fix(boundary): validate at edges and stop re-parsing admitted values

[ScriptedAlchemy]

Summary

• Review of PR feat: TraceDecay V2 delivery (PR8–PR13) + daemon performance, memory, and reliability overhaul #707 through boundary-discipline only. This PR targets codex/tracedecay-total-redesign-plan-reopened and must not be merged to master.
• Merged tip 3e6167b265639c17b7d1c174cd3b7baa3116adae into this branch (01df00f417). No conflicts. The tip already absorbed NotApplicable, dropped the removed reused chunk list, and kept publication-authority park fail-closed.
• Validation, confirmation, and wire serialization stay at the shell. Already-admitted types are not re-parsed, and transport names are not application contracts.

Motivation

Boundary discipline: validate at CLI, config, and host-stdin boundaries; trust typed data inside; keep business logic out of framework wiring; do not re-export wire or private representations through the public surface.

Changes

boundary-discipline fixes

• Claude Stop uses the shared hook stdin admission. Oversized stdin exits 0; a read error exits 1. It no longer continues on an empty event.
• PATCH /api/settings/user parses watcher_debounce once into milliseconds. The planner writes ConfigurationValueV1::Unsigned and does not parse the display string again.
• Artifact backup requires --yes, matching HostBundleWriterV1. Help no longer shows an unconfirmed backup that the writer refuses.
• Observatory and costs read models stay typed in application. MCP and diagnostics serialize them at the edge.
• Retention is not a registered setting. Snapshot load ignores invented retention JSON. Legacy config.json still validates RetentionConfig at file parse.
• Dashboard storage telemetry no longer tells operators to set sync.retention.v1.

Tip absorbed (no local rework)

• CodeIndexDemandAdmissionV1::NotApplicable is matched in branch publication.
• ChangedCodeChunkSetV1.reused is gone; receipts use reused_count / reused_digest.
• Publication-authority park remains a terminal fail-closed path.

Findings left in place

These are real boundary smells, but fixing them here would widen the principle or drop a check the domain type does not yet own:

• Automation load still calls validate_config because that function parses schedule grammar AutomationSettingsV1::validate does not. Deleting the reload check would admit schedules the scheduler later rejects.
• SqliteDriverError is a string envelope on the domain error surface, not a rusqlite re-export. Renaming it is a wider public error change.
• Workflow topology helpers re-validate a definition they can also be called with directly. Those helpers are their own boundary.
• MCP analysis handlers still own ranking formulas. Extracting them is a larger pure-function move than this slice.

Test plan

• Merged tip compiles the previously broken tracedecay-code-index-runtime path used by agent-hosts, CLI, and MCP
• cargo test -p tracedecay-agent-hosts --lib hook_stdin_admission_is_one_policy
• cargo test -p tracedecay-cli --bin tracedecay artifact_backup_requires_the_writer_confirmation
• cargo test -p tracedecay-cli --bin tracedecay host_bundle_artifact_commands_parse_explicit_scope_and_confirmation
• cargo test -p tracedecay-api -p tracedecay-configuration -p tracedecay-application -p tracedecay-dashboard-api -p tracedecay-mcp --lib for admission, retention, planner, serializer, and budget tests
• cargo nextest run --workspace --no-fail-fast not run

Checklist

• No secrets, credentials, or .env files included
• Breaking changes: artifact backup now errors at the CLI without --yes (the writer already refused); Claude Stop stdin exit codes match the other hosts
• CHANGELOG.md left to release-please; this branch has no [Unreleased] section

  

[changeset-bot]

⚠️ No Changeset found

Latest commit: 01df00f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[ScriptedAlchemy]

Integrated or superseded directly on the #707 branch at ff36c4f; follow-up compile/typecheck regressions were fixed on that branch.