comisai 1.0.44 → 1.0.46

package/node_modules/@comis/memory/dist/schema-durable-runs.d.ts

@@ -1,6 +1,6 @@
 /**
- * The `durable_runs` table DDL — the durable checkpoint spine the Phase-216
- * resume engine scans on boot (DUR-01/DUR-02/DUR-03). A long-running agent run
+ * The `durable_runs` table DDL — the durable checkpoint spine the resume engine
+ * scans on boot. A long-running agent run
  * writes its `{spawnTree, caps, leaseIds, budgetConsumed, cronOrigin, stepIndex,
  * status, lastHeartbeatAt}` here so a daemon RESTART can find it
  * (`listResumable`), keep it alive (`touchHeartbeat`), and refuse to re-mint a
@@ -9,27 +9,34 @@
  * the in-memory `BoundedAutonomy`/`LeaseManager` are rebuilt FROM it on resume.
  *
  * Forward-only, re-run-safe: create-if-not-exists only, no destructive or
- * reverse DDL (design §9). Extracted from `schema.ts` (which is at the 800-line
- * cap) — `initSchema` CALLS this so the table exists on every boot (Pitfall 5:
- * a table defined here but not wired into initSchema is MISSING at runtime).
+ * reverse DDL. Extracted from `schema.ts` (which is at the 800-line
+ * cap) — `initSchema` CALLS this so the table exists on every boot (a table
+ * defined here but not wired into initSchema is MISSING at runtime).
  *
- * SECURITY (T-216-05, mirrors video_jobs T-189-02): there is NO secret / bearer
+ * SECURITY (mirrors video_jobs): there is NO secret / bearer
  * / token / api_key column. The lease credential is NEVER persisted — only the
  * ATTENUATED `caps` (the result of `attenuateCaps`, never a superset) and the
  * `lease_ids` correlation are stored, and the credential is re-minted FRESH on
  * resume (`data-directory.mdx` invariant). A hand-edited `caps` column is gated by the
- * Plan-01 `parseDurableRunRecord` Zod union before any resume re-mint (T-216-06),
+ * `parseDurableRunRecord` Zod union before any resume re-mint,
  * so a tampered `caps:["admin"]` orphans the run rather than escalating.
  *
- * NEW-1 (the dedicated outward counter): `outward_step` is the SOLE monotonic
+ * The dedicated outward counter: `outward_step` is the SOLE monotonic
  * outward-send counter column, owned ENTIRELY by `allocateOutwardStep`. It seeds
  * at the `-1` 'no outward send yet' sentinel (the value the domain schema permits
- * via `.min(-1)`, NEW-5) so the first `allocateOutwardStep` yields 0.
+ * via `.min(-1)`) so the first `allocateOutwardStep` yields 0.
  * `upsertCheckpoint` MUST NEVER write this column, or a checkpoint between two
- * outward sends would reset the counter and re-introduce HIGH-1. (LOW-1: there
- * is NO coarse per-step index column — the runner is a spawn-orchestrator with
+ * outward sends would reset the counter and re-introduce the duplicate-send bug.
+ * (There is NO coarse per-step index column — the runner is a spawn-orchestrator with
  * no per-step loop, so a coarse marker would be dead state.)
  *
+ * Resumable-orchestrate columns: `script_ref` (the pinned script path relative to
+ * the run workspace) and `checkpoint_ref` (the last checkpoint's ResultRef id) are
+ * additive, nullable, and CONTENT-FREE — pointers, never the script bytes /
+ * checkpoint body / a bearer (INV-5; the no-secret invariant above holds). They make
+ * orchestrate the first RE-RUNNABLE durable kind. `upsertCheckpoint` writes them with
+ * `COALESCE(excluded.x, x)` so a partial upsert preserves the other's prior value.
+ *
  * `better-sqlite3` durability is WAL + path-based chmod (never fd-based file
  * sync), so this DDL is permission-model-safe by construction — no fd-fs guard
  * is needed (mirrors video_jobs / [[node-permission-model-disables-fsync]]).

