<!-- task=m-iop-agent-cli-runtime/21+13,17,20_project_log_sink plan=2 tag=REVIEW_API -->

# Durable Manager Event Delivery and Stable Project-Log Replay

## For the Implementing Agent

Filling every implementation-owned section in `CODE_REVIEW-cloud-G10.md` is mandatory. Implement the checklist, run every verification command, paste actual notes and stdout/stderr into the review file, keep both active Markdown files in place, and report ready for review; only the code-review skill finalizes the task. If blocked, record only the exact blocker, attempted commands/output, and resume conditions in implementation-owned evidence fields. Do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`.

## Background

The evidence-exact sink and task-scoped archive now pass their package tests, but production manager ordering can invoke the sink before the corresponding work evidence is durable and silently discard the error. Replay also compares volatile projection fields, so an otherwise identical manager event can conflict after time or an unrelated manager-state revision advances. This follow-up makes durable manager delivery, evidence resolution, and stable event replay one recoverable boundary.

## Archive Evidence Snapshot

- Current pair to archive during review finalization:
  - `agent-task/m-iop-agent-cli-runtime/21+13,17,20_project_log_sink/plan_cloud_G10_1.log`
  - `agent-task/m-iop-agent-cli-runtime/21+13,17,20_project_log_sink/code_review_cloud_G10_1.log`
- Prior verdict: `FAIL`.
- Required findings:
  - `EventReviewResult` and `EventDependencyReady` are emitted before their exact `WorkRecord` evidence is committed, and `Manager.emit` discards sink errors. The S12 fixture bypasses those real manager orderings.
  - replay fingerprinting includes fresh timestamps and resolved global state revisions, so the same logical `EventID` can conflict after clock or unrelated state advances.
- Suggested findings: none.
- Nit findings: none.
- Affected boundary: `packages/go/agenttask` durable event delivery, `apps/agent/internal/projectlog` evidence/replay, S12 tests, and both inner runtime contracts.
- Fresh review verification passed focused/full projectlog tests, race, vet, formatting, contract search, and `git diff --check`; the commands did not exercise the missing manager-to-sink ordering or volatile replay variants.
- Roadmap carryover remains `project-logs`; no completion may be reported until this follow-up passes.

## Roadmap Targets

- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone document](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
  - `project-logs`: project-local event/log plus WORK_LOG loop/attempt/locator and exactly-once archive lifecycle
- Completion mode: check-on-pass

## Analysis

### Files Read

- `agent-ops/rules/project/rules.md`
- `agent-ops/rules/common/rules.md`
- `agent-ops/rules/common/rules-roadmap.md`
- `agent-ops/rules/common/rules-agent-spec.md`
- `agent-ops/rules/project/domain/agent/rules.md`
- `agent-ops/rules/project/domain/platform-common/rules.md`
- `agent-ops/rules/project/domain/testing/rules.md`
- `agent-ops/skills/common/update-test/SKILL.md`
- `agent-test/local/rules.md`
- `agent-test/local/platform-common-smoke.md`
- `agent-roadmap/current.md`
- `agent-roadmap/phase/automation-runtime-bridge/PHASE.md`
- `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md`
- `agent-spec/index.md`
- `agent-contract/index.md`
- `agent-contract/inner/agent-runtime.md`
- `agent-contract/inner/iop-agent-cli-runtime.md`
- `packages/go/agenttask/types.go`
- `packages/go/agenttask/ports.go`
- `packages/go/agenttask/manager.go`
- `packages/go/agenttask/state_machine.go`
- `packages/go/agenttask/reconcile.go`
- `packages/go/agenttask/review.go`
- `packages/go/agenttask/workflow.go`
- `packages/go/agenttask/dispatch.go`
- `packages/go/agenttask/integration_queue.go`
- `packages/go/agenttask/test_support_test.go`
- `packages/go/agenttask/state_machine_test.go`
- `packages/go/agenttask/review_test.go`
- `packages/go/agenttask/manager_integration_test.go`
- `apps/agent/internal/projectlog/record.go`
- `apps/agent/internal/projectlog/sink.go`
- `apps/agent/internal/projectlog/store.go`
- `apps/agent/internal/projectlog/record_test.go`
- `apps/agent/internal/projectlog/sink_test.go`
- `apps/agent/internal/projectlog/store_test.go`
- `agent-task/m-iop-agent-cli-runtime/21+13,17,20_project_log_sink/PLAN-cloud-G10.md`
- `agent-task/m-iop-agent-cli-runtime/21+13,17,20_project_log_sink/CODE_REVIEW-cloud-G10.md`
- `agent-task/m-iop-agent-cli-runtime/21+13,17,20_project_log_sink/plan_local_G08_0.log`
- `agent-task/m-iop-agent-cli-runtime/21+13,17,20_project_log_sink/code_review_cloud_G08_0.log`

