create-walle 0.10.2 → 0.10.3

package/template/wall-e/brain/brain-sync-v2.js

@@ -0,0 +1,578 @@
+'use strict';
+
+// WP-1 (docs/shared-memory-every-machine-2026-10-31.html §5 D-3/D-4/D-8/D-9/D-10/D-12, §6.4):
+// the storage half of the v2 change feed — a version-vector addressed feed plus the one
+// transaction that applies a page of it.
+//
+//   readVector(db)                          -> { instanceId, vector, clockSeedDone }
+//   changesSince(db, { since, limit })      -> { entries, more, clockSeedDone }
+//   applyChanges(db, { sourceInstanceId, entries }) -> { ok, applied, skipped, conflicts, vector }
+//   recordMemberVector(db, { memberInstanceId, vector }) -> { ok, ... }
+//   pruneTombstones(db, { now, rejoinAfterDays }) -> { ok, pruned }
+//   digest(db, { table })                   -> { ok, table, count, buckets }
+//
+// Every entry point runs on the OWNER's write connection (workers/brain-owner-worker.js
+// CUSTOM_BRAIN_CALLS → here) — the apply creates the connection-scoped TEMP sentinel the
+// capture triggers test. The route handlers in http/sync-api.js stay thin: they
+// authenticate, bound the body and hand the page to the owner through callLocalBrain.
+//
+// The v1 outbox transport (and its apply/LWW helpers in http/sync-api.js) was retired by
+// WP-6b / brain migration 105; the LWW rule, row write and payload filters below are now the
+// only copy.
+
+const crypto = require('node:crypto');
+const {
+  REPLICATED_TABLES,
+  readReplicatedRow,
+  knowledgeRowExists,
+  localBrainInstanceId,
+  clockSeedState,
+} = require('./brain-sync-store');
+const { createBrainSyncSentinel, dropBrainSyncSentinel } = require('./schema');
+
+const DEFAULT_CHANGES_LIMIT = 500; // §6.4: one page is at most 500 clock rows
+const MAX_CHANGES_LIMIT = 2000; // …and the route's hard cap
+const MAX_APPLY_ENTRIES = 2000; // §6.4: one apply call carries at most this many entries
+const MAX_TOMBSTONE_PRUNE = 5000; // per call, so a long backlog drains over several ticks
+const MEMORY_WATCH_COLUMNS = Object.freeze(['content', 'content_raw', 'subject', 'metadata', 'importance', 'archived_at']);
+const DIGEST_PAGE = 5000;
+const MEMORY_HOST_LOCAL_RESET = Object.freeze({ extraction_attempts: 0, last_accessed: null, access_count: 0, embed_failed_count: 0 });
+const MEMORY_HOST_LOCAL_COLUMNS = Object.freeze(Object.keys(MEMORY_HOST_LOCAL_RESET));
+// The digest compares what replication keeps equal: the id, the watch columns and (memories)
+// the immutable identity columns. Everything else may legitimately differ per machine.
+const { BRAIN_SYNC_WATCH_COLUMNS } = require('./brain-sync-v2-schema');
+const DIGEST_COLUMNS = Object.freeze({
+  memories: Object.freeze(['id', 'source', 'source_id', 'memory_type', 'timestamp', ...BRAIN_SYNC_WATCH_COLUMNS.memories]),
+  knowledge: Object.freeze(['id', ...BRAIN_SYNC_WATCH_COLUMNS.knowledge]),
+  entities: Object.freeze(['id', ...BRAIN_SYNC_WATCH_COLUMNS.entities]),
+  people: Object.freeze(['id', ...BRAIN_SYNC_WATCH_COLUMNS.people]),
+});
+
+function _string(value, max = 4000) {
+  if (typeof value === 'string') return value.slice(0, max);
+  return value == null ? '' : String(value).slice(0, max);
+}
+
+function _parseSeq(value) {
+  const n = Number(value);
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : 0;
+}
+
+function _tableColumns(db, table) {
+  try {
+    return db.prepare(`PRAGMA table_info("${table}")`).all().map((row) => row.name);
+  } catch {
+    return []; // HANDLE: a missing table yields no columns — the caller treats that as "nothing to write"
+  }
+}
+
+// Payloads arrive from a peer: identifiers that reach SQL come only from the LOCAL table's
+// column list, values are always bound parameters.