package/node_modules/@comis/memory/dist/schema-durable-runs.js

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * The `durable_runs` table DDL — the durable checkpoint spine the Phase-216
- * resume engine scans on boot (DUR-01/DUR-02/DUR-03). A long-running agent run
+ * The `durable_runs` table DDL — the durable checkpoint spine the resume engine
+ * scans on boot. A long-running agent run
  * writes its `{spawnTree, caps, leaseIds, budgetConsumed, cronOrigin, stepIndex,
  * status, lastHeartbeatAt}` here so a daemon RESTART can find it
  * (`listResumable`), keep it alive (`touchHeartbeat`), and refuse to re-mint a
@@ -10,27 +10,34 @@
  * the in-memory `BoundedAutonomy`/`LeaseManager` are rebuilt FROM it on resume.
  *
  * Forward-only, re-run-safe: create-if-not-exists only, no destructive or
- * reverse DDL (design §9). Extracted from `schema.ts` (which is at the 800-line
- * cap) — `initSchema` CALLS this so the table exists on every boot (Pitfall 5:
- * a table defined here but not wired into initSchema is MISSING at runtime).
+ * reverse DDL. Extracted from `schema.ts` (which is at the 800-line
+ * cap) — `initSchema` CALLS this so the table exists on every boot (a table
+ * defined here but not wired into initSchema is MISSING at runtime).
  *
- * SECURITY (T-216-05, mirrors video_jobs T-189-02): there is NO secret / bearer
+ * SECURITY (mirrors video_jobs): there is NO secret / bearer
  * / token / api_key column. The lease credential is NEVER persisted — only the
  * ATTENUATED `caps` (the result of `attenuateCaps`, never a superset) and the
  * `lease_ids` correlation are stored, and the credential is re-minted FRESH on
  * resume (`data-directory.mdx` invariant). A hand-edited `caps` column is gated by the
- * Plan-01 `parseDurableRunRecord` Zod union before any resume re-mint (T-216-06),
+ * `parseDurableRunRecord` Zod union before any resume re-mint,
  * so a tampered `caps:["admin"]` orphans the run rather than escalating.
  *
- * NEW-1 (the dedicated outward counter): `outward_step` is the SOLE monotonic
+ * The dedicated outward counter: `outward_step` is the SOLE monotonic
  * outward-send counter column, owned ENTIRELY by `allocateOutwardStep`. It seeds
  * at the `-1` 'no outward send yet' sentinel (the value the domain schema permits
- * via `.min(-1)`, NEW-5) so the first `allocateOutwardStep` yields 0.
+ * via `.min(-1)`) so the first `allocateOutwardStep` yields 0.
  * `upsertCheckpoint` MUST NEVER write this column, or a checkpoint between two
- * outward sends would reset the counter and re-introduce HIGH-1. (LOW-1: there
- * is NO coarse per-step index column — the runner is a spawn-orchestrator with
+ * outward sends would reset the counter and re-introduce the duplicate-send bug.
+ * (There is NO coarse per-step index column — the runner is a spawn-orchestrator with
  * no per-step loop, so a coarse marker would be dead state.)
  *
+ * Resumable-orchestrate columns: `script_ref` (the pinned script path relative to
+ * the run workspace) and `checkpoint_ref` (the last checkpoint's ResultRef id) are
+ * additive, nullable, and CONTENT-FREE — pointers, never the script bytes /
+ * checkpoint body / a bearer (INV-5; the no-secret invariant above holds). They make
+ * orchestrate the first RE-RUNNABLE durable kind. `upsertCheckpoint` writes them with
+ * `COALESCE(excluded.x, x)` so a partial upsert preserves the other's prior value.
+ *
  * `better-sqlite3` durability is WAL + path-based chmod (never fd-based file
  * sync), so this DDL is permission-model-safe by construction — no fd-fs guard
  * is needed (mirrors video_jobs / [[node-permission-model-disables-fsync]]).
@@ -59,10 +66,31 @@ export function ensureDurableRunTable(db) {
       orphan_reason      TEXT,
       last_heartbeat_at  INTEGER NOT NULL,
       created_at_ms      INTEGER NOT NULL,
-      updated_at_ms      INTEGER NOT NULL
+      updated_at_ms      INTEGER NOT NULL,
+      script_ref         TEXT,
+      checkpoint_ref     TEXT
     )
   `);
-    // Partial index for the boot-resume scan (DUR-02) + the heartbeat watchdog's
+    // Partial index for the boot-resume scan + the heartbeat watchdog's
     // stale-running sweep: both filter status='running' and order by the heartbeat.
     db.exec(`CREATE INDEX IF NOT EXISTS idx_durable_runs_resumable ON durable_runs (status, last_heartbeat_at) WHERE status = 'running'`);
+    // Forward-only, re-run-safe migration for the additive {script_ref, checkpoint_ref}
+    // columns. `CREATE TABLE IF NOT EXISTS` is a no-op on a durable_runs table a PRIOR
+    // build (without these columns) already created, so a fresh db gets them from the
+    // CREATE above while an already-created `~/.comis/memory.db` needs this guarded ALTER.
+    // The `PRAGMA table_info` column-exists check makes each ALTER run at most once, so
+    // re-running ensureDurableRunTable never throws (a duplicate ADD COLUMN would). Both
+    // columns are nullable — every prior row reads back NULL (no scriptRef/checkpointRef).
+    // They make orchestrate the first RE-RUNNABLE durable kind: `script_ref` is the pinned
+    // script path relative to the run workspace, `checkpoint_ref` is the last checkpoint's
+    // ResultRef id — CONTENT-FREE pointers, NOT the script bytes / checkpoint body / any
+    // bearer (the no-secret invariant above holds; INV-5). `outward_step` is UNTOUCHED —
+    // the new columns are in no key/index and `upsertCheckpoint` never writes the counter.
+    // The `as { name: string }[]` PRAGMA cast is the sanctioned inline exception to the
+    // untyped-sqlite gate (the schema-outcome-events.ts / schema-video-jobs.ts precedent).
+    const cols = new Set(db.prepare(`PRAGMA table_info(durable_runs)`).all().map((r) => r.name));
+    if (!cols.has("script_ref"))
+        db.exec(`ALTER TABLE durable_runs ADD COLUMN script_ref TEXT`);
+    if (!cols.has("checkpoint_ref"))
+        db.exec(`ALTER TABLE durable_runs ADD COLUMN checkpoint_ref TEXT`);
 }

