[Epic] Backlog burn-down: live stability, sibling waits, operational conformance (2026-10) #154

The whole open backlog of CannObserv/replicator, burned down one child at a time: live stability first, then the work sibling repos wait on, then operational conformance. Done when the host's disk is under a canonical GC, the capture consumer is live, the co-core pin tracks the current minor, and Dependabot proposes action bumps. Every other open issue is then either parked with a trigger or waits on a named external with an observable unblock condition.

• Last check-in: 2026-10-26T17:27:16Z
• Last issue seen: Bump the dev chain's virtualenv (21.7.1 → 21.14.x) and filelock (3.32.2 → 4.2.x) past 26 advisories #160
• Last verified SHA: 9b37afe
• Next: Retention sweep can rmdir a shard the store just created, failing the write (transient; flakes test_run_dispatches_to_the_byte_path) #159, brief on the issue

Order

The operator's rule, verbatim: "Prioritize bug fixes, issues other repos are waiting on, operational conformance and stability. Older issues may need to be re-evaluated for continued relevance."

Tiebreaks the coordinator added, numbered so the operator can challenge one:

1. A hazard measured live on the host ranks as a bug. Host disk GC: adopt provisioner#61's canonical GC + headroom sensor on co-replicator (root hit 97%) #148 is the only one: root at 81% and rising (see Measured state).
2. Unblocked before blocked. A blocked child's interim (a hand step) can still run ahead of its turn.
3. A multi-minor co-core pin move lands alone, in an isolated venv, before any behaviour that needs the new version (the Converge storage on the cluster content-addressed model #114 rule, kept from [Epic] content.fetch-policy producer moves to Archiver (parked until F1) #135).
4. A shared runtime is built once, by the child with the most sibling waits. Viewport capture: consume the capture command, render headless, store, publish the stored-capture fact #138 builds the browser runtime and Headless-browser fetch path for JS-rendered pages (re-sited from watcher#3) #63 reuses it.
5. Context freshness: the child whose surface just changed goes next.

Overrides:

• Decided 2026-10-26 (operator): Tier 1 is Retention sweep can rmdir a shard the store just created, failing the write (transient; flakes test_run_dispatches_to_the_byte_path) #159 → Host disk GC: adopt provisioner#61's canonical GC + headroom sensor on co-replicator (root hit 97%) #148 → Egress guard: IPv6 forms embedding a private IPv4 address (NAT64, 6to4, ::/96) pass the deny table #156. Corrected the same day: Retention sweep can rmdir a shard the store just created, failing the write (transient; flakes test_run_dispatches_to_the_byte_path) #159's premise was "live in production", but it's live only in CI, because production runs no sweeper. The order stands, and the swap to Host disk GC: adopt provisioner#61's canonical GC + headroom sensor on co-replicator (root hit 97%) #148 first is offered.
• Decided 2026-10-26 (operator): Bump the dev chain's virtualenv (21.7.1 → 21.14.x) and filelock (3.32.2 → 4.2.x) past 26 advisories #160 filed into Tier 3.

Boundary decisions

• Close what is done or superseded. Park ideas, even dormant ones, with a re-entry trigger. Proposed 2026-10-24.
• A Replicator output that an Archiver control-plane design is still deciding (WARC/WACZ archival captures: per-InfoItem policy, produced by Replicator (design) archiver#408 WACZ, Preserve video/audio media and platform transcripts (YouTube first) for video InfoItems, produced by Replicator (design) archiver#410 video, Default featured images for InfoItems from a capture of their source, delivered to the WP Information (design) archiver#411 featured images) becomes a child only when that design files or rescopes a Replicator issue. Proposed 2026-10-24.

Exit criterion

#148, #153, #138, #76, and the bugs #159 and #156, are closed and verified live (bugs added 2026-10-26). Every other open issue is parked with a trigger, or waits on a named external with an observable unblock condition.

