Module outbox_settle 

Terminal-workflow outbox settlement sweep for boot and shard adoption (#253). Terminal-workflow outbox settlement sweep (#253).

The durable outbox table — not any in-memory cache — is the source of truth for what may still be delivered, so it must be kept consistent with workflow terminality. The Recorder settles a workflow’s live rows at terminal-record time (the live window); this module is the BOOT/ADOPTION backstop for the restart window the incident fell through: a workflow that reached a durable terminal without its rows being settled (a settle-hook store error, or a node that died between the terminal append and the settle) must have those rows retired BEFORE the dispatcher’s first claim, or a redialed worker serves a full zombie round for a dead workflow.

Liveness is projected from event history with the SAME projection list_active and pause validation use ([status_from_events]) — NOT list_active membership, which would wrongly classify Paused runs (live, merely held) as dead. Only the four hard terminals settle; ContinuedAsNew never reaches the settle set because a continued chain’s later WorkflowStarted projects the chain Running, and a chain whose replacement run has not started yet is still in flight.

Functions

is_settle_terminal

Whether status is a settle-eligible workflow terminal: the four hard terminals, never ContinuedAsNew (the workflow continues) and never Paused/Running (live).

settle_terminal_outbox_rows

Settle every terminal workflow’s live outbox rows to Cancelled, returning the settled dispatch_keys (#253).