package/node_modules/@comis/memory/dist/schema-lcd.d.ts

@@ -1,5 +1,5 @@
 /**
- * LCD (Lossless Context DAG) lossless-store schema (Phase 127, F1).
+ * LCD (Lossless Context DAG) lossless-store schema.
  *
  * Extracted from `schema.ts` so the LCD DDL stays cohesive and the umbrella
  * schema module stays under the file-size gate. `initSchema` (in `schema.ts`)
@@ -11,40 +11,38 @@
  */
 import type Database from "better-sqlite3";
 /**
- * Idempotently create the LCD (Lossless Context DAG) lossless message store
- * (Phase 127, F1): `lcd_messages` (one row per turn) + `lcd_message_parts` (one
- * row per structured block) — plus the Phase-129 (C3) compaction tables:
- * `lcd_summaries` (one row per leaf/condensed summary), `lcd_summary_messages`
- * (the leaf→message link, `ON DELETE RESTRICT` on the message FK to ENFORCE
- * losslessness) and `lcd_context_items` (the ordered, dense model-facing view) —
- * plus the Phase-130 (C2) condensed tier table `lcd_summary_parents` (the
- * condensed→child summary edge, `ON DELETE RESTRICT` on the child FK so a
- * condensed child summary is never deleted — losslessness for the multi-tier
- * DAG). Forward-only, re-run-safe — `CREATE … IF NOT EXISTS` only; NO `DROP
- * TABLE` / down-migration (design §9).
- *
- * ## What it persists (F1)
+ * Idempotently create the LCD (Lossless Context DAG) lossless message store:
+ * `lcd_messages` (one row per turn) + `lcd_message_parts` (one row per
+ * structured block) — plus the compaction tables: `lcd_summaries` (one row per
+ * leaf/condensed summary), `lcd_summary_messages` (the leaf→message link,
+ * `ON DELETE RESTRICT` on the message FK to ENFORCE losslessness) and
+ * `lcd_context_items` (the ordered, dense model-facing view) — plus the
+ * condensed tier table `lcd_summary_parents` (the condensed→child summary edge,
+ * `ON DELETE RESTRICT` on the child FK so a condensed child summary is never
+ * deleted — losslessness for the multi-tier DAG). Forward-only, re-run-safe —
+ * `CREATE … IF NOT EXISTS` only; NO `DROP TABLE` / down-migration.
+ *
+ * ## What it persists
  *
  * Every structured block — `text` / `tool_use` / `tool_result` / `reasoning` /
  * `file` — is stored as an `lcd_message_parts` row with its typed tool columns
  * (`tool_call_id` / `tool_name` / `tool_input` / `tool_output` / `is_error`) AND
  * the verbatim canonical pi-ai block in the JSON `metadata` column (which also
- * carries the F2 message envelope + the F3 reasoning marker). The typed columns
+ * carries the message envelope + the reasoning marker). The typed columns
  * are the queryable projection; `metadata.raw` is the lossless source of truth.
  *
- * ## Isolation scope (R4 — ENFORCED Phase 132-03)
+ * ## Isolation scope
  *
  * `lcd_messages` carries `conversation_id` (the tenant+agent+session composite)
  * plus the three broken-out `tenant_id` / `agent_id` / `session_key` columns and
- * the `(conversation_id, seq)` UNIQUE index from day 1. Phase 132-03 (R4) now
- * FILTERS every read by `agent_id` AND `tenant_id` (not just `conversation_id`),
- * closing the Phase-131 WR-02 cross-agent gap (two agents legitimately share one
- * `conversation_id` since `formatSessionKey` omits agentId). The FTS5 vtables
- * carry an `agent_id UNINDEXED` column so the MATCH path filters agent_id too
+ * the `(conversation_id, seq)` UNIQUE index from day 1. Every read FILTERS by
+ * `agent_id` AND `tenant_id` (not just `conversation_id`), closing the
+ * cross-agent gap (two agents legitimately share one `conversation_id` since
+ * `formatSessionKey` omits agentId). The FTS5 vtables carry an
+ * `agent_id UNINDEXED` column so the MATCH path filters agent_id too
  * (forward-only `CREATE VIRTUAL TABLE IF NOT EXISTS` — a pre-existing dev DB
- * created before 132-03 lacks the column and needs a wipe; no migration per
- * design §9). A missing scoping column would be a latent cross-tenant hole
- * (threat T-127-06).
+ * created before the column was added lacks it and needs a wipe; no migration).
+ * A missing scoping column would be a latent cross-tenant hole.
  *
  * ## Cascade
  *
@@ -56,7 +54,7 @@ import type Database from "better-sqlite3";
  *
  * The DDL is a single static `db.exec(...)` with no interpolated identifiers or
  * values — the data-write boundary (INSERT/SELECT with user data) is the
- * `createLcdStore` adapter, which uses static `prepare()` only (threat T-127-07).
+ * `createLcdStore` adapter, which uses static `prepare()` only.
  *
  * @param db - An open better-sqlite3 Database. LCD has no FK into `memories`, so
  *   it may be created in any order relative to the other ensure* tables.