+function _payloadFields(payload, allowedColumns) {
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) return [];
+  const allowed = new Set(allowedColumns);
+  return Object.keys(payload).filter((key) => allowed.has(key));
+}
+
+function _parsePayload(raw) {
+  if (raw && typeof raw === 'object' && !Array.isArray(raw)) return raw;
+  try {
+    const parsed = JSON.parse(String(raw == null ? '{}' : raw));
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null; // HANDLE: an unparseable payload is skipped; the caller records it as skipped, never as a write
+  }
+}
+
+// R-10/D-10: higher updated_at wins; a tie goes to the lexicographically smaller origin.
+function _lwwWins(db, table, rowId, updatedAt, originInstanceId, localId) {
+  const local = db.prepare(
+    'SELECT updated_at, origin_instance_id FROM brain_row_clock WHERE table_name = ? AND row_id = ?'
+  ).get(table, rowId);
+  if (!local) return true;
+  const localAt = _string(local.updated_at, 64);
+  const incomingAt = _string(updatedAt, 64);
+  if (incomingAt > localAt) return true;
+  if (incomingAt < localAt) return false;
+  const localOrigin = _string(local.origin_instance_id, 160) || _string(localId, 160);
+  return _string(originInstanceId, 160) < localOrigin;
+}
+
+// The row write: memories are append-only by id; every other
+// replicated table upserts by id.
+function _writeRow(db, table, fields, payload) {
+  const columns = fields.map((column) => `"${column}"`).join(', ');
+  const placeholders = fields.map(() => '?').join(', ');
+  const values = fields.map((column) => payload[column]);
+  if (table === 'memories') {
+    return db.prepare(`INSERT OR IGNORE INTO "memories" (${columns}) VALUES (${placeholders})`).run(...values);
+  }
+  const updates = fields.filter((column) => column !== 'id').map((column) => `"${column}" = excluded."${column}"`).join(', ');
+  const conflict = updates ? `ON CONFLICT("id") DO UPDATE SET ${updates}` : 'ON CONFLICT("id") DO NOTHING';
+  return db.prepare(`INSERT INTO "${table}" (${columns}) VALUES (${placeholders}) ${conflict}`).run(...values);
+}
+
+// The v2 clock row for one applied change: the same (table, row) key the capture trigger
+// writes, carrying the PEER's origin/seq so the row stays addressable in that origin's stream.
+function _stampClock(db, table, rowId, updatedAt, originInstanceId, originSeq, deleted) {
+  db.prepare(`
+    INSERT INTO brain_row_clock (table_name, row_id, updated_at, origin_instance_id, origin_seq, deleted)
+    VALUES (?, ?, ?, ?, ?, ?)
+    ON CONFLICT(table_name, row_id) DO UPDATE SET
+      updated_at = excluded.updated_at,
+      origin_instance_id = excluded.origin_instance_id,
+      origin_seq = excluded.origin_seq,
+      deleted = excluded.deleted
+  `).run(table, rowId, _string(updatedAt, 64), _string(originInstanceId, 160), originSeq, deleted);
+}
+
+function _bumpVv(db, originInstanceId, seq) {
+  if (!(seq > 0)) return;
+  db.prepare(`
+    INSERT INTO brain_vv (origin_instance_id, max_seq) VALUES (?, ?)
+    ON CONFLICT(origin_instance_id) DO UPDATE SET max_seq = MAX(max_seq, excluded.max_seq)
+  `).run(originInstanceId, seq);
+}
+
+function _readVv(db) {
+  const vector = {};
+  for (const row of db.prepare('SELECT origin_instance_id, max_seq FROM brain_vv ORDER BY origin_instance_id ASC').all()) {
+    vector[String(row.origin_instance_id)] = Number(row.max_seq) || 0;
+  }
+  return vector;
+}
+
+// ---------------------------------------------------------------------------
+// Feed
+// ---------------------------------------------------------------------------
+
+// GET /api/walle/sync/v2/vector — "what do I hold": this node's id, its vector and whether
+// the WP-0 seed walk has finished (a peer must not pull a node whose clocks are incomplete).
