Repository navigation
refactor: remove every on-disk store migration - #4620
Merged
Merged
Conversation
Items removed: - L097: retention receipts drop the always-zero rollback_floor field and RECEIPT_ROLLBACK_FLOOR; the receipt schema moves to v2. - L098: RetiredCodeTextArtifactDescriptorV1 and the untagged DurableTextArtifactSlotV1; index entries carry the current descriptor directly and every caller reads the field. - L099: pointer and index-entry serde defaults for pre-beta.38 pointers. generation_index_digest is a required String built with the pointer, cardinality is required, and the "older entries" admission arm is gone. - L100: the container serde(default) on ScopeDirectoryIdentityV1. - L101: ambiguous_name_drops is a required u64 in the census, the codec, sparse increments and runtime telemetry. - L102: CodeIndexProductionErrorV1::SourceCommitmentsUnavailable and GraphDbError::SourceCommitmentsUnavailable with their mappings and abstention arms. A sealed manifest without commitments is a contract failure. The planner still holds an Option while it materializes. - L103: the 124K archival partitioned_pre_paging fixture, its Bazel filegroup and gen_builds entry, and the per-revision guard tests. The generic refusal test and the retired-parent test relabel live encoder bytes instead. Retention's revision abstention and the retired-parent no-reuse branch stay: they are the mechanism for every future format revision bump, not old-release compatibility. - L107: the canonical_bytes wire field on ExactTechnicalTermV1. Tests deleted: a_pre_key_text_artifact_descriptor_reads_as_retired_and_is_replaced, a_pointer_sealed_before_segment_bytes_is_corrupt_until_the_store_is_reset, a_pre_segment_bytes_pointer_is_reset_and_rebuilt_by_the_worker, a_census_sealed_before_the_field_decodes_as_not_counted, ambiguity_census_preserves_unknown_parent_count, both_retired_manifest_census_shapes_reach_the_typed_refusal, prior_partitioned_symbol_occurrence_revision_reaches_the_typed_refusal, archival_carrier_revision_is_refused_for_rebuild, the legacy halves of the scope identity and source-commitment tests, and the cardinality-None section of the bounded admission test. Upgrade impact: derived code-index data written by older builds (pre-beta.38 pointers, pre-key text descriptors, censuses without ambiguous_name_drops, chunks with canonical_bytes, receipts with rollback_floor) fails to decode and the code index rebuilds from source. If retention reports UnsafeState on an old receipt or journal, reset the project store. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L074/L114: LogicalCopyRecordV1 decoding no longer defaults a missing knowledge_at to zero or valid_time to Unknown. Both wire fields are required. The store builds copy records from SQL columns, which always carry them. - L078: CandidateCursor and RecordCursor no longer default a missing session_id. Tests deleted: the legacy copy-record decode block in session_contract.rs. Upgrade impact: a JSON copy record without bitemporal fields, or a continuation key minted before session_id existed, fails to decode. No production path stores such JSON copy records. An old continuation key returns a decode error and the caller restarts pagination. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L086: the schema-v1 six-kind artifact chain readability test. - L087: refused-shape reset and rebuild for effect journals and the pending index: reset_refused_shapes_blocking, the unreferenced-journal retirement, the index rebuild, discard_if_refused_blocking and discard_unsupported_journal, JournalShapeProbe, read_or_discard_unsupported_record_blocking, RefusedJournalShape, refused_journal_shape_blocking, PendingAutomationEffectReset, pending_automation_effect_resets_blocking and the Doctor findings. A refused journal now fails project-open recovery with its typed reset_required error. - L091: the run ledger no longer deletes a ledger holding a schema-v1 row or rewrites rows with retired skip-reason aliases. Both are typed reset_required refusals and the ledger is kept. - L104/L150: AutomationRunLedgerRecord.task_key, the ledger row projection, AutomationRunListEntryV1.task_key and AutomationRunRowV1 are required strings. The canonical_task_key fallbacks, the scheduler diagnostic None branches, the dashboard latestRunForTask keyless join and the `task_key ?? task` displays are gone. Contract schema, dashboard types and SDK sources are regenerated. Callers migrated: daemon scheduler logging, CLI run listing, Doctor, recovery reports, lifecycle index, cursor and scheduler diagnostics, and every ledger fixture, which now carries task_key. Tests deleted: schema_v1_six_kind_chain_stays_readable, refused_memory_journal_shape_resets_per_entry_and_recovery_converges, unreferenced_refused_terminal_journal_is_retired_and_its_run_id_reusable, refused_pending_index_shape_rebuilds_from_journals_and_converges, automation_effect_reset_findings_name_each_refused_journal_by_run_id, task_summary_resets_only_a_non_canonical_budget_exhausted_row, run_ledger_locked_read_resets_schema_v1_rfc3339_rows, run_ledger_resets_only_the_row_with_an_unregistered_skip_reason, scheduled_user_job_resets_a_schema_v1_ledger_and_records_a_v2_run, and the keyless dashboard join test. The schema-v1 locked-read test now asserts the typed refusal and that the ledger is kept. Upgrade impact: automation journal and run-ledger reads from older builds fail typed instead of self-healing. Ledgers holding schema-v1 rows, retired skip-reason aliases or rows without task_key, and refused effect journals or pending indexes, block reads until the user deletes dashboard/automation_runs.jsonl and the automation journal directory. SDK consumers see task_key as a required string. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L088: the summary-only skill.json detector and the listing that silently deleted that skill directory. An unreadable record is the ordinary invalid-record config error. - L089: the last-activity fallback for skills activated before baselines existed. A missing activation baseline counts no activity. - L090: the "ignored" alias on SkillOutcomeVerdict::Unknown. - L092: a persisted materialization manifest must carry materialized_by. Only a package re-derived from disk holds None in memory. - L093: refuse_released_body_hash_package; such packages are ordinary user forks. - L094: the released unslugged prompt-index markers and their refusal. - L095: the monolithic skill_usage.json, legacy-imported-events.json and fact_proposals.json/.archive probes. Tests deleted: released_summary_only_record_is_refused_and_the_store_scan_resets_only_it, ledger_without_activation_baseline_uses_last_activity_fallback, stored_ignored_verdict_loads_and_reserializes_as_unknown, released_body_hash_package_is_a_typed_reset_not_a_user_fork, edited_released_body_hash_package_stays_a_user_fork, released_unslugged_prompt_index_is_a_typed_reset_until_deleted, released_fact_proposal_history_is_a_typed_reset_before_reservation, released_monolithic_skill_usage_ledger_is_a_typed_reset, and the stripped-field half of the manifestless project package test. Upgrade impact: an old summary-only skill record or an outcomes snapshot holding "ignored" fails listing until the user removes the reported skill directory or outcomes snapshot. Skills activated under an older build report 0 uses since activation. Old materialization manifests read as missing, so the package stays SkippedForeign in project scope. Old body-hash packages are reported as user forks. Old unslugged AGENTS.md and CLAUDE.md blocks and the retired skill-usage and fact-proposal files stay on disk as inert text and bytes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L085: PR auto-track state decodes managed entries directly. PersistedPrAutotrackState, StaleManagedPr, PrAutotrackState.stale, the reconcile reset_stale report and loop, the CLI "Stale PR branch" line and the Doctor stale warnings are gone. Doctor still fails on an unreadable state file. - L109: HealthSnapshotObservedV1.definition is a required String, and HealthDeltaError::DefinitionUnrecorded with its primitive mapping is gone. - L144: source-edit journals and receipts require verification_requested and failed, and the no-op serde defaults on Option fields are dropped. - L145: the rollback-records directory sweep in lock() and the recovery_files/recovery_digest normalization in load_journal. The journal decodes straight into SourceEditJournalV1. The daemon-protocol inspection fixture names the live str-replace use case. Tests deleted: undecodable_managed_pr_entries_are_scoped_refusals_that_save_state_resets, reconcile_resets_entry_without_head_sha_and_preserves_other_entries, an_unlabeled_released_point_is_refused_and_never_reused_as_after, retired_operation_journal_discards_bodies_and_allows_partial_acknowledgement, malformed_journal_is_preserved_when_obsolete_fields_cannot_be_normalized, the rollback-records assertion and the DefinitionUnrecorded case. The Doctor PR-state test keeps only the blocking-file case. Upgrade impact: a PR auto-track state file holding an old-shape entry fails to load and blocks reconciliation; delete the pr_autotrack state file. An old unlabeled health-delta before_cursor fails as an unknown point; omit before_cursor. Source-edit journals or receipts without verification_requested/failed, or rollback-era journals, fail as invalid; delete <data_root>/source-edit-transactions-v1/active.json. A leftover rollback-records directory is no longer deleted automatically. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L083: the Context Scout pre-provenance and untagged-evidence document reset: document_needs_provenance_reset, has_untagged_candidate_evidence, provenance_reset_required, replace_with_fresh_state, the startup branch and ContextScoutDurableStartupOutcomeV1::Reset with its three match arms. StoredDeliveryAddressV1.entry is required. - L084: the retired writer.v1.lock constant, the writer collision check and its test assertion. - L130: host bundle receipts require created_directories and a created_config Vec. The predates_creation_records flag and branches, tracedecay_namespace_directories, and the Option wrapping in the writer and component-set receipts are gone. Tests deleted: legacy_delivery_provenance_resets_without_replaying_receipts, untagged_candidate_evidence_resets_instead_of_failing_decode, uninstall_after_an_upgrade_removes_tracedecay_residue_and_keeps_unprovable_structure with strip_creation_records, LEGACY_CURSOR_EXTENSION and deposit_legacy_cursor_extension, and the retired-lock assertion. Upgrade impact: Context Scout state from an older release decodes as invalid and reads Unavailable until the project store is reset. A host receipt written before creation records fails to decode, so update and uninstall for that host refuse; run `tracedecay install --yes --adopt` for that host. A stale writer.v1.lock is ignored. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L096: "stores" from the wipe --all profile database paths and from the path_layout profile-authority match, the "legacy" wording in the wipe warning and help, and the stores/ test fixtures (now projects/). - L106: IncidentDebrisKindV1::RetiredBranchStore, RETIRED_BRANCH_STORE_DIRECTORY, is_retired_branch_store_path, the branches/ debris listing and deletion, and the manifestless-store probe. The contract schema is regenerated. - L136: BranchEntry.retired_store_reference and RetiredStoreReference. BranchEntry denies unknown fields, so a db_file key is corrupt metadata. Fixtures use the current shape. - L139: RETIRED_CHECKOUT_LAYOUT_FILES, retired_checkout_layout_dir and refuse_retired_checkout_layout with the identity call, the reset-project-store retired-checkout deletion and its bool parameter, and the help text. get_tracedecay_dir stays for project rule files. The restart-proxy test drops its legacy config fixture, and the failed-mount journey uses an unreadable graph database as its failure. Tests deleted: retired_branch_store_paths_classify_only_directly_under_branches, sweep_never_follows_a_symlinked_retired_branch_directory, sweep_unregistered_stores_collects_retired_branch_store_layout, cold_store_page_deletes_retired_branch_store_and_doctor_is_clean, metadata_naming_the_project_store_opens_and_is_rewritten_without_a_store_reference, every_retired_checkout_layout_file_is_a_typed_project_store_reset, the_profile_root_is_never_a_retired_checkout_layout, first_touch_refuses_a_retired_checkout_enrollment_marker, pending_retired_checkout_reset_admits_a_store_with_nothing_refused, the db_file parse cases and the retired-layout preludes. Upgrade impact: a leftover ~/.tracedecay/stores directory, a store's branches/ directory and a checkout-local .tracedecay/ directory are no longer reported, refused or removed; they stay on disk as debris and the user deletes them by hand. Registry rows still pointing at stores/ lose profile-authority recognition. A branch-meta.json carrying db_file is treated as corrupt until it is regenerated or deleted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L126: admission ledger frame kinds 1 (unordered admitted) and 8 (reconstructed admitted) no longer decode; they are RecordUndecodable. order_reconstructed is gone from LedgerEntry, LogFrame and HookAdmissionLedgerReceiptV1, along with the reconstructed encode and the MCP recovered_native_lifecycle_order branch. The one current test in legacy_continuity.rs moves to lifecycle_policy.rs. - L127/L128 (spool part): PRE_LEDGER_PENDING_WORK_DIR, the MCP pre-ledger probe and refusal, the census arm and the wipe --stale member. The open() refusal of the pre-log ledger shape and its census stay: the census is the only path that lets wipe --stale reset such a ledger. - L129: the retired append_intent field on spool metadata. Callers migrated: the MCP ledger map no longer threads data_root. Tests deleted: legacy_frames_preserve_admission_order_when_rewritten, fresh_saved_edit_runs_after_shipped_compacted_or_header_only_ledger, retained_legacy_receipt_keeps_producer_work_owed_until_execution, missing_or_conflicting_legacy_receipt_stays_owed_through_rewrite_and_restart, a_later_canonical_receipt_truthfully_supersedes_retained_legacy_work, disabled_claude_stop_follows_the_prior_session_cursor_without_minting_lifecycle, pre_ledger_pending_work_is_refused_for_reset_not_adopted, released_metadata_with_an_append_intent_opens_and_drops_it. Upgrade impact: a hook admission ledger holding unordered or reconstructed frames fails to decode, and a spool whose metadata still has append_intent returns ResetRequired(MetadataShape). Reset the project store; hook events not yet committed are lost. A hook-v2-pending-work spool is inert and is no longer reported or wiped; delete it by hand. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L116: the managed_test_runs document_content_digests_json pragma probe and ALTER. The CREATE TABLE already carries the column. - L124: the host_pending stack-delivery state: it leaves the CHECK and the settlement guard, and the normalizing UPDATE, the retired index DROPs and the retired transition-guard DROP are gone. No exact-shape check covers these tables, so existing stores keep their old CHECK text and open as before. - L125: the orphaned released-shape SQL fixtures session-temporal-released-v3-triggers.sql and session-relation-receipts-before-recovery.sql. - L142: the work_placements_v1_exclusive_root DROP and the duplicate-holder quarantine UPDATE. CREATE UNIQUE INDEX work_placements_v1_exclusive_target stays. - L143: migrate_activity_frontier and LEGACY_ACTIVITY_FRONTIER_KEY; the git-correlation version gate already refuses those stores. Tests deleted: a_released_store_gains_document_digests_and_keeps_its_runs, staged_rows_from_an_older_daemon_return_to_pending_on_open, migration_keeps_the_oldest_holder_and_quarantines_later_duplicates, activity_time_positions_migrate_to_a_full_rescan_once. Upgrade impact: a store whose managed_test_runs table predates document digests fails managed test-run writes, and a Work store still holding two holders of one root fails CREATE UNIQUE INDEX at open; reset the affected store. host_pending stack-delivery rows left by an older daemon are never delivered. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed:
- L115: the PRIOR_FINAL, PRE_RESIDUE_FINAL and RELEASED configuration
schema digests, their CONVERGE_*_SQL batches, the matching
ConfigurationShape variants and the three converge_* functions. Any
non-final digest is configuration ResetRequired. The
configuration-released-beta37.sql fixture is deleted, and the
registry-revision-3 fixture now carries the final table set so its
retired-entry test still reaches the entry decode.
- L135: the SourceBindingCheck::LocatorDigestDrift arm and its
RebindSource retry loop. An exact daemon binding is verified and
anything else is ResetRequired('configuration'). RebindSource stays for
GitHub origin rebinding.
Tests deleted: released_configuration_shape_is_admitted_and_converged_with_rows_intact,
prior_final_configuration_shape_drops_accepted_profiles_and_preserves_configuration_rows,
pre_residue_final_configuration_shape_drops_all_semantic_tables,
released_configuration_shape_with_credential_rows_stays_reset_required
and their connection helpers, and
ensure_runtime_configuration_rebinds_a_retired_locator_digest_once. The
locator-drift mismatch test keeps its intent with a foreign digest.
Upgrade impact: a configuration store last written by beta.25 to
beta.37 or the two intermediate tips, or one holding the source binding
published under the old root-derived locator digest, returns
configuration ResetRequired. Reset project/profile configuration, then
re-apply custom settings.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L043/L138: RETIRE_RUNTIME_EFFECTS_V1 with its re-exports and the registered-store DROP, and RETIRED_RUNTIME_EFFECTS_SCHEMA_V39 with its create_schema batch and final-shape entry. The project graph store SCHEMA_VERSION moves from 39 to 40, so fresh stores no longer carry the dead td_runtime_writer_outbox_v1/inbox_v1 tables. - L044: RETIRE_WORK_EVENT_JOURNAL_V1 and its install and schema-stage calls. - L149: the ReleasedV0067 and PreviousV2Candidate Doctor schema labels. Tests deleted: existing_store_drops_the_retired_runtime_effects_tables, tests/rusqlite_suite/work_storage.rs (shipped_executor_journal_is_retired_on_open, retirement_migration_is_idempotent). The final-shape ledger test now expects the two live ledger tables, and the v38 refusal test names the v40 shape. Upgrade impact: every existing v39 project graph store is refused with ResetRequired. Project graph stores from earlier builds must be re-indexed; run `tracedecay storage reset-project-store` for each project. Registered and beta.37 stores keep the retired outbox, inbox and Work journal tables as dead, unread tables. Doctor reports "unsupported" schema_state for v0.0.67 and V2-candidate stores. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L140/L141: legacy schema-stamp adoption. read_version reads only tracedecay_schema_version; the LEGACY_* ledger consts, read_component_legacy, read_named_legacy, legacy_global_marker, retire_named_ledgers, retire_user_version, the load/drop helpers, the runtime-core wrappers and adopt_graph_stamp are gone, and record_version no longer retires anything. The lcm, registered-schema, observation and workflow-index call sites drop their retire calls, and the session temporal namespace no longer exempts session_temporal_schema_migrations. - L137: the retired SQLite projection object-name probe. The version gate and exact final shape still refuse such stores, with a generic reason. Tests deleted: each_shipped_legacy_stamp_upgrades_onto_the_store_ledger, sibling_session_stamps_move_together, reading_a_legacy_stamp_does_not_change_it, an_unreadable_legacy_version_is_left_in_place, a_recorded_version_wins_over_a_different_legacy_stamp, current_legacy_stamp_moves_onto_the_store_ledger, a_user_version_stamp_at_the_current_schema_upgrades_onto_the_ledger, an_older_user_version_is_refused_without_adopting_it, the four retired-object reset tests, the retired-name loops of the fresh-creation test and migrations/tests/fts.rs. A ledger round-trip test replaces the schema_version module's legacy tests; lcm, temporal-catalog and CLI reset fixtures stamp tracedecay_schema_version instead of the old ledgers. Also drops a stale other_reset_pending doc line left by U25. Upgrade impact: a store whose only stamp is PRAGMA user_version or a pre-v1.0.0-beta.88 named ledger (session_schema_migrations, session_temporal_schema_migrations, global_schema_migrations) reads as unstamped and non-empty and is refused with ResetRequired. Reset the profile session store; history is rebuilt from host transcripts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L113: RepositoryRemoteIdentityV1::Unknown with its Default derive, is_unknown, the evidence skip_serializing_if and the wire serde default, and the provenance hash arm. Fixtures use Unavailable. Deferred from this unit (not removed): - L110: the Cline combined-source transition runs through the observation projection apply/rebuild macros, the retrieval-alias preflight and a persisted transition-anchor state. Removing it needs its own unit. - L111: canonical payload revision replay still needs a decision on whether the Cursor evidence-range and moved-location replays are current behavior. - L112/L134: 10 session_suite projection and store tests are built on range-only Claude identities. Moving them to native ids makes them collide by design, so removing the Claude exemption needs a fixture rewrite first. Tests deleted: legacy_unknown_remote_identity_preserves_capture_identity. Upgrade impact: a stored capture without remote_identity fails to decode. Reset the profile session store; history is rebuilt from host transcripts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L117/L146: the registered-schema canonical-body convergence: converge_canonical_bodies, compact_observation_page, the observation immutability lift/restore triggers and the three migration markers. In tracedecay-store the nested tracedecay.body_ref encoding is gone (LEGACY_BODY_REF_KEY, legacy_ref, collect_legacy_refs, migrate_stored_json); only the root _tracedecay_canonical_body_refs map hydrates. compact_lcm_bodies stays for the projection rebuild. - L118: the projection_queue revival-column ALTER loop (the CREATE already carries them), the repository-capture dedupe rewrite and its marker, and the empty pre-marker adoption. A preexisting observation table without the unified-identity marker is refused with the existing OBSERVATIONS_PREDATE_UNIFIED_IDENTITY authority. Tests deleted: completed_legacy_compaction_upgrades_small_reference_rows, compaction_advances_past_unchanged_rows_and_counts_utf8_bytes, shipped_nested_references_hydrate_and_migrate_idempotently, shipped_nested_references_preserve_missing_and_corrupt_errors, empty_pre_marker_observation_store_adopts_the_unified_identity, embedded_repository_captures_are_split_into_the_shared_table_on_admission, a_released_queue_upgrades_without_accepting_its_old_work. The canonical body compaction test now covers only the LCM pass it still owns. Upgrade impact: profile session stores from before about 2026-10-09 (inline or nested-reference observation bodies), before 2026-10-23 (no revival columns), or with an observation table lacking the unified identity marker no longer hydrate, fail writes, or are refused. Reset the profile session store; history is rebuilt from host transcripts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L121/L148: SESSION_MESSAGE_PROJECTOR_VERSION_V4/_V5, ProjectionPredecessorConvergence, converge_projection_predecessor with its adapter wrapper and re-exports, prepare_predecessor_projection_rebuild and retire_projection_predecessor_state. Alias staging and owner queries read only the current projector, and the host projection drain goes straight to replay. - L122/L147: CanonicalRendering::ShippedRelease and stored_message_is_shipped_release_rendering in tracedecay-store, the StoredProvenanceRendering::Released stored-digest fallback and the shipped-release OutputCollision arm in the authority audit. Any digest disagreement is the named refusal. The ledger stays for current-rendering repairs