package/node_modules/@comis/memory/dist/schema-lcd.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * LCD (Lossless Context DAG) lossless-store schema (Phase 127, F1).
+ * LCD (Lossless Context DAG) lossless-store schema.
  *
  * Extracted from `schema.ts` so the LCD DDL stays cohesive and the umbrella
  * schema module stays under the file-size gate. `initSchema` (in `schema.ts`)
@@ -12,40 +12,38 @@
  */
 import { ensureTrigramTwins } from "./schema-trigram.js";
 /**
- * Idempotently create the LCD (Lossless Context DAG) lossless message store
- * (Phase 127, F1): `lcd_messages` (one row per turn) + `lcd_message_parts` (one
- * row per structured block) — plus the Phase-129 (C3) compaction tables:
- * `lcd_summaries` (one row per leaf/condensed summary), `lcd_summary_messages`
- * (the leaf→message link, `ON DELETE RESTRICT` on the message FK to ENFORCE
- * losslessness) and `lcd_context_items` (the ordered, dense model-facing view) —
- * plus the Phase-130 (C2) condensed tier table `lcd_summary_parents` (the
- * condensed→child summary edge, `ON DELETE RESTRICT` on the child FK so a
- * condensed child summary is never deleted — losslessness for the multi-tier
- * DAG). Forward-only, re-run-safe — `CREATE … IF NOT EXISTS` only; NO `DROP
- * TABLE` / down-migration (design §9).
+ * Idempotently create the LCD (Lossless Context DAG) lossless message store:
+ * `lcd_messages` (one row per turn) + `lcd_message_parts` (one row per
+ * structured block) — plus the compaction tables: `lcd_summaries` (one row per
+ * leaf/condensed summary), `lcd_summary_messages` (the leaf→message link,
+ * `ON DELETE RESTRICT` on the message FK to ENFORCE losslessness) and
+ * `lcd_context_items` (the ordered, dense model-facing view) — plus the
+ * condensed tier table `lcd_summary_parents` (the condensed→child summary edge,
+ * `ON DELETE RESTRICT` on the child FK so a condensed child summary is never
+ * deleted — losslessness for the multi-tier DAG). Forward-only, re-run-safe —
+ * `CREATE … IF NOT EXISTS` only; NO `DROP TABLE` / down-migration.
  *
- * ## What it persists (F1)
+ * ## What it persists
  *
  * Every structured block — `text` / `tool_use` / `tool_result` / `reasoning` /
  * `file` — is stored as an `lcd_message_parts` row with its typed tool columns
  * (`tool_call_id` / `tool_name` / `tool_input` / `tool_output` / `is_error`) AND
  * the verbatim canonical pi-ai block in the JSON `metadata` column (which also
- * carries the F2 message envelope + the F3 reasoning marker). The typed columns
+ * carries the message envelope + the reasoning marker). The typed columns
  * are the queryable projection; `metadata.raw` is the lossless source of truth.
  *
- * ## Isolation scope (R4 — ENFORCED Phase 132-03)
+ * ## Isolation scope
  *
  * `lcd_messages` carries `conversation_id` (the tenant+agent+session composite)
  * plus the three broken-out `tenant_id` / `agent_id` / `session_key` columns and
- * the `(conversation_id, seq)` UNIQUE index from day 1. Phase 132-03 (R4) now
- * FILTERS every read by `agent_id` AND `tenant_id` (not just `conversation_id`),
- * closing the Phase-131 WR-02 cross-agent gap (two agents legitimately share one
- * `conversation_id` since `formatSessionKey` omits agentId). The FTS5 vtables
- * carry an `agent_id UNINDEXED` column so the MATCH path filters agent_id too
+ * the `(conversation_id, seq)` UNIQUE index from day 1. Every read FILTERS by
+ * `agent_id` AND `tenant_id` (not just `conversation_id`), closing the
+ * cross-agent gap (two agents legitimately share one `conversation_id` since
+ * `formatSessionKey` omits agentId). The FTS5 vtables carry an
+ * `agent_id UNINDEXED` column so the MATCH path filters agent_id too
  * (forward-only `CREATE VIRTUAL TABLE IF NOT EXISTS` — a pre-existing dev DB
- * created before 132-03 lacks the column and needs a wipe; no migration per
- * design §9). A missing scoping column would be a latent cross-tenant hole
- * (threat T-127-06).
+ * created before the column was added lacks it and needs a wipe; no migration).
+ * A missing scoping column would be a latent cross-tenant hole.
  *
  * ## Cascade
  *
@@ -57,7 +55,7 @@ import { ensureTrigramTwins } from "./schema-trigram.js";
  *
  * The DDL is a single static `db.exec(...)` with no interpolated identifiers or
  * values — the data-write boundary (INSERT/SELECT with user data) is the
- * `createLcdStore` adapter, which uses static `prepare()` only (threat T-127-07).
+ * `createLcdStore` adapter, which uses static `prepare()` only.
  *
  * @param db - An open better-sqlite3 Database. LCD has no FK into `memories`, so
  *   it may be created in any order relative to the other ensure* tables.
@@ -66,22 +64,22 @@ export function ensureLcdTables(db) {
     db.exec(`
     CREATE TABLE IF NOT EXISTS lcd_messages (
       id              TEXT PRIMARY KEY,
-      conversation_id TEXT NOT NULL,            -- tenant+agent+session composite (R4 scoping; enforce Phase 132)
+      conversation_id TEXT NOT NULL,            -- tenant+agent+session composite (isolation scoping)
       tenant_id       TEXT NOT NULL,
       agent_id        TEXT NOT NULL,
       session_key     TEXT NOT NULL,
       seq             INTEGER NOT NULL,         -- monotonic PER conversation
       role            TEXT NOT NULL
-        CHECK (role IN ('user', 'assistant', 'toolResult')),  -- IN-01: defense-in-depth; matches LcdRole + the unchecked read-path cast
+        CHECK (role IN ('user', 'assistant', 'toolResult')),  -- defense-in-depth; matches LcdRole + the unchecked read-path cast
       token_count     INTEGER NOT NULL,         -- pre-computed agent-side; the store never computes it
       created_at      INTEGER NOT NULL          -- caller-supplied epoch ms (the store does not stamp it)
     );
-    -- R4 (132-03): seq is monotonic PER (conversation, agent, tenant). Two agents
+    -- seq is monotonic PER (conversation, agent, tenant). Two agents
     -- legitimately share one conversation_id (formatSessionKey omits agentId), so
     -- each agent owns an independent seq sequence (its agent-scoped high-water
     -- mark) — a conversation-global (conversation_id, seq) index would collide
-    -- when both agents append. Per-agent uniqueness; the per-conversation R3
-    -- serializer (132-04/05) still guards interleaved writes. For the common
+    -- when both agents append. Per-agent uniqueness; the per-conversation
+    -- serializer still guards interleaved writes. For the common
     -- one-agent-per-conversation case this is identical to the old index.
     CREATE UNIQUE INDEX IF NOT EXISTS idx_lcd_messages_conv_agent_seq
       ON lcd_messages(conversation_id, agent_id, tenant_id, seq);
@@ -91,7 +89,7 @@ export function ensureLcdTables(db) {
       message_id   TEXT NOT NULL REFERENCES lcd_messages(id) ON DELETE CASCADE,
       ordinal      INTEGER NOT NULL,            -- block order within the message
       kind         TEXT NOT NULL
-        CHECK (kind IN ('text', 'tool_use', 'tool_result', 'reasoning', 'file')),  -- IN-01: defense-in-depth; matches LcdPartKind + the unchecked read-path cast
+        CHECK (kind IN ('text', 'tool_use', 'tool_result', 'reasoning', 'file')),  -- defense-in-depth; matches LcdPartKind + the unchecked read-path cast
       tool_call_id TEXT,                         -- ToolCall.id / ToolResultMessage.toolCallId (NULL for non-tool)
       tool_name    TEXT,                         -- ToolCall.name / ToolResultMessage.toolName
       tool_input   TEXT,                         -- JSON: ToolCall.arguments
@@ -101,18 +99,18 @@ export function ensureLcdTables(db) {
     );
     CREATE INDEX IF NOT EXISTS idx_lcd_parts_msg ON lcd_message_parts(message_id, ordinal);
 
