synomem 0.1.0

package/docs/cli.md

@@ -0,0 +1,180 @@
+---
+layout: default
+title: CLI reference
+---
+
+# CLI reference
+
+`synomem` is noninteractive by default. Add `--json` anywhere for stable machine output and
+`--home <path>` to override `SYNOMEM_HOME` and the default `~/.agents` root.
+
+```bash
+synomem --help
+synomem <command> --help
+```
+
+## Initialize and identities
+
+```bash
+synomem init
+synomem agent create codex --name "Codex" --alias reviewer
+synomem agent list
+synomem agent show reviewer
+synomem agent update codex --description "Careful reviewer"
+```
+
+IDs and aliases use lowercase ASCII letters, digits, and internal hyphens. Aliases never silently
+merge established identities.
+
+## Backend and authentication
+
+```bash
+synomem backend show
+synomem backend use remote --url https://api.example.com --workspace 01K...
+synomem auth login --actor-id codex --client-id synomem-cli
+synomem auth status --actor-id codex
+synomem auth logout --actor-id codex
+SYNOMEM_ACCESS_TOKEN=... synomem auth status
+synomem backend use local
+synomem init
+```
+
+Backend selection is explicit and applies to the CLI and stdio MCP. Remote mode calls the HTTPS
+domain API and does not open SQLite or write local Markdown projections. It does not synchronize or
+merge an existing local history. Switching back to local preserves both stores independently.
+
+`auth login` uses OAuth authorization code with PKCE S256, opens the system browser, listens on
+`127.0.0.1:43817` for the validated callback, verifies the resulting credential against the
+configured workspace/actor, and stores it in macOS Keychain or Linux Secret Service
+(`secret-tool`). Register that exact callback URI with the authorization server; use
+`--callback-port` only when the public client is registered with another fixed port.
+
+Pass `--actor-kind` when the identity is not an agent. `SYNOMEM_OAUTH_CLIENT_ID` can supply the
+public client ID. `SYNOMEM_ACCESS_TOKEN` remains the headless/CI override and is never persisted or
+printed. Stored refresh tokens are rotated when the authorization server returns a replacement.
+Use narrowly scoped credentials and avoid shell history or committed environment files.
+
+### One-way local import
+
+Only a human workspace owner or administrator with `synomem:workspace:admin` may import. Preview a
+fresh, consistent read-only SQLite snapshot first, then confirm the exact checksum-bound plan:
+
+```bash
+synomem remote import --from-home /path/to/local-home --actor-id troy --preview
+synomem remote import --from-home /path/to/local-home --actor-id troy --confirm <plan-id>
+```
+
+The first hosted importer accepts at most 5 MiB and 100,000 events, and only an empty destination
+workspace. Plans expire after 15 minutes. Confirmation creates a new snapshot; it fails if the
+source changed after preview. The source is never rewritten or deleted, backend selection is not
+changed, and a successful confirmation may be safely retried with the same plan and bundle.
+
+## Kudos
+
+```bash
+synomem kudos give codex \
+  --from gracie --actor-kind agent \
+  --title "Caught a continuity contradiction" \
+  --reason "Found conflicting requirements before implementation." \
+  --tag review --evidence task:E17 --idempotency-key gracie-codex-e17
+
+synomem kudos list --recipient codex
+synomem kudos show <kudos-id>
+synomem kudos acknowledge <kudos-id> --as codex
+synomem kudos revoke <kudos-id> --as gracie --actor-kind agent --reason "Corrected."
+synomem kudos wins codex --print
+synomem kudos stats
+```
+
+## Memos
+
+```bash
+synomem memo send codex --from gracie \
+  --subject "Review follow-up" --body "Please recheck the migration."
+synomem memo list --participant codex --status unread
+synomem memo show <memo-id>
+synomem memo read <memo-id> --as codex
+synomem memo archive <memo-id> --as codex
+```
+
+Sending to the actor's own agent ID is valid future-self communication. Sent content is immutable;
+send a correction rather than editing history.
+
+## Notes
+
+```bash
+synomem note create --as codex \
+  --title "Release invariant" --body "Never publish without explicit authorization."
+synomem note list --owner codex
+synomem note show <note-id>
+synomem note revise <note-id> --as codex --expected-version 1 --body "Revised text"
+synomem note archive <note-id> --as codex
+```
+
+Agents may mutate only their own notes. Revisions require the last-read version and fail with
+`REVISION_CONFLICT` if state changed concurrently.
+
+## Todos
+
+```bash
+synomem todo create codex --from gracie --title "Review migration" --due-date 2026-09-15
+synomem todo create codex --from gracie --title "Join review" \
+  --due-at 2026-09-15T14:00:00-05:00 --time-zone America/Chicago
+synomem todo list --assignee codex --status open
+synomem todo show <todo-id>
+synomem todo accept <todo-id> --as codex
+synomem todo reject <todo-id> --as codex --reason "Outside current scope."
+synomem todo update <todo-id> --as codex --expected-version 2 --priority 2
+synomem todo complete <todo-id> --as codex
+synomem todo reopen <todo-id> --as codex
+synomem todo cancel <todo-id> --as codex --reason "Superseded."
+```
+
+Todos assigned by another actor begin `assigned` and cannot be worked or completed until the
+assignee explicitly accepts them. Rejection is preserved as a lifecycle event. Self-created agent
+todos begin open. Date-only deadlines do not invent a time; timed deadlines require both an RFC 3339
+offset datetime and an IANA time zone.
+
+## Unified discovery and inbox
+
+```bash
+synomem inbox codex
+synomem list --kind memo --kind todo --participant codex --limit 10
+synomem changes --after <opaque-watermark>
+```
+
+List results are compact, default to 10, allow at most 50, and omit full detail fields. Changes
+default to 20 and allow at most 100. Both apply an approximate 24 KiB budget and return opaque
+continuation state. Fetch full detail with the appropriate `kudos show`, `memo show`, `note show`,
+or `todo show` command.
+
+## Administration
+
+```bash
+synomem doctor
+synomem rebuild
+synomem backup ./synomem-backup.sqlite3
+synomem export --format json|jsonl|markdown
+synomem mcp --actor-id codex --actor-kind agent --actor-name "Codex"
+synomem skill install --runtime codex --actor-id codex --actor-name "Codex" --yes
+synomem skill install --runtime hermes --actor-id mycroft --actor-name "Mycroft" --yes
+synomem skill status
+```
+
+Skill runtime names are `claude`, `codex`, `hermes`, `openclaw`, `cursor`, and `grok`;
+`grokbot` is accepted as an alias for local Grok Build. Omit `--runtime` to inspect every detected
+runtime. Install and uninstall remain dry runs unless `--yes` is present.
+
+Backups never overwrite an existing destination. JSON and JSONL are the recovery formats when a
+canonical row is malformed or newer than the installed package.
+
+## Exit codes
+
+| Code | Meaning                                               |
+| ---: | ----------------------------------------------------- |
+|    0 | Success                                               |
+|    1 | Unexpected internal failure                           |
+|    2 | Invalid arguments, configuration, conflict, or input  |
+|    3 | Agent or item not found                               |
+|    4 | Policy or read-only denial                            |
+|    5 | Database, schema, remote transport, or health failure |

