Wallet interoperability and reliability: bounded sync, proof recovery and BRC-118 payments

[ty-everett]

Hold open: do not merge or enable auto-merge. This draft advances #544; the implementation program and qualification are incomplete.

Program and scope

Wallet backup can hold manager ownership across a whole copy and block foreground work. Supported local SQL push, pull and backup now use a dedicated coherent source view and short atomic destination commits. Rows, bounded ID mappings and cursors commit together. Primary epochs and manager generations fence stale work; lost acknowledgements resume durable checkpoints. Unsupported providers retain the serialized path.

Issue #544 and the acceptance matrix define the complete program. BotBoard #727 owns #569. The branch includes main 022f1a25068a8533c4ebe997891b78c618f27807 through merge f27e0adc8. The current checkpoint is a0e7ec198b998b451bddb71870cd1c658921ef60; exact-head hosted gates are running.

Archive capture preserves all thirteen standard tables and original profile/storage/chain/schema metadata. Shared reservations precede source acquisition, and immutable receipts bind pages to a verified directory. Authenticated HTTP supports bounded admission, status, directories, pages and cancellation. The unadvertised v2 reader uses fixed leases, require-existing admission, bounded same-request recovery and verified packed rows. Source-only adapters integrate with local destinations. Backend guards bind SQLite WAL files or an actual MySQL server/database; exact-owner recovery releases quota only after physical cleanup. Old unguarded owners remain reserved. Reader advertisement remains OFF.

Auxiliary profile keys cover eight directly owned tables, numeric relation keys cover label/tag mappings, and the new certificate-field keys preserve source collation, exact text and both direct/parent ownership bases. Inconsistent relations remain visible to closure validation. Removal observers precede producers; atomic 256-row bootstrap batches resume after interrupted DDL or commits. Ordinary/archive readers adopt complete migrations inside their retained view. MySQL reader hints now preserve bounded primary-index seeks before optimizer statistics refresh as well as afterward. Standard indexes, legacy OFFSET order, source rows and cursor/archive encodings remain unchanged.

Earlier branch work includes fair resumable pull, proof recovery, coherent local BRC-38 capture, legacy-history normalization, binary negotiation, BRC-118 payment/authentication, Bob's warranted native HTTP-body correction and public Argon2id declaration compatibility.

Global proof/request reference edges, per-profile counts and source-presence indexes now have bounded, resumable bootstrap, typed durable cursors, metadata validation and observer maintenance. Ordinary and archive readers select the completed indexes inside their retained view. A repeated unchanged backup accepts the valid terminal checkpoint with reset offsets while preserving checkpoint monotonicity and failure ordering. Authenticated ordinary/binary HTTP and lost-ack regressions cover this behavior.

Remaining implementation: SQLite conflict-safe index generation and retirement; primary reconciliation; commit-order high-water positions and complete tombstone propagation; nonblocking IndexedDB/native adapters; remote destinations; bounded large-blob transport/reuse; canonical streaming BRC-38/39; durable staged import; downstream migration; and full performance/fault/platform acceptance. Logical quotas do not prove physical resource bounds or larger-wallet acceptance. This checkpoint does not complete S1–S4/P1–P3/A1/V1–V2.

Impact

• Public package source, API/types and persistence behavior changed
• Authenticated transport and compatibility-sensitive boundaries changed
• Documentation, examples, migration guidance and release notes updated

Core/client/mobile remain unpublished 2.15.0 minor candidates, with SDK peers ^2.8.0 || ^3.0.0. The release ledger records the decisions. Apply additive sync/archive/request/owner/guard/profile/relation/certificate/global migrations through migrate(); opening a provider does not migrate it. Preserve partial index DDL/bootstrap state for retry and recover a stale Knex lock only after proving the migrator stopped. Drain readers before down or binary downgrade. snapshotSync:false and snapshotArchives:false disable the new paths with schema retained. MySQL certificate keys require transactional InnoDB tables and matching text metadata; SQLite validates the existing unique key/collation.

Verification

Current qualification uses Node 24.18.0, pnpm 10.33.2, generated campaigns of 300 runs / seed 3242026, fixed source/configuration inputs and unchanged gates.

