docs: finalize TraceDecay V2 redesign plan

Author: ScriptedAlchemy

.gitignore

@@ -6,9 +6,7 @@
 !plugin/.mcp.json
 .claude/settings.local.json
 .cursor/
-docs/superpowers/plans/*
-!docs/superpowers/plans/tracedecay-v2/
-!docs/superpowers/plans/2026-07-09-tracedecay-brain-rewrite.md
+docs/superpowers/plans/
 /local-only
 .worktrees
 .agents/

docs/superpowers/plans/2026-07-09-tracedecay-brain-rewrite.md

@@ -63,7 +63,7 @@ When documents overlap:
 
 1. Master sections 1–9, 18–24.
 2. Plans 01, 02, 05, 06, 09, and 12.
-3. Plans 13–24 as non-negotiable evidence/scope/API/privacy/convergence/task-execution gates.
+3. Plans 13–26 as non-negotiable evidence/scope/API/privacy/convergence/task-execution/code-indexing/observability gates.
 
 ### Storage and migration implementer
 
@@ -104,7 +104,7 @@ When documents overlap:
 
 ### Test/evaluation lead
 
-1. Plans 13–16 and 22–24.
+1. Plans 13–16 and 22–26.
 2. Every plan’s Definition of Done and verification sections.
 3. Master phase/PR gates and SLO section.
 
@@ -133,6 +133,16 @@ When documents overlap:
 2. Hermes source/transcript anchors and wrong-board, copied-task, lost-dependency, already-complete-dispatch, and stale-worker regressions in plans 13–14.
 3. Canonical identity, multi-project declared scope, typed dependency edges, versioned context packets, executor capability routes, claims/run fencing, budget/effect grants, task-aware hints, board projections, and replay gates.
 
+### Code-intelligence implementer
+
+1. Plan 25 in full plus plans 01–05, 12, 14, 16, 18, and 19.
+2. Parser/grammar registry, capture-sanitized payload references, watcher intake, deterministic incremental reuse, packed generations/overlays, symbol lineage, diagnostics/test attribution, V1 graph-store dispositions, and 10× scale gates.
+
+### Observability/accounting implementer
+
+1. Plan 26 in full plus plans 01–06, 08–12, 15, 20–24.
+2. Generated surface vocabulary, denominator-safe metric descriptors/rollups, cap/truncation anchors, adoption and hint outcomes, SLOs, pricing/savings methodology, replay exclusion, Observatory contracts, and V1 analytics receipts.
+
 ## 4. Locked architectural decisions
 
 - Start as one Rust binary with bounded internal crates/ports; allow later daemon/query split without changing contracts.
@@ -165,6 +175,8 @@ When documents overlap:
 - Executor selection is explicit and typed: host/provider/model/reasoning effort, tool and effect grants, privacy/egress class, cost/time budgets, retry/concurrency policy, and availability resolve to an immutable route receipt. Codex, Claude, Cursor, Hermes, and future executors are adapters, not task owners.
 - Every dispatched run uses a compare-and-swap task revision, TTL/heartbeat claim, artifact/worktree overlap set, idempotency key, and unforgeable run fence. Completion/cancellation revokes stale authority; dependency readiness comes only from current canonical edges.
 - Versioned context packets bind task revision, scope, dependency outcomes, exact Thread/Turn anchors, code/Git/PR state, active claims, retrieval/config versions, source watermarks, visibility policy, budget, and digest. Agents receive only materially relevant, recipient-authorized sibling summaries; neither boards nor long threads become implicit context.
+- `tracedecay-code-index` is the sole production owner of code extraction, grammar registration, watcher intake, incremental reuse, generation construction, lineage, and diagnostic/test attribution. Packed generations reference plan-02 privacy-domain blobs; they never embed a second source-body store.
+- Metric definitions, surface codes, denominators, caps, horizons, pricing/savings methods, and SLOs are registered/versioned contracts. `unknown`, `partial`, and `capped` never render as known zero, and observability cannot create a second event/accounting path.
 
