dev-procfile/report/05-availability-implementation.md

Availability implementation

Implemented on feat/refactor-v1 on 2026-08-28.

• Added one fail-closed financial availability gate shared by Wallet, Internal Wallet, Market, and transaction workers.
• Normal mode requires healthy GL (including its database) and Kuknos Horizon. network.kuknos-enabled=false is the explicit, startup-time GL-only switch; it never changes automatically.
• Mutation RPCs return gRPC UNAVAILABLE during an outage. Read-only RPCs remain available; unknown future RPCs are treated as mutations.
• Transaction event outbox/inbox workers pause before claiming work. Dependency outages do not dead-letter business events.
• Kuknos subscription blocks its callback during a GL outage so the Horizon cursor cannot advance past an unrecorded external deposit; the streamer pauses entirely when Kuknos is manually disabled.
• GL health now reports not-serving when PostgreSQL is unavailable. Wallet/Market health propagates the gate, and the public API returns HTTP 503 with status=critical.
• Availability transition/recovery logs are structured JSON on stderr for the existing OTel collector. Outages use CRITICAL; recovery uses INFO.
• Added GL to the development Procfile and explicit GL/availability/Kuknos settings to dev, stage, and main service configs.

Verification:

• Wallet: go test ./... passes.
• GL: go test ./... passes (loopback test required the unrestricted runner).
• API health tests pass in an isolated verification copy populated with compatible generated stubs. The checkout itself still requires its normal buf generate build step because domain/stub/go is not committed.

Deployment prerequisite: the compose files still need the actual GL image/service definition and database secret. The config intentionally points to gl:8600; without that service, health is critical and mutations remain halted.

Remaining architectural limit: health preflight closes the known outage path but cannot make a GL write and Kuknos submission atomic. GL-first acknowledged reservation/command processing plus reconciliation is still required for a strict cross-system guarantee.