trajectories 0.0.0 → 0.1.2

package/docs/research/ledger/README.md

@@ -0,0 +1,96 @@
+# Ledger research archive
+
+This directory preserves the Markdown prior-art and implementation research from
+[archeism/ledger at `43081aef54c23b4bd017b6c0e11fc42a9a1cb381`](https://github.com/archeism/ledger/tree/43081aef54c23b4bd017b6c0e11fc42a9a1cb381).
+It is historical evidence. Runtime commands, implementation plans, test counts and
+open items describe Ledger at that frozen commit; they are not current Trajectories
+instructions or fresh verification.
+
+Only Markdown was copied. No experiments, transcripts, databases, archives or other
+runtime artifacts are included. The archive retains the complete frozen `docs/research`
+directory, Ledger's inspiration and PR2/PR6 integration records, the Wake deep dive,
+and the Confer pages directly cited by the retained research. Relative links inside
+the copied set stay local. Relative links to excluded files are rewritten to immutable
+GitHub blobs at the source commit. Existing upstream URLs are unchanged.
+
+Seven source links under `docs/research` incorrectly used `../confer`, which resolves
+to nonexistent `docs/confer` paths. This archive repairs only those destinations to
+the included root `confer` files. Each repair is declared below and in its manifest
+entry; the source text and original digest remain recorded separately.
+
+`manifest.json` is the machine-readable inventory. Every row below records the original
+path and digest, ported path and digest, and the only allowed transformation.
+
+- Source files: 43
+- Source bytes: 511973
+- Ported bytes: 516313
+- Rewritten relative links: 49
+- Declared broken-link repairs: 7
+- Archive budget: 516313 / 2,097,152 bytes
+
+## Declared link repairs
+
+| Source document | Old destination | New destination | Resolved frozen source |
+| --- | --- | --- | --- |
+| `docs/research/2026-09-13-read-path-split.md` | `../confer/2026-09-13-round-5/README.md` | `../../confer/2026-09-13-round-5/README.md` | `confer/2026-09-13-round-5/README.md` |
+| `docs/research/2026-09-13-scan-outcomes.md` | `../confer/2026-09-13-round-7/README.md` | `../../confer/2026-09-13-round-7/README.md` | `confer/2026-09-13-round-7/README.md` |
+| `docs/research/2026-09-13-search-quality.md` | `../confer/2026-09-13-round-2/cass.md` | `../../confer/2026-09-13-round-2/cass.md` | `confer/2026-09-13-round-2/cass.md` |
+| `docs/research/2026-09-13-source-coverage.md` | `../confer/2026-09-13-round-9/README.md` | `../../confer/2026-09-13-round-9/README.md` | `confer/2026-09-13-round-9/README.md` |
+| `docs/research/2026-09-13-sync-wall-budget.md` | `../confer/2026-09-13-round-10/README.md` | `../../confer/2026-09-13-round-10/README.md` | `confer/2026-09-13-round-10/README.md` |
+| `docs/research/2026-09-13-typed-read-gate.md` | `../confer/2026-09-13-round-6/README.md` | `../../confer/2026-09-13-round-6/README.md` | `confer/2026-09-13-round-6/README.md` |
+| `docs/research/2026-09-13-writer-lease.md` | `../confer/2026-09-13-round-3/README.md` | `../../confer/2026-09-13-round-3/README.md` | `confer/2026-09-13-round-3/README.md` |
+
+## Inventory
+
+| Original | Ported | Original SHA-256 | Ported SHA-256 | Change rule |
+| --- | --- | --- | --- | --- |
+| `confer/2026-09-13-round-10/README.md` | `packages/trajectories/docs/research/ledger/confer/2026-09-13-round-10/README.md` | `44254e61ceffd3faa52947031b2222527e207ecd60d87743848b9fc7fbfa3e8a` | `a154c0f70a2a6b961e89dfdef8ed54eab622b5e2930bc845567f03f65e88a046` | relative-markdown-links-rewritten-only (6) |
+| `confer/2026-09-13-round-2/cass.md` | `packages/trajectories/docs/research/ledger/confer/2026-09-13-round-2/cass.md` | `21c76e69f89abc8e9f774ab8e96be08dc170636a75c1b79bc694b6cbc606ea39` | `21c76e69f89abc8e9f774ab8e96be08dc170636a75c1b79bc694b6cbc606ea39` | verbatim |
+| `confer/2026-09-13-round-3/README.md` | `packages/trajectories/docs/research/ledger/confer/2026-09-13-round-3/README.md` | `10afd29c8e45520c2ccd9c84ba99f10803bc0c357c62153150167bdd8112b7e2` | `53f61e79675ca390ae1e8a8f1bdfa8a66db2dccc9ecc7f4b458346cb2827d285` | relative-markdown-links-rewritten-only (6) |
+| `confer/2026-09-13-round-5/README.md` | `packages/trajectories/docs/research/ledger/confer/2026-09-13-round-5/README.md` | `51fb9c9c3f6aa3a7551e31db81af97af254c36c1e0cef47d3cf3aa252f3f871c` | `b214e96243682b3a78a3119a3704fd9f2e9cfa5e20c568f67adda842d1bb450c` | relative-markdown-links-rewritten-only (6) |
+| `confer/2026-09-13-round-6/README.md` | `packages/trajectories/docs/research/ledger/confer/2026-09-13-round-6/README.md` | `2050496aaf68f48884407a6dcb646f19e9fb223695b425bf40c1e6025c59bf19` | `fc9770f596f41298b4d60b9438a668bf4d2ae738963ea7f298f482bdea82a329` | relative-markdown-links-rewritten-only (6) |
+| `confer/2026-09-13-round-7/README.md` | `packages/trajectories/docs/research/ledger/confer/2026-09-13-round-7/README.md` | `27ea87e1db60d4bd1cc8f3b219d66419119490901199c78a0d8e5e8b5740c1e7` | `a7871a8beca5907dd80f25dac952130a76bea6fcceeed5d28f04516a542043ad` | relative-markdown-links-rewritten-only (6) |
+| `confer/2026-09-13-round-9/README.md` | `packages/trajectories/docs/research/ledger/confer/2026-09-13-round-9/README.md` | `f695bfb3a2d9010d771c719d6ef7f1fb9c4fe64f395295e4b8cfd7b2749dd1a7` | `73b79a4774ade7986f5c63d425976c2a8e1d1e9db3934631471f374b1c98e3b9` | relative-markdown-links-rewritten-only (6) |
+| `confer/2026-09-14-wake/wake.md` | `packages/trajectories/docs/research/ledger/confer/2026-09-14-wake/wake.md` | `7369f061e4dbe831f43cd59fc293f318e3c7a02c095ed7ad0de6dbc6d7432cfe` | `7369f061e4dbe831f43cd59fc293f318e3c7a02c095ed7ad0de6dbc6d7432cfe` | verbatim |
+| `docs/inspirations.md` | `packages/trajectories/docs/research/ledger/docs/inspirations.md` | `0555efdcfc8db9e9c35be6c6ec3b692de903fd03d1af14988cde71ba03ff63b4` | `df3da0ff9844814bd12c24e8bd937a5e1de43a6407f9623666b9c44e8e15ce2e` | relative-markdown-links-rewritten-only (1) |
+| `docs/pr2-pr6-integration.md` | `packages/trajectories/docs/research/ledger/docs/pr2-pr6-integration.md` | `27ae83cbcf8c2faa73c66ce3e7db91b211f65f3336c186455e0c3b6f3ff80ad2` | `27ae83cbcf8c2faa73c66ce3e7db91b211f65f3336c186455e0c3b6f3ff80ad2` | verbatim |
+| `docs/research/2026-09-07-confer-inspirations.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-07-confer-inspirations.md` | `9c4e1cff49f87f82aca9631f3614477868838d963ff3d74b577c00416430a208` | `9c4e1cff49f87f82aca9631f3614477868838d963ff3d74b577c00416430a208` | verbatim |
+| `docs/research/2026-09-07-letta-continuous-service.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-07-letta-continuous-service.md` | `a636b41a93d7b72896e4d37a8a49a5d69b378ff762a7b51386283da59bfcaf0f` | `a636b41a93d7b72896e4d37a8a49a5d69b378ff762a7b51386283da59bfcaf0f` | verbatim |
+| `docs/research/2026-09-08-claude-history-retrieval.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-08-claude-history-retrieval.md` | `ebb54cf725d48e645c53db2762f9cb024c0f272563678be29787fc74441e2aad` | `ebb54cf725d48e645c53db2762f9cb024c0f272563678be29787fc74441e2aad` | verbatim |
+| `docs/research/2026-09-09-agentsview-native-discovery.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-09-agentsview-native-discovery.md` | `f355278d4eaac8efb7426b4c5e803128c25b1d1e5d194d32aff70d8cb848c138` | `f355278d4eaac8efb7426b4c5e803128c25b1d1e5d194d32aff70d8cb848c138` | verbatim |
+| `docs/research/2026-09-09-daemon-observation.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-09-daemon-observation.md` | `8f5375194be8cfcb815ccbffad3d8100840d3e4c80f98f939351094505382c9b` | `8f5375194be8cfcb815ccbffad3d8100840d3e4c80f98f939351094505382c9b` | verbatim |
+| `docs/research/2026-09-09-discovery-pagination.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-09-discovery-pagination.md` | `c2bb6df588ae69eb23a2b59c01b7571197a4ad94bb222cf6c7dfba45e05ce8cf` | `96b6605794e557c6e0a038abb8b18f31704d52fdfdc77404cf81cd6e38353fdc` | relative-markdown-links-rewritten-only (1) |
