@happyvertical/smrt-comments 0.57.1 → 0.57.3

package/dist/smrt-knowledge.json

@@ -3,20 +3,21 @@
   "sensitiveFieldsExcluded": true,
   "generatedAt": "1970-01-01T00:00:00.000Z",
   "packageName": "@happyvertical/smrt-comments",
-  "packageVersion": "0.57.1",
+  "packageVersion": "0.57.3",
   "sourceManifestPath": "dist/manifest.json",
   "agentDocPath": "AGENTS.md",
   "sourceHashes": {
-    "manifest": "4df0795f711cfff4a2b013ddf337a490a45a6c31ff643fc3253185f13a35a65e",
-    "packageJson": "40a6980fb9626e9133a2b3984d530024c37d4bcab691c8a76a8b064571f426fc",
+    "manifest": "0fc777811025297280fbfcb0e4d9ae5a77b652f60d5a95636ce17cd5639c8314",
+    "packageJson": "37080267a2b4a385978794442257d10013b7d9d6675480ea73d0fae511a3b733",
     "agents": "3e82791ea4a860351e1be18ee8cee07902b99643bd9c53d4859e1f18683979ec",
-    "moduleDoc:agents/test-design.md": "df07180c4186d6358a841e23c806cd521f772a98582676e7f0ab73035d5cbb53",
-    "moduleDoc:agents/idempotent-create.md": "97043e654f93fe59f1c2bbc2f5f3adbfad616e2741756c69fa5ca7ff6d84250f"
+    "moduleDoc:agents/test-design.md": "c30a6d4694f838b8f61b3762559cf9434588132d6df681a0da63087297c985d3",
+    "moduleDoc:agents/idempotent-create.md": "51e9512a7891ac7296e121167f9eed61842ee444e121d8896fb04a47315662c7"
   },
   "exports": [
     ".",
     "./manifest",
     "./manifest.json",
+    "./participation",
     "./svelte"
   ],
   "dependencies": {
@@ -45,7 +46,7 @@
     "cross-package"
   ],
   "risks": [
-    "cross-package-refs:1",
+    "cross-package-refs:3",
     "polymorphic-associations:1",
     "sensitive-fields-excluded"
   ],
@@ -89,6 +90,91 @@
       "tags": [],
       "risks": []
     },
+    {
+      "name": "CommentReportCollection",
+      "qualifiedName": "@happyvertical/smrt-comments:CommentReportCollection",
+      "collection": "commentreports",
+      "tableName": "comment_reports",
+      "packageName": "@happyvertical/smrt-comments",
+      "extends": "SmrtCollection",
+      "fields": [],
+      "relationships": [],
+      "methods": [],
+      "surfaces": [],
+      "relationshipFeatures": [
+        "uuidColumns"
+      ],
+      "tags": [],
+      "risks": []
+    },
+    {
+      "name": "CommentRevisionCollection",
+      "qualifiedName": "@happyvertical/smrt-comments:CommentRevisionCollection",
+      "collection": "commentrevisions",
+      "tableName": "comment_revisions",
+      "packageName": "@happyvertical/smrt-comments",
+      "extends": "SmrtCollection",
+      "fields": [],
+      "relationships": [],
+      "methods": [],
+      "surfaces": [],
+      "relationshipFeatures": [
+        "uuidColumns"
+      ],
+      "tags": [],
+      "risks": []
+    },
+    {
+      "name": "ParticipationPolicyCollection",
+      "qualifiedName": "@happyvertical/smrt-comments:ParticipationPolicyCollection",
+      "collection": "participationpolicies",
+      "tableName": "participation_policies",
+      "packageName": "@happyvertical/smrt-comments",
+      "extends": "SmrtCollection",
+      "fields": [],
+      "relationships": [],
+      "methods": [],
+      "surfaces": [],
+      "relationshipFeatures": [
+        "uuidColumns"
+      ],
+      "tags": [],
+      "risks": []
+    },
+    {
+      "name": "ParticipationBanCollection",
+      "qualifiedName": "@happyvertical/smrt-comments:ParticipationBanCollection",
+      "collection": "participationbans",
+      "tableName": "participation_bans",
+      "packageName": "@happyvertical/smrt-comments",
+      "extends": "SmrtCollection",
+      "fields": [],
+      "relationships": [],
+      "methods": [],
+      "surfaces": [],
+      "relationshipFeatures": [
+        "uuidColumns"
+      ],
+      "tags": [],
+      "risks": []
+    },
+    {
+      "name": "ParticipationRateBucketCollection",
+      "qualifiedName": "@happyvertical/smrt-comments:ParticipationRateBucketCollection",
+      "collection": "participationratebuckets",
+      "tableName": "participation_rate_buckets",
+      "packageName": "@happyvertical/smrt-comments",
+      "extends": "SmrtCollection",
+      "fields": [],
+      "relationships": [],
+      "methods": [],
+      "surfaces": [],
+      "relationshipFeatures": [
+        "uuidColumns"
+      ],
+      "tags": [],
+      "risks": []
+    },
     {
       "name": "Comment",
       "qualifiedName": "@happyvertical/smrt-comments:Comment",
@@ -167,6 +253,34 @@
           "required": false,
           "columnType": "TEXT",
           "readonly": true
+        },
+        {
+          "name": "parentCommentId",
+          "type": "foreignKey",
+          "required": false,
+          "related": "Comment",
+          "columnType": "UUID"
+        },
+        {
+          "name": "status",
+          "type": "text",
+          "required": true,
+          "columnType": "TEXT",
+          "default": "visible"
+        },
+        {
+          "name": "participationSnapshot",
+          "type": "text",
+          "required": false,
+          "columnType": "TEXT",
+          "readonly": true
+        },
+        {
+          "name": "editedAt",
+          "type": "datetime",
+          "required": false,
+          "columnType": "TIMESTAMP",
+          "readonly": true
         }
       ],
       "relationships": [
@@ -176,6 +290,13 @@
           "required": true,
           "related": "@happyvertical/smrt-users:User",
           "columnType": "UUID"
+        },
+        {
+          "name": "parentCommentId",
+          "type": "foreignKey",
+          "required": false,
+          "related": "Comment",
+          "columnType": "UUID"
         }
       ],
       "methods": [
@@ -211,6 +332,345 @@
       "relationshipFeatures": [