### SDD Criteria

- SDD: `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md`
- Status: approved; implementation lock: released.
- Targeted Acceptance Scenario: `S12`.
- Milestone Task id: `project-logs`.
- Evidence Map requirement: exact WORK_LOG loop/attempt/locator evidence, dynamic parallel work, replay-safe task-scoped terminal archive reconciliation, and stable identities under restart/crash variants.
- These rows require real manager call-site ordering, durable delivery recovery, same-ID replay after process/state changes, all archive crash phases, and fresh race verification. The implementation checklist therefore keeps manager delivery and projectlog replay in one plan and extends the named S12 oracle instead of accepting direct pre-populated sink fixtures alone.

### Verification Context

- No separate verification handoff was supplied.
- Sources read: `agent-test/local/rules.md`, `agent-test/local/platform-common-smoke.md`, the approved SDD, both inner contracts, repository Go package layout, and existing manager/projectlog tests.
- Environment: local checkout at `/config/workspace/iop-s0`.
- Tool preflight: `/config/.local/bin/go`, `go1.26.2 linux/arm64`, `GOROOT=/config/opt/go`.
- Applied commands and criteria: fresh focused tests for manager delivery and event replay, full `agenttask`/`projectlog` tests, platform-common `./packages/go/...` smoke, race coverage for state/CAS ordering, vet, formatting, deterministic contract search, and `git diff --check`.
- Preconditions: preserve unrelated dirty-worktree changes; run from the workspace root; use `-count=1` because cached output is not acceptable for completion evidence.
- Constraints: local verification only; no external runner, daemon, provider, network, secret, or long-running runtime is required.
- External Verification Preflight: not applicable.
- Gap: there is no agent-specific local profile or daemon composition test. Repository-native package tests prove the manager delivery and sink resolution halves at their shared durable `ManagerState` contract.
- Confidence: medium-high; the missing composition process is explicit, while the state, ordering, restart, replay, archive, and race oracles are deterministic in the current checkout.
- Test-rule maintenance: not needed; the platform-common profile already covers `packages/go/**`, and projectlog uses repository-native Go tests.

### Test Coverage Gaps

- Existing manager tests verify stable `EventID` values and collect events, but do not assert that `EventSink.Emit` observes a committed dependency/review/follow-up/terminal state or that a sink failure is durable and returned.
- Existing state checkpoint tests do not clone or validate a pending delivery envelope and do not reject conflicting reuse of one pending `EventID`.
- Existing sink tests resolve current state only; they do not prefer an exact pending delivery snapshot or short-circuit evidence resolution for a known replay.
- Existing store replay tests reuse an identical record, timestamp, and revision; they do not advance the clock/global manager revision or distinguish stable event content from volatile projection content.
- `TestS12LoopParallelArchiveMatrix` covers 11 follow-up pairs and archive failure phases but directly pre-populates work before `Sink.Emit`; it does not link its archive assertions to real manager ordering/recovery evidence.

