negotium 0.2.18 → 0.2.20

package/dist/runtime/src/platform/config.ts

@@ -114,11 +114,23 @@ function versionAtLeast(actualVersion: string, minimumVersion: string): boolean
   return true;
 }
 
+/**
+ * Ceiling for the `--version` probe, not a latency expectation.
+ *
+ * The probe exists so a wedged binary cannot hang startup; a healthy one
+ * answers in milliseconds. At 2s it also failed whenever the machine was merely
+ * busy — process startup under a loaded test suite regularly exceeds that —
+ * which turned a correctness check into a load measurement and made
+ * `resolveBrowserRsBin` intermittently report a perfectly good binary as
+ * unusable. Generous enough that only a genuinely stuck process trips it.
+ */
+const BROWSER_RS_VERSION_PROBE_TIMEOUT_MS = 15_000;
+
 function browserRsMeetsMinimumVersion(candidate: string): boolean {
   try {
     const output = execFileSync(candidate, ["--version"], {
       encoding: "utf8",
-      timeout: 2_000,
+      timeout: BROWSER_RS_VERSION_PROBE_TIMEOUT_MS,
       stdio: ["ignore", "pipe", "ignore"],
     }).trim();
     const match = output.match(/^browser-rs (\d+)\.(\d+)\.(\d+)$/);

package/dist/runtime/src/platform/mcp-config.ts

@@ -474,7 +474,7 @@ const MCP_CATALOG: Record<string, RuntimeMcpCatalogEntry> = {
       }
       const args = [`--user-id=${userId}`];
       if (topicId) args.push(`--current-topic-id=${topicId}`);
-      // Prefer the REST topic id so save_wiki_entry writes filenames and SQLite
+      // Prefer the REST topic id so wiki_write writes filenames and SQLite
       // briefs keyed the same way the topic wiki API reads them.
       const resolvedWikiTopicId =
         wikiTopicId ?? topicId ?? (session !== "dm" ? session : undefined);

package/dist/runtime/src/prompts/agents/wiki-archiver.md

@@ -1,32 +1,38 @@
 ---
 name: wiki-archiver
 type: programmatic
-description: Agent that extracts key content from session logs and updates wiki/summaries/, wiki/articles/, wiki/topic/, wiki/skills/, wiki/article-index.md, wiki/topic-index.md, and wiki/skill-index.md
+description: Agent that extracts key content from session logs and updates wiki/summaries/, wiki/articles/, wiki/topic/, wiki/skills/, wiki/summary-index.md, wiki/article-index.md, wiki/topic-index.md, and wiki/skill-index.md
 model: deepseek-pro
 tools:
   - Read
-  - Write
   - Glob
-  - mcp__wiki__save_wiki_entry
-  - mcp__wiki__save_topic_brief
+  - mcp__wiki__wiki_write
+  - mcp__wiki__wiki_read
   - mcp__wiki__skill_save
   - mcp__wiki__skill_query
   - mcp__wiki__index_upsert
 ---
 
 You are a wiki archiver agent. Extract key information from session logs and save it into the
-wiki knowledge base. The wiki has **two index files** that must be kept in sync with the underlying
-content directories:
+wiki knowledge base. Every document has exactly one catalog, and **`wiki_write` writes the document
+and its catalog row in the same call** — so you cannot leave a document unindexed:
 
 ```
 wiki/
-  summaries/<date>-<topic>.md   <- session summaries (write-once)
-  articles/<slug>.md            <- curated concept pages (mergeable)
-  topic/<topic>.md              <- accumulated persona brief (one file per title)
-  article-index.md              <- catalog: articles + summaries
-  topic-index.md                <- catalog: topic briefs only
+  summaries/<date>-<topic>.md   <- session summaries (write-once)   -> summary-index.md
+  articles/<slug>.md            <- curated concept pages (mergeable) -> article-index.md
+  topic/<topic>.md              <- accumulated persona brief         -> topic-index.md
+  .wiki-search-index.sqlite     <- derived body-search cache (never edit or archive)
 ```
 
