Field hardening: one-click sign-off, tee dedupe, one-call boundary, unbounded-run guard - #10

Merged

ar2rsawseen merged 64 commits into

mainfrom

poc/ledger-no-redis

Sep 22, 2026

Commits on Sep 21, 2026

feat(ledger): Final check one-click sign-off + tee-overlap dedupe + rate-display fixes

ar2rsawseen
and
claude
committed
9f3f5e7
feat(ledger): one-call set-boundary + cluster-truth dashboard tiles

ar2rsawseen
and
claude
committed
df7d4a0
feat(ledger): startup guard — refuse to run unbounded against a live target

ar2rsawseen
and
claude
committed
d29620b
docs: keep deployment references generic

ar2rsawseen
and
claude
committed
26b6d77
fix(ledger): address review — dedupe native-counterpart evidence, stricter final check, cutover-clamped content audit, dedupe UI

ar2rsawseen
and
claude
committed
ba960a4
fix(ledger): harden guard evidence, strict dedupe gates, corroborated auto-apply, drift spot-check

ar2rsawseen
and
claude
committed
712cb2d
docs(runbook): clone-source migration variant — frozen-copy semantics, dedupe decision by T-swap vs T-clone

ar2rsawseen
and
claude
committed
91a55ab
docs: make the runbook and README self-contained for on-premise operators

ar2rsawseen
and
claude
committed
85c6aca
docs(runbook): scenario chooser first; clone-source framed as an optional variant of live-source runs

ar2rsawseen
and
claude
committed
17844e4
fix(ledger): distinct-id drift coverage, fail-closed DLQ/bound reads, no-scope dedupe refusal, env-bound cutover validation

ar2rsawseen
and
claude
committed
29dbff8
feat(ledger): tiered Final check — quick (ledger verify + samples) by default, deep source recount opt-in

ar2rsawseen
and
claude
committed
d8e0fc1
fix(ledger): scope dedupe id-matching end to end, slack-aware execute license, failed null-cd sweeps surface as mismatches

ar2rsawseen
and
claude
committed
93845d5
fix(ledger): claim-fenced bound apply, exact duplicate verdicts, overflow-safe checksums, identity-coverage spot-check

ar2rsawseen
and
claude
committed
efe8a82
fix(ledger): epoch-ms validation on bound application, NaN-proof sample counts

ar2rsawseen
and
claude
committed
26cf33e
fix(ledger): page id query-params at 2,000 — ClickHouse form-field limit

ar2rsawseen
and
claude
committed
6c61685
docs(runbook): what quick vs deep can and cannot see — deep is the decommissioning gate, not routine distrust

ar2rsawseen
and
claude
committed
b489a8d
fix(ledger): verify in both tiers with cutover awareness, sweep-row verification, bound rollback, persistent boundary question

ar2rsawseen
and
claude
committed
1e304c9
fix(ledger): fail-closed cutover validation, bound rollback restores prior value, DLQ-aware content sampling, dedupe staleness detection

ar2rsawseen
and
claude
committed
db3d8d9
fix(ledger): anchor-abutting auto-apply, no bound raises on pruned grids, full prune rollback, Resume-proof boundary hold, durable dedupe fingerprint

ar2rsawseen
and
claude
committed
5b145a1
fix(ledger): gap purity + cutover-aware duplicate boundary + id paging; REVERT unsound mid-run liveness probe

ar2rsawseen
and
claude
committed
e6c2cd8
fix(ledger): CAS bound store, complete rollback receipts, fail-closed raise check, honest sampler claim

ar2rsawseen
and
claude
committed
eb32b15
docs(runbook): naive table totals are orientation only on a live target — sign-off is windowed and scoped by construction

ar2rsawseen
and
claude
committed
ffe8eb5
fix(ledger): bound-aware prune rollback, persisted empty-target verdict, ordered set-boundary completion

ar2rsawseen
and
claude
committed
8c5eda5
docs(runbook): boundary question is answered once, before first write; verdict recorded cluster-wide

ar2rsawseen
and
claude
committed
3f980b3
fix(ledger): fingerprint-bracketed final check, indeterminate rollback reporting, waiver-aware sweep expectation

ar2rsawseen
and
claude
committed
d3ee233
fix(ledger): strict sweep-subtracted verification, fail-closed winner read, honest restore errors

ar2rsawseen
and
claude
committed
9f8446a
fix(ledger): CAS'd rollback, ledger-reconciled audit coverage, fail-closed dedupe fingerprint

ar2rsawseen
and
claude
committed
761d4df
test(ledger): model the vanished-collection scenario correctly (one of several drops; zero-match discovery already fails closed)

ar2rsawseen
and
claude
committed
7bb1300
fix(ledger): never restore under an assumed bound; quick verdicts never authorize teardown

