Repository navigation
feat: consolidate pending TraceDecay changes - #4742
Merged
Merged
Conversation
Combine the open pull requests, including draft work, on one review branch. Reconcile duplicate canonical-body batching through bounded temporal reads and the shared ordered SQL authority. Complete the body-loader cutover and retain typed integrity failures.
|
This was referenced Nov 4, 2026
ScriptedAlchemy
marked this pull request as ready for review
November 4, 2026 03:06
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Note
Newer findings are available below. Devin Review posted a newer report on this PR, in addition to the findings presented here.
🔍 Devin Review: 1 flag
Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)
The global-store canonical ownership trigger requires an inline row with NULL content to have a canonical-body owner. The privacy fixture deliberately has no admitted body, so its fake inline representation now fails the FK before testing the full-text sink boundary. Keep it as an unavailable external representation with its quarantined metadata intact, and assert that the canary remains stored while no sink can retrieve it. Preserve the existing two full-text privacy regressions and all production constraints; no runtime or schema behavior changes. Native Bazel validation of the consolidated current head is still required.
Linux CI observed count-objects report six loose objects both before and after preflight, but different filesystem allocation in KiB. Compare the complete object directory's relative paths and byte contents instead of allocation blocks, preserving the stronger no-new-or-rewritten-object invariant alongside existing ref and worktree checks.
A scoped one-row pass does not persist the unscoped cursor. When no aged candidate and no later summary source exist, merely advancing the transient aged frontier to the cutoff incorrectly reports more work forever. Mark both storage passes exhausted in that case. Keep resuming when a summary source was consumed, and preserve the original byte/row budgets. Cover idle scoped single-row maintenance and existing continuation behavior.
The worker entered the shared summary-admission semaphore even when a projection pass returned retryable zero-progress failure. A blocked summary permit then stranded the projection retry and its live join. Defer summary convergence until projection retry settles, preserving the existing retry policy and the blocked-admission behavioral regression.
The integrated recommendation authority now refuses patch diagnoses without observed skill use, even when patch counts are present. Update the production MCP list and view expectations to that explicit reason rather than the old absence-of-corrections conclusion. Preserve exact JSON matching and existing usage, privacy, and no-repair assertions.
A changed observations table drops its old GC triggers. Installing the canonical-body maintenance schema then fails on its partial trigger inventory before the existing authority validator can return the typed ResetRequired. Reuse the canonical observation table contract at existing-store admission, before any install writes; retain the final full-schema audit and repair of missing triggers on otherwise valid tables. The session-suite drifted-shape regression requires the typed refusal and preserved legacy rows.
Follow exact hosted //:rustfmt_check diffs for the two newly added regressions. No behavior, assertions, or test budgets change.
GitHub Actions rejects timeout-minutes in composite action steps, before Bazel setup can start. Remove the unsupported key without changing any validation, timeout budget, or runner behavior. Also incorporate master's reviewed Renovate lucide-react lockfile update, preserving its exact blob and ancestry to resolve the current base drift. The original consolidated application changes remain unchanged. Native hosted CI is required on the new combined head.
Run the existing observation shape preflight for both registered admission and attached stores, before derived canonical-body trigger installation. Preserve the typed ResetRequired refusal when a drifted table has lost its triggers, without mutating it or bypassing existing authority validation.
A single warm-up of an 8x larger session store leaves hundreds of eligible older rows because deletion is bounded to 500 per pass. Drain the preexisting age-policy backlog before measuring, and assert that each measured tick deletes exactly the same 64 streamed rows. Retain the strict 1.2x process-read bound and WAL checkpoint guard.
Retain the original strict read-amplification and equal-work assertions. Publish actual summary lineage for each 64-row batch through the guarded production authority before measurement; raw messages without that lineage must not be dropped. Apply exact Bazel rustfmt output for the recent fixes. Consolidate #4747's complete callable rewarm source as a second parent, without modifying its two files. The draft source remains unverified.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Acquire the held spool mutex using its blocking API on the dedicated fixture thread, then verify the concurrent nonblocking reader refuses contention within the readiness deadline. The previous holder used try_lock and could fail before acquiring under unrelated daemon work. Apply exact rustfmt corrections reported by Bazel repository gates.
This was referenced Nov 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consolidate the pending TraceDecay application changes into one branch and review: session/LCM storage and retention, SQLite inode-pin lifetimes, search ranking, graph retention, host integrations, and eval identity.
Ready for review at the user's explicit request. This PR is no longer draft. Review and current-head CI should proceed now. Merge still requires complete applicable validation, resolution of known defects, and repository protections. Beta.97 release metadata remains excluded; release PR #4744 stays separate and is not authorized for publication by this work.