+| `docs/research/2026-09-09-harness-transcript-contract.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-09-harness-transcript-contract.md` | `5fdf934f351a6eca66eb0ecd9022ae431eba4117db402cfad4955bb6466b299a` | `0c05ce1a60bd6f28d443086a3ff132f27be5f19b09e5b2768614a040dd2201c3` | relative-markdown-links-rewritten-only (1) |
+| `docs/research/2026-09-09-native-history-discovery.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-09-native-history-discovery.md` | `efdbf356e4c2ed111067c7426f977c693b7c77123567a83f3c77400e3f2debd4` | `ad6493f6bc48d02dc177e35e65a40c557fd19db2b0d1e25235964113c222540d` | relative-markdown-links-rewritten-only (1) |
+| `docs/research/2026-09-09-native-history-implementation.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-09-native-history-implementation.md` | `c22b2fd509d098f10865c57f5c30a57cfbbaab4fb6e078fa253275229058cc64` | `c22b2fd509d098f10865c57f5c30a57cfbbaab4fb6e078fa253275229058cc64` | verbatim |
+| `docs/research/2026-09-09-other-inspirations.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-09-other-inspirations.md` | `4819acf55cd230a53e0728d7e4e34367f3d90f6d573cae5482f6d1d9cd62d5a1` | `4819acf55cd230a53e0728d7e4e34367f3d90f6d573cae5482f6d1d9cd62d5a1` | verbatim |
+| `docs/research/2026-09-09-trajectory-and-letta-code.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-09-trajectory-and-letta-code.md` | `02208cabe339c5ef942fa33d6557db7b1b691562a22d6b365a481e6c353f21ee` | `1e0ea3e3ccfe072a0e8430515c28af739afa6b2da0a5fe32b03b55d0467bfe3d` | relative-markdown-links-rewritten-only (1) |
+| `docs/research/2026-09-13-diagnostics-coverage.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-13-diagnostics-coverage.md` | `115a6143214b34c4672a64b25aef3b29621cf88fa50bc2f38313fecbb760ab30` | `115a6143214b34c4672a64b25aef3b29621cf88fa50bc2f38313fecbb760ab30` | verbatim |
+| `docs/research/2026-09-13-fts-rebuild.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-13-fts-rebuild.md` | `329893715deaaa9928aa935a5ada161e186f445b90f26b014603548fba422861` | `329893715deaaa9928aa935a5ada161e186f445b90f26b014603548fba422861` | verbatim |
+| `docs/research/2026-09-13-read-path-split.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-13-read-path-split.md` | `8f5442beb04b340b2efd13403d9def649310b6aa785c07b53f8e39001e89388b` | `1c5617e8d46d66743a004e9be75f6ac3b8f92e108e294878dd8573b0d5012f16` | relative-markdown-links-rewritten-only (1) |
+| `docs/research/2026-09-13-runtime-rollout.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-13-runtime-rollout.md` | `62c64f0996dba7ef3d6f952d59ec51b7695d5937876ae6652481c0ba65ba218a` | `f58ac18e567b01ffde421606cd1e1da645dcb9cfee05a7009157a696240428c4` | relative-markdown-links-rewritten-only (1) |
+| `docs/research/2026-09-13-scan-outcomes.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-13-scan-outcomes.md` | `56809f100094083b79b8f8b5aac874e309a2c638ba71c9792f2c3944480641d2` | `44ab19c1168db5755e0fd50bb3c8a753045cc14865915abcc12e715136be499c` | relative-markdown-links-rewritten-only (1) |
+| `docs/research/2026-09-13-search-quality.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-13-search-quality.md` | `fb279b7c17b7ff1efa91c7b2372d6c8311bcc82268c1f710a854952f214290cd` | `3d766f9d1bd664dab572889217949d1937b393ada810e3e2e62ece61a44fbac6` | relative-markdown-links-rewritten-only (1) |
+| `docs/research/2026-09-13-source-coverage.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-13-source-coverage.md` | `1110deac61390c7cb71cb42c1f9576c0e93ee01aae430ea13108e4c7b661c984` | `37b73217da5cd48fb0191a82e6ae612658b473a93123b401a8776aac97c2a3d6` | relative-markdown-links-rewritten-only (1) |
+| `docs/research/2026-09-13-sync-wall-budget.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-13-sync-wall-budget.md` | `1ad94f66f4dea3419b3833ad251995966e30d0adc3068c2aa25769ccabda4a23` | `ff814019d32c1ad580b21811541d76a29e6bfe602f2e39e2e248de05f69463a1` | relative-markdown-links-rewritten-only (1) |
+| `docs/research/2026-09-13-typed-read-gate.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-13-typed-read-gate.md` | `b8986e031ed75bf406f78fa9bd08a3fdb22f3ade64542fe9f5613fa4aac71d2b` | `1836755adcd4cdb5dc9b36385a3f3b1a2d652fc83a73a82b838330a7d6c77058` | relative-markdown-links-rewritten-only (1) |
+| `docs/research/2026-09-13-writer-lease.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-13-writer-lease.md` | `faf243cc3806c4092a28754694eae4fed353a0858493e0c52dfaabbd2712fe9b` | `baa8ea384bbeb8f174b0bc110d6b5e8535321bfcb596d4a46a9ac2555c187ab1` | relative-markdown-links-rewritten-only (1) |
+| `docs/research/2026-09-16-c1-copy-fallback.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-16-c1-copy-fallback.md` | `0511562c37aae9ee2a2c084c4cb57307ade18c6582eeea88c984da4b4f17a4b0` | `0511562c37aae9ee2a2c084c4cb57307ade18c6582eeea88c984da4b4f17a4b0` | verbatim |
+| `docs/research/2026-09-16-c10-kimi.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-16-c10-kimi.md` | `5e36bb0db62a75ce0262cf1df5668dd176d1ae920b0ab9693f565ba0b4062ab5` | `5e36bb0db62a75ce0262cf1df5668dd176d1ae920b0ab9693f565ba0b4062ab5` | verbatim |
+| `docs/research/2026-09-16-c2-derive-counter.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-16-c2-derive-counter.md` | `c81fc27fa5c801fcb32306a160d1e8461764f771a2e2581a44df177e1681d821` | `c81fc27fa5c801fcb32306a160d1e8461764f771a2e2581a44df177e1681d821` | verbatim |
+| `docs/research/2026-09-16-c3-echo-filter.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-16-c3-echo-filter.md` | `0c58ee7286cb7504ed338859a11ae7d7c556c24fec8d76ca45181a0e4a8162f4` | `0c58ee7286cb7504ed338859a11ae7d7c556c24fec8d76ca45181a0e4a8162f4` | verbatim |
+| `docs/research/2026-09-16-c4-title-index.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-16-c4-title-index.md` | `dfeb51cc018da0316d313559e3ef8d96bf88ca8f68acc6c4d8f8c57dfaf938ee` | `dfeb51cc018da0316d313559e3ef8d96bf88ca8f68acc6c4d8f8c57dfaf938ee` | verbatim |
+| `docs/research/2026-09-16-c5-trigram.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-16-c5-trigram.md` | `65099e8a3f50ace49e4eab5d09815c5d7aa04f3fa0c0dfbdb746de242b275f94` | `65099e8a3f50ace49e4eab5d09815c5d7aa04f3fa0c0dfbdb746de242b275f94` | verbatim |
+| `docs/research/2026-09-16-c6-recency-prior.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-16-c6-recency-prior.md` | `0c224e6b1f9ec4b44a2d4f149558bc28500908c16ad4a86b8d4179a112da7e7d` | `0c224e6b1f9ec4b44a2d4f149558bc28500908c16ad4a86b8d4179a112da7e7d` | verbatim |
+| `docs/research/2026-09-16-c7-tombstones.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-16-c7-tombstones.md` | `e89f48676ce31efd53910f385592409ee5e0e963db98b7739871301d62c859e5` | `e89f48676ce31efd53910f385592409ee5e0e963db98b7739871301d62c859e5` | verbatim |
+| `docs/research/2026-09-16-c8-remote-truth.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-16-c8-remote-truth.md` | `b938739cfc75535950a361c57a31a65e3afda8799305385721143ca69ebb7bc4` | `b938739cfc75535950a361c57a31a65e3afda8799305385721143ca69ebb7bc4` | verbatim |
+| `docs/research/2026-09-16-c9-grok.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-16-c9-grok.md` | `eea295814219519ce73018c5d2adbf6744f53ba6d1e9424372fc1063259203c3` | `eea295814219519ce73018c5d2adbf6744f53ba6d1e9424372fc1063259203c3` | verbatim |
+| `docs/research/2026-09-16-wake-port-program.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-16-wake-port-program.md` | `4f51e32d4a505093a1df5c8793aa1288c172e1d79a2d9635ac37d44bda604700` | `4f51e32d4a505093a1df5c8793aa1288c172e1d79a2d9635ac37d44bda604700` | verbatim |
+| `docs/research/2026-09-17-cursor-blobstore.md` | `packages/trajectories/docs/research/ledger/docs/research/2026-09-17-cursor-blobstore.md` | `8ce6ea4dab7b138af4237d35f9b0fdbf0dd1798c8bfb0219378d4fd052375f55` | `8ce6ea4dab7b138af4237d35f9b0fdbf0dd1798c8bfb0219378d4fd052375f55` | verbatim |
+
+## Excluded material
+
+Large experiment outputs, native histories, databases, transcript bodies and archives
+remain in Ledger's own retained history or external evidence stores. Source files,
+runbooks, case studies, decisions, lab protocols and non-cited Confer reports outside
+this bounded packet are linked to immutable Ledger blobs when referenced.

