# Supplied-evidence checkpoint ownership

- Optimization ID: `supplied-evidence-checkpoint-ownership-2026-07-31`
- Owner: auto-oncall TCID hotfix
- Source: TCID-12973 supplied-evidence diagnostic replay
- Status: `optimized_verified`

## Bounded problem

In a supplied-evidence scenario, checkpoint creation and validation could be
delegated to the read-only diagnostic child. The child could not satisfy that
write-side contract, while the top-level coordinator did not strictly own both
the canonical checkpoint and final packet admission. A bounded child execution
failure could therefore discard otherwise usable supplied evidence.

## Implemented change

The top-level coordinator now owns initial and update checkpoint validation,
the canonical `scenario-progress.json`, and final packet admission. The single
diagnostic child remains read-only and returns evidence only. The runner fails
closed when the coordinator-owned checkpoint is missing, invalid, or does not
match the admitted packet.

## Current evidence and boundary

Staging replay `a4ec77c5-7b93-4511-8e86-2a178e2021c2` for TCID-12973 verified
the ownership boundary. Parent thread
`019fb705-21a5-75f1-b3c1-c8bf590d296c` wrote and validated both canonical
checkpoints and emitted the final packet. Read-only child thread
`019fb706-5b7c-7410-b6ef-2c34594d86b9` performed only local reads, including
the supplied image, and made no file change or validator call.

## Unresolved gaps and next validation

Keep the parent-only checkpoint and validator assertions as regression
controls. The separate image-to-typed-boundary gap found by this replay is
tracked in its own optimization record and does not change this verified
ownership result.

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "supplied-evidence-checkpoint-ownership-2026-07-31",
  "problems": [
    {
      "problemId": "supplied-evidence-checkpoint-owned-by-read-only-child",
      "summary": "A supplied-evidence scenario could delegate checkpoint creation or validation to a read-only child and discard usable evidence as a bounded diagnostic failure.",
      "status": "optimized_verified",
      "issueKeys": [
        "TCID-12973"
      ],
      "sourceRefs": [
        "https://tidb.atlassian.net/browse/TCID-12973#problem:supplied-evidence-checkpoint-ownership"
      ],
      "signalTextIncludesAny": [
        "read-only child cannot write scenario-progress.json",
        "checkpoint ownership delegated to child",
        "diagnostic_scenario_progress_missing_or_invalid",
        "supplied-evidence scenario bounded failure"
      ],
      "observedThrough": "2026-07-31",
      "effectiveAt": "2026-07-31T07:13:03.518Z",
      "verifiedAt": "2026-07-31T07:16:58.481Z",
      "attemptedAction": "Move checkpoint creation, checkpoint validation, and final packet admission to the top-level coordinator while keeping the diagnostic child read-only; fail closed on missing, invalid, or mismatched coordinator state.",
      "evidenceUrl": "https://tidb.atlassian.net/browse/TCID-12973"
    }
  ]
}
-->