### Symbol References

- `Manager.emit` call sites are in `packages/go/agenttask/manager.go`, `workflow.go`, `reconcile.go`, `dispatch.go`, `review.go`, and `integration_queue.go`, plus `state_machine_test.go` and `integration_queue_test.go`.
- The public `agenttask.EventSink.Emit` signature remains unchanged; no provider or host adapter call site requires an API rename.
- `Store.AppendEventRecord` call site: `apps/agent/internal/projectlog/sink.go:189`; tests may call the generic `AppendRecord`, which must retain record-level replay behavior.
- `StateStoreEvidenceResolver.ResolveEventEvidence` call sites are the `Sink.Emit` path and sink/store tests.
- New state fields are additive checkpoint data and must be cloned, normalized, and validated by `state_machine.go`; do not add a dependency.

### Split Judgment

The invariant is indivisible: one manager transition must durably enqueue an exact event/evidence snapshot, survive sink failure and restart, resolve to one record, and deduplicate by stable logical event content before volatile evidence is consulted. Splitting the manager queue from sink/store replay would leave either an unrecoverable delivery or an unprovable replay window.

Split predecessors remain satisfied:

- `13_agent_domain`: `agent-task/archive/2026/07/m-iop-agent-cli-runtime/13_agent_domain/complete.log`
- `17+13_project_log_records`: `agent-task/archive/2026/07/m-iop-agent-cli-runtime/17+13_project_log_records/complete.log`
- `20+13,17_project_log_journal`: `agent-task/archive/2026/07/m-iop-agent-cli-runtime/20+13,17_project_log_journal/complete.log`

### Scope Rationale

Do not change provider adapters, isolation/confinement semantics, policy decisions, scheduler ordering, archive artifact formats, UI, Python task orchestration, roadmap files, or unrelated active tasks. Keep `EventSink` host-neutral and use an additive manager delivery envelope rather than importing projectlog types into `packages/go/agenttask`. Do not add a daemon composition layer that does not yet exist.

### Final Routing

- evaluation_mode: `isolated-reassessment`
- finalizer: `finalize-task-policy.sh pair`
- build closures: scope/context/verification/evidence/ownership/decision all `true`
- build scores: scope `2`, state `2`, blast `2`, evidence `2`, verification `2`; grade `G10`
- build base/final route: `grade-boundary` / `grade-boundary`, lane `cloud`, filename `PLAN-cloud-G10.md`
- review closures: scope/context/verification/evidence/ownership/decision all `true`
- review scores: scope `2`, state `2`, blast `2`, evidence `2`, verification `2`; grade `G10`
- review route: `official-review`, lane `cloud`, adapter `codex`, model `gpt-5.6-sol`, reasoning `xhigh`, filename `CODE_REVIEW-cloud-G10.md`
- large_indivisible_context: `false`
- positive loop risks: `temporal_state`, `concurrent_consistency`, `boundary_contract`, `variant_product` (count `4`)
- recovery signals: `review_rework_count=2`, `evidence_integrity_failure=true`
- risk boundary matched: `true`; recovery boundary matched: `true`; grade-boundary remains the route basis
- capability-gap evidence: none

## Implementation Checklist

- [ ] Persist and recover manager event deliveries from committed evidence, reorder dependency/review emission, and surface sink failures.
- [ ] Deduplicate project-log replay by stable logical event content before resolving volatile evidence.
- [ ] Extend manager/projectlog S12 evidence and align both contracts with the durable-delivery boundary.
- [ ] Run the focused, full, race, platform-common, vet, formatting, contract, and diff verification commands exactly as written.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_API-1] Persist Manager Event Delivery After Committed Evidence

#### Problem

`packages/go/agenttask/manager.go:535-555` assigns a fresh timestamp and discards every `EventSink.Emit` error. `packages/go/agenttask/reconcile.go:408-446` calls `emit` inside the dependency CAS before `project.Works[workID]` is stored. `packages/go/agenttask/review.go:37-127` emits the review verdict before `WorkRecord.Review` is durable and can replace the old attempt in the same later mutation. A transient sink failure therefore loses an event, while the sink can observe prior or stale work evidence.

