Sub-scope 08 (mongo) changestream - execution probes
revision=a24ece9cf797f7ea647e33bf846b115208ed1ba5
generatedAt=2026-08-30T00:18:23+00:00

Two temporary probe classes were added, run, and removed (both @Tag mongodb-contract,
hermetic - reactor and the platform's own types only, no server):
  src/test/.../changestream/Ss08PipelineProbe.java
  src/test/.../changestream/Ss08FailoverProbe.java
No production source was modified. git status after removal is shown at the end.

All three probes assemble the consumer exactly as MongoPlatformAutoConfiguration does:
  new ReactiveMongoChangeStreamConsumer(subscription, source, checkpoints, tokens,
      new MongoChangeStreamPipeline(new MongoChangeStreamRunner(projector, dedup, checkpoints)),
      new MongoChangeStreamRecoveryPolicy(), new MongoInvalidateRecovery())

=== PROBE C (the decisive one): a failover while an event is still projecting ===
One worker. Deduplication always grants the claim - no BUSY anywhere.
Stream 1 delivers E (cluster time 5.1); the projector takes 200ms; at 50ms the stream
fails with a resumable driver error (errorLabels=[ResumableChangeStreamError], code 133).
Stream 2 is what the server would resume: E redelivered (the checkpoint never moved past
it), then F (cluster time 6.1).

PROBE-C terminal=COMPLETED opens=2
PROBE-C projector started=2 completed=1
PROBE-C results=[MongoChangeProjectionResult[outcome=APPLIED, detail=]]
PROBE-C checkpoints saved=[token-6]
PROBE-C highWaterMark=6.1
PROBE-C state=RUNNING runbook=

Reading: E's projection was started and cancelled by the failover. On resume the pipeline
dropped the redelivered E because its cluster time no longer advances the high-water mark,
which had been moved to 5.1 on E's FIRST delivery - before any projection ran. F was then
projected and checkpointed, carrying the stored position past E. E is now unreachable: the
change stream never replays what the checkpoint has passed. The subscription reports state
RUNNING with an empty runbook and the caller's Flux completes normally.

=== PROBE A: the same loss via a BUSY claim plus a resumable failure ===
PROBE opens=2
PROBE claims=[BUSY, CLAIMED]
PROBE projected events=[token-6]
PROBE checkpoints saved=[token-6]
PROBE results=[CLAIMED_ELSEWHERE, APPLIED]
PROBE pipeline highWaterMark=6.1
PROBE token-5 projected? false ; checkpoint moved past it? true

=== PROBE B: no failure at all - a later event carries the checkpoint past a BUSY one ===
One healthy stream, no failover, no resume.
PROBE-B opens=1 claims=[BUSY, CLAIMED]
PROBE-B results=[CLAIMED_ELSEWHERE, APPLIED]
PROBE-B checkpoints saved=[token-6]
PROBE-B busy event token-5 checkpointed? false ; checkpoint now past it? true

Reading: MongoChangeProjectionResult.busy() states the invariant - 'The checkpoint must not
advance past it: the holder may still fail, and a checkpoint that has passed the event is a
change the stream will never replay.' MongoChangeStreamRunner honours it for that event;
the next successful event's checkpoint write moves the stored position past it anyway.

=== PROBE D: the invalidate guard compares a value with itself ===
PROBE requireCorrectResumeOption(cp, cp.position()) -> PASSED (the only call shape in production)
PROBE requireCorrectResumeOption(cp, RESUME_AFTER) -> REJECTED IllegalStateException
        (no production call passes a differing intent)

=== source tree after probe removal ===
$ git status --short | wc -l
0
exit=0

$ git status --short
exit=0