Consolidation
Commit
7a9f53506df27f122dbd872180656963cd3fbb4aintegrates #4745's complete source head9f2ae73dc4a9cdf8a8aa7c07e3bae8b429c65c36as a second parent, preserving both histories. Both tracing files were incorporated byte-for-byte without conflicts. The first-parent diff is exactly those two files; prior application changes, SQLite/LCM repairs and beta.96 metadata remain intact.#4745 is closed as superseded, with its branch retained. The earlier source PRs were consolidated and closed without deleting their branches. This is integration into this PR, not a merge into master. Keep #4374 open: the Codex timing spans enable diagnosis, not a claimed performance fix.
Integration decisions
Included source PRs
The draft-source labels describe the source PRs when imported, not the current status of this consolidated PR.
393cf31c3933213f2e1efa3ee6db01501937f385a059e3d418c71bbe806796a94e83a99be8b0972aa84f5e1906a371974aebbd32fbfce59a83c451d17a4dabdd0eb59651a9ff7f037b6454eb27dc610b82ca320ce06fc29fb90c319166d8b4cfd8434bdc98394929d75b7181fbca068b27cd5596273e6a877ee5d212ac1424da3853feaa6355f7b981747dd96d1eba31acfc0b25d581a95e1423a8f82ddac65c61ee9f2ae73dc4a9#4706 merged independently into master during inventory. #4707 also merged independently while consolidation ran. Release metadata originally folded in from #4722/#4743 was subsequently excluded; it is not part of the application scope.
Verification
The original consolidation author reported the following on the earlier combined code, before later master merges and repair commits:
pnpm install --frozen-lockfile, commit lint andgit diff --check.CARGO_BAZEL_REPIN=workspace bazel fetch --repo=@candbazel run //scripts:gen_builds, without generated drift.bazel build //:rustfmt_check --jobs=4.Those results do not establish current-head integration correctness. The full
bazel build //... --keep_goingwas interrupted under host saturation and did not pass. Master's #4741 hosted-CI cutover was incorporated afterward; current hosted coverage must validate that configuration and the combined source.Two original LCM failures have source repairs below but still require execution on the combined head:
structured_different_media_and_external_representations_are_retainedandrestoration_revisits_old_cursor_and_stops_before_exceeding_byte_budget.Follow-up corrections requiring combined validation
0b93806e: remove unauthorized beta.97 manifest/changelog/generated version changes while preserving the Grafeo upgrade and application work.f2f111f3: retain short and embeddeddata:replay representations; keep the media/external regression intact.06653e61: use sanitizer-admissible large JSON fixtures while retaining the 8 MiB pass and 4 MiB repack boundaries.317f03c8: release lost-file SQLite identity pins through existing worker-exit cleanup during health observation; retain held-writer safety and strengthen health-only cleanup coverage.7a9f5350: integrate chore(sessions): attribute Codex per-rollout store waits #4745's exact two-file tracing diff and ancestry; no behavioral edits, limits or assertions changed.5cc5e873: repair quarantined legacy privacy fixture broken by canonical-body ownership FK. Preserve unavailable content and retained metadata canary; both full-text sink regressions remain and require native execution.Latest current-head CI repairs (source-reviewed; not yet native-test verified)
The full Linux fleet run 41765053905 reported six failed Bazel targets. In addition to the earlier privacy fixture repair
5cc5e873, the following focused fixes were pushed to this same ready-for-review PR:eca03297— Git native-preflight test now compares all Git object paths and exact bytes, instead of filesystem allocation blocks ingit count-objects -v; existing refs and worktree read-only checks remain.0343b7cc— bounded LCM inlining/offload passes no longer report a pending continuation when no eligible aged candidate or later summary lineage remains. Includes an idle scoped single-row regression; does not change row/byte budgets.50fbef3e— retryable zero-progress temporal publication defers summary admission until publication retry; existing blocked-summary-admission behavioral test protects the live join.84302c42— the two production MCP skill list/view journey tests now assert the canonical missing-use-evidence rationale, preserving exact payload comparisons and the no-repair outcome. The actual mcp_suite artifact showed only these two failures (672 passing).The other integrated CI failure concerned legacy observation-shape reset precedence: a drifted observations table lost its GC triggers, and trigger installation returned a generic ownership-schema error before the typed ResetRequired check. Commits
e71ed2dcand formatting follow-up0e2cac22now reuse the canonical observation table contract in read-only existing-store admission before trigger installation, preserving the typed refusal and legacy rows. Existing exact session-suite regression still requires native verification. The old Clippy job failed but its log endpoint returned BlobNotFound, so no Clippy source defect is claimed. Fresh CI for the latest head is 41786442299, queued at inspection. No fresh combined Bazel/native suite has passed this head.No local Bazel, Rust compilation or rustfmt ran during the latest consolidation or ready-for-review transition. Full combined-head validation remains pending. Older source-PR checks and intentionally skipped draft jobs are not evidence of a passing current integration.