Verify recipe

• Gate: CI by job (test, lint, gcs (T4 against the test bucket), and since Viewport capture: consume the capture command, render headless, store, publish the stored-capture fact #138 browser (the renderer's confinements, pinned headless shell)) on the merge SHA and on main's tip. All four green on 9b37afe. The Dependabot check-runs are GitHub's security updates, not the gate; see Bump the dev chain's virtualenv (21.7.1 → 21.14.x) and filelock (3.32.2 → 4.2.x) past 26 advisories #160 and Adopt Dependabot: nothing proposes crossing this repo's dependency caps #76.
• Deploy: the main checkout is on main, clean, at origin/main. When runtime code or a dependency changed, replicator.service ActiveEnterTimestamp is after the merge, /run/replicator/build-id is the merge SHA, and the boot journal shows worker ready plus the fetch-policy replay with no decode warnings.
• Baseline: uv run pytest in the main checkout, no env file sourced: 1677 passed, 1 skipped (tests/test_deploy.py:880, not an exe.dev session), 96 deselected (integration and browser), 2026-10-26. The skip is the same test as at creation; Viewport capture: consume the capture command, render headless, store, publish the stored-capture fact #138 added 209 tests.
• By deliverable:
  • co-core pin → uv.lock, uv pip show for all three packages in the service venv, and the closure-diff report in the pin comment.
  • new consumer stream → broker reads the group back as acladmin (Go-live check for content.capture: confirm replicator.capture exists before archiver's first command broker#116), a first outcome in the journal, and ACL LOG clean (broker reads it). Never probe the group as replicator.
  • host disk → df -h /, the GC timer's journal, and the co-status headroom monitor ok.
  • a deploy/ file → the installed copy matches it (cp after every edit).
  • docs → tests/test_boundaries.py green, measure-context.sh --exact under budget with no dead links.
  • the capture path → worker ready reads capture: enabled; the browser/ cgroup's memory.max, memory.swap.max, memory.oom.group and pids.max; worker/memory.low is 134217728; -m browser 21/21 on the host after any runtime change.

Tier 1 — live stability

• Retention sweep can rmdir a shard the store just created, failing the write (transient; flakes test_run_dispatches_to_the_byte_path) #159 Retention sweep can rmdir a shard the store just created · S · bug · live in CI (a ~1-in-50 flake of test_run_dispatches_to_the_byte_path); latent in production, where the object-store backend starts no sweeper [measured 2026-10-26] · brief on the issue 2026-10-26 · a write-side retry is weighed against an mtime grace alone; a co-core change is draft-only
• Host disk GC: adopt provisioner#61's canonical GC + headroom sensor on co-replicator (root hit 97%) #148 Host disk GC: adopt the canonical GC and headroom sensor (CannObserv/provisioner#61) · M · dependency met: New skill: maintaining-host-disk — adopt Provisioner's canonical disk GC + headroom sensor, plus the repo-side knobs (cohort-wide) gregoryfoster/skills#425 closed 2026-10-26 (maintaining-host-disk, GC VERSION 2 with CannObserv/provisioner#85's clear line) · first step: vendor the skill (the submodule at ab26209b predates it) · root-owned writes are the operator's · 2026-10-24: interim hand reclaim, 81% → 77%
• Egress guard: IPv6 forms embedding a private IPv4 address (NAT64, 6to4, ::/96) pass the deny table #156 Egress guard: IPv6 forms that embed a private IPv4 address pass · S–M · bug, security, latent here (no global IPv6 route) [stated] · from Viewport capture: consume the capture command, render headless, store, publish the stored-capture fact #138's review · DestinationGuard is shared by fetch and the browser since ac2378b, so one fix covers both · grows docs/STREAMS.md (9754) and the fetch outcome reference (9840), both near budget

