Reconciliation — New Todo (Doc 09) vs The dev 1.0 Release Line

Date: 2026-07-17 Status: authoritative status map. Docs 01–09 were written against main (v0.1.8 alpha). The active line is dev (pgGraph 1.0.0, release-ready, unpublished, validated at commit 4edabea), which completed the todo/v1-release/ program (R0–R7) and rewrote the public registers without KI numbering. This document maps every doc 09 slice onto that reality.

Continuity: the old plan lives on dev at todo/v1-release/ (completed, archived) and todo/full-graph-engine/ (design references). The alpha register edits that docs 01–05 were merged into are preserved on branch review/alpha-register-merge (not carried into dev). KI numbers used in docs 01–09 refer to that superseded alpha numbering — treat them as labels for the descriptions, not live register IDs.

Verified against dev code/docs (2026-07-17)

Doc 09 slice Status on dev Evidence
S0 automated PR CI (KI-017) Removed Release gates run locally; the self-hosted GitHub Actions workflow was removed.
C1 ingest/manifest publication race (KI-012) Fixed, different mechanism Manifest publish uses create_new (O_EXCL) no-overwrite CAS; test projection_manifest_stale_publisher_loses_compare_and_swap (projection/manifest.rs). The process-local mutex remains as a fast-path guard, no longer the only protection. Verify-only item: confirm loser-retry behavior surfaces to apply_sync() callers
C2 bidirectional BFS minimality (KI-015) Fixed 2026-07-17 path_finder.rs now tracks per-node hop depth in ParentStep and fully scans each BFS level before selecting the minimum-combined-distance meeting node, instead of breaking on the first candidate found. Regression: bidirectional_bfs_selects_minimal_combined_distance_meeting_node (deterministic) + bidirectional_bfs_matches_single_direction_bfs (differential proptest, 20k cases). See todo/progress.md 2026-07-17 entry
C3 _sync_log retention (KI-016) Likely still open — re-verify No pruning path found on dev (DELETE FROM graph._sync_log absent). R3 “bounded storage” covered snapshot/watermark and compaction crash-safety; log retention was not located
C4 RLS topology boundary (KI-013) Likely still open — re-verify Dev user docs still frame RLS as a source-table concern; no topology-read RLS boundary section found in querying.mdx/limitations-and-fit.mdx. R1 “RLS green” evidence should be audited to see which paths it covered
C5 tenant filter-vs-isolation (KI-014) Re-verify Artifact v6 added a tenant dictionary and dense per-node tenant tokens (R3C); semantics of caller-supplied tenant scope need re-checking against the new representation
O1 poison-row dead-lettering (KI-018) Re-verify (R2/R3 job retry work may cover it) —
O2 atomic artifact+sidecar commit (KI-019) Probably obsolete — re-verify Persistence moved to a 26-section artifact v6 with generation-CAS publication and pinned generation-specific bases; the .sync/.projection_mode sidecar-window finding was against the v0.1.8 format
O3 truncation signal (KI-020) Fixed 2026-07-17 Added a trailing capped boolean column to graph.traverse(), graph.get_neighbors(), and graph.traverse_search(), true only when max_nodes/max_frontier cut expansion short. Confirmed shortest_path()/weighted_shortest_path() were already safe via PathWorkBudget erroring on budget exhaustion instead of returning a silent “no path”. Intentional breaking SQL change; release contract regenerated. See todo/progress.md 2026-07-17 entry
O4 mutable-overlay production caveat (KI-021) Superseded 1.0 promotes durable projections as a supported, gated surface (R3 evidence); the alpha caveat no longer applies as written
O5 README_zh parity (KI-024) Done README_zh on dev is at 1.0.0
Stage 3 live mode (L1–L4) Largely delivered by R2/R3 — re-scope Bounded builds, governed external runs, generation CAS, retained serving generation, durable projection profiles all landed. Remaining from doc 09: weighted-paths-over-overlays (L3) — re-verify; auto-maintenance beyond packaged pg_cron remains a documented operational boundary (dev known-issues “External scheduling is required”)
Stage 4 hybrid auto mode Open No projection_mode = 'auto' policy layer on dev
F1 validation-cache / first-backend cost Possibly fixed — re-verify R3C: “checksum verification is bounded”; current-manifest readers pin generation-specific bases. Benchmark the first-backend query cost on dev before keeping this item
F4 shared reverse CSR / F5 direction-optimizing BFS Open (F4 partially?) Artifact v6 loads “both graph directions … into one compact immutable mapping per backend” per dev limitations doc — re-verify whether reverse CSR is now mmap-shared; F5 not present
Stage 2P P1 property-graph catalog import Already planned on dev todo/full-graph-engine/08-postgresql-19-property-graphs.md specifies the CREATE PROPERTY GRAPH catalog frontend — merge doc 09’s P1 details (GA timing, pg_get_propgraphdef() drift detection) into that plan rather than duplicating
Stage 2P P2 LDBC harness incl. GRAPH_TABLE comparison Open Not found on dev; doc 09 stands. C2 + O3 still gate publication
Stage 2P P3 graph.graph_table() pattern surface / P4 CustomScan Open 1.0 contract explicitly excludes PG19 SQL/PGQ; roadmap-owned. Doc 09 stands
Stage 6 R1 overlay unification / R2 builder regclass / R3 endianness Re-verify Persistence and build were heavily reworked in R3/R4; re-check each against dev before scheduling

