fix: reconcile declared-key ownership on delete and null (ARN-238)

[rita-aga]

Summary

• reconcile declared-key ownership to the actor's exact current key set on every durable write, including delete and null transitions
• make composite batches and native data-only creates use the same atomic key contract
• repair deleted, orphaned, and pre-v3 key owners during startup backfill with revision and sequence fencing
• fail closed on duplicate ownership while preserving authoritative materialization across catalog fast reads
• cover actor, composite, Postgres, Sim, PATCH/PUT retry, restart, tombstone, and signature-change behavior

Root cause

Key ownership was treated as additions-only state. Deletes and key removal could leave durable index rows behind; startup backfill trusted an incomplete name-only watermark and enumerated only live catalog entities, so deleted or orphaned owners could survive indefinitely and block a later valid claimant.

The repair defines one exact reconciliation primitive: the store atomically replaces an entity's declared-key ownership with the key set derived from the newly committed state. Startup compares a versioned property-aware signature, enumerates key-only owners as well as live entities, and advances a durable repair revision only after reconciliation succeeds.

Validation

• RED commit kept separate: c7ed59de
• additional behavioral regressions: 52308b04, 5bdf0a5d
• GREEN root-cause fix: 465370f8
• cargo fmt --all -- --check
• git diff --check
• cargo clippy -p temper-runtime -p temper-server -p temper-store-postgres -p temper-store-sim -p temper-store-turso -p temper-platform --all-targets --all-features -- -D warnings
• cargo test --workspace
• isolated persisted-WASM rerun: 6/6 passed
• unbypassed serial pre-push hook: RUST_TEST_THREADS=1 git push → Pre-push: ALL GATES PASSED
• code-quality reviewer marker: PASS
• DST reviewer marker: PASS

Live Postgres E2E evidence is posted as a PR comment. Independent GitHub diff review and Greptile evidence will be linked before ARENA SHIPPABLE.

Safety

This is a correctness and durability repair. It does not weaken uniqueness, drop working capability, or bypass the normal push gates. No files under crates/temper-actor-runtime are changed.

Linear: ARN-238

Greptile Summary

This PR repairs declared-key ownership reconciliation across durable writes and startup repair. The main changes are:

• Exact key ownership replacement for delete, null, and batch write paths.
• Startup repair that reconciles catalog, journal, snapshot, and key-only sources before publishing coverage.
• Durable contract activation that skips tenants without live registered specs.
• New regression coverage for ownership races, tombstones, retries, startup backfill, and backend behavior.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
crates/temper-cli/src/serve/bootstrap/hydration.rs	Discovers durable contract tenants while limiting activation to tenants with live registered specs.
crates/temper-server/src/state/projection_backfill/key_index.rs	Reconciles declared-key coverage from durable repair candidates and leaves coverage unpublished when owners remain unresolved.
crates/temper-store-postgres/src/store.rs	Adds bounded key reconciliation queries that include catalog, journal, snapshot, field-index, and key-index sources.

_{Reviews (7): Last reviewed commit: "fix(cli): preserve unloaded tenant key c..." | Re-trigger Greptile}

Context used (4)

• Context used - CLAUDE.md (source)
• Context used - AGENTS.md (source)
• Knowledge Base — temper-cli
• Knowledge Base — Temper storage backends

[rita-aga]

Live local Postgres durability E2E (behavioral regression)

Head under test: 465370f85f4d8d4eaf81de92485095516fb1ab54

This used a fresh PostgreSQL 17 cluster and the real temper serve binary. The fixture models an upgrade from the pre-v3 declared-key signature; it is a durability regression test, not an exploit scenario.

