fix(sessions)!: scope stale session-store refusals and reset - #2613
Conversation
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d6dbe50a22
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| session_store, | ||
| Arc::new(primitive_runtime::ResetRequiredSessionLookupV1), |
There was a problem hiding this comment.
When the project session store contains pre-unified observation rows, this passes its unrestricted reset-required lease into the normal primitive runtime. That runtime retains the lease as both observation_database and test_runs.store: health_delta calls compute_verified_health_delta, which can read and insert observations and converts failures into generic unavailable evidence, while test_results still queries the same session store. These operations therefore bypass the typed reset refusal—and may write into the incompatible authority—even though only code reads should remain available; use a reduced capability or explicitly refuse every observation/session-backed primitive.
AGENTS.md reference: AGENTS.md:L189-L190
Useful? React with 👍 / 👎.
A session store whose observation rows predate the unified observation identity is admitted for its other authorities and refuses only session features, so project open, code intelligence, and MCP keep serving. `tracedecay wipe --stale --yes` deletes exactly the stores the daemon reports as requiring reset. BREAKING CHANGE: session-store reset refusals name `tracedecay wipe --stale --yes` instead of `tracedecay wipe --all --yes`.
d6dbe50 to
bd49607
Compare
A session store whose LCM schema version, git correlation version, or workflow schema identity this binary refuses is now admitted untouched for its other authorities, the same way #2613 admits a store whose observation rows predate the unified identity. Project open, code intelligence, and MCP initialize/tools/list keep serving; every session feature answers the typed reset refusal naming `tracedecay wipe --stale --yes`; doctor counts the store as a pending operator action; and the scoped reset deletes exactly that store. When a later authority also fails, the earliest session refusal stays the store's hard verdict, so a legacy store keeps its LCM identity.
1 participant
Cause
After beta.61 the operator's profile-sessions store and two project-sessions stores still held observation rows from before the unified observation identity. Schema admission refused the whole store (
ResetRequired { authority: "observations" }). A project-sessions store also holds the project's configuration and query cursor keys, so the project's own open failed. Project open landed inStalled (UnrepairableVerdict)and scheduled another retry. The core route never published, so status, search, and every other code tool answeredapplication.surface.reset_required, and the code graph never published either. Doctor counted the stall as an issue and printedRun tracedecay install. The named remedy wastracedecay wipe --all --yes.A second, separate break: since #2332 the retained core route never mounted its query authority after a daemon restart. That route is the one serving whenever a session store refuses the full upgrade. The waiter polled
latest_generation_id, and a partitioned restore leaves that empty, so search stayedgraph_warming. The existingreset_required_profile_session_store_is_served_typed_until_its_named_resetjourney already fails on this.Design
Refusal scoped to the stale authority.
ensure_observation_schemareports stale observation rows as a refused authority instead of failing the whole store. The rows stay unread, the marker is not adopted, and nothing is rewritten. The store's other authorities are admitted, it is never converged, and the owner and leases carry the refusal (reset_required()).project_sessions,mount_registered_project_sessions,mounted_project_sessions, andprofile_sessionsanswer the typed refusal.project_session_storeandmounted_project_session_storeserve only the non-session authorities (configuration and query cursor keys). Project open, branch-admin configuration, and the query-authority mount use those.ResetRequired(detail). Owners that are still missing then answer that typed refusal (kind: reset_required, remedytracedecay wipe --stale --yes) instead ofowner_failed. The retained core also registers the code-read owners (callable-code authorization and primitive runtime). Callers, file dependents, and diagnostics serve, and session lookups answerTemporalRetrievalFailure::ResetRequired.retry_deferred_query_authority_until_serving, the same wait the full route's deferred mount already uses. The hand-written loop that missed partitioned restores is deleted.Scoped remedy:
tracedecay wipe --stale --yes. It is the only new shape.storelabel throughResettableStoreV1.wipe --all --yes.<name>.db*,.<name>.db.*,<name>.grafeo*. There is no backup or copy, and the daemon recreates each store empty.StoreResetRequiredV1.remedy, tool refusals for registered-store authorities, doctor, and update now nametracedecay wipe --stale --yes.pending_actions), not a warning.Fails on master
The new
typed_terminal_restart_acceptance::stale_sessions_store_reset::stale_session_stores_refuse_sessions_only_until_their_scoped_resetfails on f883da9:The existing
reset_required_serving::reset_required_profile_session_store_is_served_typed_until_its_named_resetfails with master's query-authority waiter:Both pass on this branch. The new test covers:
initializeandtools/list, search, callers, and file dependents serving over stale stores.reset_requirednamingtracedecay wipe --stale --yes.wipe --staledeleting only the two session stores. Every other profile file stays byte-identical exceptlifecycle.lock.Runtime journey (built
tracedecaybinary)Setup: an isolated
HOME, a clone ofcargo-slotas the corpus, and a daemon under a 6 GBsystemd-runscope. The corpus was indexed, the daemon stopped, and both session stores given the pre-unified observation row with the marker removed. Then the daemon was restarted:Verification (local, after rebase on a7200ad)
cargo clippy -p tracedecay-domain -p tracedecay-global-db -p tracedecay-store-runtime -p tracedecay-daemon-service -p tracedecay-mcp -p tracedecay -p tracedecay-cli -p tracedecay-daemon-control -p tracedecay-project --all-targets --features tracedecay/test-transport,tracedecay/test-helpers,tracedecay-cli/test-transport -- -D warnings: clean.cargo fmt --all -- --check: clean.mcp_suite: 607 passed.transport_acceptance_suite: 14 passed, including both reset journeys. 1 failed:v2_surface_mount_conformance, becauseast_grep_rewriteis unlisted when the hermetic testPATHhas noast-grep. This is environmental on this host and unrelated.tracedecay-application: lib 482,application_suite66,pr_tracking7.tracedecay-daemon-service: 322 (includesadoption_observation).tracedecay-global-db: 385.tracedecay-mcp: 387.tracedecay-domain: 224 plusdomain_suite168.tracedecay-store-runtime: 122.tracedecay-daemon-control: 100.tracedecay-project: 38.tracedecay): 347 passed.tracedecaylib: 768 passed. 1 failed:verified_graph_query_authority_tests::absent_query_port_fails_closed_for_every_awaiting_graph_handler. It is red on master since feat(loom)!: record session-attributed test runs durably #2583, reproduced on f883da9 and filed as absent_query_port_fails_closed_for_every_awaiting_graph_handler red since #2583 #2611.Operator command after the next release
Fixes #2587
BREAKING CHANGE: session-store reset refusals name
tracedecay wipe --stale --yes;wipegains--stale.