Honor checkpoint tombstones in bounded node liveness (#894)

[flyingrobots]

Outcome

Closes #894. A checkpoint remove may already observe a dot whose add arrives later in the tail. The bounded node read previously treated every tail add as alive and could resurrect that removed node.

Node reads now consume the checkpoint lifecycle receipt’s floating tombstones and include that evidence in their read identity. A tail add without lifecycle evidence refuses with the existing structured bounded-basis cause. Existing refusal for tail node removes remains intact; unchanged legacy checkpoint membership remains readable. No materialization fallback or checkpoint format change is introduced.

Validation

All executable checks use COPY-based Docker without host repository/Git mounts.

• RED on main: removed-only membership incorrectly returns alive, and missing-receipt reads incorrectly succeed (two expected assertion failures).
• GREEN: real checkpoint writer/locator cases compare against full JoinReducer membership in forward/reverse delivery, including independent live adds in checkpoint/tail, malformed/missing receipts and read-identity evidence.
• Relevant optic/conformance suite: 122 tests across 22 files pass; source/test typechecking and focused lint pass.

Independent exact-head review and hosted CI remain required before merge.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 6 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: b1c6fac5-9338-413d-b340-958bef3e7738

📥 Commits

Reviewing files that changed from the base of the PR and between 780280e and 5c95845.

📒 Files selected for processing (5)

• CHANGELOG.md
• src/domain/services/optic/CheckpointTailFactReducer.ts
• src/domain/services/optic/CheckpointTailWitnessLocator.ts
• test/helpers/CheckpointTailLifecycleHarness.ts
• test/unit/domain/services/optic/CheckpointTailWitnessLocator.nodeLiveness.test.ts

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[flyingrobots]

Code Lawyer activity summary — head f183d21c1079ed5ca25a965eb8c000afe0bb74a4.

Item	Outcome	Evidence
Floating removed-dot membership (#894)	Confirmed and fixed	Real checkpoint-writer roots plus locator returned alive for an already removed dot before the fix; now agree with full JoinReducer membership
Missing lifecycle evidence	Fail closed	A late add without a receipt refuses with the existing typed cause; unchanged legacy membership still reads
Read provenance	Includes consumed evidence	The node read identity names the lifecycle receipt and applicable shard; malformed receipt refuses
Compatibility	Preserved existing tail-remove refusal	Relevant public conformance suite passes without materialization fallback or schema change
Validation	Passed	122 tests/22 files, source/test typechecking, focused lint; full Docker pre-push:8,291 passed tests and two existing skips

Manual SSJS: the existing checkpoint reader validates the receipt; the existing node scan owns dot liveness; the locator binds consumed shards into read identity. No host capability, ambient time/entropy, message parsing or casts added. This is a behavior correction, not a claim of full-module coverage or a general checkpoint refactor.

All acceptance execution used COPY-only Docker without host repository/Git mounts. Independent exact-head review and hosted CI remain outstanding; this is not merge approval.

[github-actions]

Release Preflight

Head: 5c9584502f76eda25ca4343ac5adfd499036d689 · Workflow and complete bundle evidence

• package version: 19.1.0
• prerelease: false
• npm dist-tag on release: latest
• preflight: success
• npm package payload: success
• jsr publish dry-run: success

npm bundle analysis

Metric	Measured	Limit	Usage	Remaining	Assessment
Compressed bytes	742728	760000	97.7%	17272	⚠️ Critical headroom
Unpacked bytes	3245696	3300000	98.4%	54304	⚠️ Critical headroom
Files	968	1050	92.2%	82	⚠️ Approaching limit

Warnings begin at 85% of a limit; critical headroom begins at 95%. Exceeding a limit fails the existing payload gate.

Payload group	Unpacked bytes
Declarations	228179
JavaScript	2896060
Metadata, documentation, and assets	121457

Findings (0)

No static inspection findings.

Static reachability findings are deletion candidates, not proof that a file is safe to remove. Dependency checks cover imports and manifest declarations; they are not a vulnerability audit.

Largest files (unpacked)

File	Bytes	Share
dist/src/domain/RuntimeHost.js	35335	1.1%
README.md	31900	1.0%
docs/migrations/v19/README.md	30752	0.9%
dist/src/domain/orset/trie/TrieCursor.js	24348	0.8%
docs/READINGS_AND_OPTICS.md	23600	0.7%
dist/src/domain/services/controllers/CheckpointController.js	17842	0.5%
dist/src/domain/services/JoinReducerSession.js	17742	0.5%
dist/src/domain/services/PatchBuilder.js	16761	0.5%
dist/src/domain/services/controllers/SyncController.js	16219	0.5%
dist/src/domain/services/optic/CheckpointBasisManifest.js	15503	0.5%

A release-branch merge still requires final preflight and the normal release workflow.

