Repository navigation
refactor: remove all legacy support (lanes A, B, C) - #4623
Merged
Merged
Conversation
Items removed: L005, L010, L011, L012. - L010: delete docs/REBRAND-COMPATIBILITY-POLICY.md and the pre-rebrand shim and compatibility-policy sections of TREESITTERS-RENAME-CONSTRAINTS. - L005: drop the retired qualification-gate history from the search-quality module docs and dev doc; delete the deny_unknown_fields re-proof test a_workload_declaring_a_qualification_methodology_is_refused and rename the matrix test to describe the current fact. - L011: remove /legacy dashboard, legacy local store and legacy .tracedecay fallback narration (dashboard.md, DOMAIN-EXTRACTORS, LCM payload docs, USER-GUIDE). Delete LCM-PAYLOAD-LIFECYCLE section 11 and renumber the contract sections and cross-references. Delete the test retired_dashboard_routes_fall_through_to_the_canonical_spa_index. - L012: plans 08 and 17 no longer prescribe compatibility aliases, deprecated-name bindings, older-shape conformance or reserved retired identifiers. Upgrade impact: none (documentation and two tests only). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: L001, L002, L003, L004, L006, L007, L008, L009. - L001: uninstall/wipe help describes profile project stores, not checkout-local .tracedecay indexes or "legacy" stores. - L002: drop the doctor "migration advisory" section and the legacy core_doctor wording. - L003: remove the dead default_collection slot from MultiRootCollectionSelectorV1 (new() takes only the explicit target; the single caller is migrated) and reword the NoCollectionNamed reason. - L004, L006, L007, L008, L009: comments describing gone behaviour are reworded or deleted. LiveActivityPulse.detail is now required (string | null) and the pulse fixtures set detail: null. Callers migrated: multi_root_api.rs selector construction; dashboard pulse fixtures. Tests deleted: none. Upgrade impact: none. The only wire-visible text change is the multi-root "no collection named" reason string. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: L014, L015, L017, L018, L019, L020, L021. - L014: delete CanonicalEvidenceHit::compatibility_hit and the orphaned tracedecay_lcm::LcmGrepHit; skill_writer reads CanonicalEvidenceHit. - L015: rename AutomationConfig, AutomationTaskConfig, AutomationTaskSet, AutomationBackend, AutomationHostMode, SkillUsageSummary and AutomationSettledProblem to their V1/Record domain names in 61 files and delete the `as` re-export renames and the two `pub type` aliases. - L017: delete the identity legacy_/registered_registry_reap_* copy converters in the profile registry test support. - L018: delete runtime_core::windows_security; callers use tracedecay_private_fs::windows (daemon-control gains a cfg(windows) tracedecay-private-fs dependency; Cargo.lock updated). - L019: delete RetainedSessionRefreshPortV1; callers use tracedecay_session_memory::session::SessionRefreshServicePort. - L020: delete CLAUDE_SESSION_MESSAGE_PROJECTOR_VERSION; tests use SESSION_MESSAGE_PROJECTOR_VERSION. - L021: delete the mcp_server_test re-export; three callers use mcp_server_test::support. Tests deleted: none. Upgrade impact: none. Source-level renames only; serialized shapes are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: L022, L029, L046, L066. - L022: scorecard.py reads only the `pass` field; delete row_passed and test_passed_alias. - L029: delete the legacy Bazel disk-cache restore-key fallback in the ci-linux-test job. - L046: the Claude observation benchmark validates only acceptance artifacts. Delete RETIRED_WORKLOAD_ID, the historical and retired validators and their helpers, EvidenceIndex.historical_stale, the five historical result-*.json files, the runner's symlink loop, the publication test's historical fixture, and the optional ProviderBaseline.measurement and catalog compatibility field. - L066: the agent-adoption grader accepts only Codex 0.144+ item.* envelopes and the <id>__<host>__<model> basename. The selftest fixtures moved to those shapes and the legacy-basename check was deleted. Tests deleted: test_passed_alias; the legacy id__host basename check in agent_adoption selftest. Upgrade impact: dev tooling only. Old hermetic results.jsonl rows that carry only `passed` score as not triggered, old Codex msg transcripts and old-named transcript files no longer grade, and the repo carries no benchmark evidence until a new acceptance run is published. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: L023, L059, L024, L032, L033. - L023/L059: delete the hook-pre-tool-use and hook-prompt-submit subcommands (Commands variants, the pre-tool-use fast path, the NATIVE_CAPTURE_COMMANDS and capture_command_name rows, the dispatch arms, and the TOOL_INPUT doc clause). - L032: delete hook-kiro-pre-tool-use, hook-kiro-post-tool-use, hook-cursor-subagent-start and hook-cursor-before-submit-prompt, plus the host-bundles README paragraph. - L024: drop the `--claude-code-tool-search` alias on `serve`. - L033: delete the CLI tombstone tests for retired commands, flags and config keys. Callers migrated: none remain; no installer or bundle emits these names. Tests deleted: the_beta_83_claude_plugin_flag_serves_the_full_tool_list, retired_worldwide_counter_commands_are_refused_by_the_parser, automation_config_set_rejects_retired_lock_timeout_flags, gitignore_command_is_refused_as_unknown, the pre-tool-use and Kiro pre/post replay rows, the lifecycle-lease rows and no-input block, the Kiro postToolUse half of the prompt-boundary test (renamed kiro_hooks_capture_prompt_boundary), and the legacy-seed, retired automation-defaults and sidecar asserts in the Codex automation install test and the user.upload_enabled.v1 block in the user-settings test. Upgrade impact: Claude configs from old plugins that still name hook-pre-tool-use or hook-prompt-submit, or a beta.83 MCP config that passes --claude-code-tool-search, fail with a clap usage error on every hook call or `serve` start until `tracedecay update-plugin` for Claude. Old Kiro agent hooks naming preToolUse or postToolUse exit 2 until `tracedecay update-plugin --agent kiro`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: L025. - Delete HostComponentV1::OperatorMcp and HostBundleComponentArg::OperatorMcp (the hidden `--component operator-mcp` value), and drop them from the Claude, Cursor and Codex component lists. - Delete the receipt supersede/translate machinery in host_bundle/control.rs (LEGACY_COMPONENT_IDENTITIES, canonical_component, legacy_aliases, superseded_identities, translate_to_identity, ComponentReceiptsV1, component_receipts) and the writer ownership guard, writer remove_receipt, planner superseded_receipt_digests, doctor canonical_marker and the component-set superseded-receipt retirement loop. Planning evidence is the component's own receipt. - Strip every OperatorMcp arm in capability_admission, codex/mcp_registry, cursor, kimi, droid, vibe, opencode and host_bundle_registry. Callers migrated: selected_host_component is gone, so --component passes straight through; the unscoped-sweep test uses ContextMcp. Tests deleted: agent_cmd/mcp_identity_tests.rs (whole file), the retired spelling half of the component help test, opencode_non_owner_component_cannot_ remove_context_registration, the six legacy-receipt migration tests and helpers in host_bundle/tests.rs, and legacy_mcp_only_install_updates_and_uninstalls_as_one_server. Upgrade impact: `--component operator-mcp` is a clap usage error. On Claude, Cursor and Codex an operator-mcp receipt written by an older release (receipt.<host>.operator-mcp.v1.json) is no longer recognised and is left as an orphan file; the deployed MCP file it recorded is treated as an unreceipted path, so byte-identical bytes converge and drift needs `--yes --adopt`. Codex MCP-only installs registered under that identity are no longer cleaned up by uninstall. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Replace the guidance that allowed compatibility aliases, deprecation paths and data migrations once a prior shape shipped with the operator's rule: tracedecay keeps no legacy or backward-compatibility code. When a shape changes, every caller migrates and the old one is deleted; old stores, clients and hosts are refused through the typed reset and refusal paths, never shimmed. The zack-mode skill repeated the old allowance for time-boxed adapters and is updated to match. Upgrade impact: none (documentation only). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
