[kryptobaseddev]

Summary

C2 of T12341: the open-time row-identity pass now runs by default. CLEO_ROW_UID_FILL=0 is the documented kill switch. Ship through canary only.

Before the flip, the refusal path is made cheap and quiet (de32009). A store with a stale recipe whose share state is not unshared is refused the full refill (T13231). The live cleocode store is one: 5,619 pre-release uids, Nexus-linked, no recipe marker.

• The refusal is saved as a local-only row_identity_refused marker in tasks_row_identity_meta. It records the state, recipe, a share-signal digest, the reasons, at and warnedAt.
• Later opens take the C1 fast path. rowIdentityFillPending no longer reports a stale recipe while a matching refusal holds, and the opens log nothing.
• A warning is logged once a day at most (REFUSAL_WARN_INTERVAL_MS).
• The pass is re-evaluated only when the recipe or the share signals change, or on cleo doctor row-identity --refill. The dry run also clears the marker and reports refusalCleared (new contract field).
• cleo doctor reports a standing refusal as a finding.

Default-on flip (5ae0891): rowUidFillEnabled() returns env !== '0'. Tests that exercise the fill-off path are pinned to '0'. The sync capture, sealer and repair tests are pinned too, because filling uids on capture interacts with K-capture. That is filed as T13311 for the sync team.

#1952 review LOWs (c18c611):

• LOW-1: importing or vault-restoring a bundle whose project cleo.db carries row uids marks the placed store receive. This includes bundles made before fix(T13250): bundle exports and vault pushes mark the project identity shared in the store #1952, which carry no marker. The new markStoreFileIdentityShared opens the placed file with openNativeDatabase: no migration and no open-time pass ("import only preserves"). It only writes when the meta table exists and the store holds identity values.
  • v1 .cleobundle imports carry only the legacy tasks/brain/conduit/nexus/signaldock files, never cleo.db, so they can't carry uids. They are left untouched.
• LOW-2: a machine export that cannot mark one project (busy or restoring) fails with the new E_PROJECT_STORE_UNAVAILABLE (exit LOCK_TIMEOUT), and the message names that project root.

Tests

• row-identity-full-refill.test.ts, refusal marker:
  • the second open of a refused store is fast, and a NULL-uid row still fills without re-warning;
  • unlinking re-evaluates and the store refills;
  • another recipe's refusal does not count;
  • the doctor dry run clears the marker and re-evaluates.
• row-identity-flag.test.ts: unset means on, 0 means off, other values mean on.
• identity-share.test.ts:
  • a pre-fix(T13250): bundle exports and vault pushes mark the project identity shared in the store #1952-shaped bundle (exported unmarked) imports and the placed store is marked receive, with the import still lossless;
  • a no-uid bundle import marks nothing;
  • a machine export marking failure names the project.
  • Mutation-checked: with the import mark removed and the error code changed, 2 tests fail.
• Targeted runs:
  • row-identity set: 130/130;
  • bundle and vault set (nexus-vault, portable-bundle*, identity-share): 134/134;
  • sync capture, sealer and repair: 101/101 (earlier run).
• tsc -b core+cleo is clean; biome is clean.
• Arch gates 3 (strict), 4, 17, 21, 28, 34, 38 (--base origin/main), 40 and 32 (PR mode) pass.

Not in this PR

• Running cleo doctor row-identity --refill --apply on live cleocode is the owner's call.
• Precondition evidence: Gate B passed all 7 checks on a sandbox copy of snapshot-20261006-121748 (CLI 2026.10.4).

Task: T13305

🤖 Generated with Claude Code