decompose review-004 recorded findings: 15 disposition tasks + the review-004-fixes gate (sqlite seam panic-safety, watcher-death subscribe + initial-stat, bridge alignment, scheduler classification, substrate SAFETY delta; pg forwarder hardening + diagnosability, BIGINT stamp decision + fix, log-facade decision; core offset pin + Display forging, mem doc notes, pg identifier note, tokio dev-dep normalization) — taskgraph validate green (95)

tasks/sqlite-substrate-safety-comments.md

@@ -0,0 +1,71 @@
+---
+id: sqlite-substrate-safety-comments
+name: SAFETY comments on the substrate UDF blocks, riding a PROVENANCE delta (review 004 item 15)
+status: pending
+depends_on: []
+scope: narrow
+risk: low
+impact: isolated
+level: implementation
+tags: [review-004-fixes, sqlite-engine, substrate, provenance]
+---
+
+## Description
+
+The eight `unsafe { ctx.get_connection() }` UDF blocks
+(`alkstore-sqlite/src/substrate/ops.rs:147-236`) carry no `// SAFETY`
+justification comments, per
+`docs/reviews/004-pre-release-general-review.md` §"Findings recorded,
+not fixed" item 15. The pattern is the standard rusqlite UDF shape and
+provably constrained, but AGENTS.md's own carve-out ("inline comments
+when a non-obvious safety constraint would otherwise be missed") says
+this is where they'd live.
+
+**The constraint that shapes this task**: the substrate is
+lineage-port code under ADR-012 §3's diff-fidelity posture — comments
+must ride a PROVENANCE delta. This task *is* the deliberate delta
+vehicle: add the comments and register the delta; do not treat this as
+a casual edit.
+
+Each comment must state the *concrete* invariant that makes the access
+sound (derive it from the rusqlite UDF contract and the substrate's
+actual registration/usage — e.g. the connection the ctx hands out is
+confined to the registered UDF call path on the single connection
+thread), not a generic "this is safe" hand-wave.
+
+While there: the review scoped to the eight blocks at ops.rs:147-236,
+but the same `unsafe { ctx.get_connection() }` shape also appears at
+`schema.rs:104` and `ops.rs:742` — check whether they are the same
+class; if so, include them in the same delta (and say so in Notes);
+if not, leave them and record why.
+
+## Acceptance Criteria
+
+- [ ] Each of the eight UDF blocks (plus any same-class neighbors
+      included) carries a `// SAFETY` comment stating the concrete
+      soundness invariant
+- [ ] `src/substrate/PROVENANCE.md` carries a dated delta entry
+      registering the comment-only change (diff-fidelity posture
+      honored; the entry classifies the delta per the register's
+      conventions)
+- [ ] No behavioral change: the substrate floor tests and the engine's
+      tests green unchanged
+- [ ] `cargo test -p alkstore-sqlite`, clippy `-D warnings`, fmt
+      clean; workspace gates green server-less
+
+## References
+
+- docs/reviews/004-pre-release-general-review.md §"Findings recorded,
+  not fixed" item 15 (the finding, the PROVENANCE-delta requirement)
+- docs/architecture/decisions/012-forked-substrate-design.md §3 (the
+  diff-fidelity posture)
+- alkstore-sqlite/src/substrate/PROVENANCE.md (the delta register)
+- alkstore-sqlite/src/substrate/ops.rs:147-236 (the eight blocks)
+
+## Notes
+
+> To be filled by implementation agent
+
+## Summary
+
+> To be filled on completion