Document scheduler migration signal fence gap

[chaptersix]

Problem

An update, patch, trigger, backfill, or delete can be acknowledged at V1 after the migration
snapshot is cloned. Successful destination creation then lets V1 complete without representing
that operation at either scheduler.

Deterministic reproduction

The fixed sequence is snapshot(S0); accept trigger patch; commit S0; migration success; V1 complete. The native control delivers the trigger before the snapshot and retains exactly one
pending action. The counterexample delivers it while the local activity is pending; V1 executes
zero actions, CHASM retains zero actions, and the workflow reports an unread patch signal.

The production trace and rejected drain/forwarding alternatives are commit-pinned in
the signal-fencing note.

Disposition

There is no safe scheduler-only fix. History must seal the exact source incarnation under the
same durable workflow lock used for signal acceptance and return its last accepted-event
watermark. That fence and the staged destination phase must replicate across namespace failover.
Until the cross-service protocol in #44 is implemented and fleet-gated, forward migration should
remain disabled.

Validation

go test -tags test_dep ./service/worker/scheduler \
  -run '^TestMigrationScenario_TriggerBeforeSnapshot$' -count=1

TEMPORAL_RUN_MIGRATION_COUNTEREXAMPLES=1 go test -tags test_dep \
  ./service/worker/scheduler \
  -run '^TestMigrationCounterexample_TriggerDuringSnapshot$' -count=1

Stack

• Parent forward trace: Trace ambiguous workflow-to-CHASM ownership #45
• This PR: signal-fencing evidence
• Next: Fence scheduler rollback destination ownership #47 safe rollback fixes

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T01:03:15.964180Z	75e12fe	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.