Initial public ModelForge release

2026-09-01 21:30:16 +02:00
commit 7082ab955a
490 changed files with 104252 additions and 0 deletions
@@ -0,0 +1,24 @@
+# Migration recovery
+
+Batch checkpoints and generations make preflight/backfill/validation/shadow restart-safe. Matching
+complete batches are skipped; incomplete attempts resume from the durable cursor. Old workers cannot
+write into a new generation.
+
+Cutover stages are persisted before external work. Startup reports non-terminal cutover journals but
+does not guess external truth. A registered adapter/operator inspection submits the observed target,
+fingerprint and health to reconciliation. Exact healthy target commits, exact healthy source records
+rollback, and ambiguous truth becomes `MANUAL_INTERVENTION_REQUIRED`. Orphan shadows are retained
+and surfaced for later explicit cleanup; never auto-deleted.
+
+
+## M16 reconciliation semantics
+
+Migration is the one subsystem that deliberately does not resolve itself after an interruption.
+External alias truth cannot be inferred from a crash, so an interrupted cutover stays in its
+intermediate stage, is reported as requiring reconciliation, and waits for an operator working
+through the typed adapter.
+
+That is the difference from lifecycle, which resolves: an incomplete lifecycle operation rolls back
+from its immutable snapshot exactly once, and a second control-plane start changes nothing.
+
+See ADR-0045 for the resolve / report / fail-closed contract each subsystem declares.