feat(MUN-0021): transactional outbox, local lease relay, and CommittedResultRefV0 adoption gate - #13

…on boundaries (MUN-0021)

Two reviewer findings fixed:

F1 — Lease acquisition reset failure_count=0 on every cycle, and consumer
failure inside dispatch()'s $transaction threw the original error, rolling
back the failure_count increment and delivery-attempt evidence. Poison
quarantine was unreachable.

F2 — Wrong-plane quarantine was recorded inside the same $transaction that
then threw WrongPlanePayloadError, rolling back quarantine evidence and
lease status update. Events were endlessly re-polled.

Changes:
- lease(): remove failure_count=0 reset from both raw SQL and fallback
  Prisma paths, preserving accumulated failure state across cycles.
- dispatch(): move wrong-plane validation BEFORE the main transaction;
  record quarantine in a separate durable mini-transaction via new
  recordWrongPlaneQuarantine() helper, then throw.
- dispatch() consumer-failure path: return 'expired' instead of throwing,
  so the transaction commits and failure_count + delivery-attempt evidence
  are durable. Consumer side effects were never committed (consumer threw
  inside the tx) — that is correct.

Tests:
- 7 new F1/F2 regression unit tests (outbox.relay.spec.ts, 38→41 total).
- 2 new PostgreSQL integration tests (outbox.relay.postgres.spec.ts,
  10→12 total) with real Prisma/disposable-DB proving failure_count
  accumulation across lease cycles and wrong-plane quarantine durability.

Co-Authored-By: Claude <[email protected]>

…-0021)

Close the MUN-0021 adoption gate ratified in the ARCA-0194 result-reference
consilium. MUN-0022 may remain a pure contract proof; the additive Muneral
relation and the authoritative commit seam are mandatory here.

Muneral now authors the committed-result reference and the deterministic
completion receipt in the same transaction as the accepted node mutation,
transition journal, aggregate update and outbox fact. An execution adapter
proposes an OwnedResultMutationV0 and relays the already-authored receipt; it
can never fabricate a receipt or supply an authoritative digest.

The instruction, projection and result integrity domains stay distinct:

  cardDigest       = sha256("task-card-v0\0"                   + card)
  projectionDigest = sha256("task-card-projection-v0\0"        + projection)
  resultDigest     = sha256("task-card-result-node-v0\0"       + node)
  resultRefId      = sha256("muneral-result-ref-v0\0"          + ref fields)
  receiptId        = sha256("assembly-completion-receipt-v0\0" + receipt fields)

The rejected legacy proposal `receipt.digest == projection.cardDigest` fails
closed as an unknown field, and a database CHECK refuses any row whose result,
reference or receipt digest equals an instruction digest.

Durable shape (additive, forward-only, no backfill):
- task_result_nodes — the accepted owned node mutation, append-only
- task_committed_result_refs — append-only reference plus receipt identity,
  unique on transition identity, (task, attempt, card, node, node version),
  (task, mutation) and receipt id, every FK ON DELETE RESTRICT

Per-message closed validators replace the global wrong-plane denylist for the
result plane. A valid Task Card nodeId is accepted; Supervisor lifecycle,
placement, watchdog and command-authority fields stay rejected, and Supervisor
principals are now rejected too.

Round-5 boundary unchanged: no fleet registry, lifecycle, placement, staged
rollout, watchdog, telemetry aggregation or direct command routing. No NestJS
module, controller, provider or runtime wiring.

Tests, written RED first: 52 contract, 26 migration, 16 disposable-PostgreSQL.
Two defects surfaced only by the real-database run and fixed: a result was
accepted from an `issued` attempt the reducer would refuse, and a concurrent
loser escaped as an untyped StaleVersionError instead of a typed refusal.

The disposable-PostgreSQL bootstrap and its fail-closed cleanup contract move
to test/support so both PostgreSQL suites share one implementation.

Full suite: 489 pass, 21 skip, 8 pre-existing DATABASE_URL e2e failures
attributed to MUN-0038.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01PTicw7at1VFMqzgj4LG7pX

…delivery

The disposable-PostgreSQL harness shelled out to `sudo docker`. SEC-0028
deliberately removed docker escalation from the ci-general runner, so both
database suites failed in CI with "sudo: a password is required" — 45 tests
that were only ever green on a developer machine.

The harness now resolves its provisioning mode at start():

  container — a uniquely named container on a dynamic loopback port, when
              docker is reachable (plain `docker` preferred, `sudo -n docker`
              as fallback)
  database  — a uniquely named database created on an already-ephemeral
              PostgreSQL server and dropped afterwards, when docker is not
              reachable but MUN0021_PG_BASE_URL or DATABASE_URL is. This is
              the CI path: the job already provisions a per-job postgres:16
              service.

Both modes stay task-owned, disposable and fail-closed. Database mode verifies
the scratch database is gone via pg_database and refuses to start against any
non-local host or a URL containing prod/rds/supabase/neon, so the create-and-
drop path cannot be aimed at a shared or production server.

When neither mode is available the harness throws. It never degrades to
"skipped but reported green" — an unrun database proof is not a passing one.

psql and pg_isready are no longer required: readiness, migration application
and cleanup all go through the `pg` client, now an explicit devDependency
rather than a transitive one. Migrations are applied over the simple query
protocol, which is what dollar-quoted trigger bodies and multi-statement files
need.

Verified locally in both modes: container 16/16, database 45/45 (both suites,
docker hidden behind a failing stub).

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01PTicw7at1VFMqzgj4LG7pX

…al PostgreSQL

QA Layer 3b found two operator expectations declared `evidence_type: empirical`
with no real-database proof behind them. Unit mocks cannot settle either one.

- `lease-reclaims-same-event`: a driven clock expires a lease, a second holder
  reclaims it, and the test asserts the same outbox/transition/attempt identity
  comes back while the authority fingerprint — transitions, attempts, outbox
  identity, aggregate versions — is byte-identical either side of the reclaim.
  Only the delivery ordinal and holder move; failure count stays 0.

- `poison-quarantine-no-hol`: a poison event and a healthy event belonging to
  two different task aggregates are interleaved through one relay and one
  consumer. The poison event exhausts its bounded retry budget and lands in
  quarantine with immutable evidence, while the unrelated aggregate is
  delivered and its inbox row written in the same run. No side effect leaks
  from the quarantined event.

Both relays poll the maximum batch window: earlier tests in the suite leave
pending rows behind, so a default batch made inclusion depend on seeding order
rather than on the predicate under test.

Outbox PostgreSQL suite: 31/31. Full suite: 491 pass, 21 skip, 8 pre-existing
DATABASE_URL e2e failures attributed to MUN-0038.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01PTicw7at1VFMqzgj4LG7pX