Corrected next-actions list (post-1.0 publication)

Still-open, verified items first:

  1. C2 — bidirectional BFS minimal-meeting fix. Done 2026-07-17.
  2. O3 — truncation/capped signal on bounded traversal results. Done 2026-07-17 (breaking SQL change; release contract regenerated; live-verified — see item 3’s full pgrx run, which superseded the originally-deferred “pgrx test run owed” note).
  3. C4/C5 — RLS topology boundary and tenant-scope semantics. Fixed (behavior change) 2026-07-17, superseding the earlier documentation-only decision at the user’s explicit request: graph.build() now refuses tables with row-level security enabled unless graph.allow_rls_tables = on (new GUC, diagnostic PG021), and resolve_tenant_scope() now rejects an explicit tenant SQL argument for non-pinned tenant_column-registered graphs while graph.enforce_tenant_scope = on, forcing the trusted session-setting path instead. Three existing pgrx tests were updated to the new behavior and two new ones added. Also fixed a local pgrx-test blocker (LC_ALL=C LANG=C works around a macOS postmaster became multithreaded startup failure) that had been silently preventing all live pgrx verification this session. With it fixed, ran the complete pg17 pgrx suite (--features "pg17 development", matching the release-gate convention): 1143 passed, 0 failed, 1 ignored — live confirmation of both this change and O3. True per-row RLS-aware topology filtering (vs. this build-time acknowledgment gate) remains unimplemented; it would require a panic-safe temporary PostgreSQL security-context switch to the outer caller, judged too risky to hand-roll in this pass. See todo/progress.md 2026-07-17 entry.
  4. C3 — _sync_log retention. Implemented and live-verified 2026-07-17, following the design in todo/full-graph-engine/12-sync-log-retention-plan.md: graph._sync_watermarks heartbeat table, the safe-floor computation (pure, unit- and proptest-covered), pruning wired into graph.maintenance() only, 3 new sync_health() diagnostic columns (breaking SQL change; release contract regenerated), and — a gap found and closed during implementation that the original design didn’t specify — a graph._graphs.sync_log_pruned_before_id watermark plus a new PG022 guard so a resumed stale backend fails closed instead of silently replaying past pruned rows. 6 new pgrx tests (found and fixed a real off-by-one and two flawed test simulations by actually running them live, not just compiling). Full pg17 pgrx suite: 1156/1156. See todo/progress.md 2026-07-17 entry.
  5. Stage 2P — fold doc 09’s P1/P2 specifics into todo/full-graph-engine/08-postgresql-19-property-graphs.md; keep P2’s LDBC + GRAPH_TABLE comparison and the PG19-GA clock.
  6. Re-verification sweep for the remaining “re-verify” rows above before scheduling any of them.
  7. Release-gate re-run — DONE. The live pg17 cargo pgrx test pass is now done (1156/1156, covering O3/C4/C5/C3 together), but the full-matrix evidence at release/evidence/full-matrix.json (recorded at 4edabea) still predates all four changes and has not been regenerated. Remaining: the multi-version PostgreSQL 14–18 matrix and the non-pgrx gates (docs-render, external-links, crash-recovery, pg-upgrade-matrix, package-install-matrix); the Linux postgres-sanitizer gate remains unavailable in this environment; signing/tagging/publication remain release-owner actions. In progress: re-run iteration 5 hit a genuine regression from C4 itself — graph/tests/heavy/concurrency_stress.sh’s