truf-server/docs/defect-terminal-status-scan-deadline-readback-2026-09-25.md

Terminal assignment status loses the durable scan deadline

Status: open and reproducible on the live sec validation cohort.

Impact

GET /api/v1/worker/assignments/{reservation_id} can return deadlines.scan_deadline_at: null for a resolved assignment even though the durable terminal receipt contains the concrete scan deadline. The same response labels the deadline set as immutable, so replay no longer faithfully exposes the receipt that was committed at bundle acceptance.

Receipt, payload, scan-event, diagnostic, and reservation identities remain correct. The loss is limited to terminal status readback of the scan deadline.

Live evidence

The accepted Linux assignment used for this check had:

• a durable bundle_accepted receipt with a concrete scan_deadline_at;
• a later persisted awaiting_receipt progress event with scan_deadline_at: null;
• a successful authenticated status response whose terminal receipt fields all matched PostgreSQL, except that scan_deadline_at had become null.

The complete API response is retained locally as D:\truf\worker-linux-terminal-status-raw.json with SHA-256 0954e40b4ccb6921bbd572abb3d4898ee56e2955345de21ed7df5f85177536d1. The durable receipt is retained in build/live-trace-20260925/raw-evidence-expanded.json.

Root cause

ScannerDB.remote_assignment_status() loads the durable receipt and then calls result.update(observability) (app/scanner_db.py around lines 16707-16710). The observability object reconstructs its complete deadlines object from the latest progress row. Its scan_deadline_at comes only from event.get('scan_deadline_at') (app/scanner_db.py around lines 16588-16605).

Consequently, a later progress event with a null scan deadline replaces the entire deadline object stored in the terminal receipt. This is a readback merge problem; the persisted receipt itself is unchanged and correct.

Expected correction

For resolved assignments, preserve the durable receipt's immutable deadline object while overlaying only live observability fields such as latest progress, known reason, and diagnostic authority. Add PostgreSQL regression coverage where the accepted receipt has a concrete scan deadline and a later progress event has a null deadline.