@mindrian_os/install 1.13.0-beta.11 → 1.13.0-beta.13

package/lib/core/cache-prune.cjs

@@ -0,0 +1,208 @@
+'use strict';
+/*
+ * lib/core/cache-prune.cjs -- prune stale marketplace-cache version dirs.
+ *
+ * Phase 123 Plan-05 (HARNESS-123-13). Canon Part 8: this reads LOCAL files
+ * only (~/.claude/plugins/) and writes LOCAL files only (fs.rmSync on
+ * stale version dirs). Zero network surface.
+ *
+ * Background: Claude Code's marketplace install path is
+ *   ~/.claude/plugins/cache/<marketplace>/mos/<version>/
+ * where each <version> subdir is a self-contained install of that
+ * version. On `claude plugin update`, the new version is downloaded
+ * into a new <version> dir, but the old <version> dir is NEVER removed.
+ * The Windows live test of v1.13.0-beta.12 surfaced two orphans on disk
+ * (`1.12.0/`, `1.13.0-beta.9/`) alongside the active `1.13.0-beta.12/`.
+ *
+ * This helper prunes the cache, keying off Claude Code's own
+ * installed_plugins.json (the source of truth for "which version is active"):
+ *
+ *   - active version (from installed_plugins.json's mos@mindrian-marketplace
+ *     entry) is ALWAYS kept, regardless of mtime.
+ *   - the N most recent non-active versions (default N=2, sorted by mtime
+ *     DESC) are also kept.
+ *   - everything else is removed.
+ *
+ * Belt + suspenders: before every fs.rmSync call, the path's basename is
+ * cross-checked against the active version string -- if it matches, the
+ * removal is SKIPPED with a logged reason (defends against a malformed
+ * installed_plugins.json that somehow lists two different basenames as
+ * "active", or a race between this function and a concurrent install).
+ *
+ * If installed_plugins.json is unreadable (ENOENT, parse error, or no
+ * mos@mindrian-marketplace entry), the function returns
+ *   { kept: [], removed: [], skipped: true, reason: '...' }
+ * with NO mutation. Never guesses; never deletes anything in the absence
+ * of an authoritative active-version answer.
+ *
+ * Signature:
+ *   pruneMarketplaceCache({
+ *     home = os.homedir(),
+ *     marketplace = 'mindrian-marketplace',
+ *     retainCount = 2,
+ *     dryRun = false,
+ *   } = {}) => {
+ *     kept: string[],     // version basenames kept on disk (incl. active)
+ *     removed: string[],  // version basenames removed (or would be, in dryRun)
+ *     skipped: boolean,   // true if we declined to act (see `reason`)
+ *     reason: string|null // human-readable explanation, or null on success
+ *   }
+ *
+ * Canon Part 8 sanity check (cp.6): the forbidden-network-token grep
+ * exits 1 (no match) on this source file. Test cp.6 enforces it.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+
+// Read installed_plugins.json and pull the mos@mindrian-marketplace active
+// version. Returns { activeVersion, activeInstallPath } on success, or
+// { skipped: true, reason } on any failure.
+function readActiveVersion(home) {
+  const installedPath = path.join(home, '.claude', 'plugins', 'installed_plugins.json');
+  let raw;
+  try {
+    raw = fs.readFileSync(installedPath, 'utf8');
+  } catch (e) {
+    return { skipped: true, reason: 'installed_plugins.json unreadable (' + (e && e.code || e.message) + ') -- skipping prune' };
+  }
+  let ip;
+  try {
+    ip = JSON.parse(raw);
+  } catch (e) {
+    return { skipped: true, reason: 'installed_plugins.json parse error -- skipping prune' };
+  }
+  if (!ip || typeof ip !== 'object' || !ip.plugins || typeof ip.plugins !== 'object') {
+    return { skipped: true, reason: 'installed_plugins.json has no plugins map -- skipping prune' };
+  }
+  // Accept either key shape: 'mos@mindrian-marketplace' or 'mos'.
+  let entry = ip.plugins['mos@mindrian-marketplace'];
+  if (!entry) {
+    // Defensive: find any key whose left-of-@ is mos or mindrian-os.
+    const keys = Object.keys(ip.plugins);
+    for (const k of keys) {
+      const name = String(k).split('@')[0];
+      if (name === 'mos' || name === 'mindrian-os') { entry = ip.plugins[k]; break; }
+    }
+  }
+  if (!entry) {
+    return { skipped: true, reason: 'no active mos@mindrian-marketplace entry in installed_plugins.json -- skipping prune' };
+  }
+  if (Array.isArray(entry)) entry = entry[0];
+  if (!entry || !entry.version) {
