feat: caller-selected Backend Jobs and bounded subjektiv consolidation (T-704)

docs/report/2026-10-06-t704-validation.md

@@ -0,0 +1,90 @@
+# T-704 implementation and validation ledger
+
+Base: `6f9621ca` (clean detached assigned checkout). Parent created
+`work/t-704-backend-subjektiv-jobs` without replacing a branch or discarding changes.
+Parent owns Backend/Profile/Subject authorization, cutover, documentation and
+integration. Two direct implementation SubWorkers supplied the common durable
+Job/store and Worker/Runtime contracts; parent inspected their committed sessions,
+diffs and test evidence, integrated them and corrected the boundaries below.
+Independent MR review is separate from implementation delegation.
+
+## Implemented contracts
+
+- Caller-selected existing Builtin/project registry Profiles, normal virtual
+  config/prompt bundle resolution and explicit execution-requirement rejection.
+  Chosen instructions/features/model are not replaced with backend-job defaults.
+- Immutable Host-authored Job/attempt create/restore binding and result capability,
+  independent of Profile names/instructions/tags. No inherited Workdir, parent or
+  subject-body execution authority.
+- Common transactional resource serialization (Workspace schema 81), immutable
+  Subject/candidate batch grants, exact replay vs resource collision, unknown
+  fences and all-old-attempt cleanup fences before retry/followup.
+- subjektiv requests its Profile; immutable bounded batches, empty surface-only
+  Jobs, candidate authorization, existing CAS/atomic receipts and dispositions.
+- Synchronous bounded clean-context surface generation before result submission.
+  Preparation reports an already-current snapshot to avoid needless conflicting
+  regeneration. Job failure acknowledgements are `failed_confirmed` only after
+  checking the actual failed marker/reason/revision and generation provenance.
+  Subject feature migration 6 adds immutable generation Job/attempt provenance,
+  without changing Subject/Memory/candidate content.
+- Durable results contain actual candidate dispositions and a separate verified
+  ready/failed surface outcome. Existing terminal cleanup retains results/memory.
+- Removed subject direct spawn and Idle resubmission. Persisted legacy ownership
+  plus actual foreground WorkerState and confirmed stop/removal fence the cutover.
+  Busy legacy workers are not interrupted or duplicated; subject bodies and the
+  independent old Workspace Memory feature are not selected for removal.
+
+## Final validation (bounded `CARGO_BUILD_JOBS=2`)
+
+| Command/boundary | Result |
+| --- | --- |
+| `cargo test -p yoi-workspace-server --lib backend_job` | 33 passed (before final surface acknowledgement addition; final whole-crate run below covers it) |
+| `cargo test -p yoi-workspace-server --lib subjektiv_jobs_tests` | 5 passed, including project recipe, batch/auth/receipts, actual failed acknowledgement, current surface and legacy cutover |
+| `cargo test -p worker --lib memory_surface_lifecycle` | 16 passed, including publication/failure before result, cancellation, definitive correction, ambiguous exact retry and already-current surface |
+| Root `cargo check` | Passed; normal TUI/Server/standalone compile closure |
+| `cargo test -p worker -p worker-runtime -p manifest -p runtime-api -p server-api -- --test-threads=4` | Passed: manifest 185; runtime-api 9; server-api 70; worker 815 lib + 110 integration; runtime 335 lib + 34 binary tests |
+| `cargo test -p yoi-workspace-server -- --test-threads=4` (final) | 637 lib + 11 binary passed, no skips |
+| `cargo test -p server-api --features typescript` | 77 passed, including generated/OpenAPI/TypeScript contract freshness; existing ts-rs serde-attribute warnings |
+| `cargo fmt --all -- --check` / `git diff --check HEAD` | Passed |
+
+These are recording-backend/store and scripted-client fixtures, plus real compiler
+and test binaries. They are **not** real-provider LLM execution, a live Backend /
+Runtime deployment, live dogfood consolidation or an environment update. No live
+Worker/environment was stopped or updated.
+
+## Failed checks and fixes (not erased by later passes)
+
+- During integration, new request fields, resource replay metadata and surface
+  validation arguments initially failed compilation; all were corrected before
+  final validation.
+- Initial Backend tests exposed the narrower browser builtin candidate allowlist;
+  Host launch now resolves the complete existing registry without widening browser
+  choices or adding a purpose-specific Profile allowlist.
+- Initial surface-only test exposed rejection of empty candidate grants; empty
+  batches now retain the subject lock and grant no candidate access (owned store
+  tests 9 + contract tests 9 passed).
+- Legacy fixture initially compared catalog compatibility state rather than
+  actual WorkerState. Cutover now requires the actual Idle snapshot, and the test
+  synchronizes on that authoritative observation before asserting behavior.
+- First full Server run: **635 passed / 2 failed**, both stale migration-history
+  fixtures expecting schema 80. Their explicit retained chain/history is updated
+  to 81; migration filter passed 14 tests and subsequent whole-crate runs passed.
+- Exploratory `cargo check -p worker-runtime --no-default-features` and
+  `--no-default-features --features fs-store` both **failed**, with 16 errors from
+  existing unconditional `workspace_request` / `reqwest` imports while HTTP is
+  disabled (plus unused-import warnings). The source/gates are present in the
+  original baseline and are recorded in the
+  [T-701 ledger](2026-10-06-t701-validation.md#validation-results). No isolated
+  baseline build was performed here. These remain failed exploratory unsupported
+  configurations, not feature passes or a T-704 feature-gating fix. The default
+  Runtime fs-store/ws-server configuration is fully tested.
+- The inherited intermittent Ticket checker failure described in the
+  [T-702 ledger](2026-10-06-t702-stale-checker-validation.md) and T-701 report was
+  not observed in the final T-704 full Server runs, but is **not** claimed fixed.
+
+Raw parent logs are under `target/t704-validation/` (ignored local artifacts),
+including `server-full-initial-migration-fixtures.log`, `server-full-final.log`,
+`changed-crates.log`, `root-check.log`, `worker-surface-final.log`,
+`server-subjektiv-final.log`, `server-api-typescript.log`, `runtime-no-default.log`
+and `runtime-fs-only.log`. The durable report records their concrete results;
+local log paths are not a substitute for the published immutable MR source.