Start isolated Postgres and Temper

$ /opt/homebrew/opt/postgresql@17/bin/initdb -D /private/tmp/arn238-pg-e2e --no-locale --encoding=UTF8 --auth=trust
The files belonging to this database system will be owned by user "seshendranalla".
...
Success. You can now start the database server using:

    '/opt/homebrew/opt/postgresql@17/bin/pg_ctl' -D /private/tmp/arn238-pg-e2e -l logfile start

$ /opt/homebrew/opt/postgresql@17/bin/pg_ctl -D /private/tmp/arn238-pg-e2e -l /private/tmp/arn238-pg-e2e.log -o '-p 55440' start
waiting for server to start.... done
server started

$ /opt/homebrew/opt/postgresql@17/bin/createdb -p 55440 arn238e2e

$ DATABASE_URL=postgresql://127.0.0.1:55440/arn238e2e RUST_LOG=temper_server::registry=info,temper_server::entity_actor=info ./target/debug/temper serve --storage postgres --specs-dir test-fixtures/specs --tenant arn238-live --port 55441 --no-observe

$ curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1:55441/tdata
200

Establish a deleted entity and its durable sequence

$ curl -sS -o /private/tmp/arn238-create.json -w '%{http_code}\n' -X POST http://127.0.0.1:55441/tdata/Directories -H 'content-type: application/json' --data '{"id":"arn238-deleted","Name":"shared-key","WorkspaceId":"ws-live","ParentId":"parent-live","Path":"/shared-key"}'
201

$ /opt/homebrew/opt/postgresql@17/bin/psql -p 55440 -d arn238e2e -Atc "SELECT tenant_id,entity_type,key_name,key_hash,entity_id,sequence FROM entity_key_index WHERE tenant_id='arn238-live' AND entity_type='Directory'"
arn238-live|Directory|name_parent|cac98e79e3395846657ee67fe44479191a8f48eae82977261a5ca8ae6f8d7250|arn238-deleted|1

$ curl -sS -o /dev/null -w '%{http_code}\n' -X DELETE "http://127.0.0.1:55441/tdata/Directories('arn238-deleted')"
204

$ /opt/homebrew/opt/postgresql@17/bin/psql -p 55440 -d arn238e2e -Atc "SELECT count(*) FROM entity_key_index WHERE tenant_id='arn238-live' AND entity_type='Directory' AND entity_id='arn238-deleted'"
0

$ /opt/homebrew/opt/postgresql@17/bin/psql -p 55440 -d arn238e2e -Atc "SELECT max(sequence) FROM events WHERE persistence_id='arn238-live:Directory:arn238-deleted'"
2

Seed the faithful pre-v3 stale-owner fixture and observe the regression

$ /opt/homebrew/opt/postgresql@17/bin/psql -p 55440 -d arn238e2e -c "INSERT INTO entity_key_index (tenant_id,entity_type,key_name,key_hash,entity_id,sequence) VALUES ('arn238-live','Directory','name_parent','cac98e79e3395846657ee67fe44479191a8f48eae82977261a5ca8ae6f8d7250','arn238-deleted',2)"
INSERT 0 1

$ curl -sS -o /private/tmp/arn238-before.json -w '%{http_code}\n' -X POST http://127.0.0.1:55441/tdata/Directories -H 'content-type: application/json' --data '{"id":"arn238-replacement","Name":"shared-key","WorkspaceId":"ws-live","ParentId":"parent-live","Path":"/shared-key"}'
500

$ cat /private/tmp/arn238-before.json
{"error":{"code":"CreateError","message":"Actor query failed: actor stopped"}}

The server log recorded the exact cause and exhausted the normal retry budget:

storage error: duplicate declared key 'name_parent' for Directory: held by arn238-deleted

Restart through the upgrade repair, without directly deleting the stale row

The fresh database had already recorded the current v3 watermark on first boot, so I changed only its contract metadata to the exact pre-v3 representation. The stale ownership row itself remained in place for startup reconciliation.

