feat: TraceDecay V2 delivery (PR8–PR13) + daemon performance, memory, and reliability overhaul

[ScriptedAlchemy]

Replacement review for #421 after its accidental merge was reverted from master in 52a9aab. This commit has the exact tree of #421 head d4c67d4. Do not merge until explicitly authorized.

Issues this PR fixes

Fixes #753
Fixes #792
Fixes #837
Fixes #838
Fixes #855
Fixes #862
Fixes #861
Fixes #810
Fixes #845
Fixes #856
Fixes #853
Fixes #799
Fixes #836
Fixes #830

Partially addressed here, tracked to completion on their own issues: #852, #800, #863, #843, #842, #848.

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: 4b68faf

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[ScriptedAlchemy]

Post-reopen correction pushed in a23f86a: source-neutral background reconcile no longer advances the scheduler epoch and cancel in-flight text activation; mounted hook overflow uses the explicit invalidating path. Evidence: RED reproduced 0/1, GREEN 1/1 for ordinary_background_reconcile_does_not_supersede_in_flight_text_work; cargo check --lib --locked passed.

[chatgpt-codex-connector]

💡 Codex Review

tracedecay/.github/workflows/release.yml

Lines 408 to 411 in fc20c4f

	if [[ -n "${{ steps.target-runtime.outputs.runtime_library }}" ]]; then
	companion_args+=(
	--companion
	"${{ steps.target-runtime.outputs.runtime_library }}=${{ steps.target-runtime.outputs.runtime_entry_name }}"

Install the bundled Linux runtime beside the binary

For Linux targets, this archive now contains libonnxruntime.so.1, and the verification step succeeds only while that companion remains beside the $ORIGIN-linked executable. However, install.sh lines 80-84 extracts the archive and copies only tracedecay into the install directory before deleting the temporary directory. On systems without a compatible system ONNX Runtime, binaries installed through the advertised script will therefore fail in the dynamic loader even for --version; install the companion library beside the executable or use a layout whose runtime search path matches the installed location.

---

tracedecay/release-please-config.json

Lines 22 to 25 in fc20c4f

	{
	"type": "json",
	"path": "server.json",
	"jsonpath": "$.version"

Advance the SDK version in release PRs

The new npm publication job derives its version from the packed sdks/typescript/package.json, but this release-please list updates only the root manifest, CLI manifest, and server.json; the SDK manifest and lockfile remain fixed at 0.1.0. Starting with the release after 0.1.0, the job will either fail its different-integrity check for @tracedecay/sdk@0.1.0 or no-op for identical bytes, so no SDK version corresponding to the new stable release is published.

---

tracedecay/dashboard/src/workspaces/delivery/DeliveryPage.tsx

Lines 80 to 82 in fc20c4f

	const overview = useQuery({
	queryKey: ['delivery', 'overview'],
	queryFn: () => fetchEnvelope('/api/delivery/overview', DeliveryOverviewV1Schema),

Scope Delivery queries to the selected project

When the scope bar selects a project other than the active project, this query keeps the same cache key and continues fetching the unprefixed active-project route. The dashboard already provides scopeKey and scopedUrl, and the backend mounts /api/projects/{id}/delivery/overview; without using them here, the page labels the selected project while showing another project's Git, CI, and release data, and switching scopes does not trigger a refetch.

---

tracedecay/src/tracedecay/lifecycle/registry.rs

Lines 118 to 122 in fc20c4f

	let digest = RegistrationDigest {
	project_id: project_id.to_string(),
	canonical_root: registration_root.to_path_buf(),
	git_common_dir: git_common_dir.clone(),
	tracked_branches,

Include Git remote identity in the registration digest

When origin changes via git remote set-url without touching branch metadata or store artifacts, this digest remains identical, so the cache returns at lines 130-131 before git_remote_url is recomputed at line 147. The registry consequently retains the old remote and its alias, causing remote-based cross-project resolution to reject the new identity or continue resolving the stale one until an unrelated artifact changes; include the normalized remote in the digest.

AGENTS.md reference: AGENTS.md:L159-L161

---

tracedecay/plugin/cursor-native-extension/src/extension.ts

Lines 187 to 189 in fc20c4f

	private sendCurrentDiagnostics(): void {
	const uris = vscode.languages.getDiagnostics().map(([uri]) => uri);
	this.sendChangedDiagnostics(uris);

Batch startup diagnostics instead of dropping the tail

At activation or language-client restart, getDiagnostics() can return more than 32 document URIs, but this passes the entire list to limitAdmittedNativeDiagnosticDocuments, which permanently slices it to the first 32. Documents after that boundary are never synchronized unless they later emit a diagnostic-change or open event, leaving TraceDecay's native diagnostic state incomplete indefinitely for larger workspaces; split the startup list into bounded batches instead.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ScriptedAlchemy]

#733 landed Clippy-red. Helper branch (not merged, shared checkout untouched):

cursor/707-clippy-after-733 @ latest HEAD of this PR (186880e550)

Clears the #733 Clippy denials:

• nest Unbound | Unavailable or-patterns
• collapse nested hint/witness and session-drain ifs
• box SessionGraphAttachmentStateV1::Attached so the enum is not 808B

Adopt when you want:

git fetch origin cursor/707-clippy-after-733
git merge --ff-only origin/cursor/707-clippy-after-733

I will not land this on #707.