Tier 2 — sibling waits

• Catch up co-core 0.37.0 → 0.39.1 ahead of the capture consumer #153 Catch up co-core 0.37.0 → 0.39.1 · S–M · unblocked · isolated venv, closure diff · prerequisite for Viewport capture: consume the capture command, render headless, store, publish the stored-capture fact #138 (capture contracts are in 0.37.1) · verified 2026-10-25: 42b728c..2790a53 (PR #153 chore: catch up co-core 0.37.0 -> 0.39.1 #155), CI green by job on 2790a53; deployed 2026-10-24T22:36Z, build 2790a53, co-core 0.39.1 ×3, replay clean, 20 blobs since. Floor >=0.39.0,<0.40 (operator, at ship). Closed
• Viewport capture: consume the capture command, render headless, store, publish the stored-capture fact #138 Viewport capture: consume content.capture, render, store, publish · L · dependency met: co-core 0.39.1 live (Catch up co-core 0.37.0 → 0.39.1 ahead of the capture consumer #153, 2026-10-24) · design doc first: a new command stream and the capture issuer contract · approval gate: the browser runtime dependency and its memory cap · Viewport screenshots: per-source capture policy, issued to Replicator on a dedicated command stream archiver#380, Default featured images for InfoItems from a capture of their source, delivered to the WP Information (design) archiver#411 and Go-live check for content.capture: confirm replicator.capture exists before archiver's first command broker#116 wait on it · broker grants live since 2026-10-20 · create replicator.capture before Archiver's first command, never at $ on a non-empty stream · brief on the issue 2026-10-25, with three operator decisions (runtime, enable flag, concurrency) · verified 2026-10-26: 2790a53..9b37afe (PR #138 PR 1/2: the browser runtime, its SOCKS egress guard and the delegated cgroup #157 6580979, PR #138 PR 2/2: the content.capture consumer, off by default #158 9b37afe); CI green by job incl. browser on both; live since 2026-10-26T16:42Z, capture enabled, unit and cgroup as designed; closed. Still open: the first real capture (Viewport screenshots: per-source capture policy, issued to Replicator on a dedicated command stream archiver#380) and broker's read-back (Go-live check for content.capture: confirm replicator.capture exists before archiver's first command broker#116), see Verification debt
• Headless-browser fetch path for JS-rendered pages (re-sited from watcher#3) #63 Headless-browser fetch path · L · rework: selection is settled as option 1, an issuer-driven co-core render field (Per-source render mode (headless-browser fetch) as Archiver policy, carried to content.fetch archiver#379, 2026-10-14); the body's co-core 0.10.0 field list is stale · runtime met: Renderer, SOCKS guard and browser/ cgroup from Viewport capture: consume the capture command, render headless, store, publish the stored-capture fact #138 · still waits on a cannobserv issue for the render field, not yet filed · For Headless-browser fetch path for JS-rendered pages (re-sited from watcher#3) #63 notes on the issue 2026-10-26 · Per-source render mode (headless-browser fetch) as Archiver policy, carried to content.fetch archiver#379 waits on it

Tier 3 — operational conformance

• Adopt Dependabot: nothing proposes crossing this repo's dependency caps #76 Adopt Dependabot · S · rework: github-actions only, in the cohort's shape (archiver's config excludes context-cadence.yml, prefix chore), plus the 2026-09-10 review's steps 2–4: --frozen → --locked in ci.yml, the assert step names the OIDC row, a guard test with pyyaml · uv half parked on CannObserv/cannobserv#554 · unblocked · note: GitHub's Dependabot security updates have run for uv since 2026-10-26T09:15Z and fail on the wheelhouse (red, non-gate Dependabot check)
• Bump the dev chain's virtualenv (21.7.1 → 21.14.x) and filelock (3.32.2 → 4.2.x) past 26 advisories #160 Bump the dev chain's virtualenv and filelock past 26 advisories · S · filed 2026-10-26 (operator) · a lock-only change; nothing caps the fix · dev chain only, but installed in the service venv
• Run replicator's unit from a release, not /home/exedev/replicator (CannObserv/broker#22's rollout, replicator first) #151 Run the unit from a release, not the dev checkout · L · survey done 2026-10-23 · blocked by Package broker's release deploy (CannObserv/broker#22) into the FastAPI skills gregoryfoster/skills#469 (the template) · after Host disk GC: adopt provisioner#61's canonical GC + headroom sensor on co-replicator (root hit 97%) #148 (releases need disk headroom)

Waits

Parked

Sibling replies owed

• Per-source fetch timeout, carried to content.fetch's timeout_seconds archiver#377: answered 2026-10-24. The ceiling's doc, refused not clamped, and a flag: the journal shows Watcher's 1800 s doesn't reach timeout_seconds as the issue states.
• CannObserv/cannobserv#495: answered 2026-10-24. Replicator's precondition has been met since 2026-09-27 (Converge storage on the cluster content-addressed model #114); the remaining gate is Archiver's.

Verification debt

Accepted limitations

• CR 10 of Viewport capture: consume the capture command, render headless, store, publish the stored-capture fact #138: each render's SOCKS listener is unauthenticated, and a local process could reach it. Accepted 2026-10-26.
• CR 11 of Viewport capture: consume the capture command, render headless, store, publish the stored-capture fact #138: Playwright's Node driver runs unconfined in the worker/ cgroup. A page can't reach it. Accepted 2026-10-26.