package/docs/research/ledger/confer/2026-09-13-round-10/README.md

@@ -0,0 +1,61 @@
+# Confer round 10 — 2026-09-13
+
+Deadline/watchdog round. Pins: all six unchanged (trajectory `21ae92d`
+10th, obelisk `45eaac8b` 9th, agentsview `532fd652` 6th, cass `6d445f6`
+5th, vercel/ai `6c6c2210`, letta-code `1ec6a43f` 3rd). Baseline: main
+`cb3d414`.
+
+| Repo | File |
+| --- | --- |
+| letta-ai/trajectory | [trajectory.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-10/trajectory.md) |
+| letta-ai/letta-code | [letta-code.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-10/letta-code.md) |
+| tommy0103/obelisk | [obelisk.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-10/obelisk.md) |
+| dicklesworthstone/cass | [cass.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-10/cass.md) |
+| kenn-io/agentsview | [agentsview.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-10/agentsview.md) |
+| vercel/ai harness | [vercel-ai-harness.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-10/vercel-ai-harness.md) |
+
+## Cycle-10 decision: enforce the sync wall budget across worker waits (#35)
+
+Scout defect map on main: `workDeadline` is consulted only at the two
+admission gates (`sync.ts:713/723`); the worker wave `Promise.all`
+(`:777`) has no timeout; `spawnJsonChild` (`:389-428`) fires
+SIGTERM→SIGKILL on its timer but **never settles the awaited promise** —
+a hung child stdout drain hangs the parent forever; `handleSync` has no
+signal handlers, so launchd's SIGTERM kills the parent and orphans the
+children. That is exactly the observed 75-minute zero-CPU hold.
+
+Design (sources in brackets):
+
+1. **Settle the spawn promise**: on timeout, the kill sequence
+   (SIGTERM → grace → SIGKILL, already present) must end with the
+   promise settling to a typed timeout result (pid, budget, phase);
+   the stdout drain races the kill so it cannot outlive it. Workers
+   that are slow-but-alive within their own budget are untouched.
+   [cass PAGE_SLEEP vs PARK pair is the pinned distinction]
+2. **One absolute deadline, recomputed** (`workDeadline`, already
+   computed): clamp `min(remaining wall, per-worker budget)` into every
+   wave wait; the last wait can never overshoot. On wall expiry: typed
+   outcome, kill remaining children (group semantics — the children are
+   ours), proceed to summary. [harness deadline-clamp rule; letta-code
+   outer group kill + cooperative inner wall]
+3. **Truthful reporting**: `SyncSummary.outcome` gains
+   `wall_budget_exceeded` with completed-so-far counts and the elapsed —
+   a bounded pass is a result, not a hang. [cass compact typed abort
+   line; agentsView named ReasonFinalizationTimeout]
+4. **Lease invariant preserved**: the abort path runs the existing
+   `finally` (lease release) — the deadline signal must live outside
+   the cleanup path so an abort cannot inherit the wedge.
+   [letta-code: keep the deadline out of the abort path]
+5. Tests mirror cass's fault pair: a never-replying worker (PARK) →
+   pass aborts at the wall with the typed outcome, no orphan children,
+   lease released, summary truthful; a slow-but-progressing worker
+   (PAGE_SLEEP) within budget → completes normally; normal passes
+   byte-identical summaries (regression).
+
+## Deferred
+
+- Progress-watermark stall detection inside workers (obelisk's
+  insight: watch a watermark, not just the clock) — the worker budget
+  already bounds each child; a watermark matters only for multi-minute
+  per-worker budgets.
+- Watcher drain deadlines (watch has its own paths; separate surface).