         "SmrtPolymorphicAssociation",
         "crossPackageRef",
+        "foreignKey",
+        "uuidColumns"
+      ],
+      "tags": [],
+      "risks": []
+    },
+    {
+      "name": "CommentReport",
+      "qualifiedName": "@happyvertical/smrt-comments:CommentReport",
+      "collection": "commentreports",
+      "description": "A tenant-local report; moderation resolution never deletes the report.",
+      "tableName": "comment_reports",
+      "packageName": "@happyvertical/smrt-comments",
+      "extends": "SmrtObject",
+      "fields": [
+        {
+          "name": "tenantId",
+          "type": "text",
+          "required": true,
+          "columnType": "UUID"
+        },
+        {
+          "name": "commentId",
+          "type": "foreignKey",
+          "required": true,
+          "related": "Comment",
+          "columnType": "UUID"
+        },
+        {
+          "name": "reporterUserId",
+          "type": "crossPackageRef",
+          "required": true,
+          "related": "@happyvertical/smrt-users:User",
+          "columnType": "UUID"
+        },
+        {
+          "name": "reason",
+          "type": "text",
+          "required": true,
+          "columnType": "TEXT"
+        },
+        {
+          "name": "status",
+          "type": "text",
+          "required": true,
+          "columnType": "TEXT",
+          "default": "open"
+        }
+      ],
+      "relationships": [
+        {
+          "name": "commentId",
+          "type": "foreignKey",
+          "required": true,
+          "related": "Comment",
+          "columnType": "UUID"
+        },
+        {
+          "name": "reporterUserId",
+          "type": "crossPackageRef",
+          "required": true,
+          "related": "@happyvertical/smrt-users:User",
+          "columnType": "UUID"
+        }
+      ],
+      "methods": [],
+      "tenant": {
+        "scoped": true,
+        "mode": "required",
+        "field": "tenantId"
+      },
+      "conflictColumns": [
+        "tenant_id",
+        "slug",
+        "context"
+      ],
+      "surfaces": [],
+      "relationshipFeatures": [
+        "crossPackageRef",
+        "foreignKey",
+        "uuidColumns"
+      ],
+      "tags": [],
+      "risks": []
+    },
+    {
+      "name": "CommentRevision",
+      "qualifiedName": "@happyvertical/smrt-comments:CommentRevision",
+      "collection": "commentrevisions",
+      "description": "Immutable prior body retained whenever an author edits a comment.",
+      "tableName": "comment_revisions",
+      "packageName": "@happyvertical/smrt-comments",
+      "extends": "SmrtObject",
+      "fields": [
+        {
+          "name": "tenantId",
+          "type": "text",
+          "required": true,
+          "columnType": "UUID"
+        },
+        {
+          "name": "commentId",
+          "type": "foreignKey",
+          "required": true,
+          "related": "Comment",
+          "columnType": "UUID"
+        },
+        {
+          "name": "editorUserId",
+          "type": "crossPackageRef",
+          "required": true,
+          "related": "@happyvertical/smrt-users:User",
+          "columnType": "UUID"
+        },
+        {
+          "name": "body",
+          "type": "text",
+          "required": true,
+          "columnType": "TEXT"
+        }
+      ],
+      "relationships": [
+        {
+          "name": "commentId",
+          "type": "foreignKey",
+          "required": true,
+          "related": "Comment",
+          "columnType": "UUID"
+        },
+        {
+          "name": "editorUserId",
+          "type": "crossPackageRef",
+          "required": true,
+          "related": "@happyvertical/smrt-users:User",
+          "columnType": "UUID"
+        }
+      ],
+      "methods": [],
+      "tenant": {
+        "scoped": true,
+        "mode": "required",
+        "field": "tenantId"
+      },
+      "conflictColumns": [
+        "tenant_id",
+        "slug",
+        "context"
+      ],
+      "surfaces": [],
+      "relationshipFeatures": [
+        "crossPackageRef",
+        "foreignKey",
+        "uuidColumns"
+      ],
+      "tags": [],
+      "risks": []
+    },
+    {
+      "name": "ParticipationBan",
+      "qualifiedName": "@happyvertical/smrt-comments:ParticipationBan",
+      "collection": "participationbans",
+      "description": "Tenant-local, reusable participation ban; a blank target applies tenant-wide.",
+      "tableName": "participation_bans",
+      "packageName": "@happyvertical/smrt-comments",
+      "extends": "SmrtObject",
+      "fields": [
+        {
+          "name": "tenantId",
+          "type": "text",
+          "required": true,
+          "columnType": "UUID"
+        },
+        {
+          "name": "actorUserId",
+          "type": "text",
+          "required": true,
+          "columnType": "TEXT"
+        },
+        {
+          "name": "recordType",
+          "type": "text",
+          "required": false,
+          "columnType": "TEXT"
+        },
+        {
+          "name": "recordId",
+          "type": "text",
+          "required": false,
+          "columnType": "TEXT"
+        },
+        {
+          "name": "reason",
+          "type": "text",
+          "required": true,
+          "columnType": "TEXT"
+        },
+        {
+          "name": "expiresAt",
+          "type": "datetime",
+          "required": false,
+          "columnType": "TIMESTAMP"
+        }
+      ],
+      "relationships": [],
+      "methods": [],
+      "tenant": {
+        "scoped": true,
+        "mode": "required",
+        "field": "tenantId"
+      },
+      "conflictColumns": [
+        "tenant_id",
