Sync Boatstack from Intelligence Flow Labs @ 68bcc5284017

[operator-stack-publisher]

What this sync releases

recovery-status no longer blocks on an unrelated, already-ignored stale delivery

recovery-status scans the shared delivery-state store before it selects the delivery a correction belongs to. That scan (allManagedDeliveryStates) failed closed on the first unreadable delivery and never consulted workflow.ignored_deliveries. So a single delivery abandoned by an earlier session — malformed on disk, and already explicitly ignored — turned every recovery into a repo-wide BLOCKED: Managed delivery state cannot be verified, even when the delivery actually being recovered was healthy and on the current branch. An operator hit exactly this in the field: recovery of a fine, unrelated pull request was stranded by a stale ignored delivery it had no relationship to, with no in-tool way forward.

This is the same failure class the next boundary already closed under the control law stale-delivery-cannot-block-unrelated-feature — but that law had been written as if it lived only at the ResolveNext boundary, so the twin read-only boundary, ResolveRecovery, never got the treatment. The store is one shared resource crossed by three boundaries: the two read-only resolvers (ResolveNext, ResolveRecovery), which must tolerate an unrelated corrupt delivery, and the mutation enumerator (ActiveManagedDeliveries), which must stay fail-closed so corrupt state can never be laundered into a write.

The law is now stated over the invariant rather than one call site, and ResolveRecovery enforces it. allManagedDeliveryStates partitions the store the way scanManagedDeliveries does for next: readable states come back as data, unreadable slugs come back as a separate list rather than aborting the scan. ResolveRecovery then applies the operator's ignored-deliveries filter to both lists before any invalidity becomes fatal, and blocks only on a delivery that is still both invalid and unignored — naming it and routing to the discard-delivery remedy. Recovery of an unrelated healthy delivery proceeds with an ignored corrupt delivery in the store; the mutation boundary is unchanged and still fails closed.

The regression suite pins the class shut at the recovery boundary with the twins of the existing next conformance tests — an ignored invalid delivery no longer blocks a healthy branch (positive/bypass), a still-unignored invalid delivery blocks while naming the offender and prescribing discard-delivery (negative/relation), and the read-only resolver leaves the offending state byte-for-byte untouched. A companion guide, docs/control-law-scoping.md, records the method that would have caught the original miss: state a control law over its invariant and failure class, enumerate every boundary that crosses the shared resource, and extend the existing law to cover them rather than minting a near-duplicate for the second one.

Projection provenance

Generated from operatorstack/intelligence-flow@68bcc5284017ffc1271d09e96a2b583ad555ee0e.
Review provenance, tests, and examples before merging.

[bigboateng]

Superseded and closing. This auto-generated sync snapshot predates the double-checked-locking hydration fix (intelligence-flow #198), so its test (ubuntu-latest) fails on TestGuardAutoHydrationSerializesConcurrentFirstUse ("hydrator ran 2 times under contention, want exactly 1"). That fix is on main, and boatstack main is already synced past this commit (now @ 70614614df37, #120), which passes ubuntu cleanly. Nothing here is unmerged — this snapshot is obsolete.