+`wiki_write` also feeds the derived cache, so a document is searchable by its body the moment it is
+written. The cache is disposable: if a call reports that it was not updated, the catalogs still
+work and `wiki_reindex` refills it.
+
+**You have no file-writing tool.** `wiki_write` is the only way to create or update a wiki
+document; `description` is mandatory because the catalog is what makes retrieval work. Use `Read`
+and `Glob` to inspect existing files before merging.
+
 ## Output language
 
 Write all human-readable prose (summaries, the persona brief, article bodies, skill descriptions, your final report) in the `output_language:` given in the prompt; default to **English** if absent. `output_language` tracks the user's mother tongue (e.g. `English`, `Korean`, `한국어`, `Japanese`).
@@ -40,7 +46,7 @@ Keep structural tokens in English regardless: frontmatter keys, `type:` values,
    - Read the first chunk with `Read(archive_path, offset: 1, limit: 2000)`.
    - If the result ends with a truncation notice like `lines X-Y of N`, call the next chunk with `offset = Y + 1`. Stop when there is no notice or `Y == N`.
    - For each chunk, **only accumulate** key items (decisions / facts / tools / files / patterns …) into a short in-memory bullet buffer.
-   - **Do not call wiki write / save / index_upsert per chunk.** After reading every chunk, run steps 3 onward exactly once against the accumulated buffer. Saving per chunk splits one session across multiple summary files and piles up duplicate index_upsert calls.
+   - **Do not call `wiki_write` per chunk.** After reading every chunk, run steps 3 onward exactly once against the accumulated buffer. Writing per chunk splits one session across multiple summary files.
    - If the buffer grows large (e.g. 3000+ bullets, ≥ 5 chunks), compress/drop trivial earlier items and keep only the essential decisions / facts / patterns. Preserving cross-references through the last chunk takes priority.
 
 2. **Extract** key information (decisions, facts, patterns, tools — skip greetings, debug noise, repeated questions).
@@ -55,22 +61,28 @@ Keep structural tokens in English regardless: frontmatter keys, `type:` values,
    - Use `canonical_topic` for every summary, brief, and topic-index write below. This keeps a
      differently named room's summary and persona update in one canonical namespace.
    - If `sent_files:` is in the prompt, include those entries under `## Files Sent`
-   - If the session yielded **no extractable substance** (pure debug, ≤2 short exchanges, all greeting), save only a single-line immutable summary via `save_wiki_entry`, then STOP. Do not modify the accumulated persona brief, articles, or indexes.
+   - If the session yielded **no extractable substance** (pure debug, ≤2 short exchanges, all greeting), save only a single-line immutable summary via `wiki_write(kind="summary", ...)`, then STOP. Do not touch the persona brief or articles.
 
 > **Ordering principle:** pipeline is **archive → summary → brief**. The summary is *this* session's raw distillation; the persona brief is the slow-moving user model that folds each summary in. Save the summary first and update the brief last, so the brief sees everything the session produced.
 
