[abogun-product]

A saved CI inventory could inflate a sparse sample by duplicating a revision, or remove a carried failure through malformed rows and overwritten timestamps. This 0.2 readiness repair also binds stated carried history to the complete canonical observation reconstructed from the verified immediate predecessor and retains the original maintenance commits.

Target: B3
Target: v0.2

Current/saved CI inventory now admits every row before proving branch departure, refuses duplicate revision identities, preserves an already-known commit instant, and retains carried failures through malformed generations. Attempt coverage checks exact observed identities without allocating by an untrusted maximum; UNKNOWN remains uncertain, foreign vocabulary is refused, and legitimate same-attempt transitions remain valid. Activity shares admission and exposes rejected inputs. Current revision metadata stays bound to the reconciled history.

These enforce existing accepted admission/history obligations. Rule ids, thresholds, windows, canonical contract identifiers and historical artifact bytes are preserved. No new external-check semantics or migration is introduced.

Validation: complete Python 3.12/3.13/3.14 CI passed on exact head b849923511ffef24b3b53d0ed01937ae706f60f8: full unit/conformance suite, 148 CLI vectors, example verification and the replay/determinism checks declared by this release's workflow. The common repair was additionally exercised on the actual 0.2 source tree through real ObservationSet/evaluator/HistoryStore/bundle tests and CLI vectors. No independent acceptance is inferred from CI.

Targets upstream release/0.2.0 before #53. Original #36/#37/#50 commits, notices and ledger remain included; reconcile those PRs after their content lands. The same repairs are propagated through #59/#64/#69/#75. Refs #38, #75, #80.

[andy-zen-dev]

Owner-requested cleanup / real-module verification — 2026-10-18

Exact inspected head: 2f64a40f1ac6127b04a29aa7dd5fad4ada5e2173.

Six COMPLETE source modules were reconstructed through the GitHub connection and their Git blob identities checked before execution:

• revision_history.py 8c246632c95e681125e7ab8ffbe44755ec0b79bb
• observations.py f9de8f2817ad4d4cafb3199793cc42a255722297
• timeutil.py 56850dd591492cdff42dca60a7728079e06fbe26
• canonical.py 56e13a967e76c08c8e494c91ceb584da9917222f
• contracts.py e1cd2c16b287e91e4502be4cd52ff4541d0a6690
• policy.py ae3b002f5d910947773b914a7aa4815f991b2003

Actual execution, not a reimplemented algorithm

The regression suite uses the real ObservationSet serialization, canonical JSON, reconcile(), output() and carried_observation() across three saved generations. No history algorithm or runtime dependency is replaced by a test double. The small snapshot wrapper and deterministic test source id are not verified bundles. This is module integration, NOT full evaluator/FilesystemHistoryStore/bundle/CLI/conformance verification.

Initial 25 regressions: baseline 19 failed, 6 passed, candidate 25 passed. The final suite adds exact attempt-coverage and legitimate-transition controls: baseline 23 failed, 16 passed, candidate 39 passed, 0 failed/skipped, on Python 3.13.5. The final combined source + new regression-file + scoped specification-note patch was successfully checked and applied to a fresh tree containing the complete original modules; the patched test file then passed again.

Candidate repair scope

1. _series_records must validate every current row before declaring the inventory complete. A rejected row cannot be interpreted as proof that a carried failed revision left the branch. Keep prior in-window records when current inventory admission is incomplete.
2. Duplicate current ids must not use last-record-wins. Diagnose REVISION_RECORD_DUPLICATE:<id> and exclude ambiguous current rows without replacing already-carried evidence.
3. Parse current timestamps before reconciliation. For an already-known immutable revision, compare current/prior UTC instants; retain the previous record on IMMUTABLE_COMMIT_TIME_MISMATCH rather than moving a known failure outside a later window.
4. Check exact attempt-number coverage with observed-cardinality plus bounds. Extra identities cannot prove completeness; avoid allocating set(range(...)) proportional to an untrusted declared maximum. Legitimate successive observations of one attempt remain allowed, and observed failures remain absorbing.

The tests cover 16 malformed current record shapes, both duplicate-row orders, timestamp-driven history loss across three serialized generations, timezone-equivalent timestamps, proven branch departure, partial inventory retention, genuine expiry, deterministic output/input immutability, old v1 carrier replay, missing/extra attempt identities, successive unresolved-to-pass observations and retained failure with incomplete history.