+        "slug",
+        "context"
+      ],
+      "surfaces": [],
+      "relationshipFeatures": [
+        "uuidColumns"
+      ],
+      "tags": [],
+      "risks": []
+    },
+    {
+      "name": "ParticipationPolicy",
+      "qualifiedName": "@happyvertical/smrt-comments:ParticipationPolicy",
+      "collection": "participationpolicies",
+      "description": "A generic tenant default or exact-record override for participation actions.",
+      "tableName": "participation_policies",
+      "packageName": "@happyvertical/smrt-comments",
+      "extends": "SmrtObject",
+      "fields": [
+        {
+          "name": "tenantId",
+          "type": "text",
+          "required": true,
+          "columnType": "UUID"
+        },
+        {
+          "name": "recordType",
+          "type": "text",
+          "required": false,
+          "columnType": "TEXT"
+        },
+        {
+          "name": "recordId",
+          "type": "text",
+          "required": false,
+          "columnType": "TEXT"
+        },
+        {
+          "name": "action",
+          "type": "text",
+          "required": true,
+          "columnType": "TEXT"
+        },
+        {
+          "name": "moderationMode",
+          "type": "text",
+          "required": true,
+          "columnType": "TEXT",
+          "default": "open"
+        },
+        {
+          "name": "maxActions",
+          "type": "integer",
+          "required": true,
+          "columnType": "INTEGER",
+          "default": 0
+        },
+        {
+          "name": "windowSeconds",
+          "type": "integer",
+          "required": true,
+          "columnType": "INTEGER",
+          "default": 0
+        }
+      ],
+      "relationships": [],
+      "methods": [],
+      "tenant": {
+        "scoped": true,
+        "mode": "required",
+        "field": "tenantId"
+      },
+      "conflictColumns": [
+        "tenant_id",
+        "slug",
+        "context"
+      ],
+      "surfaces": [],
+      "relationshipFeatures": [
+        "uuidColumns"
+      ],
+      "tags": [],
+      "risks": []
+    },
+    {
+      "name": "ParticipationRateBucket",
+      "qualifiedName": "@happyvertical/smrt-comments:ParticipationRateBucket",
+      "collection": "participationratebuckets",
+      "description": "Service-owned fixed-window counter. Never delete a currently active bucket.",
+      "tableName": "participation_rate_buckets",
+      "packageName": "@happyvertical/smrt-comments",
+      "extends": "SmrtObject",
+      "fields": [
+        {
+          "name": "tenantId",
+          "type": "text",
+          "required": true,
+          "columnType": "UUID"
+        },
+        {
+          "name": "bucketKey",
+          "type": "text",
+          "required": true,
+          "columnType": "TEXT"
+        },
+        {
+          "name": "actionCount",
+          "type": "integer",
+          "required": true,
+          "columnType": "INTEGER",
+          "default": 0
+        }
+      ],
+      "relationships": [],
+      "methods": [],
+      "tenant": {
+        "scoped": true,
+        "mode": "required",
+        "field": "tenantId"
+      },
+      "conflictColumns": [
+        "tenant_id",
+        "slug",
+        "context"
+      ],
+      "surfaces": [],
+      "relationshipFeatures": [
         "uuidColumns"
       ],
       "tags": [],
@@ -220,24 +680,24 @@
   "surfaces": [],
   "prompts": [],
   "relationshipsV2": {
-    "foreignKeyFields": 0,
-    "crossPackageRefFields": 1,
+    "foreignKeyFields": 3,
+    "crossPackageRefFields": 3,
     "junctionCollections": 0,
     "hierarchicalObjects": 0,
     "polymorphicAssociations": 1,
-    "uuidColumns": 6
+    "uuidColumns": 36
   },
   "agentDoc": "# @happyvertical/smrt-comments\n\nRecord discussions attach to arbitrary records through `Comment`'s inherited\n`metaType` and `metaId`; preserve these as a qualified polymorphic pair and\nnever replace them with a text foreign key. `CommentService` owns persistence\nand invokes the optional mention adapter only after the comment is saved.\n\nThe package must not depend on `smrt-messages`: hosts compose\n`CommentMentionNotificationAdapter` with `UserNotificationService` and retain\ntheir own notification delivery policy. The Svelte surface receives authorized\ncomment projections and callbacks; it does not fetch or authorize records.\n`CommentService` requires a trusted actor and host record authorization callback.\n`RecordComments.contextKey` includes tenant, actor and record identity.\nSee [test design](agents/test-design.md) and [idempotent creation](agents/idempotent-create.md) for behavior matrices and retry invariants.\n\nRun `pnpm --filter @happyvertical/smrt-comments test`, `test:postgres`, `typecheck`, `check`, and\n`npx --yes @biomejs/biome@2.5.2 check packages/comments` after changes.\n",
   "moduleDocs": [
     {
       "path": "agents/test-design.md",
       "module": "test-design",