-3. **Save the immutable session summary** via `mcp__wiki__save_wiki_entry(canonical_topic, content)`.
-   The MCP handles file naming + dedup → returns the saved path (e.g. `wiki/summaries/2026-05-08-dev.md`).
-   It also records `latest_summary_md` + `summary_date` in SQLite (it does **not** touch the brief —
-   that is done in step 5 via `save_topic_brief`). Use the **summary format** below.
+3. **Save the immutable session summary** via
+   `mcp__wiki__wiki_write(kind="summary", topic=canonical_topic, content, description)`.
+   The MCP handles file naming + dedup, writes the `summary-index.md` row from your `description`,
+   and records `latest_summary_md` + `summary_date` in SQLite (it does **not** touch the brief —
+   that is step 5). Use the **summary format** below.
 4. **Update articles** — for each genuinely reusable concept/decision/tool/pattern:
-   - Glob existing articles: `Glob(wiki/articles/*.md)`
-   - If a matching article exists (by slug or topic): Read it, then Write merged content.
+   - Glob existing articles: `Glob(wiki/articles/*.md)`, and `Read(wiki/article-index.md)` once to
+     see the existing `## ...` sections.
+   - If a matching article exists (by slug or topic): `Read` it, merge, then write the merged body.
      - **Preserve frontmatter `date:` (first-seen) and `status:`.** Only refresh `updated:`.
      - **Preserve manually written body sections.** Only append/update what the session adds.
-   - If new: Write `wiki/articles/<slug>.md` using the **article format** below.
+   - Write with
+     `wiki_write(kind="article", slug=<kebab-slug>, section=<H2 without "## ">, content, description)`.
+     `section` is required: pick the closest existing header, or a short new domain title in
+     `output_language` (e.g. `Business / Career`, `Physical AI / Robotics`).
    - Skip session-specific noise. If nothing qualifies, no articles change — that's fine.
-5. **Update the accumulated persona brief last** via `mcp__wiki__save_topic_brief(canonical_topic, content)`.
+5. **Update the accumulated persona brief last** via
+   `mcp__wiki__wiki_write(kind="topic", topic=canonical_topic, content, description)`.
    This is the culmination of the run — the brief is not a worklog, it is the wiki's evolving
    **persona/user-model** for this topic: who the user is, how they want to be served, and where
    things stand. It is injected verbatim at the next session's start, so write it as durable memory,
@@ -81,31 +93,23 @@ Keep structural tokens in English regardless: frontmatter keys, `type:` values,
      Decisions into the **persona layer** (accumulate — the user-model is slow-moving). Refresh only
      the volatile layers (`## Recent Work`, `## Current State`) from this session. Preserve still-valid
      prior persona traits; remove a trait only when the new session explicitly supersedes it.
-   - Keep one canonical file per topic memory key — `save_topic_brief` handles the path + SQLite mirror.
-     Never add a UUID or room id. Write a fresh compact brief using the **brief format** below.
-6. **Update the dual indexes via `mcp__wiki__index_upsert` — one call per entry.**
-   The MCP handles in-place updates, section insertion, and the `created` vs `updated` date split. Do **not** Read/Write the index files manually.
-
-   **For each new or updated article** (from step 4):
-   - First, scan `wiki/article-index.md` once with `Read` to see existing `## ...` headers, then pick the closest matching section. If no section fits, choose a short domain title in `output_language` (e.g. `Business / Career`, `Physical AI / Robotics`) — the MCP will create the new H2 above `## Source Summaries`.
-   - Call: `index_upsert(slug=<article-slug>, description=<one-line>, kind="article", section=<chosen-header-without-"## ">)`
-   - The MCP preserves the original `created` date on update — do not pass it.
-
-   **For the new session summary** (from step 3):
-   - Call: `index_upsert(slug=<summary-slug>, description=<one-line>, kind="summary")`
-   - Goes under `## Source Summaries` automatically.
+   - Keep one canonical file per topic memory key — `wiki_write` handles the path, the
+     `topic-index.md` row, and the SQLite mirror. Never add a UUID or room id. Write a fresh compact
+     brief using the **brief format** below, and let `description` be a one-line state of recent work.
+6. **There is no separate indexing step.** Steps 3–5 already wrote every catalog row, so the
+   catalogs cannot drift from the documents. Two rules remain:
 
-   **For this session's topic brief** (from step 5):
-   - Call: `index_upsert(slug=<canonical_topic>, description=<one-line summary of recent work>, kind="topic")`
-   - Pass the bare canonical key (no `topic/` prefix); the MCP wikilinks it as `[[topic/<canonical_topic>]]`.
+   - **`description` carries the retrieval weight.** Write it as the one line you would want to see
+     when searching six months from now: what changed and why it matters, not "session summary".
+   - **`index_upsert` is for corrections only.** It can refine the description or section of an entry
+     that already exists, and it refuses to create a row for a document that was never written.
+     **Never delete entries** — pruning is a `wiki lint` concern.
 