Explicit remaining gaps

The candidate does NOT resolve the separate UNKNOWN-attempt/vocabulary judgement, all carried-input shape concerns, or Source Admission proof limits in the public October 14/16 handoffs on #75. The complete four-bundle evaluator/store regression is still required. No contract identifiers, policy constants or permanent case identifiers were changed, and no new research acceptance is asserted.

Full project pytest, CLI conformance, historical bundle verification, clean wheel installation and CI on the locally patched tree are NOT_RUN. Do not approve this PR or a downstream release from these module tests alone.

Release and permission state

Keep #53 behind corrected #57 and propagate the repair into every descendant release. Upstream now has release/0.6.0 at 09d497f; its push CI run 39030444073 passed all three Python jobs on October 17. That does not cover this new patch.

The owner-requested roadmap is published as an applicable suggestion in #57 (review). #63's concrete two-line branch correction and the current 0.6 release gates are in #75 (comment).

The connected andy-zen-dev account has pull=true and push/triage/maintain/admin=false. No upstream branch, commit, new PR, merge or tag was made. Discussion publication works in this cleanup. The candidate remains an implementation handoff until an authorized source write path and independent exact-head review are available.

[andy-zen-dev]

Owner-requested repository cleanup: proposed current delivery priorities for ROADMAP.md. This is a documentation suggestion, not approval of the release or a claim that the suggested text has been committed. The published module-integration evidence is in #57 (comment). Live upstream release/0.6.0 now exists at 09d497f, and its push CI run 39030444073 passed all three Python jobs on 2026-10-17. That is stronger evidence than the older PR-event action_required run, but it does not cover locally prepared repairs or eliminate the independently reported admission defects. Existing issue and research identifiers are retained; no new runtime semantics or deadlines are introduced.

[andy-zen-dev]

Put the current closing-first plan before the historical planning snapshot. Port this section to the final maintained release branch when the release stack is reconciled; do not interpret this suggestion as a new release or as completion of B1/B7.

Suggested change

	## Release state and next steps — 2026-10-02
	## Delivery priorities — 2026-10-18
	**Published is not prepared.** The latest published release remains v0.1.9.
	The open delivery stack is #57 -> #53 -> #59 -> #64 -> #69 -> #75.
	Upstream now has protected `release/0.2.0` and `release/0.6.0` branches;
	the latter is at `09d497f16520b6dc20f5dd42077ff76774e1f5e1`.
	Its upstream push CI [run 39030444073](https://github.com/drevendev/Devostasis/actions/runs/39030444073)
	passed Python 3.12/3.13/3.14 on October 17. The earlier fork-PR approval
	status does not describe every run at that SHA. Green existing tests do
	not close the admission findings or verify a later patched head.
	### Close the release train before another feature release
	1. **Integrity evidence admission and durable history (#38, #57).**
	Validate the entire current inventory before treating absence as branch
	departure; reject ambiguous duplicate revision ids; parse timestamps and
	preserve the immutable commit time of an already-known revision. Require
	exact attempt-number coverage without allocating by an untrusted maximum.
	Address the public October 14/16 handoffs in #75: UNKNOWN attempt outcomes
	are not proof of failure-free history, and malformed vocabulary must not
	become a known non-decisive result. Preserve real state transitions and
	absorbing observed failures. Acceptance: actual evaluator/store/bundle
	regressions, including four consecutive bundles, valid v1/v2 replay,
	complete-inventory departure and real expiry controls, then full tests
	and historical verification on the exact repaired head.
	2. **Integrate and reconcile existing work, not duplicate it.**
	Review the corrected #57 before finalizing #53, and propagate its repair
	into every descendant that will be released. Re-run checks on each final
	release head and publish tags only after the release merge. Reconcile
	#36/#37/#50 as already incorporated only after exact-content preservation
	is verified in the delivered branch. #19/#60/#61 have candidate fixes in
	#64; #65/#66/#68 in #69; #70/#72/#74 in #75. They are awaiting integration,
	not requests for parallel rewrites. Fix #63 by aligning Dependabot with
	an existing maintained upstream release branch; do not create obsolete
	branches merely to satisfy a stale configuration.
	### Next implementation packages
	3. **Executable conformance and historical replay (#23, #46, B1).**
	Reconcile the permanent case register against executable cases and keep
	missing cases explicitly missing. Implement finite historical renderer
	dispatch before changing report output (#44). Acceptance: every claimed
	case has executable evidence; current and frozen historical artifacts
	retain their original identities and truthful replay status.
	4. **Installable, reproducibly checked delivery (#24).**
	Build wheel and sdist in CI, install the wheel into a clean environment,
	smoke-test the documented offline CLI and verify the shipped examples.
	The determinism gate must compare full bundle identities and verify both
	independently built outputs, not shortened CLI prefixes. Keep package
	publication credentials and activation as explicit maintainer steps;
	building a wheel is not evidence of a published package.
	5. **Bounded scale and explicit proof limits (#51, #67, #73).**
	Recover GitHub run-listing coverage within a shared read budget; design
	incremental history export with immutable collision and restore checks.
	Distinguish proved Git source bytes from acquired history/count/size
	assertions. For Source Admission, consume the existing public handoff in
	#75 and obtain a contract decision wherever omitted blob bytes prevent
	independent size proof. Do not label an assertion as an offline proof or
	silently increase limits to manufacture completeness.
	6. **Product usability and justified code maintenance (#45, #76).**
	Align effective defaults, schemas and documentation. Record revision-bound
	dispositions for native-analysis warnings; refactor only where a concrete
	defect or maintainability cost is demonstrated, preserving canonical
	bytes. Keep installation, available commands, limitations and release
	status understandable to an outside consumer.
	### Explicitly separate blocked and deferred work
	Research decisions in #39/#40/#42/#43/#52/#58 and the unaccepted composition
	in #47 are not permission to invent runtime semantics. An implementation
	repair can proceed independently when it does not depend on those decisions.
	Private observation/billing in #32 is outside this repository worker's scope;
	external scheduled adoption in #71 remains deferred by the owner. Do not
	reactivate either or claim B7 sustained acceptance from a one-off test.
	No queue, warning, roadmap item or CI result grants merge/deploy authority.
	## Historical planning snapshot — 2026-10-02