package/docs/research/ledger/confer/2026-09-13-round-2/cass.md

@@ -0,0 +1,72 @@
+# coding_agent_session_search (Cass) — round 2 (widening mechanics, robot envelope, FTS5 probe, qrels gate)
+
+## Outcome
+
+Four implementation-grade extracts for Ledger's cycle-2 search-quality work, all re-read at the refreshed pin. (1) Sparse-query widening is a **bounded rerun of the same search with a different query string**: five cheap gates, strictly-more acceptance, per-hit tagging, and explicit reporting. (2) The robot envelope splits into honesty fields Ledger can compute from one FTS5 table + optional embeddings, versus Tantivy/searcher-cache shard machinery to omit verbatim. (3) The FTS5 probe is a one-line special command whose *placement* matters: never on the search path, always before a destructive operation, dry-run-first repair. (4) The quality gate is a checked-in qrels fixture scored by a pure core, wired into CI **by filename**, and offline because semantic acquisition is pinned to a deterministic local embedder.
+
+## Pin (delta)
+
+- Round-2 pin `dicklesworthstone/coding_agent_session_search@c7cd1ad3ff7ee5d4323b9c840dcfcda683881e36` (`cass@c7cd1ad`); round-1 `07aa43e2` is an ancestor, **11 commits** between, none touching this round's subject files. `src/lib.rs` gained +20 lines net, all in mirror/prune/clipboard regions, so envelope anchors shift **+20** (`SearchCursorManifestInput` 33835→33855; `"cursor_manifest"` inserts 34716→34736) — content identical. `ci.yml`, `src/search/query.rs`, `src/indexer/mod.rs`, `src/search_quality_eval.rs`, `src/search/storage_integrity.rs` **unchanged**. Every round-1 substantive claim survives; only the `lib.rs` anchors move.
+- Clone: `/tmp/ledger-confer/round-2/cass` (round-1 shallow clone, `git fetch --depth 300`, `git checkout origin/main`). Read-only, never copied into the Ledger tree.
+
+## 1. Sparse/zero-result widening — exact mechanics
+
+- **Gate** (all cheap; no second query until every predicate passes) `cass@c7cd1ad:src/search/query.rs#L6754-L6772`: *sparse* = `returned_hits < min(sparse_threshold, limit)` when `limit > 0` else `< sparse_threshold`, and **`offset != 0` never widens** `#L3943-L3958`; *no explicit syntax* — no `*` in the query, `fs_cass_has_boolean_operators` false (AND/OR/NOT case-insensitive, `&&`, `||`, any quoted phrase; asserted `#L19307-L19315`), `query.trim()` non-empty; *index ceiling* — `index_doc_count <= CASS_AUTOMATIC_WILDCARD_FALLBACK_MAX_DOCS` (default `10_000`, `0` disables the feature) `#L792`, `#L811-L826`; *long-token guard* — only when `returned_hits == 0`, skip if any term exceeds `AUTOMATIC_WILDCARD_FALLBACK_MAX_TOKEN_CHARS = 16` `#L738`, `#L3962-L3974`. Threshold origin: CLI passes `3`, capped to the visible limit unless aggregation over-fetched (`src/lib.rs#L30429`, `#L30457`, `fn sparse_threshold_for_visible_limit` `#L27009-L27018`); the TUI passes `0`, i.e. interactive search never widens `src/ui/app.rs#L15625`.
+- **Shape / acceptance / tagging**: `query.split_whitespace().map(|t| format!("*{}*", t.trim_matches('*'))).join(" ")` `#L6820-L6826`, re-parsed by the same engine (`let mut fallback_hits = self.search(&wildcard_query, …)?` `#L6831-L6832` — a widened-query parse error propagates, it is not swallowed). Adopt **iff `fallback_hits.len() > hits.len()`** (strictly larger), else the original page is returned untouched `#L6842`. Every adopted hit gets `match_type = MatchType::ImplicitWildcard` `#L6843-L6845`, whose `quality_factor()` is **0.6** `#L1455` — the tag feeds ranking/trust math, not just reporting. Suggestions are generated only on a true zero `#L6803-L6807`, `#L6848-L6852`.
+- **Reporting**: `SearchResult.wildcard_fallback: bool` `#L1846-L1850` → robot `_meta.wildcard_fallback` (`src/lib.rs#L34715`) and the JSONL `_meta` **header line** (`#L34867`); `_meta.query_plan` flips `QueryPhase::Lexical.realized` true (`src/query_cost_planner.rs#L117-L119`) with reason "lexical phase realized with wildcard fallback" (`#L289-L291`); explanation card `search.wildcard_fallback` (`src/explainability.rs#L152-L171`) with `fail_open: true`, `realized_tier: "lexical"`, `operator_action: "quote terms or use explicit wildcards to control breadth"`, `rollback_trigger: "unexpected broad matches in the first result page"`. The refusal path is `tracing::debug!` only `#L6773-L6780` — **not** agent-readable, which Ledger should fix.
+- **Ledger naming (proposal, in Ledger's idiom).** Ledger has no boolean/wildcard syntax surface (`buildFtsExpression` phrase-wraps multi-word input, `db.ts#L1522-L1535`) and no meta line, so widen into a `type`-discriminated header — the idiom Ledger already uses for `build`/`watch`/`emit-pi` (`docs/api-surface.md#L299-L306`):
+
+```json
+{"type":"search_meta","query":"…","limit":20,"count":3,"total_hits":3,
+ "count_precision":"exact","count_reason":"fewer hits than the requested limit; the scan was exhausted",
+ "elapsed_ms":4,"search_mode":"lexical","requested_search_mode":"lexical","fallback_reason":null,
+ "widened":{"applied":true,"reason":"sparse_result","widened_query":"artifacts* OR hosting* OR subdomain*",
+            "original_hits":0,"widened_hits":3,"threshold":3,"corpus_records":4120},
+ "index_freshness":{"…":null},"storage_integrity":{"storage_state":"ok"}}
+```
+- Naming rules borrowed: `count_precision` + `count_reason`; a **typed** `fallback_reason` (never prose); `widened` as a nested object so both the applied and the refused path are machine-checkable (`applied:false` + `skip_reason`); per-hit `SearchHit.match_type?: "lexical" | "implicit_wildcard"` so a consumer branches without joining back to the meta line.
+
+## 2. Robot envelope — field semantics, and what Ledger must not copy
+
+- Top level `src/lib.rs#L34637-L34649`: `query, limit, offset, count, total_matches, hits, max_tokens, request_id, cursor, hits_clamped, budget`, plus conditional `sessions_filter{requested,matched}`, `sessions_filter_warning`, `suggestions`, `aggregations`, `explanation`, `_meta`, `_warning`, `_timeout`. `_meta` (only with `--robot-meta`) `#L34704-L34743` + conditionals `#L34739-L34792`: `elapsed_ms, search_mode, requested_search_mode, mode_defaulted, fallback_tier, fallback_reason, semantic_refinement, refinement_level, semantic_fallback_reason, lexical_degrade_reason, wildcard_fallback, cache_stats{…}, timing{search_ms,rerank_ms,other_ms}, tokens_estimated, max_tokens, request_id, next_cursor, hits_clamped, query_plan, cursor_manifest, explanation_cards` + `state`, `index_freshness`, `search_completeness`, `storage_integrity`, `timeout_ms`/`timed_out`/`partial_results`, `ann_stats`, `ann_unavailable_reason`.
+- `cursor_manifest` `#L33878-L33986`, per-field semantics and Ledger verdict:
+
+| Field | Semantics (OBSERVED) | Ledger |
+| --- | --- | --- |
+| `count_precision`, `count_reason` | `exact` iff the engine COUNT collector ran (`result.total_count.is_some()`, `src/lib.rs#L30953`), requiring `index_doc_count <= DEFAULT_EXACT_TOTAL_COUNT_MAX_DOCS = 50_000` (`src/search/query.rs#L790-L805`); else `lower_bound` = `offset + displayed + has_more` `#L30963-L30968` | **keep** — `exact` iff `hits.length < limit`; today Ledger's `totalHits` is always `hits.length` (`db.ts#L1635-L1640`, `#L1430-L1434`, `#L1514-L1518`) = an unlabeled lower bound |
+| `continuation_safe`, `continuation_reason` | `= next_cursor_present && !timed_out && !index_rebuilding` `#L33884`, else a first-match-wins ladder: window exhausted / no cursor emitted / timeout partial / rebuilding / clamped `#L33885-L33897` | **defer** — Ledger has no offset/cursor (`executeFtsQuery` emits `LIMIT ?` only, `db.ts#L1537-L1546`; no paging flag in `docs/api-surface.md#L34-L67`), so the field would be constant |
+| `field_mask`, `token_budget`, `budget`, `hits_clamped`, `realized_limit`, `search_page_count` | `--fields` projection; token/time budget shedding | omit — no `--fields`/`--max-tokens`; Ledger's only truncation is a 240-char snippet `cli.ts#L581` |
+| `cache_generation{reader_generation,reloads,reload_ms_total,policy,ghost_entries,admission_rejects}` | Tantivy searcher-cache lifecycle | **omit verbatim** — engine/shard machinery, no `bun:sqlite` analogue |
+| `index_generation{lexical_shard_generation,freshness,stale,partial,partial_reason,rebuilding,pending_sessions}` | shard id is shard-specific; `partial`/`partial_reason` are round-1's durable-signal win (checkpoint present but not completed; scan watermark ahead of indexed watermark) | **keep the subset** squashed to `{stale, partial, partial_reason, pending_sessions}`, derived from `ingest_cursors.status`/`updated_at` + `ingest_queue.attempt_count`/`next_attempt_at` (`schema.ts#L80-L118`) — no new table |
+| `semantic_fallback{requested,realized,fallback_tier,fallback_reason,semantic_refinement}` | typed reasons (`semantic_absent`, `semantic_backfilling`, …) so agents branch without prose | **keep — highest value here**: `querySemantic` silently returns `{hits: []}` when no compatible vectors exist or `embed()` yields nothing (`db.ts#L1299-L1304`, `#L1319-L1321`), and `queryHybrid` cannot tell the caller half its input was empty (`db.ts#L1450-L1458`) |
+| `search_completeness` | quarantine exclusions ⇒ *known* conversations absent: `{quarantine_status: ok\|degraded, quarantined_conversations, complete, can_search}` (`src/search/quarantine_status.rs#L196-L228`) | **keep the shape, change the cause** — Ledger's analog is failed/deferred normalization (PR17 `ingest_diagnostics`), i.e. `{complete, missing_sessions, reason}` |
+| `storage_integrity` | `StorageState` (with `Unchecked` so openability is never reported as `ok`, `src/search/storage_integrity.rs#L83-L89`), per-check `{name, elapsed_ms, timed_out, skipped_reason, read_only}` `#L116-L136`, `default_risk` (`FtsMetadataFailed` ⇒ Low) `#L166-L178` | **keep for `status`, optionally in `search_meta`** — see §3 |
+
+## 3. FTS5 integrity — probe, cadence, safe-next-action ladder
+
