refactor(sessions)!: delete the Codex v1 source-cursor replay

[ScriptedAlchemy]

What was wrong

Codex admission read the retired per-session source cursor (ObservationSourceIdentityV1::for_provider(codex, session)) on every pass. When the v2 cursor from codex_observation_source_v2 lagged it, legacy_cursor_matches_current_file + replay_advanced_current_user_messages (CodexAdmissionMode::CurrentUserMessageReplay) replayed current user messages into v2. That is a data migration from an old identity into the new one, which the product rules forbid.

Why deleting it cannot duplicate observations

• Only binaries before 9786266 (2026-09-04) wrote the v1 Codex cursor; no current code writes one (native_ingest_source_identity("codex", ..) already resolves to v2).
• The unified-identity marker (fix(observation): reset stores predating unified identity #2555, 2026-09-28) is recorded at store creation, and a pre-existing store that holds observation rows without it is refused with the typed session-store reset (tracedecay wipe --stale --yes, fix(sessions)!: scope stale session-store refusals and reset #2613/fix(sessions): scope every session-store refusal to sessions #2648) before admission runs.
• So a v1 Codex cursor next to admitted rows can only exist in a store the daemon already refuses. In an admitted store, a leftover v1 cursor sits next to zero observation rows, and v2 admission from its own cursor re-admits nothing.

What changed

• codex/observation.rs: admission reads only the v2 source. Deleted CodexAdmissionMode, replay_advanced_current_user_messages, legacy_cursor_matches_current_file, the v1 cursor read, and the replay-frame branches.
• jsonl_observation_admission.rs: deleted the replay-only plumbing: with_required_start_cursor, with_max_end_offset, JsonlFrameAdmission::durable_unless_observation_exists, and the per-frame skip_if_observation_exists precheck path.
• HostAdmission::observation_receipt: removed along with its production (tracedecay-host-admission) and in-memory impls and HostAdmissionOutcome::observation_point_read_unavailable. Its only caller was the replay precheck.
• Deleted the tests that only protected the replay: replay_boundary_tests, legacy_current_message_migration_records_receipted_duplicate_coverage, and the three runtime_acceptance_suite legacy-migration tests.

Proof

Fail before / pass after. retired_source_cursor_neither_gates_nor_narrows_canonical_admission (sessions lib) seeds a v1 Codex cursor covering the whole rollout into an admitted store. It then drives the production hook entry try_admit_codex_jsonl_observations_for_project_with_admission twice and asserts literal counts: 3 frames persisted and 3 observations on the first pass, 0 persisted and still 3 observations on the second.

• origin/master: FAILED with assertion failed: !first.source_deferred, because the v1 cursor turned the pass into a deferred user-message replay.
• This branch: ok.

Typed operator state for a store carrying v1 cursor + rows. retired_codex_source_cursor_store_refuses_sessions_with_scoped_reset (runtime_acceptance_suite) does the following:

• Admits a 3-frame rollout into a registered profile store and seeds the v1 cursor.
• Ages the store to the pre-fix(observation): reset stores predating unified identity #2555 shape (removes the unified-identity marker).
• Reopens it and asserts ResetRequired { authority: "observations", reason: "observation rows predate the unified observation identity and cannot be read; reset the profile so ingestion can rebuild them from host transcripts" }, with the observations row count exactly 3 before and after.

Suites:

Suite	Result
cargo test -p tracedecay-sessions --lib	566 passed
-p tracedecay-host-admission --lib	91 passed
-p tracedecay --features test-helpers --test runtime_acceptance_suite -- codex	6 passed
--test transcript_ingest_suite -- codex (with the debug CLI built)	33 passed

• cargo clippy -p tracedecay-sessions -p tracedecay-host-admission --all-targets -- -D warnings: clean.
• cargo clippy -p tracedecay --features test-helpers --test runtime_acceptance_suite -- -D warnings: clean.
• cargo fmt --all -- --check: clean.
• No cfg(windows) code or Windows-only callers touched.

Runtime journey. Debug CLI from this branch, isolated HOME/TRACEDECAY_DATA_DIR, one daemon under systemd-run --user --scope -p MemoryMax=6G -p MemorySwapMax=1G, synthetic Codex rollout plus Cursor transcript:

$ tracedecay init
initialized …/journey/project; daemon code-index reconciliation requested
$ tracedecay sessions import --project-path $P
session import scheduled (session-sync.a736db17…); historical catch-up has remaining work 2
$ tracedecay sessions refresh begin --project-path $P --session-id 019a0000-0000-7000-8000-00000000c0de --provider codex --source 3 --target 3 --json
{ "outcome": "started", "handle": "srh_68a9a5ff…", "scope": "project", … }
$ tracedecay sessions refresh status … --json
{ "outcome": "complete", "receipt": { "coverage": { "visible": 2, … }, "frontier": { "committed_through": 3, "observed_through": 3 }, … "reason": { "kind": "caught_up" } … } }
$ tracedecay sessions search quartzledger --provider codex --project-path $P
[codex] proj_30f94f100d16c44d assistant: The quartzledger reconciliation is consistent.
[codex] proj_30f94f100d16c44d user: Codex journey: audit the quartzledger reconciliation

Fixes #2700

BREAKING CHANGE: Codex admission ignores cursors of the retired per-session source identity; stores that still carry them beside observation rows must be reset with tracedecay wipe --stale --yes.

[changeset-bot]

⚠️ No Changeset found

Latest commit: e1d5589

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR