docs(decisions): renumber telemetry decision to ADR-040 [roadmap:v0.10.4]

ADR-039 was claimed by the Lore server identity decision merged on main
while this branch was in flight; the telemetry decision and every
reference to it move to ADR-040. No behavior change.

Author: tcballard

…cisions/adr-039-guide-local-telemetry.md …cisions/adr-040-guide-local-telemetry.mdrac/decisions/adr-039-guide-local-telemetry.md renamed to rac/decisions/adr-040-guide-local-telemetry.md rac/decisions/adr-039-guide-local-telemetry.md renamed to rac/decisions/adr-040-guide-local-telemetry.md

@@ -3,7 +3,7 @@ schema_version: 1
 id: RAC-KTY25D945HYK
 type: decision
 ---
-# ADR-039: Guide Local Telemetry
+# ADR-040: Guide Local Telemetry
 
 ## Status
 

rac/roadmaps/v0.10.x-guide/v0.10.4-guide-telemetry.md

@@ -19,7 +19,7 @@ that signal, search-quality and description investments are guesses.
 Telemetry for a trust-first, local-first tool has to be earned, not
 assumed. ADR-035 forbids a mandatory RAC cloud dependency, and the
 trust-transparency requirement names hosted infrastructure a non-goal.
-ADR-039 settles the shape: opt-in, default-off, local-only recording of
+ADR-040 settles the shape: opt-in, default-off, local-only recording of
 counts and metadata — never tool arguments, never repository content —
 with sharing as a deliberate, user-driven act.
 
@@ -41,10 +41,10 @@ issue URL the user submits with their own account.
 
 ## Initiatives
 
-### Initiative 1 — Telemetry Recorder (ADR-039)
+### Initiative 1 — Telemetry Recorder (ADR-040)
 
 A stdlib-only recorder module in the server layer: event schema pinned
-by ADR-039, append-only JSONL under the XDG state directory, a random
+by ADR-040, append-only JSONL under the XDG state directory, a random
 per-process session id, single-generation size rotation, and a
 never-raise posture — a recorder that cannot write records nothing and
 never breaks a tool call.
@@ -83,7 +83,7 @@ telemetry never touches the wire contract.
 - No network code anywhere in RAC (ADR-035, rac-trust-transparency);
   the share flow builds a URL and the user's browser transmits it.
 - Events carry counts and metadata only: no tool arguments, no artifact
-  IDs, no query strings, no paths, no repository content (ADR-039).
+  IDs, no query strings, no paths, no repository content (ADR-040).
 - Tool descriptions are unchanged (ADR-030).
 - The recorder lives in the server layer and imports only the standard
   library; Core and services stay telemetry-unaware (ADR-031).
@@ -112,7 +112,7 @@ The following decisions are pinned for v0.10.4.
 
 ### Event Schema
 
-One JSON object per line, fields pinned by ADR-039:
+One JSON object per line, fields pinned by ADR-040:
 `schema_version` (`"1"`), `ts` (ISO 8601 UTC), `session` (random
 per-process hex), `tool`, `outcome` (`ok` | `error` | `exception`),
 `error` (structured error code, present only when outcome is `error`),
@@ -152,7 +152,7 @@ per-process hex), `tool`, `outcome` (`ok` | `error` | `exception`),
   channel is the cost of the trust posture; onboarding docs ask early
   users to enable it.
 - Future fields drift toward recording content. Mitigated: the schema
-  is pinned field-for-field in ADR-039 and the battery; adding a field
+  is pinned field-for-field in ADR-040 and the battery; adding a field
   is a recorded decision, not a patch.
 - Prefilled-URL length limits. Mitigated: the summary is a few hundred
   bytes; the share test pins the URL round-trip.
@@ -166,7 +166,7 @@ per-process hex), `tool`, `outcome` (`ok` | `error` | `exception`),
 
 ## Related Decisions
 
-- ADR-039
+- ADR-040
 - ADR-030
 - ADR-031
 - ADR-032

src/rac/cli.py

@@ -856,7 +856,7 @@ def build_parser() -> argparse.ArgumentParser:
         action="store_true",
         help=(
             "Record tool-call counts and metadata (never arguments or content) "
-            "to a local log; off by default (ADR-039)."
+            "to a local log; off by default (ADR-040)."
         ),
     )
     p_mcp.set_defaults(func=cmd_mcp)

src/rac/mcp/server.py

@@ -20,7 +20,7 @@
 Failed lookups return structured error data, never protocol exceptions
 (ADR-034, :mod:`rac.mcp.errors`): an agent recovers from a JSON body.
 
