@mnmal-ai/cortext 1.0.0-alpha.0 → 1.0.0-alpha.10

package/dist/bootstrap.js

@@ -1,5 +1,5 @@
-import { E as isMonotonicAuth, t as createCortextPlugin, w as DEFAULT_AUTH } from "./src-BKaGTnRw.js";
-import { D as ARCHITECTURE_NAMESPACE, k as CORTEXT_NAMESPACE } from "./plugin-27UpMnoE.js";
+import { E as isMonotonicAuth, t as createCortextPlugin, w as DEFAULT_AUTH } from "./src-DAeiNhDw.js";
+import { A as CORTEXT_NAMESPACE, O as ARCHITECTURE_NAMESPACE } from "./plugin-CujP_pvT.js";
 import "./kernel.js";
 import { defineBootstrap } from "@mnmal-ai/substrate/sdk";
 import { z } from "zod";

package/dist/index.js

@@ -1,5 +1,5 @@
-import { C as runCompact, E as isMonotonicAuth, S as registerCompactRoute, T as buildAuthPolicies, _ as TODO_RESOLUTION_ALIASES, a as classSatisfies, b as buildArchitectureNamespace, c as AGENT_RULE_CATEGORY_VOCAB, d as ARCHITECTURE_TYPE_NAMES, f as CLAUDE_TYPE_NAMES, g as HOST_INSTALL_FRAGMENT_STATES, h as HOST_INSTALL_CHECK_STATES, i as bumpClass, l as AGENT_RULE_SEVERITY_ALIASES, m as DECISION_STATUS_VOCAB, n as inferTodoResolution, o as classifySurfaceChange, p as DECISION_STATUS_ALIASES, r as buildReleaseSurface, s as registerOnboardRoute, t as createCortextPlugin, u as AGENT_RULE_SEVERITY_VOCAB, v as TODO_STATUS_ALIASES, w as DEFAULT_AUTH, x as buildClaudeNamespace, y as TODO_STATUS_IMPLIES } from "./src-BKaGTnRw.js";
-import { g as AGENT_MESSAGE_STATUS_VOCAB } from "./plugin-27UpMnoE.js";
+import { C as runCompact, E as isMonotonicAuth, S as registerCompactRoute, T as buildAuthPolicies, _ as TODO_RESOLUTION_ALIASES, a as classSatisfies, b as buildArchitectureNamespace, c as AGENT_RULE_CATEGORY_VOCAB, d as ARCHITECTURE_TYPE_NAMES, f as CLAUDE_TYPE_NAMES, g as HOST_INSTALL_FRAGMENT_STATES, h as HOST_INSTALL_CHECK_STATES, i as bumpClass, l as AGENT_RULE_SEVERITY_ALIASES, m as DECISION_STATUS_VOCAB, n as inferTodoResolution, o as classifySurfaceChange, p as DECISION_STATUS_ALIASES, r as buildReleaseSurface, s as registerOnboardRoute, t as createCortextPlugin, u as AGENT_RULE_SEVERITY_VOCAB, v as TODO_STATUS_ALIASES, w as DEFAULT_AUTH, x as buildClaudeNamespace, y as TODO_STATUS_IMPLIES } from "./src-DAeiNhDw.js";
+import { _ as AGENT_MESSAGE_STATUS_VOCAB } from "./plugin-CujP_pvT.js";
 import "./kernel.js";
 
 export { AGENT_MESSAGE_STATUS_VOCAB, AGENT_RULE_CATEGORY_VOCAB, AGENT_RULE_SEVERITY_ALIASES, AGENT_RULE_SEVERITY_VOCAB, ARCHITECTURE_TYPE_NAMES, CLAUDE_TYPE_NAMES, DECISION_STATUS_ALIASES, DECISION_STATUS_VOCAB, DEFAULT_AUTH, HOST_INSTALL_CHECK_STATES, HOST_INSTALL_FRAGMENT_STATES, TODO_RESOLUTION_ALIASES, TODO_STATUS_ALIASES, TODO_STATUS_IMPLIES, buildArchitectureNamespace, buildAuthPolicies, buildClaudeNamespace, buildReleaseSurface, bumpClass, classSatisfies, classifySurfaceChange, createCortextPlugin, inferTodoResolution, isMonotonicAuth, registerCompactRoute, registerOnboardRoute, runCompact };

package/dist/kernel/cortext-namespace.d.ts

@@ -45,12 +45,12 @@
 export declare const CORTEXT_NAMESPACE = "cortext";
 /**
  * The namespace the architecture-findings surface registers under, and which
- * migration 0002 scopes its body normalization to.
+ * the pre-baseline body-normalization migration was scoped to.
  *
  * Separate from CORTEXT_NAMESPACE because the two have separate operator
  * knobs and diverging lifecycle policies (compaction, retention, audit) — but
  * subject to exactly the same gap, which is why it is stated here rather than
- * left as a bare literal inside 0002.
+ * left as a bare literal inside that migration.
  */
 export declare const ARCHITECTURE_NAMESPACE = "architecture";
 /**

package/dist/kernel/index.d.ts

@@ -8,8 +8,9 @@
 export { ARCHITECTURE_NAMESPACE, CORTEXT_COORDINATOR_NAME, CORTEXT_NAMESPACE } from './cortext-namespace.js';
 export { auditNamespaceCoverage, auditObjects, type Finding, findingMessage, INVARIANT_OBJECTS, type InvariantObject, type PluginNamespace, reportInvariantAudit, resolveCortextNamespaces, scopedNamespace, type UntargetableReason } from './invariant-audit.js';
 export { cortextBaselineMigration } from './migrations/0001_baseline.js';
+export { cortextDropEngineOwnedIndexesMigration, ENGINE_OWNED_INDEXES } from './migrations/0002_drop_engine_owned_indexes.js';
 export { createCortextKernelPlugin } from './plugin.js';
 export { REPAIR_ENV_VAR, type RepairOutcome, repairIfRequested, repairInvariants, repairOutcomeMessage, repairRequested } from './repair.js';
-export { countDuplicateHostInstallKeys, countDuplicateKids, rescopeHostInstallKeyIndex, rescopeKidUniqueIndex, rescopeRecipientIndex, rescopeVocabConstraint, VOCAB_CONSTRAINTS, type VocabConstraint } from './rescope.js';
+export { countDuplicateHostInstallKeys, countDuplicateKids, rescopeHostInstallKeyIndex, rescopeKidUniqueIndex, rescopeVocabConstraint, VOCAB_CONSTRAINTS, type VocabConstraint } from './rescope.js';
 export { SUBSTRATE_CONTRACT_RANGE } from './substrate-contract.js';
 export { AGENT_MESSAGE_STATUS_VOCAB, TODO_LIFECYCLE_VOCAB, TODO_PRIORITY_VOCAB, TODO_RESOLUTION_VOCAB } from './todo-vocab.js';