• Exact local checkpoint a0e7ec198: all six root checks pass (health:check, lint, format:check, typecheck, audit:security, test:governance). The complete retained selection passes 27 suites / 669 tests; full wallet coverage passes 358 suites / 4,654 passing tests, with one unchanged skip. All 18 package/packed/core/client/mobile/Chromium/Hermes/conformance/documentation phases pass.
• All nine pinned MySQL 8.4.11 native fixture groups pass in 106.48 seconds with the existing 60-second child bounds and owned cleanup. SQLite process-loss qualification passes in 8.09 seconds. These synthetic fixtures do not establish deployed PXC or large-wallet acceptance.
• The five complete global mutation parts finish with 1,180 mutants: 1,112 killed, six timeouts, 62 survived; 94.75% detection and zero uncovered/invalid mutants. All 166 trigger mutants are killed. The reports match the exact current source texts; all 4,479 authored inputs remain unchanged through qualification. This is complete global-index scope, not complete retained-target or whole-PR acceptance. Earlier failed reports remain preserved; no gate, authored test, source slice or worker error was waived.
• The global helper extraction uses disjoint whole-file partitions with the complete canonical retained test set. Existing canonical targets, source/test/configuration unions, aggregate 90% detection and zero uncovered/invalid gates remain required. The optional retained Jest reuse setting is scoped to its existing target; other target defaults remain unchanged.
• A separate, unadopted SQLite generation/identity repair currently passes 69 diagnostic tests in 11 suites, including fixed-seed replacement schedules, pinned readers, actual process loss and bounded retirement. It is outside this PR head and does not qualify production migration behavior or complete proposal: bounded wallet sync scheduling, concurrent reads, and portable snapshot performance #544.

Exact-head hosted coverage, native/platform, mutation, Sonar, CodeQL and the complete repository merge gate remain required. Historical passing revisions and local receipts do not qualify the new remote head.

• Current diff self-reviewed for correctness, compatibility, artifacts, dependencies and documentation
• Every applicable hosted check is terminal and successful on the exact pushed head
• Full coverage, conformance, mutation, Sonar and CodeQL qualification complete

Security, release and operations

The index implementation introduces no application dependency. Reviewed dependency remediation remains in the dependency policy. Main reconciliation preserves the newer brace-expansion fix, includes engine.io remediation, and retains #660’s reviewed knownTxids result-BEEF behavior. Synthetic fixtures contain no production wallet data.

• Dependency necessity, peer compatibility and consumer evidence reviewed
• Negative tests cover changed persistence and transport boundaries
• No suppression, advisory dismissal, authored-test skip or reduced threshold
• Exact-head CodeQL has no new alert
• Exact-head repository gate has zero new Sonar findings and unreviewed hotspots
• No workstation publication, release tag, deployment or funded operation
• Candidate versions, changelog, migration and rollback guidance current

Completion evidence

• Intermediate local evidence is distinguished from full tracker acceptance
• Complete proposal: bounded wallet sync scheduling, concurrent reads, and portable snapshot performance #544 implementation and end-to-end acceptance
• Qualified maintainer approval received

Historical requested-changes review still requires maintainer re-review. Publication, deployment, funded operations and physical platform acceptance require separate authorization and evidence. PR #569 remains OPEN / DRAFT / UNMERGED, auto-merge disabled, while implementation and exact-head validation continue.

[codecov]

Codecov Report

❌ Patch coverage is 95.62904% with 115 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
packages/sdk/src/auth/clients/AuthFetch.ts	83.01%	9 Missing and 18 partials ⚠️
...wallet-toolbox/src/storage/WalletStorageManager.ts	93.68%	10 Missing and 8 partials ⚠️
...middleware/payment-express-middleware/src/index.ts	84.50%	6 Missing and 5 partials ⚠️
...-toolbox/src/storage/remoting/StorageClientBase.ts	84.93%	11 Missing ⚠️
packages/sdk/src/auth/utils/paymentTransport.ts	91.59%	4 Missing and 6 partials ⚠️
...s/wallet/wallet-toolbox/src/storage/StorageKnex.ts	95.96%	2 Missing and 8 partials ⚠️
...payment-express-middleware/src/multipartPayment.ts	92.00%	0 Missing and 6 partials ⚠️
...llet/wallet-toolbox/src/storage/StorageProvider.ts	89.18%	3 Missing and 1 partial ⚠️
...et-toolbox/src/storage/methods/repairBeefProofs.ts	92.98%	0 Missing and 4 partials ⚠️
...allet/wallet-toolbox/src/storage/portable/index.ts	91.30%	0 Missing and 4 partials ⚠️
... and 6 more

📢 Thoughts on this report? Let us know!

