From ab61379b467cb76140d9791e362b87accc27b3ff Mon Sep 17 00:00:00 2001
From: JorisJonkers Agent <agents@jorisjonkers.dev>
Date: Sun, 12 Jul 2026 13:00:31 +0000
Subject: [PATCH 1/2] feat(job-workload): add ttlSecondsAfterFinished:3600 to
 rendered Job manifests

Adds ttlSecondsAfterFinished: 3600 to all batch/v1 Job manifests rendered
by the kubernetes-workload-fragment adapter. This implements Option B of
the job-name-uniqueness decision (DECISIONS.md 2026-07-12): completed Jobs
are automatically cleaned up after one hour, allowing Flux to re-apply a
new Job on the next reconciliation without AlreadyExists conflicts.

The TTL value (3600 s) is chosen to exceed the Flux reconciliation interval
plus health-check scrape window, ensuring Flux can observe Job completion
before the resource is deleted.

Updates the golden render hash to reflect the new Job spec shape.
---
 src/adapters/kubernetes-workload-fragment.ts | 8 ++++++++
 test/fixtures/golden/render-hash.txt         | 1 +
 test/fragment-engine.test.js                 | 3 +++
 3 files changed, 12 insertions(+)
 create mode 100644 test/fixtures/golden/render-hash.txt

diff --git a/src/adapters/kubernetes-workload-fragment.ts b/src/adapters/kubernetes-workload-fragment.ts
index 1f46f01..952d9fa 100644
--- a/src/adapters/kubernetes-workload-fragment.ts
+++ b/src/adapters/kubernetes-workload-fragment.ts
@@ -118,6 +118,13 @@ function buildWorkloadManifest(workload: WorkloadV2, ns: string, images: Record<
   };
 }
 
+/** TTL after job completion (Option B decision). Allows Flux to re-apply a
+ *  new Job after the previous one is automatically cleaned up, avoiding
+ *  AlreadyExists conflicts on reconciliation. Value must exceed the Flux
+ *  reconciliation interval + health-check scrape window; 3600 s (1 h) is
+ *  the owner-decided value (DECISIONS.md 2026-07-12). */
+const JOB_TTL_SECONDS_AFTER_FINISHED = 3600;
+
 function buildJobManifest(workload: WorkloadV2, ns: string, images: Record<string, string>): K8sManifest {
   const podSpec: Record<string, unknown> = {
     serviceAccountName: workload.name,
@@ -135,6 +142,7 @@ function buildJobManifest(workload: WorkloadV2, ns: string, images: Record<strin
     kind: "Job",
     metadata: { name: workload.name, namespace: ns, labels: jobLabels(workload) },
     spec: {
+      ttlSecondsAfterFinished: JOB_TTL_SECONDS_AFTER_FINISHED,
       template: { metadata: { labels: jobLabels(workload) }, spec: podSpec },
     },
   };
diff --git a/test/fixtures/golden/render-hash.txt b/test/fixtures/golden/render-hash.txt
new file mode 100644
index 0000000..9e40acb
--- /dev/null
+++ b/test/fixtures/golden/render-hash.txt
@@ -0,0 +1 @@
+sha256:14c2eeef572362b1d47c4eebd276cd8e1c37397aa6f26b15b2c0bdc17ae1c8be
diff --git a/test/fragment-engine.test.js b/test/fragment-engine.test.js
index 474faf1..8c89499 100644
--- a/test/fragment-engine.test.js
+++ b/test/fragment-engine.test.js
@@ -522,6 +522,9 @@ test("job workload: kubernetes fragment renders batch/v1 Job with migration labe
   assert.equal(job.metadata.labels["app.kubernetes.io/component"], "migration",
     "Job must carry app.kubernetes.io/component=migration for prune-guardrails");
   assert.equal(job.spec.template.spec.restartPolicy, "Never");
+  // TTL: Option B (owner decision 2026-07-12) — completed jobs must be cleaned up automatically
+  assert.equal(job.spec.ttlSecondsAfterFinished, 3600,
+    "Job must carry ttlSecondsAfterFinished:3600 so Flux can re-apply after cleanup");
   // No PVCs in output
   assert.ok(!rendered.manifests.some((m) => m.kind === "PersistentVolumeClaim"),
     "Job workload must not emit PVCs");

From 00435afdd4889595bcabedc867a9e54f61ff49d0 Mon Sep 17 00:00:00 2001
From: JorisJonkers Agent <agents@jorisjonkers.dev>
Date: Sun, 12 Jul 2026 13:05:00 +0000
Subject: [PATCH 2/2] fix: exclude test/fixtures/golden/ from version control

The golden render hash changes on every version bump (the context digest
embeds schemaVersion), so committing it causes CI failures on release PRs.
This was previously fixed in a23c7cc; re-add the gitignore entry that was
accidentally missing, preventing future reintroduction.
---
 .gitignore                           | 1 +
 test/fixtures/golden/render-hash.txt | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)
 delete mode 100644 test/fixtures/golden/render-hash.txt

diff --git a/.gitignore b/.gitignore
index e2d6002..f31d6a1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@ node_modules/
 npm-debug.log*
 coverage/
 dist/
+test/fixtures/golden/
diff --git a/test/fixtures/golden/render-hash.txt b/test/fixtures/golden/render-hash.txt
deleted file mode 100644
index 9e40acb..0000000
--- a/test/fixtures/golden/render-hash.txt
+++ /dev/null
@@ -1 +0,0 @@
-sha256:14c2eeef572362b1d47c4eebd276cd8e1c37397aa6f26b15b2c0bdc17ae1c8be