feat(composition): restart safety, operations, telemetry, and simulator composition (A04)

[kapustazh]

Problem and resulting behavior

A04 makes the settlement control plane restart-safe and operationally composable. The backend now also has a real executable API process: it migrates PostgreSQL before listening, serves the durable intent API, and closes HTTP plus the database pool on shutdown.

The production hosting target is Cloud Run with Cloud SQL for PostgreSQL. Local and CI runs use DATABASE_URL; Cloud Run can use INSTANCE_CONNECTION_NAME or an explicit Unix socket with credentials supplied through environment/Secret Manager.

What changed

• Recover orphaned SUBMITTING work into UNKNOWN without granting another settlement attempt.
• Preserve status and reconciliation reads while the audited submission-disable switch is active.
• Add redacted telemetry, operational metrics, alerts, simulator composition, and P4 replacement guidance.
• Add the executable Fastify entry point, strict runtime configuration, migration-before-listen, graceful shutdown, .env.example, and server deployment documentation.
• Keep standalone Arc, Privy, and settlement-testkit npm toolchains isolated from the Coder A pnpm workspace while checking all three in a dedicated CI job.
• Revalidate OpenAPI/recovery semantics and publish the versioned mock server at P4; A05/B05/C05 remain blocked until then.

Validation

• Root lint, typecheck, build, generated-contract check, fixture validation, format, and Markdown lint pass.
• Root unit suite: 93 tests pass.
• PostgreSQL/Testcontainers API and worker integration suite passes in GitHub CI, including executable-server readiness.
• Standalone package checks pass: Arc 102 tests, Privy 24 tests, settlement testkit 10 tests, plus each package's lint/typecheck/build.
• Required GitHub checks pass: repository policy, Markdown/Mermaid, ESLint/TypeScript/PostgreSQL, Arc/Privy packages.
• External Cloudflare Workers build is non-required and out of scope; the project has no Cloudflare site and this runtime targets Cloud Run/Cloud SQL.

Review evidence

• Gate A: PASS — Antigravity, gemini-3.8-flash-medium, candidate tree e9a1494c75fc90764d8d355b6c36aa4c7ffa2b43.
• Gate B: PASS — Antigravity, gemini-3.8-flash-medium, exact head 2144026acfe9f32341fa3c211b4f09e342e61d5d, ready for human review.

Human merge remains required.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	oneshot	2144026	Sep 07 2026, 07:33 PM