fix(submit): keep snapshot-integrity clients complete on filtered scans

Merged
JA
15d ago
+373-39

Summary

  • A date-bounded submit (--week, --since, --until, --year) filtered every client's messages to the window and sent fullHistory: false, so the receiver froze every SUPPORTED_VERSIONED_PARSERS client and both atomic source families. In practice a weekly submit could never advance droid, copilot, amp, the micode pair, or the antigravity trio — their usage was silently discarded run after run (Ignored Droid changes because this parser generation or partial snapshot cannot safely advance the device high-water, Preserved MiMo Code and Xiaomi MiMo AI together, Preserved Antigravity sources together).
  • The scan already parses those sources' complete history; the date filter only dropped their messages afterwards. This change keeps shipping them complete while bounded-growth clients stay filtered.
  • ReportOptions gains a submission-only date_filter_exempt_clients set backed by FULL_HISTORY_SUBMIT_CLIENTS (amp, antigravity, antigravity-cli, antigravity-extension, copilot, droid, micode, micode-desktop — the server's snapshot-integrity set). GraphSink bypasses the date filter for messages from those clients; local reports default the set to empty, so report/wrapped/TUI output is unchanged.
  • On a bounded submit, scanScope.fullHistoryClients now names exactly the exempted clients that were scanned, while fullHistory itself stays false to keep failing closed for receivers predating per-client coverage. retentionFloors populate for those clients as before. Amp keeps its cache-completeness gate: it is only declared when the local thread export is complete.

Verified end-to-end

tokscale submit --week on the same device, before this change: Ignored Copilot/Droid/Amp changes because this parser generation or partial snapshot cannot safely advance the device high-water, plus the MiMo and Antigravity family preserves. After: Rewrote Droid daily layout from the full parser snapshot without changing the lifetime high-water, Reconciled MiMo Code and Xiaomi MiMo AI together from the complete parser snapshot, Reconciled Antigravity desktop, CLI, and IDE extension usage together from one family snapshot, and the Copilot freeze is gone entirely. Amp remains frozen on this device only because the device has no Amp data to ship — it is not declared when unsafe.

Test plan

  • cargo test -p tokscale-core — 2691 tests pass, including new submission_sink_keeps_exempt_clients_outside_the_date_window (exempt client keeps out-of-window days; non-exempt client is filtered).
  • cargo test -p tokscale-cli — 1665 tests pass, including new submit_scan_scope_names_snapshot_clients_complete_on_a_partial_scan and submit_scan_scope_partial_scan_still_gates_amp_on_cache_completeness; submit_payload_populates_retention_floors_for_full_history_clients updated for the new floors contract on bounded submits.
  • Real tokscale submit --week — the server advanced Droid and reconciled the MiMo/Antigravity families instead of freezing them.

Note for reviewers

One visible side effect: because exempt clients widen the payload's reported date range, bounded-growth clients now get per-day "disappeared → preserved" notices on exempt-covered days that fall outside the filter window. Nothing is lost — the server keeps credited values — but the disappeared check could arguably be scoped to clients declared in fullHistoryClients in a follow-up.

Summary by cubic

Fixes date-bounded submits (--week, --since, --until, --year) silently discarding usage from snapshot-integrity clients. Previously those submits scoped every client to the window and sent fullHistory: false, so the receiver froze droid, copilot, amp, devin-cli, the micode pair, and the antigravity trio; now those clients ship their complete snapshots while bounded-growth clients stay filtered.

  • Adds a submission-only full_history_clients set threaded from the CLI into generate_submission_graph_v2; the CLI passes the exact list it serializes as scanScope.fullHistoryClients, so the payload's declaration and shipped data cannot diverge. Local reports pass None and output is unchanged.
  • On a bounded submit, fullHistoryClients names exactly the exempted clients that were scanned (fullHistory stays false), so their retention floors populate; Amp still requires a complete thread export, and a partially read client is withheld via withhold_full_history_for_clients so the receiver keeps stored rows.
  • An atomic-family member is exempted only when every member of the family was selected — solo micode or antigravity-surface submits stay filtered. A bounded submit that declares devin-cli ships its recount proof.

Known side effect: bounded-growth clients may show per-day "disappeared → preserved" notices on exempt-covered days outside the filter window — nothing is lost, but the check could later be scoped to clients declared in fullHistoryClients.