ci: integration batch C of reviewed PRs

.cargo/config.toml

@@ -67,11 +67,15 @@ rustflags = ["-C", "split-debuginfo=unpacked"]
 #
 # `test-ci` is the hosted acceptance selection: nextest's `ci` policy
 # (.config/nextest.toml: fail-fast off, one retry that still fails flaky
-# results, 8 threads, slow-timeout termination) and only the root fixture
-# feature. `.github/workflows/ci.yml` runs this exact alias, and its support
-# binaries/archives are built with `--profile perf` so they share artifacts
-# with it. Extra flags append: `cargo test-ci --locked -E 'binary(=x)'`.
-test-ci = "nextest run --workspace --profile ci --features tracedecay/test-helpers --cargo-profile perf"
+# results, 8 threads, slow-timeout termination), the root fixture feature and
+# `search-eval`, which is what compiles the evaluator acceptance suites (the
+# root crate's dependency on the evaluator is optional so the Linux transport
+# partition does not build the eval-only lexical projection; a `--workspace`
+# run resolves the evaluator anyway). `.github/workflows/ci.yml` runs this
+# exact alias, and its support binaries/archives are built with `--profile
+# perf` so they share artifacts with it. Extra flags append: `cargo test-ci
+# --locked -E 'binary(=x)'`.
+test-ci = "nextest run --workspace --profile ci --features tracedecay/test-helpers,tracedecay/search-eval --cargo-profile perf"
 # Deliberately broader than CI: every optional feature (test-transport
 # acceptance suites, hotpath, …) under the same cargo profile, with the
 # default nextest policy (no retries).

.claude/skills/using-hotpath/references/hotpath-0.24.md

@@ -161,6 +161,8 @@ val_logs              {"debug_id": 3}
 
 Hotpath 0.24 detail calls accept IDs, not names, and have no per-call `limit`. Retention is controlled globally by `HOTPATH_LOGS_LIMIT`.
 
+Published hotpath 0.24 applies `HOTPATH_FUNCTIONS_LIMIT`, else `HOTPATH_LIMIT`, when the exit report is built. Live `functions_timing` and `functions_alloc` use the builder limit captured at guard start. The shipped `tracedecay` process copies that environment onto the builder before the server starts, so a limit set for the process is what those tools return. Setting the variable after the process is already running does not resize the worker.
+
 Recommended order:
 
 1. `profiler_status`.

.codex/skills/using-hotpath/references/hotpath-0.24.md

@@ -161,6 +161,8 @@ val_logs              {"debug_id": 3}
 
 Hotpath 0.24 detail calls accept IDs, not names, and have no per-call `limit`. Retention is controlled globally by `HOTPATH_LOGS_LIMIT`.
 
+Published hotpath 0.24 applies `HOTPATH_FUNCTIONS_LIMIT`, else `HOTPATH_LIMIT`, when the exit report is built. Live `functions_timing` and `functions_alloc` use the builder limit captured at guard start. The shipped `tracedecay` process copies that environment onto the builder before the server starts, so a limit set for the process is what those tools return. Setting the variable after the process is already running does not resize the worker.
+
 Recommended order:
 
 1. `profiler_status`.

.github/linux-test-partitions.json

@@ -68,7 +68,8 @@
         "example:tracedecay-host-cli-fixture"
       ],
       "features": [
-        "tracedecay/test-helpers"
+        "tracedecay/test-helpers",
+        "tracedecay/search-eval"
       ]
     },
     {
@@ -193,6 +194,7 @@
         "tracedecay-framing",
         "tracedecay-hooks",
         "tracedecay-host-integration",
+        "tracedecay-hotpath-guard",
         "tracedecay-mcp-catalog",
         "tracedecay-policy",
         "tracedecay-privacy",
@@ -236,6 +238,7 @@
     }
   ],
   "not_run": {
-    "tracedecay-global-db::schema_convergence_hotpath": "requires hotpath-alloc, which no test lane enables; the hotpath workflows own it"
+    "tracedecay-global-db::schema_convergence_hotpath": "requires hotpath-alloc, which no test lane enables; the hotpath workflows own it",
+    "tracedecay-hotpath-guard::functions_limit_live": "requires hotpath and hotpath-mcp to start a live MCP server, which no test lane enables; the hotpath graph check compiles it"
   }
 }

.github/workflows/ci.yml

@@ -219,24 +219,17 @@ jobs:
           python3 scripts/test-check-dev-skill-mirrors.py
           python3 scripts/check-dev-skill-mirrors.py check
 