[ScriptedAlchemy]

Clippy helper is now on the Codex worktrees (still not landed on this PR head):

• relocate /fast/projects/tracedecay/.codex-worktrees/root-package-relocation @ 806b8c74ef (cherry-pick of 3293045f53)
• post-721 /tmp/tracedecay-integrate-post721-707-a1 @ 127ab57fae (ff to 186880e550 then same cherry-pick)

Same change as cursor/707-clippy-after-733. I will not push/merge this onto #707.

[ScriptedAlchemy]

Isolated post-#721 verification (worktree /tmp/tracedecay-integrate-post721-707-a1, CARGO_TARGET_DIR=/tmp/td-post721-isolated-target):

Green (non-vacuous) on merge 3b1baaee82 / later 127ab57fae:

• tracedecay-graph-db --lib 87
• tracedecay-runtime-core --lib 677
• tracedecay-usecases --lib 837 (+1 ignored)
• tracedecay-code-index --lib 177 (+1 ignored)
• sealed_publication_tests 3, daemon::scheduler 33, session_runtime 1, sealed_projection_deadline_tests 1
• late-bind native_declared_topology_projection 12

Not green

• --all-features cannot compile tracedecay-rusqlite-runtime (admission.rs:120): hotpath::mutex! vs std::sync::Mutex because graph-db enables hotpath/hotpath without tracedecay-rusqlite-runtime/hotpath.
• daemon::tests::scheduler 11 passed / 11 failed. Failures are scheduler_config::*: ensure_worker_plan — profile code-index worker plan was not installed during daemon bootstrap (plus one writer-gate timeout and one missing scheduler key). Production bootstrap.rs still calls install_profile_worker_plan; the test daemon path does not.

Clippy helper remains on this tree at 127ab57fae / relocate 806b8c74ef. Not pushed to this PR head.

[ScriptedAlchemy]

Architecture simplification review

Reviewed source at 0e87c01a1d783715d62664081b3d3b53dfe2af2e, the complete six-file #882 diff, the open release PR's scope, and relevant historical refactor PR descriptions. This is not a claim that every file in this PR or every historical PR diff was reviewed. No builds, tests, or live-profile measurements were run.

New scoped issues

• refactor(sqlite): await the existing writer directly instead of parking a blocking task per request #883 — await the existing SQLite writer directly. Connection::execute enters spawn_blocking, then ExactSqlHandle enqueues work to its existing writer and blocks on a reply. Remove the intermediate parked blocking task for these already-actor-owned operations, not the actor, bounded admission, write authority, or real blocking reader execution. Define cancellation after acceptance/commit rather than treating dropped callers as rolled-back writes.
• refactor(code-index): inject the canonical catalog instead of installing a process-global callback #885 — inject the canonical catalog into the Git transaction owner. ports.rs advertises constructor-injected seams but uses a process-global first-install-wins OnceLock<fn> whose failed second set is ignored. Pass the existing canonical dependency explicitly and delete the install/getter/bootstrap side channel. This is separate from perf(mcp): reduce global dispatch catalog construction churn #861's catalog allocation work and must not make construction eager.
• refactor(code-index): share partitioned descriptor validation without collapsing the streaming retention path #886 — one implementation of shared partitioned descriptor invariants. The full manifest parser and streaming retention reader independently check the same file/evidence descriptors, and fix(code-index): preserve and bound live migration replay #882 adds legacy/paged handling in both. Share private validation without merging their distinct authentication responsibilities or forcing retention to decode the complete generation.

Each issue includes pinned source, deletion scope, preserved invariants, and behavioral acceptance. They deliberately do not prescribe another framework, registry, contract-only phase, or arbitrary crate-count target.

Higher-impact work already has issue owners

#852 / #800 / #811: make the generation representation and work proportional to what is needed. The structural target is an authenticated manifest and immutable content-addressed segments, bounded borrowed/page readers, and a successor that reuses proven unchanged descriptors. Avoid coexisting full decoded generations, transformed JSON DOMs, whole-corpus identity maps, and encoder buffers. Do not weaken validation; retain proof of exact prior generation/source identity when reusing unchanged segments. A smaller batch does not bound a pipeline that still retains the full corpus at other stages.

#872 / #869: make registration lifetime follow the existing owner. Project-server eviction, invocation/scheduler retirement, and worktree replay-route release cannot be unrelated cleanup conventions. Prefer ownership/RAII registration handles attached to the actual project or retained-generation owner; derived lookup maps must not become extra lifetime authorities. Preserve genuine profile/project/worktree/generation lifetime differences and drain live response leases before retirement. Do not introduce a universal lifecycle framework or collapse all stores into one owner merely to reduce type count.