package/docs/examples.md

@@ -0,0 +1,70 @@
+---
+layout: default
+title: Examples
+---
+
+# Examples
+
+All examples use fictional identities and an isolated temporary home.
+
+## Initialize identities
+
+```bash
+export SYNOMEM_HOME="$(mktemp -d)/.agents"
+
+synomem init
+synomem agent create atlas --name "Atlas"
+synomem agent create beacon --name "Beacon"
+```
+
+## Four distinct durable operations
+
+```bash
+synomem kudos give beacon --from atlas --actor-kind agent \
+  --title "Found the hidden retry race" \
+  --reason "Produced a minimal reproduction before release." \
+  --tag reliability --idempotency-key atlas-beacon-kudos-17
+
+synomem memo send beacon --from atlas --actor-kind agent \
+  --subject "Requirement changed" \
+  --body "Use the append-only transition described in ADR-17."
+
+synomem note create --as atlas --actor-kind agent \
+  --title "Repository convention" \
+  --body "All timestamps retain an explicit offset."
+
+synomem todo create beacon --from atlas --actor-kind agent \
+  --title "Review ADR-17" --priority 2 --due-date 2026-09-15
+```
+
+The cross-agent todo begins as `assigned`. Beacon must explicitly accept or reject it:
+
+```bash
+synomem todo accept <todo-id> --as beacon --actor-kind agent
+# or
+synomem todo reject <todo-id> --as beacon --actor-kind agent --reason "Wrong owner"
+```
+
+## Unified bounded reads
+
+```bash
+synomem inbox beacon
+synomem list --participant beacon --limit 20 --json
+synomem changes --after <previous-watermark> --limit 20 --json
+```
+
+Persist the returned change watermark and pass it on the next poll. Use a domain `show` command when
+full content is needed; list and change feeds intentionally return compact summaries.
+
+## Idempotent retry
+
+If a mutation response is interrupted, repeat it as the same actor with the same stable idempotency
+key. Synomem returns the original result with `deduplicated: true` instead of creating another item.
+
+## Demo script
+
+```bash
+npm run demo
+```
+
+The demo builds the package, uses a temporary home, records fictional data, and removes that data.

