[congvc-bot-x99]

Status

This PR remains a draft. It implements CHE-1740 only.
Independent signing review is PASS for the pair head 35f2f8553dee615018f07f3583ec43654ad349e9 and main 1eea63e251018be4702c9b42ac06c35a5caab6eb. Source: CHE-1732 comment 01a157b0-0fd9-7dad-ae54-364ace48e1d0, x99-claude-sonnet (Anthropic), independent of x99-codex-luna-2 and x99-codex-luna (OpenAI). The PASS names no unwaived Test-First gap. The seam findings below stay binding on consumers.
History: the review at original head 35bd3634ba64bc68188efdbcc7f26790b0f60a71 was CHANGES_REQUIRED (CHE-1732 comment 01a1439a-edff-737d-a98a-e80807e8a2a0).
Final-head OCR (delegation lane) is complete: receipt on CHE-1740, marker for head 35f2f8553dee615018f07f3583ec43654ad349e9. The OCR review confirmed no P0 and two latent P1 findings, both recorded below.
No gate PASS follows from these annotations. Only the scoped historical waiver below applies.

Cheese approved only this PR's historical seam Test-First waiver at 09:58 ICT on 20 October 2026.
Exact quote: “approve explicit waiver limited to PR #288”.
Authenticated source: CHE-1740 comment 01a1573e-927d-7465-9e61-a125b883de0f.
Existing decision packet: CHE-1732 comment 01a143b3-010e-7daf-85f4-4f4fa0053479.
Historical seam Test-First: WAIVED only at head 35bd3634ba64bc68188efdbcc7f26790b0f60a71.
Sol maps this waiver only to the byte-identical original seam at head 35f2f8553dee615018f07f3583ec43654ad349e9. The waiver covers no new code.
Historical seam red-before-green proof remains NOT-RUN. The waiver does not make retrospective tests red evidence.
The waiver does not grant signer PASS, CI waiver, consumer admission, PR-ready, merge, deploy or extra budget.

The first commit is tests-only: 291c1c51ac66311ae05f2a526673bbe1d3c3f364 (291c1c51a).
That first commit contains no production code.
The second commit only fixes test lint: 5856705cfcdf0b20b27ffca39d4bbcc69166f053.
The implementation is separate commit 35bd3634ba64bc68188efdbcc7f26790b0f60a71.

Conditions

Do not merge or deploy this PR.
Do not spend, change credentials, run live inference probes, relax retry rules, or mutate production.
The other sixteen children remain backlog/gated-dependency.
The independent signing review at the changed head returned PASS. The review at the original head returned CHANGES_REQUIRED.
Cheese retains the merge and release gates.
OCR: run once on the final head. Done: delegation lane, receipt on CHE-1740. An OCR result is not merge authority.

Change

Migration 667_provider_failure_recovery_effects (renamed from 628_provider_failure_recovery_effects to remove a prefix collision with main; SQL unchanged) preserves legacy rows and permits the task_retry and wakeup_rearm effect shapes.
The migration adds the wakeup ID and post-rearm revision, plus a unique index that allows at most one re-arm per wakeup.
A transaction-bound reserve/apply seam invokes the effect only after one reservation inserts.
Duplicate failed-task reservations are no-ops. Apply errors roll back the caller's transaction.
The writer inventory covers query SQL, direct Go SQL literals, and migration files.
The inventory does not scan runtime-assembled SQL.

Evidence

The branch parent is d4add9fe2fd390309d2187442e1f2fd5686478a8.
At 13:43 ICT, 16 October 2026, current main was 1b238338dda4c5d1b5637c5f6ec54a0a5b07852f.
The current-main delta does not change the recovery failure path.
It adds 627_agent_task_queue_context and 627_unpin_archived_chat_sessions.
The current-main baseline fails TestMigrationNumericPrefixesAreUnique because those migrations share prefix 627.

The tests-only head 291c1c51ac66311ae05f2a526673bbe1d3c3f364 failed on the parent schema because recovery_wakeup_id was absent (SQLSTATE 42703).
The writer inventory and fake-writer control pass locally.
Initial red CI run 38858173200: https://github.com/cheese-work/multica/actions/runs/38858173200/job/116834282525
That run also found two errorlint assertions.
The tests-only follow-up uses errors.As before implementation: https://github.com/cheese-work/multica/actions/runs/38858173200/job/116834282568

Tests-only CI run 38859698364 on head 5856705cfcdf0b20b27ffca39d4bbcc69166f053 fails four schema/reservation tests because recovery_wakeup_id is absent (SQLSTATE 42703).
The writer inventory tests pass on that head.
The same run's backend job also reports the current-main duplicate-627 migration test failure.
Go lint and sqlc checks pass on the tests-only head.
Red job: https://github.com/cheese-work/multica/actions/runs/38859698364/job/116839011671

I applied migration 628 only to isolated database multica_multica_250.
The focused reservation tests pass locally on that database by 13:40 ICT, 16 October 2026.
The migration naming and direction tests pass locally by 13:41 ICT, 16 October 2026.
Focused tests: go test ./internal/service -run '^TestProviderFailureRecovery(EffectShapesPreserveLegacyRows|ReservationIsIdempotentConcurrently|AllowsOnlyOneRearmPerWakeup|ReservationRollsBackWithFailedApply|WriterInventory.*)$' -count=1 -v.
Migration checks: go test ./internal/migrations -count=1.
At 13:50 ICT, implementation-head CI run 38862760712 had backend-tests pending.
The go-lint, sqlc-check, frontend, backend-agent-tests, and vulnerability checks pass.
I do not claim CI green.
Run: https://github.com/cheese-work/multica/actions/runs/38862760712
STE lint: the earlier PR text had 5 passive-voice warnings.
This revision has 2 passive-voice warnings in the checklist.
I retain them because the actor does not change meaning.