-      - name: Validate pushed commit messages
-        if: github.event_name == 'push'
+      # Dispatch admits an integration branch. Judge the commits a merge onto
+      # the default branch would introduce, with the same linter a push uses.
+      # A push still uses the before SHA, so published history is not rejudged.
+      - name: Validate commit messages
+        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
         env:
+          EVENT_NAME: ${{ github.event_name }}
           BEFORE_SHA: ${{ github.event.before }}
           HEAD_SHA: ${{ github.sha }}
-        run: |
-          set -euo pipefail
-          if [ "$BEFORE_SHA" = "0000000000000000000000000000000000000000" ]; then
-            if git rev-parse "${HEAD_SHA}^" >/dev/null 2>&1; then
-              base_sha="${HEAD_SHA}^"
-            else
-              git show --no-patch --format=%B "$HEAD_SHA" | npm run lint:commit --
-              exit 0
-            fi
-          else
-            base_sha="$BEFORE_SHA"
-          fi
-          node scripts/lint-commit-range.mjs --repository "$PWD" "$base_sha" "$HEAD_SHA"
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: scripts/lint-ci-commits.sh
 
   macos-test-partition:
     name: Test macOS ${{ matrix.group }}
@@ -431,10 +424,14 @@ jobs:
   # `--lib` / `--test <name>` / `--bins` decide what compiles, and a filterset
   # would compile everything and skip at run time. The three root partitions
   # share one package selection (`tracedecay`, `tracedecay-cli`,
-  # `tracedecay-search-eval`) with the root fixture feature, so they resolve
-  # one identical dependency graph and every cargo invocation inside a job
-  # (the test build, the executables the suites spawn) is a cache hit against
-  # it. `scripts/linux-test-partitions.py check` proves, from `cargo
+  # `tracedecay-search-eval`) with the root fixture feature. Journeys also
+  # enable `tracedecay/search-eval`, the only link from the root crate to the
+  # evaluator library. It stays off every other partition: an unconditional
+  # dependency unifies `tracedecay-query/search-eval` into every test
+  # target of the package, and the transport suites then compile the eval-only
+  # lexical projection. Every cargo invocation inside a job (the test build,
+  # the executables the suites spawn) is a cache hit against that job's
+  # resolution. `scripts/linux-test-partitions.py check` proves, from `cargo
   # metadata`, that every test target in the workspace is selected by exactly
   # one partition or listed under `not_run` with a reason, so a new crate or
   # suite cannot fall out of the lane silently; `scope-gate` derives the
@@ -737,7 +734,12 @@ jobs:
           shared-key: ci-test-full-windows-msvc-lld
           cache-on-failure: true
 
-      # Acceptance tests execute the ordinary evaluator binaries. Match the
+      # Acceptance tests execute the ordinary evaluator binaries, and
+      # `tracedecay/search-eval` is what compiles the suites that check the
+      # CLI receipt against the library. This lane builds `--workspace`, so
+      # the evaluator and `tracedecay-query/search-eval` already resolve here
+      # and the feature adds no compilation; the Linux partitions split the
+      # package selection, which is why it is per-partition there. Match the
       # archive's features and perf profile to reuse dependency artifacts;
       # nextest's archive.include carries the executables to every shard.
       # `--tests` keeps the binaries in the dev-dependency graph the archive
@@ -746,14 +748,14 @@ jobs:
       # lane).
       - name: Build workspace binaries and tests for the Windows test lane
         shell: pwsh
-        run: cargo build --workspace --bins --tests --locked --profile perf --features tracedecay/test-helpers
+        run: cargo build --workspace --bins --tests --locked --profile perf --features tracedecay/test-helpers,tracedecay/search-eval
 
       # `--workspace`, not `-p tracedecay-cli`: the package selection decides
       # feature unification, and the narrower one recompiles the code-index
       # and extraction crates in a second configuration (see the Linux lane).
       - name: Build Windows host-CLI test fixture
         shell: pwsh
-        run: cargo build --workspace --example tracedecay-host-cli-fixture --locked --profile perf --features tracedecay/test-helpers
+        run: cargo build --workspace --example tracedecay-host-cli-fixture --locked --profile perf --features tracedecay/test-helpers,tracedecay/search-eval
 
       # The controlled-workload Hotpath parity helpers are provisioned and
       # verified by the `hotpath-parity` job. Building them here would put a
@@ -764,7 +766,7 @@ jobs:
       # archive alias, so the arguments are spelled out here once.
       - name: Build nextest archive
         shell: pwsh
-        run: cargo nextest archive --workspace --profile ci --locked --features tracedecay/test-helpers --cargo-profile perf --timings --archive-file "$env:RUNNER_TEMP/nextest-archive.tar.zst"
+        run: cargo nextest archive --workspace --profile ci --locked --features tracedecay/test-helpers,tracedecay/search-eval --cargo-profile perf --timings --archive-file "$env:RUNNER_TEMP/nextest-archive.tar.zst"
 
