fix(#631): exact pins resolve deprecated and revoked records (spec 005 FR-004, decision 127 Q11)

[enricopiovesan]

Summary

resolve_synced_public_registry_record filtered on is_active(), so an exact pin to a deprecated or revoked version returned None. That contradicts three approved sources:

• spec 005 FR-004: exact-pin resolution "ignores the flag entirely and always succeeds if the version exists";
• decision-log entry 127 Q11: exact pins "still resolve but carry a machine-readable do-not-run signal";
• spec 026's out-of-scope list (spec 005 SC-005 holds).

The exact resolver now returns the record whatever its lifecycle status. The record carries lifecycle_status() and, when revoked, revocation, so the consumer can fail closed. Range resolution is unchanged and still skips deprecated and revoked versions.

Governing Spec

• 005-yank-deprecation
• 026-model-rights-compliance
• 055-registry-sync

Project Item

• [Task]: Exact pins to deprecated/revoked records must resolve (spec 005 FR-004, decision 127 Q11), then publish traverse-registry #631

What Changed

• crates/traverse-registry/src/public_registry_state.rs:
  • the exact resolver drops the is_active() filter;
  • the doc comment states the spec 005 / entry 127 contract;
  • two tests replace the None assertions. A deprecated exact pin resolves with Deprecated status. A revoked exact pin resolves with Revoked status and its revocation. A revoked-only range still fails with OnlyDeprecatedVersions.
• docs/decision-log.md entry 131.
• No spec amendment: the code was out of step with spec 005 and spec 026, and the specs are already correct.
• Version stays 0.27.0. crates.io's newest version is 0.25.0, and neither 0.26.0 nor 0.27.0 was ever tagged, so 0.27.0 is the first published version with the spec 026 types and this behaviour.

Validation

• cargo test -p traverse-registry --locked: all green (233 unit tests, plus the integration suites).
• cargo clippy -p traverse-registry --all-targets --locked -- -D warnings: clean.
• No caller in this repo or in traverse depends on the old filtering. traverse pins =0.25.0 and doesn't call the exact resolver.

Follow-up (owner action)

Publish through the normal v0.27.0 tag push (010-crate-publish-pipeline), then tell traverse#1598.

🤖 Generated with Claude Code