$ /opt/homebrew/opt/postgresql@17/bin/psql -p 55440 -d arn238e2e -c "UPDATE key_index_backfill_watermark SET key_set='name_parent' WHERE tenant_id='arn238-live' AND entity_type='Directory'; UPDATE key_index_contract_state SET key_set='name_parent', revision=1 WHERE tenant_id='arn238-live' AND entity_type='Directory'"
UPDATE 1
UPDATE 1

After restarting the same temper serve command, the server emitted:

key index backfill: incomplete declared-key signature — reconciling every existing entity
covered_key_set:"name_parent"
current_key_set:"v3|11:name_parent[4:Name11:WorkspaceId8:ParentId]"
entity_key_index backfill complete; type watermarked
total:1 newly_keyed:0 skipped:1 repair_revision:2

$ /opt/homebrew/opt/postgresql@17/bin/psql -p 55440 -d arn238e2e -Atc "SELECT count(*) FROM entity_key_index WHERE tenant_id='arn238-live' AND entity_type='Directory' AND entity_id='arn238-deleted'"
0

$ /opt/homebrew/opt/postgresql@17/bin/psql -p 55440 -d arn238e2e -Atc "SELECT w.key_set,c.key_set,c.revision FROM key_index_backfill_watermark w JOIN key_index_contract_state c USING (tenant_id,entity_type) WHERE w.tenant_id='arn238-live' AND w.entity_type='Directory'"
v3|11:name_parent[4:Name11:WorkspaceId8:ParentId]|v3|11:name_parent[4:Name11:WorkspaceId8:ParentId]|2

$ curl -sS -o /private/tmp/arn238-after.json -w '%{http_code}\n' -X POST http://127.0.0.1:55441/tdata/Directories -H 'content-type: application/json' --data '{"id":"arn238-replacement","Name":"shared-key","WorkspaceId":"ws-live","ParentId":"parent-live","Path":"/shared-key"}'
201

$ curl -sS -o /private/tmp/arn238-filter.json -w '%{http_code}\n' "http://127.0.0.1:55441/tdata/Directories?%24filter=Name%20eq%20%27shared-key%27%20and%20WorkspaceId%20eq%20%27ws-live%27%20and%20ParentId%20eq%20%27parent-live%27"
200

$ cat /private/tmp/arn238-filter.json
{"@odata.context":"http://127.0.0.1:55441/tdata/$metadata#Directories","value":[{"id":"arn238-replacement","Name":"shared-key","WorkspaceId":"ws-live","ParentId":"parent-live","Path":"/shared-key"}]}

$ curl -sS -o /dev/null -w '%{http_code}\n' "http://127.0.0.1:55441/tdata/Directories('arn238-replacement')"
200

$ /opt/homebrew/opt/postgresql@17/bin/psql -p 55440 -d arn238e2e -Atc "SELECT entity_id,sequence FROM entity_key_index WHERE tenant_id='arn238-live' AND entity_type='Directory' AND key_name='name_parent'"
arn238-replacement|1

Second restart durability proof

After one more stop/start of the same server command:

$ curl -sS -o /dev/null -w '%{http_code}\n' "http://127.0.0.1:55441/tdata/Directories?%24filter=Name%20eq%20%27shared-key%27%20and%20WorkspaceId%20eq%20%27ws-live%27%20and%20ParentId%20eq%20%27parent-live%27"
200

$ curl -sS -o /dev/null -w '%{http_code}\n' "http://127.0.0.1:55441/tdata/Directories('arn238-replacement')"
200

$ /opt/homebrew/opt/postgresql@17/bin/psql -p 55440 -d arn238e2e -Atc "SELECT k.entity_id,k.sequence,c.key_set,c.revision FROM entity_key_index k JOIN key_index_contract_state c USING (tenant_id,entity_type) WHERE k.tenant_id='arn238-live' AND k.entity_type='Directory' AND k.key_name='name_parent'"
arn238-replacement|1|v3|11:name_parent[4:Name11:WorkspaceId8:ParentId]|2

The Temper server and PostgreSQL cluster were then stopped normally. The isolated cluster remains intact at /private/tmp/arn238-pg-e2e for auditability.