-      "content": "# Comments behavior evidence (#3714)\n\n| Behavior / trigger | Positive / failure | Actor / executor | Runtime / edge | Level / command |\n| --- | --- | --- | --- | --- |\n| Create/read a comment | Persist and reload; deny missing record permission, forged author or tenant | Trusted session actor; same supplied DB handle under tenant context | Node, SQLite/DuckDB/PostgreSQL; polymorphic record authorization callback | Integration, `test` / `test:postgres` |\n| Shared record identity in different tenants | Tenant A sees A; never B | Two tenant contexts, same actor and DB | All three SQL dialects; explicit tenant filter | Integration, `test` / `test:postgres` |\n| Mention creation | Deduplicate and exclude author; malformed UUID rejected | Authorized author, recipient access callback | All three SQL dialects; missing adapter is supported | Integration, `test` / `test:postgres` |\n| Mention delivery | Real UserNotificationService row; denied recipient gets none; replay deduplicates | Supplied notification service/DB | All three SQL dialects; upstream failure leaves saved comment | Integration, `test` / `test:postgres` |\n| UI submission | Trim/post; empty body and rejected callback keep actionable feedback | Host authorized projections | Browser Svelte; async callback | Component, `test` |\n| Actor/record switch during submission | Reset draft; stale success/error cannot mutate new draft | Changed composite contextKey | Browser Svelte; async completion | Component, `test` |\n| Recipe/schema | Recipe includes Comment; generated schema used by real persistence | Registry/test migrator | All three SQL dialects | Integration, `test` / `test:postgres`; `build` |\n\nNew feature, so a base-regression comparison is N/A. Comment insertion is one\nsave on the provided executor, with validation/authorization before mutation.\nNotification delivery intentionally occurs after save and is not atomic with it;\nthe failure test asserts the saved-row contract. Unkeyed creates have no retry contract. Explicit keyed creates now support\nretry recovery; see [idempotent creation](idempotent-create.md).\nThe fixture-only playground does not replace the authenticated record surface.\n\nRecipe metadata follow-up (#3604): the comments catalog group, embedded-only\nnavigation and help are checked in the generated manifest and knowledge artifact\nafter building with refreshed scanner/core artifacts. Model exposure stays off.\nThis change does not affect persistence or delivery; prior three-dialect evidence\nremains applicable. Full package tests, typecheck, Svelte and Biome are rerun.\n\n#3708 follow-up: the browser-only playground renders fixture projections and\naccepts local posts without storage or notification access. Component tests\nverify display, posting, instance isolation and reset on remount. Build assertions\nverify runtime, playground and demo exports in manifest and knowledge artifacts.\nPersistence and authorization are unchanged; existing three-dialect evidence\napplies. Route/settings/shell/provider contracts are N/A because they cannot\nprovide the parent record authorization context.\n\n## Accepted review6084422109 round 1 regressions\n\n- Invalid UUID and 51 distinct mentions: authorized actor, each SQL dialect,\n  failed create must leave zero rows for the record. Baseline failed on SQLite,\n  DuckDB and PostgreSQL; public model setter now validates before the one insert.\n- Actual SQLite CommentService notification rejection composed with the Svelte\n  submit callback: saved row remains, draft remains, alert instructs refresh and\n  checking the discussion before reposting. Baseline produced “Try again”.\n- Commands: full comments `test`, `test:postgres`, `typecheck`, `check`, `build`,\n  and Biome; evidence under `/private/tmp/smrt-track-b-evidence/3714-r1-*`.\n\n## Accepted review6084422109 round 6 persistence-key injection\n\nActor may comment on record A only; another author owns a comment on record B\nin the same tenant. Injecting B's slug/context, with and without its primary id,\nmust create a separate A row and preserve B's identity, author and body. Injected\ndatabase and constructor options must not reach persistence or alter defaults.\nReal SQLite/DuckDB/PostgreSQL baselines fail these assertions; the service now\nallowlists CreateCommentInput and generates identity with insert-only persistence.\nHydration options remain available only on the trusted model path. Full package,\nthree-dialect, type/Svelte, build and Biome evidence: `3714-round6-*` logs.\n"
+      "content": "# Comments behavior evidence (#3714)\n\n| Behavior / trigger | Positive / failure | Actor / executor | Runtime / edge | Level / command |\n| --- | --- | --- | --- | --- |\n| Create/read a comment | Persist and reload; deny missing record permission, forged author or tenant | Trusted session actor; same supplied DB handle under tenant context | Node, SQLite/DuckDB/PostgreSQL; polymorphic record authorization callback | Integration, `test` / `test:postgres` |\n| Shared record identity in different tenants | Tenant A sees A; never B | Two tenant contexts, same actor and DB | All three SQL dialects; explicit tenant filter | Integration, `test` / `test:postgres` |\n| Mention creation | Deduplicate and exclude author; malformed UUID rejected | Authorized author, recipient access callback | All three SQL dialects; missing adapter is supported | Integration, `test` / `test:postgres` |\n| Mention delivery | Real UserNotificationService row; denied recipient gets none; replay deduplicates | Supplied notification service/DB | All three SQL dialects; upstream failure leaves saved comment | Integration, `test` / `test:postgres` |\n| UI submission | Trim/post; empty body and rejected callback keep actionable feedback | Host authorized projections | Browser Svelte; async callback | Component, `test` |\n| Actor/record switch during submission | Reset draft; stale success/error cannot mutate new draft | Changed composite contextKey | Browser Svelte; async completion | Component, `test` |\n| Recipe/schema | Recipe includes Comment; generated schema used by real persistence | Registry/test migrator | All three SQL dialects | Integration, `test` / `test:postgres`; `build` |\n| Participation gate | Authorized post persists its immutable snapshot and pre-moderation status | Trusted actor; host-injected authorizer | All three SQL dialects; deny/banned/rate-limited decision writes no row | Integration, `test` / `test:postgres` |\n| Reply, edit and moderation | Same-record reply, immutable prior-body revision, moderator status transition/report queue | Author or authorized moderator; supplied DB | All three SQL dialects; cross-record reply and another author's edit denied | Integration, `test` / `test:postgres` |\n\nNew feature, so a base-regression comparison is N/A. Comment insertion is one\nsave on the provided executor, with validation/authorization before mutation.