#### Solution

Add a host-neutral `EventDelivery` envelope to `agenttask` with the normalized event, the exact loaded `StateRevision`, and deep-cloned project/work evidence. Add `PendingEvents map[string]EventDelivery` to `ManagerState`; normalize, clone, and validate it without importing projectlog types. `Manager.emit` must assign `EventID` and `Timestamp` once, CAS-enqueue the delivery before calling the sink, use sorted EventIDs for deterministic draining, and remove an entry by CAS only after `EventSink.Emit` succeeds. Identical enqueue replay converges; conflicting logical reuse of an EventID fails closed.

Wrap `StartProject`, `StopProject`, and `Reconcile` in a concurrency-safe delivery error collector. Retry pending deliveries at public-entry/reconcile boundaries, return sink errors to the caller while retaining their envelopes, and permit restart recovery to resend the same durable event. Move dependency and completed-project emission outside their state mutation. Persist `WorkRecord.Review` in its own committed mutation before emitting `EventReviewResult`; then perform PASS/rework/deferred transitions and their follow-up/terminal events. The envelope preserves exact prior evidence if later work advances after a failed delivery.

Before (`packages/go/agenttask/manager.go:535-555`):

```go
func (m *Manager) emit(ctx context.Context, event Event) {
	if event.EventID == "" {
		event.EventID = durableIdentity(/* logical fields */)
	}
	event.Timestamp = m.clock.Now()
	_ = m.events.Emit(ctx, event)
}
```

After:

```go
type EventDelivery struct {
	Event            Event
	EvidenceRevision StateRevision
	Project          *ProjectRecord
	Work             *WorkRecord
}

func (m *Manager) emit(ctx context.Context, event Event) {
	delivery, err := m.enqueueEvent(ctx, normalizeEvent(event, m.clock.Now()))
	if err == nil {
		err = m.flushEventDelivery(ctx, delivery.Event.EventID)
	}
	recordDeliveryError(ctx, err)
}
```

Before (`packages/go/agenttask/reconcile.go:408-446`):

```go
if err := transitionWork(&work, WorkStateReady); err != nil {
	return err
}
// ...
m.emit(ctx, Event{Type: EventDependencyReady /* ... */})
// ...
project.Works[workID] = work
```

After:

```go
decision, err := mutateDecision(m, ctx, func(state *ManagerState) ([]Event, error) {
	// Persist every ready work first and return its event as decision data.
})
if err != nil {
	return err
}
for _, event := range decision {
	m.emit(ctx, event)
}
return deliveryErrors(ctx)
```

#### Modified Files and Checklist

- [ ] `packages/go/agenttask/types.go` — add the durable delivery envelope and pending-event state.
- [ ] `packages/go/agenttask/state_machine.go` — normalize, deep-clone, and fail-closed validate pending deliveries.
- [ ] `packages/go/agenttask/manager.go` — normalize/enqueue/flush/ack deliveries, preserve timestamps, collect errors, and recover pending entries at public boundaries.
- [ ] `packages/go/agenttask/reconcile.go` — emit dependency/completion decisions after CAS and drain pending delivery before work advances.
- [ ] `packages/go/agenttask/review.go` — commit exact review evidence before review/follow-up/terminal emission.
- [ ] `packages/go/agenttask/state_machine_test.go` — cover clone/validation, duplicate enqueue, stable timestamp/ID, and conflicting pending content.
- [ ] `packages/go/agenttask/manager_integration_test.go` — cover real dependency, review, follow-up, and terminal call-site evidence plus fail/restart/retry/ack behavior.

#### Test Strategy

Write `TestEventDeliveryCheckpointCloneValidation` in `packages/go/agenttask/state_machine_test.go` to mutate cloned evidence without aliasing, reject map-key/EventID or project/work identity drift, and accept one valid envelope. Extend the event identity test to prove timestamp assignment is stable across a pending retry.

Write `TestManagerEventDeliveryUsesCommittedEvidence` and `TestManagerEventDeliveryRecoversSinkFailure` in `packages/go/agenttask/manager_integration_test.go`. Use a state-observing sink to assert dependency-ready work, persisted review verdict, next-attempt follow-up, and terminal integration/block evidence at the real manager call sites. Fail one sink call, assert `Reconcile` returns the error with the exact envelope still durable, replace/restart the manager, and assert the same EventID/timestamp is delivered once and acknowledged.