[ty-everett]

PR #569 remains open, draft and unmerged; auto-merge and reader advertisement stay off. Pushed head 91f1d597304af2581050ad94e18abe8122e4cd70 includes main 0b7dff8e510e5247556d9cc2d95b5456e1552239 (zero behind after a fresh fetch).

This batch addresses the four remaining hosted Sonar findings, retains JavaScript runtime input validation, and adds receipt tests for exact expiry/floor/capacity, malformed persisted metadata, canonical BIGINT responses, driver aliases and binding boundaries. The bounded capacity projection now uses a numeric alias. The failed receipt mutant was the empty 1 AS occupied raw expression; tracing showed Knex interpreting that empty raw object as column aliases and invoking its transaction query method during compilation. Earlier standalone ORDER BY reproductions investigated a different expression and are not evidence for that failure. No engine, source/test union, gate, worker count or deadline was weakened.

Validation on this batch:

• All six root checks (health, lint, format, typecheck, strict journal typing and CI orchestration) pass; typed local SonarJS reports zero findings in five changed files. Hosted analysis remains authoritative.
• All 680 journal tests across 14 suites pass, including 300 generated cases with seed 3242026; clean packed consumers and declarations pass.
• Native validation passes 12 SQLite journal process kills, 38 MySQL client kills, 24 server restarts and eight receipt process-kill boundaries across RC/RR and numeric/string BIGINT.
• The complete receipts execution part passes 397/411 mutants (96.59%), 14 survived, zero invalid/uncovered, no worker crashes, and all 4,544 authored inputs unchanged. Earlier unexplained native SIGSEGVs remain separately recorded; this does not establish their cause or fix.

The prior 5de CI is terminal with 37 successful jobs but four Sonar findings and dependent mutation/merge-gate failures. Exact-head hosted qualification and the complete current journal/retained campaign are now running. The full #544 implementation remains incomplete: capture fence and connection-pair lifecycle work are outside-checkout drafts; the complete controller, continuity floor/retention, registered migration, receiver/primary, portable/remote/platform and performance work remain open. No release, deployment or funded action occurred.

[ty-everett]

Paused at the maintainer’s request. PR #569 remains OPEN/DRAFT/UNMERGED at 91f1d597304af2581050ad94e18abe8122e4cd70; auto-merge and reader advertisement remain off. The branch is clean and pushed. The final fetch found one newer main commit, 0211fd965, which is deliberately left for reconciliation when implementation resumes.

Current-head receipt/root/native qualification and the mandatory zero-new-Sonar gate pass; CodeQL, Conformance, Codegen and Container runtime contracts also passed. Complete CI 37040055306 remains pending, so no green repository gate or readiness claim is made. Local complete campaigns were stopped for this pause with all 4,544 authored inputs unchanged. Six parts had completed (revision, high-water, page, clock, MySQL observers, MySQL source), in addition to the previously completed receipt part. The retained-reader campaign recorded one native SIGSEGV before cancellation; its cause remains unresolved and it has no completed current-head result.

The capture-fence and connection-reservation drafts remain outside the branch. An earlier connection draft passed ten tests including 300 generated schedules; subsequent backend/cleanup and retained-lifecycle edits are unvalidated and are being preserved as unfinished drafts, not qualified implementation.

The full #544 program remains incomplete: concrete capture publication/lifetime/backend integration; retention floors, tombstone collection and complete row/byte/physical quotas; registered journal lifecycle; generation-aware receiver/provenance and primary reconciliation; remaining remote/IndexedDB/large-blob/streaming BRC-38/39/staged-import work; and complete platform/performance/fault/exact-head acceptance. Release, deployment and funded/physical drills remain separate authorized execution gates. No publication, deployment or funded action occurred.

Owned local work is stopped. Hosted CI may finish independently; there is no unattended agent monitoring. BotBoard #727 is being released without an acknowledged successor. Resume requires a fresh handle, current-main reconciliation and review of the preserved partial evidence and drafts.

