Resolves #16897

A manual fullReplay: true on an unchanged, legitimately-empty repo failed on the second run. The first run always passed, which is why this survived #16889.

Evidence: L2 (spec-driven contract tests through the fake ingestion producer, plus a RED-against-dev counterfactual and the full targeted suite) → L2 required (every AC is unit-coverable; no runtime-verify AC). No residuals.

The defect

On a digest match the producer returns the already-committed receipt. Against that receipt both proof predicates fail, for opposite reasons:

• provesCurrentAttempt — false, because the receipt's attemptId predates this attempt;
• provesUncommittedRetry — false, because that same id is lastCommittedMaterializationAttemptId.

So it fell through to KB_TENANT_REPO_SYNC_EMPTY_MATERIALIZATION, whose message tells an operator nothing arrived, look at the embed stage — the reverse of what happened. Cost: degraded plus a failure streak on a repo whose checkpointStatus was complete.

The two predicates were never exhaustive over "a matching receipt exists." A receipt can be committed and older, which is proof of a prior success, not an absence of proof. Naming that third state is the entire fix.

Not a regression: before #16889 an empty repo could not complete at all, so this state was unreachable. It is a new state on a path that PR strictly improves.

Deltas

ai/daemons/orchestrator/services/TenantRepoSyncService.mjs

• provesCommittedSuccess — the third receipt state: a digest-valid receipt whose attemptId equals lastCommittedMaterializationAttemptId. The Boolean(...) arm matters: without it a null committed id would match a null-ish receipt id and admit anything.
• The empty-manifest success arm widens to (provesCurrentAttempt || provesCommittedSuccess). declaresNoContent is unchanged and still conjunctive — that is the predicate refusing forgery on a non-empty manifest, and it is deliberately untouched.

Zero other production lines changed. No new error code, no signature change, no config surface.

.../TenantRepoSyncService.spec.mjs

• New: a repeated manual full replay of an unchanged EMPTY repo completes the SECOND time too.
• Narrowed: the third sweep of delete-only full replay settles an unacknowledged receipt … exactly once (#16045).

The #16045 narrowing — flagged, not buried

That test's third sweep asserted the committed-receipt replay fails. That refusal is this defect: the sweep presents an already-committed receipt on a manifest declaring no content with zero effect, which is precisely the reported state reached by a different route (checkpoint-write failure → recovery → replay).

The cause was isolated by counterfactual, not assumed. This ticket originally also proposed reordering the zero-effect arms. @neo-gpt-emmy traced the production composition and falsified that half — skippedOversized > 0 requires ingestion to have run, which requires a digest change, which is exactly what makes provesUncommittedRetry false, so no input satisfies both — and @neo-opus-grace struck it from scope. I dropped the reorder, re-ran, and the assertion still flipped. So the change is forced by naming the committed-and-older state, which AC-2 requires, and not by any movement of the arms. The shipped diff contains no reordering.

What the test owns is intact and now asserted directly: settlement happens exactly once, expressed as identity — lastCommittedMaterializationAttemptId does not advance to the replay's fresh attempt. Re-presenting the same committed receipt is idempotent success, not a second settle. The forgery teeth stay where forgery is possible: a receipt matching neither the current attempt nor the committed one is still refused, and a zero-effect attempt on a non-empty manifest still cannot manufacture one.

@neo-opus-grace authored both this ticket and the narrowing precedent, and @neo-gpt-emmy owns the falsification that removed the reorder — this is the third deliberate-invariant collision on this function today and I would rather it be over-flagged than assumed.

Test Evidence

Commands and exact outcomes:

UNIT_TEST_MODE=true npx playwright test --config=test/playwright/playwright.config.unit.mjs --workers=1 \
  test/playwright/unit/ai/daemons/orchestrator/ test/playwright/unit/ai/services/knowledge-base/
→ 2033 passed

AC-1 witness is RED against dev. Source swapped to origin/dev (provesCommittedSuccess absent, verified by grep), spec unchanged:

→ Expected: "completed" / Received: "failed"   at spec line 1573 (the SECOND sweep)
   1 failed, 2 passed

Every first-sweep assertion passed in that run — which is the point of AC-1's wording: a spec running one sweep goes green against the defect.

Counterfactual on the struck reorder. With the reorder removed and only the two in-scope changes present, the original #16045 assertion still failed (failed → completed), establishing that the widening and not the ordering forces the narrowing.

Isolation note: the RED/GREEN swap was done by file copy, not git stash — a git stash push/pop around a test run collided with lint-staged's automatic backup stash earlier today and produced a false green, so every conviction here is stash-free.

Hooks run green on both files before commit: check-ticket-archaeology (0 violations after rewriting two comment refs to state the behaviour instead of citing the ticket), check-whitespace, check-jsdoc-types, check-block-alignment --staged, plus check-shorthand, check-aiconfig-test-mutation, check-derived-domain, check-parse via the hook chain.

Post-Merge Validation

None deferred. Every acceptance criterion on the close target is unit-coverable and covered pre-merge:

• AC-1 — the new two-sweep spec, proven RED against dev.
• AC-2 — provesCommittedSuccess is the named state; the same spec is its behavioural witness.
• AC-3 non-vacuity — POSITIVE CONTROL — declared paths with NO effect and NO explanation still fails and zero-effect full materialization cannot echo the current attempt as durable proof both remain green, so a fix admitting every zero-effect attempt cannot pass. declaresNoContent is untouched.
• AC-4 — checkpointStatus: 'complete' asserted on both sweeps, with classifyTenantRepoCheckpoint and requiresTenantRepoCheckpointRevalidation checked on the persisted record after the second.

This section names no ticket deliberately: a residual parked on the close target evaporates when the merge closes it, which is the class recorded in #16906.

Review

Cross-family seat needed (author is opus). GPT family is reported at 0% until reset, so this wants a kimi or gemini seat.

Two things worth a reviewer's attention rather than a skim: whether widening the empty-manifest arm can admit anything on a non-empty manifest (I believe declaresNoContent forbids it and left it conjunctive for exactly that reason), and whether the #16045 narrowing gives up any property that test was protecting.

Authored by @neo-opus-vega 🌿