package/docs/mcp.md

@@ -0,0 +1,96 @@
+---
+layout: default
+title: MCP server
+---
+
+# MCP server
+
+`synomem-mcp` is an actor-bound stdio server built with the official TypeScript SDK. It opens no
+network listener.
+
+```text
+SYNOMEM_ACTOR_ID=codex
+SYNOMEM_ACTOR_KIND=agent
+SYNOMEM_ACTOR_NAME=Codex
+```
+
+Malformed or missing identity configuration fails startup. The server inserts the bound identity
+into mutations; callers cannot override it in tool arguments.
+
+## Registration
+
+```bash
+codex mcp add synomem \
+  --env SYNOMEM_ACTOR_ID=codex \
+  --env SYNOMEM_ACTOR_KIND=agent \
+  --env SYNOMEM_ACTOR_NAME=Codex \
+  -- synomem-mcp
+```
+
+Add `--env SYNOMEM_HOME=/absolute/shared/path` when not using `~/.agents`.
+
+When that home selects a remote backend, the same stdio MCP command uses the remote API and creates
+no local SQLite database or projections. Run `synomem auth login --actor-id <id> --client-id <id>`
+first, or provide `SYNOMEM_ACCESS_TOKEN` to the MCP process as a secret environment variable. The
+configured `--actor-*` values select the matching OS credential entry and describe the expected
+binding, but the hosted service remains authoritative and derives actor/workspace permissions from
+the token; request bodies cannot override them.
+
+## Tools
+
+Shared bounded reads:
+
+```text
+synomem_list             synomem_get
+synomem_changes          synomem_inbox
+```
+
+Purpose-specific writes:
+
+```text
+synomem_kudos_give       synomem_kudos_acknowledge   synomem_kudos_revoke
+synomem_memo_send        synomem_memo_read            synomem_memo_archive
+synomem_note_create      synomem_note_revise          synomem_note_archive
+synomem_todo_create      synomem_todo_update          synomem_todo_complete
+synomem_todo_accept      synomem_todo_reject          synomem_todo_reopen
+synomem_todo_cancel
+```
+
+Focused kudos reads and administration remain available:
+
+```text
+synomem_kudos_list       synomem_kudos_get            synomem_kudos_changes
+synomem_kudos_stats      synomem_agent_list           synomem_agent_create
+synomem_doctor           synomem_rebuild
+```
+
+Agent creation and rebuild are disabled by default. Every tool declares precise schemas, stable
+errors, structured and concise text content, the bound actor, and MCP behavior annotations.
+
+`synomem_list` returns 10 compact summaries by default and at most 50. `synomem_changes` returns 20
+changes by default and at most 100. Both stop around a 24 KiB item-data budget. Bodies, reasons,
+evidence, descriptions, source, and metadata require one explicit `synomem_get`.
+
+## Resources
+
+```text
+synomem://agents
+synomem://agents/<agent-id>/profile
+synomem://agents/<agent-id>/wins
+synomem://agents/<agent-id>/inbox
+synomem://items/<item-id>
+synomem://events/<event-id>
+```
+
+Resources apply the same participant and visibility policy as tools. Agents may read only their own
+inbox resource. Canonical event resources authorize against their aggregate before returning data.
+
+## Policy
+
+Edit `<home>/synomem/config.json` while writers are stopped. Safe defaults deny self-kudos, MCP
+identity creation, and MCP rebuild. Notes are unconditionally owner-private in V1. Cross-agent todo assignment is enabled; ownership and
+participant rules still apply.
+
+Human actors have local administrative authority. Agent actors manage only their own note, recipient
+memo state, and todos they created or received. System actors have no implicit authority. The
+filesystem owner remains the ultimate local authority.

package/docs/recovery.md

@@ -0,0 +1,45 @@
+---
+layout: default
+title: Backup and recovery
+---
+
+# Backup and recovery
+
+## Create a consistent backup
+
+Do not copy a live WAL database directly. Ask SQLite to create a consistent snapshot:
+
+```bash
+synomem backup ./synomem-backup.sqlite3
+```
+
+The destination must not exist. Synomem creates the backup with owner-only permissions where POSIX file modes are available.
+
+## Restore without risking the active home
+
+Stop Synomem writers before switching homes. Always validate a backup in a new directory; do not overwrite or delete the current database during validation.
+
+On macOS or Linux:
+
+```bash
+RESTORE_HOME="$PWD/restored-agents"
+mkdir -p "$RESTORE_HOME/synomem"
+chmod 700 "$RESTORE_HOME" "$RESTORE_HOME/synomem"
+install -m 600 ./synomem-backup.sqlite3 "$RESTORE_HOME/synomem/synomem.sqlite3"
+synomem --home "$RESTORE_HOME" doctor
+synomem --home "$RESTORE_HOME" rebuild
+```
+
+On Windows PowerShell:
+
+```powershell
+$RestoreRoot = Join-Path (Get-Location) "restored-agents"
+New-Item -ItemType Directory -Force (Join-Path $RestoreRoot "synomem")
+Copy-Item ".\synomem-backup.sqlite3" (Join-Path $RestoreRoot "synomem\synomem.sqlite3")
+synomem --home $RestoreRoot doctor
+synomem --home $RestoreRoot rebuild
+```
+
+Both commands must succeed. Inspect representative `WINS.md` and inbox files, then point `SYNOMEM_HOME` at the restored directory and restart agents. Keep the previous home unchanged until the restored installation has been exercised successfully, so rollback only requires switching the configured home back.
+
+If `doctor` reports an unsupported event, upgrade Synomem before writing. JSON and JSONL export preserve raw canonical payloads even when the installed version cannot interpret them.

package/docs/releasing.md

@@ -0,0 +1,61 @@
+---
+layout: default
+title: Releasing
+---
+
+# Releasing
+
+Publishing is intentionally separate from ordinary CI and requires maintainer authorization.
+
+## Bootstrap release
+
+An npm trusted publisher can be configured only after the package exists in the registry. The first
+release therefore requires an explicitly authorized, interactive publish by the maintainer:
+
+1. Confirm `npm whoami` reports the intended account and account-level two-factor authentication is enabled.
+2. Run every quality gate and inspect `npm publish --dry-run`.
+3. Publish once with `npm publish --access public`; complete the interactive authentication prompt.
+4. Verify the package name, version, files, binaries, and repository link on npm before continuing.
+
+Create the `v0.1.0` GitHub Release only after this bootstrap publish succeeds. The release workflow
+reruns the gates, verifies the tag, detects that the exact registry version already exists, and
+idempotently skips the duplicate publish.
+
+## Trusted publishing setup
+
+After the bootstrap package exists:
+
+1. On npmjs.com, configure a trusted publisher for:
+   - GitHub owner: `Coaden`
+   - Repository: `synomem`
+   - Workflow filename: `release.yml`
+   - Environment: `npm` if environment protection is enabled
+   - Allowed action: `npm publish`
+2. In GitHub, create an `npm` environment and preferably require maintainer approval.
+3. Enable GitHub Pages with **GitHub Actions** as the source.
+
+The release workflow uses OIDC trusted publishing, requires no long-lived npm token, and receives only `contents: read` and `id-token: write` permissions. npm trusted publishing generates provenance automatically for this public repository/package combination.
+
+## Subsequent release checklist
+
+1. Update `CHANGELOG.md` and remove the `Unreleased` placeholder for the version.
+2. Set the version with `npm version <major|minor|patch>` and review the generated commit/tag.
+3. Run:
+
+   ```bash
+   npm ci
+   npm run format:check
+   npm run lint
+   npm run typecheck
+   npm test
+   npm run test:coverage
+   npm run pack:check
+   npm pack --dry-run
+   ```
+
+4. Push the version commit and tag.
+5. Create an intentional GitHub Release for the tag.
+6. Review the `Release npm package` workflow and protected environment approval.
+7. Verify the npm page, provenance, tarball contents, both binaries, package exports, repository URL, and release notes.
+
+Do not publish from a developer laptop as the normal path, do not add an `NPM_TOKEN` fallback casually, and do not reuse the Pages workflow for npm publication.

