Integrate all 62 open PRs

[alice-viola]

All 62 open pull requests (#3–#66, minus the closed #7 and #33), merged onto master @ 62610b0 in one branch and verified end-to-end against broker queen 1.5.0 + Postgres 16.

Recipe, evidence and every hand-resolution, on one page: https://claude.ai/code/artifact/11d6114f-7f10-4e11-9ef9-b392f95a0848

What is here

• 146 commits: 61 merges (16 resolved by hand — each read on both sides, none "took ours"), chore: standardize JavaScript runtime on Node 24 #4 fast-forwarded, and 4 commits of my own listed below.
• Every PR head is an ancestor of 39a8d4d. Once this lands, GitHub should mark each of the 62 as merged on its own.
• Order respects every stack, lands fix(declare): keep a stored graph running when a later rule would refuse it #66 before the six rule PRs it exists to make safe (fix(graph): reject physical queue feedback and source aliases #32 fix(validation): require a node-wide breaker budget #34 fix(validation): reject unsupported counter windows #36 fix(payload): reserve Gate routing metadata paths #37 fix(breaker): reject nodes wider than one atomic hold #42 fix: refuse graphs that can exhaust consumer workers #47), and lands the fix(history): calculate utilisation in budget cost units #14/Fix silent history read failures #60 pair last — which turned out orthogonal, not incompatible: fix(history): calculate utilisation in budget cost units #14 adds a cost column to History::flow, Fix silent history read failures #60 wraps it in Result; the reconciled signature carries both.

Verification (on 39a8d4d, broker and Postgres recreated from scratch, as CI's services are)

step	result
npm ci && npm run build	built
cargo clippy --workspace --all-targets -- -D warnings	clean
cargo test --workspace -- --include-ignored, GATE_TEST_REQUIRE_LIVE=1	258 passed, 0 failed, 0 ignored — live suite 57/57 in 435s
cargo +1.88 check --workspace --all-targets (MSRV)	clean
cargo build --release --workspace	built
cargo fmt --all --check	clean

Baseline for comparison: master itself against 1.5.0 is 41/41 live in 348s. The live count grows because the PRs bring their own tests, which ran together for the first time here. Note the CI workflow still pins queen:1.0.5.

Two clean merges that were wrong, fixed on the branch

• dac72ed — fix(console): show live node backlog in graph detail #5 × Stop reporting unknown queue depth as zero #61. Stop reporting unknown queue depth as zero #61 made Depths::pending/pending_of_group return Result and added ? at every caller on its branch; fix(console): show live node backlog in graph detail #5's three per-node backlog reads in api::declare::view were on a branch Stop reporting unknown queue depth as zero #61's stack never contained. Sixty-one PRs merged without a single conflict marker and did not compile. view() already returns queen_mq::Result, so the three reads propagate.
• 63b04bd — a #[test] lost in my fix(budgets): make counter keys collision-free #38 resolution. Git's hunk began one line below the shared attribute; clippy -D warnings caught the bare fn as "never used". Restored.

Three decisions the audit left open, taken

1. 39a8d4d — graph-workers is fatal for a stored document. fix(declare): keep a stored graph running when a later rule would refuse it #66 kept a stored document running for every rule outside its fatal list, including fix: refuse graphs that can exhaust consumer workers #47's worker cap; a plan that would exhaust the replica before it served anything is not a graph kept running and takes every other graph on the replica down with it. Reverses the placement in fix(declare): keep a stored graph running when a later rule would refuse it #66's pinning test — a maintainer's call, stated in the commit.
2. a6353c6 — test.yml runs on every PR base (pull_request.branches: ['**']; push stays master-only). 23 of the 62 PRs had no CI run because their base was another feature branch. chore: standardize JavaScript runtime on Node 24 #4 fixes docker-build.yml's main → master but not this.
3. fix(declare): keep a stored graph running when a later rule would refuse it #66's description corrected (on the PR itself): the fixture "shows the shape at risk" rather than "already trips it" — cargo test -p gate-core on fix(validation): require a node-wide breaker budget #34 passes — while the migration-runs-once argument, which is the real reason for fix(declare): keep a stored graph running when a later rule would refuse it #66, is kept through to its consequence.

Where to look when reviewing

Two resolutions combine intent rather than text and deserve the authors' eyes: #47 × #66 in crates/server/src/graph.rs (validate_plan_with feeding the caller/stored partition — either side alone compiles and silently deletes the other PR's point) and #20 × #36 in crates/server/src/lib.rs (#20's wall-clock alignment with MINUTE_MS derived from gate_core::COUNTERS_WINDOW_SECONDS rather than a fresh literal).

What merging this accepts

Every behaviour change the audit marked nota, at once: #25/#56 route to the DLQ traffic that flows today; #26 no longer pre-creates the egress queue (early subscribers get a 404); #6 cancels sibling stages on a non-retryable error; #38 resets counters whose keys contain : or % once; #59/#60/#61/#63 answer 502 during a store or history outage instead of a stale zero. If any of those needs its own window, the branch can be cut at a phase boundary — everything through phase 5 carries none of them.

Not proven here: multi-replica behaviour and network latency (one machine, one replica), and the two premises the audit could not verify from this repository — #26's configure semantics and #27's kv_apply_v1 atomicity.

🤖 Generated with Claude Code