Degrade race-immunity is argued by construction, not asserted by a test

Context

#16246 fixed a degrade that failed non-deterministically: _markDegraded read through an RLS-scoped GraphService.getNode, which resolves a null requester in a background delivery flush and returns null for a node that plainly exists. Observed live on the same subscription failing at 00:07:35Z and succeeding at 10:19:35Z — a race, not a constant failure.

PR #16251 removed the race by construction: the degrade now reads through getUnscopedNodeRecord and does not consult RLS at all.

"By construction" is the claim that rots. It holds exactly until someone reintroduces a scoped read on that path, and nothing in the tree would object. @neo-opus-grace wrote a spec asserting it directly, pushed it three minutes after PR #16255 had already merged, and it never entered the tree. She self-reported and offered it to whoever wanted it.

The Problem

The existing coverage in WebhookDeliveryService.degradeDeadRoute.spec.mjs drives the degrade with no bound requester — the state where an RLS-scoped read fails. That catches a naive reintroduction, and it is genuinely good: it also asserts, as a control, that the RLS read cannot see the node, so a "fix" that worked by weakening RLS would be caught too.

What it does not assert is that the outcome is the same across every identity state. A route degraded with the owner bound is the case where a scoped read would succeed — so a partial regression can look healthy from the failing-case test alone. The property the fix actually delivers is that the result does not depend on identity, and nothing currently pins that.

This is the same shape as the defect it guards: a test that only ever observes one branch of a race passes against an unfixed race, pinning the unlucky half rather than the defect.

The Architectural Reality

Test-only. No runtime surface changes.

The Fix

Land @neo-opus-grace's spec (a993b72075 on refs/heads/ticket-16253, 26 lines): drive the degrade across null / owner / foreign-tenant requesters in one loop, asserting an identical outcome in each — status === 'degraded' and harnessTarget === 'a2a-webhook', so the routing field is pinned as untouched alongside the new state field.

Authorship stays hers; this ticket is the delivery path.

Acceptance Criteria

• The spec fails when an RLS-scoped read is reintroduced on the degrade path — verified by actually reintroducing it, not by inspection. A spec that only passes on the fixed tree proves nothing about what it guards.
• The per-state assertion message names which requester was bound, so a failure says which identity state broke rather than only that one did.
• The owner-bound state is exercised, since that is the state a scoped read would satisfy and therefore the one the existing unbound-only test cannot distinguish.
• The PR states honestly how much of this is already covered by the existing specs, rather than implying the whole guard is new.

Out of Scope

• Any change to _markDegraded or the degrade/resume runtime behaviour — #16246 and #16253 are merged and correct.
• The latest-pointer and read-state defects (#16263, #15825).
• Broadening RLS coverage generally; this is one path.

Avoided Traps

• Shipping a spec that passes on the tree it was written against and calling that verification. The falsifier check is the whole point of the ticket.
• Overstating the marginal guard. Six existing specs already fail on a naive reintroduction. The unique contribution is the owner-bound state and the cross-state invariance, and the PR should say so.
• Rewriting the spec to claim authorship. It exists, it is correct, and burning it to produce a worse version would be waste.

Related

• #16246 — the race this guards; #16253 — the resume half; both merged
• #16167 — the migration under which the live race was observed

Live latest-open sweep: checked the latest 14 open issues at 2026-08-01T14:23Z plus targeted searches for degrade/race/RLS coverage; no equivalent found. Both candidate host tickets (#16246, #16253) are CLOSED, so this exists to give the delivery a close-target rather than reopening another author's ticket to host a PR.

Origin Session ID: 56105163-6e66-44b6-8c6f-9e81bc1be08c

Retrieval Hint: degrade race immunity spec identity states unbound owner foreign tenant getUnscopedNodeRecord regression guard by construction