fix(evidence): reconcile generations safely

2026-07-12 05:10:19 +02:00
parent f3b49f41c8
commit 459ffa0bcd
14 changed files with 227 additions and 10 deletions
@@ -29,3 +29,27 @@
 The five deselected tests are the repository's opt-in `l2` tests requiring external services;
 they are not local pgvector tests. Test output retains pre-existing Pydantic serialization and
 legacy-config deprecation warnings.
+
+## Review fix wave
+
+- Publication is now explicit and durable (`PUBLISHED` marker). Retention candidates require a
+  valid generation manifest and publication marker (ACTIVE remains backward-compatible), so
+  staged and malformed directories neither consume retention slots nor become deletion targets.
+- The policy retains ACTIVE plus exactly `N-1` newest rollback publications, ordered by durable
+  publication time and generation id. Running and failed-resumable JobRunner checkpoints protect
+  every referenced plan generation.
+- `VectorStore` now exposes exact Evidence generation inventory. Direct pgvector uses a constrained
+  `SELECT DISTINCT` over `kind='evidence'` and `metadata.vector_generation`; HTTP uses the
+  allowlisted `list_evidence_generations` RPC and fails closed on legacy 404. The writer RPC SQL,
+  revokes, and grants are packaged in `create_vector_writer_rpc.sql`.
+- Explicit GC reconciles the union of published filesystem generations and vector-only orphans,
+  preserving vector-before-filesystem deletion and retry semantics.
+- `run_as_job` holds the same corpus writer lock across checkpoint recovery, staging, publish, and
+  retention. Explicit GC already uses this lock, serializing candidate snapshots with publishers.
+- Session artifact consumers no longer receive the corpus source path after validation. They get
+  an owned, read-only copy atomically written from the bytes read and hash-validated on the same
+  descriptor.
+
+Fresh verification after the fix wave: full harness `672 passed, 5 deselected`; Docker pgvector,
+HTTP parity, and migration suites `43 passed`; exact direct inventory/delete integration `1 passed`;
+changed-file Ruff and `git diff --check` clean.