fix(live): follow active index authority in every route - #3952
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe change routes archive operations through active-index generations, adds source-only live acquisition, classifies artifacts and decoded evidence, improves hook-spool retries, and updates retention, repair, and validation behavior. ChangesActive index, live acquisition, and evidence handling
Estimated code review effort: 5 (Critical) | ~120 minutes Mergeability Score: 🟠 High · up to The change affects retained-source replay, archive routing, raw cleanup, ZIP identity, and repair batching. Unresolved paths can write to the wrong archive, merge distinct source coordinates, bypass safety handling, or commit partial repair state, so the PR is not merge-ready until these correctness and availability risks are fixed or explicitly accepted. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 79ee92aeec
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review exact head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 45bcb3ad1b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review exact head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: aa9624f452
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dc568e344c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@polylogue/sources/live/watcher.py`:
- Around line 430-463: Bound _retry_hook_spool_directory_until_populated with a
short deadline using a new _HOOK_SPOOL_DIRECTORY_RETRY_MAX_S constant defined
alongside _HOOK_SPOOL_DIRECTORY_RETRY_POLL_S. Stop polling once the deadline
expires, while preserving the existing shutdown, directory-removal, OSError, and
JSON-detected behaviors.
In `@polylogue/storage/raw_retention.py`:
- Around line 1409-1410: Update the logic around the semantic-only check so an
active semantic head is first validated for a corresponding source-tier row in
raw_sessions; raise the broken-head violation when that row is absent. Preserve
the existing byte-chain exemption, but do not let seed_raw_id in
semantic_only_raw_ids bypass the row is None validation or cursor handling.
- Around line 1678-1684: Update _terminal_artifact_raw_ids() to query ordered
terminal_paths in batches of 500, matching _terminal_artifact_paths(), and
aggregate raw_id results across all batches into the returned frozenset.
Preserve the existing empty-input behavior and query semantics while preventing
SQLite bind-variable-limit errors that bypass RawRetentionSafetyError handling.
In `@tests/unit/sources/test_hook_spool.py`:
- Around line 311-365: Mark
test_live_watcher_retries_added_hook_shard_until_atomic_publish with
pytest.mark.uses_real_clock, providing a reason that it relies on real asyncio
timing for the 0.10-second publish delay and 0.01-second polling against the
production retry interval.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 8e2f986d-2825-4ea2-96ed-f6dfc62b0bb1
📒 Files selected for processing (12)
polylogue/sources/live/append_ingest.pypolylogue/sources/live/batch.pypolylogue/sources/live/watcher.pypolylogue/storage/raw_retention.pypolylogue/storage/repair.pypolylogue/storage/sqlite/archive_tiers/archive.pypolylogue/storage/sqlite/archive_tiers/bootstrap.pytests/unit/sources/test_hook_spool.pytests/unit/sources/test_live_watcher.pytests/unit/sources/test_live_watcher_locking.pytests/unit/storage/test_raw_retention.pytests/unit/storage/test_repair.py
dc568e3 to
6a2bed2
Compare
|
@codex review Please review exact head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6a2bed2bb2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review exact head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 01327dee69
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 17435a4e5e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Problem: large non-JSONL sidecars could reach generic streaming admission before definitive path classification.\n\nWhat changed: expose the existing strong path rules for live admission, preserve weak analysis-path payload and streaming handling, and cover both the full-ingest and preloaded-payload routes.\n\nCompatibility: the public path classifier preserves its output; the fingerprint manifest records the safe internal delegation.\n\nRef #3952
|
@codex review Please review exact pushed head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 694ca99ee4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Problem: large non-JSONL sidecars could reach generic streaming admission before definitive path classification.\n\nWhat changed: expose the existing strong path rules for live admission, preserve weak analysis-path payload and streaming handling, and cover both the full-ingest and preloaded-payload routes.\n\nCompatibility: the public path classifier preserves its output; the fingerprint manifest records the safe internal delegation.\n\nRef #3952
694ca99 to
62a276a
Compare
|
@codex review Please review exact rebased head |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Please review exact head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 019f7c88e6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4ffd2d876e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6bef347fbc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Bound retained document scalar tokens before structural provider detection and preserve whole-sequence detector tightness. Carry Codex state snapshots through frozen validation as non-session evidence, enforce replay budgets before state parsing, and refresh configured roots during periodic catch-up.
Unknown acquisition and parser classification had drifted across live ZIP replay, corpus verification, and blob reconstruction. Oversized NDJSON sampling could also allocate a complete physical record before streaming admission. Keep acquisition provider separate from detected provider, persist independent ZIP entry and split coordinates in source v33, reuse those coordinates after blob replacement, and cap live JSONL record sampling. Inventory the new durable writer and cover the production routes with anti-vacuous regressions.
