Session 02: retire the tech-debt registry (TD-01..07) + double-review remediation

.github/workflows/ci.yml

@@ -34,8 +34,9 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - uses: actions/checkout@v4
-            - uses: dtolnay/rust-toolchain@nightly
+            - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
               with:
+                  toolchain: nightly
                   components: rustfmt
             - name: Check formatting
               run: cargo fmt --all -- --check
@@ -48,10 +49,11 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - uses: actions/checkout@v4
-            - uses: dtolnay/rust-toolchain@stable
+            - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
               with:
+                  toolchain: stable
                   components: clippy
-            - uses: Swatinem/rust-cache@v2
+            - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
             - name: Run Clippy
               run: cargo clippy --all-targets --all-features -- -D warnings
 
@@ -73,10 +75,10 @@ jobs:
                       rust: "1.93.0"
         steps:
             - uses: actions/checkout@v4
-            - uses: dtolnay/rust-toolchain@master
+            - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
               with:
                   toolchain: ${{ matrix.rust }}
-            - uses: Swatinem/rust-cache@v2
+            - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
               with:
                   key: ${{ matrix.os }}-${{ matrix.rust }}
 
@@ -98,8 +100,10 @@ jobs:
         needs: [fmt, clippy]
         steps:
             - uses: actions/checkout@v4
-            - uses: dtolnay/rust-toolchain@stable
-            - uses: Swatinem/rust-cache@v2
+            - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
+              with:
+                  toolchain: stable
+            - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
 
             - name: Run integration tests
               run: cargo test --test '*' --all-features
@@ -116,19 +120,22 @@ jobs:
         needs: [test]
         steps:
             - uses: actions/checkout@v4
-            - uses: dtolnay/rust-toolchain@stable
+            - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
               with:
+                  toolchain: stable
                   components: llvm-tools-preview
-            - uses: Swatinem/rust-cache@v2
+            - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
 
             - name: Install cargo-llvm-cov
-              uses: taiki-e/install-action@cargo-llvm-cov
+              uses: taiki-e/install-action@4684b8405694ae9dd42c9f39ba901a70ae83f4a3 # v2.82.9
+              with:
+                  tool: cargo-llvm-cov
 
             - name: Generate coverage report
               run: cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info
 
             - name: Upload coverage to Codecov
-              uses: codecov/codecov-action@v4
+              uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
               with:
                   files: lcov.info
                   fail_ci_if_error: false
@@ -143,8 +150,10 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - uses: actions/checkout@v4
-            - uses: dtolnay/rust-toolchain@stable
-            - uses: Swatinem/rust-cache@v2
+            - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
+              with:
+                  toolchain: stable
+            - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
 
             - name: Build documentation
               run: cargo doc --no-deps --all-features
@@ -163,7 +172,7 @@ jobs:
             issues: write
         steps:
             - uses: actions/checkout@v4
-            - uses: rustsec/audit-check@v2
+            - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
               with:
                   token: ${{ secrets.GITHUB_TOKEN }}
 
@@ -175,11 +184,15 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - uses: actions/checkout@v4
-            - uses: dtolnay/rust-toolchain@stable
-            - uses: Swatinem/rust-cache@v2
+            - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
+              with:
+                  toolchain: stable
+            - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
 
             - name: Install cargo-deny
-              uses: taiki-e/install-action@cargo-deny
+              uses: taiki-e/install-action@4684b8405694ae9dd42c9f39ba901a70ae83f4a3 # v2.82.9
+              with:
+                  tool: cargo-deny
 
             - name: Check dependency policy (advisories, bans, licenses, sources)
               run: cargo deny check

.github/workflows/extended-tests.yml

@@ -41,8 +41,10 @@ jobs:
     if: ${{ github.event_name == 'schedule' || github.event.inputs.run_benchmarks == 'true' }}
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
 
       - name: Install criterion dependencies
         run: |
@@ -98,8 +100,10 @@ jobs:
           --health-retries 10
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
 
       - name: Wait for Iggy to be ready
         run: |
@@ -133,8 +137,10 @@ jobs:
     if: ${{ github.event_name == 'schedule' || github.event.inputs.run_memory_check == 'true' }}
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
 
       - name: Install Valgrind
         run: |
@@ -172,10 +178,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@nightly
+      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
         with:
+          toolchain: nightly
           components: miri
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
 
       - name: Setup Miri
         run: cargo miri setup
@@ -205,8 +212,10 @@ jobs:
           - "--no-default-features"
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           key: features-${{ matrix.features }}
 
@@ -224,8 +233,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@nightly
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
+        with:
+          toolchain: nightly
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
 
       - name: Check documentation coverage
         run: |

.github/workflows/pr.yml

@@ -106,8 +106,10 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
 
       - name: Check for missing documentation
         run: |
@@ -137,11 +139,15 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
 
       - name: Install cargo-semver-checks
-        uses: taiki-e/install-action@cargo-semver-checks
+        uses: taiki-e/install-action@4684b8405694ae9dd42c9f39ba901a70ae83f4a3 # v2.82.9
+        with:
+          tool: cargo-semver-checks
 
       - name: Check for breaking changes
         run: cargo semver-checks check-release
@@ -189,13 +195,16 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
         with:
+          toolchain: stable
           components: llvm-tools-preview
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
 
       - name: Install cargo-llvm-cov
-        uses: taiki-e/install-action@cargo-llvm-cov
+        uses: taiki-e/install-action@4684b8405694ae9dd42c9f39ba901a70ae83f4a3 # v2.82.9
+        with:
+          tool: cargo-llvm-cov
 