#### Verification

```bash
go test -count=1 ./packages/go/agenttask -run 'TestEventDeliveryCheckpoint|TestEventIdentity|TestManagerEventDelivery|TestReview'
```

Expected: all durable delivery, ordering, recovery, and existing review tests pass with fresh execution.

### [REVIEW_API-2] Separate Stable Event Replay from Volatile Record Projection

#### Problem

`apps/agent/internal/projectlog/sink.go:171-190` resolves current manager evidence before it can recognize a replay. `apps/agent/internal/projectlog/store.go:43-46,208-241,248-327` stores only one record fingerprint, and `recordFingerprint` at lines 1069-1076 clears only `Sequence`. A fresh manager timestamp or a later global state revision therefore changes the fingerprint for the same logical EventID, including after the record has been archived and pruned.

#### Solution

Derive a stable manager-event fingerprint from every logical `agenttask.Event` field with `Timestamp` cleared; retain `Detail` and all identity/result fields so changed logical content conflicts. Let `Sink.Emit` derive the opaque RecordID and stable fingerprint first, route to the correct project/work journal, and query the retained replay index before calling `ResolveEventEvidence`. Return the original sequence/success for a matching fingerprint and fail with `ErrRecordReplayConflict` for a different fingerprint. Only unseen events resolve evidence and create a projected record.

Extend `seenRecord` with a separate event fingerprint while retaining the exact record fingerprint for journal corruption checks and generic `AppendRecord` callers. Pass the stable fingerprint to `AppendEventRecord`; preserve it through CAS retry, archive prune, reopen, and reconciliation. Treat a legacy/generic index entry without an event fingerprint as requiring normal record resolution rather than fabricating one.

Make `StateStoreEvidenceResolver` prefer the exact matching `ManagerState.PendingEvents[event.EventID]` envelope and validate the envelope event/project/work identity before falling back to current-state resolution for compatible direct callers. This makes first delivery independent of subsequent work progress while the replay precheck makes post-ack retry independent of the current global revision.

Before (`apps/agent/internal/projectlog/sink.go:171-190`):

```go
evidence, err := s.evidence.ResolveEventEvidence(ctx, event)
if err != nil {
	return fmt.Errorf("projectlog: resolve event evidence: %w", err)
}
rec, err := mapEventToRecord(event, evidence, s.store.projectID, s.store.workspaceID)
_, err = s.store.AppendEventRecord(ctx, rec)
```

After:

```go
recordID, err := opaqueRecordID(event.EventID)
fingerprint, err := eventFingerprint(event)
if replayed, err := s.store.CheckEventReplay(
	ctx, event.WorkUnitID, recordID, fingerprint,
); replayed || err != nil {
	return err
}
evidence, err := s.evidence.ResolveEventEvidence(ctx, event)
// ...
_, err = s.store.AppendEventRecord(ctx, rec, fingerprint)
```

Before (`apps/agent/internal/projectlog/store.go:43-46`):

```go
type seenRecord struct {
	Sequence    uint64 `json:"sequence"`
	Fingerprint string `json:"fingerprint"`
}
```

After:

```go
type seenRecord struct {
	Sequence         uint64 `json:"sequence"`
	RecordFingerprint string `json:"record_fingerprint"`
	EventFingerprint  string `json:"event_fingerprint,omitempty"`
}
```

#### Modified Files and Checklist

- [ ] `apps/agent/internal/projectlog/sink.go` — preflight stable replay, resolve pending delivery evidence, and append unseen event records.
- [ ] `apps/agent/internal/projectlog/store.go` — retain separate event/record fingerprints and add scope-aware pre-resolution replay checks.
- [ ] `apps/agent/internal/projectlog/sink_test.go` — prove pending-envelope resolution and resolver short-circuit after time/state advance.
- [ ] `apps/agent/internal/projectlog/store_test.go` — prove event replay across CAS/archive/prune/reopen and changed logical-content conflict.