L018 follow-up: the allow and its comment described root shims that re-exported the extracted kernel. With windows_security removed the crate builds clean under Clippy on every target without it. Upgrade impact: none. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: L026, L027, L028, L108, L040. - L108: delete RETIRED_CORE_SETTING_KEYS_V1 and RETIRED_PROFILE_SETTING_KEYS_V1 and the retired-key arguments, removals and drift allowance in converge_registry_shape and the profile store. A snapshot holding a retired key is configuration ResetRequired. - L027: delete AutomationTaskSettingsV1.legacy_stale_lock_secs and every retire_lock_timeout projection (automation config and admission, configuration get and pin, global-db convergence and rollback), plus RetiredAutomationLockTimeout. - L026: index include/exclude patterns are validated on read as well as write (validate_written_value is folded into validate_value). Delete partition_index_patterns, setting_findings, ConfigurationSettingFindingV1, ConfigurationSettingActionV1, ResolvedSetting.findings, ConfigurationDriftV1::Unapplied and unapplied_statement. The generated TypeScript SDK, dashboard contracts and embedded ChatGPT server bundle are regenerated. - L028: delete UserConfig RETIRED_KEYS and without_retired_keys and the USER-GUIDE counter history. - L040: delete DeprecationStateV1 and SettingDefinitionV1.deprecation. Callers migrated: automation config/admission, configuration operations and pin, daemon-service doctor_kernel and profile configuration get, global-db registry/store/mutation/control. Tests deleted: the retired-sync, retired-key convergence, released-key, retired-lock-timeout, stored-pattern-finding and profile retired-upload tests, the retired-keys half of the user config save test, and the retired-sync list/get assertions. Upgrade impact: a project or profile configuration store holding a retired key (diagnostics.prewarm.v1, index.git_ignore.v1, semantic.runtime.v1, sync.full_sync_escalation_files.v1, sync.max_concurrent_syncs.v1, sync.orphan_db_gc_days.v1, user.upload_enabled.v1, user.watcher_debounce_ms.v1, user.extraction_timeout_secs.v1), an automation value carrying stale_lock_secs, or an index include/exclude pattern that does not compile now returns configuration ResetRequired; reset the project or profile configuration and re-apply custom settings. Configuration get no longer returns `findings`; regenerate SDK clients. Dead keys left in config.toml stay as inert entries. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: L034, L035, L036, L037. - L034: delete is_retired_read_bundle_file and the read-bundle-* reclaim in code-index generation retention. - L035: delete RETIRED_BINDING_CLEANUP_INTENT_FILE and its removal in recover_scope_root_retention. - L036: delete seat_retained_generation_on_empty_serving, retained_empty_seat_settles_source, the mount.rs legacy-graph-recovery branch, CodeTextGenerationSharedV1.sealed_format_revision, the bind_text parameter and uses_partitioned_manifest(); the partitioned-manifest guards collapse to their true arm. - L037: delete the five always-zero retired fields of CodeGraphBuildBoundV1. Callers migrated: mount.rs guards, bind_text and restore call sites; the three tests that asserted uses_partitioned_manifest now assert the owner exists. Tests deleted: maintenance_reclaims_retired_read_bundle_files, scope_recovery_deletes_a_retired_binding_cleanup_intent, equal_metadata_without_a_decoded_generation_does_not_settle_the_seat. Upgrade impact: stores from older builds keep leftover read-bundle-* files and the .code-index-scope-binding-cleanup-intent-v1.json marker as inert files on disk. Nothing decodes differently. The code_index_graph_build_bound tracing event's Debug field loses five zero fields. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: L031, L038, L039, L041, L042, L045, L047. - L041: ToolResult.semantic_error is a plain bool set by the handler. Delete plain_text_tool_failure, value_has_semantic_error and the rendered-text fallback in tool_result_has_semantic_error and semantic_failure_reason. No production handler emitted the sniffed shapes (top-level success:false, error, failed>0, exit_code, "git error:" text): refusals go through problem_tool_result and edit/graph results set the marker. - L042: delete the former split fusion pipeline oracle (mod same_source_fusion_tests, legacy_compose). The duplicate-accounting test now asserts current behaviour directly: one compact sort, the duplicate collapse decision, the same admitted anchors under every lane order, and cursor pages that cover the ranked set exactly. - L038: the request-identity restart test no longer carries legacy id strings and is renamed every_process_local_surface_mints_a_fresh_identity_ after_restart. - L031, L039, L045, L047: delete tests that only assert the absence of retired features, routes, aliases and wire shapes. Callers migrated: with_semantic_error(false) calls dropped; semantic_error() tests assert a bool. Tests deleted: legacy_opencode_lsp_entries_do_not_disable_diagnostic_engines, doctor_routes_expose_diagnostics_without_mutation_endpoints, retired_file_metadata_is_absent_and_refused_by_public_dispatch, the retired-counter, worldwide, selector-alias and relation-table assertions, three dashboard retired-shape tests, the retired fact-state loop and the superseded diagnostics assert. Upgrade impact: none. Test and internal result-classification changes only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: L048, L049, L050, L065, L082. - L048: unknown ?view values open Cortex; tests no longer name the retired atlas and core lenses. - L049: delete the Explorer "Semantic" lane, the 'unregistered' lane state and semanticLane. LaneId is the three source lanes (SourceLaneId folded into it); the summary reads "of 3 lanes". - L050: drop the negative assertions against retired /work/snapshot, delta, accept-task and replan routes and the retired-snapshot narration. - L065: the capabilities schema requires multi_root and multiRootReading takes a capability; the 'absent' reading is gone. - L082: fetchProjectRegistry accepts a registry envelope only on a 2xx. The daemon answers every registry outcome with a 200 (projects.rs, the gateway's registry_unavailable_response); non-2xx is an error. Callers migrated: MultiRootPanel, the controller and lane switches; the ShellTruth and BrainPage fixtures now serve registry outcomes with the 200 the daemon sends. Tests deleted: the retired Atlas link, semantic-lane and semanticLane tests, the retired-route negative assertions, the silent-bundle multi-root assertion, the decoded 503 registry test and the non-2xx rows of the registry outcome tables. Upgrade impact: the Explorer shows three lanes instead of four. The bundled dashboard always matches its daemon, so a newer dashboard against an older daemon would show "HTTP <code>" for non-2xx registry answers and unsupported_schema for a capabilities bundle without multi_root. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: L030, L051, L054, L055.
- L030: delete codex/retired_bundle_files.rs (the table of released skill
file digests) and remove_codex_retired_bundle_files; every unexpected
Codex plugin entrypoint is reported as foreign.
- L051: delete the doctor's Cursor literal ${workspaceFolder} log finding
and the former-template README history. serve's path sanitizer is kept: it
still discards an unexpanded template from hosts that pass one.
- L054/L055: OpenCode no longer reads, strips or flags the V1
`mcp.tracedecay` key or the retired `lsp.tracedecay` registration.
LEGACY_MCP_SERVER_KEY, remove_legacy_lsp_registration, the legacy_lsp
state term, the doctor checks and the remove_lsp/remove_mcp parameters of
strip_registration_entries are gone; Core lifecycles leave opencode.json
untouched.
Callers migrated: codex activate/deactivate/uninstall, OpenCode
activate/deactivate/state/doctor/merge/strip; the cross-crate OpenCode
companion lifecycle test now seeds only an operator LSP and asserts
opencode.json is byte-identical across Core lifecycles.
Tests deleted: activation/deactivation_retires_released_skill_files,
RELEASED_RETIRED_SKILL, existing_core_with_legacy_lsp_requires_activation,
legacy_mcp_registration_remains_detectable_for_migration,
doctor_reports_retired_lsp_registration,
opencode_core_cleanup_is_reversible_and_revision_checked, the retired-file
setup in two Codex tests, the V1/LSP parts of the OpenCode merge test, and
the placeholder half of the Cursor log scan test.