       - name: Generate coverage summary
         run: |

.github/workflows/release.yml

@@ -99,11 +99,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
         with:
+          toolchain: stable
           targets: ${{ matrix.target }}
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           key: release-${{ matrix.target }}
 
@@ -185,7 +186,7 @@ jobs:
           echo "Generated changelog with $(wc -l < CHANGELOG.md) entries"
 
       - name: Create release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
         with:
           name: Release v${{ needs.validate.outputs.version }}
           body_path: CHANGELOG.md
@@ -204,8 +205,10 @@ jobs:
     if: needs.validate.outputs.is_prerelease == 'false'
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
 
       - name: Publish to crates.io
         run: cargo publish --token ${{ secrets.CRATES_IO_TOKEN }}
@@ -226,8 +229,10 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
 
       - name: Build documentation
         run: cargo doc --no-deps --all-features

CLAUDE.md

@@ -106,6 +106,7 @@ src/
 │   ├── connection.rs # Connection state management
 │   ├── helpers.rs    # Utility functions
 │   ├── params.rs     # PollParams builder
+│   ├── resilience.rs # Timeout/breaker/retry composition (run_resilient)
 │   └── scopeguard.rs # Scope guard utilities
 ├── validation.rs     # Input validation utilities
 ├── middleware/
@@ -135,6 +136,7 @@ tests/
 ├── integration_tests.rs  # End-to-end API tests with testcontainers
 │   ├── Standard fixture tests (basic CRUD, messages)
 │   └── Security boundary tests (auth, rate limiting)
+├── metrics_smoke_test.rs # Prometheus exporter smoke test (own process)
 └── model_tests.rs        # Unit tests for models
 
 fuzz/
@@ -427,12 +429,15 @@ environment:
 ### Running Tests
 
 ```bash
-# Unit tests (159 tests)
+# Unit tests (183 tests)
 cargo test --lib
 
-# Integration tests (29 tests, requires Docker for testcontainers)
+# Integration tests (30 tests, requires Docker for testcontainers)
 cargo test --test integration_tests
 
+# Metrics exporter smoke test (1 test)
+cargo test --test metrics_smoke_test
+
 # Model tests (18 tests)
 cargo test --test model_tests
 
@@ -711,12 +716,17 @@ Request → Rate Limit → Auth → Request ID → Timeout → Tracing → CORS
 
 ### Request Timeout (`src/middleware/timeout.rs`)
 - Clients can specify `X-Request-Timeout: <milliseconds>` header
-- Bounded: 100ms minimum, 5 minutes maximum
-- Stored in request extensions for handler use
-- `RequestTimeoutExt` trait for easy extraction in handlers
-- **Note**: currently parsed and stored only — no handler consumes it yet, so
-  all Iggy operations are bounded by the global `OPERATION_TIMEOUT_SECS`.
-  Enforcement is tracked in `docs/tech-debt/TD-2026-07-04.md`.
+- Bounded: 100ms minimum, 5 minutes maximum (header parse acceptance)
+- Enforced end-to-end: all Iggy-touching handlers scope their client via
+  `AppState::{producer,consumer,iggy}_scoped` →
+  `IggyClientWrapper::with_timeout`, bounding every operation attempt by
+  the request deadline (worst case ~3x the deadline on the reconnect
+  path: first attempt + bounded reconnect wait + single retry)
+- Timeouts under a client-shortened deadline are NOT circuit-breaker
+  failures (a client's short deadline expiring is not outage evidence)
+- The effective deadline is clamped to the global `OPERATION_TIMEOUT_SECS`
+  — clients may shorten a request's bound, never extend it
+- Requests without the header use the global timeout unchanged
 
 ## Deployment Security
 

Cargo.toml

@@ -70,6 +70,10 @@ metrics-exporter-prometheus = { version = "0.18", default-features = false, feat
 [dev-dependencies]
 reqwest = { version = "0.13", features = ["json"] }
 testcontainers = "0.27"
+# test-util unlocks tokio::time::pause()/advance() for the paused-clock
+# resilience matrix (TD-2026-07-01); dev-only so production builds are
+# unaffected.
+tokio = { version = "1.52", features = ["full", "test-util"] }
 
 # =============================================================================
 # Lints Configuration

docs/README.md

@@ -8,7 +8,7 @@ This directory contains comprehensive guides for understanding and working with
 |-------|-------------|
 | [Event-Driven Architecture Guide](guide.md) | Core concepts, streams/topics/partitions, consumer groups, error handling patterns, and production patterns (outbox, saga, idempotency) |
 | [Partitioning Guide](partitioning-guide.md) | Deep dive into partition keys, ordering guarantees, and partition selection strategies |
-| [Durable Storage Guide](durable-storage-guide.md) | Storage architecture, fsync configuration, backup/archiving to S3, recovery procedures, and production recommendations |
+| [Durable Storage Guide](durable-storage-guide.md) | Storage architecture, fsync configuration, retention, backup strategies (the built-in archiver was removed before server 0.8.0), recovery procedures, and production recommendations |
 | [Structured Concurrency](structured-concurrency.md) | Task lifecycle management, cancellation tokens, and graceful shutdown patterns |
 
 ## Quick Navigation
@@ -26,7 +26,7 @@ This directory contains comprehensive guides for understanding and working with
 
 **Data Durability**
 - [Durability Configuration](durable-storage-guide.md#durability-configuration) - fsync settings and trade-offs
-- [Backup and Archiving](durable-storage-guide.md#backup-and-archiving) - S3 and disk archival
+- [Backup and Archiving](durable-storage-guide.md#backup-and-archiving) - backup strategies (built-in archiver removed in 0.8.0)
 - [Recovery](durable-storage-guide.md#recovery-and-data-integrity) - Disaster recovery procedures
 
 **Message Ordering**