#### Test Strategy

Write `TestSinkPendingDeliveryUsesExactCommittedEvidence` to supply a pending review delivery whose current work has advanced and assert the record uses the envelope revision, review verdict, attempt, and locators. Write `TestSinkReplayShortCircuitsEvidenceAfterClockAndStateAdvance` with a resolver that fails if called on the second emit; change only timestamp and unrelated manager revision while retaining the logical event and assert no second record.

Write `TestStoreEventReplayFingerprintSurvivesPruneAndRestart` to append/archive/prune/reopen, advance volatile projection values, and assert the stable EventID returns its original sequence without a new archive ordinal. Write `TestStoreRejectsLogicalEventIDReuse` with changed detail/attempt/result and assert `ErrRecordReplayConflict`.

#### Verification

```bash
go test -count=1 ./apps/agent/internal/projectlog -run 'TestSinkPendingDelivery|TestSinkReplay|TestStoreEventReplay|TestStoreRejectsLogical'
```

Expected: exact delivery evidence and stable replay tests pass before and after archive/restart while conflicts fail closed.

### [REVIEW_API-3] Bind S12 and Contracts to Real Delivery Recovery

#### Problem

`apps/agent/internal/projectlog/store_test.go:1697` writes the desired work state before every direct `Sink.Emit`, so its archive matrix cannot detect production pre-CAS emission or sink-error loss. `agent-contract/inner/agent-runtime.md:61-63` promises replay idempotency across restart/archive without separating stable manager event identity from volatile record projection. The standalone runtime contract lists S12 package paths but does not name the manager delivery recovery oracle.

#### Solution

Keep the 11-pair, same-project parallel, five-crash-phase S12 archive matrix, but add replay variants that change timestamp and unrelated manager revision across state/store reopen and assert no new record/archive ordinal. Link S12 completion to the real manager delivery tests from Item 1: those tests prove production ordering/recovery; projectlog tests prove pending-envelope resolution and stable replay; the existing matrix proves task-scoped WORK_LOG/archive behavior. Do not fabricate a daemon composition test.

Update both inner contracts to define the durable pending-delivery envelope, exact commit-before-observe rule, returned-but-recoverable sink failure, stable logical event fingerprint (timestamp and projection revision excluded), conflicting EventID reuse, replay-before-resolution ordering, and the exact manager/projectlog test commands and source paths.

Before (`agent-contract/inner/agent-runtime.md:61-63`):

```markdown
- Identical replay of the same manager event id is idempotent ...
- replay survives process restart and post-archive prune ...
- reuse of one manager event id with different canonical record content fails closed.
```

After:

```markdown
- Manager durably enqueues one exact event/evidence delivery before invoking EventSink.
- A failed delivery remains pending, is surfaced by the public manager call, and replays with
  the same EventID and timestamp after restart.
- Replay compares stable logical event content before evidence resolution; Timestamp and
  projection StateRevision cannot create a conflict, while changed logical content fails closed.
```

#### Modified Files and Checklist

- [ ] `apps/agent/internal/projectlog/store_test.go` — extend S12 with clock/revision/reopen replay variants and unchanged archive cardinality.
- [ ] `agent-contract/inner/agent-runtime.md` — define manager delivery and stable replay invariants.
- [ ] `agent-contract/inner/iop-agent-cli-runtime.md` — map S12 to exact manager/projectlog tests, sources, and fresh race command.

#### Test Strategy

Extend `TestS12LoopParallelArchiveMatrix` rather than creating a second archive matrix. Assert the existing 11 review-failure/follow-up pairs, independent parallel completion, full decoded WORK_LOG, all five crash phases, and terminal cleanup still pass when the replay clock and unrelated manager revision advance across reopen. The manager integration tests from Item 1 are the production call-site oracle referenced by the S12 contract row.

#### Verification

```bash
go test -count=1 -race ./packages/go/agenttask ./apps/agent/internal/projectlog -run 'TestManagerEventDelivery|TestS12LoopParallelArchiveMatrix'
```

Expected: real manager ordering/recovery and the full S12 replay/archive matrix pass under the race detector.