package/dist/kernel/invariant-audit.d.ts

@@ -51,8 +51,8 @@ export interface InvariantObject {
  * if this list and the migrations disagree — which is the check that actually
  * holds them together.
  *
- * Note there is no `architecture/*` entry, and that is correct: migration 0002
- * is a one-time body normalisation, not a standing invariant. A drifted
+ * Note there is no `architecture/*` entry, and that is correct: the
+ * pre-baseline architecture migration was a one-time body normalisation, not a standing invariant. A drifted
  * architecture namespace means that normalisation never ran for those rows —
  * real, but a different and lesser thing than "kid uniqueness is not held".
  */
@@ -89,6 +89,7 @@ export type Finding =
     readonly kind: 'object_misscoped';
     readonly object: InvariantObject;
     readonly scopedTo: string | null;
+    readonly expected: string;
 }
 /** Present and correctly scoped, but NOT VALID — new writes only. */
  | {
@@ -148,7 +149,7 @@ export declare function scopedNamespace(definition: string): string | null;
  * gains a filter, an early return or a per-object skip, the completion metric
  * reports what was actually inspected instead of a promise.
  */
-export declare function auditObjects(sql: unknown): Promise<{
+export declare function auditObjects(sql: unknown, target?: string): Promise<{
     findings: Finding[];
     checked: number;
 }>;

package/dist/kernel/layout.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Which storage layout `rows` has: one shared table (`legacy`) or a table
+ * partitioned by namespace and type (`partitioned`).
+ *
+ * On a partitioned `rows`, Postgres refuses a UNIQUE index that lacks the
+ * partition keys, and clones every parent-level index and CHECK onto every
+ * other plugin's partitions. So cortext's raw DDL runs on `legacy` only; on
+ * `partitioned` the engine builds cortext's declared and `indexed: true`
+ * indexes per partition.
+ */
+export type StoreLayout = 'legacy' | 'partitioned';
+/**
+ * The layout as the catalog reports it. Migrations read `ctx.layout` instead;
+ * this is for boot-time code, whose lifecycle context does not carry it.
+ */
+export declare function storeLayout(sql: unknown): Promise<StoreLayout>;

package/dist/kernel/migrations/0002_drop_engine_owned_indexes.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Drops the hand-made indexes 0001 used to build on a legacy `rows`, now that
+ * the engine serves the same reads: the derived recipient index for the
+ * inbox, and the `indexed: true` indexes on project and status.
+ *
+ * A partitioned `rows` never had them. Idempotent, like 0001: the runner does
+ * not wrap `apply` in a transaction.
+ */
+import type { KernelMigration } from '@mnmal-ai/substrate/sdk';
+export declare const ENGINE_OWNED_INDEXES: readonly ['rows_agent_message_recipient_idx', 'rows_ns_type_project_idx', 'rows_ns_type_status_idx', 'rows_ns_type_priority_idx', 'rows_cold_start_idx'];
+export declare const cortextDropEngineOwnedIndexesMigration: KernelMigration;

package/dist/kernel/rescope.d.ts

@@ -41,14 +41,6 @@ export declare const VOCAB_CONSTRAINTS: readonly VocabConstraint[];
  * enough to accumulate bad rows.
  */
 export declare function rescopeVocabConstraint(s: Sql, metric: Metric, { constraint, type, column, vocab }: VocabConstraint, namespace: string): Promise<number>;
-/**
- * Re-scope the mailbox inbox index (0003) to `namespace`.
- *
- * Dropped and rebuilt rather than left alongside a correctly-scoped sibling:
- * two partial indexes over the same expression is one the planner can never
- * use, plus write amplification on every AgentMessage insert.
- */
-export declare function rescopeRecipientIndex(s: Sql, namespace: string): Promise<void>;
 /**
  * How many kids would collide if the unique index were scoped to `namespace`.
  *

package/dist/kernel/substrate-contract.d.ts

@@ -16,4 +16,4 @@
  * by reflex: widen it only after reading what the new major changed.
  * `substrate-contract-parity.test.ts` holds the manifest to this literal.
  */
-export declare const SUBSTRATE_CONTRACT_RANGE = ">=1.0.0-alpha.0 <2.0.0";
+export declare const SUBSTRATE_CONTRACT_RANGE = ">=1.0.0-alpha.10 <2.0.0";

package/dist/kernel-bootstrap.js

@@ -1,4 +1,4 @@
-import { t as createCortextKernelPlugin } from "./plugin-27UpMnoE.js";
+import { t as createCortextKernelPlugin } from "./plugin-CujP_pvT.js";
 import { defineBootstrap } from "@mnmal-ai/substrate/sdk";
 import { z } from "zod";
 

package/dist/kernel.js

@@ -1,3 +1,3 @@
-import { C as findingMessage, D as ARCHITECTURE_NAMESPACE, E as scopedNamespace, O as CORTEXT_COORDINATOR_NAME, S as auditObjects, T as resolveCortextNamespaces, _ as TODO_LIFECYCLE_VOCAB, a as repairInvariants, b as INVARIANT_OBJECTS, c as cortextBaselineMigration, d as countDuplicateKids, f as rescopeHostInstallKeyIndex, g as AGENT_MESSAGE_STATUS_VOCAB, h as rescopeVocabConstraint, i as repairIfRequested, k as CORTEXT_NAMESPACE, l as VOCAB_CONSTRAINTS, m as rescopeRecipientIndex, n as SUBSTRATE_CONTRACT_RANGE, o as repairOutcomeMessage, p as rescopeKidUniqueIndex, r as REPAIR_ENV_VAR, s as repairRequested, t as createCortextKernelPlugin, u as countDuplicateHostInstallKeys, v as TODO_PRIORITY_VOCAB, w as reportInvariantAudit, x as auditNamespaceCoverage, y as TODO_RESOLUTION_VOCAB } from "./plugin-27UpMnoE.js";
+import { A as CORTEXT_NAMESPACE, C as auditObjects, D as scopedNamespace, E as resolveCortextNamespaces, O as ARCHITECTURE_NAMESPACE, S as auditNamespaceCoverage, T as reportInvariantAudit, _ as AGENT_MESSAGE_STATUS_VOCAB, a as repairInvariants, b as TODO_RESOLUTION_VOCAB, c as ENGINE_OWNED_INDEXES, d as VOCAB_CONSTRAINTS, f as countDuplicateHostInstallKeys, g as rescopeVocabConstraint, h as rescopeKidUniqueIndex, i as repairIfRequested, k as CORTEXT_COORDINATOR_NAME, l as cortextDropEngineOwnedIndexesMigration, m as rescopeHostInstallKeyIndex, n as SUBSTRATE_CONTRACT_RANGE, o as repairOutcomeMessage, p as countDuplicateKids, r as REPAIR_ENV_VAR, s as repairRequested, t as createCortextKernelPlugin, u as cortextBaselineMigration, v as TODO_LIFECYCLE_VOCAB, w as findingMessage, x as INVARIANT_OBJECTS, y as TODO_PRIORITY_VOCAB } from "./plugin-CujP_pvT.js";
 