+function readVector(db) {
+  return {
+    instanceId: localBrainInstanceId(db),
+    vector: _readVv(db),
+    clockSeedDone: clockSeedState(db).done,
+  };
+}
+
+function _feedEntry(db, row) {
+  const deleted = Number(row.deleted) ? 1 : 0;
+  let payload = null;
+  if (!deleted) {
+    payload = readReplicatedRow(db, row.table_name, row.row_id);
+  }
+  // A clock that says "live" for a row that is gone is a race with a local delete (or a clock
+  // seeded before the row was written): ship it as a delete. Nothing is logged — the peer's
+  // apply is idempotent, and the clock row it writes is the same either way.
+  const isDeleted = deleted === 1 || !payload;
+  return {
+    table: row.table_name,
+    rowId: row.row_id,
+    origin: row.origin_instance_id,
+    originSeq: Number(row.origin_seq) || 0,
+    updatedAt: row.updated_at,
+    deleted: isDeleted ? 1 : 0,
+    payload: isDeleted ? null : payload,
+  };
+}
+
+// POST /api/walle/sync/v2/changes — every clock row whose origin_seq is beyond `since`, in
+// ascending (origin, origin_seq) order, filling one page. An origin absent from `since` means
+// 0; origin '' ("this host" before the identity was known, or a v1 row) is never shipped — an
+// unaddressable row has no place in a feed a peer walks by (origin, seq).
+function changesSince(db, { since = {}, limit = DEFAULT_CHANGES_LIMIT } = {}) {
+  const requested = Math.floor(Number(limit) || 0) || DEFAULT_CHANGES_LIMIT;
+  const budget = Math.max(1, Math.min(MAX_CHANGES_LIMIT, requested));
+  const sinceMap = since && typeof since === 'object' && !Array.isArray(since) ? since : {};
+  const origins = db.prepare('SELECT origin_instance_id FROM brain_vv ORDER BY origin_instance_id ASC').all()
+    .map((row) => String(row.origin_instance_id))
+    .filter((origin) => origin !== '');
+  const select = db.prepare(`
+    SELECT table_name, row_id, origin_instance_id, origin_seq, updated_at, deleted
+      FROM brain_row_clock
+     WHERE origin_instance_id = ? AND origin_seq > ?
+     ORDER BY origin_seq ASC
+     LIMIT ?
+  `);
+  const probe = db.prepare('SELECT 1 AS hit FROM brain_row_clock WHERE origin_instance_id = ? AND origin_seq > ? LIMIT 1');
+  const entries = [];
+  let pending = null;
+  for (const origin of origins) {
+    const after = Math.max(0, _parseSeq(sinceMap[origin]));
+    const remaining = budget - entries.length;
+    if (remaining <= 0) {
+      pending = { origin, after };
+      break;
+    }
+    const rows = select.all(origin, after, remaining);
+    for (const row of rows) entries.push(_feedEntry(db, row));
+    if (rows.length < remaining) continue; // this origin drained
+    // The page filled exactly at this origin's boundary: ask whether it holds more.
+    const lastSeq = rows.length ? Number(rows[rows.length - 1].origin_seq) : after;
+    if (probe.get(origin, lastSeq)) {
+      pending = { origin, after: lastSeq };
+      break;
+    }
+  }
+  // more = some origin still holds rows past what this page returned (the pending origin, or any
+  // origin after it that the exhausted budget never reached).
+  let more = false;
+  if (pending) {
+    const startAt = origins.indexOf(pending.origin);
+    for (let index = startAt; index < origins.length && !more; index += 1) {
+      const origin = origins[index];
+      const after = index === startAt ? pending.after : Math.max(0, _parseSeq(sinceMap[origin]));
+      more = !!probe.get(origin, after);
+    }
+  }
+  return {
+    entries,
+    more,
+    clockSeedDone: clockSeedState(db).done,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Apply
+// ---------------------------------------------------------------------------
+
+// POST /api/walle/sync/v2/apply — one IMMEDIATE transaction for the whole page, sentinel on.
+// Rules (§5 D-10): the clock decides first (same origin → higher seq wins), then LWW for
+// non-memory rows, memories stay append-only by id (an existing memory only takes the six
+// watch columns, and only when the incoming clock wins). Losses land in brain_sync_conflicts.
+// Nothing in a page can stop the transaction: an unknown table is a conflict, a malformed
+// entry is a skip.