Standing checks

• df -h / at every check-in. Reclaim by hand above 85% until Host disk GC: adopt provisioner#61's canonical GC + headroom sensor on co-replicator (root hit 97%) #148's timer runs. Last run 2026-10-26: 80%.
• At every check-in: the journal for stored a capture (Viewport screenshots: per-source capture policy, issued to Replicator on a dedicated command stream archiver#380's first command) and Go-live check for content.capture: confirm replicator.capture exists before archiver's first command broker#116's read-back, which discharge the Verification debt rows.
• Due 2026-11-06: the monthly patching-hosts run (knob posture scheduled; the last run was OS patching under the patching-hosts skill: first run on co-replicator (vendor the skill, commit the knob, maintenance-lane catch-up) for gregoryfoster/skills#313 step 8b #131, 2026-10-06). Read the host memory before proposing it. The run now also covers the pinned browser's system libraries, which ldd checks.

Watching

• Broker-unreachable windows. One on 2026-10-22, 04:13–04:16Z: 8 failed cycles, then recovered with no restart. Threshold: a window that exhausts the boot budget, or recurs daily. Since 2026-10-24.

Measured state

Rewritten from scratch at each check-in, never appended to.

• Production runs build 9b37afe (Viewport capture: consume the capture command, render headless, store, publish the stored-capture fact #138), active since 2026-10-26T16:42:31Z with NRestarts 0. Capture has been enabled since 16:42:36Z (REPLICATOR_CAPTURE_ENABLED=true). The unit matches deploy/replicator.service: Delegate=yes, DelegateSubgroup=worker, KillMode=mixed. The browser/ cgroup has memory.max 1610612736, swap 0, oom.group 1 and 512 pids, and is empty at idle. main is at 9b37afe. Measured 2026-10-26.
• Since go-live the journal is 26 lines, all INFO, including 2 stored blobs. No capture command has arrived yet. Measured 2026-10-26.
• The blob backend is the object store, so no retention sweeper runs in production: 0 sweep lines in 30 days. Measured 2026-10-26.
• Root is 80%, 3.8G free. Viewport capture: consume the capture command, render headless, store, publish the stored-capture fact #138's runtime added about 416M; the client installs have been flat since 2026-10-24. Measured 2026-10-26.
• Context: AGENTS.md is at 5989 of 6000 [estimate]. These reference docs are within 3% of their 10000 budget: COMMANDS 9997, ENVIRONMENT 9964, replicate issuer contract 9893, fetch outcome reference 9840, boundaries 9838, CONVENTIONS 9761, STREAMS 9754, fetch issuer contract 9723. Measured 2026-10-26.
• Dependency advisories: dev-only virtualenv 21.7.1 (23) and filelock 3.32.2 (3), from OSV against uv.lock. Measured 2026-10-26.
• The skills submodule is at ab26209b, which predates maintaining-host-disk (upstream at 5f3a3dd0). Measured 2026-10-26.