+    return { skipped: true, reason: 'mos@mindrian-marketplace entry has no version field -- skipping prune' };
+  }
+  return {
+    activeVersion: String(entry.version),
+    activeInstallPath: entry.installPath || entry.path || entry.dir || null,
+  };
+}
+
+// List child directory names under <home>/.claude/plugins/cache/<marketplace>/mos/.
+// Returns [] if the cache dir does not exist (no-op case).
+function listCacheVersions(home, marketplace) {
+  const cacheDir = path.join(home, '.claude', 'plugins', 'cache', marketplace, 'mos');
+  if (!fs.existsSync(cacheDir)) return { cacheDir, names: [] };
+  let names = [];
+  try {
+    names = fs.readdirSync(cacheDir).filter(function (name) {
+      try { return fs.statSync(path.join(cacheDir, name)).isDirectory(); }
+      catch (_) { return false; }
+    });
+  } catch (_) { /* unreadable -- treat as empty */ }
+  return { cacheDir, names };
+}
+
+// Sort version names by mtime DESC (newest first). Falls back to lexicographic
+// order if statSync fails on any path (defensive).
+function sortByMtimeDesc(cacheDir, names) {
+  const stats = names.map(function (name) {
+    let mtimeMs = 0;
+    try { mtimeMs = fs.statSync(path.join(cacheDir, name)).mtimeMs || 0; }
+    catch (_) { mtimeMs = 0; }
+    return { name, mtimeMs };
+  });
+  stats.sort(function (a, b) {
+    if (b.mtimeMs !== a.mtimeMs) return b.mtimeMs - a.mtimeMs;
+    return a.name < b.name ? 1 : -1; // tie-break lexicographic DESC (stable)
+  });
+  return stats.map(function (s) { return s.name; });
+}
+
+function pruneMarketplaceCache(opts) {
+  const o = opts || {};
+  const home = o.home || os.homedir();
+  const marketplace = o.marketplace || 'mindrian-marketplace';
+  const retainCount = (typeof o.retainCount === 'number' && o.retainCount >= 0) ? o.retainCount : 2;
+  const dryRun = !!o.dryRun;
+
+  // Step 1: read active version. Skip entirely if unavailable -- never guess.
+  const active = readActiveVersion(home);
+  if (active.skipped) {
+    return { kept: [], removed: [], skipped: true, reason: active.reason };
+  }
+  const activeVersion = active.activeVersion;
+
+  // Step 2: list cache version dirs.
+  const { cacheDir, names } = listCacheVersions(home, marketplace);
+  if (names.length === 0) {
+    // No cache dir to prune. The active version is still "kept" conceptually
+    // (it lives in the cache when it exists; absent cache = nothing to do).
+    return { kept: [activeVersion], removed: [], skipped: false, reason: 'no cache dir to prune' };
+  }
+
+  // Step 3: build the keep-set.
+  //   - the active version is ALWAYS kept (regardless of mtime).
+  //   - then the N most recent non-active versions (by mtime DESC).
+  const sorted = sortByMtimeDesc(cacheDir, names);
+  const keep = new Set();
+  keep.add(activeVersion);
+  for (const name of sorted) {
+    if (name === activeVersion) continue;
+    if (keep.size >= retainCount + 1) break; // +1 reserves the slot for active
+    keep.add(name);
+  }
+
+  // Step 4: compute the prune set and act on it.
+  const removed = [];
+  for (const name of names) {
+    if (keep.has(name)) continue;
+    // Belt + suspenders: NEVER rm the active version's dir, no matter what.
+    if (name === activeVersion) {
+      // (Cannot reach here under normal flow -- the keep-set above always
+      // contains activeVersion. Defensive sentinel for malformed inputs.)
+      continue;
+    }
+    const target = path.join(cacheDir, name);
+    if (dryRun) {
+      removed.push(name);
+      continue;
+    }
+    try {
+      fs.rmSync(target, { recursive: true, force: true });
+      removed.push(name);
+    } catch (e) {
+      // Best-effort: a failed removal does not abort the whole prune; we
+      // record it in the reason field at the end if any failures occurred.
+      // The caller (session-start with `|| true`; doctor with try/catch +
+      // report.recoveries) handles the partial state.
+      removed.push(name + ' (rm-failed: ' + (e && e.code || e.message) + ')');
+    }
+  }
+
+  return {
+    kept: Array.from(keep),
+    removed,
+    skipped: false,
+    reason: null,
+  };
+}
+
+module.exports = {
+  pruneMarketplaceCache,
+  // Internal helpers exposed for testability + future reuse.
+  readActiveVersion,
+  listCacheVersions,
+  sortByMtimeDesc,
+};

