fix: preserve Deep Scan findings across terminal failures - #617

Summary

Deep Scan could lose accepted worker output when reduction or terminal publication did not complete, and the CLI could replace a stored terminal failure with a completion-state error. This change checkpoints and reconciles partial results so incomplete scans remain inspectable without being reported as complete.

Changes

• Forward the original scan instructions into Deep Scan worker context and stop retrying deterministic missing-path worker failures.
• Checkpoint accepted worker and reducer output, then reconcile current results, historical finding versions, and deferred coverage during terminal recovery.
• Persist and publish failed, canceled, and interrupted scan results while keeping their coverage incomplete and their terminal status explicit.
• Report the stored Deep Scan failure when completion preparation observes an already-terminal scan, collapse matching worker-local refinements into canonical findings, and keep successful completion bound to the canonical draft rather than superseded checkpoints.
• Add append-only workbench migrations and behavioral coverage for reducer recovery, stopped scans, publication state, and existing database upgrades.

Testing

• bun test --timeout 30000 ./tests-ts --seed 12345 — 1,646 passed, 30 platform/integration skips, 0 failed
• Late-checkpoint regression coverage verifies that failed and interrupted terminal seals keep their manifest, findings artifact, and indexed finding count unchanged.
• Completion regression coverage verifies that the canonical nine-finding draft does not grow to 13 by promoting superseded checkpoints.
• Legacy-seal regression coverage verifies that a transient publication failure leaves source freezing retryable and preserves the restored finding.
• Worker-instance coverage verifies that distinct identity instances from one worker candidate remain separate findings.
• Cancellation coverage verifies that a transiently failed initial publication is retried by get-scan and preserves the saved finding.
• pnpm run types
• pnpm run format
• pnpm run build
• CLI-only Deep Scan E2E exercised terminal recovery, checkpoint/history preservation, deferred coverage, new-process readback, and JSON/SARIF export. Successful reducer completion was not exercised in that run.

Risk and rollout

The change affects Deep Scan orchestration, recovery, and persisted workbench state. Database migrations are append-only, recovered scans retain partial coverage, and no public CLI arguments or defaults change. Release validation should verify both successful completion and terminal recovery from an existing database.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

Change impact

Preserve canonical completion findings and freeze checkpoint evidence for explicitly incomplete terminal Deep Scan results.

flowchart LR
  subgraph column_0["Scan input"]
    direction TB
    node_0["Original scan instructions<br/><code>CodexSecurity.scan</code>"]
  end
  subgraph column_1["Terminal recovery"]
    direction TB
    node_1["Fail or interrupt Deep Scan<br/><code>fail_deep_scan_locked</code>"]
    node_2["Reconcile saved checkpoints<br/><code>merge_saved_results</code>"]
  end
  subgraph column_2["Stored result"]
    direction TB
    node_4["Canonical completed result<br/><code>merge_saved_results</code>"]
    node_3["Immutable partial result<br/><code>preserve_scan_results_locked</code>"]
  end
  node_0 -->|"registered with scan"| node_1
  node_1 -->|"starts recovery"| node_2
  node_2 -->|"freezes and seals"| node_3
  node_2 -->|"ignores superseded drafts"| node_4
  class node_0 context
  class node_1 changed
  class node_2 changed
  class node_3 affected
  class node_4 affected
  classDef changed fill:#d7f5e5,stroke:#237a4b,color:#111
  classDef affected fill:#e6f0ff,stroke:#3569a8,color:#111
  classDef context fill:#f2f3f5,stroke:#6e7781,color:#111

Limits: Recovered terminal scans remain explicitly failed, canceled, or interrupted with partial coverage. · The CLI E2E run covered terminal recovery and exports; successful completion is covered by the local behavioral regression test rather than that live run. · GitHub CI for the current head must still complete before merge.