fix: consolidate follow-up application issue repairs

crates/tracedecay-code-index-retention/src/code_index_generations/tests.rs

@@ -1227,22 +1227,106 @@ fn text_artifact_retention_refuses_tamper_and_publish_cas_movement() {
 
 #[cfg(unix)]
 #[test]
-fn text_artifact_retention_refuses_symlinked_inventory_entries() {
-    let (store, _generations) = fixture_store(1);
+fn unreferenced_nonregular_text_artifacts_do_not_block_verified_retirement() {
+    let (store, generations) = fixture_store(5);
+    let active = generations.last().expect("active generation");
+    let referenced = attach_fixture_text_artifact(&store, active, b"durably referenced");
+    let referenced_path =
+        code_text_artifact_path(store.path(), &referenced).expect("referenced artifact path");
+    let valid = text_artifact_for_bytes(&active.id, b"verified orphan beside unsafe entries");
+    let valid_path = write_text_artifact(&store, &valid, b"verified orphan beside unsafe entries");
+
     let artifacts_root = code_text_artifacts_root(store.path());
-    std::fs::create_dir_all(&artifacts_root).expect("create artifact root");
-    let outside = tempfile::NamedTempFile::new().expect("outside artifact");
-    let symlink = artifacts_root.join(format!("text-artifact-{}.bin", "d".repeat(64)));
-    std::os::unix::fs::symlink(outside.path(), &symlink).expect("create symlink");
+    let outside = tempfile::NamedTempFile::new().expect("foreign artifact");
+    std::fs::write(outside.path(), b"unrelated operator data").expect("write foreign data");
+    let link_name = format!("text-artifact-{}.bin", "d".repeat(64));
+    let link = artifacts_root.join(&link_name);
+    std::os::unix::fs::symlink(outside.path(), &link).expect("create foreign link");
+    let directory_name = format!("text-artifact-{}.bin", "e".repeat(64));
+    let directory = artifacts_root.join(&directory_name);
+    std::fs::create_dir(&directory).expect("create foreign directory");
+    std::fs::write(directory.join("keep"), b"unrelated directory data").unwrap();
+
+    let plan = prepare_next_code_generation_retention_cancellable(
+        store.path(),
+        &BTreeSet::new(),
+        &|| false,
+        None,
+    )
+    .expect("unsafe unreferenced entries cannot veto valid retirement");
+    assert_eq!(plan.collectable_generations.len(), 4);
+    assert!(
+        plan.collectable_text_artifacts
+            .iter()
+            .any(|entry| entry.artifact_file == valid.artifact_file)
+    );
+    for name in [&link_name, &directory_name] {
+        assert!(
+            plan.collectable_text_artifacts
+                .iter()
+                .all(|entry| &entry.artifact_file != name),
+            "an untrusted entry must never become a deletion candidate"
+        );
+    }
+
+    let report = execute_code_generation_retention(
+        store.path(),
+        plan,
+        CodeGenerationRetentionModeV1::Apply,
+        UtcMicros(52),
+        None,
+    )
+    .expect("collect independent verified generations and orphan");
+    assert_eq!(report.deleted_generations.len(), 4);
+    assert!(!valid_path.exists(), "verified orphan was reclaimed");
+    assert!(
+        referenced_path.is_file(),
+        "durable referenced target remains"
+    );
+    assert!(
+        std::fs::symlink_metadata(&link)
+            .unwrap()
+            .file_type()
+            .is_symlink(),
+        "untrusted symlink remains untouched"
+    );
+    assert_eq!(
+        std::fs::read(outside.path()).unwrap(),
+        b"unrelated operator data"
+    );
+    assert_eq!(
+        std::fs::read(directory.join("keep")).unwrap(),
+        b"unrelated directory data"
+    );
+}
+
+#[cfg(unix)]
+#[test]
+fn referenced_text_artifact_symlink_still_refuses_retention() {
+    let (store, generations) = fixture_store(1);
+    let active = generations.last().expect("active generation");
+    let referenced = attach_fixture_text_artifact(&store, active, b"durably referenced");
+    let target = code_text_artifact_path(store.path(), &referenced).unwrap();
+    let outside = tempfile::NamedTempFile::new().expect("foreign artifact");
+    std::fs::write(outside.path(), b"unrelated operator data").unwrap();
+    std::fs::remove_file(&target).unwrap();
+    std::os::unix::fs::symlink(outside.path(), &target).unwrap();
+
     let error = plan_code_generation_retention(store.path(), &BTreeSet::new())
-        .expect_err("symlinked artifact entry must fail closed");
+        .expect_err("a referenced descriptor cannot be replaced by a symlink");
     assert!(matches!(
         error,
         CodeGenerationRetentionErrorV1::UnsafeState(_)
     ));
     assert!(
-        symlink.exists(),
-        "refusal must preserve foreign link evidence"
+        std::fs::symlink_metadata(&target)
+            .unwrap()
+            .file_type()
+            .is_symlink()
+    );
+    assert_eq!(
+        std::fs::read(outside.path()).unwrap(),
+        b"unrelated operator data"
     );
 }
 