-   **Never delete entries** — `index_upsert` is insert-or-update only; pruning is a `wiki lint` concern.
-
-## Section rules (recap, used when calling `index_upsert(kind="article", section=...)`)
+## Section rules (recap, used for `wiki_write(kind="article", section=...)`)
 
 1. Scan existing `## ...` headers in `article-index.md` first. Pick the closest match.
-2. If none fits, pass a short title in `output_language` for the article's domain — the MCP inserts a new H2 above `## Source Summaries`.
-3. `## Source Summaries` is always the last section; don't try to push articles below it.
+2. If none fits, pass a short title in `output_language` for the article's domain — the MCP appends
+   the new H2. Do not rely on a particular ordering of sections.
 
 ## wiki/summaries/ entry format
 
@@ -226,9 +230,21 @@ _Last updated: {YYYY-MM-DD}_
 
 ## {Domain section 2}
 - ...
+```
+
+## summary-index.md structure (skeleton)
+
+```
+---
+{frontmatter — preserve as-is}
+---
+
+# Wiki Index — Summaries
+
+_Last updated: {YYYY-MM-DD}_
 
-## Source Summaries
-- [[2026-05-08-topic]] — desc (2026-05-08)
+## Session Summaries
+- [[summaries/2026-05-08-topic]] — desc (2026-05-08)
 - ...
 ```
 
@@ -302,7 +318,6 @@ description: "keyword1, keyword2, likely trigger phrases the user would type —
 Summarize in `output_language` (report in pipeline order — summary → articles → brief):
 - 📝 summary: saved `wiki/summaries/<filename>`
 - 📄 articles: created/updated N pages (slugs)
-- 🗂 brief: `wiki/topic/<topic>.md` persona merge (`save_topic_brief`)
-- 📇 article-index: N `index_upsert` calls (article + summary)
-- 📇 topic-index: 1 `index_upsert` call (this topic)
+- 🗂 brief: `wiki/topic/<topic>.md` persona merge
+- 📇 catalogs: summary-index 1 row, article-index N rows, topic-index 1 row (all written by `wiki_write`)
 - 🛠 skill: created/updated `wiki/skills/<name>/skill.md` (or 'none')

package/dist/runtime/src/runtime/ask-callbacks.ts

@@ -12,18 +12,26 @@
 import { deliverPeerReply, type RemoteReplyRoute } from "#mcp/session-comm/peer-forward";
 import { db } from "#storage/forum-db";
 import { PENDING_ASK_TTL_MS, type PendingAskUserId } from "#storage/session-asks";
+import { registerStorageSchemaInitializer } from "#storage/storage-host";
 
-db.exec(`
-  CREATE TABLE IF NOT EXISTS remote_ask_callbacks (
-    target_query_id TEXT PRIMARY KEY,
-    request_id TEXT NOT NULL,
-    node_name TEXT NOT NULL,
-    node_cell_id TEXT NOT NULL,
-    topic_id TEXT NOT NULL,
-    user_id TEXT NOT NULL,
-    created_at INTEGER NOT NULL
-  )
-`);
+// Registered rather than executed at import time. A bare top-level `db.exec`
+// resolves the storage connection the moment this module is imported, which for
+// an embedding host is before `configureStorageHost()` has run — Negotium then
+// opens its own database in the default state directory, caches it, and every
+// later caller silently keeps using it instead of the host's.
+registerStorageSchemaInitializer((database) => {
+  database.exec(`
+    CREATE TABLE IF NOT EXISTS remote_ask_callbacks (
+      target_query_id TEXT PRIMARY KEY,
+      request_id TEXT NOT NULL,
+      node_name TEXT NOT NULL,
+      node_cell_id TEXT NOT NULL,
+      topic_id TEXT NOT NULL,
+      user_id TEXT NOT NULL,
+      created_at INTEGER NOT NULL
+    )
+  `);
+});
 
 interface PendingAskIdentity {