[flyingrobots]

Independent Codex review — PR #935

PR: #935

Exact reviewed head: f183d21c1079ed5ca25a965eb8c000afe0bb74a4 (fix/894-checkpoint-node-liveness). Target main; base a6a395eaecf2c9a0f644d32f89fd67930b975004.

I performed the authorized independent Codex substitute for agy, applying the full agy-review mandatory protocol and output contract. This implementation belongs to the parent agent. No reviewed source, comments, branches or configuration were modified; no subagents were used. Approval does not authorize merging.

Findings

No verified P0–P5 defects in this exact-head change. The floating removed-dot discrepancy is reproduced, the corrected bounded result agrees with independent expected membership and full JoinReducer replay, and missing evidence refuses instead of assuming an add survives.

Verification Checklist

Lockdown, history, scope and live feedback

• Clean checkout at the exact head; full five-file diff and surrounding reducer/locator modules inspected. The only commit is f183d21c1079ed5ca25a965eb8c000afe0bb74a4, whose sole parent is the stated base. There are no merge commits, extra incoming changes or conflict resolutions to audit. The merged lifecycle-receipt writer/reader is already in the base and remains unchanged.
• Read current GitHub Bounded node liveness read counts a tail add as live when a checkpoint remove observed its dot #894 and PR Honor checkpoint tombstones in bounded node liveness (#894) #935 bodies. Exhausted GraphQL connections: three global comments, zero reviews, zero threads, all ending hasNextPage: false; no nested thread pages exist. Read CodeRabbit's draft notice, the author's activity summary and exact-head release-preflight comment. CodeRabbit's successful status is not an independent source review. Evidence: git-warp-935-all-conversation.json.
• Read Linear FLY-251, matching acceptance, In Progress state and all four comments, with hasNextPage: false. Historical source-derived hypothesis/audit coordinates remain explicitly historical; current comments record actual reproduction and correction. No measured affected-user population is invented. Main integration and its durable issue linkage remain future closure work.
• Applied AGENTS.md, Anti-Sludge Policy, Anti-Sludge Decisions and SSTS, previously read in full and verified unchanged against this base. Neither changed production module nor the touched harness appears in the quarantine manifests. Locator/reducer/harness sizes are 497/359/374 lines; new test is 53 lines, within binding limits. No new cast, any, unknown, fake trust, host capability, ambient time/entropy, broad suppression or adapter construction appears. The new reader import is type-only, so does not create a runtime cycle.
• Manual SSJS is green: existing validated receipt remains the boundary authority, dot membership remains on the existing node scan, and the locator binds consumed evidence to identity. The touched harness replaces unknown/reflection handling with typed QueryError context and rethrows unrelated failures. This is a focused behavior correction, not a preservation-only refactor or claim of whole-module 100% coverage.