-export { AGENT_MESSAGE_STATUS_VOCAB, ARCHITECTURE_NAMESPACE, CORTEXT_COORDINATOR_NAME, CORTEXT_NAMESPACE, INVARIANT_OBJECTS, REPAIR_ENV_VAR, SUBSTRATE_CONTRACT_RANGE, TODO_LIFECYCLE_VOCAB, TODO_PRIORITY_VOCAB, TODO_RESOLUTION_VOCAB, VOCAB_CONSTRAINTS, auditNamespaceCoverage, auditObjects, cortextBaselineMigration, countDuplicateHostInstallKeys, countDuplicateKids, createCortextKernelPlugin, findingMessage, repairIfRequested, repairInvariants, repairOutcomeMessage, repairRequested, reportInvariantAudit, rescopeHostInstallKeyIndex, rescopeKidUniqueIndex, rescopeRecipientIndex, rescopeVocabConstraint, resolveCortextNamespaces, scopedNamespace };
+export { AGENT_MESSAGE_STATUS_VOCAB, ARCHITECTURE_NAMESPACE, CORTEXT_COORDINATOR_NAME, CORTEXT_NAMESPACE, ENGINE_OWNED_INDEXES, INVARIANT_OBJECTS, REPAIR_ENV_VAR, SUBSTRATE_CONTRACT_RANGE, TODO_LIFECYCLE_VOCAB, TODO_PRIORITY_VOCAB, TODO_RESOLUTION_VOCAB, VOCAB_CONSTRAINTS, auditNamespaceCoverage, auditObjects, cortextBaselineMigration, cortextDropEngineOwnedIndexesMigration, countDuplicateHostInstallKeys, countDuplicateKids, createCortextKernelPlugin, findingMessage, repairIfRequested, repairInvariants, repairOutcomeMessage, repairRequested, reportInvariantAudit, rescopeHostInstallKeyIndex, rescopeKidUniqueIndex, rescopeVocabConstraint, resolveCortextNamespaces, scopedNamespace };

package/dist/participants.d.ts

@@ -21,12 +21,26 @@ export declare function isOperator(ctx: RequestContext): boolean;
  * neither is a bystander's call.
  */
 export declare function messageParticipantsOnly(installCtx: NamespaceInstallContext, name: string, inner: RegistryEntryResolver): RegistryEntryResolver;
+/**
+ * AgentIdentity create: a non-operator may not file a row whose `host` is a
+ * machine other than the one its kid names. The fleet audit trusts `host`
+ * (and `roaming` on that host) when it decides who may write a host's
+ * HostInstall rows.
+ */
+export declare function identityCreateGuard(installCtx: NamespaceInstallContext, name: string, inner: RegistryEntryResolver): RegistryEntryResolver;
 /**
  * AgentIdentity update: the identity itself (the caller's kid is the row's
  * kid) or an operator. `kid` is the row's identity, so changing it is an
  * operator act even on your own row: otherwise a row could be renamed onto a
- * kid whose mail it would then receive.
+ * kid whose mail it would then receive. `host` must stay the kid's machine,
+ * and reactivating a retired row is an operator act.
  */
 export declare function identitySelfOnly(installCtx: NamespaceInstallContext, name: string, inner: RegistryEntryResolver): RegistryEntryResolver;
+/**
+ * Todo create/update: `resolution` says why a CLOSED Todo stopped, so a live
+ * Todo carries none. A resolution with a live resulting status is refused,
+ * and moving a Todo back to a live status clears the one it had.
+ */
+export declare function todoResolutionGuard(installCtx: NamespaceInstallContext, name: string, inner: RegistryEntryResolver, statusAliases: Readonly<Record<string, string>>): RegistryEntryResolver;
 /** AgentIdentity delete: operators only. Mail hangs off these rows. */
 export declare function operatorOnly(name: string, inner: RegistryEntryResolver): RegistryEntryResolver;

package/dist/{plugin-27UpMnoE.js → plugin-CujP_pvT.js}

@@ -46,12 +46,12 @@
 const CORTEXT_NAMESPACE = "cortext";
 /**
 * The namespace the architecture-findings surface registers under, and which
-* migration 0002 scopes its body normalization to.
+* the pre-baseline body-normalization migration was scoped to.
 *
 * Separate from CORTEXT_NAMESPACE because the two have separate operator
 * knobs and diverging lifecycle policies (compaction, retention, audit) — but
 * subject to exactly the same gap, which is why it is stated here rather than
-* left as a bare literal inside 0002.
+* left as a bare literal inside that migration.
 */
 const ARCHITECTURE_NAMESPACE = "architecture";
 /**
@@ -96,6 +96,19 @@ const CORTEXT_PROMOTED_COLUMNS = {
 	}
 };
 