   userId: PendingAskUserId;

package/dist/runtime/src/runtime/background-sessions.ts

@@ -1,4 +1,5 @@
 import { listActiveMemoryArchiverSessions } from "#agents/archiver";
+import { summarizeDisplayText } from "#agents/tool-format";
 import { getTopic } from "#storage/api-topics";
 import { listRecentRuntimeEventsForTopic } from "#storage/runtime-events";
 import { listRuntimeTurnLeases } from "#storage/runtime-leases";
@@ -127,7 +128,7 @@ function detailedToolStep(payload: Record<string, unknown>): string {
 
   if (shortName === "ask_session" || shortName === "tell_session") {
     const target = typeof input.to === "string" && input.to.trim() ? input.to.trim() : "session";
-    const msg = typeof input.message === "string" ? text(input.message) : "";
+    const msg = typeof input.message === "string" ? summarizeDisplayText(text(input.message)) : "";
     const action = shortName === "ask_session" ? "Ask" : "Tell";
     return `${action} ${target}${msg ? ` — ${msg}` : ""}`;
   }
@@ -150,20 +151,21 @@ function detailedToolStep(payload: Record<string, unknown>): string {
     return `${action} file`;
   }
   if (shortName === "grep" || shortName === "glob") {
-    const pattern = typeof input.pattern === "string" ? input.pattern : "";
+    const pattern =
+      typeof input.pattern === "string" ? summarizeDisplayText(text(input.pattern)) : "";
     const action = shortName === "grep" ? "Grep" : "Glob";
-    if (pattern) return `${action} '${text(pattern)}'${path ? ` in ${path}` : ""}`;
+    if (pattern) return `${action} '${pattern}'${path ? ` in ${path}` : ""}`;
     if (path) return `${action} ${path}`;
   }
   if (shortName === "bash") {
-    const cmd = typeof input.command === "string" ? text(input.command) : "";
+    const cmd = typeof input.command === "string" ? summarizeDisplayText(text(input.command)) : "";
     return cmd ? `Bash: ${cmd}` : "Bash";
   }
   if (shortName === "webfetch" || shortName === "url_fetch") {
-    const url = typeof input.url === "string" ? text(input.url) : "";
+    const url = typeof input.url === "string" ? summarizeDisplayText(text(input.url)) : "";
     return url ? `Fetch ${url}` : "WebFetch";
   }
-  return label;
+  return summarizeDisplayText(label);
 }
 
 export function backgroundSessionProgress(
@@ -190,7 +192,7 @@ export function backgroundSessionProgress(
     else if (kind === "tool_output") {
       const toolName = toolNames.get(text(payload.toolUseId)) ?? "Tool";
       step = payload.isError
-        ? `${toolName} failed: ${text(payload.content) || "unknown error"}`
+        ? `${toolName} failed: ${summarizeDisplayText(text(payload.content)) || "unknown error"}`
         : `${toolName} result · ${byteSize(payload.content)}`;
     } else if (kind === "ai_done") {
       const usage =

package/dist/runtime/src/runtime/visual-store.ts

@@ -10,34 +10,42 @@
  */
 import { randomUUID } from "node:crypto";
 import { db } from "#storage/forum-db";
+import { registerStorageSchemaInitializer } from "#storage/storage-host";
 
 const MAX_HISTORY = 10;
 const MAX_VISUAL_TITLE_CHARS = 180;
 export const VISUAL_MEDIA_URL_PLACEHOLDER = "__NEGOTIUM_VISUAL_MEDIA_URL__";
 
-db.exec(`
-  CREATE TABLE IF NOT EXISTS api_topic_visuals (
-    id         INTEGER PRIMARY KEY AUTOINCREMENT,
-    topic_id   TEXT    NOT NULL,
-    html       TEXT    NOT NULL,
-    title      TEXT,
