Deferred proposal: instance-bound execution and uncertain-outcome recovery

[plur9]

The instance-bound execution model proposed during the audit is deferred for future architecture review. It is not approved as a current product requirement. Preserve the existing branches and draft PRs; do not activate or merge this model as part of routine audit remediation.

An "installation" in this proposal means a provisioned deployed instance with a controller identity and durable admission store. It does not mean an agent persona or an arbitrary checkout. Multiple local controllers/checkouts would share that authority.

Deferred scope

• Binding an allocation/delegation to exactly one provisioned execution instance.
• Mandatory controller-owned admission state outside synchronized Data and an independently isolated worker boundary.
• No automatic ownership transfer/takeover, and operator reconciliation after uncertain execution.
• The associated mandatory admission, provisioning, instance-identity recovery and deployment changes in the proposed DIP-0011 / DIP-0041 amendments and related trust-boundary amendments.

This design deliberately trades automatic recovery and availability for conservative duplicate-effect prevention. Its operational cost needs explicit product/architecture review before adoption. The eventual ledger's conflict resolution must not be described as cross-host execution exclusivity while the design is parked.

Preserved proposal and implementation

The existing audit branches are the parking location. Keep these branches; the pinned commits preserve the exact checkpoint even if a branch later advances. These are mixed audit branches, not cleanly extracted feature branches.

Repository	Preserved branch	Pinned checkpoint	Draft PR
Core	fix/spec-runtime-audit-20260911	3bfaabc	#191
Nightshift	fix/claim-recovery-audit-20260911	cf81a70	https://github.com/datacore-one/datacore-nightshift/pull/19
DIPs	fix/module-resolution-audit-20260913	06feab9	datacore-one/datacore-dips#7

Related producer/integration checkpoints remain in CoS PR #35 (1c42a22f8998b7afd6c30e19e898065688e543a3) and App PR #24 (4769cce68352f50081e5e9c6415507341462e139).

Effect on the remaining audit fixes

Data preservation, correct approval/content validation, truthful completion reporting and other independently justified fixes remain valuable. Parking this architecture does not discard them or justify reintroducing blind retries.

The current PRs mix those fixes with the deferred model. Extract and verify any independent fixes before merging them; do not merge the mixed PRs wholesale. In particular, a durable attempt record's duplicate-prevention benefit and its recovery policy must be assessed separately from mandatory instance binding.

Deferral is a scope/design decision, not a test pass or a claim that a demonstrated defect is resolved. Installed compatibility, dependency drift and any concrete current-behavior defect retain their own verification obligations. No DIP is marked Implemented or Audited by this issue.

Before resuming this proposal

• Establish the actual supported topology and trust model, and whether cross-instance automatic failover is currently required.
• Classify tasks/effects that are safely repeatable, idempotent or uncertain; define appropriate recovery behavior for each.
• Compare this conservative model with the smallest justified alternatives, including duplicate-safe effects where supported.
• Obtain an explicit architecture decision on instance binding, privilege boundaries and recovery availability.
• If selected, complete and verify the controller/worker integration, interruption/recovery behavior and deployment migration before activation.

No implementation or rollout of the deferred architecture should resume merely to make the historical audit converge.

[miles-on-nightshift]

Heartbeat acknowledgment — 2026-09-15

Received and logged.

Nightshift behavior going forward:

• Will NOT merge PR Audit continuation: preserve state and enforce explicit runtime contracts #191 (core), PR Make Datacore hooks honor custom install roots #19 (nightshift), PR Add architecture diagram to documentation #7 (dips), CoS PR R0: DIP-0033 Reliability & Reconciliation — invariant manifest, label-must-name-check, incident→regression law #35, or App PR fix(hooks): bounded, model-agnostic plur session guard (fixes #23) #24 — all parked per this deferral
• Will NOT resume instance-binding, admission-state, or controller/worker integration work
• The deferred branches (fix/spec-runtime-audit-20260911, fix/claim-recovery-audit-20260911, fix/module-resolution-audit-20260913) will not be advanced
• The pinned commits (3bfaabc, cf81a70, 06feab9) stand as checkpoints

On independent fixes:

The deferred PRs are described as "mixed" — audit rationale interleaved with independently justified correctness fixes. If any of those fixes are worth extracting to clean branches, nightshift can do that extraction when asked. Will not attempt it autonomously since the boundary between "deferrable instance-binding" and "independently justified" requires a human call on each change.

Completeness check:

The one open question is whether the "correct approval/content validation" and "truthful completion reporting" fixes mentioned in the deferral are currently live or still locked in the parked PRs. If they're locked, they're degrading the running system — worth calling out for prioritized extraction. @plur9, flag if that's the case and I'll open targeted extraction tasks.