+function applyChanges(db, payload = {}) {
+  const sourceInstanceId = _string(payload.sourceInstanceId || payload.source_instance_id, 160).trim();
+  if (!sourceInstanceId) {
+    const error = new Error('brain_sync_source_instance_required');
+    error.code = 'BRAIN_SYNC_SOURCE_REQUIRED';
+    throw error;
+  }
+  const list = Array.isArray(payload.entries) ? payload.entries : [];
+  if (list.length > MAX_APPLY_ENTRIES) {
+    const error = new Error('brain_sync_entries_too_large');
+    error.code = 'BRAIN_SYNC_ENTRIES_TOO_LARGE';
+    throw error;
+  }
+  const localId = localBrainInstanceId(db);
+  const memberOf = _string(payload.memberOf, 160).trim();
+  // The CREATE TEMP TABLE text lives in brain/schema.js (the sanctioned DDL module) — this
+  // storage module owns no DDL (bin/ddl-outside-runner-lint.js).
+  createBrainSyncSentinel(db);
+  try {
+    return db.transaction(() => {
+      let applied = 0;
+      let skipped = 0;
+      let conflicts = 0;
+      const clockOf = db.prepare('SELECT origin_instance_id, origin_seq, updated_at, deleted FROM brain_row_clock WHERE table_name = ? AND row_id = ?');
+      const seenThrough = db.prepare('SELECT max_seq FROM brain_vv WHERE origin_instance_id = ?');
+      const recordConflict = db.prepare(`
+        INSERT INTO brain_sync_conflicts (at, reason, table_name, row_id, origin_instance_id, origin_seq, detail)
+        VALUES (?, ?, ?, ?, ?, ?, ?)
+      `);
+      const note = (reason, entry, detail = '') => {
+        conflicts += 1;
+        recordConflict.run(
+          new Date().toISOString(), reason,
+          _string(entry.table, 40), _string(entry.rowId, 160),
+          _string(entry.origin, 160), Number(entry.originSeq) || 0, _string(detail, 500),
+        );
+      };
+      for (const entry of list) {
+        const table = _string(entry?.table || entry?.table_name, 40).trim();
+        const rowId = _string(entry?.rowId || entry?.row_id, 160).trim();
+        const origin = _string(entry?.origin || entry?.origin_instance_id, 160);
+        const originSeq = _parseSeq(entry?.originSeq ?? entry?.origin_seq);
+        const updatedAt = _string(entry?.updatedAt || entry?.updated_at, 64);
+        const deleted = Number(entry?.deleted) ? 1 : 0;
+        const shape = { table, rowId, origin, originSeq };
+        if (!REPLICATED_TABLES.includes(table)) {
+          skipped += 1;
+          note('brain_table_unknown', shape);
+          continue;
+        }
+        if (!rowId || !origin) {
+          // No id or no origin is not addressable and cannot be LWW-compared; a skip, not a write.
+          skipped += 1;
+          continue;
+        }
+        // Echo guard: a row this node produced is never taken back (the peer asked with its own
+        // maximum, so this should not happen — when it does, the local copy is authoritative).
+        if (origin === localId) {
+          skipped += 1;
+          continue;
+        }
+        // 0. already considered: this node's vector says it has seen this origin through a seq at
+        // or past this entry. Within the hub star each origin's changes arrive in ascending seq
+        // (the hub pulls each origin in order and serves its own clock in order), so a re-offer is
+        // never new information — skipping it keeps a decided conflict from being re-recorded.
+        const seen = seenThrough.get(origin);
+        if (seen && Number(seen.max_seq) >= originSeq) {
+          skipped += 1;
+          continue;
+        }
+        const local = clockOf.get(table, rowId);
+        const localOrigin = local ? _string(local.origin_instance_id, 160) : '';
+        const localSeq = local ? Number(local.origin_seq) || 0 : 0;
+        // 1. stale same-origin write (D-3: per-origin seq is the address).
+        if (local && localOrigin === origin && localSeq >= originSeq) {
+          skipped += 1;
+          _bumpVv(db, origin, originSeq); // considered: the vector means "seen through", not "holds"
+          continue;
+        }
+        // 2. LWW against a different origin, non-memory rows only.
