fix(worker): reconcile terminal ACK loss exactly

[thegeorgepu]

Lane B invariant

This head consumes the VGC atomic worker-publication contract and reconciles terminal effects only from well-typed, worker-authoritative rows using the exact canonical text VGC stores.

• Every BusClient configured for bound worker mode sends X-VGC-Expected-Worker-Principal: worker:<id> on every message POST.
• The header value comes only from the configured worker binding, never from_agent, client posted_by, or a cached/prior identity GET.
• Bound requests omit client identity fields; posted_by, posted_role, and worker from_agent remain server-derived.
• HTTP 401/403/412/422 publication refusals remain fail-closed. Terminal pending evidence is retained and there is no unbound retry.
• Terminal subject/body are published and compared in VGC's canonical stored form. Subject is server-stripped before its 200-code-point limit; body retains the server's 8,000-code-point pre-strip rejection boundary, then is stripped, with empty stored as null and normalized to empty text for comparison.
• Terminal reconciliation validates raw subject as string and raw body as string or null before permissive message normalization.
• Positive ACK-loss reconciliation requires both raw server fields: posted_by === expected_worker_principal and posted_role === "worker". Role is never inferred from principal syntax or defaulted.
• An otherwise exact semantic row with expected posted_by but missing, null, malformed, admin, agent, collector, or any other non-worker raw posted_role raises typed terminal_delivery_authority_conflict. Pending evidence remains, and there is no POST or reconciliation.
• A committed terminal POST with a lost ACK reconciles against exactly one worker-authoritative server-stamped row after restart, including whitespace-bearing source subject/body, with no duplicate POST.

The reconciliation cardinality contract remains:

• 0 exact semantic rows: one bound POST
• 1 worker-authoritative exact row: reconcile ACK loss without POST

• 1 worker-authoritative exact rows: POST zero, retain and report duplicate_terminal_delivery

• exact semantic expected-principal row with ambiguous/non-worker authority: typed conflict, POST zero, retain pending

Exact semantics still cover broadcast recipient, kind, canonical subject/body, typed outcome, in_reply_to, and ordered refs. Complete pagination and malformed/partial/shifting/repeated-page refusal are unchanged. A raw posted_by that contradicts the requested expected-principal filter is filter-inconsistent and cannot establish absence.

Blocker history and exact heads

Base: 5d3cfb9c3336442e8d51b1a6e7fdd4d4859e5699.

• f2228ebf00f9e2824e4b4392429d8b88af061da6: TOCTOU BLOCK. A prior identity GET could differ from terminal POST authentication.
• b8d865fb36d9ebda423d60ec8fd623a2e73fd0a4: round-1 BLOCK, LANE_B_SERVER_CANONICAL_BODY_RECONCILIATION.
• fa822303bf8833e3ff6a6d9a676ea39b1059ae7d: round-2 BLOCK, LANE_B_MALFORMED_BODY_FALSE_EMPTY_RECONCILIATION; verdicts msg_52b79150, msg_7a49a29f.
• ffed75f0025fed0ad73f99a2939932a750f21127: failed round-3 subject. It accepted exact semantic rows based on expected posted_by without also requiring the raw server-stamped worker role, leaving authority ambiguous. Durable blocker/verdict: msg_01e3ed71.
• Founder ruling msg_d3903a6f authorized exactly one exceptional fourth repair round, with no budget reset and no automatic fifth.
• New candidate: 8ab2b59f100cf6e155662134886372fee4e1e850, direct child of ffed75f0025fed0ad73f99a2939932a750f21127.

Server dependency remains frozen: getsimpledirect/vinci-gpu-control#421 exact head 9dec47f5f55c43bff99d6522bc6ec68bbc10bf44. Its independent PASS messages remain msg_af18881a and msg_0bf18340; natural CI is separate. No server PASS or previous client PASS transfers to this new candidate.

Discovery dependency remains getsimpledirect/vinci-gpu-control#420 exact head 5fcdae514ff05a430e26a12f4d8c8101619a320e; GET /v1/worker-principal is discovery only.

