# v0.105.1: Runtime conformance and recovery qualification

> **Status:** Released
> **Scope:** Large
> **User promise:** *"Supported contracts behave correctly under delegated access, failure, and replay."*
> **Blocked by:** [v0.105.0](v0.105.0.md)
> **Series:** [v0.105.x](v0.105.x.md)
> **Integration profile:** [`pg-mdm` Graph V1 requirements](../pg-mdm-pg-trickle-requirements-2.md)

## Theme

Qualify the runtime behavior behind the frozen Graph V1, Delta V1, DVM, CDC,
and recovery contracts. Add delegated Graph V1 source authorization as a
release-blocking security fix. Use real PostgreSQL execution and the packaged
candidate.

## Work

- Run the Graph V1 and Delta V1 suites through public SQL without private
  catalog or change-buffer access.
- Add a `pg-mdm` Graph V1 admission profile that uses `initialize = false`,
  `orchestration_mode = 'EXTERNAL'`, trigger capture, and `refresh_mode` set to
  `'AUTO'`. Use `full_policy = 'ALLOW'` for the initial baseline.
- Allow a base-table source when the caller has schema `USAGE` and table
  `SELECT` plus `MAINTAIN`. Keep owner-equivalent authority mandatory for graph
  members.
- Return separate stable reason codes for graph-member and graph-source
  authorization failures.
- Prove that contract inspection and strict refresh reject a revoked `SELECT`,
  `MAINTAIN`, or schema `USAGE` grant before member mutation.
- Prove inherited-role revocation, source-owner changes, and relation
  replacement fail closed. Define which row-level security policy dependencies
  Graph V1 tracks, then prove policy and tracked-dependency changes fail closed.
- Run definition-derived SQL as each graph member's current owner with row-level
  security enabled. Test the pg-mdm pattern in which the selected execution
  role owns every member.
- Test hostile `search_path` values and colliding object names. Use only bound
  OIDs and schema-qualified names.
- Document the `pgtrickle` schema and function grants required by a coordinator.
  Include `refresh_graph_strict(regclass[], bytea, text)` in the integration
  documentation's public function list.
- Cover graph rollback, replay, invalidation, slow consumers, schema changes,
  permissions, restore, clone, and upgrade behavior.
- Prove coordinator publication commit, rollback after graph maintenance, and
  retry without skipped or duplicate source changes.
- Interleave source writes with strict refresh. Prove that the returned source
  boundary contains every admitted source, has a 32-byte digest, reports
  `PROVEN`, and leaves changes beyond the boundary for a later refresh.
- Race strict refresh with alter, rebuild, drop, and restore operations. Reject
  stale contracts or serialize the operations before any result can commit.
- Verify stable reason codes for contract mismatch, incomplete source boundary,
  authorization failure, concurrent lifecycle change, and resource failure.
- Run the exact DVM schema and multiset oracle across supported refresh paths.
- Cover inserts, updates, deletes, and no-op refreshes. After the initial
  baseline, assert that qualifying graph shapes report differential or scoped
  maintenance instead of repeated whole-query `FULL` refreshes.
- Run the WAL receipt fault matrix across persistence, acknowledgement, retry,
  restart, and multi-source failure boundaries.
- Verify that `full_policy = 'ERROR'` rejects every whole-query FULL transition.
- Verify that exceptional exits clear graph, consumer, frontier, and
  transaction-local state.
- Fix only release blockers and record each fix in candidate-bound evidence.

## Exit criteria

- [ ] Graph V1 and Delta V1 conformance passes against the packaged candidate.
- [ ] The packaged candidate contains the delegated-source authorization
      behavior introduced by commit `e995812`, whether merged, rebased, or
      squashed.
- [ ] A coordinator that does not own a base-table source can inspect and
      refresh its graph after it receives schema `USAGE` and table `SELECT`
      plus `MAINTAIN`.
- [ ] Revoking any required source grant makes contract inspection and strict
      refresh fail before graph mutation.
- [ ] Delegated authority never applies to graph members.
- [ ] Authorization failures expose stable member or source reason codes in
      protected diagnostic detail.
- [ ] The `pg-mdm` execution-role pattern retains the member owner's row-level
      security view. Arbitrary session claims remain coordinator-owned inputs.
- [ ] Recovery tests account for committed changes after failures and retries.
- [ ] A failed coordinator transaction rolls back graph rows, source positions,
      refresh evidence, and coordinator-owned publication rows together.
- [ ] Concurrent writers on both sides of the source boundary produce no lost
      or duplicate changes.
- [ ] Contract-changing lifecycle operations either serialize with refresh or
      cause a stable pre-commit rejection.
- [ ] Graph V1 errors distinguish contract, boundary, authorization, lifecycle,
      and resource failures with stable reason codes.
- [ ] Exact result, schema, multiplicity, and effective-strategy checks pass.
- [ ] Qualifying steady-state `pg-mdm` graph shapes do not hide repeated FULL
      refreshes behind `AUTO`.
- [ ] No supported path silently bypasses its declared refresh policy.
- [ ] Ownership, permissions, rollback, restore, clone, and upgrade checks
      pass for the frozen contracts.
- [ ] No 72-hour soak or longevity run is required by this release.

## Scope control

Do not widen SQL admission or add public APIs. Preserve the correctness-
preserving FULL fallback when the differential path lacks proof.

Keep Graph V1 at version 1.0. Do not add caller ACLs, role memberships, or
session settings to the canonical digest. Recheck live authorization instead.
Because `initialize = false` requires initial population, conformance uses
`full_policy = 'ALLOW'` for the first strict refresh.

A downstream consumer may adopt a released v0.105.1 PostgreSQL 18 package after
its own checksummed-artifact admission passes. The broader v0.105.2 package and
field qualification is not a prerequisite for that adoption.