crates/tracedecay-code-index-retention/src/code_index_generations/text_artifacts.rs

@@ -451,10 +451,16 @@ pub(super) fn plan_collectable_text_artifacts_budgeted_page_cancellable(
             Err(error) => return Err(storage(error)),
         };
         if !metadata.file_type().is_file() {
-            return Err(CodeGenerationRetentionErrorV1::UnsafeState(format!(
-                "code text artifact inventory path '{}' is not a regular file",
-                path.display()
-            )));
+            // Referenced descriptors were verified above and remain fail-closed.
+            // Unreferenced symlinks/directories have no deletion authority,
+            // but must not veto a separate verified artifact or generation.
+            tracing::warn!(
+                event = "code_text_artifact_retention_candidate_preserved",
+                artifact = %path.display(),
+                reason = "non_regular_inventory_entry",
+                "unreferenced non-regular artifact preserved during retention"
+            );
+            continue;
         }
         let staging_source = staging_text_artifact_source_digest(&file_name)
             .or_else(|| staging_sidecar_text_artifact_source_digest(&file_name));

crates/tracedecay-daemon-service/src/doctor_kernel.rs

@@ -825,11 +825,11 @@ pub async fn collect_code_generation_retention_findings(
 /// absent table on a store that never published, a lock, a corrupt row).
 async fn live_sealed_generations(
     graph: &tracedecay_runtime_core::db::Database,
-) -> Option<BTreeSet<String>> {
+) -> Option<BTreeSet<(String, String, String)>> {
     let mut rows = graph
         .read_connection()
         .query(
-            "SELECT replay.generation
+            "SELECT replay.namespace, replay.projection, replay.generation
              FROM graph_publication_replay_v1 AS replay
              LEFT JOIN graph_verified_heads_v1 AS head
                ON head.shard_id = replay.shard_id
@@ -838,14 +838,19 @@ async fn live_sealed_generations(
              WHERE head.replay_sequence IS NULL
                 OR replay.sequence >= head.replay_sequence
              UNION
-             SELECT generation FROM graph_publication_replay_dependencies_v1",
+             SELECT namespace, projection, generation
+             FROM graph_publication_replay_dependencies_v1",
             (),
         )
         .await
         .ok()?;
     let mut heads = BTreeSet::new();
     while let Some(row) = rows.next().await.ok()? {
-        heads.insert(row.get::<String>(0).ok()?);
+        heads.insert((
+            row.get::<String>(0).ok()?,
+            row.get::<String>(1).ok()?,
+            row.get::<String>(2).ok()?,
+        ));
     }
     Some(heads)
 }

