A tombstoned target reports the tombstone before the runtime facet reads any
recovery field, so a target withdrawn while its recovery had failed reported
nothing anywhere. Both retirement transitions clear the failure and LKG
columns but leave recovery_phase and recovery_ref on the row, and no
projection read them back, so the failed recovery was gone from the runtime
status, the rollout status, and the attention queue in one step.
Mint a withdrawal_residue limitation in deriveTarget for a tombstoned row
carrying a failed recovery, on the same condition deriveRuntime reads, so the
caveat and the status cannot disagree about a row. It rides the limitations
array deriveTarget already threads, so it reaches the caveats surface with no
wire change, no new route, and no new broadcast.
Tombstone precedence is unchanged: the runtime status stays tombstoned and the
rollout status never sees the recovery. Only a retirement that carried a
failed recovery is qualified. After any withdrawal Sencho cannot prove the
compose project came down, because the teardown is best effort and swallows
its own error, but qualifying every retirement would train a reader to skip
the block.
Anso
b6b059a3fb