RLS-worker-identity probe legitimately enables RLS and now needs the new graph.allow_rls_tables opt-in, same as the earlier gql.rs pgrx test fix. Fixed, live-verified standalone, committed 48b18dd; matrix relaunched as iteration 6. Iteration 6 result: 16/17 gates pass (only the expected postgres-sanitizer macOS/valgrind gap fails), but two docs/tooling-only commits landed on the tree mid-run so the evidence’s commit stamp (48b18dd) trails actual HEAD by two commits; neither touches Rust/SQL so gate outcomes are unaffected, but a 7th, final iteration was relaunched against a static, confirmed-clean tree at 84cba5b for a pristine single-commit evidence bundle. Iteration 7 failed at legacy-release’s playground gate: a pre-existing, non-regression race between the sandbox container’s periodic scheduled-maintenance worker and graph.build()’s advisory build lock (PG006), which sandbox/common/run_benchmarks.py already retries around but playground_release_gate.py did not. Root-caused and live-verified against the real advisory lock (not just read from source); fixed with the same retry precedent, committed d150c64. Iteration 8 failed at read-latency – a genuine environmental blip (an unrelated ambient Homebrew Postgres service restarting), confirmed not a pgGraph bug by an immediate clean standalone re-run; no fix needed. Iteration 9 reached package-install-matrix before hitting the same PG006 cascade again, this time proving d150c64’s retry itself had a bug: run_psql’s stop_on_error=False branch (the only branch the playground gate actually uses) raised a generic hardcoded message instead of the real stderr, so the retry’s PG006 substring check could never match. My original verification of d150c64 had exercised the other branch (stop_on_error=True), so it looked correct without actually covering the real call path. Fixed by including the real stderr in the raised message (commit 04338c3), re-verified live using the correct branch this time. Iteration 10: clean pass, 16/17 gates, git_commit = ff96701, no commits mid-run. Every gate passes except the expected postgres-sanitizer macOS/no-valgrind gap. This closes out the release-gate re-validation owed since the takeover. See todo/progress.md 2026-07-17/18 entries for the full blow-by-blow.

Release-takeover record (2026-07-17)

  • The interrupted validation run completed after takeover: full-matrix tier on dev@4edabea, 16/17 gates pass. The only failure is postgres-sanitizer, which fails closed in 0.4 s because valgrind is unavailable on this macOS workstation (run_postgres_process_sanitizer.sh requires it). This is an environment-deferred release-operator gate on Linux, consistent with the repo’s existing convention for environment-specific gates. Evidence: release/evidence/full-matrix.json + release/evidence/logs/full-matrix/ (local, gitignored by design).
  • The previous agent’s planned “sfw Dockerfile correction” was rejected: sfw is a host-side wrapper (/usr/local/bin/sfw) that does not exist in Docker build containers; the AGENTS.md policy governs agent-executed host commands, not shipped build files. Adding it to the production Dockerfile would break every user’s image build and force needless evidence regeneration. dev@4edabea therefore remains the validated release candidate; no new commit or evidence regeneration is required for this item.
  • Remaining release work is release-owner action only: Linux sanitizer gate, signing/tagging, publication (per todo/v1-release/README.md).