+        if (table !== 'memories' && local && localOrigin !== origin && !_lwwWins(db, table, rowId, updatedAt, origin, localId)) {
+          skipped += 1;
+          note('lww_lost', shape);
+          _bumpVv(db, origin, originSeq); // a decided loss must not be re-offered every tick
+          continue;
+        }
+        // 3. a tombstone: the row goes, the clock stays.
+        if (deleted) {
+          db.prepare(`DELETE FROM "${table}" WHERE id = ?`).run(rowId);
+          _stampClock(db, table, rowId, updatedAt, origin, originSeq, 1);
+          _bumpVv(db, origin, originSeq);
+          applied += 1;
+          continue;
+        }
+        const parsed = _parsePayload(entry?.payload);
+        if (!parsed) {
+          skipped += 1;
+          continue;
+        }
+        const columns = _tableColumns(db, table);
+        if (!columns.length) {
+          skipped += 1;
+          note('brain_table_unknown', shape);
+          continue;
+        }
+        const row = { ...parsed, id: parsed.id || rowId };
+        if (table === 'memories') {
+          // D-4: the (source, source_id) pair is the memory's real identity. An incoming row
+          // that pins the same pair to a different id is a fork, not an update — drop it.
+          const sourceId = row.source_id == null ? '' : String(row.source_id);
+          if (sourceId) {
+            const clash = db.prepare('SELECT id FROM memories WHERE source = ? AND source_id = ?').get(_string(row.source, 200), _string(sourceId, 400));
+            if (clash && String(clash.id) !== String(rowId)) {
+              skipped += 1;
+              note('memory_identity_conflict', shape, `local_id:${_string(clash.id, 160)}`);
+              _bumpVv(db, origin, originSeq); // recorded once; re-offering it every tick would grow the ledger forever
+              continue;
+            }
+          }
+          const existed = !!db.prepare('SELECT 1 AS hit FROM memories WHERE id = ?').get(rowId);
+          if (existed) {
+            // An archive/edit travels as an update of the same id under LWW (§5 D-10); only the
+            // six watch columns move, so nothing local (extraction_status, embeddings pointers)
+            // is clobbered by a peer.
+            const wins = !local || localOrigin === origin || _lwwWins(db, table, rowId, updatedAt, origin, localId);
+            if (!wins) {
+              skipped += 1;
+              note('lww_lost', shape);
+              _bumpVv(db, origin, originSeq);
+              continue;
+            }
+            const watch = MEMORY_WATCH_COLUMNS.filter((column) => columns.includes(column) && row[column] !== undefined);
+            if (watch.length) {
+              db.prepare(`UPDATE memories SET ${watch.map((column) => `"${column}" = ?`).join(', ')} WHERE id = ?`)
+                .run(...watch.map((column) => row[column]), rowId);
+            }
+          } else {
+            // Follow-up #19 (v1 parity): a memory this host did not ingest is never extracted
+            // here — the origin host's extraction produced its knowledge rows, and those
+            // replicate on their own. Only the insert path labels the row.
+            row.extraction_status = 'replicated';
+            // Host-local bookkeeping starts fresh here: the origin's read stamps and retry
+            // counters describe ITS work (an origin embed_failed_count would stop this node's
+            // embedding backfill from ever trying the row).
+            for (const column of MEMORY_HOST_LOCAL_COLUMNS) if (column in row) row[column] = MEMORY_HOST_LOCAL_RESET[column];
+            const fields = _payloadFields(row, columns);
+            if (!fields.includes('id')) fields.unshift('id');
+            _writeRow(db, table, fields, row);
+          }
+        } else {
+          // Same repair the v1 apply makes for a dangling knowledge pointer: the target is not
+          // here, so the pointer is dropped (NULL) and the loss is recorded.