-    created_at INTEGER NOT NULL,
-    kind       TEXT    NOT NULL DEFAULT 'html',
-    source     TEXT,
-    file_id    TEXT,
-    mime_type  TEXT,
-    media_token TEXT
-  );
-  CREATE INDEX IF NOT EXISTS idx_api_topic_visuals_topic
-    ON api_topic_visuals(topic_id, created_at DESC);
-
-  CREATE TABLE IF NOT EXISTS api_topic_visual_views (
-    topic_id  TEXT NOT NULL,
-    user_id   TEXT NOT NULL,
-    visual_id INTEGER NOT NULL,
-    PRIMARY KEY (topic_id, user_id)
-  );
-`);
+// Registered rather than executed at import time. A bare top-level `db.exec`
+// resolves the storage connection the moment this module is imported, which for
+// an embedding host is before `configureStorageHost()` has run — Negotium then
+// opens its own database in the default state directory, caches it, and every
+// later caller silently keeps using it instead of the host's.
+registerStorageSchemaInitializer((database) => {
+  database.exec(`
+    CREATE TABLE IF NOT EXISTS api_topic_visuals (
+      id         INTEGER PRIMARY KEY AUTOINCREMENT,
+      topic_id   TEXT    NOT NULL,
+      html       TEXT    NOT NULL,
+      title      TEXT,
+      created_at INTEGER NOT NULL,
+      kind       TEXT    NOT NULL DEFAULT 'html',
+      source     TEXT,
+      file_id    TEXT,
+      mime_type  TEXT,
+      media_token TEXT
+    );
+    CREATE INDEX IF NOT EXISTS idx_api_topic_visuals_topic
+      ON api_topic_visuals(topic_id, created_at DESC);
+  
+    CREATE TABLE IF NOT EXISTS api_topic_visual_views (
+      topic_id  TEXT NOT NULL,
+      user_id   TEXT NOT NULL,
+      visual_id INTEGER NOT NULL,
+      PRIMARY KEY (topic_id, user_id)
+    );
+  `);
+});
 
 for (const statement of [
   "ALTER TABLE api_topic_visuals ADD COLUMN kind TEXT NOT NULL DEFAULT 'html'",

package/dist/runtime/src/storage/api-topics.ts

@@ -705,6 +705,32 @@ export function upsertTopic(t: TopicDto): void {
   })();
 }
 
+/**
+ * Apply one access mode to a set of topics as a single all-or-nothing write.
+ *
+ * A partial write is not a cosmetic glitch here: a public parent left with
+ * private subagent children (or the reverse) is exactly the half-exposed state
+ * the access-mode cascade exists to prevent, so every row commits or none do.
+ *
+ * Deliberately a narrow UPDATE instead of a loop over {@link upsertTopic}.
+ * That helper opens its own transaction, and the node:sqlite shim in
+ * `sqlite.ts` emulates transactions with bare BEGIN/COMMIT rather than
+ * savepoints — nesting one inside an outer transaction would fail outright.
+ * It also rewrites participants and browser-profile ownership, none of which
+ * an access-mode change should touch.
+ */
+export function setTopicAccessModes(
+  topicIds: readonly string[],
+  accessMode: TopicAccessMode,
+): void {
+  if (topicIds.length === 0) return;
+  const normalized = normalizeTopicAccessMode(accessMode);
+  db.transaction(() => {
+    const update = db.query("UPDATE api_topics SET access_mode = ? WHERE id = ?");
+    for (const topicId of topicIds) update.run(normalized, topicId);
+  })();
+}
+
 export function listTopics(): TopicDto[] {
   const rows = db
     .query("SELECT * FROM api_topics ORDER BY last_message_at DESC")

package/dist/runtime/src/storage/browser-profiles.ts

@@ -1,4 +1,5 @@
 import { db } from "#storage/forum-db";
+import { registerStorageSchemaInitializer } from "#storage/storage-host";
 
