471 lines
31 KiB
Go
471 lines
31 KiB
Go
package store
|
||
|
||
import (
|
||
"context"
|
||
"fmt"
|
||
)
|
||
|
||
// migrations are applied in order; schema_version records the highest applied
|
||
// version so re-runs are no-ops. Every step is also idempotent (CREATE TABLE
|
||
// IF NOT EXISTS) so a half-applied database still converges. Append-only:
|
||
// never edit an earlier migration (vojo discipline).
|
||
var migrations = []string{
|
||
// v1: the Phase-0 operational schema.
|
||
`
|
||
-- Snapshot контекста джобы (Р6, implementation-notes §3.2): материализованная
|
||
-- запись; snapshot_id входит в request-hash, так что волатильность контекста
|
||
-- заморожена на джобу. payload — JSON (версии промптов per-role, модели,
|
||
-- версия чанкера, style sheet, резюме на момент старта).
|
||
CREATE TABLE IF NOT EXISTS snapshots (
|
||
snapshot_id TEXT PRIMARY KEY,
|
||
brief_hash TEXT NOT NULL,
|
||
payload TEXT NOT NULL,
|
||
created_at TEXT NOT NULL DEFAULT (datetime('now'))
|
||
);
|
||
|
||
-- Durable jobs: джоба = глава×стадия (Р6). Гранулярность СОХРАННОСТИ — чанк
|
||
-- (checkpoints), джоба лишь группирует их и несёт snapshot_id.
|
||
CREATE TABLE IF NOT EXISTS jobs (
|
||
id INTEGER PRIMARY KEY,
|
||
book_id TEXT NOT NULL,
|
||
chapter INTEGER NOT NULL,
|
||
stage TEXT NOT NULL,
|
||
status TEXT NOT NULL DEFAULT 'pending', -- pending|running|done|failed
|
||
snapshot_id TEXT NOT NULL REFERENCES snapshots(snapshot_id),
|
||
created_at TEXT NOT NULL DEFAULT (datetime('now')),
|
||
updated_at TEXT NOT NULL DEFAULT (datetime('now')),
|
||
UNIQUE (book_id, chapter, stage)
|
||
);
|
||
|
||
-- Чанк-чекпоинты: сырой ответ LLM персистится атомарно вместе с settle
|
||
-- (одна транзакция — SettleWithCheckpoint), ключ — request_hash от
|
||
-- детерминированного рендера (§3.1). kill -9 теряет максимум один
|
||
-- in-flight вызов. Найденный чекпоинт на resume = вызов не повторяется и
|
||
-- не оплачивается второй раз.
|
||
CREATE TABLE IF NOT EXISTS checkpoints (
|
||
request_hash TEXT PRIMARY KEY,
|
||
job_id INTEGER NOT NULL REFERENCES jobs(id),
|
||
chunk_idx INTEGER NOT NULL,
|
||
attempt INTEGER NOT NULL DEFAULT 0, -- регенерации Фазы 1: attempt входит в request-hash
|
||
stage TEXT NOT NULL,
|
||
role TEXT NOT NULL,
|
||
model_requested TEXT NOT NULL,
|
||
model_actual TEXT NOT NULL,
|
||
response_text TEXT NOT NULL,
|
||
usage_json TEXT NOT NULL,
|
||
cost_usd REAL NOT NULL,
|
||
finish_reason TEXT NOT NULL DEFAULT '',
|
||
provider_request_id TEXT NOT NULL DEFAULT '',
|
||
created_at TEXT NOT NULL DEFAULT (datetime('now'))
|
||
);
|
||
CREATE INDEX IF NOT EXISTS checkpoints_job_idx ON checkpoints (job_id, chunk_idx);
|
||
|
||
-- Дневной/книжный ledger с резервированием (порт семантики vojo spend):
|
||
-- потолки считают committed + reserved на допуске, поэтому burst
|
||
-- конкурентных вызовов не проскакивает потолок (TOCTOU-дисциплина).