+          if (table === 'knowledge') {
+            const target = _string(row.superseded_by, 160).trim();
+            if (target && !knowledgeRowExists(db, target)) {
+              row.superseded_by = null;
+              note('brain_fk_dropped', shape, `referenced_id:${target}`);
+            }
+          }
+          const fields = _payloadFields(row, columns);
+          if (!fields.includes('id')) fields.unshift('id');
+          _writeRow(db, table, fields, row);
+        }
+        _stampClock(db, table, rowId, updatedAt, origin, originSeq, 0);
+        _bumpVv(db, origin, originSeq);
+        applied += 1;
+      }
+      if (memberOf) markMembership(db, { homeInstanceId: memberOf });
+      return { ok: true, applied, skipped, conflicts, vector: _readVv(db) };
+    }).immediate();
+  } finally {
+    dropBrainSyncSentinel(db);
+  }
+}
+
+// D-5: the durable "this node is a member" fact. Written when a home's sync round applies changes here
+// (header X-CTM-Memory-Sync-Home), and by the WP-4 join. Host-local kv (never replicated). A node never
+// marks itself.
+const { MEMBERSHIP_KEY, readMembership } = require('./brain-sync-membership');
+function markMembership(db, { homeInstanceId = '' } = {}) {
+  const home = _string(homeInstanceId, 160).trim();
+  if (!home || home === localBrainInstanceId(db)) return { ok: false, changed: false };
+  const current = readMembership(db);
+  if (current && current.role === 'member' && current.homeInstanceId === home) return { ok: true, changed: false };
+  db.prepare(`INSERT INTO kv_store (key, value, updated_at) VALUES (?, ?, datetime('now'))
+    ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`)
+    .run(MEMBERSHIP_KEY, JSON.stringify({ role: 'member', homeInstanceId: home, since: new Date().toISOString() }));
+  return { ok: true, changed: true };
+}
+
+// ---------------------------------------------------------------------------
+// Hub bookkeeping
+// ---------------------------------------------------------------------------
+
+// POST /api/walle/sync/v2/member-vector — the hub's record of what a member last reported.
+// Monotonic per (member, origin): a stale or out-of-order report can only ever make the
+// pruning floor more conservative, never less.
+function recordMemberVector(db, { memberInstanceId = '', vector = {} } = {}) {
+  const member = _string(memberInstanceId, 160).trim();
+  if (!member) {
+    const error = new Error('brain_sync_member_instance_required');
+    error.code = 'BRAIN_SYNC_MEMBER_REQUIRED';
+    throw error;
+  }
+  const entries = vector && typeof vector === 'object' && !Array.isArray(vector) ? Object.entries(vector) : [];
+  const at = new Date().toISOString();
+  db.transaction(() => {
+    const upsert = db.prepare(`
+      INSERT INTO brain_member_vv (member_instance_id, origin_instance_id, max_seq, reported_at)
+      VALUES (?, ?, ?, ?)
+      ON CONFLICT(member_instance_id, origin_instance_id) DO UPDATE SET
+        max_seq = MAX(brain_member_vv.max_seq, excluded.max_seq),
+        reported_at = excluded.reported_at
+    `);
+    for (const [origin, seq] of entries) {
+      if (!origin) continue;
+      upsert.run(member, _string(origin, 160), Math.max(0, _parseSeq(seq)), at);
+    }
+  }).immediate();
+  return { ok: true, memberInstanceId: member, reportedAt: at };
+}
+
+// POST /api/walle/sync/v2/prune-tombstones — §5 D-8. A tombstone goes only once EVERY member
+// whose report is still fresh (within rejoinAfterDays) has a vector covering it: the floor is
+// the MIN over those members for that origin, so one lagging member holds the tombstone back.
+// No members at all → nothing to prune (a node that just joined must not eat the history it
+// has not shipped yet).
+function pruneTombstones(db, { now = Date.now(), rejoinAfterDays = 30 } = {}) {
+  const days = Number.isFinite(Number(rejoinAfterDays)) ? Math.max(0, Number(rejoinAfterDays)) : 30;
+  const cutoff = new Date(Number(now) - days * 24 * 60 * 60 * 1000).toISOString();
+  const hasMembers = !!db.prepare('SELECT 1 AS hit FROM brain_member_vv LIMIT 1').get();
+  if (!hasMembers) {
+    // A MEMBER (no member vectors: only the hub dials, D-2) prunes by age. Its tombstones matter
+    // only until the hub has pulled them, which a member silent for longer than the rejoin window
+    // forfeits anyway (D-8: it must re-join by snapshot). updated_at is the origin's ISO clock.
+    const aged = db.prepare(`
+      DELETE FROM brain_row_clock
+       WHERE rowid IN (SELECT rowid FROM brain_row_clock WHERE deleted = 1 AND updated_at < ? LIMIT ?)