+//#endregion
+//#region src/kernel/layout.ts
+/**
+* The layout as the catalog reports it. Migrations read `ctx.layout` instead;
+* this is for boot-time code, whose lifecycle context does not carry it.
+*/
+async function storeLayout(sql) {
+	const [row] = await sql`
+    SELECT c.relkind AS kind FROM pg_class c WHERE c.oid = to_regclass('rows')
+  `;
+	return row?.kind === "p" ? "partitioned" : "legacy";
+}
+
 //#endregion
 //#region src/kernel/invariant-audit.ts
 /**
@@ -141,8 +154,8 @@ const CORTEXT_PROMOTED_COLUMNS = {
 * if this list and the migrations disagree — which is the check that actually
 * holds them together.
 *
-* Note there is no `architecture/*` entry, and that is correct: migration 0002
-* is a one-time body normalisation, not a standing invariant. A drifted
+* Note there is no `architecture/*` entry, and that is correct: the
+* pre-baseline architecture migration was a one-time body normalisation, not a standing invariant. A drifted
 * architecture namespace means that normalisation never ran for those rows —
 * real, but a different and lesser thing than "kid uniqueness is not held".
 */
@@ -159,12 +172,6 @@ const INVARIANT_OBJECTS = [
 		migration: "0001_baseline",
 		guarantee: "Todo.priority is restricted to its controlled vocabulary"
 	},
-	{
-		name: "rows_agent_message_recipient_idx",
-		kind: "index",
-		migration: "0001_baseline",
-		guarantee: "mailbox inbox reads are index-backed rather than heap scans"
-	},
 	{
 		name: "rows_agent_identity_kid_unique",
 		kind: "index",
@@ -280,7 +287,7 @@ async function readCatalog(sql) {
 * gains a filter, an early return or a per-object skip, the completion metric
 * reports what was actually inspected instead of a promise.
 */
-async function auditObjects(sql) {
+async function auditObjects(sql, target = CORTEXT_NAMESPACE) {
 	const catalog = await readCatalog(sql);
 	const findings = [];
 	let checked = 0;
@@ -295,11 +302,12 @@ async function auditObjects(sql) {
 			continue;
 		}
 		const scope = scopedNamespace(row.definition);
-		if (scope !== "cortext") {
+		if (scope !== target) {
 			findings.push({
 				kind: "object_misscoped",
 				object,
-				scopedTo: scope
+				scopedTo: scope,
+				expected: target
 			});
 			continue;
 		}
@@ -320,7 +328,7 @@ function findingMessage(finding) {
 		case "namespace_drifted": return `${head} the cortext coordinator is configured for namespace '${finding.configured}', but every kernel constraint and index is scoped to '${finding.scopedTo}'. So all of them are INACTIVE for '${finding.configured}': Todo/AgentMessage vocabularies unenforced, the mailbox inbox index covering no rows, and AgentIdentity.kid uniqueness NOT held. Writes succeed and queries answer, so nothing else will report this. Use '${finding.scopedTo}', or accept the loss deliberately.`;
 		case "namespace_uncovered": return `${head} invariants are scoped to namespace '${finding.scopedTo}', which no loaded coordinator declares (declared: ${finding.declared.join(", ") || "none"}). Every kernel guarantee below is therefore INACTIVE, and nothing else will report it — a constraint scoped to a namespace with no rows passes trivially. ` + (finding.reason === "host_does_not_attribute" ? "This substrate does not attribute namespaces to their plugin (added in 5.1.0), so which namespace REPLACED it cannot be determined — upgrade the binary to get a named target rather than this list." : "This substrate does attribute, and the cortext coordinator declared no namespace at all — it is not loaded. The objects are orphaned rather than misscoped.") + " Set SYNOPTIC_CORTEXT_REPAIR=1 for one restart to re-scope.";
 		case "object_missing": return `${head} ${finding.object.kind} '${finding.object.name}' (${finding.object.migration}) is ABSENT. Lost guarantee: ${finding.object.guarantee}. Migrations are recorded once by id, so this will NOT be reinstalled by a restart.`;
-		case "object_misscoped": return `${head} ${finding.object.kind} '${finding.object.name}' is scoped to ${finding.scopedTo === null ? "no namespace" : `'${finding.scopedTo}'`}, not '${CORTEXT_NAMESPACE}'. Lost guarantee: ${finding.object.guarantee}. It exists, so nothing errors; it simply matches no rows.`;
+		case "object_misscoped": return `${head} ${finding.object.kind} '${finding.object.name}' is scoped to ${finding.scopedTo === null ? "no namespace" : `'${finding.scopedTo}'`}, not '${finding.expected}'. Lost guarantee: ${finding.object.guarantee}. It exists, so nothing errors; it simply matches no rows.`;
 		case "object_not_validated": return `${head} ${finding.object.kind} '${finding.object.name}' exists but is NOT VALID — enforced for new writes only, and existing rows were never checked against it. Guarantee held only going forward: ${finding.object.guarantee}.`;
 	}
 }
@@ -352,11 +360,14 @@ function findingMessage(finding) {
 * structured channel this belongs in.
 */
 async function reportInvariantAudit(ctx, warn = console.warn) {
-	const findings = [...auditNamespaceCoverage(ctx.coordinatorNamespaces, ctx.coordinatorNamespacesByPlugin)];
+	let findings = [...auditNamespaceCoverage(ctx.coordinatorNamespaces, ctx.coordinatorNamespacesByPlugin)];
+	const target = ctx.coordinatorNamespaces.includes("cortext") ? CORTEXT_NAMESPACE : resolveCortextNamespaces(ctx.coordinatorNamespacesByPlugin)?.[0] ?? "cortext";
 	const catalogRead = ctx.sql !== null && ctx.sql !== void 0;
 	let objectsChecked = 0;
-	if (catalogRead) try {
-		const result = await auditObjects(ctx.sql);
+	const layout = catalogRead ? await storeLayout(ctx.sql).catch(() => "legacy") : null;
+	if (catalogRead && layout === "legacy") try {
+		const result = await auditObjects(ctx.sql, target);
+		if (target !== "cortext" && result.findings.length === 0) findings = findings.filter((f) => f.kind !== "namespace_drifted");
 		findings.push(...result.findings);
 		objectsChecked = result.checked;
 	} catch (error) {
@@ -378,7 +389,8 @@ async function reportInvariantAudit(ctx, warn = console.warn) {
 	ctx.metric("cortext_kernel.invariant_audit_complete", {
 		checked: objectsChecked,
 		findings: findings.length,
-		catalogRead
+		catalogRead,
+		layout
 	});
 	return findings;
 }
@@ -505,24 +517,6 @@ async function rescopeVocabConstraint(s, metric, { constraint, type, column, voc
 	return violations;
 }
 /**
-* Re-scope the mailbox inbox index (0003) to `namespace`.
-*
-* Dropped and rebuilt rather than left alongside a correctly-scoped sibling:
-* two partial indexes over the same expression is one the planner can never
-* use, plus write amplification on every AgentMessage insert.
-*/
-async function rescopeRecipientIndex(s, namespace) {
-	await s.unsafe("DROP INDEX IF EXISTS rows_agent_message_recipient_idx");
-	await s.unsafe(`
-    CREATE INDEX IF NOT EXISTS rows_agent_message_recipient_idx
-      ON rows ((body->>'recipient'), status)
-      WHERE namespace = '${namespace}'
-        AND type = 'AgentMessage'
-        AND deleted_at IS NULL
-        AND archived IS NOT TRUE
-  `);
-}
-/**
 * How many kids would collide if the unique index were scoped to `namespace`.
 *
 * Exposed separately because a UNIQUE index has no `NOT VALID` equivalent —
@@ -606,7 +600,8 @@ async function rescopeHostInstallKeyIndex(s, namespace) {
 //#region src/kernel/migrations/0001_baseline.ts
 const cortextBaselineMigration = {
 	id: "0001_baseline",
-	apply: async ({ sql, metric }) => {
+	apply: async (ctx) => {
+		const { sql, metric } = ctx;
 		if (sql === null) return;
 		const s = sql;
 		await s.unsafe(`
@@ -616,22 +611,12 @@ const cortextBaselineMigration = {
         ADD COLUMN IF NOT EXISTS status   text    NULL,
         ADD COLUMN IF NOT EXISTS priority text    NULL
     `);
-		for (const column of [
-			"archived",
-			"project",
-			"status",
-			"priority"
-		]) await s.unsafe(`
-        CREATE INDEX IF NOT EXISTS rows_ns_type_${column}_idx
-          ON rows (namespace, type, ${column}) WHERE deleted_at IS NULL
-      `);
+		if (ctx.layout === "partitioned") return;
 		await s.unsafe(`
-      CREATE INDEX IF NOT EXISTS rows_cold_start_idx
-        ON rows (namespace, type, project)
-        WHERE deleted_at IS NULL AND archived IS NOT TRUE
+      CREATE INDEX IF NOT EXISTS rows_ns_type_archived_idx
+        ON rows (namespace, type, archived) WHERE deleted_at IS NULL
     `);
 		for (const spec of VOCAB_CONSTRAINTS) await rescopeVocabConstraint(s, metric, spec, CORTEXT_NAMESPACE);
-		await rescopeRecipientIndex(s, CORTEXT_NAMESPACE);
 		await rescopeKidUniqueIndex(s, CORTEXT_NAMESPACE);
 		await rescopeHostInstallKeyIndex(s, CORTEXT_NAMESPACE);
 	},
@@ -644,6 +629,24 @@ const cortextBaselineMigration = {
 	}
 };
 