|
||
CREATE TABLE IF NOT EXISTS spend (
|
||
book_id TEXT NOT NULL,
|
||
date TEXT NOT NULL, -- UTC YYYY-MM-DD
|
||
committed_usd REAL NOT NULL DEFAULT 0,
|
||
reserved_usd REAL NOT NULL DEFAULT 0,
|
||
PRIMARY KEY (book_id, date)
|
||
);
|
||
|
||
-- request_log: одна строка на LLM-вызов (Р7: per-книга/глава/чанк/стадия/
|
||
-- роль/модель, $, latency, cache-поля). Телеметрия, не источник денег —
|
||
-- деньги живут в spend/checkpoints.
|
||
CREATE TABLE IF NOT EXISTS request_log (
|
||
id INTEGER PRIMARY KEY,
|
||
ts TEXT NOT NULL DEFAULT (datetime('now')),
|
||
trace_id TEXT NOT NULL DEFAULT '',
|
||
book_id TEXT NOT NULL,
|
||
chapter INTEGER NOT NULL DEFAULT 0,
|
||
chunk_idx INTEGER NOT NULL DEFAULT 0,
|
||
stage TEXT NOT NULL DEFAULT '',
|
||
role TEXT NOT NULL DEFAULT '',
|
||
model_requested TEXT NOT NULL DEFAULT '',
|
||
model_actual TEXT NOT NULL DEFAULT '',
|
||
request_hash TEXT NOT NULL DEFAULT '',
|
||
prompt_tokens INTEGER NOT NULL DEFAULT 0,
|
||
cached_tokens INTEGER NOT NULL DEFAULT 0,
|
||
cache_creation_tokens INTEGER NOT NULL DEFAULT 0,
|
||
completion_tokens INTEGER NOT NULL DEFAULT 0,
|
||
reasoning_tokens INTEGER NOT NULL DEFAULT 0,
|
||
cost_usd REAL NOT NULL DEFAULT 0,
|
||
latency_ms INTEGER NOT NULL DEFAULT 0,
|
||
finish_reason TEXT NOT NULL DEFAULT '',
|
||
tm_hit INTEGER NOT NULL DEFAULT 0, -- ответ взят из чекпоинта, вызова не было
|
||
degraded TEXT NOT NULL DEFAULT '',
|
||
err TEXT NOT NULL DEFAULT '',
|
||
ok INTEGER NOT NULL DEFAULT 1
|
||
);
|
||
CREATE INDEX IF NOT EXISTS request_log_ts_idx ON request_log (ts);
|
||
`,
|
||
// v2: per-chunk×stage disposition (Milestone 2, D2). The resolve sits ON TOP OF
|
||
// append-only checkpoints (keyed by request_hash-with-attempt) — not a column on
|
||
// checkpoints: on resume the row is rebuilt from checkpoints, so its loss on kill -9
|
||
// self-heals (classify from the checkpoint's text, without re-billing). jobs.status
|
||
// is NOT extended with content — failed stays an infra failure; a bad chunk lives
|
||
// here as a disposition, and the loop continues.