Unbypassed push gate

$ RUST_TEST_THREADS=1 git push
...
test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2397.01s
...
test persisted_wasm_modules_are_lazy_compiled_on_first_invoke ... ok
test persisted_wasm_modules_with_legacy_db_blob_fallback_execute_after_startup_restore ... ok
...
test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.44s
...
Pre-push: ALL GATES PASSED
To https://github.com/nerdsane/temper.git
   bdbf6f6f..465370f8  codex/arn-238-key-ownership-cleanup -> codex/arn-238-key-ownership-cleanup

[rita-aga]

Independent GPT-5.6 review of the complete GitHub PR diff at head 465370f85f4d8d4eaf81de92485095516fb1ab54.

[P1] Fence every repair row mutation against the type contract revision

run_key_index_backfill captures a repair revision, but each per-entity repair passes only expected_sequence and key_rows to the store; the revision is used only when publishing the final watermark (driver, repair call, final CAS). The store API has no expected contract revision/signature parameter (trait). Postgres consequently takes only the entity stream lock and validates only its journal sequence before deleting/replacing that entity key rows; it neither takes the type contract lock nor rechecks key_index_contract_state (Postgres repair). The Sim implementation has the same omission (Sim repair).

This leaves a cross-stream race: a backfill begins for contract A; a live write on another entity advances the type to contract B; then the old pass repairs an unchanged entity whose sequence still matches. That repair can commit A rows after B is current. The final watermark CAS correctly returns false, but it does not roll back the already committed stale rows. Those rows are still authoritative for write-time uniqueness, because normal append checks entity_key_index without consulting coverage/signature (append uniqueness check). The result can be a removed B claim that permits duplicate durable ownership, or an obsolete A claim that rejects a valid writer, until a later repair happens to correct it.

Required fix: carry the expected contract signature/revision into backfill_entity_keys; under the same transaction or Sim mutex, acquire/validate the type contract fence before any row mutation (preserving the documented type-lock-before-stream-lock order), and reject the repair on mismatch. Add a deterministic cross-stream interleaving test that asserts key rows remain on contract B, not merely that the A watermark publication is denied. The current old-contract test covers the final CAS but not this already-mutated-row case.

All current CI checks are green, but they do not cover this interleaving.

Verdict: FAIL

[rita-aga]

Independent-review remediation for the current GitHub head de2394b.

Initial independent review: #401 (comment) (Verdict: FAIL)

Remediation sequence:

• RED-only regression commit 45ced2e: 45ced2ea — reproduced the cross-stream contract race with: seed 15: a cross-stream contract change must reject stale repair rows; got Ok(()).
• GREEN root-cause commit de2394b: de2394bf — added a typed signature+revision backfill fence, validates it under the same transaction/mutex before any repair-row mutation, and enforces tenant/type contract-lock-before-stream-lock ordering.
• The deterministic regression now proves current rows remain and obsolete rows are absent; the real Postgres regression proves stale cross-stream repair returns KeyContractChanged without partial mutation.

Unbypassed serial push gate:

• Command: RUST_TEST_THREADS=1 git push
• rustfmt: PASS
• workspace clippy: PASS
• readability blocking ratchet: PASS
• cargo test --workspace: PASS
• dst_entity_key_index: 5/5
• dst_entity_key_reconciliation: 7/7, including dst_cross_stream_contract_change_fences_repair_rows and seeded convergence/canary
• dst_platform_random: 7/7 in 1191.47s
• persisted wasm_dispatch: 6/6, including lazy compile and legacy DB-blob restore
• Pre-push result: ALL GATES PASSED
• Push result: 465370f..de2394b

This comment records remediation only. No Greptile request has been made; the mandated fresh independent GitHub-head review comes next.

[rita-aga]

Reviewed the GitHub-hosted open PR diff at exact head de2394b.\n\n[P1] Do not publish key coverage from an events-plus-key-rows-only repair universe — crates/temper-store-postgres/src/store.rs:1046-1075 makes list_entity_ids_for_key_reconciliation select only events and entity_key_index. That is narrower than the durable entity sources recognized immediately above by list_entity_ids_by_type at lines 993-1035, which also includes entity_catalog and entity_field_index. The startup repair then treats this truncated list as the complete type population at crates/temper-server/src/state/projection_backfill/key_index.rs:107-119 and publishes the authoritative watermark whenever those listed rows have no failures at lines 224-240. After publication, crates/temper-server/src/odata/query_plane_read/keyed.rs:200-235 accepts an empty lookup as authoritative absence. A catalog/snapshot-only entity is therefore omitted from repair, yet a keyed read can return empty and a later claimant can take the same key while the original entity remains catalog-visible. This is a real compatibility shape: docs/adrs/0077-catalog-first-odata-materialization.md:65-69 documents migrated deployments populating entity_catalog directly from snapshots because migrated snapshots never replay through the live transition path. Include every durable entity source in repair enumeration and either reconstruct catalog/snapshot-only state or fail the type closed; add a Postgres regression that seeds such an entity and proves coverage cannot certify a miss.\n\nVerdict: FAIL

[nerdsane]

Independent GPT-5.6 review of the complete GitHub PR diff and surrounding remote context at exact head cd02a2836e833c0387786c94b8bee1321d52f0e6.

[P1] Journal-fence resident actor materialization in the incomplete-key scan

When exact declared-key coverage is incomplete, or a covered lookup loses its revision fence, query_plane_read/mod.rs:418-430 routes the query through the source scan with JournalAbsentOnly. For a journal-backed candidate, read_support.rs:334-400 rejects catalog materialization and calls materialize_entity_from_actor. That helper then asks the actor and may write its state back to the query projection without any journal-boundary or sequence check (read_support.rs:417-466). An already-resident actor is returned immediately without recovery (entity_ops.rs:597-603); a hydrated ID index can also retain an externally deleted candidate because store hydration only inserts IDs and later reads serve that index as-is (entity_ops.rs:411-427, entity_ops.rs:1518-1537).

Concrete failure: a local actor remains at sequence N with the old key and live state; another process or direct durable writer commits a rename or tombstone at N+1; v3 coverage is incomplete or invalidated during rollout/repair. An exact old-key read then scans, selects the retained ID, materializes actor state N, matches the old key, returns the stale live entity, and can re-upsert that stale projection. This exposes a renamed former owner or resurrects a deleted entity despite the authoritative-scan contract.

The covered-key path explicitly prevents this same stale-resident shape by rebuilding from the journal and requiring the recovered sequence to equal the ownership-row sequence (keyed.rs:53-99); the existing race test confirms resident actors can lag external writes, but only exercises the covered path (ownership_race.rs:91-177). Journal-backed candidates in the incomplete-key scan need the same recovery/boundary fence. Add a regression that keeps the stale actor resident across an external rename or tombstone while the watermark remains incomplete.

Verdict: FAIL

[rita-aga]

Independent GPT-5.6 complete-open-PR-diff review of exact head 346681ab88e209f34344b502f7a55c52ef3f73a3 against base a28fdb2ed8b0e1e0ea15a99c3b4a1dfba20e160e.

No remaining actionable ARN-238 defect was found. The review covered declared-key replacement/delete/all-null behavior, repair and generation fences, field-update intent binding across live/restart and memory-only eviction/rebinding, authoritative materialization/replay coordinates, persistence/recovery, boundedness, concurrency, and deterministic behavior.

Independent validation: ownership write surfaces 27/27; reconciliation DST 9/9; snapshot materialization 2/2; sim store 29/29; keyed-read matches 51/51; formatting and diff checks PASS.

Verdict: PASS

[rita-aga]

@greptile review

Please review the complete current PR diff at exact head 346681ab88e209f34344b502f7a55c52ef3f73a3. Focus on actionable correctness, durability, concurrency, deterministic-simulation, and regression issues caused by this diff.

[rita-aga]

@greptile-apps review

Please bypass the file-count limit and review the complete current PR diff at exact head 346681ab88e209f34344b502f7a55c52ef3f73a3. Report every actionable finding caused by this diff.

[rita-aga]

Independent GPT-5.6 complete-open-PR-diff review of exact head 975dbdf122be756f97c00be6b7c9064c30f74d34 against base a28fdb2ed8b0e1e0ea15a99c3b4a1dfba20e160e.