Evidence at 8ab2b59f

• Focused terminal reconciliation and outbox suites: 73/73 passed.
• Permanent role controls cover authoritative worker; admin, agent, collector, missing, null, numeric, boolean, object, and array roles; different raw posted_by with worker role; no-row bound publication; canonical ACK loss; and installed fresh-process ACK-loss restart.
• Every authority refusal retains pending evidence and posts zero rows. One authoritative row reconciles and clears with zero POST; multiple authoritative rows retain the existing typed duplicate condition; no semantic row publishes exactly once with the bound header.
• Five kill mutations failed semantically as required: treating conflict as zero match, defaulting missing/null role, deriving role from worker: principal syntax, removing the role check, and clearing on posted_by alone.
• Exact current modules against frozen VGC PR421 application/auth/storage: existing real-app matrix 38/38 passed. A separate real-storage authority matrix 8/8 passed for admin, agent, collector, missing, null, malformed, worker-positive, and no-row publication.
• npm run check: all 9 stages passed, then passed again in the commit hook.
• VINCI_SKIP_SMOKE=1 bash vinci/test/run.sh: all enabled groups passed; smoke intentionally skipped.
• git diff --check: passed.

The local fixture proves client classification behavior; it does not independently prove VGC source. The real integrations exercised the frozen PR421 application head. This exact successor requires fresh independent review. No PASS is claimed or transferred, and no automatic fifth repair round is authorized.

Boundaries

• Changed only vinci/worker/bus.mjs and vinci/test/worker-terminal-reconcile-integration.mjs within the existing Lane B footprint.
• No VGC repository changes.
• No merge, deployment, release, publish, tag, signing, provider, training, or GPU control-plane operation.

[thegeorgepu]

CANDIDATE_READY

Exact head: f2228ebf00f9e2824e4b4392429d8b88af061da6

Evidence:

• Old blocked head c05baa9a2fb12883b408f1360fc2e805b7896e51: exact local-id A / bearer B / committed terminal POST / lost ACK / restart sequence reproduced one duplicate POST and cleared pending evidence.
• Candidate focused identity, reconciliation, lifecycle, lock, and terminal tests: 51 passed.
• Full offline harness: all groups passed (VINCI_SKIP_SMOKE=1).
• Unsigned development package built and unpacked; packaged imports, worker module graph, launcher load, and exact version passed.
• Positive ACK-loss restart proof passed through the fresh unpacked launcher: one committed terminal row, fresh restart identity, one reconciliation, pending cleared, zero duplicate POSTs.
• Five kill mutations failed their named regressions: stale identity before reconciliation; no re-auth before cardinality-zero POST; from_agent substituted for authoritative posted_by; duplicate-cardinality collapse; premature pagination accepted as absence.

Dependency truth: the CLI fixtures mock the exact VGC PR #420 contract. VGC exact head 5fcdae514ff05a430e26a12f4d8c8101619a320e was also exercised locally with its worker-principal contract tests (9 passed). PR #420 is open and unmerged; this is not merged or deployed availability evidence.

Please commission a fresh independent review against the exact head above. Do not review a moving branch.

This comment is AI-generated by codex-b-captain-v2.

[thegeorgepu]

SUPERSEDED — do not use this classification.

Current durable state:

CANDIDATE_READY / WAITING_REVIEW_AND_DEPENDENCY

See the corrected handoff: #74 (comment)

The CLI candidate remains frozen at f2228ebf00f9e2824e4b4392429d8b88af061da6 with exact-head CI green. Review and dependency waiting are coordinator-owned lifecycle states, not NEEDS_ROUTING.

This comment is AI-generated by codex-b-captain-v2.

[thegeorgepu]

STATUS_CORRECTION — supersedes the preceding NEEDS_ROUTING classification.

CANDIDATE_READY / WAITING_REVIEW_AND_DEPENDENCY

Exact CLI candidate: f2228ebf00f9e2824e4b4392429d8b88af061da6.

The bounded Lane B implementation is complete and all exact-head natural CI is green. The absence of an independent review and the still-unmerged dependency are coordinator-owned waiting states, not a repair routing failure.

Coordinator should commission a fresh read-only PR #74 review now, independently track VGC PR #420 at 5fcdae514ff05a430e26a12f4d8c8101619a320e, and keep CONTRACT_TESTED, REVIEW_QUALIFIED, CI_QUALIFIED, MERGED, DEPLOYED, and OBSERVED_AVAILABLE distinct.

This B session may terminate after coordinator custody is durably acknowledged. If review blocks later, create a fresh repair worker from the PR head, counterexample, and durable checkpoint.

No merge or deployment was performed.

This comment is AI-generated by codex-b-captain-v2.