 export const DEFAULT_BROWSER_PROFILE = "default";
 
@@ -17,14 +18,21 @@ export function normalizeBrowserProfileName(name: string): string {
   return value;
 }
 
-db.exec(`
-  CREATE TABLE IF NOT EXISTS browser_profiles (
-    owner_id TEXT NOT NULL,
-    name TEXT NOT NULL,
-    created_at TEXT NOT NULL,
-    PRIMARY KEY (owner_id, name)
-  )
-`);
+// Registered rather than executed at import time. A bare top-level `db.exec`
+// resolves the storage connection the moment this module is imported, which for
+// an embedding host is before `configureStorageHost()` has run — Negotium then
+// opens its own database in the default state directory, caches it, and every
+// later caller silently keeps using it instead of the host's.
+registerStorageSchemaInitializer((database) => {
+  database.exec(`
+    CREATE TABLE IF NOT EXISTS browser_profiles (
+      owner_id TEXT NOT NULL,
+      name TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      PRIMARY KEY (owner_id, name)
+    )
+  `);
+});
 
 export function getBrowserProfileOwner(topicId: string, fallbackUserId: string): string {
   return (

package/dist/runtime/src/storage/runtime-events.ts

@@ -1,4 +1,5 @@
 import { db } from "#storage/forum-db";
+import { registerStorageSchemaInitializer } from "#storage/storage-host";
 
 export const RUNTIME_EVENT_TYPES = [
   "message",
@@ -29,26 +30,35 @@ interface RuntimeEventRow {
   created_at: string;
 }
 
-db.exec(`
-  CREATE TABLE IF NOT EXISTS runtime_events (
-    seq INTEGER PRIMARY KEY AUTOINCREMENT,
-    source_id TEXT NOT NULL,
-    event_type TEXT NOT NULL CHECK (
-      event_type IN (
-        'message',
-        'message-updated',
-        'ai-status',
-        'topic-created',
-        'topic-updated',
-        'topic-deleted'
-      )
-    ),
-    topic_id TEXT NOT NULL,
-    payload_json TEXT NOT NULL,
-    created_at TEXT NOT NULL
-  )
-`);
-db.exec("CREATE INDEX IF NOT EXISTS idx_runtime_events_topic_seq ON runtime_events(topic_id, seq)");
+// Registered rather than executed at import time. A bare top-level `db.exec`
+// resolves the storage connection the moment this module is imported, which for
+// an embedding host is before `configureStorageHost()` has run — Negotium then
+// opens its own database in the default state directory, caches it, and every
+// later caller silently keeps using it instead of the host's.
+registerStorageSchemaInitializer((database) => {
+  database.exec(`
+    CREATE TABLE IF NOT EXISTS runtime_events (
+      seq INTEGER PRIMARY KEY AUTOINCREMENT,
+      source_id TEXT NOT NULL,
+      event_type TEXT NOT NULL CHECK (
+        event_type IN (
+          'message',
+          'message-updated',
+          'ai-status',
+          'topic-created',
+          'topic-updated',
+          'topic-deleted'
+        )
+      ),
+      topic_id TEXT NOT NULL,
+      payload_json TEXT NOT NULL,
+      created_at TEXT NOT NULL
+    )
+  `);
+  database.exec(
+    "CREATE INDEX IF NOT EXISTS idx_runtime_events_topic_seq ON runtime_events(topic_id, seq)",
+  );
+});
 
 const types = new Set<string>(RUNTIME_EVENT_TYPES);
 

package/dist/runtime/src/storage/runtime-gateway-submissions.ts

@@ -1,4 +1,5 @@
 import { db } from "#storage/forum-db";
+import { registerStorageSchemaInitializer } from "#storage/storage-host";
 
 export interface RuntimeGatewaySubmission {
