docs: reconcile v2 plans with Hermes routing fixes

Author: ScriptedAlchemy

docs/plans/2026-07-09-tracedecay-brain-rewrite.md

@@ -58,7 +58,7 @@ The rewrite will not copy every current table into a larger database or place ev
 
 ### 2.1 Live system snapshot
 
-The audit was run on 2026-07-09/10 UTC from a clean worktree created from and repeatedly refreshed against `origin/master`; the publication base is `273f50c0372f063b97f4755563a3ded65ef324d5` at crate version 0.0.53. In addition to the 0.0.48 base through split-store consolidation PR #425, it includes accepted fixes for untracked branch graphs (#426), divergent session variants (#428), indexed consolidation-family lookup (#430), hook lifecycle quiescence (#432), conflict-safe registry reconstruction (#434), read-only search versus explicit FTS repair (#435), graph SQLite peer-checkpoint safety (#436), restart-safe retirement of applied consolidation inputs (#438), orphan-store truth derived from the registry-reconstruction diff (#439), and per-manifest isolation of registry reconstruction conflicts (#440), followed by release #437. Only draft plan PR #421 remained open at the publication refresh. Early store/analytics snapshots used installed TraceDecay 0.0.44; the final original planning probes used installed 0.0.47, and the reconciliation audit used installed 0.0.52 before the 0.0.53 source release merged, so every runtime observation remains version-labeled rather than being silently upgraded to newer source semantics. During research, the live store continued ingesting sessions, so counts are timestamped snapshot values rather than timeless constants. The direct `project_list` snapshots before and after the early rebase both reported 25 repositories; concurrent audits observed 28–29 searched/registered scopes, reinforcing the requirement that inventories carry a timestamp, tool/runtime identity, catalog generation, runtime version, and watermark rather than presenting a drifting count as timeless.
+The audit was run on 2026-07-09/10 UTC from a clean worktree created from and repeatedly refreshed against `origin/master`; the publication base was refreshed on 2026-07-11 to `e888393368ce8704e6fa123f0daecebd1af9ef8d` at crate version 0.0.56. In addition to the 0.0.48 base through split-store consolidation PR #425, it includes accepted fixes for untracked branch graphs (#426), divergent session variants (#428), indexed consolidation-family lookup (#430), hook lifecycle quiescence (#432), conflict-safe registry reconstruction (#434), read-only search versus explicit FTS repair (#435), graph SQLite peer-checkpoint safety (#436), restart-safe retirement of applied consolidation inputs (#438), orphan-store truth derived from the registry-reconstruction diff (#439), per-manifest isolation of registry reconstruction conflicts (#440), Hermes memory/context routing (#441), post-update integration recovery (#443), and projectless Hermes host routing (#445), followed by releases through #446. Only draft plan PR #421 remained open at the latest refresh. Early store/analytics snapshots used installed TraceDecay 0.0.44; the final original planning probes used installed 0.0.47, and the reconciliation audit used installed 0.0.52 before later source releases merged, so every runtime observation remains version-labeled rather than being silently upgraded to newer source semantics. During research, the live store continued ingesting sessions, so counts are timestamped snapshot values rather than timeless constants. The direct `project_list` snapshots before and after the early rebase both reported 25 repositories; concurrent audits observed 28–29 searched/registered scopes, reinforcing the requirement that inventories carry a timestamp, tool/runtime identity, catalog generation, runtime version, and watermark rather than presenting a drifting count as timeless.
 
 | Signal | Observed evidence | Design consequence |
 |---|---:|---|
@@ -168,7 +168,7 @@ This is not merely operator error. V2 must make the right capability discoverabl
 
 ### 2.6 Current-master accepted changes
 
-The plan treats merged rows below as required base semantics at publication base `273f50c0`; rows explicitly marked open are incoming constraints that execution must reconcile before touching their seam. Only draft plan PR #421 remained open at the publication audit; the 2026-07-11 follow-up found open Hermes PR #441 plus a local, unpushed and uncommitted continuation in its owned worktree. Implementation must not rediscover or regress accepted behavior, and must not assume an open input or worktree draft has merged until the execution-slice refresh proves it:
+The plan treats merged rows below as required base semantics at publication base `e8883933`; rows explicitly marked open are incoming constraints that execution must reconcile before touching their seam. The 2026-07-11 refresh verified Hermes PRs #441/#443/#445 and releases #442/#444/#446 as merged; only draft plan PR #421 remained open. Implementation must not rediscover or regress accepted behavior, and must not assume a future open input or worktree draft has merged until the execution-slice refresh proves it:
 
 | PR/status | Behavior | V2 consequence |
 |---|---|---|
@@ -201,9 +201,12 @@ The plan treats merged rows below as required base semantics at publication base
 | `#438` merged — restart-safe applied-manifest retirement | Validates and transactionally retires only proven schema-2 `Applied` source/target manifest owners under an exclusive lifecycle capability while leaving original shard data untouched and the destination canonical; final head `4f7b2b2c`, merge `3bea5ec7`. | Import restart-safe retirement as accepted anti-corruption behavior: retries are idempotent, ambiguous ownership fails closed with doctor evidence, registry rows and manifests change atomically, and V2 preserves the exact applied-ledger/retirement receipt (FM-111). |
 | `#439` merged — derive orphan stores from registry reconstruction | Reuses the read-only registry-reconstruction preflight to count only manifests actually missing project/alias/store/scope/artifact rows, replacing incomplete token-accounting/path proxies; final head `de55e376`, merge `974d423b`. | Doctor, health, migration, and repair share one per-manifest typed diff and population. Complete registry rows never produce an orphan warning; a reported orphan links the exact missing rows and reconstruction plan (FM-114). |
 | `#440` merged — isolate registry diff conflicts | Independently preflights each eligible reconstruction plan so one conflicting manifest does not hide missing rows in unrelated manifests; final head `7a56db8e`, merge `0dd1fd7d`. | Preserve each conflict, continue classifying every unrelated manifest, and expose per-manifest reconstruction/detection receipts through the shared catalog/doctor truth (FM-114). |
-| `#441` open — Hermes memory/context routing, with local follow-up | Remote PR head `152bfacc` gates first-turn guidance, routes memory/LCM from the logical Hermes session workspace, generalizes handle dereference, and isolates cloned context-engine state. Local worktree `/fast/projects/tracedecay` had amended head `26626698` plus user-owned follow-up for named Hermes profiles and a transitional profile-level `user-memory.db`; one open review finding shows generalized handle dereference can drop the original project selector. A later local fix found branch creation copied/reflinked only the live main SQLite file while another connection could checkpoint WAL pages, so its branch lock did not fence database writers and the snapshot could be half-checkpointed or omit committed WAL data. | Treat the failures as fixtures, not the draft implementation as V2 authority: host profile/config target is distinct from TraceDecay data profile; every invocation carries immutable session/workspace scope; singleton/clone state has explicit per-session versus process-shared ownership; non-code greetings produce useful silence; compatibility-handle retrieval preserves the exact canonical scope/auth binding; projectless activity remains activity-owned while durable user facts use explicit `DeclaredScope::Profile`; active-project memory composes profile plus exact-project facts with provenance. If the V1 `user-memory.db` ships, PR 33 migration imports it once into activity knowledge tables and retires the separate runtime store. V2 never creates a branch database copy and never copies/reflinks a live main file: a writer-admission barrier spans `snapshot_fences` commit through acquisition/verification of the dedicated online-backup read snapshot, then live ingest resumes above it; publication requires the same embedded fence in the verified destination. `VACUUM INTO` is permitted only after drained exclusive maintenance at a stable fence (FM-138–FM-145). |
+| `#441` merged — Hermes memory/context routing | Merged as `a1de60b8`; gates first-turn guidance, routes memory/LCM from the logical Hermes session workspace, preserves selector-bound handle retrieval, isolates cloned context-engine state, consolidates every Hermes host profile onto the user TraceDecay profile, and ships profile-level `user-memory.db`/`user-sessions.db` compatibility stores. | Preserve the behavior as V1 parity evidence while replacing its adapter-local mechanisms: host profile/config target is distinct from TraceDecay data profile; every invocation carries immutable session/workspace scope; singleton/clone state has explicit per-session versus process-shared ownership; non-code greetings produce useful silence; compatibility-handle retrieval preserves canonical scope/auth; projectless activity remains activity-owned while durable user facts use explicit `DeclaredScope::Profile`; active-project memory composes profile plus exact-project facts with provenance. PR 33 imports the shipped compatibility stores once into activity knowledge and retires them after parity (FM-138–FM-143). |
+| `#443` merged — post-update integration recovery | Merged as `fcc92afd`; narrowly repairs generated prompt blocks whose exact owned preamble and END marker survive without START, refuses ambiguous ownership, distinguishes automatic reinstall warnings from explicit migration failure, and migrates only provably neutral legacy Hermes sessions to user scope while preserving unresolved memory. | Generate one ownership grammar for install/update/repair/uninstall; exact orphan recovery is allowed only with unique signed/generated evidence and all ambiguous states fail closed. Legacy projectless classification is evidence-based per session/source, never “path missing means user”; unscoped memory is retained unresolved rather than promoted. Automatic update may continue after a typed preserved-source warning, but integrity/copy/identity/partial failures keep the operation pending and explicit migration remains strict (FM-151–FM-152). |
+| `#445` merged — projectless Hermes host routing | Merged as `49bc0805`; derives host-profile ownership from explicit/configured/installed plugin identity, resets provider home per session, treats the Hermes home itself as projectless, keeps registered descendant repositories routable, dispatches user-scoped LCM/message/memory calls without project CWD, and separates direct registry/read-only selector/mutating route classes. | V2 generates route classes from the canonical use-case catalog: host-profile ownership and runtime workspace are separate typed inputs; a host home is never a project merely because it is CWD; explicit user/profile scope clears project locators; registry discovery is unscoped; cross-project selectors are read-only unless a use case explicitly authorizes mutation; project-required operations fail with a typed registered-project requirement. The daemon/application resolver, not generated Python or MCP adapters, owns the rule and neutral execution context (FM-139/FM-141/FM-142). |
+| `#442`/`#444`/`#446` merged — releases v0.0.54 through v0.0.56 | Latest release merge `e8883933` packages #441/#443/#445; the intermediate release merges preserve their rollout order. | Bind source/package/tag/catalog/schema digests and checks to separate release receipts; never infer that a locally installed runtime or running daemon upgraded merely because source/release PRs merged. |
 