|
||
`
|
||
CREATE TABLE IF NOT EXISTS chunk_status (
|
||
book_id TEXT NOT NULL,
|
||
chapter INTEGER NOT NULL,
|
||
chunk_idx INTEGER NOT NULL,
|
||
stage TEXT NOT NULL,
|
||
snapshot_id TEXT NOT NULL, -- под каким снапшотом резолвнут (stale после --resnapshot игнорируется)
|
||
content_hash TEXT NOT NULL DEFAULT '',-- сигнатура отрендеренных msgs (исходник НЕ в снапшоте): правка src делает позиционную строку недействительной, а не подаёт устаревший перевод
|
||
disposition TEXT NOT NULL, -- ok | flagged | skipped
|
||
flag_reason TEXT NOT NULL DEFAULT '', -- '' когда ok; Go-константа FlagReason
|
||
attempts INTEGER NOT NULL DEFAULT 0,
|
||
final_hash TEXT NOT NULL DEFAULT '', -- request_hash авторитетного чекпоинта (ok-путь подаёт его текст дальше)
|
||
cost_usd REAL NOT NULL DEFAULT 0, -- сумма по ВСЕМ попыткам (F3-честно: ретраи учтены)
|
||
detail TEXT NOT NULL DEFAULT '',
|
||
updated_at TEXT NOT NULL DEFAULT (datetime('now')),
|
||
PRIMARY KEY (book_id, chapter, chunk_idx, stage)
|
||
);
|
||
CREATE INDEX IF NOT EXISTS chunk_status_book_idx ON chunk_status (book_id, disposition);
|
||
`,
|
||
// v3: escalation flag on checkpoints (Milestone 2.5, D12 single-hop). The fallback
|
||
// draft (a deterministic content-failure routed to another model ONCE) is tagged
|
||
// so the book's escalation.budget_usd can be enforced by summing ONLY escalation
|
||
// spend, independent of the primary translation cost. On the checkpoint (written
|
||
// in the same tx as the settle), NOT request_log, so the sum is durable across
|
||
// resume / kill -9 (telemetry is fire-and-forget; money-path budgeting is not).
|
||
`ALTER TABLE checkpoints ADD COLUMN escalation INTEGER NOT NULL DEFAULT 0;`,
|
||
// v4: ruby/furigana readings captured on ingest (step 3a, 04-unhappy §4 / D9). A
|
||
// ja epub's <ruby>base<rt>reading</rt></ruby> carries the AUTHOR's reading of a
|
||
// name/term; epub-v1 drops inline markup (02-mvp:25), which would silently kill
|
||
// this layer, so ingest EXTRACTS the readings into this table instead. It is NOT
|
||
// injected into any prompt (that is memory v2 + determinism-load-bearing) — this
|
||
// step only CAPTURES + PERSISTS; memory v2 (step 4) consumes it into a glossary
|
||
// name-lock (base→dst via reading, first_chapter→since_ch — D7 schema). PK
|
||
// (book_id, base, reading): the same name may carry several readings across a
|
||
// book (variant yomi), each a distinct row. first_chapter = the MIN chapter the
|
||
// pair appears in (a glossary "since"); occurrences = the pair's full-book count
|
||
// (a memory-v2 confidence signal). The persist is idempotent AND a full replace:
|
||
// ingest aggregates each (base,reading) once over the WHOLE book, and persistRuby
|
||
// DELETEs the book's set before re-inserting (store.ReplaceRubyReadings), so
|
||
// re-ingesting the same source re-derives identical rows and a source edit
|
||
// converges every column — including DROPPING a pair the edit removed (never a
|
||
// lingering phantom, never a MIN-pin/increment that drifts on resume).
|
||
`
|
||
CREATE TABLE IF NOT EXISTS ruby_readings (
|
||
book_id TEXT NOT NULL,
|
||
base TEXT NOT NULL, -- the ruby BODY: the kanji/base surface form
|
||
reading TEXT NOT NULL, -- the <rt> reading (furigana) captured for it
|
||
first_chapter INTEGER NOT NULL,-- 1-based full-book MIN chapter the pair appears in (glossary "since"; idempotent REPLACE)
|
||
occurrences INTEGER NOT NULL DEFAULT 0, -- full-book count (idempotent REPLACE, not increment)
|
||
created_at TEXT NOT NULL DEFAULT (datetime('now')),
|
||
PRIMARY KEY (book_id, base, reading)
|
||
);
|
||
CREATE INDEX IF NOT EXISTS ruby_readings_book_idx ON ruby_readings (book_id);
|
||
`,
|
||
// v5: the memory bank v2 glossary (step 4, registry architecture/06 §Гейты + D7).
