@@ -130,13 +130,16 @@ executed accidentally.
       unless `controlPlane.store=postgres` and `serving.backend=clickhouse` —
       see ADR 0010. Slice 6 (2026-07-04) released the enum ratchet to
       `[embedded, postgres]`.)*
-- [ ] **LIVE verify (kind, Docker — attempted on the Mac 2026-07-06, genuinely
-      incomplete):** `scripts/k8s_staging_up.sh` on kind with the scale
-      overlay, `k8s_smoke_test.sh` green, `replicaCount: 2` schedules without
-      PVC contention; **plus the ADR 0010 replica-correctness checks** —
-      exactly one delivery per (webhook, event) across two pods, one alert
-      page per incident, a webhook registered via either pod visible to both.
-      See the recipe below.
+- [x] **LIVE verify (kind, Docker) — DONE 2026-07-11.** The two-real-pods
+      replica-correctness proof passes on a freed VM: `replicaCount: 2` scheduled
+      without PVC contention, both pods on the postgres store, and a webhook
+      registered via the Service was visible on all 8 round-robin reads across the
+      two pods (no split-brain) — `scripts/k8s_replica_correctness_verify.sh`
+      Checks 1–2, exit 0. Canon: `docs/perf/e4-replica-topology-2026-07-11.md`.
+      Exactly-one delivery / one-alert-per-incident are covered at the store level
+      (31/31, slice-5 PG probe); their two-pod emission harness is the remaining
+      optional layer. First attempted 2026-07-06 and blocked by host resource
+      contention — kept below as honest history.
       *(Chart-side render verified locally 2026-07-04 via `helm template`/
       `lint`, and re-verified live-adjacent on the Mac 2026-07-06: `helm lint`
       clean; `helm template --set replicaCount=2 --set persistence.enabled=false`
 
@@ -0,0 +1,64 @@
+# E4 — two-real-pods replica-correctness topology proof (kind)
+
+> Executed: `2026-07-11` on `deproject-mac` (kind + Docker on Colima vz, 6 GiB / 4 CPU,
+> macOS 13.7.8 Intel). Code: `main` @ `9935bdc`.
+> Closes the cutover-plan Phase 3 item that was **attempted-but-blocked on 2026-07-06**
+> (shared-host resource crisis — kube control-plane crash-loop, build stall). This run
+> freed the VM first and completed the proof.
+
+## Result
+
+`scripts/k8s_replica_correctness_verify.sh` → **exit 0, both checks PASS**:
+
+- **[Check 1] ≥2 ready pods on the postgres store** — `deployment/agentflow` 2/2 Ready,
+  every pod carries `AGENTFLOW_CONTROLPLANE_STORE=postgres`.
+- **[Check 2] cross-pod registration visibility** — one webhook registered through the
+  Service (`webhook_id=4a4709a0-0bdc-42bc-803a-2d49c1fb8f04`) was visible on **all 8
+  round-robin reads across the two pods**. On the embedded per-pod store a read served by
+  the pod that did not register would miss it (the sharpest split-brain, ADR 0010 class 5);
+  on PostgreSQL the single registration table makes every read see it.
+
+Checks 2–3 in the recipe (exactly-one delivery per (webhook,event); one alert page per
+incident) need an event/alert emitter + capture sink and are not part of this automated
+script. Their **store-level guarantee** (idempotent enqueue insert-win, single-flight
+`claim_alert_tick`, outbox↔dead-letter atomicity) is already live-verified 31/31 by the
+slice-5 standalone-PostgreSQL probe suite (`docs/perf/control-plane-pg-verify-2026-07-03.md`).
+Phase 3 adds only the two-real-pods topology layer on top — done here.
+
+## Topology stood up
+
+- kind cluster `agentflow-staging` (`kindest/node:v1.31.0`), `k8s/kind-config.yaml`
+  (NodePort 30080 → host 8080).
+- Chart: `helm/agentflow` with `-f values-staging.yaml -f values-staging-scale.yaml.example`
+  `--set serving.clickhouse.user=agentflow` →
+  `replicaCount=2`, `persistence.enabled=false` (stateless request path),
+  `serving.backend=clickhouse`, `controlPlane.store=postgres`.
+- In-cluster deps (the chart ships neither PG nor CH): single-replica **PostgreSQL 16**
+  (`agentflow-postgres`, control-plane store), **ClickHouse 24.8** (`agentflow-clickhouse`,
+  serving backend), **Redis 7.4** (`agentflow-redis`, rate limit) + the two operator secrets
+  `agentflow-controlplane-pg` (keyword-form DSN) and `agentflow-clickhouse`.
+- Pods reach Ready without Kafka/Flink: `/v1/health` returns 200 with degraded components
+  (each `HealthCollector` check is defensive), so readiness is process-up, not dependency-up.
+
+## Environment gotchas found this run (Mac stand)
+
+- The docker data disk (`/dev/vdb1`, ~59 G) is **separate from the VM root** (`/`, ~19 G):
+  the first build died `[Errno 28] No space left on device` at the *pip install* step with
+  the docker disk at 96 %, while `df /` still showed 18 G free. Freed it by removing the
+  orphaned old DE-compose **named** volumes (`agentflow-docker-check_{clickhouse,kafka,minio}-data`,
+  `…_flink-checkpoints`) — never `docker volume prune`/`system prune`, which would also
+  delete co-tenant data (`rag_support_assistant_pgdata`, anonymous datalens/auto_bi volumes)
+  and the stopped co-tenant containers themselves.
+- The rendered Service takes an auto-assigned nodePort; patch it to **30080** so kind's
+  fixed host mapping (`30080 → 127.0.0.1:8080`) reaches it, then `BASE_URL=http://127.0.0.1:8080`.
+- Right after the nodePort patch, `curl` can time out for a few seconds until kube-proxy
+  rewires the mapping — the verify script (run a moment later) succeeds.
+- kind + a 2-replica agentflow + PG + CH + Redis fits in 6 GiB **only with the co-tenant
+  containers stopped** (DataLens ×7 + auto_bi). The 2026-07-06 failure was exactly this
+  contention; free the VM first (stop co-tenants, prune orphaned DE volumes/images), and
+  return the co-tenants on teardown.
+
+## Teardown
+
+`kind delete cluster --name agentflow-staging`; co-tenant containers restarted from the
+snapshot (`/tmp/agentflow_foreign_stopped.txt`). VM returned to ~5.3 GiB available.
@@ -157,7 +157,7 @@ Metric-cache drops are **push-driven**, not hostage to the webhook loop.
 |---|---|---|
 | **Push** | After a successful apply the bridge publishes on Redis channel `agentflow:cache:metrics_invalidate` (payload `{"event_ids":[…]}`). Every API pod's `MetricCacheController` is subscribed and runs `QueryCache.invalidate_metrics()`. | Primary path for the bridge (standalone and in-process). |
 | **In-process callback** | `ServingBridge(..., on_batch_applied=callback)` — the API schedules a local invalidate on the event loop so the DuckDB arm does not wait for the pub/sub round-trip. | Same-process only. |
-| **Journal scan fallback** | `MetricCacheController` polls `QueryEngine.fetch_pipeline_events` independently of `WebhookDispatcher` — a `newest_first` window of 200 rows (`journal_scan_fetch`), so detection stays O(window) and correct however large the journal grows. | Writers that do not push (node-ingest, seed); also covers `webhook_dispatcher_autostart=False`. |
+| **Journal scan fallback** | `MetricCacheController` polls `QueryEngine.fetch_pipeline_events` independently of `WebhookDispatcher` — a `newest_first` window of 2000 rows (`journal_scan_fetch`), sized to hold the tail a non-pushing writer can produce between two passes at the ≥100 eps target (~2 physical rows/event pre-merge), so detection stays O(window) and correct however large the journal grows. | Writers that do not push (node-ingest, seed); also covers `webhook_dispatcher_autostart=False`. |
 