       - name: Upload Windows archive build timings
         if: always()

CHANGELOG.md

@@ -1710,6 +1710,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- *(admission)* `NotApplicable` is a terminal no-op in the shared replay-pass
+  decision. A closed status that leaves the spool unchanged now stops until
+  the next kick instead of entering the retryable backoff arm.
+
 - *(code-index)* the background worker consults the typed publication-authority
   park instead of a loop-local bool, so a park it has not yet observed still
   stops reconcile. Branch publication handles `NotApplicable` as a closed

Cargo.toml

@@ -26,6 +26,7 @@ members = [
     "crates/tracedecay-host-admission",
     "crates/tracedecay-host-integration",
     "crates/tracedecay-hooks",
+    "crates/tracedecay-hotpath-guard",
     "crates/tracedecay-lcm",
     "crates/tracedecay-lsp",
     "crates/tracedecay-maintenance",

crates/tracedecay-agent-hosts/src/agents/codex.rs

@@ -92,6 +92,17 @@ impl AgentIntegration for CodexIntegration {
         // Core apply drives `codex plugin add` when the host CLI is present.
         // When it is not, stop with the same backtick remediation preflight
         // uses so operators (and lifecycle tests) can activate natively.
+        //
+        // `Ready` here is a promise that Core apply can complete, so it must
+        // not be returned when no `codex` resolves. Returning it anyway opens
+        // a component transaction that can only die in activation with
+        // `HostCliUnavailable`; the rollback leaves a `RolledBack` journal
+        // whose registration backup pins `config.toml` and the versioned
+        // plugin cache as they were *before* the operator runs the printed
+        // `codex plugin add`. The next lifecycle command starts with
+        // `recover_host`, replays that stale rollback over the now-remediated
+        // host, and refuses with `StalePreview` -- making the remediation this
+        // very error prints impossible to follow.
         if plugin_registry::require_codex_plugin_cli().is_err() {
             let marketplace_name = codex_exact_personal_marketplace_name(&ctx.home)
                 .ok()

crates/tracedecay-agent-hosts/src/agents/codex/tests.rs

@@ -1027,6 +1027,42 @@ fn prepare_stages_the_source_and_returns_ready_for_cli_activation() {
     );
 }
 
+/// `Ready` promises Core apply can drive `codex plugin add`, so an
+/// unresolvable plugin CLI must defer instead.
+///
+/// Answering `Ready` opens a component transaction that can only die in
+/// activation with `HostCliUnavailable`. Its rollback leaves a `RolledBack`
+/// journal pinning `config.toml` and the versioned cache as they were before
+/// the operator runs the remediation the failure prints, and the next
+/// lifecycle command's `recover_host` then refuses the drifted host with
+/// `StalePreview`.
+#[test]
+fn prepare_defers_when_no_plugin_cli_resolves() {
+    let home = tempfile::tempdir().unwrap();
+    // Resolution sees only this empty directory; the process `PATH` (which on
+    // a developer box usually does carry `codex`) is untouched.
+    let empty = tempfile::tempdir().unwrap();
+    let _host_programs =
+        tracedecay_runtime_core::config::HostProgramSearchPathGuard::set(empty.path());
+
+    let outcome = CodexIntegration
+        .prepare_non_interactive_install(&install_ctx(home.path()))
+        .unwrap();
+    let NonInteractiveInstallOutcome::DeferredUserAction(deferred) = outcome else {
+        panic!("staging Codex without a resolvable plugin CLI must defer, got {outcome:?}");
+    };
+    assert!(
+        deferred
+            .remediation
+            .contains("`codex plugin add tracedecay@personal`"),
+        "the deferral must print the executable remediation: {}",
+        deferred.remediation
+    );
+    // The source is still staged: the operator's `codex plugin add` consumes it.
+    assert!(codex_plugin_manifest_path(home.path()).is_file());
+    assert!(codex_personal_marketplace_path(home.path()).is_file());
+}
+
 /// Activation must record hook trust even when Codex already reports the
 /// plugin natively active (no `codex plugin add` run): an already-current
 /// install can still carry missing or stale trust, and the canonical

crates/tracedecay-cli/Cargo.toml

@@ -179,6 +179,7 @@ tracedecay-dashboard-api = { path = "../tracedecay-dashboard-api", version = "0.
 tracedecay-domain = { path = "../tracedecay-domain", version = "0.1.0" }
 tracedecay-global-db = { path = "../tracedecay-global-db", version = "0.1.0" }
 tracedecay-hooks = { path = "../tracedecay-hooks", version = "0.1.0" }
+tracedecay-hotpath-guard = { path = "../tracedecay-hotpath-guard", version = "0.1.0" }
 tracedecay-host-integration = { path = "../tracedecay-host-integration", version = "0.1.0" }
 tracedecay-lsp = { path = "../tracedecay-lsp", version = "0.1.0" }
 tracedecay-maintenance = { path = "../tracedecay-maintenance", version = "0.1.0" }

crates/tracedecay-cli/src/cli/dispatch.rs

@@ -66,13 +66,13 @@ pub async fn resolve_cli_application_surface(
     execute_application_surface(operation, dispatched, executor).await
 }
 
