feat: consolidate TraceDecay V2 PR8-PR13 delivery - #707
feat: consolidate TraceDecay V2 PR8-PR13 delivery#707ScriptedAlchemy wants to merge 1546 commits into
Conversation
🦋 Changeset detectedLatest commit: 0d11921 The changes in this PR will be included in the next version bump. Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
Post-reopen correction pushed in a23f86a: source-neutral background reconcile no longer advances the scheduler epoch and cancel in-flight text activation; mounted hook overflow uses the explicit invalidating path. Evidence: RED reproduced 0/1, GREEN 1/1 for ordinary_background_reconcile_does_not_supersede_in_flight_text_work; cargo check --lib --locked passed. |
💡 Codex Reviewtracedecay/.github/workflows/release.yml Lines 408 to 411 in fc20c4f  Install the bundled Linux runtime beside the binary
For Linux targets, this archive now contains tracedecay/release-please-config.json Lines 22 to 25 in fc20c4f Advance the SDK version in release PRs
The new npm publication job derives its version from the packed tracedecay/dashboard/src/workspaces/delivery/DeliveryPage.tsx Lines 80 to 82 in fc20c4f Scope Delivery queries to the selected project
When the scope bar selects a project other than the active project, this query keeps the same cache key and continues fetching the unprefixed active-project route. The dashboard already provides tracedecay/src/tracedecay/lifecycle/registry.rs Lines 118 to 122 in fc20c4f Include Git remote identity in the registration digest
When AGENTS.md reference: AGENTS.md:L159-L161 tracedecay/plugin/cursor-native-extension/src/extension.ts Lines 187 to 189 in fc20c4f  Batch startup diagnostics instead of dropping the tail
At activation or language-client restart, ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
fix(clippy): clear the workspace clippy failures on #707
Removing the re-export shims left their module doc comments orphaned in `context` and `graph`. The rest are pre-existing lints that only fire under `--all-features`, which compiles the `test-transport` support surface as non-test code: - the registered-test-server constructor gets the file's existing explicit `expect_used` allow, since `lib.rs` denies it only outside `cfg(test)`; - `http_application_registry` is read by the `cfg(test)` capacity journey and only reads as dead under `test-transport` alone, so the allow is gated to `not(test)` rather than renamed to a discard; - the hotpath cadence helpers keep `#[inline(always)]` with an explicit allow, preserving the author's intent instead of silently downgrading it. The `daemon_suite` restart wait is now the original helper recovered from the PR #707 head rather than a reconstruction: it additionally proves the runtime readiness receipt authorizes the exact configuration the SDK selected.
The relocation fix that anchored this test above the package allocated a `PathBuf` only to hand out a reference, which `-D warnings` rejects as `unnecessary_to_owned` and which failed the Clippy gate on #707. `validate_requested_workload` takes `&Path`, and `CARGO_MANIFEST_DIR` is a literal, so `Path::new` yields a `&'static Path` with no allocation and no temporary to borrow from.
|
#733 landed Clippy-red. Helper branch (not merged, shared checkout untouched):
Clears the #733 Clippy denials:
Adopt when you want: I will not land this on #707. |
|
Clippy helper is now on the Codex worktrees (still not landed on this PR head):
Same change as |
|
Isolated post-#721 verification (worktree Green (non-vacuous) on merge
Not green
Clippy helper remains on this tree at |
Ports the missing pieces of commit b1e41b712 ("fix(build): land the
batching commit's missing consumers") onto #707: HookCompletedReadinessDistributions
moved into tracedecay-agent-hosts with pub(crate) fields, so
input_rows_processed, input_rows_dropped_at_cap, and events_considered
are no longer reachable outside the crate. Adds the three public
accessors.
source_event and input_rows_received (also added by the source commit)
are not ported: nothing on this branch reads them through an accessor
today - the root-crate benchmark still compares via
serde_json::to_value(&readiness_distributions)["field"], which does
not need them.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
5d8f2a1 to
c7fcf3f
Compare
…d6ed chore(vendor): stacked vendor-only PR for #707 — generated vendor churn, land first
…rules Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
…plan-reopened' into HEAD
Keep engine and automation conversions with their owning crates while removing the runtime-core dependency from daemon-protocol.
…plan-reopened' into perf/root-crate-shrink
…plan-reopened' into codex/tracedecay-total-redesign-plan-reopened
A permanent CRC fault in the registry-owned durable graph container was retried identically forever: every mount refaulted the same typed Corrupt verdict, every activation refused, and the project runtime stayed unadmitted until an operator manually moved the store and WAL aside (issue #763). The container is a derived index in every namespace it serves, so the manual recovery was always safe — this makes it automatic and typed. The mount now re-proves a corruption verdict itself under an exclusive cross-incarnation decision lock; only a second byte-identical fault quarantines the container family (WAL sidecar, verified marker, spill, then the container last) into a timestamped `.corrupt-<micros>` sibling directory with a durable store-quarantined.json receipt carrying the fault fingerprint, then reopens the vacant path fresh so the relational replay journal re-projects every generation. A held decision lock defers retryably; a drifting fault stays terminal; forensic bytes are never deleted. Publication now treats a quarantined generation as a cache miss instead of a refusal, because the republish re-projects the rows and re-proves the digest — the repair the quarantine was waiting for.