crates/tracedecay-global-db/src/observation/canonical_body_gc.rs

@@ -25,6 +25,8 @@ pub const MAX_CANONICAL_BODY_GC_ROWS: usize = 48;
 pub struct CanonicalBodyGcReport {
     pub roots_scanned: u64,
     pub bodies_scanned: u64,
+    /// Candidates discharged in the committed page, even if their body stays live.
+    pub candidates_discharged: u64,
     pub bodies_deleted: u64,
     /// Stored BLOB bytes deleted, including the effect of their existing
     /// compression. This is not database-file or filesystem space reclaimed.
@@ -323,13 +325,25 @@ async fn collect_candidates(
     drop(deleted);
     // Referenced candidates are discharged too. The final owner removal
     // records them again; idle ticks never revisit every retained body.
-    conn.execute(
-        "DELETE FROM canonical_body_gc_candidates
-         WHERE content_hash IN (SELECT value FROM json_each(?1))",
-        params![hashes],
-    )
-    .await
-    .map_err(db_error)?;
+    // Deleting an unreferenced body cascades to its candidate row. The
+    // remaining explicit removals discharge referenced bodies that stay live.
+    let explicitly_discharged = conn
+        .execute(
+            "DELETE FROM canonical_body_gc_candidates
+             WHERE content_hash IN (SELECT value FROM json_each(?1))",
+            params![hashes],
+        )
+        .await
+        .map_err(db_error)?;
+    let discharged = explicitly_discharged
+        .checked_add(report.bodies_deleted)
+        .ok_or_else(|| integrity_error("canonical body candidate discharge overflow"))?;
+    if discharged != report.bodies_scanned {
+        return Err(integrity_error(
+            "canonical body candidate page was not fully discharged",
+        ));
+    }
+    report.candidates_discharged = discharged;
     Ok(())
 }
 

crates/tracedecay-global-db/src/observation/canonical_body_gc/tests.rs

@@ -506,3 +506,52 @@ async fn nonpositive_legacy_owner_ids_cannot_be_skipped_by_bootstrap() {
         );
     }
 }
+
+#[asupersync::test]
+async fn zero_delete_pages_discharge_distinct_candidates_and_quiesce() {
+    let store = Store::open().await;
+    for ordinal in 0..52 {
+        let body =
+            StoredCanonicalBody::pack(format!("still referenced {ordinal}").as_bytes()).unwrap();
+        insert_body(store.conn(), &body).await;
+        store
+            .conn()
+            .execute(
+                "INSERT INTO lcm_raw_messages(storage_kind, content, content_hash)
+                 VALUES ('inline', NULL, ?1)",
+                params![body.content_hash.as_str()],
+            )
+            .await
+            .unwrap();
+    }
+    store.install().await;
+
+    let mut discharged_pages = Vec::new();
+    for _ in 0..16 {
+        let report = store.tick(48).await;
+        assert_eq!(report.bodies_deleted, 0, "referenced bodies stay live");
+        if report.candidates_discharged > 0 {
+            assert_eq!(report.candidates_discharged, report.bodies_scanned);
+            discharged_pages.push(report.candidates_discharged);
+        }
+        if !report.has_more {
+            break;
+        }
+    }
+    assert_eq!(discharged_pages, vec![48, 4]);
+    assert!(!has_candidates(store.conn()).await.unwrap());
+    assert_eq!(
+        store.tick(48).await,
+        CanonicalBodyGcReport {
+            bootstrap_complete: true,
+            ..CanonicalBodyGcReport::default()
+        }
+    );
+    let mut rows = store
+        .conn()
+        .query("SELECT COUNT(*) FROM session_canonical_bodies", ())
+        .await
+        .unwrap();
+    let count: i64 = rows.next().await.unwrap().unwrap().get(0).unwrap();
+    assert_eq!(count, 52);
+}

crates/tracedecay-global-db/src/observation_collision_tests.rs

@@ -491,7 +491,7 @@ fn collision_candidate_at(
     (observation, anchored)
 }
 
-fn collision_candidate(
+pub(super) fn collision_candidate(
     session_id: &SessionId,
     record_id: &str,
     generation: u64,