+//#endregion
+//#region src/kernel/migrations/0002_drop_engine_owned_indexes.ts
+const ENGINE_OWNED_INDEXES = [
+	"rows_agent_message_recipient_idx",
+	"rows_ns_type_project_idx",
+	"rows_ns_type_status_idx",
+	"rows_ns_type_priority_idx",
+	"rows_cold_start_idx"
+];
+const cortextDropEngineOwnedIndexesMigration = {
+	id: "0002_drop_engine_owned_indexes",
+	apply: async ({ sql, layout }) => {
+		if (sql === null || layout === "partitioned") return;
+		await sql.unsafe(`DROP INDEX IF EXISTS ${ENGINE_OWNED_INDEXES.join(", ")}`);
+	},
+	rollback: async () => {}
+};
+
 //#endregion
 //#region src/kernel/repair.ts
 /** The env var that opts a deployment in, for one restart. */
@@ -681,11 +684,6 @@ async function repairInvariants(sql, metric, namespace) {
 			object: spec.constraint
 		});
 	}
-	await rescopeRecipientIndex(s, namespace);
-	outcomes.push({
-		kind: "repaired",
-		object: "rows_agent_message_recipient_idx"
-	});
 	const duplicates = await countDuplicateKids(s, namespace);
 	if (duplicates > 0) outcomes.push({
 		kind: "skipped",
@@ -742,6 +740,11 @@ async function repairIfRequested(ctx, warn = console.warn) {
 		ctx.metric("cortext_kernel.repair_declined", { reason: "target_unknown" });
 		return null;
 	}
+	if (await storeLayout(ctx.sql).catch(() => "legacy") === "partitioned") {
+		warn(`[cortext-kernel] ${REPAIR_ENV_VAR} is set, but rows is partitioned: the engine owns cortext's indexes there and there are no parent-level objects to repair. Nothing to do.`);
+		ctx.metric("cortext_kernel.repair_declined", { reason: "partitioned" });
+		return null;
+	}
 	warn(`[cortext-kernel] ${REPAIR_ENV_VAR} is set — re-scoping kernel invariants to '${ctx.namespace}'. This takes ACCESS EXCLUSIVE on rows and briefly blocks writes.` + (ctx.namespace === "cortext" ? " Target matches the built-in scope literal, so this is a no-op rebuild." : ""));
 	try {
 		const outcomes = await repairInvariants(ctx.sql, ctx.metric, ctx.namespace);
@@ -786,7 +789,7 @@ async function repairIfRequested(ctx, warn = console.warn) {
 * by reflex: widen it only after reading what the new major changed.
 * `substrate-contract-parity.test.ts` holds the manifest to this literal.
 */
-const SUBSTRATE_CONTRACT_RANGE = ">=1.0.0-alpha.0 <2.0.0";
+const SUBSTRATE_CONTRACT_RANGE = ">=1.0.0-alpha.10 <2.0.0";
 
 //#endregion
 //#region src/kernel/plugin.ts
@@ -796,6 +799,7 @@ function createCortextKernelPlugin() {
 		contractVersion: SUBSTRATE_CONTRACT_RANGE,
 		onKernelReady: async (ctx) => {
 			await reportInvariantAudit(ctx);
+			if (!ctx.background) return;
 			await repairIfRequested({
 				sql: ctx.sql,
 				namespace: resolveCortextNamespaces(ctx.coordinatorNamespacesByPlugin)?.[0] ?? null,
@@ -803,9 +807,9 @@ function createCortextKernelPlugin() {
 				metric: ctx.metric
 			});
 		},
-		migrations: [cortextBaselineMigration]
+		migrations: [cortextBaselineMigration, cortextDropEngineOwnedIndexesMigration]
 	};
 }
 
 //#endregion
-export { CORTEXT_PROMOTED_COLUMNS as A, findingMessage as C, ARCHITECTURE_NAMESPACE as D, scopedNamespace as E, CORTEXT_COORDINATOR_NAME as O, auditObjects as S, resolveCortextNamespaces as T, TODO_LIFECYCLE_VOCAB as _, repairInvariants as a, INVARIANT_OBJECTS as b, cortextBaselineMigration as c, countDuplicateKids as d, rescopeHostInstallKeyIndex as f, AGENT_MESSAGE_STATUS_VOCAB as g, rescopeVocabConstraint as h, repairIfRequested as i, CORTEXT_NAMESPACE as k, VOCAB_CONSTRAINTS as l, rescopeRecipientIndex as m, SUBSTRATE_CONTRACT_RANGE as n, repairOutcomeMessage as o, rescopeKidUniqueIndex as p, REPAIR_ENV_VAR as r, repairRequested as s, createCortextKernelPlugin as t, countDuplicateHostInstallKeys as u, TODO_PRIORITY_VOCAB as v, reportInvariantAudit as w, auditNamespaceCoverage as x, TODO_RESOLUTION_VOCAB as y };
+export { CORTEXT_NAMESPACE as A, auditObjects as C, scopedNamespace as D, resolveCortextNamespaces as E, ARCHITECTURE_NAMESPACE as O, auditNamespaceCoverage as S, reportInvariantAudit as T, AGENT_MESSAGE_STATUS_VOCAB as _, repairInvariants as a, TODO_RESOLUTION_VOCAB as b, ENGINE_OWNED_INDEXES as c, VOCAB_CONSTRAINTS as d, countDuplicateHostInstallKeys as f, rescopeVocabConstraint as g, rescopeKidUniqueIndex as h, repairIfRequested as i, CORTEXT_PROMOTED_COLUMNS as j, CORTEXT_COORDINATOR_NAME as k, cortextDropEngineOwnedIndexesMigration as l, rescopeHostInstallKeyIndex as m, SUBSTRATE_CONTRACT_RANGE as n, repairOutcomeMessage as o, countDuplicateKids as p, REPAIR_ENV_VAR as r, repairRequested as s, createCortextKernelPlugin as t, cortextBaselineMigration as u, TODO_LIFECYCLE_VOCAB as v, findingMessage as w, INVARIANT_OBJECTS as x, TODO_PRIORITY_VOCAB as y };

package/dist/release-surface.d.ts

@@ -33,10 +33,9 @@
  * enum, or moving the substrate contract range are all breaks for someone holding
  * data or code against this schema.
  *
- * `indexed` is included and it is not cosmetic: un-indexing a field turns a
- * working `where` filter into an `unindexed_field` rejection. That is a
- * runtime break for a caller who changed nothing, and it would otherwise be
- * invisible to a version-bump decision.
+ * `indexed` is included as a review item, not a break: every field filters,
+ * so un-indexing one turns an index-served `where` into a scan of the type.
+ * The caller's query still works, but slower, and a human should weigh it.
  */
 /** One field, reduced to the properties a consumer can break against. */
 export interface SurfaceField {