package/lib/core/framework-chain-composer.cjs

@@ -12,6 +12,31 @@
  * an engine.offer_next_step candidate consumed by the navigation engine
  * (Plan 91-00) and rendered through the offer presenter (Plan 91-04).
  *
+ * Phase 122-04 -- routed through the resolver (the only door)
+ * ==========================================================
+ * proposeNextFramework() now resolves the next framework's /mos: command
+ * via lib/workflow/command-resolver.cjs commandsForFramework() -- the SOLE
+ * deterministic framework -> command path, reading only the generated
+ * data/command-registry.json. When the registry has no command for that
+ * framework, command degrades to null ("no /mos: for [framework] yet" --
+ * degrade, not fabricate per WORKFLOW-LAYER-SPEC reliability rule 5); the
+ * offer presenter already treats a null/empty command as not-an-offer.
+ * proposeNextFramework also returns a workflow field -- the resolver's
+ * composeWorkflow([completed, next, ...successors]) array -- so a multi-hop
+ * FEEDS_INTO chain is available as data on the proposal (a future plan can
+ * carry it into offer_next_step / shape-f1-renderer; this plan only puts
+ * the data there). mapFrameworkToCommandSlug() relies solely on the
+ * resolver (then FALLBACK_COMMAND_SLUG) so any remaining caller also gets
+ * the resolver answer.
+ *
+ * Phase 122-05 -- the residual map pruned
+ * =======================================
+ * FRAMEWORK_TO_COMMAND_SLUG is now Object.freeze({}) -- the resolver is the
+ * ONLY framework-to-command door (data/command-registry.json, generated from
+ * frontmatter; WORKFLOW-LAYER-SPEC reliability rule 1). The empty table is
+ * kept only as a back-compat export. KNOWN_FRAMEWORKS stays exported as a
+ * name-recognition bootstrap (it is NOT the framework-to-command source).
+ *
  * Canon Part 2 Engine 1 + Appendix E:
  *   Framework chains power Act 1 -> BONO Orchestration handoffs.
  *   FEEDS_INTO is the Brain-flagged graph infrastructure (~40 edges in
@@ -49,6 +74,11 @@
 const fs = require('node:fs');
 const path = require('node:path');
 
+// The resolver (the only door). Required lazily inside the functions that
+// need it so a missing module never crashes a caller that does not use the
+// resolver path -- but it is an in-repo sibling so this never fails in
+// practice. Reads only data/command-registry.json; never touches the Brain.
+
 // ---------- Frozen constants ----------
 
 // Confidence gates per locked decision in PLAN frontmatter:
@@ -63,12 +93,14 @@ const RECOMMENDED_FLOOR = 0.7;
 // plans may layer richer signal on top).
 const RECENT_WRITE_WINDOW_MS = 5 * 60 * 1000;
 