Review Disposition

The tests-only red evidence covers schema shapes only.
The reserve-and-apply seam tests were changed or added with implementation commit 35bd3634ba64bc68188efdbcc7f26790b0f60a71.
Those seam tests are retrospective. Red-before-green evidence for the seam is NOT-RUN.
The writer inventory tests are retrospective controls for this gate: they passed before implementation and are not red evidence.
No historical red evidence is reconstructed. Cheese's scoped historical waiver is recorded in Status; the proof remains NOT-RUN.

Sol chooses the reviewer's deferral option for finding 2.
CHE-1764 (M0b) owns the savepoint/constraint-refusal correction and seam-level red-before-green tests within its existing 2 h ceiling.
CHE-1736 (M1) owns the failure-transaction integration proof within its existing 2 h ceiling.
No caller may adopt this seam until the correction and continued-outer-transaction tests pass and receive independent review.
This gate also binds CHE-1768 (M0c) and CHE-1765 (M2c).

Current hazards remain in this head.
The insert handles a duplicate failed task only. A unique conflict on recovery wakeup, run or task can abort the outer transaction.
On an apply error the seam rolls back the caller-owned transaction.
M0b must contain insert/apply errors in a nested transaction/savepoint.
M0b must test capped wakeup and duplicate task/run effects through the seam, not raw SQL alone.
M0b must test continued outer-transaction use after a refusal or apply error.
M1 must prove that the original failed status commits despite a refused or failed recovery effect.
M0b must define effect kind from the column shape and document valid trigger_kind/trigger_id mappings for task_retry, including ordinary issue tasks.
The inventory also misses dynamic status placeholders and distinct inline writers sharing a file key.
The M0b/M1 admission packet must preserve those inventory limits; the inventory does not prove completeness beyond its scanner.

History: CI at the original head was FAIL on the duplicate migration prefix 627 inherited from the earlier main snapshot.
Current head CI run 39369656456 is SUCCESS: https://github.com/cheese-work/multica/actions/runs/39369656456
The numbering fix has its own tests-only red run: https://github.com/cheese-work/multica/actions/runs/39367997700/job/118449201660
CHE-1824's repair, PR #290, is merged. No unrelated repair is added here.
History: main was 860e4e1210bb2879e4658d282d0076aeb727bef3 while the stored base was 1b238338dda4c5d1b5637c5f6ec54a0a5b07852f.
The head now contains main 1eea63e251018be4702c9b42ac06c35a5caab6eb through a merge commit. Earlier, the current-target integration/checks and final-pair signing evidence were unestablished. The checks and signing above now cover the current pair.
M0b/M1 remain unadmitted pending credible re-slicing within the approved 32 h scope and each 2 h ceiling.
The author implementation budget is exhausted. No correction run or extra budget is authorized by these annotations.
The seam findings above remain binding on M0b, M1, M0c and M2c.
The reservation tests passed in CI on the current head. Local reservation QA by Luna stays NOT-RUN.
Do not mark this PR ready until Sol reconciles the remaining gates and the independent review dispositions above.

Update 31 Oct 2026 (ICT): main merged, migration renumbered

Merged origin/main (7f6e49f71d6346c6746f2c3eb71227b4921c341a) into this branch with a merge commit. No conflicts.
Main now holds 667_governed_vote_record. The provider recovery migration moved from 667 to 813. The SQL is unchanged.
Red: TestProviderFailureRecoveryMigrationPrefixIsUnique failed with 667_governed_vote_record shares numeric prefix 667.
Green: after the rename, go test ./internal/migrations passed. go test ./internal/service -run 'ProviderFailure|Reservation' passed on multica_che1740_m0a (48 run lines, no skips).
This PR stays draft. CI on the new head f0a7dfd891c5efedf6b5ece67a945fa727a5f69a is pending.

Changelog

Changelog: none

Type of Change

• Feature
• Tests

How to Test

Set DATABASE_URL to the isolated multica_multica_250 database.
Run cd server && go test ./internal/service -run '^TestProviderFailureRecovery(EffectShapesPreserveLegacyRows|ReservationIsIdempotentConcurrently|AllowsOnlyOneRearmPerWakeup|ReservationRollsBackWithFailedApply|WriterInventory.*)' -count=1 -v.
The schema test fails on the parent before migration 813.
Run cd server && go test ./internal/migrations -count=1.

Checklist

• Focused reservation tests pass locally
• Tests are included
• Risks are documented
• Full PR CI passes (run 39369656456)

AI Disclosure

AI tool used: Multica Codex.
Prompt / approach: Implement CHE-1740 only under the approved 2 h ceiling. Tests precede implementation.

Related Issue

Closes CHE-1740

[congvc-bot-x99]

Superseded by #672 (same history plus fixes). The head branch name contains luna-2, which the close-target check rejects, and a head branch cannot be renamed. Closed, not merged.