Upgrade impact: stale `mcp.tracedecay` and `lsp.tracedecay` entries in an
old opencode.json stay and doctor no longer flags them; delete them by hand.
An unedited retired skill under the Codex plugin dir (for example
skills/tracedecay-find-impact) is reported as a foreign entrypoint; delete
that skills/<name> directory or reinstall the Codex plugin. Doctor no longer
warns about old Cursor ${workspaceFolder} spawns.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L097: retention receipts drop the always-zero rollback_floor field and RECEIPT_ROLLBACK_FLOOR; the receipt schema moves to v2. - L098: RetiredCodeTextArtifactDescriptorV1 and the untagged DurableTextArtifactSlotV1; index entries carry the current descriptor directly and every caller reads the field. - L099: pointer and index-entry serde defaults for pre-beta.38 pointers. generation_index_digest is a required String built with the pointer, cardinality is required, and the "older entries" admission arm is gone. - L100: the container serde(default) on ScopeDirectoryIdentityV1. - L101: ambiguous_name_drops is a required u64 in the census, the codec, sparse increments and runtime telemetry. - L102: CodeIndexProductionErrorV1::SourceCommitmentsUnavailable and GraphDbError::SourceCommitmentsUnavailable with their mappings and abstention arms. A sealed manifest without commitments is a contract failure. The planner still holds an Option while it materializes. - L103: the 124K archival partitioned_pre_paging fixture, its Bazel filegroup and gen_builds entry, and the per-revision guard tests. The generic refusal test and the retired-parent test relabel live encoder bytes instead. Retention's revision abstention and the retired-parent no-reuse branch stay: they are the mechanism for every future format revision bump, not old-release compatibility. - L107: the canonical_bytes wire field on ExactTechnicalTermV1. Tests deleted: a_pre_key_text_artifact_descriptor_reads_as_retired_and_is_replaced, a_pointer_sealed_before_segment_bytes_is_corrupt_until_the_store_is_reset, a_pre_segment_bytes_pointer_is_reset_and_rebuilt_by_the_worker, a_census_sealed_before_the_field_decodes_as_not_counted, ambiguity_census_preserves_unknown_parent_count, both_retired_manifest_census_shapes_reach_the_typed_refusal, prior_partitioned_symbol_occurrence_revision_reaches_the_typed_refusal, archival_carrier_revision_is_refused_for_rebuild, the legacy halves of the scope identity and source-commitment tests, and the cardinality-None section of the bounded admission test. Upgrade impact: derived code-index data written by older builds (pre-beta.38 pointers, pre-key text descriptors, censuses without ambiguous_name_drops, chunks with canonical_bytes, receipts with rollback_floor) fails to decode and the code index rebuilds from source. If retention reports UnsafeState on an old receipt or journal, reset the project store. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L074/L114: LogicalCopyRecordV1 decoding no longer defaults a missing knowledge_at to zero or valid_time to Unknown. Both wire fields are required. The store builds copy records from SQL columns, which always carry them. - L078: CandidateCursor and RecordCursor no longer default a missing session_id. Tests deleted: the legacy copy-record decode block in session_contract.rs. Upgrade impact: a JSON copy record without bitemporal fields, or a continuation key minted before session_id existed, fails to decode. No production path stores such JSON copy records. An old continuation key returns a decode error and the caller restarts pagination. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L086: the schema-v1 six-kind artifact chain readability test. - L087: refused-shape reset and rebuild for effect journals and the pending index: reset_refused_shapes_blocking, the unreferenced-journal retirement, the index rebuild, discard_if_refused_blocking and discard_unsupported_journal, JournalShapeProbe, read_or_discard_unsupported_record_blocking, RefusedJournalShape, refused_journal_shape_blocking, PendingAutomationEffectReset, pending_automation_effect_resets_blocking and the Doctor findings. A refused journal now fails project-open recovery with its typed reset_required error. - L091: the run ledger no longer deletes a ledger holding a schema-v1 row or rewrites rows with retired skip-reason aliases. Both are typed reset_required refusals and the ledger is kept. - L104/L150: AutomationRunLedgerRecord.task_key, the ledger row projection, AutomationRunListEntryV1.task_key and AutomationRunRowV1 are required strings. The canonical_task_key fallbacks, the scheduler diagnostic None branches, the dashboard latestRunForTask keyless join and the `task_key ?? task` displays are gone. Contract schema, dashboard types and SDK sources are regenerated. Callers migrated: daemon scheduler logging, CLI run listing, Doctor, recovery reports, lifecycle index, cursor and scheduler diagnostics, and every ledger fixture, which now carries task_key. Tests deleted: schema_v1_six_kind_chain_stays_readable, refused_memory_journal_shape_resets_per_entry_and_recovery_converges, unreferenced_refused_terminal_journal_is_retired_and_its_run_id_reusable, refused_pending_index_shape_rebuilds_from_journals_and_converges, automation_effect_reset_findings_name_each_refused_journal_by_run_id, task_summary_resets_only_a_non_canonical_budget_exhausted_row, run_ledger_locked_read_resets_schema_v1_rfc3339_rows, run_ledger_resets_only_the_row_with_an_unregistered_skip_reason, scheduled_user_job_resets_a_schema_v1_ledger_and_records_a_v2_run, and the keyless dashboard join test. The schema-v1 locked-read test now asserts the typed refusal and that the ledger is kept. Upgrade impact: automation journal and run-ledger reads from older builds fail typed instead of self-healing. Ledgers holding schema-v1 rows, retired skip-reason aliases or rows without task_key, and refused effect journals or pending indexes, block reads until the user deletes dashboard/automation_runs.jsonl and the automation journal directory. SDK consumers see task_key as a required string. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L088: the summary-only skill.json detector and the listing that silently deleted that skill directory. An unreadable record is the ordinary invalid-record config error. - L089: the last-activity fallback for skills activated before baselines existed. A missing activation baseline counts no activity. - L090: the "ignored" alias on SkillOutcomeVerdict::Unknown. - L092: a persisted materialization manifest must carry materialized_by. Only a package re-derived from disk holds None in memory. - L093: refuse_released_body_hash_package; such packages are ordinary user forks. - L094: the released unslugged prompt-index markers and their refusal. - L095: the monolithic skill_usage.json, legacy-imported-events.json and fact_proposals.json/.archive probes. Tests deleted: released_summary_only_record_is_refused_and_the_store_scan_resets_only_it, ledger_without_activation_baseline_uses_last_activity_fallback, stored_ignored_verdict_loads_and_reserializes_as_unknown, released_body_hash_package_is_a_typed_reset_not_a_user_fork, edited_released_body_hash_package_stays_a_user_fork, released_unslugged_prompt_index_is_a_typed_reset_until_deleted, released_fact_proposal_history_is_a_typed_reset_before_reservation, released_monolithic_skill_usage_ledger_is_a_typed_reset, and the stripped-field half of the manifestless project package test. Upgrade impact: an old summary-only skill record or an outcomes snapshot holding "ignored" fails listing until the user removes the reported skill directory or outcomes snapshot. Skills activated under an older build report 0 uses since activation. Old materialization manifests read as missing, so the package stays SkippedForeign in project scope. Old body-hash packages are reported as user forks. Old unslugged AGENTS.md and CLAUDE.md blocks and the retired skill-usage and fact-proposal files stay on disk as inert text and bytes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L085: PR auto-track state decodes managed entries directly. PersistedPrAutotrackState, StaleManagedPr, PrAutotrackState.stale, the reconcile reset_stale report and loop, the CLI "Stale PR branch" line and the Doctor stale warnings are gone. Doctor still fails on an unreadable state file. - L109: HealthSnapshotObservedV1.definition is a required String, and HealthDeltaError::DefinitionUnrecorded with its primitive mapping is gone. - L144: source-edit journals and receipts require verification_requested and failed, and the no-op serde defaults on Option fields are dropped. - L145: the rollback-records directory sweep in lock() and the recovery_files/recovery_digest normalization in load_journal. The journal decodes straight into SourceEditJournalV1. The daemon-protocol inspection fixture names the live str-replace use case. Tests deleted: undecodable_managed_pr_entries_are_scoped_refusals_that_save_state_resets, reconcile_resets_entry_without_head_sha_and_preserves_other_entries, an_unlabeled_released_point_is_refused_and_never_reused_as_after, retired_operation_journal_discards_bodies_and_allows_partial_acknowledgement, malformed_journal_is_preserved_when_obsolete_fields_cannot_be_normalized, the rollback-records assertion and the DefinitionUnrecorded case. The Doctor PR-state test keeps only the blocking-file case. Upgrade impact: a PR auto-track state file holding an old-shape entry fails to load and blocks reconciliation; delete the pr_autotrack state file. An old unlabeled health-delta before_cursor fails as an unknown point; omit before_cursor. Source-edit journals or receipts without verification_requested/failed, or rollback-era journals, fail as invalid; delete <data_root>/source-edit-transactions-v1/active.json. A leftover rollback-records directory is no longer deleted automatically. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L083: the Context Scout pre-provenance and untagged-evidence document reset: document_needs_provenance_reset, has_untagged_candidate_evidence, provenance_reset_required, replace_with_fresh_state, the startup branch and ContextScoutDurableStartupOutcomeV1::Reset with its three match arms. StoredDeliveryAddressV1.entry is required. - L084: the retired writer.v1.lock constant, the writer collision check and its test assertion. - L130: host bundle receipts require created_directories and a created_config Vec. The predates_creation_records flag and branches, tracedecay_namespace_directories, and the Option wrapping in the writer and component-set receipts are gone. Tests deleted: legacy_delivery_provenance_resets_without_replaying_receipts, untagged_candidate_evidence_resets_instead_of_failing_decode, uninstall_after_an_upgrade_removes_tracedecay_residue_and_keeps_unprovable_structure with strip_creation_records, LEGACY_CURSOR_EXTENSION and deposit_legacy_cursor_extension, and the retired-lock assertion. Upgrade impact: Context Scout state from an older release decodes as invalid and reads Unavailable until the project store is reset. A host receipt written before creation records fails to decode, so update and uninstall for that host refuse; run `tracedecay install --yes --adopt` for that host. A stale writer.v1.lock is ignored. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L096: "stores" from the wipe --all profile database paths and from the path_layout profile-authority match, the "legacy" wording in the wipe warning and help, and the stores/ test fixtures (now projects/). - L106: IncidentDebrisKindV1::RetiredBranchStore, RETIRED_BRANCH_STORE_DIRECTORY, is_retired_branch_store_path, the branches/ debris listing and deletion, and the manifestless-store probe. The contract schema is regenerated. - L136: BranchEntry.retired_store_reference and RetiredStoreReference. BranchEntry denies unknown fields, so a db_file key is corrupt metadata. Fixtures use the current shape. - L139: RETIRED_CHECKOUT_LAYOUT_FILES, retired_checkout_layout_dir and refuse_retired_checkout_layout with the identity call, the reset-project-store retired-checkout deletion and its bool parameter, and the help text. get_tracedecay_dir stays for project rule files. The restart-proxy test drops its legacy config fixture, and the failed-mount journey uses an unreadable graph database as its failure. Tests deleted: retired_branch_store_paths_classify_only_directly_under_branches, sweep_never_follows_a_symlinked_retired_branch_directory, sweep_unregistered_stores_collects_retired_branch_store_layout, cold_store_page_deletes_retired_branch_store_and_doctor_is_clean, metadata_naming_the_project_store_opens_and_is_rewritten_without_a_store_reference, every_retired_checkout_layout_file_is_a_typed_project_store_reset, the_profile_root_is_never_a_retired_checkout_layout, first_touch_refuses_a_retired_checkout_enrollment_marker, pending_retired_checkout_reset_admits_a_store_with_nothing_refused, the db_file parse cases and the retired-layout preludes. Upgrade impact: a leftover ~/.tracedecay/stores directory, a store's branches/ directory and a checkout-local .tracedecay/ directory are no longer reported, refused or removed; they stay on disk as debris and the user deletes them by hand. Registry rows still pointing at stores/ lose profile-authority recognition. A branch-meta.json carrying db_file is treated as corrupt until it is regenerated or deleted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L126: admission ledger frame kinds 1 (unordered admitted) and 8 (reconstructed admitted) no longer decode; they are RecordUndecodable. order_reconstructed is gone from LedgerEntry, LogFrame and HookAdmissionLedgerReceiptV1, along with the reconstructed encode and the MCP recovered_native_lifecycle_order branch. The one current test in legacy_continuity.rs moves to lifecycle_policy.rs. - L127/L128 (spool part): PRE_LEDGER_PENDING_WORK_DIR, the MCP pre-ledger probe and refusal, the census arm and the wipe --stale member. The open() refusal of the pre-log ledger shape and its census stay: the census is the only path that lets wipe --stale reset such a ledger. - L129: the retired append_intent field on spool metadata. Callers migrated: the MCP ledger map no longer threads data_root. Tests deleted: legacy_frames_preserve_admission_order_when_rewritten, fresh_saved_edit_runs_after_shipped_compacted_or_header_only_ledger, retained_legacy_receipt_keeps_producer_work_owed_until_execution, missing_or_conflicting_legacy_receipt_stays_owed_through_rewrite_and_restart, a_later_canonical_receipt_truthfully_supersedes_retained_legacy_work, disabled_claude_stop_follows_the_prior_session_cursor_without_minting_lifecycle, pre_ledger_pending_work_is_refused_for_reset_not_adopted, released_metadata_with_an_append_intent_opens_and_drops_it. Upgrade impact: a hook admission ledger holding unordered or reconstructed frames fails to decode, and a spool whose metadata still has append_intent returns ResetRequired(MetadataShape). Reset the project store; hook events not yet committed are lost. A hook-v2-pending-work spool is inert and is no longer reported or wiped; delete it by hand. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L116: the managed_test_runs document_content_digests_json pragma probe and ALTER. The CREATE TABLE already carries the column. - L124: the host_pending stack-delivery state: it leaves the CHECK and the settlement guard, and the normalizing UPDATE, the retired index DROPs and the retired transition-guard DROP are gone. No exact-shape check covers these tables, so existing stores keep their old CHECK text and open as before. - L125: the orphaned released-shape SQL fixtures session-temporal-released-v3-triggers.sql and session-relation-receipts-before-recovery.sql. - L142: the work_placements_v1_exclusive_root DROP and the duplicate-holder quarantine UPDATE. CREATE UNIQUE INDEX work_placements_v1_exclusive_target stays. - L143: migrate_activity_frontier and LEGACY_ACTIVITY_FRONTIER_KEY; the git-correlation version gate already refuses those stores. Tests deleted: a_released_store_gains_document_digests_and_keeps_its_runs, staged_rows_from_an_older_daemon_return_to_pending_on_open, migration_keeps_the_oldest_holder_and_quarantines_later_duplicates, activity_time_positions_migrate_to_a_full_rescan_once. Upgrade impact: a store whose managed_test_runs table predates document digests fails managed test-run writes, and a Work store still holding two holders of one root fails CREATE UNIQUE INDEX at open; reset the affected store. host_pending stack-delivery rows left by an older daemon are never delivered. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed:
- L115: the PRIOR_FINAL, PRE_RESIDUE_FINAL and RELEASED configuration
schema digests, their CONVERGE_*_SQL batches, the matching
ConfigurationShape variants and the three converge_* functions. Any
non-final digest is configuration ResetRequired. The
configuration-released-beta37.sql fixture is deleted, and the
registry-revision-3 fixture now carries the final table set so its
retired-entry test still reaches the entry decode.
- L135: the SourceBindingCheck::LocatorDigestDrift arm and its
RebindSource retry loop. An exact daemon binding is verified and
anything else is ResetRequired('configuration'). RebindSource stays for
GitHub origin rebinding.