 The historical monkey-patch that wrapped `WebhookDispatcher.dispatch_new_events`
 in `main.py` is gone. Webhooks keep their own scan for delivery; cache
@@ -188,10 +188,11 @@ now bounded:
   inserted rows) and a redundant metric-cache invalidate just repopulates on
   the next read.
 - **Cache scan fallback** — the lifespan used to wire an *ascending* limited
-  scan: the oldest 200 rows, a window that stops changing once the journal
+  scan: the oldest rows, a window that stops changing once the journal
   outgrows it, which silently disabled scan-driven invalidation on grown
   journals (push kept the soak honest). `journal_scan_fetch` reads the tail
-  window instead.
+  window instead, and it is sized (`DEFAULT_SCAN_WINDOW_ROWS = 2000`) to hold a
+  full ≥100 eps burst between two passes rather than clip it.
 - **SSE stream** (`/v1/stream/events`) — the per-connection dedup cache is a
   `BoundedSeenSet` too (was a bare set growing one entry per distinct event
   for the connection's lifetime). Eviction cannot re-emit: the scan window is
 
@@ -217,8 +217,19 @@ def mark_existing_events_seen(self) -> None:
             if event_id:
                 self.seen_event_ids.add(_seen_event_key(event))
         if events:
-            # newest_first — the first row is the journal tail.
-            self._scan_cursor = _cursor_timestamp(events[0]) or self._scan_cursor
+            # newest_first — seed the cursor from the newest row whose
+            # processed_at parses. If the very newest row's timestamp is
+            # malformed, fall back to the next parseable row rather than
+            # leaving the cursor None: a None cursor makes the next scan fetch
+            # with min_processed_at=None (from the oldest journal row), which
+            # re-delivers the whole batch we just seeded (audit #185, defensive
+            # seed-edge). All rows in this batch are already in the seen-set, so
+            # advancing to any of their timestamps drops nothing.
+            for event in events:
+                seeded = _cursor_timestamp(event)
+                if seeded is not None:
+                    self._scan_cursor = seeded
+                    break
 
