[trissim]

Commander answers repeatedly decoded history to reconstruct answer membership, while the bus migration had drifted from current storage and installer ownership. This integrates the SQLite bus with those owners and deletes the replaced wire-log runtime and checkpoint readers. The combined change removes 4,611 net lines against the current base.

Send, Say, Strike and Problem inherit one resolve/refuse/respond algorithm. Exact originals must exist before indexed answer membership can clear a directive; repeated references retain their separate deadlines. Messaging completes committed sends once and retains the committed record and both errors if notification and completion fail.

BusSchema composes durable and derived declarations through ComposedSchemas. Registry privacy selects the complete coordinator schema and native notification behavior; public reads do not touch private tables. Historical optional-awareness renames remain distinct from strict claim identity. Standalone native commitment reads borrow the existing evidence reader.

Installer migration retains coherent declared-owner copies, typed worker results, rollback and retirement after acceptance. Rehearsal refusals no longer publish target-code messages on the live bus. PackageRecord owns its Pydantic representation and composes the existing WireValue capability; the installed-package subprocess returns those records directly. The real staged build exposed a stale Core wheel: uv now includes the Git commit in its local build cache key, matching the existing commit-stamping build hook. No cache flush or weakened identity check.

Builtin channel addresses derive from their declaring classes. Channel consumers use addresses explicitly; wire kind names and addresses no longer share an accidental spelling.

Includes reviewed #2612, #2613, #2614, #2615 and #2618, plus the channel correction. Paired Toad #1137 consumes the new bus and committed-send results and must be included in the final installation.

Source ownership evidence:

• Existing NRA tooling parsed Core and Toad production roots plus hatch_build.py: 746 modules, 6,316 original classes, no parse omissions; class-family index built. The Toad checkout contains separately owned work, so this census is source coverage rather than qualification of an installed pin.
• Before/after maps enumerate package/probe, channel, schema and commander declarations and consumers. Runtime checks separately confirm shared commander MRO, the four owed-answer members and the durable/derived table split.

Validation:

• Initial selected bus/storage/installer/commander/policy checks: 127 passed across the broad run and focused corrections.
• Real predecessor-history conversion passed with exact identities, ledger references, repeat application and retirement.
• Combined presence/todo/recovery/session checks: 84 passed initially; watcher and actual stdio new/load ordering passed after fixture migration.
• Actual committed-send double-failure controls passed with one committed row and one completion invocation.
• Commander/escalation/activity batch: 49 passed; the exposed coordinator bootstrap defect is now repaired in the integrated privacy-owned schema family. Final directive/vibe/identity selection: 13 passed.
• Real installer CLI: all three current-format checks passed in 205.66 seconds, covering post-cutover no-copy rehearsal, drifted-store copy/reconciliation and failed live migration restoring data, checkout, runtime selection and send admission.
• Channel/IRC/global/target checks: 60 passed. Package/install/proof checks: 25 passed. Combined bootstrap/channel/package checks: 35 passed. Final carry/privacy/announcement/probe/ingress checks: 31 passed.
• Real subprocess negative-identity regression: three passed. Package wire and source/pin checks: four passed.
• Actual staged build of 9f356f4 succeeded. The real -P subprocess returned 81 typed PackageRecord values; a deliberately wrong requested commit refused with both actual and requested identities. The installed runtime pointer remains unchanged.
• Native build inputs rebuilt successfully. CI remains deferred.

The actual-root installer rehearsal passed on a5c7200 in 208.38 seconds. It copied 3,789,429,769 bytes in 34.19 seconds, continuously converted and round-tripped all 19,182 history records, preserved 30 read viewers / 184 conversations / 18 transcript entries, and read back all 194 registered threads before and after migration. Exactly four files were rewritten and 18,992 stayed identical. The obsolete history inputs were retired on the practice copy; the temporary copy and target tree were then removed. Dominant work was conversion (78.1 seconds) plus validation (40.6 seconds); native preparation took 16.1 seconds. The installed runtime pointer remains on the outgoing d9ce build.

That rehearsal exposed an incomplete write declaration: bus commits create their change marker, and retained-archive conversion marks its registry historical. BusHistory now derives marker paths from Bus.source_paths; the converting catalogue member returns the existing Carried result using RegistryStore.written, and the publisher aggregates it. The strict installer change check is unchanged. The real predecessor regression now passes through that same check, including archived registry and guard writes (6.83 seconds). Before/after NRA evidence covers 465 modules / 4,862 classes including the converter, with no parse omissions.

