fix-surprise-startup-archival — WorksGood live mirror

Metadata

Status	done
Agent identity	`fbb2d89fe44d6b761bcb4b67748ab3d417f29df70a65f8d9403308f5bb2bab78`
Created	2026-08-01T07:14:11.405826078+00:00
Started	2026-08-01T07:14:27.971931743+00:00
Completed	2026-08-03T09:42:51.782626346+00:00
Tokens	29876801 in / 45514 out

Description

Fix the destructive visibility regression observed in /home/bot/jobs on 2026-08-01. Restarting a 38-day-old legacy daemon on the current binary caused the first maintenance pass to apply the configured/default dispatcher.archive_retention_days=7 retroactively and auto-archive 57 historical terminal tasks immediately. The attended TUI went from showing the completed body of work to only chats/open recurring tasks, making it appear that all history was cleared. Recovery required stopping the service, backing up graph/archive/batch/config, setting retention=0, and wg archive --undo; all 57 records were restored exactly. Evidence backup: /home/bot/jobs/.wg/recovery/auto-archive-20260801T071318Z.

Required product behavior: daemon start/restart/upgrade must never silently apply a large overdue archival backlog. Automatic archival should be opt-in and/or require a persisted acknowledgment/watermark before first destructive application. A legacy/unverified daemon migration, long downtime, build change, absent prior archival receipt, or backlog above a small bound must fail closed into a visible archival pending operator confirmation state. Routine already-acknowledged incremental archival may continue when explicitly enabled. Preserve exact tasks and archive boundaries; no task status mutation, WIP loss, or graph-edge loss. TUI/service status must explain the hold and provide a dry-run/confirm command. Default attended-project behavior should preserve visible history.

Validation

Candidate-binary smoke: month-old graph + 7d retention + legacy daemon state + current daemon restart => zero tasks archived before explicit confirmation.
Dry-run reports exact IDs/count; confirmation archives that exact batch once; undo restores exact bytes/status/log/dependencies.
retention=0 disables automatic archival.
restart after an acknowledged watermark archives only newly eligible incremental tasks, without reprocessing backlog.
TUI/status makes pending archival visible and actionable.
cargo fmt --check, focused archive/service restart tests, cargo check, cargo clippy.

Fix the destructive visibility regression observed in `/home/bot/jobs` on 2026-08-01. Restarting a 38-day-old legacy daemon on the current binary caused the first maintenance pass to apply the configured/default `dispatcher.archive_retention_days=7` retroactively and auto-archive 57 historical terminal tasks immediately. The attended TUI went from showing the completed body of work to only chats/open recurring tasks, making it appear that all history was cleared. Recovery required stopping the service, backing up graph/archive/batch/config, setting retention=0, and `wg archive --undo`; all 57 records were restored exactly. Evidence backup: `/home/bot/jobs/.wg/recovery/auto-archive-20260801T071318Z`.

Required product behavior: daemon start/restart/upgrade must never silently apply a large overdue archival backlog. Automatic archival should be opt-in and/or require a persisted acknowledgment/watermark before first destructive application. A legacy/unverified daemon migration, long downtime, build change, absent prior archival receipt, or backlog above a small bound must fail closed into a visible `archival pending operator confirmation` state. Routine already-acknowledged incremental archival may continue when explicitly enabled. Preserve exact tasks and archive boundaries; no task status mutation, WIP loss, or graph-edge loss. TUI/service status must explain the hold and provide a dry-run/confirm command. Default attended-project behavior should preserve visible history.

## Validation
- Candidate-binary smoke: month-old graph + 7d retention + legacy daemon state + current daemon restart => zero tasks archived before explicit confirmation.
- Dry-run reports exact IDs/count; confirmation archives that exact batch once; undo restores exact bytes/status/log/dependencies.
- retention=0 disables automatic archival.
- restart after an acknowledged watermark archives only newly eligible incremental tasks, without reprocessing backlog.
- TUI/status makes pending archival visible and actionable.
- cargo fmt --check, focused archive/service restart tests, cargo check, cargo clippy.

Depends on

done .assign-fix-surprise-startup-archival

Required by

(none)

Log

2026-08-01T07:14:11.365881789+00:00 Task paused
2026-08-01T07:14:13.801119128+00:00 Task published
2026-08-01T07:14:23.024758986+00:00 Lightweight assignment: agent=Pi Lifecycle Hotfix Programmer (fbb2d89f), exec_mode=full, context_scope=graph, reason=Lifecycle hotfix programmer is the closest fit for preventing destructive restart-time archival while preserving exact recovery and validating service/TUI integration.
2026-08-01T07:14:29.102177572+00:00 Spawned by coordinator --executor pi --model openai-codex:gpt-5.6-sol --isolation required-worktree
2026-08-01T07:14:40.958757057+00:00 Starting implementation: inspecting prior WIP, archive maintenance paths, and validation requirements
2026-08-01T08:26:06.655409242+00:00 Implemented guarded automatic archival receipts/watermarks, exact pending plans + confirm CLI, default retention=0, service/TUI hold visibility, and candidate daemon/TUI smoke. Focused archive/config/service tests and owned smoke pass; cargo check/fmt/clippy pass. Full cargo test attempted: unrelated pre-existing route/lifecycle/profile test failures remain, while task-focused suites pass.
2026-08-01T08:35:24.274289592+00:00 Committed: 5ca52c29 — pushed to remote. Validation: 47 archive tests pass; 131 config-focused tests pass; 62 service tests pass; candidate daemon+real tmux TUI smoke passes; fmt/check/clippy pass; cargo install --path . --locked completed. Full suite attempted twice and exposed unrelated pre-existing route/lifecycle/profile tests (focused reruns pass where applicable).
2026-08-01T08:36:09.946196579+00:00 Bounded evaluator infrastructure state error[WG-EVAL-INSUFFICIENT-EVIDENCE]: bounded evidence insufficient [candidate-manifest:candidate-manifest:truncated,candidate-source:candidate-source:truncated,declared-artifact:declared-artifact-000:truncated,declared-artifact:declared-artifact-001:truncated,declared-artifact:declared-artifact-002:truncated,declared-artifact:declared-artifact-003:truncated,declared-artifact:declared-artifact-004:truncated,declared-artifact:declared-artifact-005:truncated,declared-artifact:declared-artifact-006:truncated,declared-artifact:declared-artifact-007:truncated,declared-artifact:declared-artifact-008:truncated,declared-artifact:declared-artifact-009:truncated] without semantic rejection or cross-executor fallback; source remains in-progress
2026-08-01T08:36:56.237586571+00:00 Deep FLIP infrastructure failed closed without source/config/repository mutation: error[WG-DEEP-REPORT-SCHEMA]: strict deep report rejected: expected `,` or `]` at line 1 column 1128
2026-08-01T08:37:00.963141964+00:00 Bounded evaluator infrastructure state error[WG-EVAL-EVIDENCE-UNAVAILABLE]: automatic immutable evidence assembly failed without semantic rejection or cross-executor fallback; source remains in-progress
2026-08-01T08:37:33.501556824+00:00 Bounded evaluator infrastructure state error[WG-EVAL-EVIDENCE-UNAVAILABLE]: automatic immutable evidence assembly failed without semantic rejection or cross-executor fallback; source remains in-progress
2026-08-01T08:44:22.558800709+00:00 Smoke-gate follow-up committed: 174be2f9 — fallback now reuses the project-required installed candidate instead of timing out on a redundant full build; scenario passes without WG_SMOKE_CANDIDATE_BIN.