Return directly after a generation-lease refusal, bound unknown retained JSONL detection, and keep terminal Codex state snapshots out of frozen session parsing. Ref #3952.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 118005dbe1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if not raw_line: | ||
| return Provider.UNKNOWN, "bounded JSONL provider scan exhausted; used fallback_provider" |
There was a problem hiding this comment.
When an UNKNOWN JSONL starts with a provider-identifying record larger than 64 KiB, _detect_provider_from_bounded_prefix() can successfully identify Codex or Claude from the first 8 KiB, but this branch drains the record until the new total scan cap is exhausted and then replaces that positive result with Provider.UNKNOWN. Replay subsequently raises the unresolved-provider error instead of invoking the supported streaming parser. Fresh evidence at this exact head is the newly added total-cap return; preserve a provider already detected before attempting to drain the remainder.
AGENTS.md reference: AGENTS.md:L149-L158
Useful? React with 👍 / 👎.
| generation_pin_refused = False | ||
| with contextlib.ExitStack() as lease_stack: | ||
| try: | ||
| index_db = lease_stack.enter_context(raw_authority.materialization_generation_lease(config)) |
There was a problem hiding this comment.
When the default recover=True pass encounters a planned frontier census while an offline rebuild owns the lease, recover_interrupted_frontier() runs before this acquisition. Its _frontier_items() resolves and attaches the current active index and then recovery persists outcomes, so a promotion can race those reads/writes before the typed lease refusal is reached. Fresh evidence beyond the resolved post-repair fall-through issue is this pre-lease recovery path; acquire the generation lease before recovery and stale-plan processing.
Useful? React with 👍 / 👎.
|
@codex review Please review exact pushed head |
|
@codex review Please review exact pushed head |
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Please review exact pushed head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4984774bcc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| archive_root_path = Path(archive_root()) | ||
| archive_root_path.mkdir(mode=0o700, parents=True, exist_ok=True) | ||
| with archive_writer_rebuild_exclusion(archive_root_path): |
There was a problem hiding this comment.
Whenever automatic bulk rebuild routing or POST /api/maintenance/rebuild-index invokes rebuild_index_from_source_sync, the rebuild engine tries to acquire an exclusive RebuildLease while this wrapper still holds its shared ActiveWriterLease. Separate flock opens conflict even within the same process, so every daemon-owned rebuild is refused for the daemon's entire lifetime; bulk recovery repeatedly makes no progress and the HTTP maintenance route fails. The lifetime exclusion needs a handoff or a daemon-owned rebuild mode that preserves single-writer coordination without competing with its own lease.
AGENTS.md reference: AGENTS.md:L164-L167
Useful? React with 👍 / 👎.
|
|
||
| archive_root_path = Path(archive_root()) | ||
| archive_root_path.mkdir(mode=0o700, parents=True, exist_ok=True) | ||
| with archive_writer_rebuild_exclusion(archive_root_path): |
There was a problem hiding this comment.
After a completed rebuild leaves its now-dead PID in .index-rebuild.lock, this daemon acquires the shared lease without replacing that metadata. A later external RebuildLease fails to lock the daemon-held inode, sees the recorded PID as dead, and _open_lock_fd() atomically replaces the lock file and acquires the new inode exclusively, allowing the rebuild to run concurrently with the still-writing daemon. The lifetime lease therefore needs a reclamation protocol that cannot discard a currently locked shared-holder inode merely because its contents describe an older exclusive owner.
AGENTS.md reference: AGENTS.md:L182-L184
Useful? React with 👍 / 👎.
|
@codex review Please review exact pushed head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7e58dd94e0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| finally: | ||
| if watcher is not None: | ||
| watcher.stop() | ||
| writer_drained = await coordinator.shutdown(timeout=5.0) |
There was a problem hiding this comment.
If cancellation or another BaseException interrupts coordinator.shutdown() while a shielded admitted writer is still running, writer_drained is never returned and _retain_rebuild_exclusion_for_undrained_writer() is skipped; the surrounding context then calls release_if_safe(), which treats the unmarked state as safe and releases the shared lease. This can let an offline rebuild overlap the detached SQLite writer precisely on an interrupted shutdown, so the exclusion must fail closed until a completed drain explicitly proves it can be released.
AGENTS.md reference: AGENTS.md:L182-L184
Useful? React with 👍 / 👎.
| finally: | ||
| if watcher is not None: | ||
| watcher.stop() |
There was a problem hiding this comment.
