---
id: sqlite-substrate-safety-comments
name: SAFETY comments on the substrate UDF blocks, riding a PROVENANCE delta (review 004 item 15)
status: pending
depends_on: []
scope: narrow
risk: low
impact: isolated
level: implementation
tags: [review-004-fixes, sqlite-engine, substrate, provenance]
---

## Description

The eight `unsafe { ctx.get_connection() }` UDF blocks
(`alkstore-sqlite/src/substrate/ops.rs:147-236`) carry no `// SAFETY`
justification comments, per
`docs/reviews/004-pre-release-general-review.md` §"Findings recorded,
not fixed" item 15. The pattern is the standard rusqlite UDF shape and
provably constrained, but AGENTS.md's own carve-out ("inline comments
when a non-obvious safety constraint would otherwise be missed") says
this is where they'd live.

**The constraint that shapes this task**: the substrate is
lineage-port code under ADR-012 §3's diff-fidelity posture — comments
must ride a PROVENANCE delta. This task *is* the deliberate delta
vehicle: add the comments and register the delta; do not treat this as
a casual edit.

Each comment must state the *concrete* invariant that makes the access
sound (derive it from the rusqlite UDF contract and the substrate's
actual registration/usage — e.g. the connection the ctx hands out is
confined to the registered UDF call path on the single connection
thread), not a generic "this is safe" hand-wave.

While there: the review scoped to the eight blocks at ops.rs:147-236,
but the same `unsafe { ctx.get_connection() }` shape also appears at
`schema.rs:104` and `ops.rs:742` — check whether they are the same
class; if so, include them in the same delta (and say so in Notes);
if not, leave them and record why.

## Acceptance Criteria

- [ ] Each of the eight UDF blocks (plus any same-class neighbors
      included) carries a `// SAFETY` comment stating the concrete
      soundness invariant
- [ ] `src/substrate/PROVENANCE.md` carries a dated delta entry
      registering the comment-only change (diff-fidelity posture
      honored; the entry classifies the delta per the register's
      conventions)
- [ ] No behavioral change: the substrate floor tests and the engine's
      tests green unchanged
- [ ] `cargo test -p alkstore-sqlite`, clippy `-D warnings`, fmt
      clean; workspace gates green server-less

## References

- docs/reviews/004-pre-release-general-review.md §"Findings recorded,
  not fixed" item 15 (the finding, the PROVENANCE-delta requirement)
- docs/architecture/decisions/012-forked-substrate-design.md §3 (the
  diff-fidelity posture)
- alkstore-sqlite/src/substrate/PROVENANCE.md (the delta register)
- alkstore-sqlite/src/substrate/ops.rs:147-236 (the eight blocks)

## Notes

> To be filled by implementation agent

## Summary

> To be filled on completion