fix(native-runner): materialize phase 6 live effects

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/paperclip-runner/docs/design/phase-6-thin-paperclip-adapter.md

@@ -1,6 +1,6 @@
 # Phase 6 Thin Paperclip Adapter Boundary
 
-Status: design approved; implementation remediated; CTO conformance re-review pending
+Status: design approved; remediation 4 implemented; CTO conformance re-review pending
 Date: 2026-08-09
 Decision scope: the first feature-flagged Paperclip native run, including the
 normative native finalizer and server-owned Section 18 status arbitration
@@ -797,6 +797,32 @@ that consumer did not execute or returned different semantics. No hand-written
 test policy table supplies observed outcomes and no row is satisfied by a
 coverage-label join to a generic observation.
 
+### Remediation 4 live-consumer and effect-materialization amendment (2026-08-09)
+
+The fixture-keyed scenario arbiter is removed. Finalization now calls the same
+fact-based arbiter as the heartbeat finalizer, while attention, cancellation,
+reconciliation, compatibility, and migration decisions accept canonical facts
+and each has a non-test production caller. The corpus constructs those durable
+facts, invokes the production consumer, and uses that return plus persisted
+issue, run, decision, interaction, wake, recovery, workspace-operation, and
+contract rows as its observation.
+
+`StatusDecisionCommitter` handles every `NativeStatusEffect` explicitly. Each
+case creates or changes its named target before its delivered ledger row is
+written. Reconciliation acknowledges a pending effect only after its existing
+company- and issue-bound target is verified. An unknown effect or target type
+throws inside the transaction, leaving the decision, effect ledger, issue
+status/version, and finalization coordinator unchanged. Corpus replay calls the
+committer twice and requires one decision identity and exactly one delivery
+attempt per target; audit-only attention and replacement-turn paths likewise
+assert their real target state.
+
+The 52-fixture/70-row proof therefore depends on runtime-reachable consumer
+returns and materialized state. Removing a production consumer invocation,
+changing its facts or decision, suppressing its target mutation, duplicating a
+delivery, or restoring a synthetic `issue_checkout` fallback fails the focused
+database gate.
+
 ## Commands the implementation must make runnable
 
 These commands are the acceptance contract for the implementation issue. They

packages/paperclip-runner/docs/phase-06-thin-paperclip-adapter.md

@@ -61,7 +61,9 @@ terminal state succeeded, every criterion and verification has accepted
 durable evidence, and no blocking work remains. It marks `blocked` only for a
 task-wide first-class blocker with a named owner and action. Review, retry,
 continuation, blocker, and recovery effects materialize atomically with the
-status-version CAS and audit record.
+status-version CAS and audit record. The committer has no catch-all delivery:
+all native effect kinds must create or mutate their named target, and unknown
+effects fail the transaction closed.
 
 ## Recovery and safety
 
@@ -104,7 +106,17 @@ committer, reconciliation, compatibility, or migration consumer and fails if
 that consumer did not execute or returned different semantics. A per-fixture
 mutation check independently changes every expected field and proves the
 comparison rejects it; there is no test-owned policy table supplying observed
-semantics.
+semantics. Finalizer observations come from the live fact-based arbiter rather
+than a fixture-state switch. Every delivered effect is joined to an actual
+persisted target, replay is required to retain the same decision with one
+delivery attempt, and an unknown-effect test proves the transaction leaves no
+decision, ledger, issue-version, or coordinator mutation.
+
+The production call graph invokes the fact consumers from heartbeat
+finalization, interaction-response projection, normalized session
+cancellation, finalization reconciliation, and runtime compatibility/migration
+selection. The corpus uses those same exported entry points and fails its row
+when their returned semantics or materialized target state changes.
 
 Result-less same-run recovery is also proven through the production heartbeat
 seam: a persisted envelope/checkpoint is leased by `reapOrphanedRuns`, enters

