Description
Durable Objects lack errors, wall-time and response-size percentiles and a script dimension; D1 lacks rows read/written (the billing driver) and batch-time percentiles; Queues lack message lag and retry count (the main queue health signals) and billable-operation breakdowns.
Acceptance Criteria
- #1 DO errors and wall-time/response-size percentiles are exported with a script attribute
- #2 D1 rows read and written and query batch time/response size percentiles are exported
- #3 Queue lag time and retry count gauges and billable operations by action, consumer type and outcome are exported
- #4 A new dataset or endpoint has a live-verified entry in doc-0003 and an API drift canary probe
- #5 Every new signal and attribute is declared in internal/semconv, listed in docs/signals.md, and has a panel in grafana/build_dashboard.py
Definition of Done
- #1 just check (fmt-check, lint, vet, test, tidy-check, build, vuln)
- #2 just ci before a change that touches the Dockerfile, goreleaser or the image (adds snapshot + image)
- #3 Every new signal or attribute name declared in internal/semconv and listed in docs/signals.md
Implementation Notes
A9v2 DO/D1/Queue contract additions landed in seam 9705290 with full gate, independent review, integrated live canary, ordinary CI and doc-0003 section 15. ReadMessage filter value is positively verified by a live row carrying exactly ReadMessage, with an empty invented-action control. I1 registered local HTTP proof passed three domains; full gate stopped on five capitalized error-string lint findings. Bounded I2 repair is commissioned. AC1-3 remain unchecked until reviewed, gated candidate landing; dashboard/live AC5 remains unshipped beyond the final release boundary.
Fresh independent review rejected candidate 7e69463 on two fail-closed gaps: selected additive counts could silently omit null/missing/negative values and accept fractions, and raw null depth datasets could normalize to empty while old outputs and checkpoint advanced. Root commissioned RR1 in owned domain files: separate strict selected unsigned-integral count validation from optional N/A statistics, and use the existing raw batch boundary without changing shared query semantics. Registered real-HTTP malformed-count and null-versus-empty controls must fail before emission/checkpoint, then pass after repair. True zero, unentitled omissions and empty inapplicable Queue consumer values remain valid; the existing leaf-bucket validation remains required.
Fresh independent review rejected candidate 531aec3 despite passing local gates and CodeRabbit minor severity. Deterministic combined name-sort/cap truncation let new points displace old DO requests, D1 read/write queries and Queue aggregate operations; DO is affected even at the default 500-series cap with 500 script error series. Root treats this as a blocking preservation regression under A9, not an out-of-scope cap-policy exemption. RR2 is commissioned inside the three owned collectors: retain legacy points in their previous deterministic cap order, then admit depth points only into remaining capacity without exceeding the same total cap. Existing cap tests checked length and returned early; new real Register/HTTP assertions must pin old metric identities/values and fail on 531aec3 before the fix. RR1 raw dataset/count-validation repairs remain required and are not weakened.
RR2 candidate 6b5326c received fresh independent PASS. All legacy cap helpers exactly match pre-extension selection and apply first; new points fill only remaining capacity without increasing the total cap. Nine real HTTP legacy identity/value assertions failed on 531aec3 and passed after repair, including default DO cap 500 and D1/Queue cap 2. Raw null datasets and malformed selected additive counts fail before emission; optional N/A statistics remain omitted and genuine zero/empty values remain valid. Root integration e82fc61 passed exact-SHA full gate and net/newly-reachable-history privacy scans and was pushed. Exact-SHA CI watcher is pending, not claimed green. AC1-3 source behavior is locally proven and landed; AC5 dashboard/live remains unshipped beyond this loop release boundary. Lifetime churn and float64 rounding after exact uint64 source validation remain residuals, not solved by a per-window cap.
Loop16 RECON-M1 checked source criteria 5 against landed tests at ced4edfbfb66f1b9ee45037bdb425b69820a8ebe. Evidence: codex/evidence-loop16/RECON-return.txt. No new live or browser observation is claimed.
Final Summary
Loop16 reconciled all acceptance criteria on the landed source and cited test evidence.