alkstore/tasks/sqlite-substrate-safety-comments.md

id, name, status, depends_on, scope, risk, impact, level, tags

id	name	status	depends_on	scope	risk	impact	level	tags
sqlite-substrate-safety-comments	SAFETY comments on the substrate UDF blocks, riding a PROVENANCE delta (review 004 item 15)	pending		narrow	low	isolated	implementation	review-004-fixes sqlite-engine substrate provenance

Description

The eight unsafe { ctx.get_connection() } UDF blocks (alkstore-sqlite/src/substrate/ops.rs:147-236) carry no // SAFETY justification comments, per docs/reviews/004-pre-release-general-review.md §"Findings recorded, not fixed" item 15. The pattern is the standard rusqlite UDF shape and provably constrained, but AGENTS.md's own carve-out ("inline comments when a non-obvious safety constraint would otherwise be missed") says this is where they'd live.

The constraint that shapes this task: the substrate is lineage-port code under ADR-012 §3's diff-fidelity posture — comments must ride a PROVENANCE delta. This task is the deliberate delta vehicle: add the comments and register the delta; do not treat this as a casual edit.

Each comment must state the concrete invariant that makes the access sound (derive it from the rusqlite UDF contract and the substrate's actual registration/usage — e.g. the connection the ctx hands out is confined to the registered UDF call path on the single connection thread), not a generic "this is safe" hand-wave.

While there: the review scoped to the eight blocks at ops.rs:147-236, but the same unsafe { ctx.get_connection() } shape also appears at schema.rs:104 and ops.rs:742 — check whether they are the same class; if so, include them in the same delta (and say so in Notes); if not, leave them and record why.

Acceptance Criteria

• Each of the eight UDF blocks (plus any same-class neighbors included) carries a // SAFETY comment stating the concrete soundness invariant
• src/substrate/PROVENANCE.md carries a dated delta entry registering the comment-only change (diff-fidelity posture honored; the entry classifies the delta per the register's conventions)
• No behavioral change: the substrate floor tests and the engine's tests green unchanged
• cargo test -p alkstore-sqlite, clippy -D warnings, fmt clean; workspace gates green server-less

References

• docs/reviews/004-pre-release-general-review.md §"Findings recorded, not fixed" item 15 (the finding, the PROVENANCE-delta requirement)
• docs/architecture/decisions/012-forked-substrate-design.md §3 (the diff-fidelity posture)
• alkstore-sqlite/src/substrate/PROVENANCE.md (the delta register)
• alkstore-sqlite/src/substrate/ops.rs:147-236 (the eight blocks)

Notes

To be filled by implementation agent

Summary

To be filled on completion