[ty-everett]

Capture and main reconciliation are now pushed at a1a90330b4bae10cf987d7db7719a35901237156, incorporating main 2d64fcd3d607f8ea33193cbe9f26a77a0663ba13. GitHub reports the branch mergeable. #569 remains open, draft and unmerged with auto-merge off under BotBoard #757 ownership.

The owned native capture implementation commits the durable receipt before publishing a coherent thirteen-table source, reserves distinct verified connections, and retains admission through proved physical cleanup. Current local root gates, packed consumers and 55 focused capture tests pass. Refreshed native evidence covers WAL generation/capture process cuts and all four MySQL generation/server-restart/receipt/capture groups. Serialized full wallet coverage passes 5,585 tests across 389 suites, with seven governed skips; the earlier two SQLite fixture failures and successful retries remain in the evidence record.

This is a qualified component batch, not the completed #544 program. Exact-head hosted checks and complete applicable mutation still need proof. Retention floor/collection currently have an unadopted 60-test/300-ledger draft and are entering native isolation and process-loss qualification. Runtime quotas, registered recovery, receiver/primary, IDB/remote destination, streaming portability/staged import and the remaining eleven-row system/platform acceptance inventory remain open. Incremental reader advertisement stays off. Publication, deployment, funded operations and physical drills require separate authorization after concrete artifacts are ready.

[ty-everett]

The held-open #569 branch is pushed at f43133c3c822682c9facbd531b09b029a8beebe4 and includes main 5c92262e478f2a2b21fe48fb896a8b4cc4371906 (#629). Both MessageBox payment/PeerPay release paragraphs and changelog sections are preserved, and generated facts are reconciled. PR stays draft/open/unmerged, with auto-merge off.

This batch adds internal floor advancement and bounded primary-key tombstone collection. Floors respect live receipts and database-clock expiry; scans count live/newer rows, bind cursors to epoch/floor/stream, and delete only matching old absent metadata. All thirteen source tables remain unchanged in native recovery cohorts. No incremental reader advertisement or journal migration publication is enabled.

Local merged-head validation: root health/lint/format/types/security audit; 766 journal tests/19 suites with separate 300-ledger floor and collection models; 414 MessageBox tests/16 suites; both packages' clean packed consumers; native WAL and six MySQL groups, including 24 retention process-loss cuts; four TS and nine CJS modules with zero local typed findings. Collection mutation feedback is 96.8912% (372 killed, 2 timeout, 12 survivors), zero uncovered/invalid and zero unexecuted survivors. One native worker SIGSEGV was retried and retained; this is one execution part, and complete nineteen-module/seventeen-part qualification remains pending. The first failed 70.47% run is retained.

The two capture fixture CodeQL races on prior 5af7ac1c7 are corrected by reading the exclusive inherited descriptor. Fresh exact-head hosted results, including the separate CodeQL reporting gate, are pending. Provider maintenance integration, runtime quotas, registered recovery, primary/receiver, remote/IDB, streaming/staged import and system/platform qualification remain unfinished; all eleven #544 acceptance rows remain open. No production-readiness claim, merge, publication, deployment, funded operation, physical drill or Slack/chat send occurred.

[ty-everett]

PR #569 remains OPEN, draft and unmerged; auto-merge is off. Pushed head 6da089b76269a97c6f41db31a4cd2df7afe1d73a contains current main 729ad70e0cf5d507319ded3583691184f47ba488 (#764) and has completed exact-head qualification: all 57 check runs are terminal successful or governed skips; CI, Conformance, Container runtime contracts and CodeQL workflows succeed. The separate CodeQL reporting check confirms no new alerts with zero annotations, and the zero-new-Sonar gate succeeds. Ordinary PR mutation remains governed as deferred; this is not a complete mutation campaign receipt. The historical changes-requested review still needs maintainer re-review when the implementation is complete.

Reconciliation preserves every wallet source/test/timeout union and native fingerprint input, and the corrected regression requires ordinary PR concurrency six and full campaign concurrency twenty. Required local root gates and affected fund-wallet/402-pay coverage, builds and packed consumers pass. No finding, threshold or skip was waived.