+- **Probe** `src/indexer/mod.rs#L19781-L19803`: `sqlite_master` existence check, then `INSERT INTO fts_messages(fts_messages) VALUES('integrity-check')`. Doc comment `#L19774-L19780`: "`PRAGMA quick_check` validates SQLite's b-trees, but it does not understand the payload stored inside `%_data`, so it can report `ok` for the exact corrupt-segment shape seen in GH #374. The special command is read-only despite its INSERT syntax." Classification `#L19797-L19803`: a `retryable_franken_error` (transient contention) becomes a **hard error**, never a corruption verdict; anything else → `Some("FTS5 segment integrity-check failed: {err}")`.
+- **Cadence**: only in the read-only **full-rebuild preflight**, before any writable open (the writable open itself repairs schema objects) `#L15602-L15615` → `full_rebuild_existing_archive_integrity_preflight` `#L19884-L19957`; size-gated at 2 GiB (`DEFAULT_INDEX_INTEGRITY_PREFLIGHT_MAX_BYTES`, env-overridable, `0` = always `#L19700-L19720`), over the cap every engine-backed query is skipped with a warning routing to `cass doctor check --json` `#L19810-L19821`. Never startup, never per-query. Pinned by a test that seeds one segment, overwrites its `fts_messages_data.block`, and asserts the preflight names the probe `#L49845-L49890`.
+- **Doctor ladder** (on demand only): `doctor_database_quick_check` runs `PRAGMA quick_check(1)` `src/lib.rs#L37376-L37385`, then `doctor_database_integrity_probe` runs `PRAGMA integrity_check(20)` **only if quick_check is `ok`** `#L37419-L37432`; diagnostics are bounded to 20 rows + "N additional diagnostic row(s) omitted" `#L37342-L37371`; `failed_pragma_name()` names the failed probe `#L37467-L37474`.
+- **Safe-next-action ladder**: (1) *refuse the destructive operation* — `needs_rebuild = true` + a `"database","fail"` check carrying pragma name and row counts `src/lib.rs#L88856-L88872`, and the indexer returns `canonical_archive_unhealthy_for_index_error` instead of replacing the archive `src/indexer/mod.rs#L15604-L15615`; (2) *classify derived vs canonical* — a queryable FTS shadow whose docsize count fails is only `"fts_table","warn"` with remedy ``cass doctor --rebuild-canonical-fts --yes`` `src/lib.rs#L88845-L88852`, and `FtsMetadataFailed` carries `SourceOfTruthRisk::Low` because canonical rows survive `storage_integrity.rs#L166-L178`; (3) *dry-run first* — without `--yes` the repair refuses with exit code 4, kind `refused-unsafe`, hinting the inspect-then-apply sequence `src/doctor_recover.rs#L621-L636`, and an unopenable shadow is reported only because the dry run must not lock `#L653-L678`; (4) *escalate, don't improvise* — if both structured opens fail, preserve db+`-wal`+`-shm`+sidecars and route to recovery commands `#L690-L703`; (5) *never claim health without a probe* — `Unchecked` exists for "db_open succeeded, nothing structural ran" `storage_integrity.rs#L83-L89`.
+- **Ledger-dialect verification** (my own throwaway `bun:sqlite` 1.3.14 scripts in `/tmp`, now deleted — not Cass behaviour): `INSERT INTO records_fts(records_fts) VALUES('integrity-check')` and the rank-1 variant both return cleanly on a healthy table, as does `('merge', N)`/`('automerge', 4)` which Ledger already issues (`db.ts#L108`, `sync.ts#L420`). Cass's `*term*` shape is **not translatable**: `MATCH '*artifacts*'` → `unknown special query: artifacts*`; the FTS5 equivalent is an OR-join of prefixes (`artifacts* OR hosting* OR subdomain*`, which widened a 1-hit phrase query to 2 hits). Blind byte-corruption over pages 3..120 of a 3000-row fixture did **not** reproduce a "quick_check ok / integrity-check ERR" divergence on stock SQLite, and FTS shadow tables are write-protected ("table f_data may not be modified") — so a Ledger regression test for the corrupt-`%_data` case needs a crafted DB file. The probe's justification is the decode/checksum it performs (and rank 1 also verifies index-vs-content), which is exactly what Ledger's own in-place FTS rewrite in the v3→v4 migration needs after the fact (`UPDATE records_fts SET record_id = …, session_id = …`, `schema.ts#L223-L229`).
+
+## 4. Search-quality gate — qrels fixture, metrics, drift diff, CI wiring
+
+- **Fixture**: `{_comment, qrels:[{id, query, mode?, expected_refs[], k, note?}]}` (`src/search_quality_eval.rs#L62-L77`; 5 checked-in judgments in `tests/fixtures/search_quality/qrels.json`) plus a corpus manifest `{_comment, docs:[{stem, keywords[], age_days, extra_text}]}` seeded as **real harness sessions** (`tests/fixtures/search_quality/corpus.json`; `struct CorpusDoc` `tests/e2e_search_quality_gate.rs#L99-L105`, `fn load_corpus` `#L123`, `fn seed_corpus_doc` `#L153`, reduction `fn run_qrel` `#L239-L296`). Queries are distinctive single tokens, multi-ref recall is two entries in `expected_refs`, one doc is aged 400 days to exercise the live trust tier, one carries a planted email `#L63`.
+- **Metrics** (pure, deterministic): `QueryRun{qrel, observed, realized_mode, fallback_tier, latency_ms}` → `evaluate()` gives `recall@k = |expected ∩ observed[..k]| / |expected|`, `precision@k = |expected ∩ observed[..k]| / min(k, |observed|)`, `mrr = 1/rank(first expected)`; `passed` requires recall = precision = 1.0 (±1e-9) **and** no unexpected top-k ref **and** a non-empty judgment (`#L112-L150`, `#L268-L369`). Aggregates `query_count, passed_count, failed_count, mean_recall_at_k, mean_precision_at_k, mean_mrr, mean_latency_ms, trust_tier_distribution, realized_mode_counts` `#L152-L171`; report `{schema_version: 1, label?, queries[], aggregate}` `#L175-L187`.
+- **Drift diff**: `diff_reports(baseline, current)` joins by qrel id → `QueryDiff{recall_delta, precision_delta, mrr_delta, newly_missing_refs, regressed}` and `RegressionDiff{mean_*_delta, per_query, dropped_query_ids, added_query_ids, regressed_query_ids, has_regression}`; `regressed` = any metric dropped beyond 1e-9 **or** a previously-found ref vanished `#L431-L517`. OBSERVED: no CLI call site (`grep -rn diff_reports` matches only its module + the gate's import) — drift is a library API; the shipped gate asserts absolute conformance.
+- **Privacy**: refs pass `sanitize_doc_ref` (alnum + `.`/`-`/`_`, ≤128 chars) and a non-canonical ref becomes a `__invalid_doc_ref__` sentinel that still reduces precision rather than transforming private text `#L56`, `#L228-L250`; the gate asserts the planted email never reaches either artifact `tests/e2e_search_quality_gate.rs#L470-L478`.
+- **CI wiring without network**: the gate is `tests/e2e_search_quality_gate.rs`, discovered by glob in the `test-rust` job — `mapfile -t tests < <(git ls-files 'tests/e2e_*.rs' | sed …)` then `E2E_LOG=1 cargo test --features "qr encryption backtrace" --test <each>` (`.github/workflows/ci.yml#L363-L371`, `#L411-L425`): **the filename is the wiring** (no `#[ignore]`, no allowlist, no workflow edit). Offline-ness is env-enforced in the child: `CASS_SEMANTIC_EMBEDDER=hash` (deterministic local embedder, so `--hybrid` needs no model download), tempdir `HOME`/`XDG_*`/cwd, `CODING_AGENT_SEARCH_NO_UPDATE_PROMPT=1`, `NO_COLOR=1` `#L186-L200`; hangs become diagnostics via the bounded runner `spawn_with_timeout_or_diag` (120 s index / 60 s search `#L55-L57`); artifacts honour `CASS_SEARCH_QUALITY_ARTIFACT_DIR` else tempdir `#L446-L451`.
+
+## Ledger integration points (main `2b08be4`)
+
+- **Widening** — `db.ts#L1108-L1131` (`queryLexical`): the `catch`-only fallback is invisible and fires on syntax errors, not sparsity; `buildFtsExpression` `#L1522-L1535` phrase-wraps every multi-word query, so `"artifacts hosting subdomain"` demands adjacency. Port the gate (offset/limit-aware threshold, no-op on explicit syntax, corpus ceiling, long-token guard, strictly-more acceptance) with an FTS5-legal widened expression (`term* OR term*`), a `widened` field on `QueryResult` (`types.ts#L190-L195`), `match_type` on widened hits, and a `{"type":"search_meta",…}` line emitted before the hit stream `cli.ts#L574-L592`. Propagate through `queryHybrid` (`db.ts#L1438-L1520`), which today discards the lexical result's identity when re-ranking into `scoredMap`.
+- **Envelope** — `cli.ts#L574-L592` assembles bare hit objects and `docs/api-surface.md#L299-L306` documents that stream, so the meta line must be `type`-discriminated and additive. Derive `count_precision` in `executeFtsQuery` (`db.ts#L1537-L1640`) from `hits.length < limit`; `index_freshness`/`search_completeness` from `ingest_cursors` + `ingest_queue` + PR17 `ingest_diagnostics` (no new table); `semantic_fallback` from `querySemantic`'s silent empty returns (`db.ts#L1299-L1304`, `#L1319-L1321`). Omit `cache_generation`, `lexical_shard_generation`, `field_mask`, `token_budget`, `budget`, `hits_clamped`, and defer `continuation_*` until Ledger has paging.
+- **FTS probe** — home is the existing maintenance child (`sync.ts#L411-L431`: `('merge', N)`, `PRAGMA optimize`, `PRAGMA wal_checkpoint(PASSIVE)`, reply fields `fts_changes`/`optimize_actions`/`wal_*`; `db.ts#L104-L110` sets `('automerge', 4)`), reporting `fts_integrity: "ok"|"failed"`; surface it in `ledger status` as a `storage_integrity` field with a `read_only: true` check record, and refuse a full FTS rebuild rather than rebuilding a shadow that failed its probe. Never on the search path; rank-1 check is the post-migration verification for `schema.ts#L223-L229`.
+- **Qrels gate** — Ledger's runner is `bun test` (`packages/core/package.json`), tests in `packages/core/tests/*.test.ts`; a fixture-driven `search-quality.test.ts` (qrels JSON + a seeded store) needs no new harness, and Ledger's equivalent of `CASS_SEMANTIC_EMBEDDER=hash` is the lexical-only default plus the `applyEmbeddingProvider` overrides in `cli.ts#L528`.
+
+## Boundaries
+
+- **No code reused.** Cass carries a nonstandard license rider; this is pattern/vocabulary extraction only — no Cass source copied, translated, or vendored, only JSON field names, state vocabularies, and probe/cadence decisions cited as precedent.
+- No Cass build, test, or binary was run; all Cass claims are static reads of `cass@c7cd1ad` (`/tmp/ledger-confer/round-2/cass`). §3's FTS5 experiments are `bun:sqlite` results on throwaway `/tmp` databases (deleted), labelled as Ledger-dialect, not Cass behaviour. Ledger was inspected read-only at `2b08be4`.
+- Out of scope (as round 1): federated/remote search, fleet surfaces, TUI, semantic model acquisition, encryption/pages assets — plus, this round, cursor pagination, which Ledger cannot use until it has offset/cursor search at all.