-Opt-in telemetry (v0.10.4, ADR-039): when serving with a recorder, each tool
+Opt-in telemetry (v0.10.4, ADR-040): when serving with a recorder, each tool
 call routes through :func:`rac.mcp.telemetry.observe`, which times the call,
 classifies the structured payload, and returns it unchanged — tool responses
 are byte-identical with telemetry on and off, and the log is never an input
@@ -223,7 +223,7 @@ def build_server(
 
     ``budget`` is the per-response character cap (ADR-033), configurable here at
     startup; there is no per-call override. ``recorder`` enables opt-in usage
-    telemetry (ADR-039): with ``None`` — the default — nothing is recorded and
+    telemetry (ADR-040): with ``None`` — the default — nothing is recorded and
     every call is exactly the bare tool body. The returned :class:`FastMCP`
     instance has the four pinned tools registered and is ready to run over any
     transport — the CLI runs it over stdio.
@@ -285,7 +285,7 @@ def run_server(root: str, budget: int = DEFAULT_BUDGET, telemetry_enabled: bool
     Emits a one-line notice to stderr when the repository root contains no
     recognized artifacts (v0.10.1 startup hardening), and another when
     telemetry is enabled — opt-in recording is announced, never silent
-    (ADR-039).
+    (ADR-040).
     """
     _check_corpus(root)
     recorder: TelemetryRecorder | None = None

src/rac/mcp/telemetry.py

@@ -1,7 +1,7 @@
 """Opt-in local usage telemetry for Guide (v0.10.4).
 
 Telemetry answers one product question — is Guide actually used, and which
-tools matter — without spending the trust the Guide asks for (ADR-039). The
+tools matter — without spending the trust the Guide asks for (ADR-040). The
 shape is pinned: opt-in and default-off, local-only, and content-free. Events
 carry counts and metadata; tool arguments, artifact IDs, query strings, paths,
 and repository content are never recorded.
@@ -44,17 +44,17 @@
 from datetime import UTC, datetime
 from pathlib import Path
 
-# Pinned event schema version (ADR-039). Bumping it is a recorded decision.
+# Pinned event schema version (ADR-040). Bumping it is a recorded decision.
 SCHEMA_VERSION = "1"
 
 TELEMETRY_FILENAME = "guide-telemetry.jsonl"
 
 # Rotation threshold: events are ~120 bytes, so 1 MB holds roughly 8,000
 # calls. One previous generation is kept (``.1``), bounding disk use at about
-# 2 MB with no in-flight rotation and no retention configuration (ADR-039).
+# 2 MB with no in-flight rotation and no retention configuration (ADR-040).
 MAX_LOG_BYTES = 1_000_000
 
-# Share flow (ADR-039): a prefilled new-issue URL against the repository's
+# Share flow (ADR-040): a prefilled new-issue URL against the repository's
 # usage-report issue form. Issue forms accept ``?field_id=value`` prefill;
 # the user's browser transmits, RAC never does.
 SHARE_ISSUE_URL = "https://github.com/tcballard/requirements-as-code/issues/new"
@@ -283,7 +283,7 @@ def share_url(summary: TelemetrySummary) -> str:
     """The prefilled usage-report issue URL for ``summary``.
 
     String formatting only — the user opens the URL, reviews the prefilled
-    report, and submits it with their own GitHub account (ADR-039). The
+    report, and submits it with their own GitHub account (ADR-040). The
     local log path stays out of the shared report: a home-directory path
     can embed a username, and the report is counts and timestamps only.
     """

tests/test_mcp_server.py

@@ -100,7 +100,7 @@ def _fake_run(root: str, telemetry_enabled: bool = False) -> int:
     args = parser.parse_args(["mcp", "--root", CORPUS])
     assert args.func(args) == cli.EXIT_OK
     assert captured["root"] == CORPUS
-    assert captured["telemetry"] is False, "telemetry is opt-in, default off (ADR-039)"
+    assert captured["telemetry"] is False, "telemetry is opt-in, default off (ADR-040)"
 
 
 def test_run_server_returns_zero_on_clean_shutdown(monkeypatch):

tests/test_mcp_telemetry.py

@@ -1,6 +1,6 @@
 """Guide telemetry contracts — opt-in, local-only, content-free (v0.10.4).
 
-The battery pins ADR-039's shape: nothing is recorded without the explicit
+The battery pins ADR-040's shape: nothing is recorded without the explicit
 opt-in; events carry the pinned field set and never tool arguments or
 repository content; tool responses are byte-identical with a recorder attached
 and without one (the ADR-032 guard); a recorder that cannot write disables
@@ -41,7 +41,7 @@
 
 DEC = "RAC-MCPDEC000001"
 
-# The pinned event field set, in emission order (ADR-039). ``error`` appears
+# The pinned event field set, in emission order (ADR-040). ``error`` appears
 # only on error outcomes, between ``outcome`` and ``duration_ms``.
 EVENT_FIELDS = ["schema_version", "ts", "session", "tool", "outcome", "duration_ms", "truncated"]
 EVENT_FIELDS_ERROR = [
@@ -143,7 +143,7 @@ def test_each_tool_records_exactly_one_pinned_event(tmp_path):
 
 
 def test_events_never_carry_arguments_or_content(tmp_path):
-    # The content-free guarantee is a test, not a comment (ADR-039): the
+    # The content-free guarantee is a test, not a comment (ADR-040): the
     # artifact ID argument and the repository content the call returned must
     # not appear anywhere in the log.
     recorder = make_recorder(tmp_path)