feat(session): add strict managed GC retirement receipt codec

[snowykr]

Summary

Complete pure strict GC retirement receipt codec, independently callable without owner access, stores, native effects or automatic GC/task/session production. Four state DTOs: prepared, artifacts_removed, owner_pending, owner_retired; exact original owner/context identities and shrinking continuation shapes.

A decoded DTO is data, never native physical completion, fresh payload scrub, writer closure or deletion permission. Contiguous numbered history, ordering, original prepared binding and actual effect authority belong to the later complete journal reader/publisher, not this single-record parser. Attempt 2 alone may be valid data; it does not prove a complete history.

Exact independent review range

Base dev, captured 73475e180dfa4e72580288148baa8cb769a6dca3.
Head e480e8f0f59f2d243bc0fb30f1aa833d954755de.
Production owned AND actual dev diff: 319 added+deleted; tests add 394 lines. This genuinely independent root does not include unmerged access337 or hide a cumulative parent diff. Runtime imports only the already-merged pure owner codec; storage types are type-only.

Exact clean-source verification

bun test packages/coding-agent/test/managed-gc-retirement-codec.test.ts packages/coding-agent/test/task-artifact-owner-codec.test.ts packages/coding-agent/test/task-artifact-owner-retirement.test.ts packages/coding-agent/test/session-storage.test.ts — exit 0: 136 passed, 8 existing platform skips, 577 assertions, four files.
bun --cwd=packages/coding-agent run check — exit 0 at exactly e480e8f0f59f2d243bc0fb30f1aa833d954755de, vendor/Biome and tsc -p tsconfig.json --noEmit included.
Independent exact detached clean tracked QA; actual addon matches committed strict 0.18.5 metadata and unchanged native source; no metadata rewrite. Source clean before/after. 09-gc-codec-independent-base73475e18-qualification.json records head and command exit codes; full output retained.

Historical 1a6d58aa878bb8ad47d4a0b47e3a6f036acdc9b3 on base03c code-event 37154515048 completed SUCCESS; it remains historical and does not approve this current734-based head. Prior head 7e48d3d91acfc6fd000dca8f59fcb856bdd00c60 code-event 37148094157 completed SUCCESS. This is an owned-only rebase to audited advancing dev, no codec change. New exact clean focused/package gates passed; old CI or review is not transferred, current-head CI/review required.

Limits

Pure DTO tests are not physical retirement or replay/crash behavior proof. Darwin API/package execution only; existing platform skips and warnings/info uncredited. Automatic consumers/producers intentionally unchanged until the complete effects stack. No user-facing changelog for inert internal DTO APIs. Current code-event CI and exact write-access maintainer review remain required; no leader merge, transferred approval or whole-goal completion claim. Protected44 and consolidated #6240/reference retained unchanged.

[probepark]

Review (head 7e48d3d, gajae-reviewer on behalf of probepark) — approve held

CI: green. All planned checks passed (affected tests for managed-gc-retirement-codec, notifications-live-stream, session-manager-resident-cache; ts-build for coding-agent; native-build; gjc-state-gates; Virtual integration validation). The rest were skipped as not applicable.
Scope: +713 / -0, 2 files. packages/coding-agent/src/session/internal/managed-gc-retirement-codec.ts (319, new) and its test (394, new).
Conventions: no CHANGELOG entry. The body explains why: these are internal, inert DTO APIs, so that is acceptable. No generated files, no labels, no console.*, no new Worker.
Code review (3단계): no blocking candidates.

• managed-gc-retirement-codec.ts:L175-213: the expected key set for each state is exact, and payload_retired adds its two flags only conditionally. L245-252 cross-checks those flags against outcome.kind in both directions. Covered by the "contradictory payload-retired owner flags" and "structurally consistent payload-retired" tests.
• managed-gc-retirement-codec.ts:L71-100: the identity decode is strict. It requires exactly 6 keys, canonical decimal strings, a signed mtimeNs that rejects -0, nlink equal to "1", and lowercase sha256. Covered by the six-field identity test.
• Note (non-blocking): continuationExtendsPrevious (L277) is exported and unit-tested directly, but nothing in this PR calls it. The body says the future journal reader will consume it. Keep that in mind so it doesn't stay a dead export.

Approve held: the CI plan did not run cd packages/coding-agent && bun run check (biome + check:types) on 7e48d3d. ts-build:ts:coding-agent only runs bun run build.ts, which bundles and does not run tsc --noEmit. The PR body reports bun --cwd=packages/coding-agent run check exit 0 at this exact head, but the reviewer's gate needs that check observed in CI, or confirmed in a reply after this review that gives the command and exit code at this head. Run it at this head (or add it to the plan) and re-request review.

[probepark]

Review held: the approval gate reported a missing required CI surface at this exact head.

CI: gate pending — gaja-approve-gate.py returned NEED_LOCAL because check:@gajae-code/coding-agent was not in the head CI plan; Biome and check:types were not observed for this head.

