test(global-db): prove refusal fast path with corruption tripwire - #653

Finding addressed

Codex P1 on #652: the restored identity-digest-probe feature in tracedecay-domain was another test-only production port — a public feature with no production caller whose thread-local counter mutations get compiled into every instrumented canonical hashing path by any --all-features build (which CI runs). This PR removes counter instrumentation entirely and replaces its proof role with a counter-free behavioral proof.

Tripwire design

The refusal fast path's contract: a re-admitted identical candidate is answered from the observation_admission_refusals marker and the frontier cursor with bare-column reads — zero stored-row decode, zero identity derivation, zero payload hashing of stored data. The tests now prove that contract behaviorally:

1. After the terminal refusal marker exists, an engine fixture (the harness doc sanctions engine fixtures for post-admission corruption setup) corrupts the retained observations row: observation_json and committed_cursor_json become undecodable garbage and payload_digest becomes a value no re-hash can match. The corruption stays json_valid with a matching $.observation_id, so production retention's json_extract bookkeeping and mount-time audits that legitimately touch committed rows keep working; the fixture writes through the observations_immutable_update guard exactly the way production retention's tombstone writer does (drop trigger → update → recreate trigger, one transaction).
2. Re-admission (and the subsequent-trigger/catch-up/retention scenarios the existing tests cover) must still return the typed IdentityCollision with converged coverage and no error, and the corrupted bytes must remain byte-identical afterward — proving no pass read back, repaired, or rewrote the row.
3. Restart-bearing tests restore the original bytes before remount (mount-time invariant convergence legitimately serde-decodes committed rows) and re-assert byte-identity against the pre-corruption capture, which also proves the restore round-trip.

If a regression reintroduces stored-row decode, identity re-derivation, or payload re-hashing on the fast path, the corrupted bytes make it fail loudly. Six tests arm the tripwire: re_admitted_identity_collision_short_circuits_without_decode_or_hash, replacement_domain_collision_records_terminal_coverage_without_rework, terminal_refusal_survives_retention_and_catch_up_never_reopens_the_record, post_retention_rescan_re_admits_from_raw_source_without_terminal_rework, eof_refusal_converges_new_generation_rescans_without_reopening, orphaned_refusal_marker_repairs_coverage_on_the_next_frontier_pass.

RED receipt

Temporarily disabling the marker fast path (appending .filter(|_| false) to the read_admission_refusal result in persist_observation, forcing the full path) made all six tripwire tests fail RED on the corruption:

test observation_collision_tests::re_admitted_identity_collision_short_circuits_without_decode_or_hash ... FAILED

re-admission over the corrupted retained row must stay the typed terminal collision — any
stored-row decode, identity re-derivation, or payload re-hash would have failed on the
tripwire bytes; Storage { operation: "dispatch observation runtime read", source: Custom {
kind: Other, error: "runtime read failed: PhysicalRuntimeFailed { operation: \"dispatch
repository read\", message: \"repository read failed: reader worker failed: SQLite reader
failed: storage infrastructure failed during repository read: Conversion error from type
Text at index: 0, unknown field `__tripwire`, expected one of `observation_id`,
`idempotency_key`, `identity`, `receipt`, `retention_class`, `payload` at line 1 column 13\" }" } }

(The other five failed identically: terminal_refusal…, post_retention…, eof…, orphaned…, replacement_domain….) The fast path was then restored and all tests went green again — the tripwire is falsifiable, not vacuous.

Deletions

All counter instrumentation is gone (net −241 lines across the two commits):

• crates/tracedecay-domain: identity-digest-probe feature (Cargo.toml), identity_digest_probe module (68 lines), and all three probe call sites in observation.rs (domain_digest, sha256_digest) and research/canonical.rs (canonical_sha256). −84 lines.
• crates/tracedecay-global-db: the probe dev-dependency feature, digest_counts(), CatchUpRecordReceipt/digest_deltas, and every counter assertion including the (0,0,1) command-digest shape. Frontier-read behavior stays proven by the existing coverage-convergence assertions.
• cargo build -p tracedecay-domain --all-features compiles no probe code (the feature no longer exists); rg identity.digest.probe crates/ returns nothing.

Verification

• cargo test -p tracedecay-global-db: 399 passed, 4 failed — exactly the 4 known pre-existing base failures (registered_database_lease_keeps_runtime_alive_after_map_owner_drops, registered_project_graph_binding_retains_only_the_database_weak_proxy, registered_legacy_relations…installation_requires_typed_reset…, concurrent_registered_mounts_singleflight_to_one_runtime); all 18 collision tests green.
• cargo test -p tracedecay-domain: all green (209 unit + doc/integration suites).
• cargo clippy -p tracedecay-global-db -p tracedecay-domain --all-targets -- -D warnings: clean.
• cargo fmt -p tracedecay-global-db -p tracedecay-domain -- --check: clean.