-    -- ── LCD compaction tables (Phase 129, C3) ──────────────────────────────
+    -- ── LCD compaction tables ──────────────────────────────
     -- The depth-0 leaf-summary half of the contract. lcd_summaries holds one
     -- row per leaf summary (a condensation of a contiguous run of messages);
     -- lcd_summary_messages links a summary to the messages it covers; and
     -- lcd_context_items is the ordered model-facing view the assembler walks
     -- (each item references either a raw message or a leaf summary). Condensed
-    -- kinds (depth>0) are Phase 130. Forward-only, re-run-safe (CREATE … IF NOT
-    -- EXISTS only); NO DROP / down-migration (design §9).
+    -- kinds (depth>0) are the condensed tier. Forward-only, re-run-safe (CREATE … IF NOT
+    -- EXISTS only); NO DROP / down-migration.
 
     CREATE TABLE IF NOT EXISTS lcd_summaries (
       summary_id       TEXT PRIMARY KEY,
-      conversation_id  TEXT NOT NULL,            -- tenant+agent+session composite (R4 scoping; enforce Phase 132)
+      conversation_id  TEXT NOT NULL,            -- tenant+agent+session composite (isolation scoping)
       tenant_id        TEXT NOT NULL,
       agent_id         TEXT NOT NULL,
       session_key      TEXT NOT NULL,
@@ -125,7 +123,7 @@ export function ensureLcdTables(db) {
       token_count      INTEGER NOT NULL,         -- pre-computed agent-side; the store never computes it
       content          TEXT NOT NULL,            -- leaf summary plaintext (never logged)
       file_ids         TEXT NOT NULL DEFAULT '[]', -- JSON string[]
-      taint            INTEGER NOT NULL DEFAULT 0, -- 0/1 untrusted-content flag (enforced Phase 132)
+      taint            INTEGER NOT NULL DEFAULT 0, -- 0/1 untrusted-content flag
       fallback         INTEGER NOT NULL DEFAULT 0, -- 0/1 Level-3 deterministic-truncation marker
       created_at       INTEGER NOT NULL          -- caller-supplied epoch ms (the store does not stamp it)
     );
@@ -133,12 +131,12 @@ export function ensureLcdTables(db) {
 
     CREATE TABLE IF NOT EXISTS lcd_summary_messages (
       summary_id TEXT NOT NULL REFERENCES lcd_summaries(summary_id) ON DELETE CASCADE,
-      message_id TEXT NOT NULL REFERENCES lcd_messages(id) ON DELETE RESTRICT,  -- RESTRICT ENFORCES losslessness (Pitfall 5)
+      message_id TEXT NOT NULL REFERENCES lcd_messages(id) ON DELETE RESTRICT,  -- RESTRICT ENFORCES losslessness
       PRIMARY KEY (summary_id, message_id)
     );
     CREATE INDEX IF NOT EXISTS idx_lcd_summary_messages_msg ON lcd_summary_messages(message_id);
 
-    -- ── LCD condensed tier (Phase 130, C2) ─────────────────────────────────
+    -- ── LCD condensed tier ─────────────────────────────────
     -- lcd_summary_parents is the condensed→child summary edge: one row per
     -- (condensed parent summary, child summary it links). It mirrors
     -- lcd_summary_messages but BOTH endpoints are lcd_summaries rows — the
@@ -155,7 +153,7 @@ export function ensureLcdTables(db) {
 
     CREATE TABLE IF NOT EXISTS lcd_context_items (
       id              TEXT PRIMARY KEY,
-      conversation_id TEXT NOT NULL,             -- tenant+agent+session composite (R4 scoping; enforce Phase 132)
+      conversation_id TEXT NOT NULL,             -- tenant+agent+session composite (isolation scoping)
       tenant_id       TEXT NOT NULL,
       agent_id        TEXT NOT NULL,
       session_key     TEXT NOT NULL,
@@ -164,7 +162,7 @@ export function ensureLcdTables(db) {
         CHECK (ref_kind IN ('message','summary')),  -- closed discriminator (AGENTS.md §2.8)
       ref_id          TEXT NOT NULL              -- lcd_messages.id OR lcd_summaries.summary_id
     );
-    -- R4 (132-03): the model-facing view is per (conversation, agent, tenant) —
+    -- The model-facing view is per (conversation, agent, tenant) —
     -- each agent's ordinals are dense + gap-free over ITS OWN items. A
     -- conversation-global (conversation_id, ordinal) index would collide when two
     -- agents sharing a conversation_id each seed a dense 0..N-1 sequence; scoping
@@ -173,14 +171,14 @@ export function ensureLcdTables(db) {
     CREATE UNIQUE INDEX IF NOT EXISTS idx_lcd_ctx_items_conv_agent_ord
       ON lcd_context_items(conversation_id, agent_id, tenant_id, ordinal);
 