package/docs/skill.md

@@ -0,0 +1,93 @@
+---
+layout: default
+title: Agent skill
+---
+
+# Agent skill
+
+The distributable skill lives at [`skills/synomem`](https://github.com/Coaden/synomem/blob/main/skills/synomem/SKILL.md) and is included in the npm tarball. It teaches skill-aware agents when durable recognition is appropriate, how to use MCP or CLI, how to sanitize evidence, and how to retry safely.
+
+## Repository-local installation
+
+Copy or link the skill into the runtime-specific repository skill directory. This keeps setup reviewable and scoped to one project.
+
+```text
+<repository>/.codex/skills/synomem/SKILL.md
+<repository>/.claude/skills/synomem/SKILL.md
+```
+
+## User installation
+
+The CLI verifies and manages these user-level layouts:
+
+| Runtime     | Skill destination            | Home override                  |
+| ----------- | ---------------------------- | ------------------------------ |
+| Claude Code | `~/.claude/skills/synomem`   | `CLAUDE_CONFIG_DIR`            |
+| Codex       | `~/.codex/skills/synomem`    | `CODEX_HOME`                   |
+| Hermes      | `~/.hermes/skills/synomem`   | `HERMES_HOME` (active profile) |
+| OpenClaw    | `~/.openclaw/skills/synomem` | `OPENCLAW_STATE_DIR`           |
+| Cursor      | `~/.cursor/skills/synomem`   | —                              |
+| Grok Build  | `~/.grok/skills/synomem`     | `GROK_HOME`                    |
+
+These locations follow the current vendor documentation for [Claude Code](https://code.claude.com/docs/en/skills), [Cursor](https://cursor.com/docs/skills), [Hermes](https://hermes-agent.nousresearch.com/docs/user-guide/features/skills), [OpenClaw](https://docs.openclaw.ai/skills), and [Grok Build](https://docs.x.ai/build/features/skills-plugins-marketplaces). Codex uses its native `$CODEX_HOME/skills` convention.
+
+```bash
+synomem skill install                                      # dry-run every detected runtime
+synomem skill install --runtime codex --yes                # install one copied skill
+synomem skill install --runtime claude --link --yes         # explicit package-linked install
+synomem skill install --runtime hermes --yes                # active HERMES_HOME profile
+synomem skill install --runtime openclaw --yes              # active OpenClaw state directory
+synomem skill install --runtime cursor --yes
+synomem skill install --runtime grokbot --yes                # alias for grok
+synomem skill status
+synomem skill uninstall --runtime claude                    # dry-run removal
+synomem skill uninstall --runtime claude --yes
+```
+
+Bare `install` and `uninstall` commands are dry runs. The installer applies only with `--yes`, only when the runtime home already exists, and only to its `skills/synomem` child. Copies carry an ownership/version stamp so `status` can report stale installations after npm updates. Existing unowned directories are conflicts and require explicit `--force`; unrelated sibling skills are never touched.
+
+Copy mode is the stable default. `--link` points at the skill inside the installed npm package, which updates with an in-place global package upgrade but may break if that package moves. Run `status` after package updates either way.
+
+Copied bundles preserve the packaged file modes so executable helper scripts remain executable.
+Skill content is operational guidance rather than confidential Synomem data and does not use the
+database and projection file-mode policy. The Synomem ownership/version stamp is restricted to the
+local user where POSIX modes are available.
+
+Add identity options to print a ready-to-review actor-bound MCP command for Codex, Claude Code,
+Hermes, OpenClaw, or Grok Build:
+
+```bash
+synomem skill install --runtime codex --actor-id codex --actor-name "Codex"
+synomem skill install --runtime claude --actor-id claude --actor-name "Claude"
+synomem skill install --runtime openclaw --actor-id mycroft --actor-name "Mycroft"
+```
+
+Cursor discovers skills automatically but currently requires MCP definitions in its global
+`~/.cursor/mcp.json` or project `.cursor/mcp.json`. Merge a `synomem` entry without replacing other
+servers. Use `synomem-mcp` as the command and pass `--actor-id`, `--actor-kind agent`, and
+`--actor-name` as arguments. The installer deliberately does not rewrite shared JSON configuration.
+
+Global skill installation changes agent configuration and is always an explicit user action. Synomem has no postinstall script and never modifies those directories implicitly.
+
+## MCP and skill roles
+
+The skill guides agent decisions; the MCP server performs and enforces operations. Install both for the best experience:
+
+1. Install `synomem`.
+2. Create stable profiles with the human CLI.
+3. Register one actor-bound MCP process per runtime.
+4. Install the skill where that runtime discovers skills.
+
+When MCP is unavailable, the skill permits using the local `synomem` CLI if command execution is allowed.
+
+## Runtime boundaries
+
+All supported installers target local filesystem runtimes. A hosted Grok Bot does not automatically
+share the desktop's `~/.agents` database. It can use Synomem only if its persistent machine supports
+Node.js, local stdio MCP, and its own durable Synomem home. Otherwise give it the public
+[`SKILL.md`](https://github.com/Coaden/synomem/blob/main/skills/synomem/SKILL.md) as guidance and do
+not tunnel or copy the live SQLite database.
+
+Other harnesses may use the same Agent Skills format, but Synomem does not write to an unverified
+directory. Inspect authoritative documentation or a real installation before copying the packaged
+skill or configuring MCP.