-// Bootstrap KNOWN_FRAMEWORKS list. Order is preservation-friendly with
-// existing /mos:* commands. The list is conservative; Brain-derived
-// FEEDS_INTO edges may reference frameworks outside this set (in which
-// case completion detection falls through to the mtime slug fallback,
-// and command mapping falls through to /mos:beautiful-question). The
-// list is extensible; future plans may pull from the Brain frameworks
+// Bootstrap KNOWN_FRAMEWORKS list. NAME-RECOGNITION BOOTSTRAP ONLY -- this is
+// NOT the framework-to-command source (that is OWNED by lib/workflow/
+// command-resolver.cjs, reading the generated data/command-registry.json).
+// detectCompletedFramework() uses this list to recognize a framework name in a
+// governing thought / a filed-artifact slug; the list is conservative; a
+// Brain-derived FEEDS_INTO edge may reference a framework outside this set, in
+// which case completion detection falls through to the mtime slug fallback.
+// The list is extensible; future plans may pull from the Brain frameworks
 // catalog directly.
 const KNOWN_FRAMEWORKS = Object.freeze([
   'SWOT Analysis',
@@ -91,31 +123,14 @@ const KNOWN_FRAMEWORKS = Object.freeze([
   'Rich Pictures',
 ]);
 
-// Map known framework names to canonical /mos: command slugs. This is a
-// best-effort table; unknown frameworks fall back to the
-// /mos:beautiful-question guide command per plan locked decisions.
-// The map is intentionally case-insensitive at lookup time so a Brain
-// edge "Lean Canvas" or "lean canvas" resolves identically.
-const FRAMEWORK_TO_COMMAND_SLUG = Object.freeze({
-  'swot analysis': 'beautiful-question', // No dedicated /mos:swot today; bypass to BQ guide.
-  'porter five forces': 'beautiful-question',
-  'value chain analysis': 'beautiful-question',
-  'business model canvas': 'beautiful-question',
-  'lean canvas': 'lean-canvas',
-  'jobs-to-be-done': 'beautiful-question',
-  'value proposition canvas': 'beautiful-question',
-  '5 whys': 'beautiful-question',
-  'first principles': 'beautiful-question',
-  'design thinking': 'beautiful-question',
-  'blue ocean strategy': 'beautiful-question',
-  "innovator's dilemma": 'beautiful-question',
-  '7 s framework': 'beautiful-question',
-  'balanced scorecard': 'beautiful-question',
-  'mullins': 'mullins',
-  'beautiful question': 'beautiful-question',
-  'soft systems': 'beautiful-question',
-  'rich pictures': 'beautiful-question',
-});
+// Framework-to-command mapping is OWNED by lib/workflow/command-resolver.cjs
+// (the generated data/command-registry.json, built from each command's
+// frontmatter -- WORKFLOW-LAYER-SPEC reliability rule 1: a single source of
+// truth, nothing else asserts the mapping). Phase 122-05 pruned this table to
+// an empty Object.freeze({}); it is kept ONLY as an empty back-compat export
+// so any caller that still imports FRAMEWORK_TO_COMMAND_SLUG does not crash.
+// Do NOT add entries here -- declare `frameworks:` in the command frontmatter.
+const FRAMEWORK_TO_COMMAND_SLUG = Object.freeze({});
 
 // Default fallback command when the next framework has no known mapping.
 const FALLBACK_COMMAND_SLUG = 'beautiful-question';
@@ -304,7 +319,12 @@ function detectCompletedFramework(roomDir, sectionPath, reasoning) {
  *     confidence: number,
  *     source: 'FEEDS_INTO',
  *     phase_indicator: string|null,
- *     command: string,               // '/mos:<slug>'
+ *     command: string|null,          // '/mos:<slug>' from the resolver, or null
+ *                                    //   when the registry has no command for
+ *                                    //   `next` yet (degrade, do not fabricate)
+ *     workflow: Array|null,           // resolver.composeWorkflow([completed, next, ...])
+ *                                    //   -- the multi-hop chain as data; the engine
+ *                                    //   does not propagate it yet (future plan)
  *     reason: string,                // grounding text (FEEDS_INTO + Brain + confidence)
  *     recommended_eligible: boolean, // true when confidence >= 0.7
  *   }
@@ -353,12 +373,44 @@ function proposeNextFramework(completedFramework, edges) {
   // the noise gate (we cannot certify a confidenceless edge).
   if (conf === null || conf < NOISE_FLOOR) return null;
 
