ADR 003 post-cutover follow-ups: delivery robustness and projection consistency

[HCHogan]

Tracking issue for the defects found in the post-cutover review (agents + manual verification, 2026-08-04). The legacy emote/card projection pollution was already repaired in production and is documented in docs/runbooks/adr003-cutover.md; everything below is a runtime fix deployable at normal cadence.

Ordered by priority:

• 1. Retry attempt budget (ADR §7's one unimplemented promise). Deliveries that fail deterministically (QQ risk-control retcode≠0, reactions on deleted targets) retry forever as failed/AttemptRetryable and block the per-endpoint ordered lane behind them — retryDelay caps the interval at 300s but nothing caps attempts (src/Max/Platform/Delivery.hs retry paths, claim ordering predicate in src/Max/Platform/Store.hs). Convert over-budget attempts to suppressed (content) or outcome_unknown (undecidable) so the lane releases.
• 2. LISTEN/NOTIFY listener can starve the pool into a deadlock. claimOrWait/waitForTimeline hold a listener connection and then request a second one for the recheck; with dispatch + delivery workers + a handful of admin timeline long-polls, all pool connections become listeners and every recheck blocks on acquiring a connection with no timeout (src/Max/DB/Notify.hs). Bound admin long-poll concurrency, or run the recheck on the pinned listener connection.
• 3. Blob read failure poisons the whole message. loadDeliveryMedia treats an unreadable blob the same as an over-limit one: error → DeliveryPermanentlyFailed, taking the message's text down with it (src/Max/Platform/Delivery.hs). A missing/unreadable blob is semantically sourceless — ADR §2 says it must fold to the text tier with a lower note; only genuine size-limit violations should stay permanent failures.
• 4. insertCanonical and verify disagree on the rendered_text source. Ingest renders from the unenriched 'Ingest body while maintenance verify/reproject recompute from the enriched canonical body + identity map, so verify false-positives (and dies) on post-cutover rows whose mention display got enriched. Render from the resolved body in insertCanonical (src/Max/Platform/Store.hs). Until fixed, do not run max-adr003-maintenance verify against the live database.
• 5. Re-stamp compartment source_hash. Migration 062 changed both the hash function and its input set (055 rewrote content, 059 added event_kind, 060 changed occurred_at), so every stored conversation_compartments.source_hash is stale: admin integrity checks report all historical compartments as bad_source_ranges and episode expansion flags spurious source mismatches. One offline UPDATE … SET source_hash = conversation_source_hash(…) re-stamp.
• 6. wechatpad deliveries never confirm. Self-message echoes are filtered before ingest (src/Max/Wechatpad.hs) so the content-match echo fallback never sees them, and listUnconfirmedDeliveries is only consumed by iMessage — every WeChat delivery parks at accepted_unconfirmed forever and the admin counter grows monotonically. The synthetic native id ("sent:" <> chat <> ":" <> take 32 body) also collides for repeated identical texts, which nativeEventAlreadyOwned then discards. Needs a real confirmation loop (or an honest terminal state) and a collision-free receipt id.
• 7. QQ multi-image resend regressed. [image#id] referencing a multi-image message emits all stored images (messageImageNodes, src/Max/ReplySend.hs) but QQ's maxNativeMedia = 1 folds every image after the first into bare [图片] text with no attachable URL for blob refs. Either raise QQ's media budget (it can send several images per message) or split lowered media across chunks.

Lower priority, recorded from the same review:

• Permanent failures and deliberate suppressions share status='suppressed', so poisoned messages are indistinguishable from quiet no-ops in /api/platforms/status monitoring without grepping last_error.
• Matrix/iMessage blob-backed inbound media never reaches the vision pipeline (enqueueCanonicalMedia only picks remote URLs), so models see bare [image] for non-QQ media even though the bytes are already in BlobStore.
• ensureConfiguredEndpoint resets endpoint_mode/caps on every boot, so a hand-promoted mirror reverts to standalone; no supported configuration lets a wechatpad room join a mirror conversation despite the code path existing.
• Non-QQ conversations advertise the [@#<QQ号>] mention syntax and accept hallucinated numeric ids when no roster exists, minting fake principal identities on the destination account (src/Max/ReplySend.hs known-check, prompt advertisement in src/Max/Prompt/System.hs).
• max_native_media > 1 on Matrix/iMessage endpoints permanently fails any multi-media chunk (ContractFailure): chunking never splits media, so the declared budget is unusable above 1.
• Historical @全体成员 mentions were lifted as literal text; MentionAll semantics exist in the IR but the (now-squashed) backfill never produced them — only worth revisiting if mention-all lowering ever matters.
• deliverContent's state machine (media fallback re-lower, empty-chunks suppression, toCompletion mapping) and the oneBot sendChunks failure matrix have no test coverage; same for the wechatpad outbound lifecycle.