-    -- ── Phase 164 (RR1): durable per-conversation ingest cursor ────────────────
+    -- ── Durable per-conversation ingest cursor ────────────────
     -- Stores the durable per-conversation epoch cursor used by the afterTurn
     -- ingest to detect JSONL re-bases (a fresh/disjoint live transcript) and
     -- continue-append without a gap. Primary key = (conversation_id, agent_id,
-    -- tenant_id) — the same three-column R4 isolation scope as lcd_messages.
+    -- tenant_id) — the same three-column isolation scope as lcd_messages.
     -- updated_at is caller-supplied epoch ms (the store never reads the clock).
     -- Forward-only, re-run-safe (CREATE … IF NOT EXISTS only; NO DROP TABLE /
-    -- down-migration — design §9). An existing memory.db gains the empty table at
+    -- down-migration). An existing memory.db gains the empty table at
     -- the next boot; existing conversations have no cursor row (first-turn after
     -- upgrade detects null → treats as epoch A with ingestedLiveLen=0, correct).
     CREATE TABLE IF NOT EXISTS lcd_ingest_cursor (
@@ -193,33 +191,33 @@ export function ensureLcdTables(db) {
       PRIMARY KEY (conversation_id, agent_id, tenant_id)
     );
   `);
-    // ── Phase 172 (DIST-01/03/05): LCD→LTM distillation provenance ─────────
+    // ── LCD→LTM distillation provenance ─────────
     // Links a distilled episodic memory to the LCD condensed summary it came from.
-    // Additive (CREATE IF NOT EXISTS only, forward-only — design §9).
+    // Additive (CREATE IF NOT EXISTS only, forward-only).
     //
-    // FK design decisions (from design/lcd-v3-unified-substrate.md §6.2):
+    // FK design decisions:
     //   memory_id → memories(id) ON DELETE CASCADE:
     //     Auto-deletes provenance row when the distilled memory is deleted.
-    //     This is the correct direction for DIST-05 (--memory cleanup) — a
+    //     This is the correct direction for the --memory cleanup path — a
     //     deleteBySessionKey call removes memories rows and their provenance rows
     //     are swept automatically by the CASCADE.
     //   superseded_by → memories(id) ON DELETE SET NULL:
     //     If the subsuming distilled memory is later deleted, the superseded
     //     provenance row becomes "dormant-eligible" again rather than being
-    //     deleted (conservative / reversible by design — §14 decision 3).
+    //     deleted (conservative / reversible by design).
     //   summary_id is intentionally NOT a FK into lcd_summaries:
     //     Provenance rows must survive LCD resets (which wipe lcd_summaries) so
-    //     that DIST-05 --memory delete can still query source_session_key.
+    //     that the --memory delete path can still query source_session_key.
     db.exec(`
     CREATE TABLE IF NOT EXISTS lcd_memory_provenance (
       provenance_id      TEXT    PRIMARY KEY,
       memory_id          TEXT    NOT NULL
         REFERENCES memories(id) ON DELETE CASCADE,
       summary_id         TEXT    NOT NULL,     -- NOT FK into lcd_summaries (survives LCD resets)
-      source_session_key TEXT    NOT NULL,     -- for DIST-05 --memory delete path
-      conversation_id    TEXT    NOT NULL,     -- R4 isolation column
-      agent_id           TEXT    NOT NULL,     -- R4 isolation column
-      tenant_id          TEXT    NOT NULL,     -- R4 isolation column
+      source_session_key TEXT    NOT NULL,     -- for the --memory delete path
+      conversation_id    TEXT    NOT NULL,     -- tenant/agent isolation column
+      agent_id           TEXT    NOT NULL,     -- tenant/agent isolation column
+      tenant_id          TEXT    NOT NULL,     -- tenant/agent isolation column
       created_at         INTEGER NOT NULL,
       superseded_by      TEXT                 -- memory_id of subsuming distilled memory (pyramid rule)
         REFERENCES memories(id) ON DELETE SET NULL
@@ -234,15 +232,15 @@ export function ensureLcdTables(db) {
       ON lcd_memory_provenance(superseded_by)
       WHERE superseded_by IS NOT NULL;
   `);
-    // ── LCD full-text search (Phase 131, E1 ctx_search) ────────────────────────