+    `).run(cutoff, MAX_TOMBSTONE_PRUNE).changes;
+    return { ok: true, pruned: aged, mode: 'age' };
+  }
+  let pruned = 0;
+  db.transaction(() => {
+    const floors = db.prepare(`
+      SELECT origin_instance_id AS origin, MIN(max_seq) AS floor
+        FROM brain_member_vv
+       WHERE reported_at >= ?
+       GROUP BY origin_instance_id
+    `).all(cutoff);
+    const del = db.prepare(`
+      DELETE FROM brain_row_clock
+       WHERE rowid IN (
+         SELECT rowid FROM brain_row_clock
+          WHERE deleted = 1 AND origin_instance_id = ? AND origin_seq <= ?
+          LIMIT ?
+       )
+    `);
+    for (const row of floors) {
+      if (pruned >= MAX_TOMBSTONE_PRUNE) break;
+      pruned += del.run(_string(row.origin, 160), Math.max(0, Number(row.floor) || 0), MAX_TOMBSTONE_PRUNE - pruned).changes;
+    }
+  }).immediate();
+  return { ok: true, pruned };
+}
+
+// ---------------------------------------------------------------------------
+// Convergence digest (§6.5) — the comparison WP-6's verifier reads
+// ---------------------------------------------------------------------------
+
+function _canonicalJson(table, payload) {
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) return 'null';
+  const ordered = {};
+  for (const key of [...(DIGEST_COLUMNS[table] || [])].sort()) ordered[key] = payload[key] === undefined ? null : payload[key];
+  return JSON.stringify(ordered);
+}
+
+// GET /api/walle/sync/v2/digest?table=memories — bucket = first byte of sha256(rowId);
+// rowHash = first 8 bytes of sha256(`${table}|${rowId}|${deleted}|${canonicalJson(payload)}`),
+// XOR-folded per bucket. Only DIGEST_COLUMNS are hashed: read stamps, retry counters and local
+// classifier output are this host's bookkeeping, not the replicated state. CPU-bound, paged.
+function digest(db, { table } = {}) {
+  const name = _string(table, 40).trim();
+  if (!REPLICATED_TABLES.includes(name)) {
+    const error = new Error(`brain_sync_digest_unknown_table: ${name}`);
+    error.code = 'BRAIN_SYNC_TABLE_UNKNOWN';
+    throw error;
+  }
+  const counts = new Array(256).fill(0);
+  const folds = new Array(256).fill(null);
+  // LIVE rows only (shared-memory WP-4c review): tombstones are bookkeeping that each node prunes on
+  // its own schedule (pruneTombstones), so hashing them would make converged nodes differ. A delete
+  // that never applied still shows: the lagging node keeps a live row the others do not have.
+  const page = db.prepare('SELECT rowid AS rid, row_id, deleted FROM brain_row_clock WHERE table_name = ? AND deleted = 0 AND rowid > ? ORDER BY rowid ASC LIMIT ?');
+  let afterRowid = 0;
+  let count = 0;
+  for (;;) {
+    const rows = page.all(name, afterRowid, DIGEST_PAGE);
+    if (!rows.length) break;
+    for (const clockRow of rows) {
+      afterRowid = Number(clockRow.rid);
+      const live = Number(clockRow.deleted) ? null : readReplicatedRow(db, name, clockRow.row_id);
+      const deleted = live ? 0 : 1;
+      const hash = crypto.createHash('sha256').update(`${name}|${clockRow.row_id}|${deleted}|${_canonicalJson(name, live)}`).digest();
+      const bucket = crypto.createHash('sha256').update(String(clockRow.row_id)).digest()[0];
+      counts[bucket] += 1;
+      count += 1;
+      const fold = folds[bucket] || Buffer.alloc(8);
+      for (let index = 0; index < 8; index += 1) fold[index] ^= hash[index];
+      folds[bucket] = fold;
+    }
+  }
+  const buckets = [];
+  for (let bucket = 0; bucket < 256; bucket += 1) {
+    buckets.push({ b: bucket, count: counts[bucket], xor: (folds[bucket] || Buffer.alloc(8)).toString('hex') });
+  }
+  return { ok: true, table: name, count, buckets };
+}
+
+module.exports = {
+  markMembership,
+  readMembership,
+  MEMBERSHIP_KEY,
+  DEFAULT_CHANGES_LIMIT,
+  MAX_CHANGES_LIMIT,
+  MAX_APPLY_ENTRIES,
+  MEMORY_WATCH_COLUMNS,
+  readVector,
+  changesSince,
+  applyChanges,
+  recordMemberVector,
+  pruneTombstones,
+  digest,
+};

package/template/wall-e/brain/delegate-model-prefs-store.js

@@ -3,7 +3,7 @@
 // Delegate model preferences (lead-and-delegate-model-picker-ux-2026-10-08.html
 // §5 D-9/D-11, §6.4): one row per scope in delegate_model_prefs --
 //   session:<ctm_session_id>  the pick made for ONE lead session
-//   default:claude | default:codex  the per-lead-agent default
+//   default:claude | default:codex | default:opencode | default:dsh  the per-lead-agent default
 // Every write to the table lives here. effectiveDelegatePref() walks the
 // ladder session > default > vendor and names the winning rung as `source`.