Representative read comparison completed on one 19,189-record / 52,962,373-byte history snapshot with matching owner-copied metadata, the outgoing production checkpoint index and one frozen clock. The old answerable-plus-overdue reads took 55.0716 seconds; the new shared open-and-due read took 0.8987 seconds (about 61 times faster), returning exactly the same 27 overdue entries, including their multiplicities. All 296 removed answerable candidates were independently checked as active-request directives already answered by the commander or its aliases. Both measurements used cProfile; this is the debt-read portion rather than end-to-end send/UI latency. The old run decoded 31,844 messages; its copied-index relocation cost 0.1138 seconds and performed no rebuild. An earlier run without the production checkpoint reached its 180-second cap and is excluded from the latency comparison. The same indexed snapshot was converted by the existing converter, with coordinator reconciliation and input retirement under the existing maintenance hold.

The hosted checks exposed a remaining import of the deleted schema module in the debt checker. The import and obsolete exemption are deleted; the generic implementation remains covered at its actual owner, typed_table. Two stale test imports now use the same pinned audit namespace as production. All 17 selected collector, facade and owner/codec controls passed in 52.57 seconds. Detector logic and thresholds are unchanged. The final tool/test-only head is acb2ddd; its runtime source is identical to the fully rehearsed a5c7200.

The merger owns the paired installed saved-session journey and fresh-message/reply/tab-return qualification; Toad's demonstrated mounted-history defect has an active repair owner. This PR is ready with auto-merge enabled; exact-head review and hosted queue checks still govern merging. It is not installed, and end-to-end send/UI latency remains unmeasured.

[trissim]

Reviewed the two installer-fixture follow-ups. The ordinary no-carry/drift/rollback cases now use an actual outgoing runtime whose bus format matches the fixture writer; the isolated target retires the completed converter to represent a post-cutover install. This replaces the invalid combination of an old runtime and newly authored SQL bus without adding a production workaround or weakening the expected rehearsal type.

Read installer-retired.txt: all three real CLI paths passed in 205.66s, including restoring data, checkout, selected runtime and send admission after an injected failure following a live write. These are accepted current-format installer checks. Actual predecessor-state migration, privacy-owned bootstrap repair and paired installed/native qualification remain separate open work.

[trissim]

Accepted for merge on a5c7200. This combines the previously reviewed bus, SQLite ownership, installer recovery, coordination capability, privacy/bootstrap and Toad subscription-order repairs. Final source review includes channel-derived addresses, typed PackageRecord transport through the existing WireValue boundary, the commit-derived uv cache key, historical rename inclusion and standalone evidence-reader borrowing.

The actual configured predecessor root passed the complete CLI rehearsal: 19,182 continuous/round-tripped records, 194 threads readable before and after, and unchanged ledger counts of 30 viewers, 184 conversations and 18 transcripts. The 3,789,429,769-byte declared-owner copy took 34.19 seconds; total elapsed was 208.38 seconds. Four declared rewrites were bus.changed, bus.sqlite3, coordination.sqlite3 and read_ledger.json; 18,992 files remained identical. Both retired JSONL inputs were removed only from the practice copy. The actual staged package probe returned 81 typed records and rejected a deliberately wrong requested commit. The initial rehearsal's missing marker declaration was corrected using Bus.source_paths; the retained-archive registry/guard result derives from RegistryStore.written. The real predecessor regression now also passes the installer's file-change guard.

Retained acceptance result: /home/ts/..agent-comms.installer-e823bacf9c6e4abcb3e74eaae1eec1b9/result.json. The practice copy and target scratch were retired. The live pointer remains Core d9ce9cd. Paired installation and the installed saved-fork/fresh-DM/reply/tab-return journey remain integration work; no end-to-end latency improvement is claimed by this review.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[trissim]

Accepted this exact stable checkpoint after reading the final source correction. The obsolete schema import and its blanket exemption are deleted; no replacement exemption or threshold increase remains. The two guard imports now use the pinned audit package. The final collector/facade/owner-codec controls pass (17 passed, 52.57s).

The runtime portion is unchanged from the reviewed a5c checkpoint: actual-root rehearsal completed in 208.38s with 19,182 records read back and exact retained counts. On one frozen indexed workload, the debt-owner read fell from 55.0716s to 0.8987s; this measures that read, not complete send/UI latency.

The newly discovered owner-request, identity and installer reporting repairs are separate unfinished changes. This acceptance does not claim those are removed or that the new paired runtime is installed.