 ## 5. Dependency and implementation order
 
@@ -193,6 +205,10 @@ flowchart TD
     P --> T
     T --> A
     T --> UI
+    S --> O["Accounting and observability projections"]
+    Q --> O
+    A --> O
+    O --> UI
     M --> X["Bounded cutovers, V2 default, V1 retirement"]
 ```
 

docs/superpowers/plans/tracedecay-v2/00-plan-set-index.md

@@ -68,11 +68,11 @@ This plan is the type authority inside the converged system described by [`19-sy
 | Session-origin classification and copied-prompt representatives | merged PR #410: `src/sessions/message_noise.rs`, message search/LCM query filters, CLI/MCP schemas and regressions | Model native row, origin classification (`direct_user`, `subagent`, `tool_result`, protocol/unknown), representative membership, and derivation evidence separately. Raw observations are never deleted by representative views. |
 | Duplicated LCM message model | `src/sessions/lcm/types.rs`, `src/sessions/lcm/schema.rs::LCM_SCHEMA_VERSION`, `ensure_lcm_schema` | Canonical content stays in activity entities/events; LCM DAG and compression state become derived lineage projections with explicit source coverage. |
 | V1 retention semantics | `src/retention.rs`: `RetentionConfig`, `RetentionTable`, `prune_table` | Preserve the strict “older than cutoff” boundary, but use required `ingested_at` as the V2 retention anchor and retain tombstone/provenance skeletons. |
-| Hermes legacy consolidation | incoming PR #407: `src/migrate/hermes.rs`: `LegacyHermesMigration`, `MigrationMarker`, `migrate_legacy_hermes_stores`, fact/session copy functions | Import `~/.hermes` only as a source. Sessions/LCM and profile/zero-project/cross-project or unresolved facts/skills/policy/automation land in activity; explicitly project-scoped equivalents land in that canonical project shard. The migration ledger and logical source fingerprint are parity evidence. |
+| Hermes legacy consolidation | merged PR #407: historical `src/migrate/hermes.rs`: `LegacyHermesMigration`, `MigrationMarker`, `migrate_legacy_hermes_stores`, fact/session copy functions | Import `~/.hermes` only as a source. Sessions/LCM and profile/zero-project/cross-project or unresolved facts/skills/policy/automation land in activity; explicitly project-scoped equivalents land in that canonical project shard. The migration ledger and logical source fingerprint are parity evidence. |
 | Runtime drain and lifecycle serialization | merged PR #412: `src/lifecycle_lease.rs`, daemon/service/update shutdown changes | Model lease epoch, drain intent, writer quiescence, checkpoint completion, service state, and shutdown receipt as distinct typed evidence. A restart/update may not imply writers drained or WAL checkpointed without the receipt. |
 | Foreign managed-skill ownership and remediation | merged PR #411: `package_is_foreign_to_installation`, `SkillDrift::ForeignOrphan`, doctor/removal agreement | Model installation owner, scope, drift classification, severity, and remediation capability separately. A foreign/legacy package is informative evidence and cannot receive a destructive/update remediation owned by another installation. |
 
-Planning began at `99ad19bc`; publication master `9f7a1108` later merged #410/#411/#413/#414/#415/#416/#417/#419/#420/#422. Open #407/#418/#423 remain live refresh inputs. PR #409 was closed unmerged. Immediately before PR 4, regenerate the exact crate/schema/protocol/tool inventory from current master; #414/#419 require a cataloged race-safe move-symbol capability contract, #417 identity-conflict states must remain visible rather than collapsed, and #423's fact-rank/counter behavior is future input until merge.
+Planning began at `99ad19bc`; publication master `6c4b8b91` includes #407/#410/#411/#413/#414/#415/#416/#417/#419/#420/#422/#423/#424. Open #418 remains a live refresh input. PR #409 was closed unmerged. Immediately before PR 4, regenerate the exact crate/schema/protocol/tool inventory from current master; #414/#419 require a cataloged race-safe move-symbol capability contract, #417 identity-conflict states must remain visible rather than collapsed, and #423/#424 retrieval/accounting semantics are accepted behavior.
 
 ## Proposed crate tree
 

docs/superpowers/plans/tracedecay-v2/01-domain-crate.md

@@ -86,7 +86,7 @@ Required SQLite behavior:
 | Runtime lifecycle drain | merged PR #412: `src/lifecycle_lease.rs`, daemon/service/update shutdown, writer drain and WAL checkpoint order | Import/emit fenced lifecycle leases and shutdown receipts. Store maintenance/update cannot checkpoint, migrate, replace, or reopen until owned background writers and clients are drained; preserve stopped/disabled/masked service state. |
 | Foreign skill ownership | merged PR #411: shared doctor/removal ownership predicate and `ForeignOrphan` | Persist installation owner/source manifest and remediation classification for skill materialization evidence. Foreign or legacy-owner packages are never deletion/update candidates for this installation without explicit ownership transfer. |
 