Every changed behavior and production path

Path	Trace and result
Public node-exists reading	src/domain/api/ReadingRuntime.ts:76 / :83 → :117 / :124 → src/domain/WarpWorldline.ts:277 → src/domain/services/ProjectionHandle.ts:123 → src/domain/services/optic/WorldlineOptic.ts:31 / :45 → NodeOptic.ts:29 → CheckpointTailWitnessLocator.ts:94 / :173. This shared locator implements the correction.
Captured timeline and draft reads	src/domain/api/TimelineViewRuntime.ts:14 / :20 and DraftTimelineRuntime.ts:148 / :154 deliver coordinate optics to the same ReadingRuntime executor. Captured ProjectionHandle optics at ProjectionHandle.ts:230 and draft strand optics at WarpWorldline.ts:426 / :449 use CoordinateCheckpointTailOpticSource and the same WorldlineOptic/locator. No alternate liveness reducer is introduced.
Exact-id bounded query	ProjectionHandle.ts:182 / :199 → src/domain/services/query/CheckpointTailExactIdQueryReadModel.ts:75 → NodeOptic/locator; false membership yields no node, and identity serializes the completed read identity. Query scopes outside this optimization retain their existing read-model path.
Bounded checkpoint and tail inputs	CheckpointTailWitnessLocator.ts:174 reads captured basis, :175 metadata alive bit, :176 relevant tail and new :177 lifecycle evidence. :318 uses includesNodeLiveness; CheckpointTailWitnessScan.ts:35, :74, :96 retain sorted writer discovery, checkpoint frontier stopping, budget and validation. There is no materialization fallback.
Receipt admission and additional I/O	CheckpointShardFactReader.ts:159 loads the receipt, validates it at :213 through src/domain/services/index/NodeLifecycleShardReader.ts:80, builds the floating-dot set, then loads at most the node's applicable lifecycle shard. Receipt constructors validate safe counts and ascending valid dots at src/domain/artifacts/NodeLifecycleReceipt.ts:30 / :53; decoder checks exact envelope, schema and shard-count agreement. Each opened shard is identity-bound at CheckpointShardFactReader.ts:277 and byte-bounded at :358 / :382. The new node path adds receipt plus at most one lifecycle-member read, not full materialization. This is additional I/O/allocation; no zero-cost or whole-heap bound is claimed.
Corrected reduction	CheckpointTailFactReducer.ts:99 → _assertNoNodeRemoves at :195 → CheckpointTailNodeScan.ts:52 / :103. Relevant tail removes still refuse before any success, including empty-observation removes. An unwitnessed tail add refuses; an unchanged unwitnessed tail preserves the metadata bit. A witnessed tail add survives only if its dot is outside checkpoint floating tombstones; without surviving adds the checkpoint bit stands. Since all target removes were refused, the scan cannot produce undecided here. Independent adds in checkpoint or tail remain alive.
Identity completeness	CheckpointTailWitnessLocator.ts:187 combines existing meta identity with receipt/applicable lifecycle identities (CheckpointShardFactReader.ts:178), then CheckpointTailReadIdentityBuilder.ts:23 / :79 includes checkpoint SHA/frontier, worldline/aspect, shard OIDs and sorted tail witness identities. ReadIdentity freezes copies. Receipt-backed reads now have different identity evidence from the old implementation; legacy unchanged reads have unchanged inputs and behavior. No omitted newly consumed member or new duplicate path was found.
Existing property behavior	CheckpointTailWitnessLocator.ts:201 → CheckpointNodePropertyWitness and existing CheckpointTailFactReducer.ts:118 use the same floating-dot scan with property lifecycle/register semantics. That path and its tests remain unchanged and green; liveness correction does not replace property-clear semantics. Neighborhood/traversal paths remain adjacency reads, not alternative node-exists implementations.
Materialized/retained node presence	ProjectionHandle.ts:160 → src/domain/services/query/Observer.ts:290 → snapshot StateReader (src/domain/services/state/StateReader.ts:51 / :156) or graph query. src/domain/services/controllers/QueryReads.ts:124 first uses retained presence, otherwise full state membership at :132; RuntimeHost.ts:446 → MaterializeController.ts:169 delegates the retained strategy. src/domain/materialization/TrieMaterializationReader.ts:46 checks the retained causal cursor. Full-state oracle is JoinReducer.ts:127 → NodeAdd.ts:37 / NodeRemove.ts:37 → ORSet.ts:94 / :111 / :125, preserving global tombstones regardless of delivery order. These are retained/materialized views of their own basis, not a second checkpoint-tail reducer.

Errors, transitions, resource constraints and compatibility

• Missing receipt is distinguished from malformed receipt. No receipt plus unchanged tail preserves old readable membership; no receipt plus add refuses. Unsupported receipt schema, member-count disagreement, invalid dot/order, malformed node lifecycle member, unavailable bytes or mismatched handle cannot silently become a successful membership result.
• Existing QueryErrors flow through locator readNode to CheckpointTailReadFailure.ts:40; existing registered causes include both lifecycle-add and raw-remove refusals. Enrichment replaces structured context without nested exception causes; non-QueryErrors rethrow. The harness also rethrows unexpected failures instead of classifying them as expected refusals.
• This is a read path with no publication, mutable transaction, retention change, stream-start API or shutdown hold. Added awaits can fail before result construction, leaving no partially published result. Existing APIs do not accept a new abort signal here; cancellation routing is unchanged. Process death, physical power loss and new recovery behavior are neither implemented nor claimed.
• No production limit/timing/buffer/timeout constant changed. Existing MAX_MATERIALIZATION_INDEX_SHARD_BYTES = 16 * 1024 * 1024 at MaterializationIndexProfile.ts:3 applies to the additional receipt/member reads and matches the documented stricter optic boundary at docs/topics/content-and-cas.md:147. Existing locator default 10,000 tail patches and scanner accounting remain unchanged. Decoded receipt sets allocate proportional to the bounded shard; 16 MiB encoded does not claim 16 MiB whole-heap usage. No new performance or memory benchmark is claimed.
• Existing public conformance tail-remove witness at test/conformance/v17CheckpointTailOpticReadBasis.test.ts:110 still verifies the structured refusal and traps materialization fallback. Unchanged first-use/captured-coordinate and property suites execute with the new node path. No checkpoint format, materialization schema, receipt version, release metadata or supported root export changes occur.