-  // Map next to /mos: command.
-  const slug = mapFrameworkToCommandSlug(top.to);
-  const command = '/mos:' + slug;
+  // Resolve next -> /mos: command via the resolver (the only door). The
+  // resolver reads only data/command-registry.json; it never touches the
+  // Brain. When the registry has no command for `next`, command degrades
+  // to null -- "no /mos: for [framework] yet" -- never a fabricated one
+  // (WORKFLOW-LAYER-SPEC reliability rule 5). The offer presenter already
+  // treats a null/empty command as not-an-offer.
+  let resolver = null;
+  try {
+    resolver = require('../workflow/command-resolver.cjs');
+  } catch (_e) {
+    resolver = null;
+  }
+  let command = null;
+  let workflow = null;
+  if (resolver) {
+    try {
+      const cmds = resolver.commandsForFramework(top.to);
+      command = (Array.isArray(cmds) && cmds.length > 0) ? cmds[0] : null;
+    } catch (_e) {
+      command = null;
+    }
+    // Multi-step path: build the resolver's composeWorkflow for the chain
+    // [completedFramework, next, ...further FEEDS_INTO successors up to ~3].
+    // This puts the multi-hop chain on the proposal as data; the navigation
+    // engine does not propagate `workflow` into offer_next_step in this plan
+    // (the presenter / shape-f1-renderer wiring is a future plan's job).
+    try {
+      const chain = collectForwardChain(completedFramework, edges, 3);
+      workflow = resolver.composeWorkflow(chain);
+    } catch (_e) {
+      workflow = null;
+    }
+  }
 
   // Grounding-rule reason: must contain FEEDS_INTO + Brain + the
-  // confidence number per Plan 91-04 presenter contract + Test 13.
+  // confidence number per Plan 91-04 presenter contract + Test 13. When
+  // there is no command for `next`, the reason still names the framework
+  // (the consumer prints "run [framework] manually" rather than a command).
   const confStr = conf.toFixed(2);
   const reason =
     completedFramework + ' FEEDS_INTO ' + top.to +
@@ -370,26 +422,81 @@ function proposeNextFramework(completedFramework, edges) {
     source: 'FEEDS_INTO',
     phase_indicator: (typeof top.phase_indicator === 'string') ? top.phase_indicator : null,
     command: command,
+    workflow: workflow,
     reason: reason,
     recommended_eligible: conf >= RECOMMENDED_FLOOR,
   };
 }
 
