W05 local SQLite restart evidence — 2026-09-18

Scope

This is isolated local evidence for the Dispatcher outbox recovery seam. It is not a broker crash, commit-failure, cross-Cell, or production acceptance.

Mode: mock / local development
Go: go1.27.1 linux/amd64
Test: internal/store/TestOutboxRecoverySurvivesSQLiteReopen

Procedure and result

The test opens a real SQLite file, inserts one dispatching outbox row, closes the store, reopens the same file, and verifies startup recovery changes the row to retry with last_error=recovered_after_restart.

$ go test ./internal/store -run '^TestOutboxRecoverySurvivesSQLiteReopen$' -count=1 -v
go version go1.27.1 linux/amd64
=== RUN   TestOutboxRecoverySurvivesSQLiteReopen
--- PASS: TestOutboxRecoverySurvivesSQLiteReopen (0.01s)
PASS
ok   git.ipao.vip/rogee/go-sip/internal/store 0.016s

Dispatcher claim/restart replay

A second test exercises the Dispatcher path rather than inserting the row manually. It ingests the contract-backed command, claims the pending outbox row (simulated crash after claim), closes the SQLite store, reopens it, and flushes the recovered row through a publisher:

$ go test ./internal/dispatcher -run '^TestOutboxClaimRecoveryPublishesAfterRestart$' -count=1 -v
go version go1.27.1 linux/amd64
=== RUN   TestOutboxClaimRecoveryPublishesAfterRestart
--- PASS: TestOutboxClaimRecoveryPublishesAfterRestart (0.02s)
PASS
ok   git.ipao.vip/rogee/go-sip/internal/dispatcher 0.033s

Process crash injection

TestOutboxProcessCrashRecovery starts the same test binary as a helper, ingests and durably claims an outbox row, exits with a dedicated status before publish, then reopens the SQLite file in the parent process and flushes the recovered row. This covers an actual process-death boundary rather than only a same-process close/reopen simulation:

$ go test -race ./internal/dispatcher -run TestOutboxProcessCrashRecovery -count=1
ok   git.ipao.vip/rogee/go-sip/internal/dispatcher

Limits

This proves persistence across a close/reopen boundary and one deterministic process-crash-after-claim window. It does not prove broker commit ordering, process kill at every W05 crash window, application receipt, approved broker ACL/topology, cross-Cell final permit barriers, or real P1 behavior. Those remain separately blocked or pending in the acceptance matrix.

2.4 KiB Raw Blame History