fix(provenance): stop two expected states from reporting as faults

Cursor Bugbot caught `backfill-checkpoint-*`: the guard covered four conditions
under one reason classified as an originating fault, and one of them — a state
persisted before the checkpoint contract existed — is what essentially every
legacy row looks like. A backfill over historical rows would have put one error
line per row into the stream the error/warn split exists to protect.

Auditing the rest of the error-level reasons for the same shape found a second:
a client tool invoked without a run id has no binding to unseal against, so it
took the `[null, null]` path and reported `client-tool-seal-failed` at error on an
ordinary configuration.

Split both along the line that matters — absent versus unusable, not attempted
versus failed — and classify each half: expected states warn, genuine faults keep
error. `backfill-scope-mismatch` is retired; it named one of its four conditions.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Vikhyath Mondreti

apps/sim/executor/utils/resolved-secret-trace-registry.test.ts

@@ -1453,7 +1453,7 @@ describe('incompleteness diagnostics', () => {
     'knowledge-row-content-mismatch',
     'mothership-response-unreadable',
     'structural-input-root-unprojected',
-    'backfill-scope-mismatch',
+    'backfill-checkpoint-unusable',
   ] as const)('reports %s at error, since it cannot trip on a healthy run', (reason) => {
     new ResolvedSecretTraceRegistry([], scope).markIncomplete(reason)
 
@@ -1478,6 +1478,8 @@ describe('incompleteness diagnostics', () => {
     'mounted-file-provenance-unavailable',
     'table-snapshot-unsafe-for-mount',
     'restored-provenance-untrusted',
+    'backfill-checkpoint-absent',
+    'client-tool-seal-absent',
   ] as const)('reports %s at warn, since it is reachable without a fault', (reason) => {
     new ResolvedSecretTraceRegistry([], scope).markIncomplete(reason)
 
@@ -1488,6 +1490,27 @@ describe('incompleteness diagnostics', () => {
     expect(mockLogger.error).not.toHaveBeenCalled()
   })
 
+  /**
+   * The taxonomy's rule is that an error reason cannot trip on a healthy run. A backfill walking
+   * historical rows hits the no-checkpoint case on essentially every legacy row, so classifying it
+   * as a fault would put one error line per row into the stream this split exists to protect.
+   */
+  it('separates an absent checkpoint from an unusable one, so a backfill cannot flood errors', () => {
+    new ResolvedSecretTraceRegistry([], scope).markIncomplete('backfill-checkpoint-absent')
+    expect(mockLogger.error).not.toHaveBeenCalled()
+    expect(mockLogger.warn).toHaveBeenCalledWith(
+      'Resolved secret registry marked incomplete',
+      expect.objectContaining({ reason: 'backfill-checkpoint-absent' })
+    )
+
+    vi.clearAllMocks()
+    new ResolvedSecretTraceRegistry([], scope).markIncomplete('backfill-checkpoint-unusable')
+    expect(mockLogger.error).toHaveBeenCalledWith(
+      'Resolved secret registry marked incomplete',
+      expect.objectContaining({ reason: 'backfill-checkpoint-unusable' })
+    )
+  })
+
   it('does not report a log-less session at all, since it fires on every such run', () => {
     new ResolvedSecretTraceRegistry([], scope).markIncomplete('log-creation-skipped')
 

apps/sim/executor/utils/resolved-secret-trace-registry.ts

@@ -48,6 +48,7 @@ export type ResolvedSecretIncompletenessReason =
   | 'mothership-provenance-invalid'
   | 'mothership-response-unreadable'
   | 'mothership-provenance-missing'
+  | 'client-tool-seal-absent'
   | 'client-tool-seal-failed'
   | 'client-tool-completion-missing'
   | 'client-tool-completion-deferred'
@@ -63,7 +64,8 @@ export type ResolvedSecretIncompletenessReason =
   | 'mounted-file-provenance-unavailable'
   | 'table-snapshot-unsafe-for-mount'
   | 'restored-provenance-untrusted'
-  | 'backfill-scope-mismatch'
+  | 'backfill-checkpoint-absent'
+  | 'backfill-checkpoint-unusable'
   | 'log-creation-skipped'
   /**
    * Only for a caller that has not been given a reason yet. A refusal reporting this names no
@@ -105,7 +107,7 @@ const ORIGINATING_FAULT_REASONS = new Set<ResolvedSecretIncompletenessReason>([
   'knowledge-row-content-mismatch',
   'mothership-response-unreadable',
   'structural-input-root-unprojected',
-  'backfill-scope-mismatch',
+  'backfill-checkpoint-unusable',
 ])
 
 /**

apps/sim/lib/copilot/request/tools/client.ts

@@ -91,16 +91,24 @@ export async function waitForClientToolCompletion({
   const finishPendingActivation = toolRegistry?.beginPendingActivation()
   let content: Awaited<ReturnType<typeof unsealClientToolCompletion>> = null
   try {
+    /**
+     * A tool invoked without a run id has no binding to unseal against, which is a configuration
+     * rather than a fault. Tracking whether unsealing was even attempted keeps that ordinary case
+     * out of the error stream while a genuine unseal failure stays in it.
+     */
+    const sealingAttempted = Boolean(binding && registry && toolRegistry && registryCanImport)
     const [sealedContent, sealedContext] =
-      binding && registry && toolRegistry && registryCanImport
+      sealingAttempted && binding && registry
         ? await Promise.all([
             unsealClientToolCompletion(completion.data, binding),
             unsealClientToolContext(completion.data, binding, registry),
           ])
         : [null, null]
     if (toolRegistry && registryCanImport) {
       if (!sealedContent || !sealedContext) {
-        toolRegistry.markIncomplete('client-tool-seal-failed')
+        toolRegistry.markIncomplete(
+          sealingAttempted ? 'client-tool-seal-failed' : 'client-tool-seal-absent'
+        )
       } else {
         const imported = await toolRegistry.importProvenance(sealedContext.provenance, {
           origin: 'copilotToolClient.sealedContext',

apps/sim/lib/table/backfill-runner.ts

@@ -72,14 +72,24 @@ export async function createBackfillExecutionSecretRegistry(options: {
     ? options.executionData.executionState
     : undefined
   const provenance = state?.resolvedSecretTraceProvenance
+  /**
+   * A state persisted before the checkpoint contract carries no version at all. That is the bulk of
+   * any backfill over historical rows, so it is separated from a checkpoint that exists but cannot
+   * be used — only the latter is worth an error, and conflating them would put one line per legacy
+   * row into the error stream.
+   */
+  const checkpointPresent =
+    state?.resolvedSecretTraceCheckpointVersion === RESOLVED_SECRET_TRACE_CHECKPOINT_VERSION
   const valid =
-    state?.resolvedSecretTraceCheckpointVersion === RESOLVED_SECRET_TRACE_CHECKPOINT_VERSION &&
+    checkpointPresent &&
     state?.sourceExecutionId === options.executionId &&
     isResolvedSecretTraceProvenanceV1(provenance) &&
     provenance.scope?.workspaceId === options.workspaceId
   const registry = new ResolvedSecretTraceRegistry([], valid ? provenance.scope : undefined)
   if (!valid) {
-    registry.markIncomplete('backfill-scope-mismatch')
+    registry.markIncomplete(
+      checkpointPresent ? 'backfill-checkpoint-unusable' : 'backfill-checkpoint-absent'
+    )
     return registry
   }
   await registry.importProvenance(provenance, {