# Legacy connector execution retirement

This records the current-tree consumer audit for the cleanup based on NexusCRM
`4324361c2`. It retires unreachable execution machinery after the independent
Runtime cutover; it does not change connector schema, installed metadata, or
historical identity ownership.

## Current owners

| Concern | Live owner / read path | Retired implementation |
| --- | --- | --- |
| Flow outbound request | Runtime composition enables `RuntimeOutboundIntentFlowActionCallRegistration`; the action persists a Runtime intent and Integration delivers it | `executePushToConnector`, synchronous HTTP adapter, `ConnectorPushWorker`, async/callout injection options |
| Outbound result | Runtime result committer publishes the accepted result and identity projection | Old attempt reservation, dispatch, POST/PATCH outcome and writeback transitions |
| Setup/control-plane graph | `buildControlplaneServiceGraph` and `BuildConnectorInboundRemoteIdentityRecoveryMaintenance` construct `ServiceManager` | ServiceManager's unused outbox, scheduler, approval replay and connector worker lifecycle; setup's unowned audit writer/retention startup |
| Remote identity recovery | Installed contract/profile resolvers, durable identity/evidence store and explicit recovery service | No recovery authority is removed |
| Historical migration | Published control-plane calls `AdoptConnectorPushLegacyMirrorEvidence` | No migration entrypoint is removed |

The execution-root audit included production consumers in this repository,
the six sibling repositories' current main refs, and the published L0 module
versions selected by this tree. The old constructors, executable registration,
callout injection, and removed store methods had no remaining production
consumer. Backend builds also exercise the actual pinned dependency closure.

`ServiceManager` remains a headless metadata/records/approval composition graph.
Its outbox producer and approval replay store remain available for transactional
writes. Metadata refresh remains intact. It no longer constructs unused
scheduled/replay workers or starts process-global audit/retention tasks during
setup. The control-plane adapter preserves its existing no-worker behavior:
`ConnectorInbound()` returns nil and reconciliation is a no-op. The independently
owned Integration process observes installed catalog changes.

## Retained compatibility boundary

`_System_ConnectorRemoteLink`, `_System_ConnectorPushAttempt`, and inbound evidence
are not dropped. Historical attempts still fence adoption, owner deletion and
identity transfer. The remaining store reads also serve connector diagnostics.
Legacy snapshot decoding and the pinned control-plane's mirror-adoption entrypoint
remain live. A field/profile/contract snapshot is identity evidence, not permission
to restart the retired HTTP dispatcher.

Shared metadata fingerprints, payload authorization and technical projection
helpers remain used by current Runtime or recovery. Their files are named for
those responsibilities. The boundary inventory moves the pre-existing
`models.SObject` carrier usage from the deleted executor file to the surviving
payload helper; it does not authorize any new product-specific behavior.

## Verification boundary

- Current Runtime intent admission and result publication, including real TiDB
  commit/rollback paths and identity projection.
- Inbound finalization/recovery, historical conflict rejection, corrupt persisted
  state, identity transfer and owner-deletion fences on real TiDB.
- Concurrent inbound writers competing for one remote locator.
- Setup/control-plane composition, independent worker assembly, app-blind Runtime
  dependency closure and CRM setup distribution compilation.
- Module boundary gate and whitespace checks.

Tests solely exercising removed dispatch transitions are deleted with their
implementation. Tests that used the retired dispatcher to manufacture historical
rows now seed the persisted format directly and assert against the live reader or
recovery operation. Current producer-to-consumer tests continue to use the real
Runtime repositories and committers.

The scoped literal scan reports the retained `left.FlowDeveloperName ==
right.FlowDeveloperName` comparison in the durable store. This compares two
metadata snapshots for exact identity continuity; it contains no product or
tenant DeveloperName literal and is unchanged from the base commit. The module
boundary gate reports zero forbidden edges and zero new dialect violations.

### Release gate ownership

`tests/integration/connector-identity-ownership.sh` runs the surviving inbound
locator concurrency, retained point-read/snapshot, transfer/replay, owner-deletion
and historical identity reader proofs against real TiDB. Local verification and
the trusted-main workflow invoke this same runner. Its required test list selects
the tests and verifies their pass events; missing tests or skipped subtests fail.

The old cross-table dispatch/attempt test and the POST-outcome/CAS execution
transition tests were removed with their unreachable production methods. CI must
not continue selecting those names, nor restore the retired executor merely to
satisfy a stale gate. Current Runtime intent admission and result publication
remain covered by their Runtime-owner gates.

### Local results (2026-09-08)

- Automation and backend production builds and all-package test compilation pass.
  CRM setup also builds with `GOWORK=off`, `-tags=crm`, and the checked-in
  app-packs source revision `fbb0db216c3db5c25c2b9eaa40d0056e64b37c43`.
- The selected connector/Runtime owner batch passed 413 tests/subtests with
  `NEXUSCRM_TIDB_REQUIRED=1` and no skips. Across the full and remaining batches,
  1,531 of the automation root package's 1,532 top-level tests pass; its
  subpackage suites pass. The remaining test has the baseline failure below.
- The services, serverruntime, runtimeworker and setupcmd suites pass. The
  broader backend run passes outside the two baseline-blocked integration
  paths below; the remaining REST tests pass when the reproduced PKCE failure
  is excluded. The Linux-only inherited-file-descriptor proof and opt-in startup
  profiling workload are not counted as passes on this macOS run.
- The following failures were each rerun independently on unchanged
  `4324361c2` and reproduced with the same diagnostic. The full suites are
  therefore **not green**; these are not waived or silently marked as passes:
  - `TestFencedScheduledRunTiDBCommitsEffectsAndCompletionTogetherAndFencesStaleOwner`:
    readiness accepts the fixture's legacy active row (line 738).
  - `TestOAuthPublicPKCEAuthorizeResumeAndTokenExchangeEndToEnd`: nil dereference
    in pinned control-plane `withControlPlaneMutationLock`, before graph creation.
  - `TestApprovalService_Submit_CanonicalTargetIDWithSkipEntryCriteria_Integration`:
    CRM source installation rejects unsupported `custom_permission` components
    and the absent `product-dialect/salesforce-v63` host capability. Both trees
    complete L0 schema, headless graph creation and platform-pack application
    before reaching this failure.