package/docs/research/ledger/confer/2026-09-13-round-3/README.md

@@ -0,0 +1,70 @@
+# Confer round 3 — 2026-09-13
+
+Delta round: pins mostly frozen (obelisk `45eaac8b` ×3 rounds, trajectory
+`21ae92d` ×3, vercel/ai `6c6c2210` ×2, agentsview `532fd652` ×2; letta-code
++1 telemetry commit, cass +2 test-only commits). Value this round is the
+cycle-3 focus: participating-writer ownership. Baseline: main `b20664a`.
+
+| Repo | Pin | File |
+| --- | --- | --- |
+| letta-ai/trajectory | `21ae92d` (8 open PRs census-corrected) | [trajectory.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-3/trajectory.md) |
+| letta-ai/letta-code | `6a12dcb0` | [letta-code.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-3/letta-code.md) |
+| tommy0103/obelisk | `45eaac8b` | [obelisk.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-3/obelisk.md) |
+| dicklesworthstone/cass | `3ac128bf` | [cass.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-3/cass.md) |
+| kenn-io/agentsview | `532fd652` | [agentsview.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-3/agentsview.md) |
+| vercel/ai harness | `6c6c2210` | [vercel-ai-harness.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-3/vercel-ai-harness.md) |
+
+## Cycle-3 decision: hard writer lease between CLI verbs and the daemon
+
+Verified on main (WritePathScout3): the shipping daemon is a 15-minute
+oneshot `sync` (launchd `StartInterval` 900 / systemd timer 15min) — not an
+always-on watch; `new TrajectoryDb()` writes DDL in its constructor, so the
+lease must attach BEFORE any `new TrajectoryDb()` (mutating entry points:
+`cli.ts` handleBuild, `sync.ts` runSync:541 + worker children :242,
+`watch.ts` startWatching:223); today's only arbitration is
+`busy_timeout=15000` — 15s of silent blocking.
+
+Design (sources in brackets):
+
+1. **Sibling lock DB** `<dbPath>-write.lock`: bare SQLite connection,
+   `busy_timeout=0`, `BEGIN IMMEDIATE`, attempt budget `ceil(waitMs/25)+1`,
+   busy-only retry, non-busy rethrow; connection close = release; process
+   death releases via fd teardown — no TTL, no reaper, no pid-liveness
+   checks (which letta-code.md shows are zombie-broken on darwin anyway).
+2. **Metadata-bearing lease, two-phase acquire**: the holder label commits
+   in its own transaction FIRST, then the lease is taken with a held
+   `BEGIN IMMEDIATE` and kept uncommitted for the lease lifetime — a
+   contender arriving in the commit-to-hold gap simply sees busy, and the
+   committed label lets any refusal name the holder. Release deletes the
+   label self-conditionally (own pid) so it can never erase a successor's.
+   [cass]
+3. **Typed, actionable refusals**: robot error code + human text naming the
+   escapes ("held by pid N (sync); retry shortly or stop the scheduler") —
+   replace silent 15s blocking at the mutating entry points. [agentsview]
+4. **Caller-class policy split**: foreground CLI verbs wait briefly (250ms)
+   then fail typed; the scheduled daemon (env `LEDGER_SCHEDULER=1` set by
+   the ops installers) soft-skips the pass with a log line, exit 0.
+   [cass scheduler-verb pattern]
+5. **Worker exemption bound to parent authority**: sync worker children
+   inherit the parent's lease authority via an explicit invocation option
+   plus a child-side check that the lease label's pid is `process.ppid` —
+   an ambient env marker alone never exempts a foreground run. [agentsview
+   worker-marker pattern, hardened]
+6. **watch acquires per reconcile/batch tick** (short holds, skip-on-busy
+   with a note), never for process lifetime — the foreground watch must not
+   starve CLI verbs for hours. [agentsview daemon-cadence analysis]
+7. **No TOCTOU change needed**: `commitIngest` already re-reads staged/live
+   state inside its transaction; harness round 3 confirms that is the
+   correct shape for row-commit writers and that its grace-then-proceed
+   fence does NOT translate (no persistence engine; artifact writes are
+   non-atomic caches) — expiry in Ledger is the typed busy refusal.
+
+## Deferred
+
+- Obelisk-style carve-out register (exempt routes with proof obligations) —
+  Ledger has no proven disjoint write route yet; the queue bookkeeping
+  stays under the lease.
+- Owner-token predicates on `ingest_runtime_state` writes — schema change,
+  later cycle with run-state work.
+- Reader policy changes (search/recent/emit-pi still open `TrajectoryDb`) —
+  read-path connection split is its own cycle.