Overlaps

Log

• 2026-10-24: created. 8 open: 5 in tiers, plus 1 new child (Catch up co-core 0.37.0 → 0.39.1 ahead of the capture consumer #153); 3 parked (Research: WebRecorder/WACZ archival capture path (re-sited from watcher#4) #64, [Epic] content.fetch-policy producer moves to Archiver (parked until F1) #135 and its After F1: state the fetch-policy producer as Archiver, retire the "until F1" wording #144); 0 closures proposed. Reworks: Headless-browser fetch path for JS-rendered pages (re-sited from watcher#3) #63 (selection settled), Adopt Dependabot: nothing proposes crossing this repo's dependency caps #76 (cohort shape). CannObserv/provisioner#61 closed today, so Host disk GC: adopt provisioner#61's canonical GC + headroom sensor on co-replicator (root hit 97%) #148 is half unblocked. Gate green on 42b728c. Next: Catch up co-core 0.37.0 → 0.39.1 ahead of the capture consumer #153.
• 2026-10-24: filed Catch up co-core 0.37.0 → 0.39.1 ahead of the capture consumer #153 (co-core catch-up; operator-approved) and posted its brief. Host disk GC: adopt provisioner#61's canonical GC + headroom sensor on co-replicator (root hit 97%) #148 interim reclaim: 81% → 77% (SocratiCode 1.14.0 _npx and Claude Code 2.1.301; CachedExtensionVSIXs kept, because the live VS Code server holds a handle in it). Replies posted on Per-source fetch timeout, carried to content.fetch's timeout_seconds archiver#377 and CannObserv/cannobserv#495 (operator consent). Next: Catch up co-core 0.37.0 → 0.39.1 ahead of the capture consumer #153.
• 2026-10-25: check-in 1: Catch up co-core 0.37.0 → 0.39.1 ahead of the capture consumer #153 verified, deployed and closed (PR #153 chore: catch up co-core 0.37.0 -> 0.39.1 #155, the only new number). The baseline is 1468/1, with the skip identical. My [extract] claim was corrected in place on Catch up co-core 0.37.0 → 0.39.1 ahead of the capture consumer #153's body and brief. Harvest: the For Viewport capture: consume the capture command, render headless, store, publish the stored-capture fact #138 notes are in Viewport capture: consume the capture command, render headless, store, publish the stored-capture fact #138's brief. Blockers: CannObserv/provisioner#85 closed (Host disk GC: adopt provisioner#61's canonical GC + headroom sensor on co-replicator (root hit 97%) #148's line rewritten); New skill: maintaining-host-disk — adopt Provisioner's canonical disk GC + headroom sensor, plus the repo-side knobs (cohort-wide) gregoryfoster/skills#425, Package broker's release deploy (CannObserv/broker#22) into the FastAPI skills gregoryfoster/skills#469, CannObserv/cannobserv#554, F1: stop the content.fetch-policy producer watcher#374 and Produce content.fetch-policy (dark until F1) archiver#366 still open. Found: the vendored mcp-driver.mjs has no update subcommand; filing upstream is pending the operator. Next: Viewport capture: consume the capture command, render headless, store, publish the stored-capture fact #138.
• 2026-10-25: filed init-socraticode: mcp-driver.mjs has no update subcommand, so a capped codebase_update outside a session needs a shim gregoryfoster/skills#483 (operator): mcp-driver.mjs needs an update subcommand, so a capped codebase_update can run outside a session. Next: Viewport capture: consume the capture command, render headless, store, publish the stored-capture fact #138.
• 2026-10-26: check-in 2: Viewport capture: consume the capture command, render headless, store, publish the stored-capture fact #138 verified, deployed and closed (PRs #138 PR 1/2: the browser runtime, its SOCKS egress guard and the delegated cgroup #157 and #138 PR 2/2: the content.capture consumer, off by default #158, 49 commits); capture is live and the debt is listed. New: Egress guard: IPv6 forms embedding a private IPv4 address (NAT64, 6to4, ::/96) pass the deny table #156 and Retention sweep can rmdir a shard the store just created, failing the write (transient; flakes test_run_dispatches_to_the_byte_path) #159 (bugs, Tier 1) and Bump the dev chain's virtualenv (21.7.1 → 21.14.x) and filelock (3.32.2 → 4.2.x) past 26 advisories #160 (filed, Tier 3; red Dependabot security-update runs since 09:15Z). New skill: maintaining-host-disk — adopt Provisioner's canonical disk GC + headroom sensor, plus the repo-side knobs (cohort-wide) gregoryfoster/skills#425 closed, so Host disk GC: adopt provisioner#61's canonical GC + headroom sensor on co-replicator (root hit 97%) #148 is unblocked once the skill is vendored. Produce content.fetch-policy (dark until F1) archiver#366 is deployed dark; F1 is still open. Corrected in place: Retention sweep can rmdir a shard the store just created, failing the write (transient; flakes test_run_dispatches_to_the_byte_path) #159 isn't live in production (no sweeper under the object store). Harvest notes are on Headless-browser fetch path for JS-rendered pages (re-sited from watcher#3) #63, Adopt Dependabot: nothing proposes crossing this repo's dependency caps #76, Host disk GC: adopt provisioner#61's canonical GC + headroom sensor on co-replicator (root hit 97%) #148 and Egress guard: IPv6 forms embedding a private IPv4 address (NAT64, 6to4, ::/96) pass the deny table #156. Next: Retention sweep can rmdir a shard the store just created, failing the write (transient; flakes test_run_dispatches_to_the_byte_path) #159.