feat(etl): replace cancellation on repaired conditional-status stack

[seonghobae]

Stack repair purpose

This Draft replaces old-stack PR #133 with a non-destructive cancellation branch rooted at repaired conditional-status predecessor PR #146. The original #133 branch and its fail-first history remain preserved. Checks, reviews, approvals, statuses, comments, and base snapshots from #133 or any predecessor head do not transfer.

Exact current boundary

• immediate predecessor PR: feat(etl): replace conditional status on repaired polling stack #146;
• base branch: repair/durable-job-conditional-status-2e388ad;
• exact live predecessor/base tip: 9e4d69e0bb33ab57627c697a5d028b5309eca2bb;
• branch: repair/durable-job-cancellation-9e4d69e;
• exact current head: 0a07ca3ba447ba696da2777d7d51eca373b38b2c;
• exact ancestry: 31 commits ahead, zero behind, merge base exactly 9e4d69e0bb33ab57627c697a5d028b5309eca2bb;
• GitHub mergeability: true;
• Draft: true.

No force push, -X ours, -X theirs, destructive history rewrite, temporary repair workflow, protection bypass, or cross-repository write was used.

Stack-divergence replacement RCA

Old PR #133 targets superseded old conditional-status PR #131. PR #146 is the repaired conditional-status boundary, so continuing #133 would preserve obsolete ancestry. The feasible repair was a replacement branch from exact #146 with auditable TDD history. Destructive rebase/force-push, retargeting an unchanged obsolete head, and deepening replay before cancellation repair are rejected.

Cancellation boundary

The repaired slice provides authenticated owner-scoped idempotent cancellation, a database-owned CANCELLED terminal state, one owner-matched conditional transition, payload/lease clearing, stale-worker fencing, principal/job-domain-separated replay identity, stable RFC 9457 conflicts, conditional-status invalidation, transactional V6 migration, concurrency/race coverage, rollout/rollback guidance, and explicit limits for non-transactional external side effects.

RED → RCA → GREEN

The branch preserves the original fail-first cancellation history. A later exact-head CI failure on dc53a3a7de2ab1ad59421c183db000b1bdf22426 isolated one documentation-contract mismatch: DurableJobCancellationDocumentationTest required the exact buyer-visible phrase Owner-scoped durable-job cancellation, while CHANGELOG.md had drifted to Authenticated owner-scoped durable-job cancellation. Production cancellation, migration, concurrency, controller, and service tests were otherwise green.

Immediate cause: exact changelog/test phrase mismatch. Technical cause: the prior repair used file/blob-level Contents API compare-and-swap while another writer changed the test contract, so branch-tip state was not atomically bound. Systemic cause: the repository writer lease is branch-wide but the mutation primitive used in that attempt was file-wide.

Material remediation options:

• execute_now: restore only the expected changelog phrase on the exact current parent and publish through Git Data tree/commit plus a non-forced ref update, making publication fail if the branch advances concurrently;
• reject: weaken the test to accept alternate/case-insensitive text, because that hides documentation drift;
• reject: edit both test and changelog, because the current test correctly expresses the established contract and broadens scope unnecessarily.

Commit 0a07ca3ba447ba696da2777d7d51eca373b38b2c is one non-forced fast-forward commit over dc53a3a...; its delta is exactly one CHANGELOG.md line. The branch-wide publication path used exact parent binding and force=false ref update rather than the Contents API for this source repair.

Exact-current-head proof

Accepted for literal head 0a07ca3ba447ba696da2777d7d51eca373b38b2c on unchanged exact predecessor 9e4d69e0bb33ab57627c697a5d028b5309eca2bb:

• CI 31302915344: success;
• Ubuntu, macOS, and Windows jobs each checked out and verified the literal current head and completed their applicable full Maven tests successfully;
• etl-service: 429 tests, zero failures/errors/skips; DurableJobCancellationDocumentationTest 4/4 green; all configured JaCoCo coverage checks met;
• cdc-service: 106 tests, zero failures/errors/skips;
• gateway: 3 tests, zero failures/errors/skips;
• Dependency Review 31302915311: success;
• CycloneDX SBOM 31302915319: success;
• CodeRabbit exact-head commit status: success;
• unresolved review threads: zero;
• formal reviews: zero;
• GitHub mergeability: true.

The conditional self-hosted job is skipped and is not counted as positive evidence.

Still not passing

• SAST Semgrep and Security Scan are absent on this non-default stacked base and are not inferred from any predecessor or protected-branch run;
• no qualifying independent non-author formal APPROVED review exists on this exact head;
• the repaired chain still depends on ci: schedule NVIDIA OpenCode maintenance agent #121, whose hard literal-head scanner and autonomous-review control-plane prerequisites remain read-only dependencies owned outside this repository writer lease.

Queued, pending, skipped-required, neutral-required, absent, cancelled, failed, stale-head, old-base, predecessor-head, author-only, status-only, and synthetic-merge-only evidence are not accepted.

Merge policy

Keep this PR Draft. Do not merge or deepen replay until the prerequisite chain is eligible. After every predecessor/base/head movement, regenerate affected exact-head/base CI, Dependency Review, SBOM, SAST, Security Scan, commit-status, review-thread, automated-review, and independent-approval evidence. Merge only in dependency order with expected-head semantics and without weakening branch protection, tests, security, coverage, review independence, or writer leases.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 33846c22-4cec-479c-9dbd-e4d6fd54eadc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by refreshed cancellation replacement #254 after preservation verification against the current stack boundary. Fresh state immediately before this disposition: this old Draft is unchanged at 0a07ca3ba447ba696da2777d7d51eca373b38b2c; current predecessor #146 has advanced to 37cd3b40f5850ab7bdd043660d9b0705587da53b; #254 is rooted exactly on that refreshed predecessor and is currently 6ea6a7c16d78f2e0488bde40300d132d6c3e3c05. The old 21-path cancellation surface is preserved in #254: changed-path comparison shows the same cancellation production/controller/migration/docs/test paths, while #254 adds the dedicated EtlJobCancellationKeyDomainIntegrationTest; representative preservation checks show byte-identical cancellation doctoring, operations runbook, plan, design, EtlJobCancellation record, and V6 migration, and patch-identical cancellation deltas for EtlJobController and EtlJobService (aside from harmless EOF-newline/base-context differences in rebuilt files). The rebuilt documentation contract is semantically identical and additionally remains aligned to the refreshed ancestry. No check, review, approval, status, or synthetic-merge evidence from this obsolete head transfers to #254. Keep #254 as the only active cancellation integration line; this PR must not be merged separately.