Handoff: Decide which source-validation contract BuildTest restart must preserve

Written 2026-10-19 UTC. RE-VERIFY: This is the r76 write-time snapshot. Re-read the linked test, README and current branch; ask the owner for the decision rather than treating this document as approval.

Design decisions in force

2026-10-19 owner direction, verbatim:

"startup (and incremental recovery) should always be fast. If there is any situation where startup or incremental recovery are slow, that's a bug which should have been tested and exercised by https://github.com/CodexCoder21Organization/DocumentationRepository/blob/main/architecture/TESTING.md#extreme-condition-testing-load-fuzzing-failure-injection-and-chaos and which should be fixed."

The brief requires zero record/archive reads for unchanged restart and also says "Keep every existing recovery assertion" and "Never raise timeouts, reduce iterations, weaken assertions or skip tests." No exception for eager ownership-source validation was provided. Production is read-only; do not merge, enqueue, publish or deploy.

Remaining decision

Choose whether verified catalog rows may be trusted until a source is addressed or marked unfinished, explicitly revising the old eager-validation fixture/contract; or whether unchanged sources must still be opened to discover read failures, in which case zero unchanged-source reads is impossible. The r76 user question is pending; there is no approval to revise the test.

Evidence and proof

uploadOwnershipSeedRetainsUnreadableOwner.kts creates/cancels/archives a run through the API and closes it. Restart receives a filesystem that throws only on opening run.json; stored data and metadata remain unchanged. After awaitStartupRecovery, an unknown-marker query must throw the exact incomplete-index error, and the known-marker query must retry that run and throw the injected IOException. Returning to readable sources makes both queries succeed.

README documents initial full source validation and indexed owner absence; service line6690 says no durable owner is a complete indexed answer, never a reason to scan history. The test does not itself assert that awaitStartupRecovery throws; the failure is observed at the first query. Deferring a full scan to that query would hide the same history work and break the indexed-query contract.

Healthy and injected-failure stores produce identical observations until source(run.json) is called. An algorithm that opens zero unchanged records during recovery and does not scan history on indexed queries cannot produce different answers in these two cases. Metadata probes, a checksummed catalog and a single sampled record do not change that fact. Special-casing wrappers is not a valid implementation.

The new graceful guard already reliably fails on main (all3 automatic local attempts), independently of this contract conflict. It measured 6/48 unchanged record decodes and9438/75676 source bytes. Source/test head was 0a23fbd7011bc1d189f3fe0f651cbf3b37d98f9e. No production implementation was edited.

Relevant refs

Primary findings, native local XML/full stacktrace, direct stdout, remote setup-failure XML, baseline findings, writer/test inventory, unimplemented design sketch.

Local/remote heads were compared with git rev-parse HEAD and git ls-remote. Worktree clean, no stash, no unpushed local branches or extra worktree. This is the only branch created by the lane.

No code was deployed, published, merged or enqueued by this lane. No production mutation command was run.

Next steps

1. Re-verify the test and documented semantics on current main.
2. Obtain the owner decision explicitly and record the chosen public contract in the main work handoff/findings.
3. Complete this decision handoff only once that decision is recorded; then continue the dependent run-store implementation. Never change the separate journal0.0.21 recovery assertions.