Assertions, raw evidence and every numeric claim

Check/claim	Verified outcome and evidence
Load-bearing golden/oracle	Seven new tests compare explicit expected false/true membership with real full JoinReducer state in forward/reverse patch delivery and the production locator over actual MaterializationIndexRootPlan output. Mock storage supplies boundary bytes, not a canned membership answer. Independent surviving checkpoint/tail dots calibrate against a blanket-false implementation. Receipt provenance, legacy unchanged membership, malformed and missing receipt cases are distinct.
RED on stated parent	Independently verified both changed runtime files in git-warp-894:red byte-for-byte against base a6a395e; evidence git-warp-935-red-parent-hashes.log. Executed that COPY image: two expected assertion failures and two passing positive controls, exit 1 (git-warp-935-independent-red.log). Removed-only returns true instead of false; missing receipt succeeds instead of refusing. This initial RED fixture has four cases; the final seven-case fixture adds identity, invalid receipt and unchanged-legacy checks. Author git-warp-894-red.log agrees.
Exact-head GREEN	Independently SHA-256 compared every changed file with COPY image git-warp-894:final, image ID sha256:4f7d366bdb780d40129e141bd03dd52fa19cce9ea5d3eb4fa092be15c5f7b6bf; all five paths match (git-warp-935-image-source-hashes.log). Independent COPY-only optic plus v17/v18 conformance run passes 122 tests in 22 files with no skips (git-warp-935-independent-optics.log). Author final log has identical totals. Containers used two CPUs/two GiB, no host mounts or isolation bypass.
Full normal gate	Inspected complete git-warp-894-push.log: all normal static/npm gates, including Mermaid execution, pass; six stable shards total 245+917+781+3090+2091+1167 = 8,291 passed tests and two existing skips; 48+89+128+265+142+89 = 761 passed files and one skipped file. Gate 0 explicitly skips lychee because absent; hosted broken-link check succeeds. Full stable suite and static gates were inspected, not redundantly rerun by this review.
Source documentation	CHANGELOG's new four-line entry accurately describes honoring checkpoint tombstones and refusing unwitnessed adds; it contains no new measured figure. Other tracked README/topic/architecture/release text and historical measurements are unchanged. Issue numbers and schema constants in fixtures are coordinates/controls, not timing or resource claims. Fixture schema 3 intentionally differs from current lifecycle receipt schema 2.
Hosted bundle numeric claims	Downloaded exact-head preflight run 37070506660's npm-bundle-analysis artifact. Independently counted archive bytes/files: compressed 741,725; unpacked 3,242,649; 968 files, matching the posted report. Declarations 228,179 + JS 2,896,060 + other 118,410 equal total. Limits 760,000 / 3,300,000 / 1,050 match PackagePayloadPolicy.ts:50; usage percentages/remaining values are arithmetically correct. Warning/critical thresholds 85%/95% match PackageBundleReport.ts:4. All ten largest-file byte counts and rounded shares also match the actual archive. These are exact-run historical measurements, not universal package guarantees.
Hosted current head	Final git-warp-935-final-checks.json still identifies the reviewed full SHA and main base. All 20 check runs and the CodeRabbit status are successful, including packed consumers, Node22, Bun, Deno, coverage, preflight, performance, type firewall aggregate and link check. Status success does not replace source review or demonstrate universal absence of regressions.

Coverage limitations and merge gate

No mandatory source-review area for this focused change remains unavailable. The new floating-dot fixture is production-writer/locator integration, not a claim of a separately executed root Runtime end-to-end workflow. Existing public optic conformance was independently executed. No fuzz distribution, affected-user population, full heap bound, crash durability or full-module 100% coverage is claimed.

Source acceptance for #894 is satisfied at this exact head; normal local gates and hosted checks are green. Root must preserve current-head review/CI and repository protections and record the eventual main integration before closing the issue. This report grants no merge authorization.

APPROVE

[flyingrobots]

Main integration preparation

Merged current main 780280ea8f95503f7c26f97ace4c1281de84a70a into this branch without rebasing or rewriting history. New local head 5c9584502f76eda25ca4343ac5adfd499036d689 preserves the approved liveness runtime/test changes and incorporates the reviewed ownership contract and attachment guide. No conflict resolution was required.

The normal full COPY-Docker push gate is running before publication. An exact-head independent integration review is requested; fresh hosted checks will also gate merge. This comment does not claim the unpublished head is already accepted or integrated.

[flyingrobots]

Independent Codex integration review — PR #935

Exact current head: 5c9584502f76eda25ca4343ac5adfd499036d689, target main, current base 780280ea8f95503f7c26f97ace4c1281de84a70a. The published GitHub head was verified after the complete normal push gate. The original full checklist below is retained with its historical coordinates; the integration checklist explicitly verifies which conclusions remain applicable.

No new verified defect. The original four non-changelog paths remain byte-identical, the incoming ownership model stays test-only, and the guide expressly separates byte capability from structural ownership. Source review approves this head. New hosted checks are running and remain a separate merge blocker; the previous head's successful CI is not current-head evidence. This report does not authorize merging.

