feat(traces): isolate legacy code references

MTR-40 filters legacy trace references and unauthorized wants and haves while preserving explicit repair and ordinary Git compatibility. Full-pack object closure remains assigned to MTR-13.

Final local C: 21 targets, 3154 passed, 0 failed, 3 pre-existing ignored; nightly fmt, strict all-target/all-feature Clippy, cargo build and cargo build --tests passed. The first resource postcheck failed; 27 test-owned disconnected databases were manually removed, with baseline databases preserved.

Local final Claude review: cdbb38ee-0ddb-43d2-a34d-b9b422c1276e; output SHA256 793ac5fbc698169f7f1cddcf29156bb074964e53e9bc1dec235fee1ded9ca8f8. The tag Docker and main workflow results remain pending.

Signed-off-by: ELi Ma <eli@patch.sh>

Author: genedna

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "mega2"
-version = "0.42.76"
+version = "0.42.77"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 description = "Monorepo engine and Git hosting server for AI agents: trunk-based storage, Git Smart HTTP, Git LFS, OCI registry, and Agent Session Capture"

Cargo.toml

@@ -12,6 +12,7 @@ Repository behavior depends on the path you use:
 
 - **Monorepo paths** (the root path and paths outside `import_dir`) expose only the public branch `main`. Git-client tag writes and pushes to other branches are rejected. Create, list, and delete tags through the HTTP API (§4.2) or Libra's `libra mega2 browser` command (§6).
 - **ImportRepo paths** under `[monorepo].import_dir` (default `/third-party`) follow ordinary Git semantics: they allow multiple branches and Git-client tag operations, accept later pushes, and can be removed (§2.6). Use them when migrating or hosting third-party repositories.
+- An old ImportRepo's `refs/libra/traces` is hidden from ordinary code refs and is never selected as the code `HEAD`; a repository with only that legacy ref has an unborn code `HEAD`. If a code ref descends from a legacy traces commit, ordinary reads isolate that ref while clean refs remain discoverable; an explicit request for its commit returns 409 `trace_history_in_code`. A maintainer with code push rights can explicitly delete or reset the polluted ref through receive-pack. Only callers that pass the push permission check see that ref in receive discovery; standard Git clients cannot discover the hidden legacy traces ref's old value for updates. At this stage, an ordinary clone's PACK **still contains all objects in that repository, including traces-only and contaminated objects**. The want/have guards do not provide confidentiality; full isolation requires MTR-13 in the [traces protocol](./refactoring/traces.md#6-普通代码-clone-与旧-git-traces). The legacy view returns 413 `response_budget` when its published code-ref/tag, commit, or authorized-object limits are exceeded, and 503 `query_timeout` when the read budget expires or a database read fails. For ImportRepos without a legacy traces ref, ordinary code advertisement uses a limited ref read in place of the previous read, while fetch authorisation adds a ref read. At 4098 refs or more, a named lookup and a full ref read may also be needed. Those read views have a 10-second budget and return 503 `query_timeout` on timeout or database read failure. A database read failure in receive advertisement also returns 503. A missing ancestor or non-commit branch tip rejects the repository with 409 `object_integrity`; repair the data before retrying.
 - The shipped storage-only service has no Web UI or Change List (CL). Its OpenAPI document omits CL, issue, reviewer, and user routes.
 - On Monorepo paths, Git pushes and product API writes share the same write queue and path-tip authority; edit/save inside a live ImportRepo writes that repository directly, see §4.1. The [architecture guide](./architecture.md) describes the write path.
 

docs/plan/README.md

@@ -12,6 +12,7 @@ mega2 是面向 Agent 的第二代 Mega 引擎，主要提供 Monorepo 引擎与
 
 - **Monorepo 路径**（根路径及 `import_dir` 之外的路径）只公开 `main` 分支。Git 客户端推送其它分支或 Tag 都会被拒绝。请通过 HTTP API（见第 4.2 节）或 Libra 命令 `libra mega2 browser`（见第 6 节）创建、查看和删除 Tag。
 - **ImportRepo 路径**位于 `[monorepo].import_dir`（默认 `/third-party`）下，遵循常规 Git 语义，允许多个分支和 Git 客户端 Tag 操作，可以持续推送更新，也可以清理（见第 2.6 节）。迁移或托管第三方仓库时可使用这类路径。
+- 旧 ImportRepo 中的 `refs/libra/traces` 不在普通代码引用列表中，也不作为代码 `HEAD`；只有该旧引用的仓库呈现 unborn 代码 `HEAD`。若某个代码引用的祖先混入旧 traces 提交，普通读取隔离该引用，其余干净引用仍可发现；显式请求受污染提交返回 409 `trace_history_in_code`。有代码推送权限的维护者可通过 receive-pack 显式删除或重置污染引用；receive 广告只向通过推送权限检查者显示该引用，标准 Git 客户端无法从广告取得隐藏旧 traces ref 的更新旧值。现阶段普通 clone 的 PACK **实际仍包含同仓的 traces 专属及受污染对象**，want/have 守卫不提供内容保密性；完整隔离必须等 [traces 协议](./refactoring/traces.md#6-普通代码-clone-与旧-git-traces)中的 MTR-13 完成。 旧视图的代码引用或 Tag、提交与授权对象超过已公布预算时返回 413 `response_budget`；读预算超时或数据库读取失败返回 503 `query_timeout`。没有旧 traces 引用的 ImportRepo 在普通代码广告中使用限量引用读取替代原读取，fetch 校验会新增一次引用读取；引用达到 4098 个时可能再按名探测并回退为完整读取。相关读取视图限时 10 秒；读超时或数据库读取失败返回 503 `query_timeout`，receive 广告的数据库读取失败也返回 503。缺失祖先或非提交分支顶点按 409 `object_integrity` 整仓拒绝，修复数据后重试。
 - 随仓库提供的 storage-only 服务不提供 Web UI，也不包含 Change List（CL）。其 OpenAPI 文档不包含 CL、issue、reviewer 和 user 路由。
 - Monorepo 路径上的 Git push 与产品 API 写入共用写入队列和路径 tip 权威；存活 ImportRepo 内部的编辑保存直接写该仓库，见第 4.1 节。写入流程见[架构设计](./architecture.zh.md)。