\nNotification delivery intentionally occurs after save and is not atomic with it;\nthe failure test asserts the saved-row contract. Unkeyed creates have no retry contract. Explicit keyed creates now support\nretry recovery; see [idempotent creation](idempotent-create.md).\nThe fixture-only playground does not replace the authenticated record surface.\n\nRecipe metadata follow-up (#3604): the comments catalog group, embedded-only\nnavigation and help are checked in the generated manifest and knowledge artifact\nafter building with refreshed scanner/core artifacts. Model exposure stays off.\nThis change does not affect persistence or delivery; prior three-dialect evidence\nremains applicable. Full package tests, typecheck, Svelte and Biome are rerun.\n\n#3708 follow-up: the browser-only playground renders fixture projections and\naccepts local posts without storage or notification access. Component tests\nverify display, posting, instance isolation and reset on remount. Build assertions\nverify runtime, playground and demo exports in manifest and knowledge artifacts.\nPersistence and authorization are unchanged; existing three-dialect evidence\napplies. Route/settings/shell/provider contracts are N/A because they cannot\nprovide the parent record authorization context.\n\n## Accepted review6084422109 round 1 regressions\n\n- Invalid UUID and 51 distinct mentions: authorized actor, each SQL dialect,\n  failed create must leave zero rows for the record. Baseline failed on SQLite,\n  DuckDB and PostgreSQL; public model setter now validates before the one insert.\n- Actual SQLite CommentService notification rejection composed with the Svelte\n  submit callback: saved row remains, draft remains, alert instructs refresh and\n  checking the discussion before reposting. Baseline produced “Try again”.\n- Commands: full comments `test`, `test:postgres`, `typecheck`, `check`, `build`,\n  and Biome; evidence under `/private/tmp/smrt-track-b-evidence/3714-r1-*`.\n\n## Accepted review6084422109 round 6 persistence-key injection\n\nActor may comment on record A only; another author owns a comment on record B\nin the same tenant. Injecting B's slug/context, with and without its primary id,\nmust create a separate A row and preserve B's identity, author and body. Injected\ndatabase and constructor options must not reach persistence or alter defaults.\nReal SQLite/DuckDB/PostgreSQL baselines fail these assertions; the service now\nallowlists CreateCommentInput and generates identity with insert-only persistence.\nHydration options remain available only on the trusted model path. Full package,\nthree-dialect, type/Svelte, build and Biome evidence: `3714-round6-*` logs.\n\n## #3836 generic participation enforcement\n\n| Behavior/invariant | Reachable trigger; positive / negative | Actor/context; executor/transaction | Runtime/dialect; external edge | Test level / validation |\n| --- | --- | --- | --- | --- |\n| Policy selection | Tenant default and exact target override; closed/unknown policy denies | Trusted actor × own/other tenant × mismatched ambient tenant; supplied database | Node SQLite/DuckDB/PostgreSQL; missing policy defaults open | Integration `test`, `test:postgres` |\n| Membership and snapshots | Member allowed with frozen evidence; absent/false/malformed entitlement and upstream rejection deny | Host trusted identity/entitlement, no subscription coupling | All three dialects; optional snapshot and unknown decision values | Integration `test`, `test:postgres` |\n| Ban enforcement | Tenant/target ban denies; expired/other tenant/other target permits | Tenant-bound query independent of ambient context | All three dialects; malformed expiry fails closed | Integration `test`, `test:postgres` |\n| Persisted quota | Concurrent requests never exceed fixed-window quota; actors/tenants isolated, next window permits | Reservation and mutation on same transaction; failure rolls both back | All three dialects; independent service instances sharing DB | Integration `test`, `test:postgres` |\n| Retry identity | Keyed comment replay consumes no additional quota, changed payload denied | Comment runOnce transaction and nested participation transaction use same executor | All three dialects; retained comment retry binding | Integration `test`, `test:postgres` |\n| UI moderation | Pending/reported rows and callback transitions | Authorized host projections; no browser authorization | Browser Svelte; callback errors and parent-specific reply callback | Component `test`, Svelte `check` |\n\nThe generic fixture is a worker co-op project task. New feature: base failure\ncomparison is N/A. Rate windows are fixed UTC epoch windows, per actor/action\nand selected tenant-default or exact-target scope. Policy changes take effect\non subsequent evaluations; concurrent administrative changes are not retroactive.