package/dist/{src-BKaGTnRw.js → src-DAeiNhDw.js}

@@ -1,5 +1,5 @@
-import { A as CORTEXT_PROMOTED_COLUMNS, D as ARCHITECTURE_NAMESPACE, O as CORTEXT_COORDINATOR_NAME, _ as TODO_LIFECYCLE_VOCAB, g as AGENT_MESSAGE_STATUS_VOCAB, k as CORTEXT_NAMESPACE, n as SUBSTRATE_CONTRACT_RANGE, v as TODO_PRIORITY_VOCAB, y as TODO_RESOLUTION_VOCAB } from "./plugin-27UpMnoE.js";
-import { JSON_HEADERS, RESERVED_AUTOCRUD_FIELDS, ResolverFrameError, and, applyUpdatePatch, createResolverWithEdges, defineNamespace, deleteResolver, denyAll, denyVerbs, field, formatQualifiedKey, getResolver, grantOf, grantedIn, jsonResponse, listResolver, makeCtx, or, queryAll, requireIdentity, resolveEntityRow, resolveIdentity, selectAll, updateResolver } from "@mnmal-ai/substrate/sdk";
+import { A as CORTEXT_NAMESPACE, O as ARCHITECTURE_NAMESPACE, _ as AGENT_MESSAGE_STATUS_VOCAB, b as TODO_RESOLUTION_VOCAB, j as CORTEXT_PROMOTED_COLUMNS, k as CORTEXT_COORDINATOR_NAME, n as SUBSTRATE_CONTRACT_RANGE, v as TODO_LIFECYCLE_VOCAB, y as TODO_PRIORITY_VOCAB } from "./plugin-CujP_pvT.js";
+import { JSON_HEADERS, RESERVED_AUTOCRUD_FIELDS, ResolverFrameError, and, createResolverWithEdges, defineNamespace, deleteResolver, denyAll, denyVerbs, field, formatQualifiedKey, getResolver, grantOf, grantedIn, jsonResponse, listResolver, makeCtx, or, queryAll, requireIdentity, resolveEntityRow, resolveIdentity, selectAll, updateResolver } from "@mnmal-ai/substrate/sdk";
 
