feat(chat-swarm): deterministic worker continuation epoch transfer (#120)

[James3014]

Refs #120 / #51.

Disposition

DETERMINISTIC_WORKER_CONTINUATION_SOURCE_CANDIDATE_READY

Exact subject:

• base: main@c6e09967cb745407de3a7d09808c472d38f6e612
• head: a168bb39ea55a868f40c15e85f91fb1a59c0d8ce
• scope: feat(chat-swarm): add durable worker continuity and conversation rollover #51-A deterministic worker continuation only
• Capability Discovery disposition: EXTEND_EXISTING local_agent_execution_and_chat_swarm

This PR remains transport-neutral. It does not implement #117/#105 browser/carrier creation, public continuation MCP tools, Auto Compact, real ChatGPT rollover, deployment, or #51/#104 closure.

Implemented contract

• reuses existing Chat Swarm SQLite + durable_operations; no second continuation ledger/table/migration;
• target carrier identity comes only from authenticated request metadata;
• owner approval/reconciliation is exact-owner + exact-swarm bound;
• exact sourceEpoch -> targetEpoch CAS and atomic worker carrier transfer;
• checkpoint/source-carrier drift fails closed;
• active/busy/unknown work cannot roll over or silently retry;
• unresolved continuation fences any second replacement attempt;
• concurrent replacement targets produce one winner and terminal SUPERSEDED losers;
• accepted source carrier becomes retired/fenced and cannot be revived as a later target;
• exact replay is state-independent across PENDING/APPROVED/SUPERSEDED/EXPIRED/RECONCILE_REQUIRED;
• changed material is REPLAY_CONFLICT;
• immutable continuation material binds stable attempt identity, source/target epoch/carrier, checkpoint hash, TTL, requestedAt and absolute expiresAt;
• created_at == requestedAt and durable request hash are revalidated on readback;
• terminal durable metadata is strict: succeeded requires a valid approval receipt, non-succeeded states may not carry approval receipts, and outcome_unknown requires RECONCILIATION_REQUIRED evidence;
• corrupt durable continuation state fails closed for reads and subsequent continuation writes;
• restart normalizes pending continuation to RECONCILE_REQUIRED; explicit same-request no-effect reconciliation is required;
• drain/reconcile-only lifecycle blocks continuation request/approval while allowing bounded status/reconcile;
• PR-only CI runs git diff --check against the exact GitHub PR base SHA and HEAD.

Exact-head verification

GitHub CI run #206 / 34745371083 on head a168bb39...:

• Diff check (PR) — PASS;
• all seven Chat Swarm continuation focused macOS jobs — PASS;
• Local agent sessions (macOS) — PASS;
• Smoke (macos-latest) — Typecheck PASS, Test PASS, Build PASS, Doctor PASS;
• Smoke (ubuntu-latest) — Typecheck PASS, Test PASS, Build PASS, Doctor PASS;
• Smoke (windows-latest) — Typecheck PASS, Test FAIL on the pre-existing carrier-binding baseline.

Windows baseline classification is evidence-bound: current main@c6e09967... push CI run #150 / 34735356613 fails the same first seven carrier-binding.test.ts cases with the same AUTHORITY_REQUIRED: Cutover approval exceeds exact local resource or validity error while main macOS and Ubuntu smoke pass. Therefore the Windows result is not a #120 regression. Whether that baseline check is required for merge remains repository-governance policy; this GitHub App cannot read branch-protection settings and no bypass is claimed.

Database persistence/reopen is exercised by the lifecycle startup-recovery witness using the same stateDir from a second lifecycle instance. No schema/table/migration is introduced by this slice, so schema upgrade is N/A.

Owner review policy amendment — 2026-09-13

Owner explicitly waived the independent exact-head reviewer requirement for #120. Controller/source review plus the exact-head evidence above is sufficient for this child issue. This is not represented as an independent review. GitHub-enforced required checks / branch rules still apply; no bypass is claimed.

Merge boundary

The exact head may proceed through normal GitHub merge if the repository permits it. After accepted merge, #120 may be closed with source-only claim ceiling:
DETERMINISTIC_WORKER_CONTINUATION_SOURCE_ACCEPTED

Real zero-touch conversation replacement and Auto Compact remain downstream under #117/#105 + parent #51.

[James3014]

Independent exact-head review on b86c6676c46c29b22a5625bf6f46fbe4ae0490ee found two source-correctness blockers before #120 can claim deterministic continuation source acceptance:

1. Continuation replay material does not bind expiry/TTL. continuationMaterialHash() currently binds worker/swarm/epoch/carrier/checkpoint but not ttlSeconds / the requested expiry contract. Therefore replaying the same (swarmId, workerId, attemptKey, target) with a materially different TTL can return the existing request instead of REPLAY_CONFLICT. Bind the bounded expiry request material into the immutable request hash and add a hostile replay test. Also verify persisted attemptKey corresponds to the durable row's stable attempt identity so request_json corruption cannot silently change logical attempt identity.