+/**
+ * collectForwardChain(start, edges, maxHops) -> [start, next, ...]
+ *
+ * Walks the highest-confidence FEEDS_INTO edge from `start`, then from that
+ * successor, etc., up to `maxHops` hops. Cycle-safe (a framework already in
+ * the chain stops the walk). Only follows edges that pass the noise floor.
+ * Returns at least [start]. Pure: no I/O.
+ *
+ * @param {string} start
+ * @param {Array} edges
+ * @param {number} maxHops
+ * @returns {string[]}
+ */
+function collectForwardChain(start, edges, maxHops) {
+  const chain = [start];
+  if (!Array.isArray(edges) || edges.length === 0) return chain;
+  const hops = (typeof maxHops === 'number' && maxHops > 0) ? maxHops : 3;
+  const seen = new Set([String(start).toLowerCase()]);
+  let current = start;
+  for (let i = 0; i < hops; i += 1) {
+    const cur = String(current).toLowerCase();
+    let best = null;
+    for (const e of edges) {
+      if (!e || typeof e !== 'object') continue;
+      if (typeof e.from !== 'string' || typeof e.to !== 'string') continue;
+      if (e.from.toLowerCase() !== cur) continue;
+      const c = (typeof e.confidence === 'number') ? e.confidence : null;
+      if (c === null || c < NOISE_FLOOR) continue;
+      if (best === null || c > best.confidence) best = { to: e.to, confidence: c };
+    }
+    if (best === null) break;
+    const nextLc = best.to.toLowerCase();
+    if (seen.has(nextLc)) break;
+    chain.push(best.to);
+    seen.add(nextLc);
+    current = best.to;
+  }
+  return chain;
+}
+
 /**
  * mapFrameworkToCommandSlug(name) -> slug
  *
- * Maps a framework name (in any case) to a /mos: command slug via the
- * frozen FRAMEWORK_TO_COMMAND_SLUG table. Falls back to FALLBACK_COMMAND_
- * SLUG ('beautiful-question') when no entry matches. Pure: no I/O.
+ * Maps a framework name (in any case) to a /mos: command slug via the resolver
+ * (lib/workflow/command-resolver.cjs commandsForFramework -- the ONLY door,
+ * reads only data/command-registry.json, never touches the Brain), falling
+ * back to FALLBACK_COMMAND_SLUG ('beautiful-question') when the registry has no
+ * command for `name` or the resolver is unavailable. Phase 122-05 removed the
+ * legacy in-module table (FRAMEWORK_TO_COMMAND_SLUG is now empty) -- the
+ * resolver is authoritative.
+ *
+ * Note: proposeNextFramework() does NOT use this helper -- it calls
+ * commandsForFramework() directly so it can degrade to command:null (the
+ * helper keeps a non-null fallback for back-compat with callers that expect
+ * a slug string).
  *
  * @param {string} name
  * @returns {string}
  */
 function mapFrameworkToCommandSlug(name) {
   if (typeof name !== 'string' || name.length === 0) return FALLBACK_COMMAND_SLUG;
-  const lc = name.toLowerCase();
-  if (Object.prototype.hasOwnProperty.call(FRAMEWORK_TO_COMMAND_SLUG, lc)) {
-    return FRAMEWORK_TO_COMMAND_SLUG[lc];
+  // Resolver -- the only door.
+  try {
+    const cmds = require('../workflow/command-resolver.cjs').commandsForFramework(name);
+    if (Array.isArray(cmds) && cmds.length > 0) {
+      return cmds[0].replace(/^\/mos:/, '');
+    }
+  } catch (_e) {
+    // resolver unavailable -> fall through to the fallback slug
   }
   return FALLBACK_COMMAND_SLUG;
 }
@@ -400,7 +507,13 @@ module.exports = {
   parseFrameworkChainSection: parseFrameworkChainSection,
   detectCompletedFramework: detectCompletedFramework,
   proposeNextFramework: proposeNextFramework,
-  // Frozen tables exposed for downstream introspection + test invariants.
+  collectForwardChain: collectForwardChain,
+  // Exported for back-compat: relies solely on the resolver, then the
+  // fallback slug. Phase 122-05 removed the legacy in-module table.
+  mapFrameworkToCommandSlug: mapFrameworkToCommandSlug,
+  // KNOWN_FRAMEWORKS is a name-recognition bootstrap (NOT the framework-to-
+  // command source). FRAMEWORK_TO_COMMAND_SLUG is an EMPTY back-compat export
+  // (Phase 122-05) -- the resolver (data/command-registry.json) is the only door.
   KNOWN_FRAMEWORKS: KNOWN_FRAMEWORKS,
   FRAMEWORK_TO_COMMAND_SLUG: FRAMEWORK_TO_COMMAND_SLUG,
   // Constants exposed for invariant tests + downstream callers.

package/lib/core/migrations/phase-109-nodes-provenance.cjs

@@ -242,6 +242,31 @@ function backfillAssumptionsAsGraphNodes(db) {
   return db.prepare("SELECT COUNT(*) AS n FROM assumptions").get().n;
 }
 