## Modified Files Summary

| File | Item |
|------|------|
| `packages/go/agenttask/types.go` | REVIEW_API-1 |
| `packages/go/agenttask/state_machine.go` | REVIEW_API-1 |
| `packages/go/agenttask/manager.go` | REVIEW_API-1 |
| `packages/go/agenttask/reconcile.go` | REVIEW_API-1 |
| `packages/go/agenttask/review.go` | REVIEW_API-1 |
| `packages/go/agenttask/state_machine_test.go` | REVIEW_API-1 |
| `packages/go/agenttask/manager_integration_test.go` | REVIEW_API-1 |
| `apps/agent/internal/projectlog/sink.go` | REVIEW_API-2 |
| `apps/agent/internal/projectlog/store.go` | REVIEW_API-2 |
| `apps/agent/internal/projectlog/sink_test.go` | REVIEW_API-2 |
| `apps/agent/internal/projectlog/store_test.go` | REVIEW_API-2, REVIEW_API-3 |
| `agent-contract/inner/agent-runtime.md` | REVIEW_API-3 |
| `agent-contract/inner/iop-agent-cli-runtime.md` | REVIEW_API-3 |
| `agent-task/m-iop-agent-cli-runtime/21+13,17,20_project_log_sink/CODE_REVIEW-cloud-G10.md` | REVIEW_API-1, REVIEW_API-2, REVIEW_API-3 |

## Final Verification

Run from `/config/workspace/iop-s0`. Fresh Go execution is required; cached test results are not acceptable.

```bash
command -v go
go version
go env GOROOT
gofmt -w packages/go/agenttask/types.go packages/go/agenttask/state_machine.go packages/go/agenttask/manager.go packages/go/agenttask/reconcile.go packages/go/agenttask/review.go packages/go/agenttask/state_machine_test.go packages/go/agenttask/manager_integration_test.go apps/agent/internal/projectlog/sink.go apps/agent/internal/projectlog/store.go apps/agent/internal/projectlog/sink_test.go apps/agent/internal/projectlog/store_test.go
test -z "$(gofmt -d packages/go/agenttask/types.go packages/go/agenttask/state_machine.go packages/go/agenttask/manager.go packages/go/agenttask/reconcile.go packages/go/agenttask/review.go packages/go/agenttask/state_machine_test.go packages/go/agenttask/manager_integration_test.go apps/agent/internal/projectlog/sink.go apps/agent/internal/projectlog/store.go apps/agent/internal/projectlog/sink_test.go apps/agent/internal/projectlog/store_test.go)"
go test -count=1 ./packages/go/agenttask -run 'TestEventDeliveryCheckpoint|TestEventIdentity|TestManagerEventDelivery|TestReview'
go test -count=1 ./apps/agent/internal/projectlog -run 'TestSinkPendingDelivery|TestSinkReplay|TestStoreEventReplay|TestStoreRejectsLogical'
go test -count=1 -race ./packages/go/agenttask ./apps/agent/internal/projectlog -run 'TestManagerEventDelivery|TestS12LoopParallelArchiveMatrix'
go test -count=1 ./packages/go/agenttask ./apps/agent/internal/projectlog
go test -count=1 ./packages/go/...
go test -count=1 -race ./packages/go/agenttask ./apps/agent/internal/projectlog ./packages/go/agentstate
go vet ./packages/go/... ./apps/agent/internal/projectlog
rg --sort path -n 'pending delivery|stable logical event|TestManagerEventDelivery|TestS12LoopParallelArchiveMatrix|project-logs' agent-contract/inner/agent-runtime.md agent-contract/inner/iop-agent-cli-runtime.md
git diff --check
```

Expected:

- preflight resolves `/config/.local/bin/go`, `go1.26.2 linux/arm64`, and `GOROOT=/config/opt/go`;
- every focused/full/platform-common/race test exits `0` with fresh `ok` output;
- vet, formatting, and `git diff --check` are clean;
- the deterministic contract search names pending delivery, stable logical replay, manager delivery tests, the S12 matrix, and `project-logs`.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