 //#region src/auth-policy.ts
 /**
@@ -163,8 +163,12 @@ function parseBody(req) {
 	} catch (err) {
 		return { error: err instanceof Error ? err.message : "invalid JSON" };
 	}
-	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return { dryRun: false };
-	return { dryRun: parsed.dryRun === true };
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return { error: "body must be a JSON object, e.g. {\"dryRun\": true}" };
+	const unknown = Object.keys(parsed).filter((k) => k !== "dryRun");
+	if (unknown.length > 0) return { error: `unknown field(s): ${unknown.join(", ")}` };
+	const dryRun = parsed.dryRun;
+	if (dryRun !== void 0 && typeof dryRun !== "boolean") return { error: "\"dryRun\" must be true or false" };
+	return { dryRun: dryRun === true };
 }
 function registerCompactRoute(router, ctx, retention, namespace, auth = DEFAULT_AUTH) {
 	router.post("/compact", async (req) => {
@@ -295,10 +299,44 @@ function messageParticipantsOnly(installCtx, name, inner) {
 	};
 }
 /**
+* Whether `host` names the machine in `kid`'s `@host` part, ignoring case.
+* A kid with no `@` names no machine, so it may carry no host.
+*/
+function hostMatchesKid(host, kid) {
+	if (host === void 0 || host === null) return true;
+	if (typeof kid !== "string" || !kid.includes("@")) return false;
+	return String(host).toLowerCase() === kid.slice(kid.lastIndexOf("@") + 1).toLowerCase();
+}
+function refuseForeignHost(name, host, kid) {
+	if (hostMatchesKid(host, kid)) return;
+	throw new ResolverFrameError("operator_only", `${name}: 'host' must be the machine in the kid ('${String(kid)}'); only an operator may set another`, { field: "host" });
+}
+/**
+* AgentIdentity create: a non-operator may not file a row whose `host` is a
+* machine other than the one its kid names. The fleet audit trusts `host`
+* (and `roaming` on that host) when it decides who may write a host's
+* HostInstall rows.
+*/
+function identityCreateGuard(installCtx, name, inner) {
+	return async (ctx, args) => {
+		const params = args.params ?? {};
+		if (!isOperator(ctx)) refuseForeignHost(name, params.host, params.kid);
+		if (typeof params.kid === "string") {
+			const { rows } = await (args.dataset ?? installCtx.dataset).read("AgentIdentity", {
+				where: { kid: { eq: params.kid } },
+				limit: 1
+			});
+			if (rows.length > 0) throw new ResolverFrameError("duplicate_kid", `${name}: an AgentIdentity row for '${params.kid}' already exists; update it instead`, { field: "kid" });
+		}
+		return inner(ctx, args);
+	};
+}
+/**
 * AgentIdentity update: the identity itself (the caller's kid is the row's
 * kid) or an operator. `kid` is the row's identity, so changing it is an
 * operator act even on your own row: otherwise a row could be renamed onto a
-* kid whose mail it would then receive.
+* kid whose mail it would then receive. `host` must stay the kid's machine,
+* and reactivating a retired row is an operator act.
 */
 function identitySelfOnly(installCtx, name, inner) {
 	return async (ctx, args) => {
@@ -309,10 +347,45 @@ function identitySelfOnly(installCtx, name, inner) {
 		if (row === null) return inner(ctx, args);
 		const params = args.params ?? {};
 		if ("kid" in params && params.kid !== row.kid) throw new ResolverFrameError("operator_only", `${name}: 'kid' is the row's identity and only an operator may change it`, { field: "kid" });
-		if (callerKid(ctx) === row.kid) return inner(ctx, args);
+		if (callerKid(ctx) === row.kid) {
+			if ("host" in params || "roaming" in params || "project" in params) refuseForeignHost(name, "host" in params ? params.host : row.host, row.kid);
+			if (params.active === true && row.active === false) throw new ResolverFrameError("operator_only", `${name}: a retired identity may only be reactivated by an operator`, { field: "active" });
+			return inner(ctx, args);
+		}
 		throw new ResolverFrameError("not_self", `${name}: only '${String(row.kid)}' itself, or an operator, may edit this identity row`, { id: row.id });
 	};
 }
+/**
+* Todo create/update: `resolution` says why a CLOSED Todo stopped, so a live
+* Todo carries none. A resolution with a live resulting status is refused,
+* and moving a Todo back to a live status clears the one it had.
+*/
+function todoResolutionGuard(installCtx, name, inner, statusAliases) {
+	const canon = (v) => {
+		const s = String(v).trim().toLowerCase();
+		return statusAliases[s] ?? s;
+	};
+	return async (ctx, args) => {
+		const params = { ...args.params ?? {} };
+		const statusGiven = params.status !== void 0 && params.status !== null;
+		let resulting = statusGiven ? canon(params.status) : null;
+		let current = null;
+		const id = rowId(args);
+		if (id !== void 0) {
+			const ds = args.dataset ?? installCtx.dataset;
+			current = await resolveEntityRow(ds, "Todo", id);
+			if (resulting === null && current !== null) resulting = canon(current.status);
+		}
+		if (resulting === null) resulting = "open";
+		if (resulting === "closed") return inner(ctx, args);
+		if (params.resolution !== void 0 && params.resolution !== null) throw new ResolverFrameError("resolution_on_live_todo", `${name}: 'resolution' is for closed Todos; this one would be '${resulting}'`, { field: "resolution" });
+		if (statusGiven && current !== null && current.resolution != null && !("resolution" in params)) params.resolution = null;
+		return inner(ctx, {
+			...args,
+			params
+		});
+	};
+}
 /** AgentIdentity delete: operators only. Mail hangs off these rows. */
 function operatorOnly(name, inner) {
 	return async (ctx, args) => {
@@ -541,12 +614,27 @@ function transitionResolver(installCtx, target) {
 		if (identityRow === void 0) throw new ResolverFrameError("no_recipient", `${name}: the recipient identity row no longer exists`, { id: message.id });
 		const actor = resolveIdentity(ctx);
 		if (actor.id !== identityRow.kid) throw new ResolverFrameError("not_recipient", `${name}: only the recipient ('${String(identityRow.kid)}') may transition this message`, { recipient: identityRow.kid });
-		if (isNoOp(message.status)) return message;
-		const at = ctx.now.toISOString();
-		return applyUpdatePatch(ds, TYPE, message.id, {
-			status: target,
-			...stamp(actor, at)
-		}, ctx, args.onWrite);
+		let current = message;
+		for (let attempt = 0; attempt < 3 && current !== null; attempt++) {
+			if (isNoOp(current.status)) return current;
+			const { matched, row } = await ds.conditionalUpdate(TYPE, current.id, { status: current.status }, {
+				status: target,
+				...stamp(actor, ctx.now.toISOString())
+			}, actor, ctx.now);
+			if (matched && row !== null) {
+				args.onWrite?.({
+					ns: ds.namespace,
+					type: TYPE,
+					id: row.id,
+					operation: "update",
+					row
+				});
+				return row;
+			}
+			current = await resolveEntityRow(ds, TYPE, message.id);
+		}
+		if (current === null) return null;
+		throw new ResolverFrameError("conflict", `${name}: the message kept changing while it was being transitioned; retry`, { id: message.id });
 	};
 }
 /**
@@ -989,7 +1077,8 @@ function buildClaudeNamespace(ns) {
 			area: field.string(),
 			status: field.vocab(TODO_LIFECYCLE_VOCAB, {
 				aliases: TODO_STATUS_ALIASES,
-				implies: TODO_STATUS_IMPLIES
+				implies: TODO_STATUS_IMPLIES,
+				indexed: true
 			}),
 			resolution: field.vocab(TODO_RESOLUTION_VOCAB, {
 				aliases: TODO_RESOLUTION_ALIASES,
@@ -1026,7 +1115,10 @@ function buildClaudeNamespace(ns) {
 				nullable: true,
 				onDelete: "set_null"
 			}),
-			project: field.string({ nullable: true })
+			project: field.string({
+				nullable: true,
+				indexed: true
+			})
 		} },
 		AgentRule: {
 			fields: {
@@ -1045,7 +1137,10 @@ function buildClaudeNamespace(ns) {
 					onDelete: "set_null"
 				}),
 				archived: field.boolean({ default: false }),
-				project: field.string({ nullable: true })
+				project: field.string({
+					nullable: true,
+					indexed: true
+				})
 			},
 			embed: { source: (r) => {
 				return `${embedText(r.synopsis, typeof r.rule === "string" ? r.rule : "")}${typeof r.category === "string" && r.category.length > 0 ? ` [${r.category}]` : ""}`;
@@ -1098,7 +1193,10 @@ function buildClaudeNamespace(ns) {
 				body: field.string({ indexed: false }),
 				synopsis: field.string({ nullable: true }),
 				archived: field.boolean({ default: false }),
-				project: field.string({ nullable: true })
+				project: field.string({
+					nullable: true,
+					indexed: true
+				})
 			},
 			embed: { source: (r) => {
 				const desc = typeof r.description === "string" ? r.description : "";
@@ -1115,7 +1213,10 @@ function buildClaudeNamespace(ns) {
 					indexed: false
 				}),
 				authoredBy: field.struct({ kind: field.string() }),
-				project: field.string({ nullable: true }),
+				project: field.string({
+					nullable: true,