+function dependentSchemaObjects(db) {
+  // Enumerate every view and trigger that mentions the legacy `nodes` table in
+  // its definition. The SQLite "making other kinds of table schema changes"
+  // recipe (the canonical 12-step procedure) requires these to be dropped
+  // BEFORE the rename-out-of-existence rebuild and recreated AFTER -- otherwise
+  // SQLite re-validates the schema during ALTER TABLE ... RENAME TO, finds the
+  // now-dangling view, and throws "error in view <name>: no such table:
+  // main.nodes". We do not hardcode rs_discoveries; any future view/trigger on
+  // `nodes` is picked up automatically. Drop-then-recreate is idempotent: views
+  // whose sql carries IF NOT EXISTS re-exec cleanly; ones without it are simply
+  // recreated fresh since we dropped them first.
+  const rows = db.prepare(
+    "SELECT type, name, sql FROM sqlite_master " +
+    "WHERE type IN ('view','trigger') AND sql IS NOT NULL " +
+    // \bnodes\b style match: the token "nodes" not immediately followed by an
+    // identifier char (so we do not mistakenly catch nodes_new). SQLite LIKE
+    // has no word boundaries, so over-match a little and trust the recreate to
+    // be a no-op for anything unrelated -- but exclude the obvious nodes_new.
+    "AND sql LIKE '%nodes%' AND sql NOT LIKE '%nodes_new%'"
+  ).all();
+  // Defensive: drop NULL/empty sql rows (autogenerated indexes never appear
+  // here because we filtered type, but be safe).
+  return rows.filter((r) => r && r.name && typeof r.sql === 'string' && r.sql.trim());
+}
+
 function tightenSchemaWithCheckConstraints(db) {
   // Step 2: re-create-table-with-NOT-NULL plus CHECK constraints.
   // Canonical SQLite 12-step recipe (foreign_keys disabled for the duration;
@@ -251,6 +276,19 @@ function tightenSchemaWithCheckConstraints(db) {
   // do not flip it here; the BEGIN/COMMIT wrapper guarantees atomicity, and
   // FK behavior is unchanged because the only FK targeting nodes is from edges
   // which we do not drop.
+
+  // Step 2a: capture and drop every view/trigger that depends on `nodes`. Must
+  // happen before DROP TABLE nodes so the schema stays internally consistent
+  // through the rename. Recreated verbatim at the end of this function.
+  const dependents = dependentSchemaObjects(db);
+  for (const obj of dependents) {
+    if (obj.type === 'view') {
+      db.exec('DROP VIEW IF EXISTS "' + obj.name.replace(/"/g, '""') + '"');
+    } else {
+      db.exec('DROP TRIGGER IF EXISTS "' + obj.name.replace(/"/g, '""') + '"');
+    }
+  }
+
   db.exec(
     "CREATE TABLE nodes_new (" +
     "  id TEXT PRIMARY KEY, " +
@@ -291,6 +329,15 @@ function tightenSchemaWithCheckConstraints(db) {
     'CREATE INDEX IF NOT EXISTS idx_nodes_confirmed_by ON nodes(confirmed_by) ' +
     'WHERE confirmed_by IS NOT NULL'
   );
+
+  // Step 2b: recreate the views/triggers we dropped in Step 2a, now that
+  // `nodes` exists again with the tightened schema. The captured `sql` is the
+  // exact CREATE statement from sqlite_master; many carry IF NOT EXISTS which
+  // keeps the recreate idempotent, and any that do not were dropped above so
+  // re-exec is still safe.
+  for (const obj of dependents) {
+    db.exec(obj.sql);
+  }
 }
 