\n\nAuthor edits serialize on a database row write lock and retain the prior body in\nthe same transaction. The failed-save regression proves both history and body\nroll back; foreign-author edits, foreign-tenant moderation and cross-record replies\nare rejected in all three dialects. Models in the recipe include every service\nstorage dependency. Built participation subpath is imported by a standalone Node\nconsumer to verify the runtime export, alongside package typechecking.\n\nAuthor edits also reauthorize participation and spend the comment-action quota;\nbanned and rate-limited edits fail before changing the retained body/history.\n\nVisible edits under pre-moderation return to pending; editing hidden comments\npreserves hidden status. The three-dialect edit test proves both transitions.\n\n## Review6204625041 round 1 accepted regressions\n\n- F1: seed a pre-upgrade parentless request digest, replay with retained receipt,\n  remove receipt, replay again; same comment identity in all three dialects.\n- F2: create with key, edit twice, replay original before/after receipt retention;\n  return current body and reject edited body as a changed create payload.\n- F3: concurrent duplicate reports retain one actor/comment row and one quota unit;\n  receipt cleanup preserves deduplication, excess quota and banned retries deny,\n  hidden/pending/deleted targets deny. SQLite/DuckDB/restricted PostgreSQL.\n- Full comments test/test:postgres plus types, Svelte, build and Biome. Public\n  contract adds report action so quota policy can be configured independently.\n\n## Review6204625041 round 2 R1 regression\n\nWith tenancy interception enabled, create and edit a keyed comment under each\nUUID casing, replay from the opposite casing before/after receipt cleanup.\nThe baseline rejects both original-spelling writes under the canonical guard\ncontext and revision reads under the replay context. Mutation callbacks and\nhistory reads use the stored comment tenant spelling; quota/policy scope remains\ncanonical. The full SQLite/DuckDB/PostgreSQL suite validates the correction.\n\n## PR4039 accepted external feedback / round4\n\n- Canonical parent UUID: keyed reply with uppercase parent succeeds and replays\n  lowercase/uppercase before and after receipt cleanup on all SQL dialects.\n- Notification visibility: pending create and hidden/deleted replay never call\n  the adapter; explicit visible replay can deliver. Approval alone does not notify.\n- Moderation lifecycle: real `_smrt_changes` update exists after moderation save;\n  transaction locks and reloads before save to preserve concurrent body edits.\n- Reply-only component has no root composer before selection, after success or\n  after cancel. Baseline regression run fails five SQLite/DuckDB/component cases.\n"
     },
     {
       "path": "agents/idempotent-create.md",
       "module": "idempotent-create",
-      "content": "# Idempotent comment creation (#3941)\n\n`CommentService.create({...input, idempotencyKey})` returns a `Comment`, including\nits server-generated UUID. Keys are optional, trimmed nonempty strings of at most\n200 characters, unique within a tenant. Omitted keys retain the original create\nbehavior. The service allowlists input: identity, slug, context, executor and\nrequestDigest and retryTenantId cannot be supplied by the caller.\n\nValid UUID tenant/author identities use lowercase for equality, arbitration and\ndigest comparisons. Authorization and stored tenant/author references preserve the\ntrusted actor spelling, including existing SQLite identities. A separate nullable\n`retryTenantId` binds keyed rows to the canonical tenant; its unique index with\n`idempotencyKey` matches arbitration and retention lookup. Opaque textual tenant\nIDs remain case-sensitive, and parent record keys remain exact.\nThe trusted actor and record authorization run before every attempt, including\nreplays. A key binds the actual author, qualified parent, exact body and sorted,\ndeduplicated validated mentions. Reusing a key with different bound content throws\n`CommentIdempotencyError` with code `COMMENT_REQUEST_CONFLICT`. Replays return the\noriginal unchanged comment. A retained receipt referring to a missing or modified\ncomment throws `COMMENT_REQUEST_UNAVAILABLE`, never recreates it.\n\nThe service reuses core `runOnce` for atomic arbitration. Its fixed internal actor\n`smrt-comments.create:v1` is only an arbitration namespace: different authenticated\nauthors racing the same tenant/key must contend together. The actual author is\nbound in the separate immutable request digest. Claim insertion uses core's\nconflict-safe SQL; comment insertion uses the callback's executor and remains\ninsert-only with a random server UUID. Nullable key/digest/retry-tenant fields on Comment retain the binding after normal\ngeneric claim retention. Existing rows need no key or canonical binding.\n\nInternal lookups use parameterized queries against the resolved public\n`CommentCollection.tableName`, honoring `smrt.tableNames` deployment bindings.\nThe table identifier is quoted separately from bound values (mapping configuration\naccepts a single lowercase SQL identifier, not schema-qualified names). Lookups are\nrestricted to canonical retry tenant plus key (or exact authorized parent for\nlisting). The stored tenant must be UUID-equivalent to the authorized tenant before\nhydration in that original tenant scope; no system-context bypass is used. Lists\nmerge legacy exact-scope rows with equivalent-tenant keyed rows, deduplicate by\nserver UUID and sort by public creation timestamp with UUID as a tie-breaker. This\npreserves old unkeyed listing semantics while showing keyed replies across trusted\nactor UUID spellings. Stored tenant and author references are never rewritten.