+					indexed: true
+				}),
 				archived: field.boolean({ default: false })
 			},
 			embed: { source: (r) => embedText(r.synopsis, typeof r.body === "string" ? r.body : "") },
@@ -1157,19 +1258,27 @@ function buildClaudeNamespace(ns) {
 			version: field.string(),
 			active: field.boolean()
 		} },
-		AgentIdentity: { fields: {
-			kid: field.string(),
-			project: field.string({ nullable: true }),
-			host: field.string(),
-			displayName: field.string({ nullable: true }),
-			description: field.string({
-				nullable: true,
-				indexed: false
-			}),
-			active: field.boolean({ default: true }),
-			broadcastEligible: field.boolean({ default: true }),
-			roaming: field.boolean({ default: false })
-		} },
+		AgentIdentity: {
+			fields: {
+				kid: field.string(),
+				project: field.string({ nullable: true }),
+				host: field.string(),
+				displayName: field.string({ nullable: true }),
+				description: field.string({
+					nullable: true,
+					indexed: false
+				}),
+				active: field.boolean({ default: true }),
+				broadcastEligible: field.boolean({ default: true }),
+				roaming: field.boolean({ default: false })
+			},
+			indexes: [{
+				fields: ["kid"],
+				unique: true,
+				where: "live",
+				name: "rows_agent_identity_kid_unique"
+			}]
+		},
 		AgentMessage: {
 			autoCrud: false,
 			fields: {
@@ -1199,40 +1308,48 @@ function buildClaudeNamespace(ns) {
 				archived: field.boolean({ default: false })
 			}
 		},
-		HostInstall: { fields: {
-			key: field.string(),
-			host: field.string(),
-			hostReported: field.string(),
-			project: field.string(),
-			kid: field.string({ nullable: true }),
-			harness: field.string(),
-			pluginVersion: field.string({ nullable: true }),
-			fragmentVersion: field.string({ nullable: true }),
-			fragmentDigest: field.string({ nullable: true }),
-			fragmentState: field.enum(HOST_INSTALL_FRAGMENT_STATES),
-			refreshedAt: field.date(),
-			pinState: field.enum(HOST_INSTALL_CHECK_STATES, { nullable: true }),
-			pinNote: field.string({
-				nullable: true,
-				indexed: false
-			}),
-			mcpJsonState: field.enum(HOST_INSTALL_CHECK_STATES, { nullable: true }),
-			mcpJsonNote: field.string({
-				nullable: true,
-				indexed: false
-			}),
-			authorityState: field.enum(HOST_INSTALL_CHECK_STATES, { nullable: true }),
-			authorityNote: field.string({
-				nullable: true,
-				indexed: false
-			}),
-			settingsState: field.enum(HOST_INSTALL_CHECK_STATES, { nullable: true }),
-			settingsNote: field.string({
-				nullable: true,
-				indexed: false
-			}),
-			settingsEnv: field.json({ nullable: true })
-		} }
+		HostInstall: {
+			fields: {
+				key: field.string(),
+				host: field.string(),
+				hostReported: field.string(),
+				project: field.string(),
+				kid: field.string({ nullable: true }),
+				harness: field.string(),
+				pluginVersion: field.string({ nullable: true }),
+				fragmentVersion: field.string({ nullable: true }),
+				fragmentDigest: field.string({ nullable: true }),
+				fragmentState: field.enum(HOST_INSTALL_FRAGMENT_STATES),
+				refreshedAt: field.date(),
+				pinState: field.enum(HOST_INSTALL_CHECK_STATES, { nullable: true }),
+				pinNote: field.string({
+					nullable: true,
+					indexed: false
+				}),
+				mcpJsonState: field.enum(HOST_INSTALL_CHECK_STATES, { nullable: true }),
+				mcpJsonNote: field.string({
+					nullable: true,
+					indexed: false
+				}),
+				authorityState: field.enum(HOST_INSTALL_CHECK_STATES, { nullable: true }),
+				authorityNote: field.string({
+					nullable: true,
+					indexed: false
+				}),
+				settingsState: field.enum(HOST_INSTALL_CHECK_STATES, { nullable: true }),
+				settingsNote: field.string({
+					nullable: true,
+					indexed: false
+				}),
+				settingsEnv: field.json({ nullable: true })
+			},
+			indexes: [{
+				fields: ["key"],
+				unique: true,
+				where: "live",
+				name: "rows_host_install_key_unique"
+			}]
+		}
 	};
 	const definition = defineNamespace(ns, types, {
 		annotations: { nl: CORTEXT_NL_RULINGS },
@@ -1244,7 +1361,13 @@ function buildClaudeNamespace(ns) {
 		install(ctx) {
 			baseInstall(ctx);
 			installMailboxMutations(ctx, definition.types.AgentMessage.fields);
-			for (const [name, wrap] of [["updateAgentIdentity", (r) => identitySelfOnly(ctx, "updateAgentIdentity", r)], ["deleteAgentIdentity", (r) => operatorOnly("deleteAgentIdentity", r)]]) {
+			for (const [name, wrap] of [
+				["createAgentIdentity", (r) => identityCreateGuard(ctx, "createAgentIdentity", r)],
+				["updateAgentIdentity", (r) => identitySelfOnly(ctx, "updateAgentIdentity", r)],
+				["deleteAgentIdentity", (r) => operatorOnly("deleteAgentIdentity", r)],
+				["createTodo", (r) => todoResolutionGuard(ctx, "createTodo", r, TODO_STATUS_ALIASES)],
+				["updateTodo", (r) => todoResolutionGuard(ctx, "updateTodo", r, TODO_STATUS_ALIASES)]
+			]) {
 				const entry = ctx.registry.get(name);
 				if (entry === void 0) throw new Error(`cortext: autoCRUD did not register ${name}`);
 				ctx.registry.replace(name, {
@@ -1592,7 +1715,11 @@ function buildBody(namespace, retention) {
 			description: "Load recent context at the start of each session",
 			query: {
 				SessionLog: {
-					params: { limit: 3 },
+					params: {
+						where: { archived: { eq: false } },
+						orderBy: [{ createdAt: "desc" }],
+						limit: 3
+					},
 					fields: {
 						id: true,
 						branch: true,
@@ -1602,7 +1729,11 @@ function buildBody(namespace, retention) {
 					}
 				},
 				Decision: {
-					params: { limit: 80 },
+					params: {
+						where: { archived: { eq: false } },
+						orderBy: [{ createdAt: "desc" }],
+						limit: 80
+					},
 					fields: {
 						id: true,
 						topic: true,
@@ -1615,7 +1746,18 @@ function buildBody(namespace, retention) {
 					}
 				},
 				Todo: {
-					params: { limit: 50 },
+					params: {
+						where: {
+							archived: { eq: false },
+							status: { in: [
+								"open",
+								"in_progress",
+								"blocked"
+							] }
+						},
+						orderBy: [{ createdAt: "desc" }],
+						limit: 50
+					},
 					fields: {
 						id: true,
 						title: true,
@@ -1631,7 +1773,7 @@ function buildBody(namespace, retention) {
 			surfaceToUser: [
 				"The 3 most recent non-archived SessionLog entries",
 				"Non-archived Decisions",
-				"Todos with status 'open' or 'blocked'",
+				"Todos with status 'open', 'in_progress' or 'blocked'",
 				"Skip archived records silently"
 			]
 		} },
@@ -1697,10 +1839,9 @@ function registerOnboardRoute(router, _ctx, retention, namespace) {
 * enum, or moving the substrate contract range are all breaks for someone holding
 * data or code against this schema.
 *
-* `indexed` is included and it is not cosmetic: un-indexing a field turns a
-* working `where` filter into an `unindexed_field` rejection. That is a
-* runtime break for a caller who changed nothing, and it would otherwise be
-* invisible to a version-bump decision.
+* `indexed` is included as a review item, not a break: every field filters,
+* so un-indexing one turns an index-served `where` into a scan of the type.
+* The caller's query still works, but slower, and a human should weigh it.
 */
 function reduceField(raw) {
 	const nullable = raw.nullable === true;
@@ -1791,7 +1932,7 @@ function classifySurfaceChange(before, after) {
 			if (!bf.required && af.required) breaking.push(`field became REQUIRED: ${at}`);
 			if (bf.required && !af.required) additive.push(`field relaxed to optional: ${at}`);
 			if (bf.nullable && !af.nullable) breaking.push(`field no longer nullable: ${at}`);
-			if (bf.indexed && !af.indexed) breaking.push(`field no longer indexed: ${at}`);
+			if (bf.indexed && !af.indexed) review.push(`field no longer indexed: ${at}`);
 			if (!bf.indexed && af.indexed) additive.push(`field now indexed: ${at}`);
 			const bEnum = bf.enum ?? null;
 			const aEnum = af.enum ?? null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnmal-ai/cortext",
-  "version": "1.0.0-alpha.0",
+  "version": "1.0.0-alpha.10",
   "description": "Cortext: the agent-neutral coordination context store for Substrate (Todos, Decisions, SessionLogs, AgentRules, Memory, Concepts, Councils, …) plus architecture findings. One package carrying two plugins: the coordinator that registers the namespaces, and the kernel plugin that owns their Postgres invariants.",
   "license": "Apache-2.0",
   "repository": {
@@ -62,10 +62,10 @@
     "zod": "^4.6.5"
   },
   "peerDependencies": {
-    "@mnmal-ai/substrate": ">=1.0.0-alpha.0 <2.0.0"
+    "@mnmal-ai/substrate": ">=1.0.0-alpha.10 <2.0.0"
   },
   "devDependencies": {
-    "@mnmal-ai/substrate": "1.0.0-alpha.0",
+    "@mnmal-ai/substrate": "1.0.0-alpha.10",
     "@types/node": "^26.6.4",
     "tsdown": "^0.23.0",
     "typescript": "^7.0.2",