   clientMessageId: string;
@@ -25,19 +26,29 @@ interface RuntimeGatewaySubmissionRow {
   payload_hash: string | null;
 }
 
-db.exec(`
-  CREATE TABLE IF NOT EXISTS runtime_gateway_submissions (
-    client_message_id TEXT PRIMARY KEY,
-    request_id TEXT NOT NULL UNIQUE,
-    topic_id TEXT NOT NULL,
-    message_id TEXT NOT NULL,
-    user_id TEXT NOT NULL,
-    created_at TEXT NOT NULL,
-    ack_cursor INTEGER NOT NULL DEFAULT 0,
-    message_cursor INTEGER NOT NULL DEFAULT 0,
-    payload_hash TEXT
-  )
-`);
+// Registered rather than executed at import time. A bare top-level `db.exec`
+// resolves the storage connection the moment this module is imported, which for
+// an embedding host is before `configureStorageHost()` has run — Negotium then
+// opens its own database in the default state directory, caches it, and every
+// later caller silently keeps using it instead of the host's.
+registerStorageSchemaInitializer((database) => {
+  database.exec(`
+    CREATE TABLE IF NOT EXISTS runtime_gateway_submissions (
+      client_message_id TEXT PRIMARY KEY,
+      request_id TEXT NOT NULL UNIQUE,
+      topic_id TEXT NOT NULL,
+      message_id TEXT NOT NULL,
+      user_id TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      ack_cursor INTEGER NOT NULL DEFAULT 0,
+      message_cursor INTEGER NOT NULL DEFAULT 0,
+      payload_hash TEXT
+    )
+  `);
+  database.exec(
+    "CREATE INDEX IF NOT EXISTS idx_runtime_gateway_submissions_topic ON runtime_gateway_submissions(topic_id)",
+  );
+});
 try {
   db.exec(
     "ALTER TABLE runtime_gateway_submissions ADD COLUMN ack_cursor INTEGER NOT NULL DEFAULT 0",
@@ -51,9 +62,6 @@ try {
     "ALTER TABLE runtime_gateway_submissions ADD COLUMN message_cursor INTEGER NOT NULL DEFAULT 0",
   );
 } catch {}
-db.exec(
-  "CREATE INDEX IF NOT EXISTS idx_runtime_gateway_submissions_topic ON runtime_gateway_submissions(topic_id)",
-);
 
 function rowToSubmission(row: RuntimeGatewaySubmissionRow): RuntimeGatewaySubmission {
   return {

package/dist/runtime/src/storage/runtime-turn-requests.ts

@@ -9,6 +9,7 @@ import { db } from "#storage/forum-db";
 import { TURN_LEASE_STALE_MS } from "#storage/runtime-leases";
 import { getRuntimeTopicEpoch, TOPIC_MAINTENANCE_STALE_MS } from "#storage/runtime-topic-state";
 import type { StorageDatabase } from "#storage/storage-contract";
+import { registerStorageSchemaInitializer } from "#storage/storage-host";
 import type { AgentKind, EffortLevel, PeerRuntimeBridgeContext } from "#types";
 
 const REQUEST_CLAIM_STALE_MS = TURN_LEASE_STALE_MS;
@@ -149,7 +150,14 @@ export function ensureRuntimeUserTurnRequestsSchema(database: StorageDatabase):
   );
 }
 
-ensureRuntimeUserTurnRequestsSchema(db);
+// Registered rather than run at import time. Calling this with `db` on module
+// evaluation resolves the storage connection immediately, which for an
+// embedding host happens before `configureStorageHost()` — Negotium then opens
+// and caches its own database in the default state directory, and every later
+// caller silently keeps using it instead of the host's.
+registerStorageSchemaInitializer((database) =>
+  ensureRuntimeUserTurnRequestsSchema(database as unknown as StorageDatabase),
+);
 
 function rowToRequest(row: RuntimeUserTurnRequestRow): RuntimeUserTurnRequest {
   let attachments: string[] | undefined;