Original exact-head review retained as historical evidence — PR #935

PR: #935

Exact reviewed head: f183d21c1079ed5ca25a965eb8c000afe0bb74a4 (fix/894-checkpoint-node-liveness). Target main; base a6a395eaecf2c9a0f644d32f89fd67930b975004.

I performed the authorized independent Codex substitute for agy, applying the full agy-review mandatory protocol and output contract. This implementation belongs to the parent agent. No reviewed source, comments, branches or configuration were modified; no subagents were used. Approval does not authorize merging.

Findings

No verified P0–P5 defects in this exact-head change. The floating removed-dot discrepancy is reproduced, the corrected bounded result agrees with independent expected membership and full JoinReducer replay, and missing evidence refuses instead of assuming an add survives.

Verification Checklist

Lockdown, history, scope and live feedback

• Clean checkout at the exact head; full five-file diff and surrounding reducer/locator modules inspected. The only commit is f183d21c1079ed5ca25a965eb8c000afe0bb74a4, whose sole parent is the stated base. There are no merge commits, extra incoming changes or conflict resolutions to audit. The merged lifecycle-receipt writer/reader is already in the base and remains unchanged.
• Read current GitHub Bounded node liveness read counts a tail add as live when a checkpoint remove observed its dot #894 and PR Honor checkpoint tombstones in bounded node liveness (#894) #935 bodies. Exhausted GraphQL connections: three global comments, zero reviews, zero threads, all ending hasNextPage: false; no nested thread pages exist. Read CodeRabbit's draft notice, the author's activity summary and exact-head release-preflight comment. CodeRabbit's successful status is not an independent source review. Evidence: git-warp-935-all-conversation.json.
• Read Linear FLY-251, matching acceptance, In Progress state and all four comments, with hasNextPage: false. Historical source-derived hypothesis/audit coordinates remain explicitly historical; current comments record actual reproduction and correction. No measured affected-user population is invented. Main integration and its durable issue linkage remain future closure work.
• Applied AGENTS.md, Anti-Sludge Policy, Anti-Sludge Decisions and SSTS, previously read in full and verified unchanged against this base. Neither changed production module nor the touched harness appears in the quarantine manifests. Locator/reducer/harness sizes are 497/359/374 lines; new test is 53 lines, within binding limits. No new cast, any, unknown, fake trust, host capability, ambient time/entropy, broad suppression or adapter construction appears. The new reader import is type-only, so does not create a runtime cycle.
• Manual SSJS is green: existing validated receipt remains the boundary authority, dot membership remains on the existing node scan, and the locator binds consumed evidence to identity. The touched harness replaces unknown/reflection handling with typed QueryError context and rethrows unrelated failures. This is a focused behavior correction, not a preservation-only refactor or claim of whole-module 100% coverage.