Required action: run cd packages/coding-agent && bun run check at 1a6d58aa878bb8ad47d4a0b47e3a6f036acdc9b3 (or add the check to the plan), then re-request review.

No approval or body verdict update was made.

[snowykr]

Current independent pure GC codec head 1a6d58aa878bb8ad47d4a0b47e3a6f036acdc9b3: production 319, test 394; complete inert receipt codec, no owner production/deletion effects activated. Exact code-event Dev CI 37154515048 is success, and exact-clean local 09-gc-codec-independent-base03c88 focused/package verification passed with genuine byte-bound native dependency. Metadata skipped run 37154646159 is not code proof. The standalone codec owns structural parsing and trusted-context binding; journal readers still own prepared-first history, contiguous attempts and live physical retirement proof. DTO-completed data is not native authority. Requesting current exact-head write-access maintainer review; no older approval transfers and no leader merge.

[probepark]

Re: #6293 (comment)

Approval remains held at 1a6d58a. The approve gate still reports NEED_LOCAL: check:@gajae-code/coding-agent is not in this head's CI plan, so Biome and check:types have never run on this head. Dev CI run 37154515048 being green does not cover them.

The comment says "focused/package verification passed", but it does not name the command or give an exit code. To clear the hold, do one of the following:

1. Run cd packages/coding-agent && bun run check at 1a6d58aa878bb8ad47d4a0b47e3a6f036acdc9b3. Post the exact command, the head SHA, and the exit code (it must be 0), plus the tail of the output.
2. Or push a head whose CI plan includes check:@gajae-code/coding-agent and passes.

When that is posted, a new exact-head verdict follows.

[Yeachan-Heo]

cd packages/coding-agent && bun run check passed (exit 0) on the exact head e480e8f. It ran Biome (no fixes applied; 2 warnings and 1 info, none of them errors) and tsc -p tsconfig.json --noEmit (no errors). This is the check:@gajae-code/coding-agent step that the CI plan skipped and that the approval gate held on as NEED_LOCAL.

@probepark could you re-review this head?

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[probepark]

Review (head e480e8f, gajae-reviewer on behalf of probepark)

CI: green. All planned checks passed at this head: Affected path validation (plan, native-build, evidence producer, ts-build coding-agent, tests for managed-gc-retirement-codec, notifications-live-stream, session-manager-resident-cache), gjc-state-gates, Virtual integration validation, and Local public surfaces. Nothing is pending or failed. The rest were skipped as not applicable.
Scope: +713 / -0, 2 files. packages/coding-agent/src/session/internal/managed-gc-retirement-codec.ts (319, new) and packages/coding-agent/test/managed-gc-retirement-codec.test.ts (394, new).
Conventions: no CHANGELOG entry. These are internal, inert DTO APIs, as the body explains, so that is acceptable. No generated files, no labels, no console.*, no new Worker.
Delta vs prior reviews: git diff 7e48d3d e480e8f and git diff 1a6d58a e480e8f, limited to the two PR files, are both empty. This head is an owned-only rebase onto dev 73475e1, and the codec and test bytes are unchanged. The code review from 7e48d3d therefore still applies:

• managed-gc-retirement-codec.ts:L175-213 / L245-252: each state has an exact key set. payload_retired flags are cross-checked against outcome.kind in both directions, and tests cover both the contradictory and the consistent case.
• managed-gc-retirement-codec.ts:L71-100: identity decode is strict. It requires 6 keys, canonical decimals, signed mtimeNs rejecting -0, nlink equal to "1", and lowercase sha256.
• Note (non-blocking, carried over): continuationExtendsPrevious (L271) is exported and tested, but nothing in this PR calls it yet.

Prior hold resolved: the only open item was NEED_LOCAL cd packages/coding-agent && bun run check (Biome + check:types), which is missing from the head CI plan. need-local satisfied by #6293 (comment). That comment is from the repo owner, posted at 05:56Z, after the head commit at 05:12Z. It reports exit 0 on exact head e480e8f: Biome found no errors, and tsc -p tsconfig.json --noEmit found no errors.
Blocking: none.

Body verdict line count=0, not updated. Suggested verdict line: gajae.pr-review-verdict.v1 merge-approved sha256:952f3fbb7f83346ba84a007440a7aef17a6c714e0ac043f6410dbfcfcf088e1c reviewer:human reviewer-id:probepark evidence:ci-green;codec-bytes-unchanged-since-7e48d3d;need-local-check-exit0-by-owner-at-head

Verdict: gajae.pr-review-verdict.v1 merge-approved sha256:952f3fbb7f83346ba84a007440a7aef17a6c714e0ac043f6410dbfcfcf088e1c reviewer:human reviewer-id:probepark evidence:ci-green;codec-bytes-unchanged-since-7e48d3d;need-local-check-exit0-by-owner-at-head