Full analysis: the two review reports in the 2026-08-04 session; production repair record in docs/runbooks/adr003-cutover.md.

[HCHogan]

All seven priority items shipped in v0.14.1 (0a07c2a). The
lower-priority list is untouched except where noted below.

#	commit	notes
1. retry budget	b024134	Split along the axis production actually has: a rejection by a reachable edge (risk control, a reaction on a deleted target) is budgeted and ends as suppressed after 16 attempts; an unreachable edge is deliberately unbounded. Delivery 72552 spent 159 attempts across an eleven-hour QQ outage and then landed — it is the only row in the ledger that ever exceeded the budget, and dropping that backlog would have been the wrong fix. New AttemptRejected makes the transport say which it saw.
2. LISTEN/NOTIFY deadlock	b024134	Both waiters run their recheck on the pinned listener connection, reusing Max.DB.Transaction.withPinnedConnection. Each waiter now holds exactly one pooled connection instead of holding one and blocking, untimed, on a second.
3. blob poison pill	b024134	An unreadable blob is sourceless, not oversized: it folds to the text tier with a media_source lower note and the message's text still goes out. Only genuine size-integrity violations stay permanent failures.
4. projection disagreement	b024134	All three writers render rendered_text from the resolved canonical body; delivery and the gate now agree on identity resolution by construction. Also fixed the gate's required-migrations check, which still demanded the pre-squash filenames reconcileSquash had already collapsed — verify was failing on every database, including the one it exists to protect. It is safe against the live database again.
5. compartment source hashes	b024134	Migration 065, applied automatically at boot. Production before the fix: 161 of 186 compartments stale, and the split fell exactly on the cutover — every stale row created before migration 062, every correct one after. The re-stamp therefore touches only hashes the old function computed.
6. wechatpad confirmation	b024134	The colliding synthetic sent: receipt is gone; pbCall now honestly reports no message_id. Self echoes enter ingest as reconcile-only evidence (new IngestOptions.reconcileEchoOnly): a match confirms the delivery with WeChat's real native id, no match stores nothing rather than minting a second copy of the bot's own line. Known limitation: a mirrored copy carries an attribution prefix the canonical body does not, so mirror-mode WeChat endpoints still will not confirm.
7. QQ multi-image	b024134	max_native_media = 9. The OneBot emitter already encoded several image segments; only the budget was stopping it. Endpoint capabilities refresh at boot, so no migration.

Also fixed, found while working on the above

• @-mentioning the bot had never worked on Matrix or iMessage (2b7b12e).
  dispatchMentionsSelf compared the mention's resolved native id against
  show selfId — the compatibility bigint — and those coincide on exactly one
  platform, because QQ's compatibility id is its QQ号 passed through. Every @
  on Matrix resolved to "not addressed" and fell through to the intent gate.
  Replying to the bot was never affected. Mention stripping had the same defect
  and is now structural rather than string replacement.
• Matrix mentions reached the prompt as
  [@@max:server](https://matrix.to/#/@max:server) (2b7b12e) — a markdown
  pill whose label alone was consumed, plus an @ doubled onto an mxid that
  already had one.
• Matrix speakers were named by mxid (2b7b12e). The adapter never asked
  for m.room.member; it now seeds the roster from /joined_members and
  tracks renames, while keeping member events out of the ledger.
• The transcript stops naming platforms at all (2b7b12e). Matrix · alice
  vs a bare QQ nickname made one platform the implicit home, and worse, split
  one principal into two speakers.

Still open from the lower-priority list

Unchanged, except:

• "Non-QQ conversations advertise [@#<QQ号>] and accept hallucinated numeric
  ids" is superseded by ADR 004 (1e03189), which moves the model's mention
  vocabulary to [@#<principal_id>]. A hallucinated principal id simply fails
  to resolve, so the roster membership check that guards this today disappears
  with the conversion.
• "deliverContent's state machine has no test coverage" is partially
  addressed: toCompletion's mapping including the outage exemption, the blob
  fallback, QQ multi-image lowering, ordered-lane release on suppression, and
  the reconcile-only echo lifecycle all have tests now. The media-fallback
  re-lower, empty-chunks suppression, and the oneBot sendChunks failure
  matrix still do not.

Operational notes for the next deploy

• Migration 065 runs at boot and re-stamps 161 compartment hashes.
• QQ endpoints pick up max_native_media = 9 at boot.
• Behaviour change: @max starts triggering on Matrix and iMessage, so
  previously silent mentions become live.