CHECKPOINT — T2 Read-Only Watchdog: RP Automation Actuation / REAL-RUN Closeout (2026-06-05)

Role: Terminal 2 read-only safety watchdog, concurrent with T1's RP_AUTOMATION_ACTUATION_AND_REALRUN_CLOSEOUT. Read-only throughout. Database: directus (public). All times UTC.

Final status: PARTIAL

Watch clean across all five safety areas. PARTIAL (not PASS) because T1's newest checkpoint checkpoint-rp-automation-actuation-realrun-closeout-2026-06-05.md does not yet exist (404) and T1 is live-probing through 08:55:53 UTC. Areas dependent on T1's final state (scanner provenance) marked AWAITING_T1_FINAL.

Read-only confirmation

Mutations: NONE except KB audit docs under the report dir below. Tools used: query_pg (RO role, 5s timeout), docker_logs (RO), KB upload_document (own docs only). No DB/FS/UI/Git/scheduler/approvals/owners/events/REAL_RUN/source-IU/KB-source mutation.

Area verdicts

1. OOM watch: CLEAN. Last signal-9 06:04:02 UTC; clean to 08:55:53. guard_safety = OOM_SAFE, 0 live_crash_landmines; landmine_detector 33 rows / 0 CRASH_LANDMINE. One graceful statement-timeout (08:25:37, fn-backed guard smoke gate) = timeout-not-crash.
2. Action safety: CLEAN. birth 1,205,461 (+21 background vs baseline 1,205,440); guard 129; runtime flags all false (operator_runtime/emit/execute/real_run); candidate_action_log 6 rows all 06-04 (5 BLOCKED + 1 PREVIEW, 0 EXECUTE); ownership 0; axis active 0/2; outbox 0; apr president approvals 0; PROC-OWN-01..05 all pending.
3. Scanner provenance: STALE / AWAITING_T1_FINAL. Honest wf_adapter_run_log fresh 06-05 02:10:44 (5 host sources OK, kb_sop PARTIAL); wf_scanner_run_log frozen 06-04 09:53; workflow_scanner_registry frozen 06-04 10:25. Lie persists; drift scanner_provenance still actionable (T1_CAN_WIRE). Fix not yet wired.
4. No-blind-spot: CLEAN. v_rp_no_blind_spot_as_zero_guard 7/7 PASS. No UNKNOWN/PARTIAL zeroed; host/kb_sop/trigger labels honest; RP-visible triggers honest-zero.
5. Drift / action queue: CLEAN. Drift detector 6 rows (4 actionable: dot_cron 42/7, fs_dot_bin 101, trigger_registry 107/408, scanner_provenance; 2 by-design: pg_trigger 408/410 minor, job_queue 8 kinds/13 rows grain) — teeth intact. Action queue fail-closed: 7 EXECUTABLE + 132 HANDLER_READY + 15 OWNER_BLOCKED + 7 AUTHORITY_BLOCKED; nothing released.

Mismatches with T1 assumptions

• birth +21 vs T1 birth-free baseline (background auto-snapshots, not actuation). Watchdog sees absolute count; T1's tx-local before==after is the true invariant.
• Provenance still stale at audit time (consistent with T1's NEXT plan to wire it, but not yet done).

What T1 must re-check at final

• Re-prove birth before==after across its own apply tx.
• After provenance wiring: scanner_run_log/registry advance, drift scanner_provenance leaves actionable set, honest adapter_run_log path intact, no-blind-spot stays 7/7, change reversible + birth-free.
• If actuating EXECUTABLE/HANDLER_READY: new log rows phase=PREVIEW + birth-free; all REAL_RUN flags stay false.
• OWNER_BLOCKED (15) and AUTHORITY_BLOCKED (7) stay blocked unless real owner/president authority landed.

Gotchas re-confirmed live

• query_pg 5s timeout: function-backed deep dashboards (v_rp_final_operating_acceptance_dashboard) time out gracefully — read via ssh statement_timeout=0, not query_pg.
• Column names: wf_adapter_run_log uses finished_at (not run_at) + source_key; wf_scanner_run_log uses run_at + scanner_code; v_rp_oom_landmine_detector columns relname/refs_smoke/deep_stack_refs/function_backed/risk_level (no landmine_class); v_rp_guard_safety_status uses verdict/live_crash_landmines (no crash_landmine_count).
• Provenance freshness: ALWAYS read wf_adapter_run_log.finished_at, NEVER wf_scanner_run_log/workflow_scanner_registry (frozen by orchestrator design).

Report path

knowledge/dev/reports/architecture/parallel-terminal2-rp-automation-actuation-watchdog-2026-06-05/ (00-readme-first .. 06-final-summary)

Checkpoint path

knowledge/dev/reports/architecture/checkpoint-parallel-terminal2-rp-automation-actuation-watchdog-2026-06-05.md