Latest full Linux evidence (previous head
7a9f5350)Linux fleet run 41765053905 completed with six failing Bazel targets, not a green matrix: LCM retention bounded continuation, native Git preflight read-only object-count size, two privacy fixture FK tests now source-repaired above, a blocked-summary projection retry, drifted observation schema losing its typed reset, and the MCP suite whose detailed output is in the uploaded test-log artifact. Clippy also failed but its log could not be retrieved reliably. Do not relax limits or equate these with tested fixes. The new head
5cc5e873requires fresh full applicable CI.Current gate repair
b707d39f: fixed both exact Bazelrustfmt_checkdifferences reported by Repository gates job 126429555946, without modifying behavior or assertions. The current-head CI run 41791985865 is queued; no current-head full native pass is claimed.Latest native Linux findings and current repair head
Linux fleet run 41806785945 failed exactly two of 183 Bazel targets on former head
468b03c, while repository gates, Clippy, Dashboard, benchmarks and feature gates succeeded:session_suite: droppedobservationstable also dropped its GC triggers; attached-store admission still installed maintenance first and surfaced an untyped ownership error instead ofResetRequired.3fa508fuses the same read-only table-contract preflight on initial registration, subsequent attachments and reset inspection, ahead of trigger installation. The original precise drift regression remains.session_retention_read_cost: a single warm-up of the eightfold fixture left hundreds of older eligible rows behind the 500-row retention cap. The compared measured ticks therefore did different work (base read 1,052,960 bytes; grown read 6,402,972 bytes).c2c045cdrains prior retention backlog before the probe and now asserts both measured ticks delete exactly 64 new rows, retaining the strict 1.2x read threshold and WAL checkpoint guard.These are source-reviewed repairs only; current-head CI 41829722887 is queued and full native validation is not yet proven. The separate beta.97 release PR remains excluded. Do not merge on prior-head tests or skipped jobs.
Review focus
Review the storage hydration conflict resolution, imported LCM/retention/host changes, and SQLite lifetime repairs. Preserve the fail-closed submodule boundary (#4593 remains open) and existing validation limits. Ready for review is not a test-pass claim or permission to bypass merge gates. No release, tag mutation or production deployment is authorized.
November 4 consolidation and current validation
e28de3985e248a252f53d9913056e5ecb81f7c42, commit e28de398 preserves draft source PR fix(code-index): reserve callable rewarm dispatch time #4747 as the second parent. Its callable graph rewarm code and bounded deadline test are included byte-for-byte in two files. fix(code-index): reserve callable rewarm dispatch time #4747's source branch stays available; the application work is reviewed here.schema_stages.rsand the retention test import; these are corrected in the same integration.session_retention_read_costfailing. Linux/Windows and repository gate results on this new head remain unverified. The previous Windows job is still running at last check. New CI: current head.session_suite. Neither source-PR checks nor the 182 passed targets constitute full current-head merge validation. Keep this PR non-draft/ready; merge only after all applicable checks, reviews and branch protections clear. Release PR chore(release): release 1.0.0-beta.97 #4744 remains out of scope.November 4 integration/repair checkpoint
76e784c4: repaired the confirmed current-head repository-gates rustfmt failure in the retention cost fixture. The same commit addresses the posted graph re-warm review finding: synchronous zero-budget probes no longer run on Tokio workers for callable/project reads. Callable admission also bounds the whole probe and measured wait within the carried request budget. Existing graph re-warm behavior tests remain; no new native validation is claimed.0d28b76d: integrates fix(accounting): recover durable savings after baseline read errors #4748's exact three source/test blobs and commit head as a second parent, preserving its regression that writes durable savings despite a missing startup display baseline and its project/global projection behavior. fix(accounting): recover durable savings after baseline read errors #4748 is consolidated into this READY PR, not independently merged to master; preserve simplify(accounting): give saved-token totals one durable owner and delete asynchronous absolute-total rewrites #4447 for remaining receipt-idempotency work.Current tip
fc1c0286fixes all three exact hosted Rustfmt differences and repairs the real Linuxunit_testfailure (776/777 passed): the dedicated host-admission contention fixture used nonblockingtry_lockfor its holder and could spuriously refuse during unrelated admission. Its holder now takes the canonical blocking runtime lock on a dedicated thread; the concurrent nonblocking refusal, bounded readiness and recovery assertions remain. This repair is not yet native-verified: new full CI and companion workflows are queued. Previous passing Clippy/Dashboard and other tests do not validate this commit. Remain READY/NON-DRAFT; merge only with full current-head matrix, resolved review defects and normal protections. Beta.97 release remains excluded and unauthorized.