No actionable diff-caused findings remain. Declared-key deletion/nulling, ownership transfer, durability, restart recovery, concurrency fencing, and idempotency behavior are sound. The PR-caused default-thread-stack WASM regression is fixed by bounding the enlarged dispatch future through the boxed generation-context result; no WASM test or stack provisioning was modified.

Independent validation reviewed the complete open diff and confirmed default-stack wasm_dispatch 6/6, ownership-focused suites 38/38, and git diff --check PASS. The unbypassed local full workspace gate, strict clippy, and live E2E also passed on this exact head.

Verdict: PASS

[rita-aga]

@greptile review

Please review the complete current PR diff at exact head 975dbdf122be756f97c00be6b7c9064c30f74d34. Focus on every actionable correctness, durability, concurrency, deterministic-simulation, and regression issue caused by this diff.

[rita-aga]

@greptile-apps review

Please bypass the file-count limit and perform a fresh review of the complete current PR diff at exact head 975dbdf122be756f97c00be6b7c9064c30f74d34. Report every actionable finding caused by this diff.

[rita-aga]

Verdict: PASS

Fresh independent review at exact commit 6782e1d48580d6e13713ee1b642c5fbdf5ecabfa found no actionable ARN-238 diff-caused defects. Verified exact-set ownership atomicity across actor, data-only, file, composite, PostgreSQL, and Sim paths; source/revision/liveness/snapshot fencing for repair, coverage, tombstones, and audit-only stale-row purge; historical snapshot provenance and spawn-identity preservation; materialized zero-domain owners versus audit-only phantom classification; and default-stack WASM generation-context boxing. Validation included temper-server lib with sim (680 passed), key-ownership write surfaces (28), reconciliation DST (9), passivation/materialization, WASM dispatch, Sim, and PostgreSQL fencing suites—all green.

[rita-aga]

@greptile review

Please perform a fresh complete-diff review of PR #401 at exact head 6782e1d48580d6e13713ee1b642c5fbdf5ecabfa. Scope is ARN-238 declared-key ownership deletion/nulling correctness and durability only. Report every actionable finding caused by this diff.

[rita-aga]

@greptile-apps review

Please bypass the file-count limit and perform a fresh complete-diff review of PR #401 at exact head 6782e1d48580d6e13713ee1b642c5fbdf5ecabfa. Scope is ARN-238 declared-key ownership deletion/nulling correctness and durability only. Report every actionable finding caused by this diff.

[rita-aga]

Verdict: PASS

Fresh independent GPT-5.6 review of the complete open PR diff at exact commit a703b7d536b0265ffe2ec728af7c73bbeca57c86 against base a28fdb2ed8b0e1e0ea15a99c3b4a1dfba20e160e found no actionable diff-caused defects.

The review rechecked exact-set ownership across actor, field-update, data-only, File, composite, PostgreSQL, and Sim paths; contract epoch/revision/liveness/snapshot fencing; bounded repair and authoritative keyed reads; historical snapshot provenance; materialized zero-domain owners versus audit-only phantom purge; replay-safe field-update intent binding; tenant-generation admission; and the default-stack WASM future boxing. The Greptile P1 remediation preserves durable contract-only tenants by excluding them from empty-registry activation while retaining them in hydration/backfill discovery, and still activates every tenant with live registered specs.

Independent focused validation passed: durable contract-only tenant regression 1/1; ownership write surfaces 28/28; reconciliation DST 9/9; WASM dispatch 6/6; complete PR git diff --check.

[rita-aga]

@greptile review

Please perform a fresh complete-diff review of PR #401 at exact head a703b7d536b0265ffe2ec728af7c73bbeca57c86. Scope is ARN-238 declared-key ownership deletion/nulling correctness and durability only. Recheck the current remediation for durable contract-only tenants and report every actionable finding caused by this diff.