ar2rsawseen
and
claude
committed
1fadb85
fix(ledger): per-write duplicate detection in restore, fingerprinted dedupe execute license

ar2rsawseen
and
claude
committed
ffbc30f
fix(ledger): absent-first DLQ discount in id coverage; unscoped windows block deep sign-off unless explicitly accepted

ar2rsawseen
and
claude
committed
f8c3fea
fix(ledger): auto-ack only on truly EMPTY targets, full drift-window coverage with stated evidence, discounted rebuilt sentinel

ar2rsawseen
and
claude
committed
6a28409
fix(ledger): map-vs-apply self-prune, absent-first sweep discount, probe-spread audit samples

ar2rsawseen
and
claude
committed
15efbf6
fix(ledger): post-claim bound fence, final-check/dedupe mutual exclusion

ar2rsawseen
and
claude
committed
a9696e5
fix(ledger): authoritative-only auto-ack, receipt-scoped clamping

ar2rsawseen
and
claude
committed
799ea14
fix(ledger): immutable env bound in the post-claim fence; pre-delete fingerprint fence in dedupe

ar2rsawseen
and
claude
committed
e88ce1b
fix(ledger): per-page delete fence, durable clamp gate, accepted expectations after rebuild

ar2rsawseen
and
claude
committed
124550e
fix(ledger): fence stride equals the staging DELETE page — one fence read per actual command

ar2rsawseen
and
claude
committed
63c5a81
fix(ledger): receipt-before-write prune, synchronous maintenance lock

ar2rsawseen
and
claude
committed
ac97407
fix(ledger): remove the automatic empty-target verdict — the boundary question is always answered explicitly

ar2rsawseen
and
claude
committed
15bda2a
fix(ledger): absent-intersected window discounts, tokenized bound ownership

ar2rsawseen
and
claude
committed
c662d63
fix(ledger): token-scoped fence casualties restored on bound rollback

ar2rsawseen
and
claude
committed
32b5bd9
fix(ledger): lost-ack compensations fail closed

ar2rsawseen
and
claude
committed
d011053
fix(ledger): apply-in-progress marker — claims release while the grid is provisional

ar2rsawseen
and
claude
committed
7090f42
Serialize bound applies via CAS marker; anchor dedupe execute to the licensed fingerprint

ar2rsawseen
and
claude
committed
422a726
Durable prune journal for bound applies; exclude null-cd sweep rows from dedupe native evidence

ar2rsawseen
and
claude
committed
77cd12b
Retry prune-journal recovery at claim time and completion; page huge receipts

ar2rsawseen
and
claude
committed
4673cfe
Drop rolled-back adopted bounds at map passes; replayed DLQ rows bump rows_expected

ar2rsawseen
and
claude
committed
0b9826d

Commits on Sep 22, 2026

Defer receipt-less prunes while an apply is in flight; replay accounting made crash-proof

ar2rsawseen
and
claude
committed
a0f87c4
Dedupe matches and deletes exact (_id, cd) pairs; reconcile replay intent on chunk-window purge

ar2rsawseen
and
claude
committed
6bd0fff
Frozen-source bracket for unbounded deep checks; recover journal pages by _id

ar2rsawseen
and
claude
committed
0428c52
Round 38: row-exact sweep evidence, pair-exact null-cd audits, marker heartbeat, cluster maintenance lock

ar2rsawseen
and
claude
committed
0cd9051
Refuse dedupe execute on the dry-run service; a lost maintenance lease aborts the operation

ar2rsawseen
and
claude
committed
1478287
Ownership-fence prune writes; frozen-source bracket uses exact count + cd checksum

ar2rsawseen
and
claude
committed
737af53
Dedupe deletes only the observed live subset; bracket compares both directions; replay holds the reservation

ar2rsawseen
and
claude
committed
23fda18
Bracket the audited prefix on bounded deep checks; reduce the source checksum server-side

ar2rsawseen
and
claude
committed
167cf7a
Primary reads for decision-authorizing probes; synchronous lease revalidation at decision points

ar2rsawseen
and
claude
committed
0cb43fb
Fence generation makes prune mutations atomic with ownership

ar2rsawseen
and
claude
committed
db27346
Target-stability bracket on both check tiers; identity hash in the source checksum

ar2rsawseen
and
claude
committed
ffc888d
Scope replay already-live presence checks per source collection

ar2rsawseen
and
claude
committed
7d9b424
Replay inserts are idempotent by reconciliation

ar2rsawseen
and
claude
committed
f50a488
Pair-exact replay reconciliation; sweep pairs join the target bracket

ar2rsawseen
and
claude
committed
377e21d
Replay: resolution failures never re-trigger target inserts

ar2rsawseen
and
claude
committed
b19d39b
Duplicate groups are scoped to the source identity

ar2rsawseen
and
claude
committed
0bf1895