-Planning began at `99ad19bc`; publication master `9f7a1108` includes #410/#411/#413/#414/#415/#416/#417/#419/#420/#422. Open #407/#418/#423 remain refresh inputs; #417 identity-split visibility is a required catalog/store conflict fixture, #419 requires snapshot/same-file-safe edit receipts, #420 requires daemon authority selection before local store open, #422 requires bounded generation-local client refresh state to remain runtime metadata rather than canonical store truth, and #423 contributes future fact retrieval/counter events. PR #409 remains historical. Every implementation/import PR refreshes current master/open state and exact store/schema/protocol inventories before generating manifests.
+Planning began at `99ad19bc`; publication master `6c4b8b91` includes #407/#410/#411/#413/#414/#415/#416/#417/#419/#420/#422/#423/#424. Open #418 remains a refresh input; #417 identity-split visibility is a required catalog/store conflict fixture, #419 requires snapshot/same-file-safe edit receipts, #420 requires daemon authority selection before local store open, #422 requires bounded generation-local client refresh state to remain runtime metadata rather than canonical store truth, #423 contributes fact retrieval/counter events, and #424 contributes aggregate-before-sample analytics plus project/time indexes. PR #409 remains historical. Every implementation/import PR refreshes current master/open state and exact store/schema/protocol inventories before generating manifests.
 
 ## 6. Proposed crate tree
 
@@ -871,7 +871,7 @@ This sequence refines master-plan PR 5 into PRs 5A–5B, implements the master p
 - [ ] Add failing copied-store cases for every V1 table/sidecar/payload family, interrupted resume, repeated import, unknown schema, missing payload, PR #405 unique/adopted/conflicting identities, PR #407 moved/facts-only/collision scopes, and PR #410 native/direct/subagent/tool-result/protocol/representative counts.
 - [ ] Run `cargo test -p tracedecay-store --test import_parity -- --nocapture`. Expected: importer and receipts are absent.
 - [ ] Implement the nine-step import order in Section 17 with read-only source opens, logical source manifests, stable allocation mapping, per-domain checkpoints, counts/hashes/offsets/payload inventory/quarantine, and signed parity receipts, consuming capture PR 7E's sanitized receipt-bearing batches and refusing receiptless payloads. Never scan a Hermes runtime destination, mutate a V1 file, or collapse copied prompt rows at ingest.
-- [ ] Re-run from publication base `9f7a1108` with merged #405/#410/#411/#412/#413/#414/#415/#416/#417/#419/#420/#422 and open-assumed #407/#418/#423 fixtures recorded separately, then regenerate manifests from that exact base. Expected: second import emits zero canonical additions; every difference has a named disposition; sanitized-native #410 counts, #411 ownership/remediation, #417 conflict state, #419 edit receipts, #420 routing authority, #422 catalog-generation state, #423 fact retrieval/counter events when merged, and lifecycle receipts all match.
+- [ ] Re-run from publication base `6c4b8b91` with merged #405/#407/#410/#411/#412/#413/#414/#415/#416/#417/#419/#420/#422/#423/#424 and open-assumed #418 fixtures recorded separately, then regenerate manifests from that exact base. Expected: second import emits zero canonical additions; every difference has a named disposition; sanitized-native #410 counts, #411 ownership/remediation, #417 conflict state, #419 edit receipts, #420 routing authority, #422 catalog-generation state, #423 fact retrieval/counter events, #424 aggregate/index behavior, and lifecycle receipts all match.
 - [ ] Commit `feat(store): import v1 evidence with parity receipts`.
 
 ### PR 33S-2: Store cutover support, rollback window, and deletion proof

docs/superpowers/plans/tracedecay-v2/02-store-crate.md

@@ -462,7 +462,7 @@ pub struct CaptureReplayManifestV1 {
 
 Canonical provider activity, including generic and cross-project sessions, belongs to profile `activity.db`. Project attribution is zero-to-many evidence produced later; project shards receive locators and scoped projections, never duplicate message bodies. Profile/zero-project/cross-project knowledge, skills, policies, and automation also resolve to activity ownership. Project-native Git/code and explicitly project-scoped knowledge/policy/automation evidence belongs to the canonical repository/privacy-domain `project.db`.
 