Every changed behavior and production path

Path	Trace and result
Public node-exists reading	src/domain/api/ReadingRuntime.ts:76 / :83 → :117 / :124 → src/domain/WarpWorldline.ts:277 → src/domain/services/ProjectionHandle.ts:123 → src/domain/services/optic/WorldlineOptic.ts:31 / :45 → NodeOptic.ts:29 → CheckpointTailWitnessLocator.ts:94 / :173. This shared locator implements the correction.
Captured timeline and draft reads	src/domain/api/TimelineViewRuntime.ts:14 / :20 and DraftTimelineRuntime.ts:148 / :154 deliver coordinate optics to the same ReadingRuntime executor. Captured ProjectionHandle optics at ProjectionHandle.ts:230 and draft strand optics at WarpWorldline.ts:426 / :449 use CoordinateCheckpointTailOpticSource and the same WorldlineOptic/locator. No alternate liveness reducer is introduced.
Exact-id bounded query	ProjectionHandle.ts:182 / :199 → src/domain/services/query/CheckpointTailExactIdQueryReadModel.ts:75 → NodeOptic/locator; false membership yields no node, and identity serializes the completed read identity. Query scopes outside this optimization retain their existing read-model path.
Bounded checkpoint and tail inputs	CheckpointTailWitnessLocator.ts:174 reads captured basis, :175 metadata alive bit, :176 relevant tail and new :177 lifecycle evidence. :318 uses includesNodeLiveness; CheckpointTailWitnessScan.ts:35, :74, :96 retain sorted writer discovery, checkpoint frontier stopping, budget and validation. There is no materialization fallback.
Receipt admission and additional I/O	CheckpointShardFactReader.ts:159 loads the receipt, validates it at :213 through src/domain/services/index/NodeLifecycleShardReader.ts:80, builds the floating-dot set, then loads at most the node's applicable lifecycle shard. Receipt constructors validate safe counts and ascending valid dots at src/domain/artifacts/NodeLifecycleReceipt.ts:30 / :53; decoder checks exact envelope, schema and shard-count agreement. Each opened shard is identity-bound at CheckpointShardFactReader.ts:277 and byte-bounded at :358 / :382. The new node path adds receipt plus at most one lifecycle-member read, not full materialization. This is additional I/O/allocation; no zero-cost or whole-heap bound is claimed.
Corrected reduction	CheckpointTailFactReducer.ts:99 → _assertNoNodeRemoves at :195 → CheckpointTailNodeScan.ts:52 / :103. Relevant tail removes still refuse before any success, including empty-observation removes. An unwitnessed tail add refuses; an unchanged unwitnessed tail preserves the metadata bit. A witnessed tail add survives only if its dot is outside checkpoint floating tombstones; without surviving adds the checkpoint bit stands. Since all target removes were refused, the scan cannot produce undecided here. Independent adds in checkpoint or tail remain alive.
Identity completeness	CheckpointTailWitnessLocator.ts:187 combines existing meta identity with receipt/applicable lifecycle identities (CheckpointShardFactReader.ts:178), then CheckpointTailReadIdentityBuilder.ts:23 / :79 includes checkpoint SHA/frontier, worldline/aspect, shard OIDs and sorted tail witness identities. ReadIdentity freezes copies. Receipt-backed reads now have different identity evidence from the old implementation; legacy unchanged reads have unchanged inputs and behavior. No omitted newly consumed member or new duplicate path was found.
Existing property behavior	CheckpointTailWitnessLocator.ts:201 → CheckpointNodePropertyWitness and existing CheckpointTailFactReducer.ts:118 use the same floating-dot scan with property lifecycle/register semantics. That path and its tests remain unchanged and green; liveness correction does not replace property-clear semantics. Neighborhood/traversal paths remain adjacency reads, not alternative node-exists implementations.
Materialized/retained node presence	ProjectionHandle.ts:160 → src/domain/services/query/Observer.ts:290 → snapshot StateReader (src/domain/services/state/StateReader.ts:51 / :156) or graph query. src/domain/services/controllers/QueryReads.ts:124 first uses retained presence, otherwise full state membership at :132; RuntimeHost.ts:446 → MaterializeController.ts:169 delegates the retained strategy. src/domain/materialization/TrieMaterializationReader.ts:46 checks the retained causal cursor. Full-state oracle is JoinReducer.ts:127 → NodeAdd.ts:37 / NodeRemove.ts:37 → ORSet.ts:94 / :111 / :125, preserving global tombstones regardless of delivery order. These are retained/materialized views of their own basis, not a second checkpoint-tail reducer.

Errors, transitions, resource constraints and compatibility

• Missing receipt is distinguished from malformed receipt. No receipt plus unchanged tail preserves old readable membership; no receipt plus add refuses. Unsupported receipt schema, member-count disagreement, invalid dot/order, malformed node lifecycle member, unavailable bytes or mismatched handle cannot silently become a successful membership result.
• Existing QueryErrors flow through locator readNode to CheckpointTailReadFailure.ts:40; existing registered causes include both lifecycle-add and raw-remove refusals. Enrichment replaces structured context without nested exception causes; non-QueryErrors rethrow. The harness also rethrows unexpected failures instead of classifying them as expected refusals.
• This is a read path with no publication, mutable transaction, retention change, stream-start API or shutdown hold. Added awaits can fail before result construction, leaving no partially published result. Existing APIs do not accept a new abort signal here; cancellation routing is unchanged. Process death, physical power loss and new recovery behavior are neither implemented nor claimed.
• No production limit/timing/buffer/timeout constant changed. Existing MAX_MATERIALIZATION_INDEX_SHARD_BYTES = 16 * 1024 * 1024 at MaterializationIndexProfile.ts:3 applies to the additional receipt/member reads and matches the documented stricter optic boundary at docs/topics/content-and-cas.md:147. Existing locator default 10,000 tail patches and scanner accounting remain unchanged. Decoded receipt sets allocate proportional to the bounded shard; 16 MiB encoded does not claim 16 MiB whole-heap usage. No new performance or memory benchmark is claimed.
• Existing public conformance tail-remove witness at test/conformance/v17CheckpointTailOpticReadBasis.test.ts:110 still verifies the structured refusal and traps materialization fallback. Unchanged first-use/captured-coordinate and property suites execute with the new node path. No checkpoint format, materialization schema, receipt version, release metadata or supported root export changes occur.