 // Migration 86 also lives here: it folds the retired model_defaults
@@ -11,7 +11,10 @@
 const { foldDelegateLadder } = require('../llm/delegate-vendor-default');
 
 const LANES = Object.freeze(['native', 'routed', 'inherit']);
-const AGENTS = Object.freeze(['claude', 'codex']);
+// The lead agents the ladder is keyed on. WP-10/P-5 (deepseek-harness-acp-agent-2026-10-28.html
+// §5b D-24): dsh joins as a first-class delegating lead -- its `default:dsh` rung is exactly as
+// reachable as default:opencode's.
+const AGENTS = Object.freeze(['claude', 'codex', 'opencode', 'dsh']);
 const SESSION_SCOPE_RE = /^session:[A-Za-z0-9._-]{1,160}$/;
 const FIELD_MAX = 200;
 // '' = the model's own default. native: the Agent tool / spawn_agent accept up to max; routed:
@@ -54,7 +57,7 @@ function optionalString(value, field) {
 function putDelegatePref(db, row, { now = () => new Date().toISOString() } = {}) {
   const v = row && typeof row === 'object' && !Array.isArray(row) ? row : {};
   if (!isValidScopeKey(v.scope_key)) {
-    throw prefError('scope_key', 'must be session:<ctm_session_id>, default:claude or default:codex');
+    throw prefError('scope_key', 'must be session:<ctm_session_id>, default:claude, default:codex, default:opencode or default:dsh');
   }
   if (!LANES.includes(v.lane)) throw prefError('lane', 'must be native, routed or inherit');
   const model = optionalString(v.model, 'model');
@@ -96,7 +99,10 @@ function deleteDelegatePref(db, scopeKey) {
  * @returns {{effective:{lane,model,route_id,identity_id,display,effort,source}, ladder:Array}}
  */
 function effectiveDelegatePref(db, { ctmSessionId, agent } = {}) {
-  const leadAgent = agent === 'codex' ? 'codex' : 'claude';
+  // AGENTS is the one list of lead agents; an absent/unknown agent keeps the historical claude
+  // fallback. Reading `default:${leadAgent}` is what makes default:opencode / default:dsh
+  // reachable at all.
+  const leadAgent = AGENTS.includes(agent) ? agent : 'claude';
   const sessionKey = ctmSessionId ? `session:${ctmSessionId}` : '';
   return foldDelegateLadder({
     session: isValidScopeKey(sessionKey) ? getDelegatePref(db, sessionKey) : null,
@@ -127,6 +133,9 @@ function migrateDelegatedWorkerDefault(d) {
         VALUES (?, 'routed', ?, ?, ?, ?, ?)
       `);
       const now = new Date().toISOString();
+      // AC-4f / WP-10: `agents` comes from servableAgents(), which only ever yields claude/codex,
+      // so an 'opencode' or 'dsh' member of AGENTS is always skipped and this migration's
+      // behaviour is unchanged by either joining the list.
       for (const agent of AGENTS) {
         if (!agents.includes(agent)) continue;
         const info = insert.run(`default:${agent}`, reg.model_id, identity ? identity.identity_id : '', reg.provider_id, reg.display_name || reg.model_id, now);