[rocketbitz]

Durable lifecycle publication can repeat when immediate completion overlaps the background dispatcher. The bridge previously assigned each copy a fresh ingested-event ID, allowing one source completion to launch two downstream runs. This change derives a stable internal ID from the trusted nonzero sequence and atomically stops routing when that ID already exists. Admission, match persistence and the replay fence share one transaction; rollback permits later delivery. Namespace guards and post-commit execution remain intact. The fence lasts while the ingested row is retained; legacy sequence-zero events and repeated external HTTP requests retain fresh-event behavior.

The real-surface regression starts a job over HTTP, holds its committed completion before immediate publication, observes background ingestion, then releases the same sequence. A terminal hook and a later unrelated HTTP-run completion establish that the bridge consumed the replay. It requires one ingested row, one match, one marketing run, empty queues and no finance delivery through ten configured dequeue intervals. The ordinary integration case retains its exact-one assertion and runs without a fault overlay or skip.

The qualification repairs also isolate generic HTTP fixtures, keep explicit cron/backfill schedules outside the live test window, and join owned work during child-test cleanup before deletion. This prevents the foreign cron work observed in the master SQL-budget failure; budgets are unchanged. Connector API probes close connections from their first request without retries. A controlled transport experiment supports that repair; the original hosted reset's cause remains an inference. The CLI-only group-refresh test gates its fake directory response until the initial assertion finishes, preserving its group and call-count assertions.

The mobile test sends its navigation chord in one keyboard.type('gy') call. The failed trace bounds the actual keydown gap above 1,051.535ms against the existing one-second window; timer expiry remains an inference because the callback was not recorded. Controlled real input kept the drawer open after expired separate presses and navigated to /system with a valid batched chord. Product keyboard behavior, assertions, timeouts and retries are unchanged.

The latest Helm shard 1 failure exposed a separate fixture premise: Docker Hub returned HTTP 500 while resolving values_leaf's alpine:3.23. Caesium correctly bypassed cache reuse when immutable identity was unavailable, executed the task, and completed the run successfully. The fixture nevertheless required a cache hit. Its first-run checks established execution, not a usable image digest for every later tag lookup.

The existing public-tag positive control now runs unchanged before DAG construction: two actual runs with digestTTL: 0s, first execution and resolved digest, second cache hit with matching digest, and CLI why reporting CACHE_HIT. The graph's seven stable inputs use that observed digest in alpine:3.23@sha256:… references. The node-local mutable source and all transitive, skipped-predecessor and values-chain assertions remain. There are no added retries, skips, TTL windows or resolver fallbacks. The separate public-registry control still fails if its required lookup cannot succeed.

Validation:

• New candidate: head df1c2dba19e284851add9b389ab9fe7da53228f1, base cb77e8a3b53af20309b7b04ca24bcd463d63eccc, literal merge eb1a930f77a1b7dd9d78f0b2d03b6027e815ba71, equal head/merge tree ab1ea276cdbefe5456d6284b3a1f55715a73e3ad, new workflow, attempt 1, passed: 49 terminal jobs (46 successful and three expected release/nightly skips), all nine required checks successful. All six critical jobs finished 748 seconds after changes, within the 900-second budget.
• Actual candidate-bound artifact audit passed: six provider/HTTP scenarios, concurrent receipt lookups, ten connector browser cases and the three-member configuration scenario passed once with no selected skips, retries or flakes. Source/tree/image and producer receipts match the literal candidate; reply-loss, outage, restart and configuration-skew observations are present. Fresh required checks and whole-workflow success were verified before and after the audit. Independent raw-evidence review: CLEAR.
• The hosted Helm job passed. Its retained raw log contains exactly one passed local result and one passed distributed result, with expected worker claims, unresolved mutable images and stable cache hits. The checkout names the literal candidate.
• Revised Kubernetes fixture: local PASS once in 31.826s; distributed PASS once in 110.776s. Both drove real CLI/API execution against Kubernetes with zero skips or retries. Local executed tasks had claim attempt 0; distributed executed tasks had claim attempt 1. All 21 original assertions remain. Syntax and scoped whitespace checks plus all 188 CI-helper tests passed. Source stayed unchanged during both runs; owned resources were cleaned up.
• Prior local proofs remain applicable through unchanged relevant inputs: containerized unit tests passed all 168 packages, including ten lifecycle/store regressions and the repaired auth case; lint passed with zero issues. The 24 existing PostgreSQL opt-in skips remain. Full unfiltered Linux/arm64 integration passed once: 415 PASS, 135 existing lane SKIP, zero FAIL; lifecycle and SQL-budget cases both passed without skips.
• Paired replay used one frozen runner: old server failed once with two events/matches/marketing runs; fixed server passed once with exact one/one/one, empty queues and zero finance delivery across ten 500ms intervals. No testcase retry occurred. UI lint, 659 Vitest tests, build, and both mobile projects with retries zero passed. These proofs do not execute the revised Kubernetes fixture.

This PR changes fifteen files. F4 promotion and N1 remain unchecked; no PR result is counted as a qualifying master run. Required checks, whole-CI success and review requirements still govern merge readiness.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The changes appear safe to merge; no new actionable issue was found.

Summary

The PR prevents repeated durable lifecycle events from starting duplicate downstream runs.

• A repeated durable lifecycle event starts only one downstream run.
• Integration fixtures use HTTP triggers and wait for their work before cleanup.
• Connector probes open a fresh connection for each request.
• The mobile shortcut test sends both keys together.
• The group-refresh test holds its fake response until the first check finishes.
• The cache test reuses one resolved image across its graph.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Durable lifecycle event] --> B[Derive stable event ID]
  B --> C[Begin transaction]
  C --> D{Insert event ID}
  D -->|Already exists| E[Stop without routing again]
  D -->|Inserted| F[Admit runs and write matches]
  F --> G{Commit succeeds}
  G -->|Yes| H[Launch execution]
  G -->|No| I[Roll back event and admissions]

Loading

_{Reviews (6) · Last reviewed commit: "Pin stable Kubernetes cache fixture inpu..." · Reviewed by Greptile}