Assertions, raw evidence and every numeric claim

Check/claim	Verified outcome and evidence
Load-bearing golden/oracle	Seven new tests compare explicit expected false/true membership with real full JoinReducer state in forward/reverse patch delivery and the production locator over actual MaterializationIndexRootPlan output. Mock storage supplies boundary bytes, not a canned membership answer. Independent surviving checkpoint/tail dots calibrate against a blanket-false implementation. Receipt provenance, legacy unchanged membership, malformed and missing receipt cases are distinct.
RED on stated parent	Independently verified both changed runtime files in git-warp-894:red byte-for-byte against base a6a395e; evidence git-warp-935-red-parent-hashes.log. Executed that COPY image: two expected assertion failures and two passing positive controls, exit 1 (git-warp-935-independent-red.log). Removed-only returns true instead of false; missing receipt succeeds instead of refusing. This initial RED fixture has four cases; the final seven-case fixture adds identity, invalid receipt and unchanged-legacy checks. Author git-warp-894-red.log agrees.
Exact-head GREEN	Independently SHA-256 compared every changed file with COPY image git-warp-894:final, image ID sha256:4f7d366bdb780d40129e141bd03dd52fa19cce9ea5d3eb4fa092be15c5f7b6bf; all five paths match (git-warp-935-image-source-hashes.log). Independent COPY-only optic plus v17/v18 conformance run passes 122 tests in 22 files with no skips (git-warp-935-independent-optics.log). Author final log has identical totals. Containers used two CPUs/two GiB, no host mounts or isolation bypass.
Full normal gate	Inspected complete git-warp-894-push.log: all normal static/npm gates, including Mermaid execution, pass; six stable shards total 245+917+781+3090+2091+1167 = 8,291 passed tests and two existing skips; 48+89+128+265+142+89 = 761 passed files and one skipped file. Gate 0 explicitly skips lychee because absent; hosted broken-link check succeeds. Full stable suite and static gates were inspected, not redundantly rerun by this review.
Source documentation	CHANGELOG's new four-line entry accurately describes honoring checkpoint tombstones and refusing unwitnessed adds; it contains no new measured figure. Other tracked README/topic/architecture/release text and historical measurements are unchanged. Issue numbers and schema constants in fixtures are coordinates/controls, not timing or resource claims. Fixture schema 3 intentionally differs from current lifecycle receipt schema 2.
Hosted bundle numeric claims	Downloaded exact-head preflight run 37070506660's npm-bundle-analysis artifact. Independently counted archive bytes/files: compressed 741,725; unpacked 3,242,649; 968 files, matching the posted report. Declarations 228,179 + JS 2,896,060 + other 118,410 equal total. Limits 760,000 / 3,300,000 / 1,050 match PackagePayloadPolicy.ts:50; usage percentages/remaining values are arithmetically correct. Warning/critical thresholds 85%/95% match PackageBundleReport.ts:4. All ten largest-file byte counts and rounded shares also match the actual archive. These are exact-run historical measurements, not universal package guarantees.
Hosted current head	Final git-warp-935-final-checks.json still identifies the reviewed full SHA and main base. All 20 check runs and the CodeRabbit status are successful, including packed consumers, Node22, Bun, Deno, coverage, preflight, performance, type firewall aggregate and link check. Status success does not replace source review or demonstrate universal absence of regressions.

Coverage limitations and merge gate

No mandatory source-review area for this focused change remains unavailable. The new floating-dot fixture is production-writer/locator integration, not a claim of a separately executed root Runtime end-to-end workflow. Existing public optic conformance was independently executed. No fuzz distribution, affected-user population, full heap bound, crash durability or full-module 100% coverage is claimed.

Source acceptance for #894 is satisfied at this exact head; normal local gates and hosted checks are green. Root must preserve current-head review/CI and repository protections and record the eventual main integration before closing the issue. This report grants no merge authorization.