Tests deleted: released_configuration_shape_is_admitted_and_converged_with_rows_intact,
prior_final_configuration_shape_drops_accepted_profiles_and_preserves_configuration_rows,
pre_residue_final_configuration_shape_drops_all_semantic_tables,
released_configuration_shape_with_credential_rows_stays_reset_required
and their connection helpers, and
ensure_runtime_configuration_rebinds_a_retired_locator_digest_once. The
locator-drift mismatch test keeps its intent with a foreign digest.
Upgrade impact: a configuration store last written by beta.25 to
beta.37 or the two intermediate tips, or one holding the source binding
published under the old root-derived locator digest, returns
configuration ResetRequired. Reset project/profile configuration, then
re-apply custom settings.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L043/L138: RETIRE_RUNTIME_EFFECTS_V1 with its re-exports and the registered-store DROP, and RETIRED_RUNTIME_EFFECTS_SCHEMA_V39 with its create_schema batch and final-shape entry. The project graph store SCHEMA_VERSION moves from 39 to 40, so fresh stores no longer carry the dead td_runtime_writer_outbox_v1/inbox_v1 tables. - L044: RETIRE_WORK_EVENT_JOURNAL_V1 and its install and schema-stage calls. - L149: the ReleasedV0067 and PreviousV2Candidate Doctor schema labels. Tests deleted: existing_store_drops_the_retired_runtime_effects_tables, tests/rusqlite_suite/work_storage.rs (shipped_executor_journal_is_retired_on_open, retirement_migration_is_idempotent). The final-shape ledger test now expects the two live ledger tables, and the v38 refusal test names the v40 shape. Upgrade impact: every existing v39 project graph store is refused with ResetRequired. Project graph stores from earlier builds must be re-indexed; run `tracedecay storage reset-project-store` for each project. Registered and beta.37 stores keep the retired outbox, inbox and Work journal tables as dead, unread tables. Doctor reports "unsupported" schema_state for v0.0.67 and V2-candidate stores. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L140/L141: legacy schema-stamp adoption. read_version reads only tracedecay_schema_version; the LEGACY_* ledger consts, read_component_legacy, read_named_legacy, legacy_global_marker, retire_named_ledgers, retire_user_version, the load/drop helpers, the runtime-core wrappers and adopt_graph_stamp are gone, and record_version no longer retires anything. The lcm, registered-schema, observation and workflow-index call sites drop their retire calls, and the session temporal namespace no longer exempts session_temporal_schema_migrations. - L137: the retired SQLite projection object-name probe. The version gate and exact final shape still refuse such stores, with a generic reason. Tests deleted: each_shipped_legacy_stamp_upgrades_onto_the_store_ledger, sibling_session_stamps_move_together, reading_a_legacy_stamp_does_not_change_it, an_unreadable_legacy_version_is_left_in_place, a_recorded_version_wins_over_a_different_legacy_stamp, current_legacy_stamp_moves_onto_the_store_ledger, a_user_version_stamp_at_the_current_schema_upgrades_onto_the_ledger, an_older_user_version_is_refused_without_adopting_it, the four retired-object reset tests, the retired-name loops of the fresh-creation test and migrations/tests/fts.rs. A ledger round-trip test replaces the schema_version module's legacy tests; lcm, temporal-catalog and CLI reset fixtures stamp tracedecay_schema_version instead of the old ledgers. Also drops a stale other_reset_pending doc line left by U25. Upgrade impact: a store whose only stamp is PRAGMA user_version or a pre-v1.0.0-beta.88 named ledger (session_schema_migrations, session_temporal_schema_migrations, global_schema_migrations) reads as unstamped and non-empty and is refused with ResetRequired. Reset the profile session store; history is rebuilt from host transcripts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L113: RepositoryRemoteIdentityV1::Unknown with its Default derive, is_unknown, the evidence skip_serializing_if and the wire serde default, and the provenance hash arm. Fixtures use Unavailable. Deferred from this unit (not removed): - L110: the Cline combined-source transition runs through the observation projection apply/rebuild macros, the retrieval-alias preflight and a persisted transition-anchor state. Removing it needs its own unit. - L111: canonical payload revision replay still needs a decision on whether the Cursor evidence-range and moved-location replays are current behavior. - L112/L134: 10 session_suite projection and store tests are built on range-only Claude identities. Moving them to native ids makes them collide by design, so removing the Claude exemption needs a fixture rewrite first. Tests deleted: legacy_unknown_remote_identity_preserves_capture_identity. Upgrade impact: a stored capture without remote_identity fails to decode. Reset the profile session store; history is rebuilt from host transcripts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L117/L146: the registered-schema canonical-body convergence: converge_canonical_bodies, compact_observation_page, the observation immutability lift/restore triggers and the three migration markers. In tracedecay-store the nested tracedecay.body_ref encoding is gone (LEGACY_BODY_REF_KEY, legacy_ref, collect_legacy_refs, migrate_stored_json); only the root _tracedecay_canonical_body_refs map hydrates. compact_lcm_bodies stays for the projection rebuild. - L118: the projection_queue revival-column ALTER loop (the CREATE already carries them), the repository-capture dedupe rewrite and its marker, and the empty pre-marker adoption. A preexisting observation table without the unified-identity marker is refused with the existing OBSERVATIONS_PREDATE_UNIFIED_IDENTITY authority. Tests deleted: completed_legacy_compaction_upgrades_small_reference_rows, compaction_advances_past_unchanged_rows_and_counts_utf8_bytes, shipped_nested_references_hydrate_and_migrate_idempotently, shipped_nested_references_preserve_missing_and_corrupt_errors, empty_pre_marker_observation_store_adopts_the_unified_identity, embedded_repository_captures_are_split_into_the_shared_table_on_admission, a_released_queue_upgrades_without_accepting_its_old_work. The canonical body compaction test now covers only the LCM pass it still owns. Upgrade impact: profile session stores from before about 2026-10-09 (inline or nested-reference observation bodies), before 2026-10-23 (no revival columns), or with an observation table lacking the unified identity marker no longer hydrate, fail writes, or are refused. Reset the profile session store; history is rebuilt from host transcripts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L121/L148: SESSION_MESSAGE_PROJECTOR_VERSION_V4/_V5, ProjectionPredecessorConvergence, converge_projection_predecessor with its adapter wrapper and re-exports, prepare_predecessor_projection_rebuild and retire_projection_predecessor_state. Alias staging and owner queries read only the current projector, and the host projection drain goes straight to replay. - L122/L147: CanonicalRendering::ShippedRelease and stored_message_is_shipped_release_rendering in tracedecay-store, the StoredProvenanceRendering::Released stored-digest fallback and the shipped-release OutputCollision arm in the authority audit. Any digest disagreement is the named refusal. The ledger stays for current-rendering repairs as ProjectionRepairLedger in schema_contract/invariants/ projection_repair.rs, and converge_released_output_rendering is converge_projection_output. The released fixture shrinks to the goal-context observation envelope the remaining tests use. Tests deleted: v5_predecessor_cutover_rebuilds_stale_provenance_and_preserves_unrelated_owner, v5_predecessor_cutover_rolls_back_and_retries_after_activation_failure, host_drain_converges_predecessor_before_ordinary_projection_and_is_idempotent, host_drain_resumes_predecessor_convergence_after_restart, cancelled_host_drain_leaves_predecessor_rebuild_resumable, workflow_only_v5_profile_rebuilds_before_current_search, released_codex_goal_rendering_converges_instead_of_degrading, quarantined_codex_goal_rendering_converges_to_the_withheld_capture, current_provenance_repairs_its_stale_output_row and the v4/v5 seed and released-rendering helpers. Upgrade impact: none in practice; v4/v5-owned and beta.37-rendering stores carry LCM schema below 15 and are already refused with a typed profile reset. A hand-built store with v4/v5 rows or a pre-current rendering under LCM 15 now hits "projection provenance disagrees with deterministic output"; reset the profile session store. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L119: converge_codex_response_echoes with its paging helpers, the codex-response-echo-retirement-v1 marker, the registered-schema call and the re-export. Projection-time echo retirement stays. - L120: project_path_rearm.rs, reproject_project_path_collision and restage_recovered_collision, the registered-schema call and the re-export. rearm_queued_projection_retries stays. Tests deleted: opening_a_store_with_a_projected_codex_echo_keeps_one_turn (tests/codex_response_echo.rs), project_path_collisions_rearm_once_and_genuine_collisions_stay_parked, project_path_rearm_commits_bounded_windows_before_recording_completion, registered_upgrade_recovers_parked_codex_messages_once, registered_upgrade_keeps_recovered_codex_messages_after_rebuild_resume and their helpers. Upgrade impact: duplicate Codex echoes projected before about 2026-10-15 stay in session history, and Codex messages beta.88 parked on a project_path collision stay unprojected. Reset the profile to recover full Codex history. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: - L131: the LcmSchemaAdmission::Current upgrade branch, the retired grep index drop, the superseded payload-owner index drop, the location_path ALTER (location_path is in CREATE TABLE lcm_raw_messages) and the payload-GC candidate backfill. Fresh installs still seed the dangling-scan cursor. LCM_SCHEMA_VERSION moves from 15 to 16 so older stores fail closed. - L133: the summary-convergence queue pragma probes, ALTERs, trigger replacement and backfill inserts; ensure_schema runs the two DDL batches. - L132: the one-shot role-aware predecessor-range rewrite: its journal, page type, retirement call, has-work probe, page function, raw::rewrite_predecessor_ranges_for_store_range, the session-runtime PredecessorRangeRewrite lane and the pass counter. - L123: the existing-store hook-route and LCM status index convergence batches, the RegisteredSchemaConvergence lcm_status_performance_indexes flag, converge_migration_batches, and the renamed observations index drop. Fresh installs build these indexes. Deferred: L105, renaming the PendingSchemaMigration and ReleasedShapeConvergenceInProgress wire states, is an SDK wire change left for an operator decision; the surface still reports the live authority-audit convergence. Tests deleted: short_lived_attach_convergence_rebuilds_queryable_lcm_status_indexes, role_filter_range_rewrite_pages_in_background_without_blocking_admission, a_fresh_store_opens_with_the_range_rewrite_already_retired, current_profiles_install_the_unreleased_queue_shape_in_place, perpetually_pending_history_cannot_starve_the_range_rewrite, installing_candidate_triggers_records_existing_payloads, existing_store_defers_hook_index_build_then_preserves_earliest_receipt, non_partial_session_index_predecessor_is_replaced_on_reopen, daemon_admission_remains_ready_while_lcm_indexes_converge_in_background, the shipped-v15 half of session_seen_from_another_cwd_projects_every_message, the retirement half of the LCM index test and their helpers. Upgrade impact: every v15 profile sessions.db returns ProfileResetRequired and is reset; LCM summaries are regenerated after reset and older summaries are not kept. Stores created before the hook-route or LCM status indexes keep running without them until reset. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items: - L105: SchemaConvergenceStateV1::PendingSchemaMigration and ReleasedShapeConvergenceInProgress are still produced. The registered schema convergence task re-arms projection retries and runs the authority-invariant audit, and its Pending and Running statuses map to these states. Their producers were not the deleted migrations, so the states are renamed, not deleted: pending_schema_migration is now pending, released_shape_convergence_in_progress is now running. DoctorStorageFindingKindV1::PendingSchemaMigration is now schema_convergence_incomplete, with the finding and Doctor read functions renamed to match. - SchemaConvergenceProgressV1 and SchemaConvergenceFindingV1.progress are removed. Nothing produced progress, even before this lane; it described the per-row and per-page migration passes. - Doctor, status, MCP, dashboard labels and docs now describe the audit convergence instead of schema migrations. Contracts, the TypeScript SDK and the ChatGPT extension bundle are regenerated. Tests deleted: none. The progress assertions in the CLI, Doctor, dashboard API, MCP status and dashboard DOM tests are removed, and the state and kind strings in those tests use the new names. Upgrade impact: dashboard and SDK consumers see the convergence state strings pending and running, the storage finding kind schema_convergence_incomplete, and no progress field on convergence findings. Regenerate SDK clients. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items: - L111: the payload replay comparator keeps the two cases current capture still produces and drops the normalizations for records written by older capture code. Kept: a Cursor transcript mirrors one native record (top-level id or nested message.id) at another offset, so the same record id arrives with a new evidence range; snapshot hosts (Cline-family, Kiro) and Vibe derive their leading location-only Session fact again on every rescan from mutable task metadata or workspace mappings, so a retained record can see its location move. Removed: the Codex turn_id relation, session project_path/location_path/transcript_path, null tool arguments, unknown model and missing-model dimension normalizations, the Cursor thread_id relation, message model/timestamp and native_timestamp removals, the insertion of a missing leading location session, and remove_legacy_relation_when_current_absent, is_unknown_absent_model and current_adds_only_missing_model. - is_canonical_payload_revision_replay is renamed is_replayed_occurrence, and the ObservationCoverageReason::CanonicalPayloadRevision cursor advance reason is renamed ReplayedOccurrence (stored string replayed_occurrence). Tests deleted: canonical_payload_revision_adopts_only_dropped_codex_tool_arguments. canonical_payload_revision_replays_advance_typed_coverage becomes replayed_cursor_occurrence_advances_typed_coverage over a mirrored Cursor offset; the compatibility test runs from a current-form stored record; the snapshot test now asserts that a moved location adopts and that a record retained without its location session collides. The two global-db revision tests use a mirrored Cursor occurrence instead of a legacy Codex record. Upgrade impact: records captured by older builds that differ from the current capture only in the removed fields now report identity collisions on re-ingest. Reset the profile session store; history is rebuilt from host transcripts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items: - L110: the Cline-family combined-source to native-stream transition. ClineNativeSourceTransition, cline_native_source_successor_id and prove_cline_native_source_transition are gone, with observation_projection/source_transition.rs, the NativeSourceSuperseded skip reason and every apply, rebuild, audit and lineage branch that verified or settled it, the adapter's pending Cline alias acceptance and supersession preflight, the rusqlite shared-alias transition, and the session-memory host_source_predecessor, superseded-receipt check and read_host_observation. Host source commits are always Initial; a retained receipt is valid only while its object is the latest one. ClineTranscriptStream and cline_task_native_observation_id stay: host source capture keys every current Cline stream record's native object by the task-level id. - L134: the sanitizer's two Claude no-native-id arms and the projection's synthesizes_native_record_id exemption. - L112: ObservationIdentityMaterialV1::new is deleted and native_record_id is a required field. The range-only observation id derivation, the sanitizer's file-bytes no-native-id branch and the optional provider record alias are gone; every retrieval anchor carries that alias. Fixture rewrite: session_suite store fixtures give each Claude row a uuid per generation and range, as captured rows carry. A Claude row projects under its own record id, so two observations can no longer own one Claude output; the seven projection tests whose scenario is several observations owning one output across generations or offsets now use an opencode shared-output fixture with distinct native ids and one message relation. The projection write helper builds its cursor from the observation's own source, and the table-count tests count the native alias row. Pinned identity and receipt hashes follow the native identity, and the receipt test now varies the native record it is bound to. Tests deleted: cline_native_transition_proofs_bind_exact_records_and_stable_lookup_ids, cline_native_transition_rejects_source_scope_and_native_identity_mismatches, cline_native_transition_rejects_authored_and_native_evidence_changes, cline_native_transition_preserves_sanitization_authority, cline_native_transition_rejects_invalid_ui_offsets_and_ordering_domains, cline_retained_cutover_keeps_objects_and_replays_historical_receipts, cline_retained_cutover_denies_changed_facts_and_wrong_stream, cline_cutover_requires_the_durable_retained_receipt_and_exact_revision, cline_stream_alias_waits_for_projection_and_preserves_historical_receipt, cline_stream_alias_refuses_changed_usage_or_wrong_native_stream, session_suite observation_projection/source_transition.rs (four tests), provider_sanitizer_allows_only_legacy_claude_to_omit_native_record_identity, only_claude_may_omit_the_native_record_id_on_identity_material. Upgrade impact: stores holding combined-source Cline observations, native_source_superseded dispositions, or identity material without a native record id (range-only Claude captures) fail to decode or collide on re-ingest. Reset the profile session store; history is rebuilt from host transcripts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items:
- Shape check for the U32 revival columns and the U27 document-digest
column. projection_queue is in the exact authority-schema column
contract, so any registered store whose queue lacks
revival_generation/revival_start_offset is refused at admission with
reset_required("authority schema"); the new test rebuilds the queue in
its pre-revival shape and asserts that refusal. managed_test_runs is
not in that contract, but its only writer is the MCP managed-run
recorder over the project sessions lease, which
SessionRuntimeRegistry::project_sessions refuses for any store held
in its typed reset-required state. Every hosted store with a
pre-digest table carries an LCM marker of 15 or lower, because the
table and the LCM schema were installed in the same admission
transaction from the table's first release, and LCM 16 refuses those
markers. No code change was needed.