Full #544 remains active and unfinished. Outside-source journal maintenance drafts have WAL and MySQL RC/RR controller/provider proofs, bounded collection preserving all thirteen source arrays, cancellation/destruction admission fences and physical connection cleanup. Eleven task lifecycle cases and twelve migration-fence cases pass with complete measured module coverage, including 300 seeded schedules. Full controller fault tests, complete additive source/test/native/mutation registration, runtime quotas and registered journal lifecycle/recovery remain required. Primary/receiver, remote/IDB, streaming encryption/staged import, consumer/performance/fault/full-system evidence and operator release/funded/physical acceptance also remain open. Reader advertisement stays off; this update authorizes no merge, publication, deployment or funded/physical action.

[ty-everett]

Owned bounded journal maintenance is pushed at be0be62, with current main729ad70e0cf5d507319ded3583691184f47ba488 already reconciled. The internal provider controller validates complete owned generation/epoch/ceiling/receipt policy and excludes the configured migration owner before each bounded floor or collection transaction. Shared source admission remains owned through cancellation, rollback and physical connection/pool drain; cleanup failure remains observable and fences further retained work. Raw operator DDL remains outside the configured migration-owner contract.

Validation for this batch:

• Required root health, lint, formatting, typecheck and unchanged-lock security audit pass. Current wallet build/packed payload and clean consumer checks pass.
• The complete canonical snapshot/journal selection passed1680 tests/62 suites before five added malformed-prerequisite cases; the final focused selection passes55 cases with100% measured statement/branch/function/line coverage across all three complete new modules.
• Current production bytes pass the full native WAL chain and all8 guarded MySQL groups, including24 owned-controller process-loss cuts, actual RC/RR pool isolation assertions, source-array preservation, foreground writer progress, cancellation/destruction and physical native cleanup.
• Frozen complete-three-module mutation feedback passes93.20987654320987% aggregate (controller94.7368, fence91.2281, task93.5065), zero uncovered/invalid/unexecuted, with all1598 inputs unchanged. Stronger malformed-input tests were subsequently added without changing those production bytes. The earlier failed88.82 aggregate/75.32 task result and harness/lint failures remain retained without waivers. This local feedback is not a complete target/campaign receipt.
• Under BotBoard#756 ACK, all47 canonical target IDs and prior source/test/settings unions remain; total execution parts90->93 and journal19->22 whole modules/17->20 parts. Existing retained-provider and inherited snapshot-sync selections include their complete maintenance/journal tests. All40 shared mutation/native orchestration controls pass.

Exact-new-head hosted CI and the complete manual Mutation quality campaign are being started/monitored. There is no new-head green or full-program readiness claim yet. Runtime quotas and registered forward lifecycle/recovery are next; generation-aware payload/receiver, remaining remote/IDB, streaming/staged portability, platform/performance and release/operator acceptance remain open in the eleven-row#544 inventory. Reader advertisement remains off. PR#569 stays draft, open and unmerged with auto-merge disabled; no publication, deployment or funded/physical action is authorized.

[ty-everett]

Pushed head be0be62 now passes all57 ordinary hosted check runs (55success,2 governed skips), including the complete CI final gate, all six wallet shards/current Linux native recovery, conformance/runtime, the exact-head zero-new-Sonar gate and separate CodeQL reporting with zero new alerts/annotations. CI37081013773, CodeQL37081013698, runtime37081013675 and conformance37081013788 all succeed. The Sonar job's single annotation is an Ubuntu runner-label migration notice, not a code finding.

The separately dispatched complete Mutation quality37081056554 remains active against this exact head. Its complete93-part inventory retains all target/test/native input unions and governed floors; no full-campaign success is claimed until its reports/gate finish.

The next quota work remains outside the branch: exact logical-accounting38 tests/300 seeded schedules pass, and a corrected actual WAL component experiment passes ordinary source-write availability at row/byte/window exhaustion plus exact update/tombstone/rollback/credit accounting. The first unbootstrapped complete-journal oracle failure is retained and corrected. MySQL enforcement, source-event fan-out, whole forward-generation upgrade/crash recovery and complete target qualification remain pending; none of that prototype is an installed or production-qualified generation. All11#544 rows remain open. #569 stays draft/open/unmerged with auto-merge off and reader advertisement disabled.