as ProjectionRepairLedger in schema_contract/invariants/ projection_repair.rs, and converge_released_output_rendering is converge_projection_output. The released fixture shrinks to the goal-context observation envelope the remaining tests use. Tests deleted: v5_predecessor_cutover_rebuilds_stale_provenance_and_preserves_unrelated_owner, v5_predecessor_cutover_rolls_back_and_retries_after_activation_failure, host_drain_converges_predecessor_before_ordinary_projection_and_is_idempotent, host_drain_resumes_predecessor_convergence_after_restart, cancelled_host_drain_leaves_predecessor_rebuild_resumable, workflow_only_v5_profile_rebuilds_before_current_search, released_codex_goal_rendering_converges_instead_of_degrading, quarantined_codex_goal_rendering_converges_to_the_withheld_capture, current_provenance_repairs_its_stale_output_row and the v4/v5 seed and released-rendering helpers. Upgrade impact: none in practice; v4/v5-owned and beta.37-rendering stores carry LCM schema below 15 and are already refused with a typed profile reset. A hand-built store with v4/v5 rows or a pre-current rendering under LCM 15 now hits "projection provenance disagrees with deterministic output"; reset the profile session store. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L119: converge_codex_response_echoes with its paging helpers, the codex-response-echo-retirement-v1 marker, the registered-schema call and the re-export. Projection-time echo retirement stays. - L120: project_path_rearm.rs, reproject_project_path_collision and restage_recovered_collision, the registered-schema call and the re-export. rearm_queued_projection_retries stays. Tests deleted: opening_a_store_with_a_projected_codex_echo_keeps_one_turn (tests/codex_response_echo.rs), project_path_collisions_rearm_once_and_genuine_collisions_stay_parked, project_path_rearm_commits_bounded_windows_before_recording_completion, registered_upgrade_recovers_parked_codex_messages_once, registered_upgrade_keeps_recovered_codex_messages_after_rebuild_resume and their helpers. Upgrade impact: duplicate Codex echoes projected before about 2026-10-15 stay in session history, and Codex messages beta.88 parked on a project_path collision stay unprojected. Reset the profile to recover full Codex history. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L131: the LcmSchemaAdmission::Current upgrade branch, the retired grep index drop, the superseded payload-owner index drop, the location_path ALTER (location_path is in CREATE TABLE lcm_raw_messages) and the payload-GC candidate backfill. Fresh installs still seed the dangling-scan cursor. LCM_SCHEMA_VERSION moves from 15 to 16 so older stores fail closed. - L133: the summary-convergence queue pragma probes, ALTERs, trigger replacement and backfill inserts; ensure_schema runs the two DDL batches. - L132: the one-shot role-aware predecessor-range rewrite: its journal, page type, retirement call, has-work probe, page function, raw::rewrite_predecessor_ranges_for_store_range, the session-runtime PredecessorRangeRewrite lane and the pass counter. - L123: the existing-store hook-route and LCM status index convergence batches, the RegisteredSchemaConvergence lcm_status_performance_indexes flag, converge_migration_batches, and the renamed observations index drop. Fresh installs build these indexes. Deferred: L105, renaming the PendingSchemaMigration and ReleasedShapeConvergenceInProgress wire states, is an SDK wire change left for an operator decision; the surface still reports the live authority-audit convergence. Tests deleted: short_lived_attach_convergence_rebuilds_queryable_lcm_status_indexes, role_filter_range_rewrite_pages_in_background_without_blocking_admission, a_fresh_store_opens_with_the_range_rewrite_already_retired, current_profiles_install_the_unreleased_queue_shape_in_place, perpetually_pending_history_cannot_starve_the_range_rewrite, installing_candidate_triggers_records_existing_payloads, existing_store_defers_hook_index_build_then_preserves_earliest_receipt, non_partial_session_index_predecessor_is_replaced_on_reopen, daemon_admission_remains_ready_while_lcm_indexes_converge_in_background, the shipped-v15 half of session_seen_from_another_cwd_projects_every_message, the retirement half of the LCM index test and their helpers. Upgrade impact: every v15 profile sessions.db returns ProfileResetRequired and is reset; LCM summaries are regenerated after reset and older summaries are not kept. Stores created before the hook-route or LCM status indexes keep running without them until reset. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items: - L105: SchemaConvergenceStateV1::PendingSchemaMigration and ReleasedShapeConvergenceInProgress are still produced. The registered schema convergence task re-arms projection retries and runs the authority-invariant audit, and its Pending and Running statuses map to these states. Their producers were not the deleted migrations, so the states are renamed, not deleted: pending_schema_migration is now pending, released_shape_convergence_in_progress is now running. DoctorStorageFindingKindV1::PendingSchemaMigration is now schema_convergence_incomplete, with the finding and Doctor read functions renamed to match. - SchemaConvergenceProgressV1 and SchemaConvergenceFindingV1.progress are removed. Nothing produced progress, even before this lane; it described the per-row and per-page migration passes. - Doctor, status, MCP, dashboard labels and docs now describe the audit convergence instead of schema migrations. Contracts, the TypeScript SDK and the ChatGPT extension bundle are regenerated. Tests deleted: none. The progress assertions in the CLI, Doctor, dashboard API, MCP status and dashboard DOM tests are removed, and the state and kind strings in those tests use the new names. Upgrade impact: dashboard and SDK consumers see the convergence state strings pending and running, the storage finding kind schema_convergence_incomplete, and no progress field on convergence findings. Regenerate SDK clients. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items: - L111: the payload replay comparator keeps the two cases current capture still produces and drops the normalizations for records written by older capture code. Kept: a Cursor transcript mirrors one native record (top-level id or nested message.id) at another offset, so the same record id arrives with a new evidence range; snapshot hosts (Cline-family, Kiro) and Vibe derive their leading location-only Session fact again on every rescan from mutable task metadata or workspace mappings, so a retained record can see its location move. Removed: the Codex turn_id relation, session project_path/location_path/transcript_path, null tool arguments, unknown model and missing-model dimension normalizations, the Cursor thread_id relation, message model/timestamp and native_timestamp removals, the insertion of a missing leading location session, and remove_legacy_relation_when_current_absent, is_unknown_absent_model and current_adds_only_missing_model. - is_canonical_payload_revision_replay is renamed is_replayed_occurrence, and the ObservationCoverageReason::CanonicalPayloadRevision cursor advance reason is renamed ReplayedOccurrence (stored string replayed_occurrence). Tests deleted: canonical_payload_revision_adopts_only_dropped_codex_tool_arguments. canonical_payload_revision_replays_advance_typed_coverage becomes replayed_cursor_occurrence_advances_typed_coverage over a mirrored Cursor offset; the compatibility test runs from a current-form stored record; the snapshot test now asserts that a moved location adopts and that a record retained without its location session collides. The two global-db revision tests use a mirrored Cursor occurrence instead of a legacy Codex record. Upgrade impact: records captured by older builds that differ from the current capture only in the removed fields now report identity collisions on re-ingest. Reset the profile session store; history is rebuilt from host transcripts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items: - L110: the Cline-family combined-source to native-stream transition. ClineNativeSourceTransition, cline_native_source_successor_id and prove_cline_native_source_transition are gone, with observation_projection/source_transition.rs, the NativeSourceSuperseded skip reason and every apply, rebuild, audit and lineage branch that verified or settled it, the adapter's pending Cline alias acceptance and supersession preflight, the rusqlite shared-alias transition, and the session-memory host_source_predecessor, superseded-receipt check and read_host_observation. Host source commits are always Initial; a retained receipt is valid only while its object is the latest one. ClineTranscriptStream and cline_task_native_observation_id stay: host source capture keys every current Cline stream record's native object by the task-level id. - L134: the sanitizer's two Claude no-native-id arms and the projection's synthesizes_native_record_id exemption. - L112: ObservationIdentityMaterialV1::new is deleted and native_record_id is a required field. The range-only observation id derivation, the sanitizer's file-bytes no-native-id branch and the optional provider record alias are gone; every retrieval anchor carries that alias. Fixture rewrite: session_suite store fixtures give each Claude row a uuid per generation and range, as captured rows carry. A Claude row projects under its own record id, so two observations can no longer own one Claude output; the seven projection tests whose scenario is several observations owning one output across generations or offsets now use an opencode shared-output fixture with distinct native ids and one message relation. The projection write helper builds