[adrianwebb]

Outcome

Managed TreeDX could not start because two registered append logs ended in incomplete records. Add and package treedx_store_recover DATA_DIR REGISTERED_LOG [--apply EXACT_PLAN_DIGEST] to recover only a validated complete prefix while retaining every original byte. Ordinary readers continue refusing corruption.

Work authority

• Work item / Issue: Current treedx backlog: retained requirements after issue consolidation #86 and Complete communication closeout inside the original assignment window agent#496.
• Proposal / decision: Standing user approval to repair architectural/MCP blockers and preserve retained work and unknown history.
• Assignment / checkpoint: Integrator bootstrap recovery; the broken native knowledge boundary prevented governed delegation. No fabricated assignment.
• Actor: Codex integrator; human authority: @adrianwebb.
• Agent / capacity provider: No new worker admission for this repair.
• Exact base ref: 13d9f90.
• Exact head ref: ad46a57.
• Agent-assisted under human authority

Plan and changes

Use the original store registry and shared envelope/checksum validator. Plan under the same OS lock as the managed runtime; apply only the exact planned digest. Stream a verified full-original backup, sync, atomically install the complete prefix, then verify readback. Refuse interior/newline-terminated corruption, wrong kind/checksum, symlinks, escaping backup paths, stale source and active owners. Preserve pending copies across interruption. Document stopped-service operation. The existing entrypoint retains privilege dropping; its OS lock covers managed service and offline command. The pre-existing non-container startup marker remains. Compatible plug_crypto2.2.1 repairs the actual locked2.2.0 Hex advisory. No new storage model, task policy, coordinator host-control MCP tool or execution wrapper.

Verification and commits

• b372eb5 implements connected-token recovery; a510c73 applies compatible dependency patch and input cases; ad46a57 reuses the existing registry for all registered append logs after the real audit EOF was exposed.
• Missing audit operation reproduced RED1FAIL; final23lifecycle cases plus complete79Rust/276Elixir, strict workspace clippy, formatting/file policies, sh -n and diff checks PASS. Exact local log /tmp/codex-treedx98-native-audit-final496.log.
• Full PR40037234704 PASS, both native architectures/eight SDK jobs/contracts/specs/gate. Push40037229818 required Fast PR Gate rerun alone PASS after its earlier cancellation blocked merge. Historical40035716276 failed Hex advisory; original failed activations and all earlier native observations retained in Issue86.
• Fresh protected base/head checked before merge; merged94bccf5812c690a511b7a95ddb500a3a32378929. Protected40039003085 and sealed candidate40039003127 PASS, including both native architectures, eight SDK jobs, architecture/performance/federation profiles, package/images and exact protected-branch seal.

Actual recovery/readback

recovered the real audit log using exact digest blake3:7deb454812f988c3ea5fea5036dd055c39259529c57e4dd073a25446e2e7d8f0. Original7119544320bytes were backed up byte-for-byte to treedx://backup/log-tail-7deb454812f988c3ea5fea5036dd055c39259529c57e4dd073a25446e2e7d8f0/original.tdb; installed prefix7119543732bytes contains10875769complete audit events. The588incomplete bytes remain retained unknown history. Token original2714865664bytes/digest9200b14c31a1909aec70484a83c620d7bc41b80055eb28ab4e33bbe0ce3a3c51 remains preserved at its earlier token-tail backup URI. Files /tmp/codex-treedx98-real-audit-{plan,apply}496.{json,stderr}, both native process exits0 and --rm containers removed. Maintenance image82d7ec312a6e2f7ef0a67df184fe71b0ff2a8eaaece1f36ada3db5ad263916a4 was built from clean exactad46 using the existing owning Dockerfile; no alternative runtime or wrapper. Networknone/read-onlyrootfs/4GiB/UID65532 retained; sampled76.68MiB during copy is not a peak or agent usage.

Supported trsd dev rebuild treedx.service --session dev-5007e344-493 succeeded after both repairs; generation12546 ready, actual container healthy from23:14:25UTC. Receipt /tmp/codex-treedx98-restored-development496.{json,stderr}. Native MCP workspace show/diff/content/update/submit succeeded afterward. Workspacecfe77be2-6d10-4bc1-b95a-927b3d6c8c44 publishedv19; integration operation2866e361-e63e-457b-a99d-8e7fa556d3fe succeeded, content commite20f1e7bfa659a82d7a8287414661ab311c63c1d, published revision5f63e4e90ff8f7eedcc1d063ab31cdfc8878cce8. These are real content/control-plane readback, not a complete agent execution proof. All original10claims, retained products and unknown usage preserved.

Risk and rollback

Retain both complete original backups, the original data volume and failed observations. Never interpret incomplete bytes as successful events. Recovery refuses unsupported corruption and does not fix the unproved append-durability/log-growth root cause. Managed development is healthy; sealed release adoption and full meaningful agent/MCP product-release proof remain pending.

Completion summary

Real token and audit recovery, healthy supported development rebuild, and native MCP governed content publication succeeded. Original10retained claims/products/unknownusage preserved. All source PR checks passed and the change merged. Protected release gates and candidate sealing passed. Final installed release adoption, growth prevention and full agent workflow remain unproved.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.