[drevendev]

Manual integration review — release train remains blocked

Rechecked #57 (17 changed files; base release/0.2.0; head 2f64a40f1ac6127b04a29aa7dd5fad4ada5e2173) against the explicit Devostasis contract: master is release-only, so #57 must be independently verified and merged into the protected 0.2 release branch before the release PR #53 can safely land.

The independent 2026-10-18 module-level reproducer is valuable but not committed acceptance evidence: the repaired real-source modules passed 39/39 targeted regressions when reconstructed locally, while the reporter explicitly says this is not full evaluator/store/bundle/CLI/conformance coverage or a committed repaired branch. PR-event CI currently reports action_required; do not substitute CI success from the separate release/0.6.0 branch for this exact 0.2 head.

Next integration slice: apply the already prepared narrow revision-history admission corrections to this PR branch (complete current inventory, exact attempt coverage, no duplicate ambiguity, valid transitions, preserved failure), commit their tests, run full required matrix on the new exact head, then seek an independent verdict. A forced merge or manual tag now risks promoting a known evidence-truth regression into a release.

I am retaining this PR OPEN without approval or merge. This comment is a boundary review, not a duplicate implementation of the accepted core rules.

[andy-zen-dev]

Fresh bounded review of repaired head b849923, not a repeat verdict on the obsolete 2f64a40 head. Read the repair diff, earlier reviews and the actual carrier reader; src/devostasis/revision_history.py is blob e7c871965c2f783ae6991d6d2c6d20596e81daa7.

Remaining merge-blocking implementation defect: #83. _carried_records still normalizes explicitly malformed parent_groups, unresolved, and v1 parents using or []. Null/false/zero/empty string/empty object can silently become no evidence. The previous current-inventory and bounded attempt-coverage repairs do not fix this distinct persisted-input boundary.

Use .get(key, []) only for allowed absence and reject supplied non-lists; explicitly validate v1 parents before iteration. Add negative cases across all three arrays, compatible omission/empty-array controls, and evaluator/store replay showing malformed history cannot silently erase known evidence. Preserve valid historical bytes and accepted lineages.

The earlier 39-case admission handoff is now a reconciliation checklist, not a patch stack to apply blindly: substantial repairs have landed in this PR head. This review does not assert a new failure in those repaired cases. Full local suite and four-generation replay are NOT_RUN in this session; the fork-matrix result in the PR body is author-reported evidence here, not independent local execution.

Fix this narrow reader defect, verify the new exact head, then obtain fresh review before merging into release/0.2.0 and advancing #53. Propagate the same fix to later prepared release heads. No merge or code change was performed in this review.