-PR `#409` was closed without merge and superseded by release PRs `#413`/`#416`; PRs #418, #425–#440 listed as merged above are accepted history where applicable. Latest audited `origin/master` is `273f50c0372f063b97f4755563a3ded65ef324d5` at 0.0.53; draft plan PR #421 and Hermes PR #441 are open. The plan branch must be rebased to this or a newer accepted base before final verification. The implementation lead refreshes open PRs, merge bases, changed files, checks, and TraceDecay semantic context immediately before each program phase. If GitHub and TraceDecay disagree, record both snapshots and reconcile index/ref freshness before changing the plan.
+PR `#409` was closed without merge and superseded by release PRs `#413`/`#416`; every row explicitly marked merged above is accepted history where applicable. Latest audited `origin/master` is `e888393368ce8704e6fa123f0daecebd1af9ef8d` at 0.0.56; only draft plan PR #421 is open. The plan branch must be rebased to this or a newer accepted base before final verification. The implementation lead refreshes open PRs, merge bases, changed files, checks, and TraceDecay semantic context immediately before each program phase. If GitHub and TraceDecay disagree, record both snapshots and reconcile index/ref freshness before changing the plan.
 
 ### 2.7 Historical failure inventory
 

docs/plans/tracedecay-v2/00-plan-set-index.md

@@ -4,6 +4,8 @@
 
 **Canonical master plan:** [`../2026-07-09-tracedecay-brain-rewrite.md`](../2026-07-09-tracedecay-brain-rewrite.md). This tracked path is authoritative; there is intentionally no second `docs/architecture/tracedecay-v2-master-plan.md` copy that could drift.
 
+**Accepted-base refresh:** audited `origin/master` is `e888393368ce8704e6fa123f0daecebd1af9ef8d` at v0.0.56, including merged Hermes routing/recovery PRs #441/#443/#445 and releases through #446. The master §2.6, plans 12–14, and affected scope/configuration/transport/provider plans preserve those behaviors as fixtures rather than adapter-local V2 architecture.
+
 ## 1. Intended outcome
 
 TraceDecay V2 defragments and reconciles the product into one local-first “Brain” for human intent, agent/Turn/session activity, tools and visible reasoning summaries, code and diagnostics, Git/delivery, goals/workflows, memory/knowledge, hints/policy, automation/skills, usage/cost, health, privacy, and outcomes. It is not a dashboard skin over existing silos or a set of new crates that preserve duplicate semantics. The plan replaces the internal model, storage/query/policy/privacy architecture, public contracts, and product interface behind bounded parity/cutover/deletion gates.