When watcher.run() raises KeyboardInterrupt while a failed-retry child is still scheduled, this finally executes only after Polylogue.__aexit__() has closed the repository/backend. watcher.stop() is what cancels that retry task, so it can resume during the asynchronous close and schedule work against already-closing services, producing shutdown failures or losing the pending ingestion. Stop and cancel the watcher children inside the Polylogue context, then drain the coordinator before closing those dependencies.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8dbb6352ec
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| writer_drained = await _shutdown_writer_coordinator_with_rebuild_exclusion( | ||
| write_coordinator, | ||
| rebuild_exclusion, | ||
| timeout=5.0, | ||
| ) |
There was a problem hiding this comment.
In _run_daemon_services_under_active_writer_lease, a second cancellation can arrive during any earlier cleanup await—such as server shutdown, _drain_tasks(), or the final lifecycle write—before this helper is reached. If an admitted sync writer is still detached, that cancellation exits the cleanup with writer_drained=False but without calling retain_until_process_exit(), so the outer context releases the shared rebuild lease and an offline rebuild can overlap the writer. Unlike the now-covered cancellation inside coordinator.shutdown(), the cleanup should fail closed from its start and release the exclusion only after a completed drain proves safety.
AGENTS.md reference: AGENTS.md:L182-L184
Useful? React with 👍 / 👎.
Problem: Provider detection stopped at the first 8192 bytes of an oversized JSONL record, so a valid discriminator after a large preceding field was treated as UNKNOWN. What changed: Stream each retained JSONL record through the existing scalar-bounded structural probe in 4096-byte chunks, sharing the hard 64 KiB total scan envelope. Add a Codex late-session_meta regression and malformed huge-input budget coverage. Alternatives rejected: Eager whole-record parsing and unbounded scanning would violate the retained-replay resource contract. Compatibility: Positive evidence remains routed through the existing provider detectors. Evidence outside the envelope remains UNKNOWN.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7412c09f9b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| finally: | ||
| try: | ||
| if watcher is not None: | ||
| watcher.stop() |
There was a problem hiding this comment.
On Ctrl-C while the real _drain_task is inside _flush_pending() or pre-parsing a live batch, LiveWatcher.run() does not cancel or await that child; control first exits async with Polylogue, closing its repository/backend, and only then reaches this stop() call and the coordinator drain. The child can therefore resume against closed services—or reach the coordinator only after admission has closed—causing shutdown failures and abandoning the pending batch. Fresh evidence at this exact head is the production _enqueue() → _debounced_batch() route, while the new nested finally still preserves the close-before-stop ordering; stop/cancel and await watcher children, then drain the coordinator, before leaving the Polylogue context.
Useful? React with 👍 / 👎.
| if self._db_path_explicit: | ||
| return self.db_path |
There was a problem hiding this comment.
When a normal long-lived service obtains its config through resolve_runtime_config().as_config(), ResolvedRuntimeConfig.as_config() passes the already-resolved paths.index_db argument, so this flag is set even though the operator did not request an explicit database override. After an active-generation promotion, current_db_path() consequently keeps returning the startup generation; callers in raw repair and raw_reconciler can then read or mutate the inactive index while the rest of the archive serves the promoted one. Preserve whether the original runtime setting was truly explicit instead of inferring it solely from db_path is not None.
Useful? React with 👍 / 👎.
## Summary Remove self-attesting campaign machinery while retaining executable product behavior, durable authority, operational safety, and independently valuable verification. ## Problem The repository had accumulated generated mirrors, passive ledgers, campaign packets, duplicate tracker projections, source-text scans, one-shot reports, and tests that proved only their declarations. They increased maintenance cost and made process artifacts look like runtime authority. Review of the purge also exposed real defects in destructive deletion, raw-authority proof binding, canary authority, benchmark reporting, and continuity replay isolation. ## Solution - Delete 324 retired files and roughly 79,000 lines of generated reports, campaign wrappers, tracker/dashboard mirrors, prose-pattern gates, stale planning packets, and duplicate authority registries. - Retain runtime-consumed registries and executable evidence: operation/action/query descriptors, origin specifications, SLO benchmarks, durable migrations and audit records, parser fingerprints, continuity replay, schema/layering checks, and behavior-level tests. - Preserve one daemon-owned destructive-delete path with exact preview, authorization, acknowledgement, cancellation, and batch binding. - Bind raw-authority exceptions to the complete exact set of planted terminal/deferred outcomes and seeded