chore: remove internal task ID references from comments and docs

Strips tracking identifiers (T1-xx, T2-xx, T3-xx, T4-xx) from inline
comments, doc strings, and test names across the codebase. Descriptions
are reworded to stand on their own without referencing internal task IDs.

Also removes backward-compat prose tied to pre-existing legacy clients
from `CrdtAuthContext` (device_id/seq_no now required fields, no
`#[serde(default)]`) and from the `HlcState` clock-skew comment.
Tightens `backup_envelope.rs` constants doc to remove a forward-compat
claim that is now simply the default behavior.

Author: farhan-syah

Cargo.lock

@@ -465,7 +465,7 @@ mod tests {
         }
     }
 
-    // ── T1-05 ResolvedColumnCodec tests ────────────────────────────────────────
+    // ── ResolvedColumnCodec tests ──────────────────────────────────────────────
 
     /// Discriminants of ResolvedColumnCodec must exactly match those of the
     /// corresponding ColumnCodec variants so on-disk byte values are unchanged.

nodedb-codec/src/lib.rs

@@ -654,7 +654,7 @@ mod tests {
 
     // ── Bloom filter parameter persistence ─────────────────────────────────
 
-    /// T1-18: bloom parameters (k, m) must survive a BlockStats MessagePack
+    /// Bloom parameters (k, m) must survive a BlockStats MessagePack
     /// roundtrip so that future readers can reconstruct the filter without
     /// relying on compile-time constants.
     #[test]
@@ -693,7 +693,7 @@ mod tests {
         assert!(bloom_may_contain(&persisted, "world"));
     }
 
-    /// T1-18: a filter built with non-default k=7, m=8192 uses those params
+    /// A filter built with non-default k=7, m=8192 uses those params
     /// for bit-position calculations — not the default BLOOM_BITS_DEFAULT/K.
     #[test]
     fn bloom_custom_params_functional() {

nodedb-columnar/src/predicate.rs

@@ -556,7 +556,7 @@ mod tests {
             .expect("write")
     }
 
-    // ── T1-05 ResolvedColumnCodec reader tests ─────────────────────────────────
+    // ── ResolvedColumnCodec reader tests ──────────────────────────────────────
 
     /// The `ResolvedColumnCodec` type statically excludes `Auto` (discriminant 0).
     ///

nodedb-columnar/src/reader.rs

@@ -205,7 +205,7 @@ mod tests {
         .expect("valid")
     }
 
-    // ── T1-05 ResolvedColumnCodec integration tests ────────────────────────────
+    // ── ResolvedColumnCodec integration tests ─────────────────────────────────
 
     /// The writer resolves Auto to a concrete codec before writing.
     /// The resulting footer must not contain codec byte 0 (Auto discriminant).

nodedb-columnar/src/writer/mod.rs

@@ -31,21 +31,18 @@
 /// than `last_seen[(user_id, device_id)]` on the server. The HMAC input
 /// binds the seq_no and device_id so they cannot be altered after signing.
 ///
-/// ## Wire compatibility
+/// ## Required fields
 ///
-/// Both `device_id` and `seq_no` have `#[msgpack(default)]` so that old
-/// clients (pre-T4-D) that don't send these fields will deserialize with
-/// 0/0. Note: seq_no=0 is never accepted (must be > last_seen=0), so old
-/// unsigned deltas will be rejected unless the caller sets delta_signature
-/// to all-zeros (unsigned path, which bypasses the replay check).
+/// All fields, including `device_id` and `seq_no`, must be present in the
+/// serialized form. Missing fields are a hard decode error.
 #[derive(Debug, Clone, Copy, Default, serde::Serialize, serde::Deserialize)]
 pub struct CrdtAuthContext {
-    /// Authenticated user_id (0 = unauthenticated/legacy).
+    /// Authenticated user_id (0 = unauthenticated).
     pub user_id: u64,
     /// Tenant this operation belongs to.
     pub tenant_id: u64,
     /// Unix timestamp (milliseconds) when this auth session expires.
-    /// 0 = no expiry (trust mode / legacy).
+    /// 0 = no expiry (trust mode).
     /// Agents accumulating deltas offline must re-authenticate before
     /// syncing if their auth context has expired.
     pub auth_expires_at: u64,
@@ -54,13 +51,9 @@ pub struct CrdtAuthContext {
     /// before accepting, and also enforces replay protection.
     pub delta_signature: [u8; 32],
     /// Stable per-device identifier assigned by the server on first bind.
-    /// 0 = legacy / pre-T4-D client that does not participate in replay protection.
-    #[serde(default)]
     pub device_id: u64,
     /// Monotonically increasing per-device sequence number.
     /// Must be strictly greater than last_seen[(user_id, device_id)] on the server.
-    /// 0 = legacy / pre-T4-D client.
-    #[serde(default)]
     pub seq_no: u64,
 }
 

