-review.json": {
+      "bytes": 3198,
+      "sha256": "09c67142786156a91b8e9861c2331de2f21c7eb262397d5deb247f097d82b76c"
+    },
+    "independent/source-and-reproduction-review.json": {
+      "bytes": 6631,
+      "sha256": "92cc82aa677eeaca9496fe57af2997c8b45e95da58cba9fdb2778f5cb9df0700"
+    },
+    "root/result.json": {
+      "bytes": 816,
+      "sha256": "65176335b275a669885aa9dba91ca4ba1215aacbfc761d7060069fff68179c17"
+    },
+    "independent/result.json": {
+      "bytes": 1190,
+      "sha256": "50b558e1c8138b77f7f4634f3202ed01ca15cc13345149c5231554da33ecce6d"
+    },
+    "root/domain.json": {
+      "bytes": 18883,
+      "sha256": "c1f0fd6d54a8b0bbb7658e4def4836342bf005f76f5a7ac5fae758289e8de21d"
+    },
+    "independent/domain.json": {
+      "bytes": 19096,
+      "sha256": "9b3f56f9fcfaee6c8934f1daa9abb7166b7b5c2c727019081a11b5037e9caf85"
+    },
+    "root/unittest.log": {
+      "bytes": 329,
+      "sha256": "51f85c0c2f20c80697cf1843ba84c3fe9aebd8d78942440ef7f6c79540212955"
+    },
+    "independent/unittest.log": {
+      "bytes": 329,
+      "sha256": "34169a1efd6154fe6f00c8ccb016b48c0e9a6097b8ecdbec54776f00a40d1cce"
+    }
+  }
+}