[rita-aga]

@greptile-apps review

Please bypass the file-count limit and perform a fresh complete-diff review of PR #401 at exact head a703b7d536b0265ffe2ec728af7c73bbeca57c86. Scope is ARN-238 declared-key ownership deletion/nulling correctness and durability only. Recheck the current remediation for durable contract-only tenants and report every actionable finding caused by this diff.

[rita-aga]

Verdict: PASS

Fresh final independent GPT-5.6 review after Greptile of the complete open PR diff at exact commit a703b7d536b0265ffe2ec728af7c73bbeca57c86 against base a28fdb2ed8b0e1e0ea15a99c3b4a1dfba20e160e found no actionable diff-caused defects.

The review rechecked exact-set declared-key replacement, delete, and all-null release across actor, PATCH/PUT, data-only, File, composite, PostgreSQL, and Sim paths; type-contract activation/revision and stream/liveness/snapshot fencing; bounded repair enumeration and coverage publication; authoritative keyed hit/miss materialization; historical snapshot provenance; materialized zero-domain owners versus audit-only phantom purge; replay-safe field-update intent binding; tenant-generation admission; and the default-stack WASM future boxing.

The fresh Greptile Review check is PASS at this exact head, and all 3 review threads are resolved with 0 unresolved actionable threads. Independent current-head validation passed: durable contract-only tenant regression 1/1, ownership write surfaces 28/28, reconciliation DST 9/9, snapshot-only materialization 2/2, WASM dispatch 6/6, and complete PR git diff --check. The durable contract-only tenant remediation preserves unloaded tenants by excluding them from empty-registry activation while retaining them for hydration/backfill discovery.

[rita-aga]

ARENA SHIPPABLE

ARN-238 is shippable at exact OPEN PR head a703b7d536b0265ffe2ec728af7c73bbeca57c86. MERGE NOTHING — PR #401 remains open.

Frozen-head validation

• Fresh local code review: PASS.
• Fresh local DST/determinism review: PASS.
• Focused Greptile remediation regression: 1/1; temper-cli: 74/74; strict CLI clippy: PASS.
• Complete unbypassed local gate: PASS — fmt, strict workspace clippy, readability ratchet, full workspace, temper-server lib 761/761, ownership write surfaces 28/28, reconciliation DST 9/9, randomized platform 8/8 (1514.90s), live GEPA E2E 12/12, default-stack WASM dispatch 6/6, feature-unified tests, and doctests.
• The first full-gate attempt encountered one unrelated transient SIGABRT in ensure_entity_loaded; its unchanged default-stack target rerun passed 10/10, and the complete full-gate rerun passed. No test was altered, skipped, or stack-provisioned.

Required published-head review order

1. Fresh independent complete-open-diff PASS at exact head.
2. Fresh Greptile requested only afterward: standard request, file-limit bypass request. Exact-head Greptile check: PASS; no new actionable findings.
3. Greptile P1 remediation thread answered and resolved; all 3/3 review threads are resolved.
4. Fresh final independent complete-open-diff PASS at exact head.

RED/GREEN durability evidence

• WASM enlarged dispatch future: exact base PASS / 346681ab FAIL; fixed by bounding the generation-context future, without changing the WASM test or provisioning stack.
• Snapshot provenance/coordinates: b267a8c2 → b1f052f0; 96089d53 → 20fb1218; fb087cd2 → 666b4637.
• Materialized zero-domain owner preservation: bacde955 → 7e1833b4.
• Audit-only phantom purge: 5b981593 → 6782e1d4.
• Field-update intent binding: 66cda2f7 → 4e3e827b, with in-memory retry follow-ups 64a75249 / 346681ab; thread resolved.
• Durable contract-only tenant preservation: ddff420e → a703b7d5.

Current-head CI

Actions run 30194176518 is green at a703b7d5: compile/lint, integrity/DST patterns, verification contract, spec verification, instrumentation, core/boot/consistency/random platform DST, and Tests (24m29s). Greptile Review is also PASS.

The protected untracked SQLite artifact remains untouched. crates/temper-actor-runtime was not changed. No temporary stack configuration is present.