Migrate, Reconcile, and Prove the Gateway

Day 02 established versioned connector configuration, Day 07 separated secret references from values, and Day 08 made credential versions authoritative. A bulk copy can still lose updates that arrive during migration, resurrect deletions, or echo mirrored writes back to their source. Today you will finish the Atlas Connector Lab with an ordered transactional outbox, idempotent application, tombstones, quarantine, reconciliation, rollback, and structured evidence.

The capstone proves a bounded local mechanism, not production availability, durability, isolation, or universal correctness. Its local processes share one machine, network, disk, clock, and operator session.

The source transaction locks one per-stream cursor, allocates the next sequence, updates connector state, and appends an outbox event before committing. That serialization makes sequence order match commit visibility; a database sequence alone would not, because a later transaction can commit first. The migration worker consumes only the contiguous committed prefix and pauses at a missing head. Each event carries an idempotency key, entity version, origin, and operation. Deletes become tombstones so a delayed upsert cannot resurrect them.

BEGIN;
SELECT next_seq FROM migration_stream WHERE stream_id = 'connector' FOR UPDATE;
UPDATE connector_config
SET version = version + 1, updated_at = CURRENT_TIMESTAMP
WHERE connector_id = 'calendar-lab';
INSERT INTO connector_outbox(event_id, source_seq, connector_id, entity_version, operation, origin)
VALUES ('evt-1042', 1042, 'calendar-lab', 8, 'upsert', 'source');
UPDATE migration_stream SET next_seq = 1043 WHERE stream_id = 'connector';
COMMIT;

{
  "eventId": "evt-1043",
  "sourceSeq": 1043,
  "connectorId": "calendar-lab",
  "entityVersion": 9,
  "operation": "delete",
  "tombstone": true,
  "origin": "source"
}

The target applies each event once by eventId, rejects a lower entity version, and never emits a source-origin event back into the mirror. A schema-invalid or referentially impossible event enters quarantine with its sequence and reason; processing cannot silently skip it and declare parity.

if (await target.hasApplied(event.eventId)) return "duplicate_ignored";
if (event.origin !== "source") return "echo_rejected";
if (event.entityVersion < target.currentVersion(event.connectorId)) return "stale_rejected";
return target.applyAndRecord(event);

{
  "credentialMigration": "references-only",
  "sourceReference": "vault://calendar-lab/grants/grant-d04",
  "targetBindingValidated": true,
  "rawSecretCopiedIntoLog": false
}

Credential migration copies references or rebinds managed records; the ordered log never carries token or secret values. A rotated version observed during dual-run must reconcile to the authoritative vault version from Day 08.

Reconciliation compares connector IDs, versions, tombstones, credential-reference bindings, last applied source sequence, quarantined events, and a bounded set of live reads. Cutover requires zero unexplained differences, zero open quarantine, all consumers at the barrier sequence, and an executable rollback route.

{
  "receipt": "SCG-R09",
  "barrierSourceSeq": 1100,
  "unexplainedDiffs": 0,
  "openQuarantine": 0,
  "duplicateEventsIgnored": 1,
  "echoEvents": 0,
  "resurrectedDeletes": 0,
  "rollbackProbe": "passed"
}

The normal path backfills, applies concurrent update/delete/credential-rotation events, reaches the barrier, and cuts over. The denial path leaves one quarantined invalid event and must hold. Recovery repairs or explicitly rejects that event under review, replays from its sequence, and reconciles again. An unmigrated connector is the unaffected positive control. Cleanup returns routing to the chosen owner, stops mirror workers, removes disposable target data, and retains the redacted capstone bundle.

Given the complete reconciliation receipt and fixed invariants, choose only proceed or hold, naming one violated invariant when holding. Any unexplained diff, open quarantine, consumer behind the barrier, secret in the log, echo, or failed rollback probe requires hold. With all invariants satisfied, proceed is the deterministic result.

The misconception is “matching row counts prove migration.” Replay a tombstone lost behind an equal row count to show why ordered versions and semantic reconciliation matter. Decline subjective confidence scores, independent cursor comparisons, or production-certification claims.

SCG-R09 bundles SCG-R01 through SCG-R08, the source checksum, registration and grant policy, redaction proof, refresh ledger, ordered outbox barrier, reconciliation report, denial and recovery records, positive control, rollback probe, and cleanup. It proves only the observed lab paths. The reusable rule is simple: admit a connector only when each trust transition has one owner, one authoritative state, one bounded failure response, and reproducible evidence.