     async def dispatch_new_events(self) -> None:
         webhooks = [webhook for webhook in load_webhooks(self.app) if webhook.active]
@@ -246,7 +257,13 @@ async def dispatch_new_events(self) -> None:
         ):
             event_id = str(event.get("event_id") or "")
             seen_key = _seen_event_key(event)
-            if not event_id or event_id in self.seen_event_ids or seen_key in self.seen_event_ids:
+            # Dedup is keyed on ``seen_key`` (``tenant:event_id``) — the only
+            # shape the seen-set ever stores (see mark_existing_events_seen and
+            # the add below). A bare-``event_id`` membership test never matched
+            # and dropped here as dead (audit #184); cross-tenant collisions on
+            # the same event_id must stay distinct, so the namespaced key is the
+            # correct and only check.
+            if not event_id or seen_key in self.seen_event_ids:
                 # Handled earlier (or unidentifiable — nothing to retry): let
                 # the cursor move over it so a frontier of already-seen rows
                 # cannot pin the scan window.
 
@@ -37,10 +37,16 @@
 # How often the journal fallback re-scans when no push has landed.
 DEFAULT_SCAN_INTERVAL_SECONDS = 2.0
 
-# One scan window: enough to always contain the journal tail between two
-# 2-second passes with an order of magnitude to spare (87 eps measured × 2 s
-# ≈ 175 rows), small enough to stay O(1) against a journal of any size.
-DEFAULT_SCAN_WINDOW_ROWS = 200
+# One scan window must contain every journal row that lands between two
+# 2-second passes, or the newest-first window slides past the middle of a
+# burst and a non-pushing writer's events are never marked seen. Sizing at the
+# ≥100 eps target, with the journal's pre-merge ReplacingMergeTree emitting
+# ~2 physical rows per applied event: 100 eps × 2 rows × 2 s ≈ 400 tail rows,
+# so 2000 keeps a ~5× margin (the earlier 200 left none — 87 eps already
+# produced ~350 physical rows/pass). Still O(window) against a journal of any
+# size. Push feeds (bridge apply) cover writers that publish; this window is
+# the fallback that must not silently under-scan the ones that do not.
+DEFAULT_SCAN_WINDOW_ROWS = 2000
 
 # Dedup memory cap. Eviction is harmless here: a re-detected old event only
 # causes one redundant invalidate, and the metric cache repopulates on the
 
@@ -445,6 +445,51 @@ async def test_seen_set_stays_bounded_across_scans() -> None:
         conn.close()
 
 
+def test_mark_existing_seeds_cursor_past_a_malformed_newest_timestamp() -> None:
+    # Defensive seed-edge (audit #185): if the newest journal row's processed_at
+    # does not parse, the cursor must fall back to the next parseable row rather
+    # than stay None. A None cursor makes the first dispatch fetch with
+    # min_processed_at=None (from the oldest journal row) and re-deliver the
+    # whole batch mark_existing_events_seen just marked seen.
+    events = [
+        {"event_id": "new", "tenant_id": "acme", "processed_at": "not-a-timestamp"},
+        {"event_id": "mid", "tenant_id": "acme", "processed_at": "2026-07-10 10:00:05"},
+        {"event_id": "old", "tenant_id": "acme", "processed_at": "2026-07-10 10:00:00"},
+    ]
+    app = SimpleNamespace(
+        state=SimpleNamespace(
+            query_engine=SimpleNamespace(fetch_pipeline_events=lambda **kwargs: list(events))
+        )
+    )
+    dispatcher = WebhookDispatcher(app)
+
+    dispatcher.mark_existing_events_seen()
+
+    # newest row's ts is malformed -> cursor falls back to the next parseable row
+    assert dispatcher._scan_cursor == "2026-07-10 10:00:05"
+    # every row is marked seen regardless of ts validity (id-keyed, not ts-keyed)
+    assert dispatcher.seen_event_ids == {"acme:new", "acme:mid", "acme:old"}
+
+
+@pytest.mark.asyncio
+async def test_dispatch_does_not_dedup_same_event_id_across_tenants() -> None:
+    # Dedup is strictly on tenant:event_id (audit #184 removed the dead bare
+    # `event_id in seen` check). The same event_id already seen for one tenant
+    # must not suppress that id for another tenant — they are distinct events.
+    conn = _journal_conn([("e1", "other", "order.created", "2026-07-10 10:00:00")])
+    try:
+        dispatcher = WebhookDispatcher(_stub_app(conn))
+        dispatcher.seen_event_ids.add("acme:e1")  # same id, different tenant, already seen
+
+        await dispatcher.dispatch_new_events()
+
+        # 'other:e1' is processed (marked seen) despite 'acme:e1' being seen
+        assert "other:e1" in dispatcher.seen_event_ids
+        assert dispatcher._scan_cursor == "2026-07-10 10:00:00"
+    finally:
+        conn.close()
+
+
 def test_delivery_logs_roundtrip() -> None:
     conn = duckdb.connect(":memory:")
     try: