fix(antigravity-cli): only infer generation timestamps against a decoded session anchor

[junhoyeo]

The problem

read_trajectory_meta collapsed two different things into one i64. It decoded the session created-at from trajectory_metadata_blob.#2, and when that blob was missing or would not decode it substituted the database file's mtime — then returned a single number that served both as the per-row timestamp fallback and as the trust anchor bounding the inferred agy 1.1.18 chatModel.#9.#10 reading.

#9.#10's 8-byte layout is inferred from a field dump rather than read off a real database, so every candidate reading is deliberately pinned to the containing session's lifetime before it is accepted, and session_window_ms declines to build a window when the anchor is not positive. That guard was not doing what its doc comment claimed. A file mtime is always positive, so the <= 0 check almost never fired, and inference ran against a window anchored on the last write to the file rather than on when the conversation began. It cuts both ways: an opaque payload that happens to decode near the mtime clears the window and silently re-dates a turn, while a legitimate older generation is rejected for sitting below a recent mtime. Mis-dated turns corrupt day buckets and the server-side monotonic ratchet, which has no correction path.

The change

read_trajectory_meta now returns a TrajectoryMeta that keeps the decoded created-at (Option<i64>) separate from the effective row fallback (i64, still the mtime when nothing decoded). The Option is threaded through parse_gen_metadata into generation_timestamp_ms and inferred_epoch_ms, so inference runs only when a genuine decoded created-at is present and positive. With no real anchor the #9.#10 path is skipped entirely and the row keeps exactly the fallback dating it had before the 1.1.18 layout was handled at all.

The confirmed #9.#4 Timestamp path is untouched — it returns before any of this logic and needs no anchor, and its existing "not bounded by the session window" regression test still passes unchanged.

Tests

The existing missing-anchor test only exercised anchors of 0 and -1, neither of which a real database produces, which is precisely why this went unnoticed. It now holds the row fallback positive and varies the anchor over None, Some(0), and Some(-1), so the case that actually occurs — no decoded created-at, positive mtime fallback — is covered.

New: an_mtime_only_session_anchors_no_inference drives the real SQLite path with a positive file mtime and no decodable created-at, in both shapes that produce one (the trajectory_metadata_blob table absent outright, and the table present with a blob carrying a workspace but no #2). The #9.#10 payload is a value half an hour before the file was written, and the test asserts up front that an mtime-anchored window would have accepted it, so it cannot silently stop testing anything. agy_1_1_18_rows_are_dated_per_turn_not_at_session_start remains as the positive half of the contract: with a genuine decoded created-at, per-turn inference still works end to end.

Falsified by temporarily restoring the collapsed single-timestamp behaviour: the new test failed with assertion left != right failed: an mtime is not a session start and must not anchor inference (both sides 1787684689447, i.e. the row was re-dated to the opaque payload), while all 34 other tests in the module still passed. Restoring the fix returned the suite to green.

Verification

cargo test -p tokscale-core antigravity — exit 0, 50 passed / 0 failed. cargo test -p tokscale-core — exit 0, 1899 passed / 0 failed. cargo clippy -p tokscale-core --all-targets -- -D warnings — exit 0. cargo fmt --all -- --check — exit 0.

No agy 1.1.18 database was available, so #9.#10 remains an inferred layout; this PR narrows when that inference is trusted rather than confirming the encoding.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
tokscale	Ignored		Aug 25, 2026 7:37pm