packages/paperclip-runner/docs/tutorials/phase-06-thin-paperclip-adapter.md

@@ -60,7 +60,7 @@ pnpm --filter @paperclipai/server exec vitest run \
 ```
 
 This runs the unchanged package conformance suite against the real Paperclip
-port. Forty-one targeted tests check company binding, duplicate/gap replay,
+port. Forty-two targeted tests check company binding, duplicate/gap replay,
 checkpoint recovery, immutable result ingestion, durable-evidence authority,
 workspace-gated finalization, atomic liveness rollback, status-version CAS,
 migration repair, legacy byte equivalence, typed interaction materialization,
@@ -76,7 +76,11 @@ decision count, maximum wake count, and maximum notification count. Every one
 of the 70 matrix rows requires evidence from its responsible finalizer,
 terminal projection, attention, cancellation, committer, reconciliation,
 compatibility, or migration consumer; a missing call or changed return fails
-the row. The recovery case uses a scripted provider only at the backend
+the row. Each native effect must also have a delivered, company-bound target
+row or concrete target-state mutation, and replay must retain one decision and
+one delivery attempt. A separate unknown-effect case proves the status
+transaction fails closed without partial rows. The recovery case uses a
+scripted provider only at the backend
 boundary while the real heartbeat reaper, lease claim, original run execution,
 persistence port, finalizer, and terminal projection execute.
 

packages/paperclip-runner/knowledge/evidence/2026-08-09-phase-06-verification.md

@@ -4,7 +4,7 @@ title: Phase 6 thin Paperclip adapter verification
 description: Targeted package, database-port, finalization, security-boundary, feature-selection, and legacy fallback evidence.
 tags: [native-runner, phase-6, verification, paperclip, replay, finalization]
 status: stable
-generated: { by: openai/gpt-5.6, at: 2026-08-09T05:20:00Z }
+generated: { by: openai/gpt-5.6, at: 2026-08-09T05:52:00Z }
 ---
 
 # Scope
@@ -13,7 +13,7 @@ This record verifies the default-off Phase 6 tracer at the approved
 `ControlPlanePort`/`NativeSessionBackend` boundary. No browser surface changed,
 so Phase 6 has command/database evidence rather than screenshots.
 
-The counts below are the PAP-16877 remediation rerun. “Internal canary” means
+The counts below are the PAP-16878 remediation rerun. “Internal canary” means
 the selected-task database test through the public package session contract;
 it does not mean that a new live Codex provider task was dispatched.
 
@@ -39,7 +39,7 @@ existing accepted result event, and appended only the missing terminal fact.
 
 # Real Paperclip adapter and public-session task
 
-The complete acceptance gate below passed 41 tests in thirteen files against
+The complete acceptance gate below passed 42 tests in thirteen files against
 embedded PostgreSQL with zero skipped tests. Database-backed tests start their
 own database instead of skipping when a developer `DATABASE_URL` is absent.
 The same package conformance suite passed unchanged against
@@ -76,13 +76,13 @@ The focused corpus also proved:
 - a completion decision writes immutable assessment/decision/effect records and
   an activity-log audit row;
 - a failed workspace barrier preserves the accepted semantic result, leaves the
-  issue status unchanged, and records a leased `retryable_failure` plus recovery
-  owner/action;
+  issue status/version unchanged, commits the fact-based preserve decision and
+  concrete recovery target, and records a leased `retryable_failure`;
 - six injected failures prove governance binding, interactions, wakes, blocker
   bindings, recovery, status,
   decisions, and effects roll back together before retry ownership is recorded.
 
-The acceptance-matrix entry points passed as one 13-file, 41-test gate:
+The acceptance-matrix entry points passed as one 13-file, 42-test gate:
 
 ```sh
 pnpm --filter @paperclipai/server exec vitest run \
@@ -113,7 +113,10 @@ explicit responsible finalizer, terminal projection, attention, cancellation,
 committer, reconciliation, compatibility, or migration consumer; the row fails
 if that consumer was not executed or its returned semantics differ. A mutation
 test changes every expected field for every fixture and proves comparison
-failure. No test-owned policy table supplies an observation. The selected-task
+failure. Every required native effect is joined to its actual target state,
+each decision replay retains one identity and one delivery attempt, and an
+unknown effect rolls the entire transaction back. No test-owned scenario
+policy supplies an observation. The selected-task
 and recovery canaries remain scripted only at the provider boundary, while the
 production Paperclip persistence/finalization paths and the flag-off legacy
 adapter/finalizer path execute for real.

packages/paperclip-runner/knowledge/journal/2026-08-09-phase-06-implementation.md

@@ -47,6 +47,16 @@ existing server authority and keep legacy execution as the default.
 12. Project supported resolved interaction responses through the existing
     authorized issue-interaction service. Governed, unresolved, unsupported,
     cross-boundary, or self-approved requests fail closed without credentials.
+13. Remove fixture-scenario arbitration from production. Finalization consumes
+    durable evidence facts, and attention, cancellation, reconciliation,
+    compatibility, and migration consumers are invoked from their live server
+    paths.
+14. Handle every native status effect exhaustively. A delivered row is written
+    only after its named target exists or changes; pending delivery verifies the
+    original target, and unknown effects or target types roll back.
+15. Prove at-most-once materialization by replaying each corpus decision and
+    requiring one decision identity, one delivery attempt, and the persisted
+    target state.
 
 # Evidence
 
@@ -54,7 +64,7 @@ existing server authority and keep legacy execution as the default.
 - [Phase 6 reference](../../docs/phase-06-thin-paperclip-adapter.md)
 - [Runnable tutorial](../../docs/tutorials/phase-06-thin-paperclip-adapter.md)
 - Package conformance and recovery: four files, seven tests passed.
-- Phase 6 acceptance-matrix entry points: thirteen files, forty-one tests passed
+- Phase 6 acceptance-matrix entry points: thirteen files, forty-two tests passed
   with zero skips, including the database-backed selected-task canary, six
   atomic-liveness failpoints, migration, sequencing, bounded recovery, and
   legacy compatibility.
@@ -69,6 +79,10 @@ existing server authority and keep legacy execution as the default.
   count. All 70 matrix rows require their named consumer execution and compare
   that consumer's semantics. Per-fixture mutation checks reject changes to
   every expected field; no test-owned policy table supplies observations.
+- All native effect observations resolve to actual interaction, wake, issue,
+  recovery, run, workspace-operation, contract, decision, or governance state.
+  Unknown effects fail before any decision, ledger, status-version, or
+  coordinator mutation.
 - The production heartbeat reaper resumed one persisted result-less run through
   the original execution/finalization path with the flag disabled. It recovered
   an already-active scripted provider turn and produced exactly one result,