fix(sessions): block cover-past on observation commit failures

[ScriptedAlchemy]

Live symptom

daemon.err.log (7.9MB) is dominated by ~32k WARNs at ~8630/min:

WARN tracedecay_sessions::runtime::jsonl_observation_admission admission refused; covering past it provider=codex reason=observation_commit_failed

matching a 2.8G user-sessions.db + 415M WAL. Cursor hits the same path. Root cause: ActiveAdmission::capture treated every non-retryable capture error as a deterministic content refusal and wrote AdmissionRefused coverage from a stale in-memory expected_cursor — after a persist that had already committed the row and advanced the source cursor. Each frame produced a successful persist plus a conflicting cover-past cursor write, 32k times, while a live reader held the WAL open.

Cover-past contract (two outcomes)

1. Exact duplicate (same identity + digest) → idempotent no-op receipt. No WARN, no cover-past, no extra cursor write; the frontier already reflects the durable row.
2. Cursor-gap past an uncommitted record → typed TranscriptIngestError::HostAdmission block, no retry, the frontier does not advance.

observation_commit_failed, authority_write_failed, and observation_persisted_value_unavailable are store write/read failures, not content refusals — they now take the typed-block arm. Only deterministic content refusals (invalid_observation_contract, privacy_boundary_failed) still cover past so the stream converges. Retryable races (cursor_conflict, still-mounting authority, cancellation) keep their own verdict via host_admission_error instead of being laundered into a terminal NonDurableRecord.

A committed persist whose immediate read-back returns None (missed read-your-writes under a busy WAL) now reports the Queued status persist just wrote instead of failing the capture as PersistedObservationUnavailable; exact_duplicate_reports_authoritative_projection_status still passes when the read succeeds.

Isolated tests (this crate only, no live home dirs)

• observation_test.rs: persist commits, read-back misses → capture stays Persisted with Queued.
• runtime/jsonl_observation_admission/tests.rs (tempfile rollouts + MemoryHostAdmission spy):
  • all three commit-failure codes → typed HostAdmission block, advance_non_durable_source_cursor never called, frontier stays put;
  • retryable cursor_conflict keeps retryable: true;
  • invalid_observation_contract still covers past with AdmissionRefused and the stream converges (second pass reads 0 bytes, no re-written coverage);
  • exact-duplicate replay from a lost frontier → no-op receipts, no coverage writes, cursor byte-identical.

cargo test -p tracedecay-sessions (all targets) and cargo clippy -p tracedecay-sessions --all-targets are green. Only crates/tracedecay-sessions is touched; sessions stays robust to the usecases classify_error mapping without changing it.

  

[changeset-bot]

⚠️ No Changeset found

Latest commit: 3b26f3c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e782c3b7e6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".