package/docs/research/ledger/confer/2026-09-13-round-5/README.md

@@ -0,0 +1,61 @@
+# Confer round 5 — 2026-09-13
+
+Read-connection-discipline round. Pins: obelisk `45eaac8b` (5th), agentsview
+`532fd652` (3rd), cass `3ac128bf` (3rd), trajectory `21ae92d` (5th),
+vercel/ai `6c6c2210` (3rd); letta-code +7 commits (`72b04acf`, lease stack
+untouched). Baseline: main `a19916b`.
+
+| Repo | File |
+| --- | --- |
+| letta-ai/trajectory | [trajectory.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-5/trajectory.md) |
+| letta-ai/letta-code | [letta-code.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-5/letta-code.md) |
+| tommy0103/obelisk | [obelisk.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-5/obelisk.md) |
+| dicklesworthstone/cass | [cass.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-5/cass.md) |
+| kenn-io/agentsview | [agentsview.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-5/agentsview.md) |
+| vercel/ai harness | [vercel-ai-harness.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-5/vercel-ai-harness.md) |
+
+## Cycle-5 decision: read-path connection split (issue #23)
+
+Verified on main (ReadPathScout5): `search`, `recent`, and `emit-pi` open
+`TrajectoryDb`, whose constructor always performs writes (WAL pragma,
+`CREATE_TABLES_SQL`, trigger-repair transaction; migrate on old schemas) —
+read verbs can create or upgrade a store outside the writer lease, and
+`querySemantic` backfills embeddings mid-query (a write on the read path).
+
+Design (sources in brackets):
+
+1. **Reader class** (`TrajectoryReader`): `new Database(path,
+   {readonly: true})` — the open flag, engine-enforced and irreversible;
+   never `PRAGMA query_only` (reversible, still allows file creation).
+   [obelisk] No DDL, no migration, no trigger repair, no FTS config;
+   `busy_timeout` set; short-lived per verb invocation (no pool → no
+   stranded-inode hazard on replaced stores). [agentsview reader-pool
+   hazard] No WAL fallback to a writable open — the round-4 stale-`-shm`
+   `disk I/O error` is the same constraint; fail typed instead.
+   [trajectory's `openWithWalFallback` is the anti-pattern]
+2. **Typed read errors**: missing store → "not initialized; run ledger sync
+   or build" (beating Obelisk's untranslated raw error); too-new schema →
+   existing `SCHEMA_MISMATCH` vocabulary; readable-but-old schema → serve
+   reads, matching `store-status` semantics. [obelisk typed-refusal spec;
+   letta-code manifest refusal with remedy]
+3. **Semantic/hybrid without embeddings never writes**: skip the mid-query
+   backfill; fall back to lexical with
+   `requested_search_mode: "semantic"|"hybrid"`, `search_mode: "lexical"`,
+4. **Read-verb invariance pinned Cass-style**: byte-compare `<db>` and
+   `-wal` before/after read verbs on a checkpointed store — zero store-side
+   writes, no sidecar creation. (`-shm` is shared wal-index bookkeeping
+   that SQLite itself may refresh on the first read-only open of a dirty
+   WAL; excluded from the data-hash contract and documented as such.)
+   [cass gh422 byte-invariance test]
+5. Writers unchanged (lease + `TrajectoryDb`); the read/write boundary
+   documented in api-surface.
+
+## Deferred
+
+- Obelisk's `ensureReadableSchema` (read-triggered, lease-arbitrated
+  upgrade): Ledger read verbs refuse instead of upgrading — revisit only if
+  an operator need appears.
+- Reader pool with WAL-snapshot pinning across statements: per-invocation
+  readers make it unnecessary today.
+- FTS5 `prefix=` index (issue #21) and the other queued candidates stay
+  next in the matrix.

package/docs/research/ledger/confer/2026-09-13-round-6/README.md

@@ -0,0 +1,68 @@
+# Confer round 6 — 2026-09-13
+
+Read-boundary validation + discovery-taxonomy round. Pins: trajectory
+`21ae92d` (6th), obelisk `45eaac8b` (5th), agentsview `532fd652` (2nd),
+vercel/ai `6c6c2210`; letta-code +5 (`438f821a`, local-store anchors
+exact); cass +9 (`6d445f6`, taxonomy files byte-identical). Baseline: main
+`3469076`.
+
+| Repo | File |
+| --- | --- |
+| letta-ai/trajectory | [trajectory.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-6/trajectory.md) |
+| letta-ai/letta-code | [letta-code.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-6/letta-code.md) |
+| tommy0103/obelisk | [obelisk.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-6/obelisk.md) |
+| dicklesworthstone/cass | [cass.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-6/cass.md) |
+| kenn-io/agentsview | [agentsview.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-6/agentsview.md) |
+| vercel/ai harness | [vercel-ai-harness.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-6/vercel-ai-harness.md) |
+
+## Cycle-6 decision: typed read gate (issue #27)
+
+Reproduced on main (ObeliskRound6): a foreign SQLite file with only a
+`sessions` table and `user_version=0` makes `ledger status --json` die
+with a raw `no such table: records` (exit 1, no code, no payload) and
+`ledger last` with `no such column: updated_at`. Both gates
+(`reader.ts` `openReadOnlyStore`, `store-status.ts` `readStoreStatus`)
+test `sessions` presence alone; `db.ts` throws for `user_version=0 &&
+sessions present` — the same foreign case the gate should name.
+
+Design (sources in brackets):
+
+1. **Four-state ladder** in one shared classifier used by both gates:
+   absent/zero-byte → `STORE_NOT_INITIALIZED` (empty = not initialized,
+   never unreadable [letta-code]); not-a-database → `STORE_UNREADABLE`;
+   `user_version > SCHEMA_VERSION` → `SCHEMA_MISMATCH` (existing);
+   sessions present but required pairs missing → **new**
+   `STORE_SCHEMA_INCOMPLETE` naming the first gap in **sorted order**
+   (AgentsView's map-iteration nondeterminism is a named gap to avoid)
+   with the single-sourced remedy line. [agentsview error shape; harness
+   observed-vs-expected wording; obelisk four-outcome analysis]
+2. **Required pairs, not :memory: replay**: Ledger's DDL is a
+   branch-dependent migration sequence, so AgentsView's embedded-schema
+   trick does not port. Use Obelisk's shape — an explicit
+   `REQUIRED_READ_SCHEMA` (table, column) list — but derive it honestly:
+   a test materializes every migration-fixture store the repo can
+   generate (v1→v10) and asserts the gate passes on all of them plus a
+   fresh v10, and fails with the right gap on synthetic foreign shapes.
+   Readable-but-old keeps serving reads (round-5 decision preserved).
+   [obelisk pair-list spec; agentsview creator/expectation-drift
+   invariant adapted as the fixture test]
+3. **Index presence stays out of scope** (AgentsView's by-name index
+   check is itself a one-level-down hole — noted, not copied).
+4. **Dead-path removal**: `applyEmbeddingProvider` is dead at
+   `handleScan`, `handleLast`, and `handleEmitPi` (reader split made them
+   dead); remove all three (#27 item 2).
+5. `store-status` gains the same typed states (the diagnostic verb is
+   currently the one escaping untyped — ObeliskRound6 reproduction).
+
+## Deferred with recorded specs (cycle 7+)
+
+- **Scanner listing taxonomy**: trajectory's closed 16-code union maps
+  `listing_unavailable` (exactly atif/copilot-cli/cursor/gemini-cli/
+  opencode + no-SQLite runtimes), `unknown_source`, and
+  store-unreadable-as-invalid-input (a conflation Ledger must not inherit
+  — caller error ≠ store error [trajectory finding 2]); Cass's
+  7-state disposition × 8-kind failure taxonomy with per-connector
+  capability bools is the richer shape [cass]; today Ledger collapses all
+  of it into `read_error` at `scanner.ts:105-107` and `scanSessions`
+  returns items only. Spec complete in this round's files.
+- FTS5 `prefix=` index (#21) unchanged in queue.