-    // TWO FTS5 virtual tables over the lossless store (RESEARCH Open Q1 → two
-    // tables: origin parity, clean per-`scope` query, and PATTERNS gap #1 forces
+    // ── LCD full-text search (ctx_search) ────────────────────────
+    // TWO FTS5 virtual tables over the lossless store (two
+    // tables: origin parity, clean per-`scope` query, and the two tables force
     // different mechanisms — summaries HAVE a `content` column, messages do NOT).
     //
     //   - lcd_summaries_fts : external-content over lcd_summaries.content (mirrors
     //       memory_fts over memories.content, schema.ts:531-565). Kept in sync by
     //       AFTER INSERT/DELETE triggers; the 'rebuild' idiom backfills pre-index
-    //       history (A5).
+    //       history.
     //   - lcd_messages_fts  : SELF-CONTAINED — it stores its OWN content (no
     //       `content=` option), because lcd_messages has NO content column (the
     //       message text is JSON in lcd_message_parts.tool_input/tool_output + text
@@ -252,20 +250,20 @@ export function ensureLcdTables(db) {
     //       table to 'rebuild' from, so pre-index message history is covered by
     //       searchLcd's LIKE fallback (and new appends populate it going forward —
     //       a documented tradeoff). (Storing its own content is also why orphaned
-    //       rows stay matchable until an explicit scoped DELETE — the G10 hole the
-    //       Phase-180 wipe-list close addresses.)
+    //       rows stay matchable until an explicit scoped DELETE — the hole the
+    //       scoped-wipe path closes.)
     //
     // The WHOLE section is wrapped in a try/catch so a host whose better-sqlite3
-    // lacks compiled FTS5 still BOOTS (Pitfall 4 — initSchema must not throw):
+    // lacks compiled FTS5 still BOOTS (initSchema must not throw):
     // searchLcd then detects the missing table and degrades to a LIKE scan. The
     // CREATE statements use `IF NOT EXISTS` (forward-only, re-run-safe — the file's
-    // discipline; NO DROP). No interpolated identifiers/values (T-127-09).
+    // discipline; NO DROP). No interpolated identifiers/values.
     try {
         db.exec(`
       CREATE VIRTUAL TABLE IF NOT EXISTS lcd_summaries_fts USING fts5(
         content,
         conversation_id UNINDEXED,
-        agent_id UNINDEXED,          -- R4: per-agent read isolation (WR-02); flat AND agent_id = ?
+        agent_id UNINDEXED,          -- per-agent read isolation; flat AND agent_id = ?
         summary_id UNINDEXED,
         content='lcd_summaries',
         content_rowid='rowid',
@@ -276,13 +274,13 @@ export function ensureLcdTables(db) {
       CREATE VIRTUAL TABLE IF NOT EXISTS lcd_messages_fts USING fts5(
         content,
         conversation_id UNINDEXED,
-        agent_id UNINDEXED,          -- R4: per-agent read isolation (WR-02); adapter-populated on append
+        agent_id UNINDEXED,          -- per-agent read isolation; adapter-populated on append
         message_id UNINDEXED,
         tokenize='porter unicode61'
       );
     `);
-        // A5 backfill: cover summaries written BEFORE the index existed (RESEARCH A5,
-        // MEDIUM risk if skipped). External-content 'rebuild' idiom (mirror
+        // Backfill: cover summaries written BEFORE the index existed (MEDIUM risk if
+        // skipped). External-content 'rebuild' idiom (mirror
         // schema.ts:545-549) — safe on an empty/just-created table.
         try {
             db.exec(`INSERT INTO lcd_summaries_fts(lcd_summaries_fts) VALUES('rebuild')`);
@@ -309,7 +307,7 @@ export function ensureLcdTables(db) {
         // FTS5 not compiled into this host's better-sqlite3 → boot WITHOUT the index.
         // searchLcd detects the missing table and uses a LIKE scan (never hard-fails).
     }
-    // ── Phase 180 (FTS-01): trigram twins for multilingual search ───────────────
+    // ── Trigram twins for multilingual search ───────────────
     // The self-contained trigram twins (lcd_messages_fts_tri / lcd_summaries_fts_tri
     // / memory_fts_tri) + their base-table delete-mirror triggers. Created LAST, so
     // the LCD/memories base tables exist by now; schema.ts:initSchema picks this up