Tests deleted: none.
Upgrade impact: none.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: L013/L068 (fixed-action fact_* tool aliases and the fact_type->category translation in the plugin), L052 (hermes_cli.config get_hermes_home fallback), L053 (register_context_engine capability gate), L062 (state.db column probing and no-active frontier variant), L064 (wrapper compatibility API forwarders, /capabilities, _proxy). Callers migrated: skill.md and the stock/unit check scripts use fact_store(action=...) with category; the Hermes ctx test stubs implement register_context_engine; the sessions fixtures build state.db from one current-schema DDL (TEST_STATE_DB_SCHEMA_SQL); docs/dashboard.md no longer describes the /legacy frontend proxy. Tests deleted: fact_add/fact_type alias assertions (unit check, stock check), the LegacyCtx registration case, the minimal legacy state.db fixture and its pagination/seek-plan halves, and sweep_reads_legacy_stores_without_active_or_reasoning_columns. Upgrade impact: Hermes must provide hermes_constants, register_context_engine and the current state.db sessions/messages columns. Older builds fail plugin load, and their state.db is refused with a typed missing-columns error instead of being ingested. Agents must call fact_store(action=...); fact_add/fact_search/... and the wrapper's /holographic, /lcm, /graph, /savings, /analytics, /automation and /capabilities routes no longer exist. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: L057 (Codex event_msg user_message records), L058 (id-less Codex response goal context; Claude API-error placeholders recognised by the synthetic model without isApiErrorMessage), L063 (Kiro <workspace-hash>/<execution-id>.chat layout and its two .chat discovery scans), L067 (render-codex-hook-inputs user_message branch and the retired static tracedecay hint classification). The Cursor epoch-ms createdAt handling stays: Cursor's store keeps old composers, so it is current data. Callers migrated: every Codex rollout fixture in the sessions, host-admission, transcript-ingest, mcp, runtime and transport suites, the two benches and tool_sweep now write item_completed/UserMessage via one helper per crate; Kiro fixtures use extensionless execution files. Tests deleted: kiro_legacy_chat_populates_searchable_messages and write_legacy_chat, the content-addressed session_rewrite case, the older synthetic-model placeholder case, test_legacy_user_message_remains_supported. Upgrade impact: Codex rollouts with event_msg user_message prompts, Codex response goal-context items without an id, and Kiro .chat transcripts are no longer ingested; rows already ingested are kept. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Item removed: L056. AutomationTaskLock now holds only the <key>.lease file. Deleted the <key>.lock.lock publication-coordination lease, retire_pre_lease_owner, PreLeaseOwner, read_pre_lease_owner, parse_unique_lock_field, recorded_owner_was_reused, unverifiable_pre_lease_owner and MAX_PRE_LEASE_TASK_LOCK_BYTES. process_state, foreign_process_is_dead and append_lock_path stay: other callers use them. Callers migrated: the scheduler prefilter and memory-curator runner tests that held a lock by writing a pid file now hold a real lease through AutomationTaskLock::try_acquire(_keyed). Tests deleted: the old/new process participant harness and old_and_new_processes_exclude_publication_and_execution_until_release, the five pre_lease_* unit tests plus reaped_pid, the pid-file reclaim cases in automation_runner_test (and the liveness child helpers), and memory_curator_runner_recovers_stale_scheduler_lock_file. The cancellation, symlink and lifecycle tests lose their lock.lock halves. Upgrade impact: an older daemon that is still running no longer excludes the new daemon, so both can run the same automation task at once during a mixed-version upgrade. Stop the old daemon before starting the new one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: L060, L071, L079, L081. The daemon no longer serves a version-skewed client with a warning. Every handshake is checked once, before anything is routed: a client from another build, a client that reports no version, or one with a non-conforming instance id gets one typed unsupported_revision refusal frame, and the connection closes. Removed: the six #[serde(default)] handshake fields (a handshake missing any of them is refused as unsupported_revision), the empty-version no-skew rule, the per-client admission bypass for invalid instance ids, the skew log (client_version_skew_to_log, log_client_version_skew, logged_client_version_skews), the proxy-side skew warning (daemon_version_skew_warning_for_request), refuse_enrollment_from_another_build (subsumed by the handshake check), and the mixed-version docs. The saturation path now requires the auth preface and applies the same refusal. Callers migrated: daemon_reachable and daemon_socket_connectable take the caller's build version instead of daemon-control's own crate version, and the readiness probe reads a typed refusal frame as a running daemon of another version. Integration suites build handshakes through one helper that names only the release; the fixture runtime reports its release without a commit so a test process matches the daemon binary it spawns. Fixture client ids are conforming. Tests deleted: the legacy handshake decode cases, the version-skew log test, the empty-version skew case, per-client admission for legacy clients, the enrollment-from-another-build test, the legacy listChanged half of the proxy metadata test, the proxy skew-warning assertion in mcp_cli_serve_test. Added: skewed-client refusal at the handshake and over the live daemon, every-field-required, probe refusal case. Upgrade impact: an older CLI or long-lived `tracedecay serve` talking to a newer daemon, or the reverse, is refused with unsupported_revision (daemon_protocol_revision_skew) instead of being served with a warning. Restart MCP hosts and any running `tracedecay serve` after upgrading. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: L016 (since/until aliases on tracedecay_lcm_grep, in the
MCP catalog schema, LcmGrepRequestV1, the retrieval merge, and the Hermes
lcm_grep schema), L061/L076 (bare `initialized` MCP method), L070
(AffectedResultV1.affected_tests and AffectedRankingMetadataV1.
compatibility_field; count and touched files now derive from
ranked_tests), L080 (authority_audit_error mirroring the typed reason; the
key now carries only the observed detail, null otherwise). message_search
and sessions_for keep their own since/until, and LSP `initialized` is
untouched.
Callers migrated: the lcm_grep MCP test and the preserved-profile
journey send start_time; the affected tests and the golden JSON assert
ranked_tests; the SDK client fixture drops the removed fields.
Regenerated in this commit: sdks/typescript/src/operations.ts and
plugin/chatgpt-extension/embedded/server.mjs (contracts:check and
check:embedded pass). The regeneration also picks up the StatusHookReplayV1
`waiting` variant that master's generated SDK was missing.
Tests deleted: the "compatibility list must remain exhaustive and
path-sorted" assertion. Added: classify_mcp_method("initialized") is
Unknown.
Upgrade impact: lcm_grep requests that send since/until are rejected;
use start_time/end_time. A host that sends a bare `initialized` gets
method-not-found; hosts must send notifications/initialized.
tracedecay_affected no longer returns affected_tests or
ranking_metadata.compatibility_field; read ranked_tests/recommended_tests.