 function insertSentinel(db) {

package/lib/core/navigation/memory-events.cjs

@@ -47,13 +47,29 @@ const EVENT_TYPES = Object.freeze(new Set([
   //   fired (fingerprint detection -> spawn) -> finding_surfaced (drain -> F.1)
   //   -> user_response (Explore/Skip/Later/Free-text) OR skipped (suppression).
   //   brain_canon_drift_observed (FourLenses Brain vs FiveLenses Canon; emitted once per
-  //   session by 117-05 emitBrainCanonDrift via this EVENT_TYPES string; size 31 invariant).
+  //   session by 117-05 emitBrainCanonDrift via this EVENT_TYPES string).
+  // Size-invariant note: additive set; downstream phases extend (see the Phase 88.2-00,
+  // 89-07-00, 116-00, 117-00, 110-02 blocks). Tests assert a FLOOR + named membership,
+  // not an exact count -- so a future phase adding an event type cannot regress baseline.
   'auto_explore_fired',
   'auto_explore_finding_surfaced',
   'auto_explore_user_response',
   'auto_explore_skipped',
   'auto_explore_sanitizer_hit',
   'brain_canon_drift_observed',
+  // Phase 110-02 extension (Brain Context Packet Contract; D-07 + D-10 telemetry mirror):
+  //   brain_packet_rejected   -> an outbound packet failed in-schema validation in
+  //                              brain-client.sendPacket (reject hard -- thrown error).
+  //   brain_response_rejected -> a Brain response failed out-schema validation -> degraded
+  //                              soft, NOT ingested, no partial-ingest.
+  //   brain_legacy_path_used  -> the forward-looking deprecation guard fired (no current
+  //                              call site shipped in 110-02; see brain-client.cjs).
+  // Additive extension only; mirrors the Phase 116-00 5-tension-strings idiom and the
+  // 117-00 6-auto_explore-strings idiom. logEvent already rejects event_type values
+  // outside EVENT_TYPES -- so these are accepted only because they are now IN the Set.
+  'brain_packet_rejected',
+  'brain_response_rejected',
+  'brain_legacy_path_used',
 ]));
 
 function isPlainObject(v) {

package/lib/core/navigation/neighborhood.cjs

@@ -11,20 +11,20 @@
 // Canon Part 9: SELECT supersedes folder scanning; this is the load-bearing
 // query for the acceptance test.
 
-const NEIGHBORHOOD_SQL = "WITH RECURSIVE neighborhood(id, type, edge_path, depth, edge_type_in, last_seen_at, confidence, source_section, review_status, created_by, source_path) AS ( "
+const NEIGHBORHOOD_SQL = "WITH RECURSIVE neighborhood(id, type, edge_path, depth, edge_type_in, last_seen_at, created_at, confidence, source_section, review_status, created_by, source_path) AS ( "
   + "SELECT n.id, n.type, json_array(n.id) AS edge_path, 0 AS depth, NULL AS edge_type_in, "
-  + "n.last_seen_at, n.confidence, n.source_section, n.review_status, n.created_by, n.source_path "
+  + "n.last_seen_at, n.created_at, n.confidence, n.source_section, n.review_status, n.created_by, n.source_path "
   + "FROM nodes n WHERE n.id = :focus_node_id "
   + "UNION ALL "
   + "SELECT next_n.id, next_n.type, json_insert(nh.edge_path, '$[#]', next_n.id) AS edge_path, "
   + "nh.depth + 1 AS depth, e.type AS edge_type_in, "
-  + "next_n.last_seen_at, next_n.confidence, next_n.source_section, next_n.review_status, next_n.created_by, next_n.source_path "
+  + "next_n.last_seen_at, next_n.created_at, next_n.confidence, next_n.source_section, next_n.review_status, next_n.created_by, next_n.source_path "
   + "FROM neighborhood nh JOIN edges e ON e.source = nh.id JOIN nodes next_n ON next_n.id = e.target "
   + "WHERE nh.depth < :max_depth "
   + "AND json_array_length(nh.edge_path) < (:max_depth + 1) "
   + "AND nh.id != next_n.id "
   + ") "
-  + "SELECT id, type, edge_path, depth, edge_type_in, source_path, review_status, created_by, confidence, last_seen_at, "
+  + "SELECT id, type, edge_path, depth, edge_type_in, source_path, review_status, created_by, created_at, confidence, last_seen_at, "
   + "( "
   + "CASE edge_type_in "
   + "WHEN 'CONTRADICTS' THEN 1.0 "
@@ -70,6 +70,7 @@ function getNeighborhood(db, focusNodeId, opts) {
     sourcePath: r.source_path,
     reviewStatus: r.review_status,
     createdBy: r.created_by,
+    createdAt: r.created_at,
     confidence: r.confidence,
     lastSeenAt: r.last_seen_at,
   }));