# WO-08 — Shadow Rollout, Migration, and Legacy Removal

**Status:** in progress  
**Primary modules:** orchestrator configuration, telemetry, TUI audit display,
legacy compaction/rehydration paths  
**Depends on:** WO-07

## Rollout contract

The strict v2 path is the default request compiler: at the exact 40%-free
headroom boundary it uses only a validated inference plan, and a failure holds
the unmodified request. `OMNIUS_MEMORY_COMPILER_MODE=shadow` is an explicit
rollback/diagnostic mode while comparison and canary evidence is gathered.
`hold` must never block a read, edit, exploration, or verifier tool call.

## Todos

- [ ] Add feature flags for ledger dual-write, graph materialization, shadow
  compiler, active compiler, and second opinion; document defaults.
- [x] Emit body-free TUI/log lifecycle receipts: exact request budget →
  inference dispositions/locators → applied/held/rejected request fingerprint.
- [ ] Define promotion thresholds from WO-07 and reject rollout if authority,
  fidelity, or tool-freedom regress.
- [ ] Canary by session/model tier with automatic rollback to untouched history
  on schema/validation/runtime failure.
- [ ] Run and document a rollback drill.
- [ ] Remove synthetic recap, silent recovery, heuristic fallback, and stale
  controller injection code only after canary acceptance.
- [ ] Remove obsolete flags, tests, and docs in the same release; do not leave
  dead legacy behavior silently enabled by environment variables.

## Acceptance tests

- Shadow mode changes no outgoing request while producing an auditable delta.
- A malformed delta rolls back before request send and does not affect tool
  availability.
- Rollback restores the last known valid materialized working set.
- After legacy deletion, a source scan proves no synthetic recap or automatic
  recovery injection remains on the normal request path.

## Definition of done

The canary report meets published thresholds, rollback has been exercised, the
legacy source is removed, and the package build plus focused regression suite
pass. Deployment remains a separate explicitly approved operation.