fix(history): bound W63 rollup aggregate overflow

[ammarheidari]

Corrective authority

Post-merge exact-head review of W63 Slice 2 PR #236 found that individually valid raw samples could overflow aggregate Count or produce non-finite Sum, permanently blocking the oldest maintenance window.

Correction

• aggregate raw batches with finite/saturating arithmetic;
• cap unrepresentable count at long.MaxValue;
• cap unrepresentable sum at finite ±double.MaxValue;
• mark any bounded/clipped aggregate as Partial;
• apply the same saturation and Partial truth during late merge into an existing rollup;
• preserve min/max and coverage evidence;
• add batch-overflow and late-merge-overflow regressions.

No raw payload or secret state is introduced. This correction preserves maintenance forward progress while explicitly marking evidence that cannot be represented exactly.

Exact head: 5389d0a44e8675916df34589faf9f00793ae3b86.

Final canonical gate

• protected-main parent: c1e6f1f53ed9c4677b131fa1352a404f7ba6e731;
• exact head: 389710b3f03b6d137925df438c04312317b1db69;
• one DCO-signed commit;
• W63 corrective uses schema-v3 exact binary sum/count/base-state metadata so temporary saturation can recover deterministically and late arrival order cannot change the aggregate.
• fresh exact-head CI, CODEOWNER approval and Codex review are required before merge.

Exact-accumulator remediation

• protected-main parent: c1e6f1f53ed9c4677b131fa1352a404f7ba6e731;
• canonical exact head: 16aca4d85c68c2f85c6f7b89ff52cea7e8ff62c4;
• historical schema evolves backward-compatibly to v3;
• rollups persist exact binary sum significand/exponent, exact count and base truth-state;
• display sum/count remain bounded to double/BIGINT, but future late merges use exact metadata rather than prior clamps;
• temporary saturation can recover deterministically when later opposite-signed evidence makes the exact aggregate representable again;
• v2→v3 migration, batch cancellation and late-arrival recovery have regression coverage;
• fresh exact-head CI, CODEOWNER approval and Codex review required.

Upgrade-safe exact accumulator closeout

• protected-main parent: 6ea6dfc6ea441b1917cce4a4beb54320a297aabf;
• exact canonical head: 0af7de350d6fa83ce9331fde6812fabf501190df;
• historical schema v3 stores exact sum/count/base-state metadata;
• maintenance schema v2 fences restarted legacy writers and PostgreSQL installs a trigger that rejects stale v2-style updates once exact metadata exists;
• legacy non-finite rollups degrade to finite Partial state without blocking the oldest window;
• exact→double conversion uses round-to-nearest-even;
• batch and late-arrival cancellation remain order-independent;
• v2→v3 migration, mixed-writer fence, legacy Infinity and rounding all have regression coverage;
• fresh exact-head CI, CODEOWNER approval and Codex review required.

Final protected-main reconciliation

• parent/protected main: 4a4ec6302b4209f25b7456f95d3687d32ff6b134;
• exact head: de33fde8b20e5c056fff3399e1c6967214b93c26;
• one DCO-signed commit;
• historical schema v3 exact binary sum/count/base-state metadata;
• maintenance schema v2 + PostgreSQL legacy-writer fence;
• valid PostgreSQL function dollar quoting;
• legacy non-finite sums and oversized SQLite counts recover forward progress conservatively as Partial;
• exact-to-double conversion uses nearest-even rounding;
• batch and late-arrival accumulation are order-independent;
• fresh exact-head CI, CODEOWNER approval and Codex review required.

Final post-W65 resynchronization

• protected-main parent: e1abda30d3d8ae57b4ddbf983f4bb12e145eed26;
• exact head: 5389d0a44e8675916df34589faf9f00793ae3b86;
• one DCO-signed commit;
• W66 security corrective + W65 evaluator Slice 2 are now in the parent baseline;
• W63 source/test payload is unchanged from the frozen corrective content;
• fresh exact-head CI, CODEOWNER approval and Codex review required before merge.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-28T19:15:24.375775Z	5389d0a	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[ammarheidari]

@codex review

Please review exact corrective head e3a667f5dbce5f92f6662ae02b67ab064411cc67, especially finite/saturating batch aggregation, late-rollup conflict arithmetic and explicit Partial truth.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e3a667f5db

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ammarheidari]

@codex review

Please review final canonical exact head 389710b3f03b6d137925df438c04312317b1db69.

[ammarheidari]

@codex review

Please review exact W63 corrective head 16aca4d85c68c2f85c6f7b89ff52cea7e8ff62c4, especially schema-v3 migration, exact binary accumulation and late-arrival order independence.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 16aca4d85c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ammarheidari]

@codex review

Please review final canonical W63 corrective head 0af7de350d6fa83ce9331fde6812fabf501190df, focusing on mixed-version fencing, legacy non-finite recovery and nearest-even exact accumulation.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0af7de350d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ammarheidari]

@codex review

Please review final exact W63 corrective head de33fde8b20e5c056fff3399e1c6967214b93c26 on protected-main 4a4ec6302b4209f25b7456f95d3687d32ff6b134, focusing on upgrade fencing, legacy recovery and exact accumulator correctness.

[ammarheidari]

@codex review

Please review final post-W65 exact W63 corrective head 5389d0a44e8675916df34589faf9f00793ae3b86 on protected-main e1abda30d3d8ae57b4ddbf983f4bb12e145eed26.

[ammarheidari]

@codex review

Final gate request: review exact W63 corrective head 5389d0a44e8675916df34589faf9f00793ae3b86 only. Quality, persistence and benchmark gates are green.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 5389d0a44e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".