\n\nThe caller's DB must support transactions for keyed creates. Nested transaction\nsupport follows the database adapter: unsupported nested transactions fail before\nwork, rather than silently widening the supplied executor. Hosts needing atomic\ncomment/notification rollback compose the service and notification adapter with\nthe same outer transaction handle. Notification delivery happens after comment\narbitration, including on identical retries. The default messages adapter's stable\ncomment sourceRef deduplicates delivered mentions and retries missing delivery.\nArbitrary adapters must provide their own replay safety; no exactly-once external\ndelivery is promised. Without an outer transaction a delivery failure leaves the\ncomment saved, and retrying the same key is supported.\n\nThe service exposes no edit/delete lifecycle. Trusted model/collection bypasses\nmust preserve key/digest binding. Deleting both the comment and retained core\nclaim intentionally destroys retry history and is outside this contract. Do not\npurge retry history while clients may still retry. Runtime does not create schema;\napply normal SMRT migrations before using keyed creates.\n\n## Test-design contract\n\nAll rows use the authenticated author and explicit tenant context, a real supplied\nDB executor, and SQLite/DuckDB/PostgreSQL unless noted. Commands are package `test`\nand `test:postgres`; public TypeScript contract is also checked by `typecheck`.\n\n| Invariant / reachable trigger | Positive | Negative / failure | Executor / edge / level |\n| --- | --- | --- | --- |\n| Optional keyed create and retry | Same key and normalized mentions return one UUID | Empty, oversized or nonstring keys rejected before mutation | Root DB, public input, integration |\n| Immutable tenant/request binding | Different tenants may reuse key | Changed author, parent, body or mentions conflicts | Authenticated actor, public service, integration |\n| Authorization precedes replay | Authorized replay succeeds | Revoked record access or forged tenant/actor denied | Same DB, host authorization callback, integration |\n| Concurrent arbitration | Simultaneous identical creates produce one row | Competing authors/payloads yield one winner, one typed conflict | Root DB; PostgreSQL outer transactions also remain usable, integration |\n| Transaction affinity | Comment and claim use runOnce callback executor | Caller rollback removes comment, claim and composed notifications | PostgreSQL/SQLite supported nesting; DuckDB rejects unsupported nesting before writes, integration |\n| Delivery recovery | Default notifications replay once per recipient | Partial adapter failure retains comment; same-key retry finishes missing notification | Real messages adapter and supplied DB; integration |\n| Durable binding | All 16 actor/input UUID casing combinations, before/after claim retention, reuse one comment | Deleted/modified retained comment or forged canonical tenant binding is unavailable | Cold concurrent cross-case actors, unique index independent of claim, all dialects |\n| Legacy references/listing | Uppercase Tenant/User references and legacy NULL-binding rows remain usable | Another tenant/parent and differently cased opaque IDs stay isolated | Mixed legacy/keyed order and dedup; old-to-new migration repeat |\n| Persistence-option injection | Generated UUID remains server-owned | Injected id/slug/context/db/digest cannot replace another row | Existing three-dialect regression suite plus keyed case |\n\nNew additive API: baseline rejects `idempotencyKey` at the TypeScript boundary and\nignores it at runtime, creating duplicate rows. Record an executable baseline\nretry failure before final evidence. Browser behavior is unchanged; existing Svelte\nchecks/tests remain required, and a new browser flow is N/A.\n"
+      "content": "# Idempotent comment creation (#3941)\n\n`CommentService.create({...input, idempotencyKey})` returns a `Comment`, including\nits server-generated UUID. Keys are optional, trimmed nonempty strings of at most\n200 characters, unique within a tenant. Omitted keys retain the original create\nbehavior. The service allowlists input: identity, slug, context, executor and\nrequestDigest and retryTenantId cannot be supplied by the caller.\n\nValid UUID tenant/author identities use lowercase for equality, arbitration and\ndigest comparisons. Authorization and stored tenant/author references preserve the\ntrusted actor spelling, including existing SQLite identities. A separate nullable\n`retryTenantId` binds keyed rows to the canonical tenant; its unique index with\n`idempotencyKey` matches arbitration and retention lookup. Opaque textual tenant\nIDs remain case-sensitive, and parent record keys remain exact.\nThe trusted actor and record authorization run before every attempt, including\nreplays. A key binds the actual author, qualified parent, exact body and sorted,\ndeduplicated validated mentions. Reusing a key with different bound content throws\n`CommentIdempotencyError` with code `COMMENT_REQUEST_CONFLICT`. Replays return the\nsame comment identity with its current body after authorized edits. The immutable\ncreation digest is verified against retained revision history when edited; history\nmust remain while the keyed comment is retained. Parentless requests omit the parent\nfield from the v1 digest to preserve pre-thread upgrade bindings. A retained receipt\nreferring to a missing comment or a mismatched creation binding throws\n`COMMENT_REQUEST_UNAVAILABLE`, never recreates it.