-Merged PR #405 (`legacy-store-adoption`) is a required pre-backfill seam: source discovery consumes its manifest-backed adopted identity, treats pristine retargeting as the same source, and quarantines nonempty split-identity conflicts instead of minting duplicate artifact IDs. Open PR #407 keeps `~/.hermes` source-only if merged. Merged #410 remains a semantic fixture: every copied parent/subagent prompt, direct-user row, tool result, and protocol row is captured losslessly. Merged #412 supplies lifecycle drain evidence; merged #411 supplies foreign skill-owner/remediation events. #414/#419 and release PRs #413/#416 add no capture semantics by assumption; merged #415/#417/#420/#422 contribute release, identity, routing, and catalog-generation evidence. Open #418/#423 are refreshed before implementation; #417's identity-split visibility is a required discovery/quarantine case. PR #409 remains historical. The conformance manifest records actual merge/base commits and semantics.
+Merged PR #405 (`legacy-store-adoption`) is a required pre-backfill seam: source discovery consumes its manifest-backed adopted identity, treats pristine retargeting as the same source, and quarantines nonempty split-identity conflicts instead of minting duplicate artifact IDs. Merged PR #407 keeps `~/.hermes` source-only under the ordinary user profile. Merged #410 remains a semantic fixture: every copied parent/subagent prompt, direct-user row, tool result, and protocol row is captured losslessly. Merged #412 supplies lifecycle drain evidence; merged #411 supplies foreign skill-owner/remediation events. #414/#419 and release PRs #413/#416 add no capture semantics by assumption; merged #415/#417/#420/#422/#423/#424 contribute release, identity, routing, catalog-generation, retrieval-event, and accounting evidence. Open #418 is refreshed before implementation; #417's identity-split visibility is a required discovery/quarantine case. PR #409 remains historical. The conformance manifest records actual merge/base commits and semantics.
 
 ## Per-provider conformance matrix
 
@@ -530,7 +530,7 @@ The `code_snapshot` adapter is the single sanctioned sanitizer-crossing entry po
 - [ ] Implement Cursor agent/Composer read-only framing, dispatch/subagent/presence/claim evidence, SQLite replacement detection, and bounded blob traversal; include shared-worktree session `ebc96a27-b046-4c88-865f-b38d76da9d2d`.
 - [ ] Implement Cline-like, Hermes, Kiro, and Vibe adapters with every matrix assertion.
 - [ ] Implement the `code_snapshot` extractor adapter with explicit repository/checkout/worktree/ref/snapshot tuple identity, bounded dirty overlays, large-blob/binary budgets with skip coverage, and secret-bearing repository fixtures proving sanitizer conformance for the plan 25 pipeline.
-- [ ] Refresh after PR #407 merges, regenerate the Hermes fixture manifest, and prove `~/.hermes` is source-only while sessions/LCM are activity-owned and scope-sensitive histories retain `DeclaredScope` for activity/project routing.
+- [ ] Regenerate the Hermes fixture manifest from merged PR #407 and prove `~/.hermes` is source-only while sessions/LCM are activity-owned and scope-sensitive histories retain `DeclaredScope` for activity/project routing.
 - [ ] Run `cargo test -p tracedecay-capture --test provider_conformance`; expected: exit 0 for every adapter registered in `adapters/mod.rs` and no untested registry entry.
 - [ ] Run `cargo test --test transcript_ingest_suite`; expected: existing V1 provider suite remains green because shadow capture does not change V1 writes.
 - [ ] Commit `feat(capture): conform remaining provider sources`.
@@ -544,7 +544,7 @@ PR 7E owns V1 parse and sanitize: every byte of V1 import content passes the man
 - [ ] Capture every LCM raw/summary/source/compression/payload/lifecycle/tombstone family, session/message/analytics row, Git/worktree/ref/commit observation, hook/hint terminal row, and automation family listed in the seam map.
 - [ ] Add the provider-global backfill-marker regression: a completed marker for one provider/source artifact cannot suppress scanning another provider or cause every source to reparse. Checkpoints are keyed by `(adapter, source instance, artifact, rewrite generation)` and report per-provider reparsed/skipped counts.
 - [ ] On the base containing merged #405, assert moved roots, symlinks, linked worktrees, and pristine adopted stores retain source/artifact identity; nonempty split identities produce `ownership_conflict` quarantine.
-- [ ] Refresh after PR #407 merges and assert session/fact/LCM migrations produce one idempotent source lineage with collision reports and `DeclaredScope` preserved.
+- [ ] Refresh from merged PR #407 and assert session/fact/LCM migrations produce one idempotent source lineage with collision reports and `DeclaredScope` preserved.
 - [ ] Run `cargo test -p tracedecay-capture --test provider_conformance v1_`; expected: exit 0 and every V1 structured family has at least one golden observation.
 - [ ] Run `cargo test -p tracedecay-capture --test shadow_parity backfill_manifest`; expected: counts/hashes/offsets/source lineage/payload refs match or appear in the explicit quarantine report.
 - [ ] Commit `feat(capture): add v1 backfill sources`.