The graph mount's corruption quarantine (issue #763) retains the corrupt container family in a timestamped `.corrupt-<micros>` directory beside the rebuilt store. The incident-debris scan previously skipped directories, so Doctor could not see the retained forensics. A debris-named directory is now one typed Corrupt artifact sized by its recursive payload, flowing into the existing IncidentDebrisPresent finding; the sweep leaves it in place because it is already quarantined evidence, never loose debris to relocate or collect.
A preexisting zero-byte container is the corruption class a crash or a full disk leaves behind. The registry contract previously pinned the terminal Corrupt fault that issue #763 removed; it now pins the quarantine-and-fresh-remount recovery with the forensic file retained.
…plan-reopened' into td-763-quarantine
Introduce lower service ports, move invocation-owned cancellation, and relocate dependency-clean MCP handlers without widening the MCP production closure.
…plan-reopened' into perf/root-crate-shrink
…plan-reopened' into perf/root-crate-shrink
lcm_status, lcm_grep, message_search, and every other retained surface failed with a bare "The retained operation authority is unavailable" / "reported an application failure" because map_execution_error collapsed ten rich TraceDecayError variants into a unit Unavailable and the renderer emitted a static sentence. Unavailable now carries the producer's detail; the renderer appends it to the diagnostic message after sanitizing at one choke point (control chars, trim, 512-byte char-boundary truncation) so SafeDiagnostic validation cannot drop the problem. Every producer names its real cause: mount/admission sites get honest statics, decode/serde/receipt/git/workflow-index sites thread the inner error Display, and the LCM execution outcomes split ready/ unavailable/failed with their typed reasons.
Layout already knew every file span but discarded them, so source_scan re-walked the sealed files array one byte at a time. Record the ranges, read_exact, and admit on the indexing pool.
Per-file extraction now retains the references its own symbol table cannot bind (kind-filtered, blocklisted ubiquitous names and dotted receivers excluded), and generation sealing resolves them against the whole staged file set into NameResolved relation edges. The same-file binder gains the Calls/Implements target-kind matrix and no longer fabricates a self edge from a dotted receiver call, and generation validation re-derives edge evidence with the sealing authority.
Symbol line-bounds validation now cross-checks the extraction-attested byte span (which begins at leading docs/attrs) against the attested declaration lines instead of requiring them to coincide, so every docs-carrying symbol stops failing before the effect. Symbol resolution accepts module-qualified and backslash-path forms as a suffix of the stored file-path-qualified chain, and a failed preview now reports the guard's own typed failure detail instead of one generic label.
tracedecay_changelog and tracedecay_run_affected_tests now take their graph admission lazily (like pr_context), so a repository git refuses or a request without manifest-scoped changed paths reports its typed refusal instead of dying on an unmounted graph projection. Git-backed tools refuse a directory without a HEAD reference at open, and tracedecay_diagnose normalizes absolute and backslash compiler paths before mapping diagnostics to graph nodes.
A project whose verified source publishes no code generation at all (every file unsupported or unextractable) is a typed state, not a warming one: the scheduler and registry expose it, and the production composition harness accepts it instead of exhausting its publication timeout. The test source-edit authority likewise reports a direct server without the production graph projection port as a typed not-mounted state, so dispatch-boundary journeys stay reachable.
The changelog journey asserts the unborn-HEAD refusal its enrolled fixture repository actually produces (the no-repository refusal is covered at the git shell boundary), graph-query production calls keep the markdown default for markdown-default tools, the high-limit search journey follows the truncation envelope's retrieve handle, and the source-edit fixture proceeds through the dispatch boundary when the direct server cannot mount the production source-edit authority.
…plan-reopened' into HEAD # Conflicts: # crates/tracedecay/src/mcp/server.rs
A quarantine-recovery replay stages several whole-corpus scope generations into the one shared staging store within a single daemon incarnation. Bulk staging accumulates MVCC version chains and completed transaction metadata that nothing prunes (the engine's version GC runs only when called, and nothing called it), and on glibc the freed nodes stay in retained arenas the kernel still counts as anon RSS. The only release was a process restart: the daemon grew unboundedly, the kernel OOM-killed it (39.9-45.6 GB anon against a 12.4 GB store, six kills in one day), and the replay resumed from durable page receipts - converging only through repeated crashes (#762). Count applied mutation records in the batch apply paths and, when a completed publication crosses a corpus-sized budget, prune in place: engine MVCC GC, then malloc_trim to return the freed arenas. The release runs with no gate held and never converts a settled publication into a failure. A close/reopen collapse was measured and rejected: it rebuilds the store beside the retained old heap, raising both resident and peak (quarantine_replay_rss probe). Serialize corpus-sized sealed publication builds per shard: concurrent scope publications each hold a decoded generation, a projection manifest, staging pages, and the sealed-store copy at once, and unbounded overlap of those transients is what grew the replay working set past physical memory. Waiters observe their typed interruption.
The incident retry loop re-attempts a corpus-sized sealed publication every minute; an interrupted attempt frees the same decoded-generation, manifest, and page transients a settled one does, and without a release those freed arenas accumulate across retries exactly like settled staging. Run the release per attempt on success and failure alike, gated on daemon lifecycle rather than the request's already-spent interruption, and unconditionally rather than budget-gated: a sealed publication attempt is corpus-sized by construction. The budget-gated release stays on the shared publish path for small inline publications.
2 participants
Replacement review for #421 after its accidental merge was reverted from master in 52a9aab. This commit has the exact tree of #421 head d4c67d4. Do not merge until explicitly authorized.