component/raw IDs; reject missing, swapped, duplicate, unrelated, or falsely successful receipts. - Keep canary semantic authority package-local and exact: a delta must declare the reviewed operation, columns, table, and targeted session/origin scope. Constraint-only, unscoped, unrelated, tracker, or successor metadata cannot authorize candidate differences. - Require continuity replay to name an exact catalog and run in a completely hermetic environment: no inherited cwd/site config, daemon URL/token, MCP capability, HOME/XDG, temp, or user-data authority. Explicit offline mode suppresses per-call delivery and startup outbox draining. A supplied archive is proven byte-identical before/after and cannot emit an outbound daemon request. - Replace the cancellation swarm/timing race with one deterministic production-route proof per interruptible MCP tool. A disposable server holds its real admission slot, one official MCP request queues, one cancellation is confirmed, and a protocol ping proves healthy ordered teardown. Equivalent scenarios reuse that tool-level proof. - Keep structured Beads graph-cycle failure reporting, canonical canary row identities, real benchmark metrics, and behavior-derived command/document coverage. - Retire the closed claim-vs-evidence campaign’s private-report/calibration/publishing harness; reusable query semantics remain on ordinary production routes. ## Verification - Affected reindex-canary, daemon coordination, continuity, MCP telemetry, CLI, and Beads graph suite: `167 passed in 154.70s`. - Deterministic MCP cancellation regression: three fresh-process passes; deduplicated run `1 passed in 18.92s` (previous redundant path was roughly 26–30 seconds). - Hermetic supplied-archive proof: zero outbound requests, unchanged tier SHA-256 digests, and no archive-local runtime state. - Focused deletion/raw-authority suites from the branch: 14 and 22 passed. - Semantic schema wiring: 30 passed. - Action/completion/workflow behavior: 192 passed. - Documentation discovery/render coverage: 7 passed; `devtools render all --check` passed. - Exact-head review-repair suite: 98 focused tests covering canary authority, raw-authority restart proof, hermetic continuity replay, MCP telemetry, and server runtime. - Exact post-rebase quick gate: all 10 checks passed in 59.29s (`20260814T031542Z-quick-1912950-306d6f9e`). - Final P1 repair restored the published source migration bytes exactly; two durable-train hash/replay tests passed, followed by the 25.4s exact-head quick gate (`20260814T033106Z-quick-2033174-5bd70dec`). ## Scope disposition This is self-contained repository cleanup and correctness repair. It assigns or mutates no Beads. #3952 merged first; this branch is now rebased onto that exact master, with the 98-test production-route suite and quick gate run at parent `e49a320d`, then the published-migration repair verified at final head `13135b37`. The merge train still requires its terminal complete-suite/testmon receipt. <!-- polylogue-pr-scope:v2 { "assigned_beads": [], "dispositions": [], "mutated_beads": [], "scope_digest": "79a7984a9ec80a157c96dc8d28561159c642c15de3793837eff751fa7eac34a1", "scope_kind": "self_contained", "version": 2 } -->
1 participant
Summary
Make live ingest, replay, repair, and degraded acquisition follow the selected archive and active-index authority while preserving durable raw evidence when parsing or derived writes are unavailable.
Problem
Retained replay and source-only acquisition had authority gaps: weakly classified JSONL could be discarded or scanned without a total bound; oversized records could lose valid provider evidence based on key order; ZIP members could lose acquisition coordinates; cursors could outrun quarantine; repair could consult a stale index generation; and daemon/watcher startup or any exceptional shutdown step could permit source writes without rebuild exclusion.
Solution
Verification
32 passed in 338.32sat parent58a687b26(20260814T023634Z-focused-test-1506517-c5e0bced). It includes the sanitized 804-revision acquisition → crash → resume → inactive-candidate proof; bounded late-discriminator and outside-budget cases; daemon/watch refusal, cancellation, cleanup failure, and undrained retention; ZIP coordinates; raw replay; corpus validation; frozen state; and watcher rediscovery.4 passed in 1.65sat7412c09f9b8516c07a51ce8464e6de3c174a9642(20260814T025306Z-focused-test-1682868-43880690). It reproduces a throwingwatcher.stop()with an undrained coordinator and proves rebuild exclusion remains held.direnv exec . devtools verify --quick: all 25 gates passed in159.45s(20260814T025335Z-quick-1689690-74c1c4e5).devtools workspace pr-scope check --pr 3952:pr-scope OK @ 7412c09f.Review disposition
All earlier inline findings were repaired before their threads were resolved. The final three independent P1 findings—cleanup failure releasing exclusion, key-order-sensitive oversized JSONL detection, and standalone watcher-stop failure skipping drain—are reproduced and repaired. CI and final exact-head review are not represented as complete until returned.
Risks and follow-ups
This changes live-ingest authority but does not mutate the production archive. Authenticated archive-root recovery, source migration, inactive-candidate construction, and the terminal current-master full-suite/testmon receipt remain separate operations.