Why
Replan publishes node mutations, workflow config and graph revision in separate transactions. Failure before WorkflowConfigUpdated leaves a partially replaced graph, and recovery can launch an added node using its name because its real config was never committed. DAG-A03 reproduced the split with a one-shot commit failure.
Scope
Replan command transaction boundary, instance-aware event batching, post-commit notifications and regression tests. Guard dispatch when an active node has no configuration. Reuse existing EventV2 transaction support where appropriate.
Approach
Assign this foundational issue first to GPT-5.6-Sol. Stage all events for one workflow replan and commit them atomically before runtime notifications. Preserve the event location bridge. Validate rollback using a real projection/store failure and prove observers only see the committed complete graph.
This issue is one independently verifiable repair in the seven-finding DAG audit delivery. The authorized route is SpecGit delivery to dev, a separately tracked promotion to main, then the official release workflow. The integrator reviews each issue patch and records exact-head local and CI evidence before acceptance. Unrelated workspace modifications and deferred database maintenance #531 remain outside this delivery.
Acceptance
A failure anywhere in replan leaves nodes, config, superseded state and revision unchanged. Successful replan commits the whole state once and preserves ordered notifications with correct instance location. Recovery never invents a prompt for a node missing from config. Existing replan, event replay, DAG core coverage and typechecks pass.
The audit baseline is cf5fd26; the DAG runtime tree is identical on dev at 711e7b5. Regression tests must assert corrected public behavior using real DAG state and deterministic boundary stubs.
Why
Replan publishes node mutations, workflow config and graph revision in separate transactions. Failure before WorkflowConfigUpdated leaves a partially replaced graph, and recovery can launch an added node using its name because its real config was never committed. DAG-A03 reproduced the split with a one-shot commit failure.
Scope
Replan command transaction boundary, instance-aware event batching, post-commit notifications and regression tests. Guard dispatch when an active node has no configuration. Reuse existing EventV2 transaction support where appropriate.
Approach
Assign this foundational issue first to GPT-5.6-Sol. Stage all events for one workflow replan and commit them atomically before runtime notifications. Preserve the event location bridge. Validate rollback using a real projection/store failure and prove observers only see the committed complete graph.
This issue is one independently verifiable repair in the seven-finding DAG audit delivery. The authorized route is SpecGit delivery to dev, a separately tracked promotion to main, then the official release workflow. The integrator reviews each issue patch and records exact-head local and CI evidence before acceptance. Unrelated workspace modifications and deferred database maintenance #531 remain outside this delivery.
Acceptance
A failure anywhere in replan leaves nodes, config, superseded state and revision unchanged. Successful replan commits the whole state once and preserves ordered notifications with correct instance location. Recovery never invents a prompt for a node missing from config. Existing replan, event replay, DAG core coverage and typechecks pass.
The audit baseline is cf5fd26; the DAG runtime tree is identical on dev at 711e7b5. Regression tests must assert corrected public behavior using real DAG state and deterministic boundary stubs.