Regenerate SDK clients. Doctor readers use authority_audit_reason.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Items removed: L069 (CodeIndexWorktreeFreshnessV1.rebuild_in_flight default), L073 (source_role default on CompactCandidate, FusedCandidate, ExactLaneEvidence and LexicalLaneEvidence, plus the LexicalRouteReceiptV1.decision default), L075 (the StorageReport and StorageReportCoverage serde defaults for size_coverage, root_state, unavailable_entry_count, graph_container, graph_replay_pool, code_generation_retention_availability, user_sessions_db_bytes, unregistered_size, unregistered_count_is_lower_bound, and the digest_verified default plus digest_verified_default), L077 (ReaderPoolSnapshot.snapshot_admissions default). Defaults paired with skip_serializing_if (full_profile_size, footprint, reason) stay. Regenerated: dashboard/codegen/schemas/dashboard-contracts.schema.json, sdks/typescript/src/operations.ts and plugin/chatgpt-extension/embedded/ server.mjs (contracts:check and check:embedded pass). Tests deleted: the older-response half of graph_serving_readiness_is_additive_for_older_daemon_responses (the test keeps the terminal-verdict cases under a new name) and exact_lane_evidence_treats_missing_source_role_as_production_other. Upgrade impact: a new CLI reading a storage report or freshness payload from an older daemon fails to decode it. Restart the daemon after upgrading. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Item removed: L072. The git index preview input, preview and receipt wire structs no longer accept commit_intent, commit_intent_digest or created_commit (deny_unknown_fields now rejects them), the digest material no longer carries the always-null commit_intent_digest and created_commit keys, and final_snapshot_captured is required instead of defaulting to true. default_true stays: other crates use it. Tests deleted: records_stored_before_commit_index_removal_still_decode and tests/fixtures/git_index_legacy/ (three JSON fixtures). Added: removed_commit_fields_and_missing_receipt_flags_are_refused, which builds current records and proves the removed fields and the missing flag are refused. Upgrade impact: dropping the null keys changes the digest of every preview, preview input and receipt, so stored pending git-index previews and stored receipts written by an earlier build fail digest verification and are refused with the existing typed digest-mismatch error. Re-create pending git-index previews after upgrading. No migration code was added. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
U17 (fb73388) made FusedCandidate.source_role required, but two tracedecay-mcp unit fixtures still decoded candidates from JSON without it, so route_evidence_is_attached_only_when_additional_routes_ran and markdown_search_trims_the_weak_tail_but_json_returns_every_row panicked with `missing field source_role` on Linux fleet CI. The fixtures now carry the current shape. No other fixture in the repo decodes a FusedCandidate from JSON (rg for "utility_micros" outside generated schemas). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
U16 (c912814) removed the bare `initialized` MCP alias, so classify_mcp_method("initialized") is Unknown and the request is no longer reserved control traffic. mcp_discovery_requests_are_reserved_control_traffic still asserted the alias was reserved and failed in //crates/tracedecay:unit_test on Linux fleet CI. The test now covers only notifications/initialized. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…nto integration/legacy-removal # Conflicts: # crates/tracedecay/tests/automation_runner_test/scheduler.rs # docs/dashboard.md # plugin/chatgpt-extension/embedded/server.mjs
…nto integration/legacy-removal Conflicts: - host_bundle/component_set.rs: recorded_creations keeps lane A's single per-component receipt and lane C's required created_config Vec. - host_bundle/writer.rs: control imports drop both HOST_BUNDLE_LOCK_FILE (lane C) and component_slug/superseded_identities (lane A). - host_bundle/tests.rs: the operator-mcp legacy-receipt tests stay deleted (lane A); lane C only touched their created_config fixtures. - tracedecay-store/src/lib.rs and session_suite/observation_projection: projection re-exports drop CLAUDE_SESSION_MESSAGE_PROJECTOR_VERSION (lane A) and the v4/v5 predecessors and ProjectionPredecessorConvergence (lane C). - plugin/chatgpt-extension/embedded/server.mjs: regenerated with scripts/build.mjs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ScriptedAlchemy
enabled auto-merge
October 29, 2026 19:13
|
This was referenced Oct 29, 2026
ScriptedAlchemy
added a commit
that referenced
this pull request
Oct 30, 2026
hook_branch_write_lands_in_a_sealed_single_store_generation failed on CI for two unrelated PRs (#4618, #4623) with code_index_activation_unavailable: the branch publisher waited for a generation at the new HEAD that the scheduler never built. The reconcile pass sampled the git-metadata freshness witness in mark_reconciled, after capture, because capture can refresh .git/index. When a commit landed between capture and mark, the pass sealed a dirty snapshot with no source revision but recorded the post-commit HEAD as reconciled. A commit leaves worktree stats unchanged, so every later freshness probe answered Current and no pass ever built the new HEAD. mark_reconciled now takes the fingerprint sampled before the pass read any source. If HEAD or a ref moved since then, it records that earlier sample, so the next probe sees the move. The index stays out of the comparison because capture may refresh it on its own. The same run showed the sibling path: post-projection source verification found the moved source, its rebuild lost the publication compare-and-swap, and the worker only logged it. A lost publication race (CompareAndSwap, PublicationConflict) now wakes a rescan there and takes the bounded capacity retry in the main reconcile loop. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Removing the tracedecay_runtime_core::windows_security re-export pointed windows_task.rs at tracedecay_private_fs and added that crate under [target.'cfg(windows)'.dependencies]. gen_builds resolves the Linux graph only and silently dropped the member dependency, so the generated BUILD file lacked it and the Windows build failed with eleven E0433 errors in tracedecay-daemon-control. Declare the dependency unconditionally, as tracedecay-runtime-core already does; the code that uses it stays cfg(windows). gen_builds now refuses a workspace-member dependency gated off Linux instead of dropping it, so the next one fails at generation rather than on the Windows runner. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
dropping_request_waiting_pair_before_submit_abandons_both_authorities failed once on the Linux fleet: "request-waiting pair did not abandon both authorities before releasing its locks" after its 5 s deadline. It passes 10/10 alone and 4/4 in full-suite runs locally. Four wait loops in these tests probe the journal, the recovery index, or the task lock with blocking calls and then only yield_now before probing again. On a 4-worker runtime inside a binary running hundreds of tests in parallel on an oversubscribed host, that spin keeps a worker busy and competes with the settlement work being awaited. The loops now sleep 10 ms between probes. The deadlines and every asserted state are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Integration: remove all legacy support
tracedecay keeps no legacy or backward-compatibility code. This PR combines the three legacy-removal lanes so they share one CI run. Run separately, they conflict with each other and with master in shared generated files. Each lane is merged with
--no-ff, so its per-unit commits are preserved.Land this as a merge commit, not a squash. A merge commit marks each lane PR as merged automatically.
AGENTS.mdno-legacy rulecommit_indexdecoding (U12–U18)628 files changed: +5,443 / −45,108.
The upgrade impact is listed in each lane PR and in every unit's commit body. In short:
sessions.dbresets, and LCM summary history is lost;tracedecay update-plugin;How the lanes were combined
scheduler.rskeeps lane B's deletion of the pid-lock tests.docs/dashboard.mdkeeps lane A's wording with lane B's Hermes removal.host_bundle/{component_set,writer,tests}.rs, lane A's single-receipt operator-mcp removal is combined with lane C's requiredcreated_config. The legacy-receipt test block stays deleted.tracedecay-store/src/lib.rsand thesession_suiteprojection fixtures, re-exports are dropped from both lanes.Verification (head
ff23e40418, up to date with master)bazel build --config=clippy //crates/...: clean.bazel test //...: 172/173 targets pass. The remaining one iscore_cli_suite, where fourremote_cli_testHTTPS cases fail. They fail identically onorigin/master(0f734a50dc) in the same worktree.gen_builds --check,contracts:checkand the ChatGPT-extensionbuild.mjs --checkare current.tsc --noEmitpasses, as does vitest (2,236 tests).rustfmt --checkpasses on all 506 changed Rust files.🤖 Generated with Claude Code