nodedb-crdt/src/lib.rs

@@ -343,11 +343,10 @@ mod tests {
         );
     }
 
-    // ── Backward-compat: pre-T4-D context (device_id=0, seq_no=0) ────────────
-    // With device_id=0, seq_no=0: check_seq(0) <= last_seen(0) → ReplayDetected.
-    // This pins the behavior: old unsigned clients are rejected in signed mode.
+    // ── seq_no=0 is rejected ─────────────────────────────────────────────────
+    // With seq_no=0: check_seq(0) <= last_seen(0) → ReplayDetected.
     #[test]
-    fn pre_t4d_context_seq_zero_rejected() {
+    fn seq_zero_rejected() {
         let registry = DeviceRegistry::new();
         // seq_no=0 is never > last_seen=0.
         let err = registry.check_seq(1, 0, 0).unwrap_err();

nodedb-crdt/src/signing.rs

@@ -53,12 +53,10 @@ pub const DEFAULT_MAX_TOTAL_BYTES: u64 = 16 * 1024 * 1024 * 1024;
 pub const DEFAULT_MAX_SECTION_BYTES: u64 = 16 * 1024 * 1024 * 1024;
 
 /// Sentinel `origin_node_id` values that mark sections carrying
-/// metadata rather than per-node engine data. The envelope format is
-/// backward-compatible: V1 readers that don't know about these
-/// sentinels still decode the envelope (the bytes just aren't applied
-/// at restore time), but the section CRCs still validate. Restore
-/// handlers recognize the sentinel and route the body to the correct
-/// catalog writer.
+/// metadata rather than per-node engine data. Restore handlers
+/// recognize the sentinel and route the body to the correct
+/// catalog writer. Section CRCs validate independently of whether
+/// the reader acts on the section body.
 pub const SECTION_ORIGIN_CATALOG_ROWS: u64 = 0xFFFF_FFFF_FFFF_FFF0;
 pub const SECTION_ORIGIN_SOURCE_TOMBSTONES: u64 = 0xFFFF_FFFF_FFFF_FFF1;
 

nodedb-types/src/backup_envelope.rs

@@ -10,7 +10,7 @@ use crate::value::Value;
 /// Typed column definition for strict document and columnar collections.
 ///
 /// `#[non_exhaustive]` — this enum grows with each type system expansion
-/// (e.g. T3-07 adds `Decimal { precision, scale }`, T4-10 splits
+/// (e.g. future variants may add `Decimal { precision, scale }` or split
 /// `Timestamp`/`TimestampTz`). External exhaustive `match` arms must handle
 /// future variants via a typed error arm rather than `_ => unreachable!()`.
 #[non_exhaustive]

nodedb-types/src/columnar/column_type.rs

@@ -21,7 +21,7 @@ use serde::{Deserialize, Serialize};
 ///
 /// # Wire format note
 ///
-/// `logical` was widened from `u32` to `u64` (T4-11) to eliminate
+/// `logical` was widened from `u32` to `u64` to eliminate
 /// saturation under high-frequency burst writes. Persisted zerompk
 /// blobs from before this change carry a 32-bit logical counter;
 /// MessagePack integers decode by value (not by declared width), so
@@ -95,7 +95,7 @@ impl HlcClock {
         let wall = wall_now_ns();
         let mut st = self.state.lock().unwrap_or_else(|p| p.into_inner());
         // Clamp wall to at least st.wall_ns so the HLC never regresses on
-        // clock skew or NTP adjustments (T4-15).
+        // clock skew or NTP adjustments.
         let wall = wall.max(st.wall_ns);
         let next = if wall > st.wall_ns {
             Hlc::new(wall, 0)