126 · T111 — the submission projection and audit surface

[athvin]

Ticket: T111 — docs/implementation/126-T111-submission-projection-and-audit.md

Summary

Projects T108's attempt-submitted records into the run index and ships the audit
surface over them. fold_stream surfaces submissions on the RunArtifact — including
submissions that never produced an outcome — while staying a deterministic reader with
no store, network, or graph access. An additive attempt_submitted table (plus a child
attempt_submitted_input carrying positional order) lands through the existing
migration mechanism with no foreign keys, produced through the same build_statements
path so live-tee and sync rows are byte-identical. Four worked audit queries ship in
the cookbook; no new CLI verb.

Tests-first

Confirmed — failing tests committed first in 555e246.

Definition of done

• fold_stream surfaces attempt-submitted records on the RunArtifact, including submissions with no outcome; the fold stays a deterministic reader with no store, network, or graph access.
• An additive attempt_submitted table and its indexes land through the existing migration mechanism, with no foreign keys; an existing store upgrades in place and converges with a fresh one.
• Rows are produced through the same build_statements path; live-tee and sync rows are byte-identical and sync is idempotent.
• Positional input order is preserved and queryable; a consume-nothing source records zero inputs, distinguishable from unknown.
• Intended and observed target identity are separate columns; submitted-but-never-completed is a queryable state (completed=0 + NULL outcome_state, rather than a tenth state token).
• Cookbook ships worked audit queries for: launch parameters of a given attempt, submitted-never-completed attempts, submitted-vs-read divergence, and the join to existing lineage tables.
• The metastore still has no edge onto dagr-core; the feature stays default-off; a toggle-off run is unchanged; the acceptance-boundary script passes.
• Tests pass on ubuntu-latest and macos-latest — pending, confirmed by this PR's CI.
• CI is green on the ticket branch — pending. The local gate is GATE=PASS (36 PASS, 1 deliberate SKIP, 0 FAIL), verified on the committed tree, but CI on the PR is the authoritative verdict.

Open questions resolved

Both ticket questions plus two in-PR decisions are recorded in the ticket's
## Open questions section (docs/tasks.md enumerates M0–M4 only and carries no T111
entry):

1. Child table vs encoded column for inputs → a child attempt_submitted_input
   table with a position column. Decided against the shipped queries: two of the
   four filter on an individual reference, which an encoded column would make
   unqueryable.
2. Divergence query: SQL or a verb → SQL in the cookbook, a single join, no verb
   added.
3. Submissions on the RunArtifact type but NOT in to_value() — which preserves
   T108's merged byte-identical-artifact assertion.
4. Submitted-but-never-completed as completed=0 + NULL outcome_state, rather
   than introducing a tenth state token into the terminal taxonomy.

Deviations

None.

Notes

Two correctness decisions worth calling out, both about not letting the audit surface
overstate what happened:

• The fold surfaces submissions from the records themselves, not from the assembled
  attempt list. The assembled list synthesizes coverage rows at try 1, so folding from
  it would have claimed an outcome for attempts that never produced one.
• A submitted input deliberately produces no asset row. Submission is intent, and
  an attempt that never ran consumed nothing.

The four cookbook queries live inside the existing "Querying run state across DAGs" H2,
so metastore_example_and_docs.rs executes them verbatim against a real store (3
passed, 123s) and metastore_docs_claims.rs guards that the surrounding prose stays
true (6 passed).

Boundaries hold: the run index remains a projection, never authoritative for
execution — nothing in the engine reads it back to make a decision. The feature stays
default-off, the metastore keeps no edge onto dagr-core, and no scripts/check-*.sh
was modified — including check-metastore-acceptance-boundary.sh, which passes
unchanged.