[ty-everett]

Exact pushed head be0be625d3b79b6fdd01244cfaee4f930f17ab12 passes all 57 ordinary hosted checks (55 success, two governed skips), including zero-new CodeQL and Sonar gates. The full 93-part Mutation quality campaign continues and has a real qualification failure in its journal revision partition: score 96.92%, but seven RuntimeError executions exceed the unchanged zero-invalid limit.

The downloaded report identifies fixture validation running during module import in the capture and maintenance tests. Mutated validation rejects those fixtures before Jest can judge the tests. The local correction moves that validation into beforeEach, retaining all tests, complete source/test unions and every threshold. Both affected files pass all 36 tests; the complete revision partition is running locally with the complete journal union. The failure and report are retained; this is not full-campaign success.

The bounded quota work remains outside the branch. Owned native WAL and MySQL RC/RR accounting checks pass row/byte/window exhaustion, source-write availability and transactional exact credits. Forward generation/recovery, full fan-out bounds, concurrency/process-loss qualification and the other full #544 requirements remain open. PR stays open/draft/unmerged with auto-merge and reader advertisement off; no publication/deployment/funded or physical actions.

[ty-everett]

Pushed fixture-only correction 66f3001f9 retains all capture/maintenance tests and moves revision validation into test setup. Main 729ad70e0 is already an ancestor, the branch is clean and PR remains open/draft/mergeable/unmerged with auto-merge off.

The same complete revision partition now passes locally: all72 mutations,97.22%,69 killed/one timeout/two equivalent survivors; zero invalid/uncovered/unexecuted and all1599 frozen inputs unchanged. The full821-case journal dryrun,36 affected tests, strict whole-test typing, zero-new local typed analysis and root health/lint/format/types/audit pass. The initial root-health failure from concurrent Stryker sandbox discovery remains retained; after cleanup the unchanged health gate passes.

Exact-head ordinary CI is running; conformance has passed. Full Mutation quality37084010210 was dispatched without a diagnostic target and queues behind the prior full campaign under unchanged concurrency. Historicalbe0 ordinary CI was green, but its full campaign revision failure remains a failed receipt, never a success claim. Complete new-head qualification and maintainer re-review remain required.

Outside-only quota proof also found and fixed an actual MySQL RR deadlock at simultaneous exhausted-quota admission: quota exclusivity must precede the current invalidation read. The same controlled two-writer test now passes RC/RR without retries, alongside accounting, source availability, credits, stale snapshots and actual400-byte UTF8 boundaries. No quota source is adopted or production-qualified yet; forward generation/recovery, complete event fan-out, crash/performance/platform proof and the other full #544 requirements remain open. Reader advertisement, merge/publication/deployment/funded/physical actions stay off.

[ty-everett]

Pushed head 66f3001f962eb769984af70d1e37b07a7a02a0d0 has all 57 ordinary checks terminal green: 55 successes and two governed skips, including CI, CodeQL, runtime, conformance and the repository-owned zero-new Sonar gate. Main 729ad70e0 remains an ancestor. The exact-head full mutation run 37084010210 remains pending behind the preserved prior full campaign under unchanged workflow concurrency.

The prior campaign has also reported retained-storage feedback at 85.79%, with four uncovered mutants and 22 survivors. The report is retained. I have added four lifecycle regression cases and strengthened existing cleanup assertions: destruction during deferred capture/maintenance configuration must refuse database access, malformed maintenance input must release admission, provider destruction must stop/drain active maintenance, and teardown must detach all query listeners. These changes pass all 40 focused tests, strict whole-test typing and zero new selected typed-analysis findings. The complete original retained-storage union passes 978 tests/47 suites. Local feedback now executes all five original storage source ranges and the complete original test union with 3,219 frozen inputs; its mutation result and required root checks are pending before push. Production source and the gates are unchanged. The first new shutdown-test oracle failures are retained; the corrected tests preserve existing error identities.

Outside quota work passes 83 pure/native cases with complete measured coverage of the three policy/SQLite modules, six-overlay strict typing and zero new typed findings. The full canonical journal union plus all new quota tests passes the 904-test mutation dry run; all three complete modules are being mutated with 1,604 frozen inputs. Previous WAL/RC/RR accounting evidence includes 18 transaction process-loss cuts. This is component feedback only: installed v1 is refused unchanged, and registered forward upgrade/recovery, whole-source-event fan-out bounds and provider/reader adoption remain unfinished.