-/// Delay before re-sending the same CLI application request when its typed
-/// pre-admission problem explicitly directs an after-delay retry.
+/// Delay before re-sending the same CLI application request when its completed
+/// problem is the publication-window mounting refusal.
 pub(crate) fn surface_retry_delay(result: &ApplicationSurfaceInvocationResult) -> Option<Duration> {
     result
         .result
         .as_ref()
         .err()?
         .problem
-        .pre_admission_retry_delay()
+        .owner_mount_resend_delay()
 }

crates/tracedecay-cli/src/main.rs

@@ -523,9 +523,14 @@ fn hotpath_guard() -> hotpath::HotpathGuard {
     // CPU sampling remains available only by explicit operator request:
     // `HOTPATH_REPORT` (e.g. `functions-cpu`) takes precedence over this
     // default exclusion.
-    hotpath::HotpathGuardBuilder::new("tracedecay")
-        .sections_exclude(vec![hotpath::Section::FunctionsCpu])
-        .build()
+    // Hotpath 0.24 reads HOTPATH_FUNCTIONS_LIMIT only when the exit report is
+    // built. Live functions_timing and functions_alloc use the builder limit
+    // captured when this guard starts, so the same env is applied here.
+    tracedecay_hotpath_guard::with_functions_display_limit(
+        hotpath::HotpathGuardBuilder::new("tracedecay")
+            .sections_exclude(vec![hotpath::Section::FunctionsCpu]),
+    )
+    .build()
 }
 
 #[cfg(feature = "hotpath")]

crates/tracedecay-cli/src/tool_command.rs

@@ -121,8 +121,6 @@ const PROFILE_REGISTRY_TOOLS: &[&str] = &[
     "tracedecay_project_context",
 ];
 
-const MAX_SURFACE_ATTEMPTS: usize = 3;
-
 fn tool_deadline_range_error() -> TraceDecayError {
     TraceDecayError::Config {
         message: format!(
@@ -429,17 +427,13 @@ fn dispatch_cli_application_surface_inner(
         let handshake =
             tracedecay::daemon::handshake_for_current_client(project, None, false, false)?;
         let client = tracedecay_daemon_identity::invocation_client_for_current(handshake)?;
-        // A cold daemon answers a retryable pre-admission problem while the
-        // project open still warms in the background (bounded by the daemon's
-        // foreground open wait). The compatibility tool path rides that state out
-        // through its project-open retry loop; the typed surface path must present
-        // the same transport behavior, so re-send the same request per the
-        // envelope's own retry directive, bounded by both the CLI deadline and
-        // three attempts so a persistent refusal remains visible to callers.
+        // A cold daemon answers the mounting refusal while the project open
+        // still warms in the background. The compatibility tool path rides
+        // that state out through its project-open retry loop; the typed
+        // surface path re-sends only that same refusal, until the CLI
+        // deadline. Every other completed problem is the answer.
         let mut next_request = Some(request);
-        let mut attempts = 0usize;
         let result = loop {
-            attempts += 1;
             let request = match next_request.take() {
                 Some(request) => request,
                 None => parse_application_surface_request(operation, tool_args.clone()).map_err(
@@ -486,29 +480,18 @@ fn dispatch_cli_application_surface_inner(
                     message: error.to_string(),
                 },
             })?;
-            let Some(delay) = bounded_surface_retry_delay(
-                crate::cli::dispatch::surface_retry_delay(&result),
-                attempts,
-                deadline,
-            ) else {
+            let Some(delay) = crate::cli::dispatch::surface_retry_delay(&result) else {
                 break result;
             };
+            if deadline.saturating_duration_since(Instant::now()) <= delay {
+                break result;
+            }
             tokio::time::sleep(delay).await;
         };
         print_cli_application_surface(result, requested_format == RequestedOutputFormat::Json)
     })
 }
 
-fn bounded_surface_retry_delay(
-    delay: Option<Duration>,
-    attempts: usize,
-    deadline: Instant,
-) -> Option<Duration> {
-    let delay = delay?;
-    (attempts < MAX_SURFACE_ATTEMPTS && deadline.saturating_duration_since(Instant::now()) > delay)
-        .then_some(delay)
-}
-
 fn print_cli_application_surface(
     result: ApplicationSurfaceInvocationResult,
     raw_json: bool,