Integration Verification Checklist at the current head

• Clean reviewed checkout. Merge 5c9584502f76eda25ca4343ac5adfd499036d689 has exactly two parents: original approved f183d21c1079ed5ca25a965eb8c000afe0bb74a4 and main 780280ea8f95503f7c26f97ace4c1281de84a70a. Both complete parent diffs inspected. Against main, the original five-file change is preserved, with the changelog correction added to the existing main entries. Against the original head, only the already reviewed Define recursive attachment ownership and descendant-preserving mutation semantics #903/Correct public attachment documentation and publish executable capability examples #904 topic/migration documentation and test-only model are added. No conflict resolution, changed production caller, runtime merge, new configuration or manifest change exists.
• All 17 changed paths compared by SHA-256 with fresh COPY image git-warp-894:integration, ID sha256:e3b1416c1c07a8a6a048f0be10da83a5295c91d6378c690fa178df45a6416dd7. Every non-changelog path also compared byte-for-byte with its relevant original or incoming parent. Evidence: git-warp-935-integration-source-hashes.log. Changelog's two additive parent diffs were read directly rather than treating a hash inequality as a conflict.
• Every original production path, parallel node/property/retained read path, structured error, lifecycle admission/identity check, tail-remove refusal, default patch budget and 16 MiB member limit remains exactly as traced in the full historical checklist. The merged parent contains no production edits. Consequently none of these traces is inferred solely from a merge message, and no previously reviewed path or refusal is rerouted.
• Incoming ownership witness path remains test/unit/specs/StructuralAttachments.test.ts to test/helpers/structuralAttachments/AttachmentContractTick.ts, StructuralAttachmentState.ts, SkeletonRewrite.ts, AttachmentUpdate.ts and the validated ownership/value objects. It has no production import and does not claim a new Runtime API. Its 14 tests exercise finite acyclic complete ownership, node/edge symmetry, protected-descendant deletion/copy refusal, transport, independent update ordering, stable conflicts, stale-basis rejection and private rollback. The complete supplied ownership forest is separate from mutations that do not create containment links. Neither membership tombstones nor opaque content handles are reclassified as structural ownership.
• Incoming guide laws remain consistent with corrected liveness: unavailable evidence obstructs observation; missing association is distinguished from unavailable history; whole-array graph publication does not imply storage rollback; captured payloads need retained history/storage and a live originating Runtime. No claim that CRDT convergence supplies Paper II scheduling or DPOI is introduced. Pinned Paper I/II links, explicit single-parent occurrence adaptation and encoding/traversal/retention exclusions are unchanged from their separately reviewed main integration. Their full source text was previously read; delta verification confirms no paper requirement or attribution changed here.
• Numeric/constant review: no runtime timing, buffer, size or rate constant changes in either parent integration. Packed fixture still generates 64 × 1024-byte chunks 1,024 times = 67,108,864 bytes (64 MiB). Historical storage witness paragraph still names 2 GiB generation, 384 MiB container and 96 MiB heap, matching the unchanged named runner inspected in Document the supported byte attachment lifecycle and migration (#904) #938; that experiment is not newly executed or claimed here. The source-built/published-v19 distinction, optional metadata, pre-existing limits and illustrative encryption values remain explicit. No new performance claim or parameter makes a historical value current. The original preflight archive measurements remain pinned to original head/run 37070506660, not transplanted to this integration head.
• Repository standards unchanged; original runtime correction is still behavior work, and incoming model is test-only contract evidence. No whole-module 100% claim is invented. Checked source/test paths and sizes are unchanged; additive docs retain portable links and prose. Manual SSJS remains green for the original changed modules, and the immutable incoming model introduces no adapter or host capability into production.
• Live feedback refreshed after publication: git-warp-935-integration-final-threads.json names the exact new head; five global comments, zero reviews and zero threads are exhausted with every hasNextPage:false. Existing posted original review, actual historical preflight report, author activity summary and explicit pending-integration comment read; CodeRabbit's current rate-limit notice does not provide source approval. GitHub Bounded node liveness read counts a tail add as live when a checkpoint remove observed its dot #894 current acceptance and zero comments re-read. Linear FLY-251 remains In Review; all five comments read with hasNextPage:false (git-warp-935-integration-linear.json). No new actionable feedback is hidden by pagination.
• Complete fresh normal gate inspected in git-warp-894-integration-push.log: all static/consumer/declaration/policy/topology checks green, including actual Mermaid 51 diagrams/8 files and 73 Markdown-file syntax checks. Six unit shards total 259+917+781+3090+2091+1167 = 8,305 passed tests, plus two existing skips; 49+89+128+265+142+89 = 762 passing files, plus one existing skip. This is exactly the original 8,291 plus 14 ownership witnesses. Local lychee absence is explicitly disclosed; the current hosted link check has succeeded. No skip flag bypassed the normal gate.
• Execution/evidence boundaries: original independent 122-test/22-file GREEN and calibrated two-failure/two-positive parent RED remain valid behavior evidence because all four behavior/test files match. They were not redundantly re-executed for this documentation/test-model merge. This addendum independently executes only COPY hash comparisons and static history/source/live-state inspections; it inspects the author’s full fresh COPY gate. The incoming guide's independent packed acceptance and ownership model's independent controls were already performed in the separate main reviews and are not claimed as new Honor checkpoint tombstones in bounded node liveness (#894) #935 executions.
• git-warp-935-integration-published.json verifies main and exact current head; hosted Node22/Bun/Deno/coverage/packed/preflight/performance/type checks are pending at inspection. The old head's green checks and historical bundle figures do not satisfy this head's merge gate. No mandatory source-review area remains unavailable; root must wait for all current-head checks, preserve protections and record mainline integration before closure.

APPROVE