feat: consolidate TraceDecay V2 PR8-PR13 delivery

[ScriptedAlchemy]

Replacement review for #421 after its accidental merge was reverted from master in 52a9aab. This commit has the exact tree of #421 head d4c67d4. Do not merge until explicitly authorized.

[changeset-bot]

🦋 Changeset detected

Latest commit: 83f3ac9

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[ScriptedAlchemy]

Post-reopen correction pushed in a23f86a: source-neutral background reconcile no longer advances the scheduler epoch and cancel in-flight text activation; mounted hook overflow uses the explicit invalidating path. Evidence: RED reproduced 0/1, GREEN 1/1 for ordinary_background_reconcile_does_not_supersede_in_flight_text_work; cargo check --lib --locked passed.

[chatgpt-codex-connector]

💡 Codex Review

tracedecay/.github/workflows/release.yml

Lines 408 to 411 in fc20c4f

	if [[ -n "${{ steps.target-runtime.outputs.runtime_library }}" ]]; then
	companion_args+=(
	--companion
	"${{ steps.target-runtime.outputs.runtime_library }}=${{ steps.target-runtime.outputs.runtime_entry_name }}"

Install the bundled Linux runtime beside the binary

For Linux targets, this archive now contains libonnxruntime.so.1, and the verification step succeeds only while that companion remains beside the $ORIGIN-linked executable. However, install.sh lines 80-84 extracts the archive and copies only tracedecay into the install directory before deleting the temporary directory. On systems without a compatible system ONNX Runtime, binaries installed through the advertised script will therefore fail in the dynamic loader even for --version; install the companion library beside the executable or use a layout whose runtime search path matches the installed location.

---

tracedecay/release-please-config.json

Lines 22 to 25 in fc20c4f

	{
	"type": "json",
	"path": "server.json",
	"jsonpath": "$.version"

Advance the SDK version in release PRs

The new npm publication job derives its version from the packed sdks/typescript/package.json, but this release-please list updates only the root manifest, CLI manifest, and server.json; the SDK manifest and lockfile remain fixed at 0.1.0. Starting with the release after 0.1.0, the job will either fail its different-integrity check for @tracedecay/sdk@0.1.0 or no-op for identical bytes, so no SDK version corresponding to the new stable release is published.

---

tracedecay/dashboard/src/workspaces/delivery/DeliveryPage.tsx

Lines 80 to 82 in fc20c4f

	const overview = useQuery({
	queryKey: ['delivery', 'overview'],
	queryFn: () => fetchEnvelope('/api/delivery/overview', DeliveryOverviewV1Schema),

Scope Delivery queries to the selected project

When the scope bar selects a project other than the active project, this query keeps the same cache key and continues fetching the unprefixed active-project route. The dashboard already provides scopeKey and scopedUrl, and the backend mounts /api/projects/{id}/delivery/overview; without using them here, the page labels the selected project while showing another project's Git, CI, and release data, and switching scopes does not trigger a refetch.

---

tracedecay/src/tracedecay/lifecycle/registry.rs

Lines 118 to 122 in fc20c4f

	let digest = RegistrationDigest {
	project_id: project_id.to_string(),
	canonical_root: registration_root.to_path_buf(),
	git_common_dir: git_common_dir.clone(),
	tracked_branches,

Include Git remote identity in the registration digest

When origin changes via git remote set-url without touching branch metadata or store artifacts, this digest remains identical, so the cache returns at lines 130-131 before git_remote_url is recomputed at line 147. The registry consequently retains the old remote and its alias, causing remote-based cross-project resolution to reject the new identity or continue resolving the stale one until an unrelated artifact changes; include the normalized remote in the digest.

AGENTS.md reference: AGENTS.md:L159-L161

---

tracedecay/plugin/cursor-native-extension/src/extension.ts

Lines 187 to 189 in fc20c4f

	private sendCurrentDiagnostics(): void {
	const uris = vscode.languages.getDiagnostics().map(([uri]) => uri);
	this.sendChangedDiagnostics(uris);

Batch startup diagnostics instead of dropping the tail

At activation or language-client restart, getDiagnostics() can return more than 32 document URIs, but this passes the entire list to limitAdmittedNativeDiagnosticDocuments, which permanently slices it to the first 32. Documents after that boundary are never synchronized unless they later emit a diagnostic-change or open event, leaving TraceDecay's native diagnostic state incomplete indefinitely for larger workspaces; split the startup list into bounded batches instead.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ScriptedAlchemy]

#733 landed Clippy-red. Helper branch (not merged, shared checkout untouched):

cursor/707-clippy-after-733 @ latest HEAD of this PR (186880e550)

Clears the #733 Clippy denials:

• nest Unbound | Unavailable or-patterns
• collapse nested hint/witness and session-drain ifs
• box SessionGraphAttachmentStateV1::Attached so the enum is not 808B

Adopt when you want:

git fetch origin cursor/707-clippy-after-733
git merge --ff-only origin/cursor/707-clippy-after-733

I will not land this on #707.

[ScriptedAlchemy]

Clippy helper is now on the Codex worktrees (still not landed on this PR head):

• relocate /fast/projects/tracedecay/.codex-worktrees/root-package-relocation @ 806b8c74ef (cherry-pick of 3293045f53)
• post-721 /tmp/tracedecay-integrate-post721-707-a1 @ 127ab57fae (ff to 186880e550 then same cherry-pick)

Same change as cursor/707-clippy-after-733. I will not push/merge this onto #707.

[ScriptedAlchemy]

Isolated post-#721 verification (worktree /tmp/tracedecay-integrate-post721-707-a1, CARGO_TARGET_DIR=/tmp/td-post721-isolated-target):

Green (non-vacuous) on merge 3b1baaee82 / later 127ab57fae:

• tracedecay-graph-db --lib 87
• tracedecay-runtime-core --lib 677
• tracedecay-usecases --lib 837 (+1 ignored)
• tracedecay-code-index --lib 177 (+1 ignored)
• sealed_publication_tests 3, daemon::scheduler 33, session_runtime 1, sealed_projection_deadline_tests 1
• late-bind native_declared_topology_projection 12

Not green

• --all-features cannot compile tracedecay-rusqlite-runtime (admission.rs:120): hotpath::mutex! vs std::sync::Mutex because graph-db enables hotpath/hotpath without tracedecay-rusqlite-runtime/hotpath.
• daemon::tests::scheduler 11 passed / 11 failed. Failures are scheduler_config::*: ensure_worker_plan — profile code-index worker plan was not installed during daemon bootstrap (plus one writer-gate timeout and one missing scheduler key). Production bootstrap.rs still calls install_profile_worker_plan; the test daemon path does not.

Clippy helper remains on this tree at 127ab57fae / relocate 806b8c74ef. Not pushed to this PR head.

[ScriptedAlchemy]

Closing the remaining findings in the Aug 28 Codex review:

• Beta workspace-version authority was already fixed by 261c40e1ebf6229eb09657c227a2d8d7a91c5378.
• Hermes same-origin embedding is fixed in e77654aad8e003b823a29ae7e6838d3b3b06e0d8: /dashboard-url now returns /api/plugins/tracedecay/embed/; that mount proxies HTML/assets/API/SSE, and the iframe rejects cross-origin loopback URLs.
• Selected-project events are fixed in the same commit: the provider reconnects to /api/projects/{id}/events, derives scoped delivery acknowledgements, and the project gateway explicitly admits that selected project's events/delivery-ack POST.

Verification: dashboard typecheck; 38 focused Vitest cases; dashboard-api scoped-post unit test; 8 Hermes proxy tests passed with one FastAPI-only case skipped because FastAPI is not installed.

[ScriptedAlchemy]

Follow-up on the scheduler-race note: no additional port is required on the current implementation. read_task_lock_snapshot distinguishes a vanished file (None) from on-disk garbage (Some with timestamp fallback), and task-lock create/read/remove is serialized by acquire_task_lock_coordination; the normal owner cannot disappear between an AlreadyExists result and the contender's snapshot read. The old #739 fix b44015fa02571d93938aa764c0a81102615131ce is also an ancestor of current #707. The earlier #738 conflict is gone.

[ScriptedAlchemy]

Closing the remaining actionable findings in the Aug 17 Codex review: all five are fixed by 8b9d07f936f7ac7069921658b6fb29ec834eddb6, which is an ancestor of the current #707 head.

• Linux installs copy every libonnxruntime.so* companion next to the installed binary; tests/install_script_test.sh verifies the versioned and unversioned runtime files survive installation.
• Both release-please manifests update crates/tracedecay-sdk/Cargo.toml and Cargo.lock with the release.
• Delivery queries use selected-project scope.
• The registration digest includes normalized Git-remote identity.
• Startup diagnostics are processed in bounded batches without dropping the tail.

The focused install regression and the current dashboard/release verification pass on the pushed head.