\n\nThe service reuses core `runOnce` for atomic arbitration. Its fixed internal actor\n`smrt-comments.create:v1` is only an arbitration namespace: different authenticated\nauthors racing the same tenant/key must contend together. The actual author is\nbound in the separate immutable request digest. Claim insertion uses core's\nconflict-safe SQL; comment insertion uses the callback's executor and remains\ninsert-only with a random server UUID. Nullable key/digest/retry-tenant fields on Comment retain the binding after normal\ngeneric claim retention. Existing rows need no key or canonical binding.\n\nInternal lookups use parameterized queries against the resolved public\n`CommentCollection.tableName`, honoring `smrt.tableNames` deployment bindings.\nThe table identifier is quoted separately from bound values (mapping configuration\naccepts a single lowercase SQL identifier, not schema-qualified names). Lookups are\nrestricted to canonical retry tenant plus key (or exact authorized parent for\nlisting). The stored tenant must be UUID-equivalent to the authorized tenant before\nhydration in that original tenant scope; no system-context bypass is used. Lists\nmerge legacy exact-scope rows with equivalent-tenant keyed rows, deduplicate by\nserver UUID and sort by public creation timestamp with UUID as a tie-breaker. This\npreserves old unkeyed listing semantics while showing keyed replies across trusted\nactor UUID spellings. Stored tenant and author references are never rewritten.\n\nThe caller's DB must support transactions for keyed creates. Nested transaction\nsupport follows the database adapter: unsupported nested transactions fail before\nwork, rather than silently widening the supplied executor. Hosts needing atomic\ncomment/notification rollback compose the service and notification adapter with\nthe same outer transaction handle. Notification delivery happens after comment\narbitration, including on identical retries. The default messages adapter's stable\ncomment sourceRef deduplicates delivered mentions and retries missing delivery.\nArbitrary adapters must provide their own replay safety; no exactly-once external\ndelivery is promised. Without an outer transaction a delivery failure leaves the\ncomment saved, and retrying the same key is supported.\n\nThe service exposes no edit/delete lifecycle. Trusted model/collection bypasses\nmust preserve key/digest binding. Deleting both the comment and retained core\nclaim intentionally destroys retry history and is outside this contract. Do not\npurge retry history while clients may still retry. Runtime does not create schema;\napply normal SMRT migrations before using keyed creates.\n\n## Test-design contract\n\nAll rows use the authenticated author and explicit tenant context, a real supplied\nDB executor, and SQLite/DuckDB/PostgreSQL unless noted. Commands are package `test`\nand `test:postgres`; public TypeScript contract is also checked by `typecheck`.\n\n| Invariant / reachable trigger | Positive | Negative / failure | Executor / edge / level |\n| --- | --- | --- | --- |\n| Optional keyed create and retry | Same key and normalized mentions return one UUID | Empty, oversized or nonstring keys rejected before mutation | Root DB, public input, integration |\n| Immutable tenant/request binding | Different tenants may reuse key | Changed author, parent, body or mentions conflicts | Authenticated actor, public service, integration |\n| Authorization precedes replay | Authorized replay succeeds | Revoked record access or forged tenant/actor denied | Same DB, host authorization callback, integration |\n| Concurrent arbitration | Simultaneous identical creates produce one row | Competing authors/payloads yield one winner, one typed conflict | Root DB; PostgreSQL outer transactions also remain usable, integration |\n| Transaction affinity | Comment and claim use runOnce callback executor | Caller rollback removes comment, claim and composed notifications | PostgreSQL/SQLite supported nesting; DuckDB rejects unsupported nesting before writes, integration |\n| Delivery recovery | Default notifications replay once per recipient | Partial adapter failure retains comment; same-key retry finishes missing notification | Real messages adapter and supplied DB; integration |\n| Durable binding | All 16 actor/input UUID casing combinations, before/after claim retention, reuse one comment | Deleted/modified retained comment or forged canonical tenant binding is unavailable | Cold concurrent cross-case actors, unique index independent of claim, all dialects |\n| Legacy references/listing | Uppercase Tenant/User references and legacy NULL-binding rows remain usable | Another tenant/parent and differently cased opaque IDs stay isolated | Mixed legacy/keyed order and dedup; old-to-new migration repeat |\n| Persistence-option injection | Generated UUID remains server-owned | Injected id/slug/context/db/digest cannot replace another row | Existing three-dialect regression suite plus keyed case |\n\nNew additive API: baseline rejects `idempotencyKey` at the TypeScript boundary and\nignores it at runtime, creating duplicate rows. Record an executable baseline\nretry failure before final evidence. Browser behavior is unchanged; existing Svelte\nchecks/tests remain required, and a new browser flow is N/A.\n"
     }
   ],
   "recipes": [
@@ -252,7 +712,12 @@
         "discussion"
       ],
       "models": [
-        "@happyvertical/smrt-comments:Comment"
+        "@happyvertical/smrt-comments:Comment",
+        "@happyvertical/smrt-comments:CommentRevision",
+        "@happyvertical/smrt-comments:CommentReport",
+        "@happyvertical/smrt-comments:ParticipationPolicy",
+        "@happyvertical/smrt-comments:ParticipationBan",
+        "@happyvertical/smrt-comments:ParticipationRateBucket"
       ],
       "nav": [],
       "requires": [],