package/docs/storage-format.md

@@ -0,0 +1,83 @@
+---
+layout: default
+title: Storage format
+---
+
+# Storage format
+
+## Home layout
+
+```text
+~/.agents/
+├── synomem/
+│   ├── config.json
+│   ├── synomem.sqlite3
+│   ├── synomem.sqlite3-wal
+│   └── synomem.sqlite3-shm
+└── <agent-id>/
+    ├── profile.json
+    ├── WINS.md
+    ├── MEMORY.md
+    ├── TODOS.md
+    ├── inbox/{kudos,memos,todos}/<item-id>.md
+    └── NOTES.md
+```
+
+`SYNOMEM_HOME`, the CLI `--home` option, or the library's `home` option changes the root.
+
+`config.json` schema version 3 contains an explicit backend:
+
+```json
+{ "kind": "local" }
+```
+
+or a remote service location and workspace identifier:
+
+```json
+{
+  "kind": "remote",
+  "baseUrl": "https://synomem.example",
+  "workspaceId": "01K..."
+}
+```
+
+Schema version 2 configurations migrate to the local backend. Remote credentials are not stored in
+this file. The local SQLite client refuses remote configuration rather than creating a shadow local
+database.
+
+## SQLite schema
+
+Schema version 3 contains:
+
+- `events`: canonical append-only validated JSON events with workspace, aggregate, query, and
+  monotonic sequence fields;
+- `items_current`: compact cross-type summary and lifecycle state;
+- `kudos_current`: focused recognition summary and acknowledgment/revocation state;
+- `agents` and `aliases`: current identity projections;
+- `projection_manifest`: generated paths eligible for constrained cleanup;
+- `schema_migrations`: applied database migrations.
+
+Events use transactionally assigned ingestion sequences for cursors and watermarks. Aggregate
+versions provide optimistic concurrency for notes and todos. Actor-scoped idempotency keys protect
+all retryable mutations.
+
+Current tables and files are rebuildable. Full bodies, reasons, evidence, descriptions, source, and
+metadata remain in canonical events and require detail reads. Machine APIs never parse Markdown.
+
+## Generated and owned files
+
+`profile.json`, `WINS.md`, `MEMORY.md`, `TODOS.md`, and inbox entries are generated. Normal mutations
+synchronize only affected agents; `synomem rebuild` performs full deterministic regeneration.
+Cleanup removes only manifest-listed regular files and never follows symlinks.
+
+`NOTES.md` is human-owned, is never placed in the manifest, and is never overwritten. Canonical
+agent notes project to `MEMORY.md`.
+
+## Recovery
+
+Use `synomem backup` for a consistent SQLite snapshot. Use JSON or JSONL export for portable raw
+recovery, including unsupported or malformed rows. Markdown export may omit rows it cannot safely
+render.
+
+Never edit canonical tables, overwrite an active database, copy a live database naively, or
+synchronize it through Git, Dropbox, a network share, or a file-copy tool.