#569 stays open, draft and unmerged, with auto-merge and reader advertisement off. All eleven #544 acceptance rows remain open; ordinary CI, a component test suite or one mutation part does not establish full program or production completion. No publication, deployment or funded/physical action is authorized by this update.

[ty-everett]

Current #569 head66f3001f962eb769984af70d1e37b07a7a02a0d0 still includes main729ad70e0 and has57 ordinary terminal-green checks, but the full #544 program is unfinished and the PR remains draft/open/unmerged with auto-merge and reader advertisement off.

Full mutation37081056554 on the preceding be0 head now reports six failed parts (revision, retained-storage, connections, capture-fence, capture-backend, capture) and11retained-snapshot cancellations at the preserved90minute wall deadline. Current66 full37084010210 is queued behind it. No cancelled, stale or failed part is accepted as qualification; no gate, union, worker, seed or deadline is relaxed. The fixture-only revision fix is already pushed. The current coherent test batch adds lifecycle and backend/connection/fence boundary proof:40lifecycle cases plus the original978-case retained-storage selection pass;87boundary cases, strict whole-source typing and zero selected typed findings pass. Complete original retained-storage mutation feedback is still active; its native worker crash warning is preserved.

Fresh root audit now fails high GHSA-vfj7-8cjw-p6xm through the unchanged Metro development closure. Under the exact #756 coordination ACK, a narrow two-file Metro-file-map patch calls its existing Picomatch2.3.2 loop directly and removes scoped micromatch and the now-unused affected closure. Outside frozen install, exact structural graph comparison (all41importers/settings and1631retained package metadata unchanged;no version drift), unexcluded fresh audit,1120+300seeded watcher comparisons and unchanged native Metro/Hermes platform/budget checks pass with1719copied artifact inputs unchanged. Canonical adoption and full affected validation follow when frozen workers drain; there is no advisory exclusion or audit waiver.

Outside quota generation passes108pure/native tests/full measured three-module coverage, while preceding whole-module mutation failed84.45 against90 with904dryrun tests and1604inputs unchanged. That failure is retained and more meaningful integrity/boundary proof is being added. Registered v1 forward upgrade/recovery, complete per-source-event fan-out and provider/reader/receiver integration are still required. All11acceptance rows in the #544 program remain open. Component tests/ordinary CI do not establish readiness for merge or production; no publication/deployment/funded/physical action has occurred.

[ty-everett]

Pushed a7ceefb86: a native regression demonstrated that transaction cleanup could replace the original capture/receipt failure. The compatible fix keeps the original cause alongside actual rollback failures; successful cleanup preserves the original rejection. Added cases cover real rollback/destroy failures and storage, fence and provider lifecycle boundaries.

The coherent batch also removes the vulnerable unused Metro/micromatch/braces closure through the ACKed exact-version watcher repair. Paired JS/Flow preserve existing Picomatch2.3.2 semantics; the1120-case installed watcher oracle, complete unexcluded audit and frozen graph comparison pass, with all41 importers/settings/1631 surviving package records unchanged and zero added/changed versions. Root policy records ownership, review date and removal conditions.

Validation:145focused cases/strict/no introduced typed findings;2378 tests across92 source suites at unchanged production bytes; fresh SDK/full/client/mobile builds and3 packed checks; native browser/Metro/Hermes/maps/composition at unchanged budgets; SQLite process-loss and all8MySQL groups. Complete Capture module/original888-test union now scores93.41 with zero uncovered/invalid/unexecuted mutants and4882 frozen inputs unchanged. Other unchanged whole modules pass Backend92.20/Fence93.15/Connections98.48 local feedback. The previous Capture run's two uncovered branches and all failed hosted results remain retained; this is local feedback, not full-campaign qualification.

#569 remains draft/open/unmerged, auto-merge and reader advertisement off. All11 #544 acceptance rows remain open. Registered forward quota upgrade/recovery, whole-event fan-out, bounded primary reconciliation, durable remote destination, complete portability/adoption/performance/platform proof and release drill work remain in progress. New recovery prototypes are outside the branch until qualified. Exact-head hosted CI/full mutation and maintainer approval still need to pass; no production-ready claim.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
1.2% Duplication on New Code

See analysis details on SonarQube Cloud