package/node_modules/@comis/memory/dist/schema-mental-models.d.ts

@@ -1,7 +1,7 @@
 /**
- * The `mental_models` table DDL — the v2.31 Mental Model doc store (generalized
- * from the v2.26 Verified Learning WS2 / SKILL-01 `learned_skills` procedural
- * store). Each row is one advisory doc of `kind ∈ {skill, profile, topic}`
+ * The `mental_models` table DDL — the mental-model doc store (generalized
+ * from the `learned_skills` procedural store). Each row is one advisory doc of
+ * `kind ∈ {skill, profile, topic}`
  * (markdown `body`) distilled from successful trajectories; candidates are
  * admitted here at `trust=learned`, `state=candidate`, and a proof count drives
  * promote/demote/evict. A `kind='skill'` row materializes byte-identically to the
@@ -9,7 +9,7 @@
  *
  * Forward-only, re-run-safe: `CREATE TABLE IF NOT EXISTS` + `CREATE INDEX IF NOT
  * EXISTS` + `CREATE … VIRTUAL TABLE IF NOT EXISTS` only — no reverse DDL, no
- * branch on an old shape (design §9, additive) — PLUS a one-time copy-forward
+ * branch on an old shape (additive) — PLUS a one-time copy-forward
  * REBUILD from a pre-existing `learned_skills` table (below). Extracted from
  * `schema.ts` (which is at the 800-line cap), like `schema-outcome-events.ts` /
  * `schema-video-jobs.ts` — `initSchema` CALLS this so the table exists on every
@@ -24,9 +24,9 @@
  * `params_schema` / `mutating` advisory-metadata columns are KEPT (the surface
  * filter reads `mutating`). The dead `trigger` column is dropped too (zero
  * readers). The new `structured_body` / `history` JSON columns are provisioned
- * NULL this phase (Phase 223 populates `structured_body` via typed delta-ops).
+ * NULL for now (`structured_body` is populated later via typed delta-ops).
  *
- * ## SEC-01 trust ceiling (T-201-05) — the keystone
+ * ## Trust ceiling — the keystone
  *
  * `trust_level TEXT NOT NULL CHECK (trust_level IN ('learned')) DEFAULT 'learned'`
  * makes a learned doc STRUCTURALLY incapable of being `system`: the DB REJECTS
@@ -34,7 +34,7 @@
  * `'learned'` in code (belt-and-suspenders) — a candidate claiming `trust:'system'`
  * is rejected by the DB AND never even reaches the column.
  *
- * ## SEC-01 isolation (T-201-06) — the multi-tenant boundary
+ * ## Tenant/agent isolation — the multi-tenant boundary
  *
  * `(tenant_id, agent_id)` are bare `NOT NULL` columns and lead every key/index;
  * the store filters EVERY statement on them, so a doc under one (tenant, agent)
@@ -67,7 +67,7 @@ import type Database from "better-sqlite3";
  * Safe to call multiple times (all DDL uses IF NOT EXISTS; the copy-forward only
  * fires while a `learned_skills` table still exists). Called from `initSchema`
  * right after `ensureOutcomeEventsTable` so the table exists on every daemon
- * boot. The `CHECK` constraints pin the `trust_level` (the SEC-01 keystone),
+ * boot. The `CHECK` constraints pin the `trust_level` (the trust keystone),
  * `kind`, and `state` closed enums; the `UNIQUE (…)` is the lookup key +
  * idempotency backstop; the index serves the scoped `list()` read.
  *