package/docs/research/ledger/confer/2026-09-13-round-7/README.md

@@ -0,0 +1,64 @@
+# Confer round 7 — 2026-09-13
+
+Scan-outcome surfacing round. Pins: all six unchanged (trajectory `21ae92d`
+7th, obelisk `45eaac8b` 6th, agentsview `532fd652` 3rd, cass `6d445f6` 2nd,
+letta-code `438f821a`, vercel/ai `6c6c2210`). Baseline: main `cb673ea`.
+
+| Repo | File |
+| --- | --- |
+| letta-ai/trajectory | [trajectory.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-7/trajectory.md) |
+| letta-ai/letta-code | [letta-code.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-7/letta-code.md) |
+| tommy0103/obelisk | [obelisk.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-7/obelisk.md) |
+| dicklesworthstone/cass | [cass.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-7/cass.md) |
+| kenn-io/agentsview | [agentsview.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-7/agentsview.md) |
+| vercel/ai harness | [vercel-ai-harness.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-7/vercel-ai-harness.md) |
+
+## Cycle-7 decision: per-source scan outcomes
+
+Verified on main (ScanPathScout7): `scanner.ts:105-107` collapses every
+listing failure into one `read_error` diagnostic delivered to an
+`onDiagnostic` callback that NO caller passes (cli scan/build, sync,
+watch) — sources fail silently and report 0 sessions; the extended
+directory branch swallows fs errors with no diagnostic at all
+(`scanner.ts:226`); `scanSessions` returns items only.
+
+The upstream probe (trajectory.md, verified against the installed 0.3.0
+under Bun) is decisive: **8 of 10 file listers return silent `items=0`
+for missing/empty/unreadable roots**; only hermes/deepagents throw, and
+their most common real failures (zero-byte store, wrong schema) escape as
+raw `SQLiteError` with no code. The outcome cannot be reconstructed from
+listing results — it must be computed scanner-side.
+
+Design (sources in brackets):
+
+1. **Ledger's own fs probe per source** before listing: resolved root
+   stat → `missing_root` (ENOENT), `root_not_directory`,
+   `unreadable_root` (non-ENOENT stat error — never suppressed, first
+   scan included [obelisk errno split]), else attempt listing.
+2. **Closed status enum** per source row: `listable` (listing succeeded,
+   0 items is legitimate), `missing_root`, `root_not_directory`,
+   `unreadable_root`, `listing_failed` (any throw from listTrajectories
+   or native discovery — detail = error name/class + errno, capped,
+   never a raw dump [cass curated-channel rule]); every row always
+   carries `discovered` count and `root` [cass all-keys rule; agentsview
+   one-row-per-source-including-healthy].
+3. **Return-shape cutover**: `scanSessions` returns
+   `{sessions, outcomes}`; all callers migrated (clean cutover). `scan
+   --robot` JSONL gains a leading `{"type":"scan_outcomes",...}` line
+   (search_meta precedent); `--json` gains `outcomes`; human output stays
+   byte-identical when every source is `listable` and prints one stderr
+   line per non-listable source otherwise. Outcomes sorted by source
+   [cass BTreeMap discipline].
+4. Native sources (cursor/opencode) funnel their existing diagnostics
+   into the outcome rows; extended sources (gemini-cli/copilot-cli)
+   replace silent skips with rows.
+5. Outcomes are recomputed per scan, never persisted [obelisk];
+   provenance-relative absence suppression is NOT adopted — the row is
+   always emitted, robots filter.
+
+## Deferred
+
+- Durably recorded per-source coverage state (could ride
+  `ingest_queue.last_outcome` without schema change — scout note) —
+  later cycle with coverage work.
+- FTS5 `prefix=` index (#21) unchanged in queue.

package/docs/research/ledger/confer/2026-09-13-round-9/README.md

@@ -0,0 +1,59 @@
+# Confer round 9 — 2026-09-13
+
+Durable per-source state round. Pins: trajectory `21ae92d` (9th), obelisk
+`45eaac8b` (8th), agentsview `532fd652` (5th), cass `6d445f6` (4th),
+vercel/ai `6c6c2210`; letta-code `1ec6a43f` (2nd). Baseline: main
+`8945146`. Ops this round: recovered a wedged sync that held the lease
+75× past its `--wall-ms` budget (bug filed as #35); live store migrated
+to v11 (161,580 records), widening verified live.
+
+| Repo | File |
+| --- | --- |
+| letta-ai/trajectory | [trajectory.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-9/trajectory.md) |
+| letta-ai/letta-code | [letta-code.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-9/letta-code.md) |
+| tommy0103/obelisk | [obelisk.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-9/obelisk.md) |
+| dicklesworthstone/cass | [cass.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-9/cass.md) |
+| kenn-io/agentsview | [agentsview.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-9/agentsview.md) |
+| vercel/ai harness | [vercel-ai-harness.md](https://github.com/archeism/ledger/blob/43081aef54c23b4bd017b6c0e11fc42a9a1cb381/confer/2026-09-13-round-9/vercel-ai-harness.md) |
+
+## Cycle-9 decision: durable source coverage (schema v12)
+
+Cycle 7's scan outcomes are dropped on every floor today (verified:
+`sync.ts:687` and `watch.ts:548` destructure `sessions` only;
+`buildStore` logs them only under `--verbose`). Recording them durably
+closes the "visible coverage reporting / expose unsupported-failed-
+pending sources" gap named since round 1.
+
+Design (sources in brackets):
+
+1. **`source_coverage` table** (schema v12): one last-write-wins row per
+   source — `source PK, root, status (ScanOutcomeStatus), discovered,
+   detail, updated_at, first_seen_at` [letta-code outcome slot;
+   agentsview raw_coverage shape]. Version discipline: the SCHEMA_VERSION
+   bump is the epoch; no version-in-key strings [agentsview anti-pattern
+   named]. No TTL, no counters this cycle — the row is state, not
+   notification history.
+2. **Single writer choke point**: one shared `recordSourceCoverage`
+   helper called at the end of the scan phase from exactly the three
+   lease-holding passes (sync `runSync`, `buildStore`, watch reconcile),
+   writing inside the pass's existing transaction — marker written last,
+   only after outcomes are complete [harness rule; obelisk marker-in-txn].
+3. **Reader ships in the same change** [obelisk's proven failure: its
+   durable markers have zero production readers]: `ledger status` gains a
+   `coverage` block (per-source rows, sorted; robot gets the array, human
+   gets non-listable rows + a count), read through the existing
+   sqlite_master-guarded probe (`null` pre-v12, like diagnostics).
+4. **Compute counts at read time; persist only non-derivable truth**
+   [cass rule]: the row persists the scan verdict; anything derivable
+   (queue pending, cursor states) is not duplicated.
+5. Post-pass transitions always write [letta-code's stale-success
+   qualifier]: a source that becomes listable overwrites its failing row;
+   first_seen_at survives while the source is seen.
+
+## Deferred
+
+- Coverage-driven retry/notification semantics (letta-code's in-row dedup
+  gate) — no notification consumer exists yet.
+- Certified/rescanned distinction (cass source-ledger) — Ledger's
+  cursor/queue state already covers per-file reuse.
+- #35 wall-budget enforcement — separate bug, needs its own cycle.