its cursor from the observation's own source, and the table-count tests count the native alias row. Pinned identity and receipt hashes follow the native identity, and the receipt test now varies the native record it is bound to. Tests deleted: cline_native_transition_proofs_bind_exact_records_and_stable_lookup_ids, cline_native_transition_rejects_source_scope_and_native_identity_mismatches, cline_native_transition_rejects_authored_and_native_evidence_changes, cline_native_transition_preserves_sanitization_authority, cline_native_transition_rejects_invalid_ui_offsets_and_ordering_domains, cline_retained_cutover_keeps_objects_and_replays_historical_receipts, cline_retained_cutover_denies_changed_facts_and_wrong_stream, cline_cutover_requires_the_durable_retained_receipt_and_exact_revision, cline_stream_alias_waits_for_projection_and_preserves_historical_receipt, cline_stream_alias_refuses_changed_usage_or_wrong_native_stream, session_suite observation_projection/source_transition.rs (four tests), provider_sanitizer_allows_only_legacy_claude_to_omit_native_record_identity, only_claude_may_omit_the_native_record_id_on_identity_material. Upgrade impact: stores holding combined-source Cline observations, native_source_superseded dispositions, or identity material without a native record id (range-only Claude captures) fail to decode or collide on re-ingest. Reset the profile session store; history is rebuilt from host transcripts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items:
- Shape check for the U32 revival columns and the U27 document-digest
column. projection_queue is in the exact authority-schema column
contract, so any registered store whose queue lacks
revival_generation/revival_start_offset is refused at admission with
reset_required("authority schema"); the new test rebuilds the queue in
its pre-revival shape and asserts that refusal. managed_test_runs is
not in that contract, but its only writer is the MCP managed-run
recorder over the project sessions lease, which
SessionRuntimeRegistry::project_sessions refuses for any store held
in its typed reset-required state. Every hosted store with a
pre-digest table carries an LCM marker of 15 or lower, because the
table and the LCM schema were installed in the same admission
transaction from the table's first release, and LCM 16 refuses those
markers. No code change was needed.
Tests deleted: none.
Upgrade impact: none.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
ScriptedAlchemy
enabled auto-merge
October 29, 2026 16:21
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
ScriptedAlchemy
disabled auto-merge
October 29, 2026 19:13
Owner
Author
|
Combined into #4623 with lanes A, B and C, merged with --no-ff so this branch's commits land unchanged; that PR's merge commit marks this one merged. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
tracedecay keeps no legacy or backward-compatibility code. For on-disk stores the operator chose to reset everything. This PR removes every store-format migration and convergence path, inventory units U19–U35, and adds four follow-up units, U36–U39.
There is one commit per unit. Each commit body lists the items removed, the tests deleted, and the upgrade impact. In total, 296 files change: +2,979 / −19,573.
Units
task_keyis now required; contracts and SDK are regeneratedstores/,branches/, checkout.tracedecay/, branch-metadb_fileSCHEMA_VERSION39 → 40user_versionand the pre-beta.88 named ledgersProjectionRepairLedgerLCM_SCHEMA_VERSION15 → 16pendingandrunning; finding kind renamed toschema_convergence_incomplete. Theprogressfield, which nothing produced, is removednative_record_idis now required; the session_suite fixtures use current-format identities with the same scenariosreset_required("authority schema")Upgrade impact
sessions.dbis reset, and its LCM summary history is lost.dashboard/automation_runs.jsonl;stores/,branches/, and checkout-local.tracedecay/directories stay on disk for the user to delete.tracedecay install --yes --adoptfor a host whose receipts or writer lock predate the current format.Kept on purpose
wipe --staleresets through.Verification
bazel build --config=clippyandbazel teston the touched crates. Every schema-changing unit also ran the seven store suites: global-db, rusqlite-runtime, store, sessions, lcm, session-temporal-store, and store-runtime.97346807c0://crates/tracedecay:session_suite,contracts:check,gen_builds --check, and the ChatGPT extensioncheck:embedded.crates/for copies that master had moved into lower crates.core_cli_suiteremote_cli_testcases (HTTPS to the local test server) fail on master too. Two tests failed once in a full concurrent run and passed when run alone.Follow-ups (not in this PR)
observation_projection_aliasestables any more. Removing them is a schema-contract change.claude_v1sanitizer has no production caller.🤖 Generated with Claude Code