#882 / #753 / #837: bounded progress, not a very long timer, is the background-work design. The reported successful restart is useful evidence. It does not by itself prove bounded working set or cancellation of stalled corpus-scale work. The existing #882 inline review already flags the corpus-wide legacy identity maps and deadline change; I added the #886 linkage rather than duplicating those reports.

Preserve the simplifications already made

The historical direction is sound when a change deletes an authority or an unmounted path: #525's single verified graph publisher; #650's core-owner/alias split; #652's removal of a test-only runtime dispatch port; #523/#520's deletion of uncalled runtime/workflow machinery; #250's single plugin source tree; #666's single language-tier membership definition. Moving files or adding more adapter traits is not equivalent progress.

In particular, tracedecay-application is already a transport-neutral contracts crate with native Git optional. Its use by the protocol crate is not evidence of dragging the application runtime into clients. Likewise, consumer-owned ports are not inherently a dependency-direction defect; moving them into a new crate without reducing the actual dependency closure would just rearrange complexity.

Recommended sequence: finish bounded generation ownership and complete project/route retirement first; then #883; then #885 and #886 as contained deletion-oriented refactors. Keep the existing physical graph durability verification, exact identity, policy rechecks, and typed unavailable/reset states.

[ScriptedAlchemy]

Second deletion/slop pass, this time against current master (b9204dcf7de8faac4ef05af367a546aa29c32e9f) as well as the #707 architecture findings.

Filed three additional issues:

• refactor: delete dead production surfaces and stale dead-code suppressions #887 — delete dead production surfaces and stale allow(dead_code) suppressions. Confirmed examples include unused extractor comment helpers and the dead dashboard build_state wrapper; it also calls out stale suppressions on code that became live and the blanket tests/common/mod.rs dead-code allowance that lets fixture junk accumulate.
• test(agent-hosts): collapse duplicated plugin tree inventories and prose-shape assertions into behavioral acceptance #888 — collapse duplicated plugin-tree inventories, mirrored schema tests, filesystem helpers, and prose-string assertions into one canonical source validator plus real installer/host acceptance. The shared plugin source tree is already single-source; the tests should stop re-describing it independently.
• perf(resolution): stop cloning the full symbol corpus into parallel resolver indexes #889 — ReferenceResolver::from_nodes currently receives the full borrowed node corpus and then clones it into multiple parallel maps plus duplicated name/suffix sets. Replace full Node/String duplication with compact indexes/ordinals/borrows and delete the unused DB field, with measured 10k/100k-node before/after evidence.

General rule for the cleanup work: delete a test when it only protects source shape, inventory count, prose wording, or another test's fixture; keep tests that falsifiably protect a shipped wire/persisted contract, failure mode, rollback/cancellation/lifetime invariant, or real production journey. Delete an abstraction when it has no independent policy/lifetime/authority. Do not replace removed slop with a new framework, compatibility alias, snapshot gate, or source scanner.

I did not run the workspace tests or performance suite during this source audit, so #889 does not claim measured bytes yet; it requires them as acceptance.

[ScriptedAlchemy]

Current guidance before this becomes mergeable:

• Land #882 only after its two unresolved P1s are fixed: remove corpus-wide identity-map cloning during legacy restore and restore a measured bounded restart deadline with cancellation/progress evidence. #882 is a stacked PR against this branch, so its fixes should be incorporated before final validation.
• Rerun the complete integration gate on the final head. The latest head 0e87c01a1 has successful hotpath-profile/runtime-core, SDK conformance, and plugin validation, but the main CI and hotpath-coverage runs are cancelled. Do not treat that as green. Final acceptance should include the supported full nextest/CI lane and the relevant hotpath coverage lane on the exact merge candidate.
• Keep the architectural cleanup issues as explicit follow-ups unless they are shown to be release blockers: #883 (remove the redundant blocking waiter in front of the SQLite writer), #885 (delete the process-global catalog callback), #887/#888 (dead-code and duplicate/prose-shape test deletion), #889 (resolver clone/index memory), #890-#892 (skill bootstrap/curator/body simplification). Do not expand #707 further just to absorb all of them; this PR is already extremely broad.
• Do not close partially addressed issues as fixed. The PR body already distinguishes #852/#800/#863/#843/#842/#848 as partial; keep that discipline for any newly discovered simplification/perf work.
• Before merge, reconcile the PR body against what actually lands. It currently claims fixes for many issues and has accumulated release, host, dashboard, daemon, storage, automation, and code-index work. Make the final body state the exact remaining known limitations, especially semantic activation and generation memory ownership, rather than implying V2 is generally complete.

Architecturally, I would not block this PR on crate-count reduction. The higher-value deletion work is reducing simultaneous generation representations, hidden lifetime authorities, redundant execution hops, and duplicated policy/tests.