2. reconcileNoEffect does not exact-bind its swarmId parameter to the durable request. The coordinator authorizes the supplied swarm, then reconciles solely by requestId; if one owner identity owns multiple swarms, a request from swarm B can be reconciled while passing swarm A. Require exact request.swarmId == asserted swarmId and add a cross-swarm same-owner negative test.

The new SUPERSEDED terminal loser handling and generic-restart normalization are directionally sound. Keep the PR draft until these exact-binding gaps are closed and fresh macOS CI passes. This review does not request any #117 browser/carrier work or public MCP continuation tool surface.

[James3014]

Controller exact-head re-review on 503c900c1d3413207e1db7a9b0a98981c94b0281 resolves the earlier findings.

Verified repairs:

• TTL/expiry is immutable replay material; same attempt with changed TTL is REPLAY_CONFLICT.
• durable attempt_key and request hash are recomputed/verified on readback; corrupt rows fail closed.
• reconcileNoEffect is exact-swarm bound, including same-owner cross-swarm negative coverage.
• unresolved continuation outcomes fence any second replacement attempt.
• concurrent targets produce one accepted transfer and terminal SUPERSEDED losers.
• accepted source carriers are retired/fenced from future target reuse.
• exact replay remains idempotent after APPROVED/SUPERSEDED/EXPIRED and does not depend on the worker still being at the source epoch.
• target identity remains authenticated metadata, not caller-supplied material.
• no second continuation ledger/table/migration, browser carrier, public continuation MCP tool, provider catalog, or routing authority was introduced.

Exact-head CI run #201:

• macOS Smoke: typecheck/test/build/Doctor PASS
• all seven continuation focused macOS jobs PASS
• Local agent sessions macOS PASS
• Ubuntu Smoke PASS
• Windows remains the same pre-existing Test failure observed on current main c6e09967...; macOS-only acceptance does not reinterpret that baseline as #120 success/failure, and no check bypass is claimed.

Controller disposition: DETERMINISTIC_WORKER_CONTINUATION_SOURCE_CANDIDATE_READY.

This is not the required independent review and is not merge/acceptance authority. Independent exact-head review remains the next gate.

[James3014]

Exact-head follow-up review found one remaining durable-integrity blocker, so the PR was returned to Draft.

ChatSwarmContinuationStore.toRequest() currently maps any durable row with status='succeeded' to APPROVED even when receipt_json is null. That permits a corrupted terminal row to be interpreted as an accepted continuation without its atomic approval receipt, contradicting the PR's fail-closed corruption claim. The inverse binding is also not strict: a non-succeeded row may carry an approval receipt without being rejected, and outcome_unknown is accepted as RECONCILE_REQUIRED without requiring the expected reconciliation error code.

Required bounded repair:

• succeeded MUST require a valid bound receipt and no error code/message;
• non-succeeded states MUST NOT carry an approval receipt;
• outcome_unknown MUST be bound to the expected RECONCILIATION_REQUIRED error state;
• add hostile corruption tests for at least succeeded-without-receipt and nonterminal-with-forged-receipt;
• rerun exact-head macOS CI before restoring SOURCE_CANDIDATE_READY.

No #117/browser/carrier scope expansion is requested.

[James3014]

Controller exact-head re-review complete for a168bb39ea55a868f40c15e85f91fb1a59c0d8ce against main@c6e09967cb745407de3a7d09808c472d38f6e612.

No remaining #51-A source correctness blocker was found after the durable terminal-metadata, absolute-expiry, corruption-fence, replay, unresolved-continuation, and retired-carrier repairs.

Verification bound to this subject:

• PR diff check: PASS;
• all focused Chat Swarm continuation macOS jobs: PASS;
• Local Agent Sessions macOS: PASS;
• macOS Smoke: Typecheck/Test/Build/Doctor PASS;
• Ubuntu Smoke: Typecheck/Test/Build/Doctor PASS;
• Windows Smoke: Typecheck PASS, Test FAIL on the same current-main carrier-binding baseline. The PR and main@c6e09967... both fail the same first seven carrier-binding.test.ts cases with the same AUTHORITY_REQUIRED: Cutover approval exceeds exact local resource or validity error; this is not attributed to #120. No branch-protection bypass is claimed.

Controller disposition: SOURCE_CANDIDATE_READY.

This is an owner/controller review, NOT the independent exact-head review required by #120. Do not treat this comment as approval, integration authority, merge authority, deployment authority, or #120/#51 closure.