|
||
// The DETERMINISTIC substrate the hot-path matcher, the injection surface and the
|
||
// post-check are built on. Rows are the frozen-at-job-start injectable pool whose
|
||
// approved subset the F1 memoryVersion() hashes into the snapshot. Like ruby_readings
|
||
// this is "dumb storage" (aggregation/classification live in the pipeline); the
|
||
// pipeline REPLACES a book's whole glossary from its deterministic inputs (seed file
|
||
// + classified ruby), so re-seeding is idempotent and a seed edit converges every
|
||
// column. No cross-table FK (mirrors the ruby/chunkstatus dumb-storage style): both
|
||
// child tables are scoped by book_id and replaced in the same transaction, term_id is
|
||
// a logical link (glossary.id is a fresh autoincrement each replace and is NEVER hashed
|
||
// into memoryVersion — only content columns are, ORDER BY-stable).
|
||
`
|
||
CREATE TABLE IF NOT EXISTS glossary (
|
||
id INTEGER PRIMARY KEY,
|
||
book_id TEXT NOT NULL,
|
||
src TEXT NOT NULL, -- source key (raw; normalized in Go for matching, §3.6)
|
||
dst TEXT NOT NULL DEFAULT '', -- approved Russian translation (LEMMA/base form); '' for a ruby candidate with no dst yet
|
||
type TEXT NOT NULL DEFAULT '', -- name|term|title|… alias-graph node type (B3)
|
||
sense TEXT NOT NULL DEFAULT '', -- A3 polysemy disambiguator (part of the uniqueness key)
|
||
gender TEXT NOT NULL DEFAULT '', -- male|female|hidden|'' (C2; hidden = gender-avoidant rendering until reveal)
|
||
speech TEXT NOT NULL DEFAULT '', -- DEPRECATED (pack-19): superseded by the address_pairs journal (v13); never read, never hashed
|
||
decl TEXT NOT NULL DEFAULT '', -- JSON {"invariant":bool,"forms":[...]}: the dst declension forms the post-check accepts (E1/E2 safety, decl = grammaticality mechanism, not a market feature)
|
||
translit_policy TEXT NOT NULL DEFAULT '', -- B5 western-name-via-katakana (field only in v1; validator = Phase 2)
|
||
first_person TEXT NOT NULL DEFAULT '', -- D7 first_person field (field only)
|
||
nickname_translation TEXT NOT NULL DEFAULT '', -- D7 (keep in v1: a column + a "translate once" lock)
|
||
since_ch INTEGER NOT NULL DEFAULT 0, -- spoiler window start; 0 = valid from the beginning (C1 hard reject-gate below since_ch)
|
||
until_ch INTEGER NOT NULL DEFAULT 0, -- spoiler window end; 0 = no end (valid forever)
|
||
status TEXT NOT NULL DEFAULT 'auto',-- auto|draft|approved (term status machine; only approved is CONFIRMED-injected)
|
||
allow_short INTEGER NOT NULL DEFAULT 0, -- rare escape hatch: permit a below-min_key_len key (A3 single-key ban override)
|
||
source TEXT NOT NULL DEFAULT '', -- provenance: seed|ruby|auto (who created the row)
|
||
ruby_reading TEXT NOT NULL DEFAULT '', -- ruby-seeded rows: the furigana reading (bridge to Polivanov dst validation, B6 Phase 2 — NOT a dst)
|
||
ruby_class TEXT NOT NULL DEFAULT '', -- name|gloss|ambiguous (ruby classifier §8: phonetic-name → name-lock candidate, unrelated reading → gloss/footnote, else flag)
|
||
confidence INTEGER NOT NULL DEFAULT 0, -- ruby occurrences count = confidence prior (NOT a direct promotion to approved)
|
||
note TEXT NOT NULL DEFAULT '',
|
||
-- B2: at most one row per (source key, sense, spoiler window). since_ch/until_ch are
|
||
-- NOT NULL with default 0, so the SQLite "NULLs are distinct in UNIQUE" gotcha cannot
|
||
-- silently admit a duplicate. A term whose approved rendering changes across a spoiler
|
||
-- boundary is two rows with different windows (legitimately distinct), not a collision.
|
||
UNIQUE (book_id, src, sense, since_ch, until_ch)
|
||
);
|
||
CREATE INDEX IF NOT EXISTS glossary_book_idx ON glossary (book_id, status);
|
||
|
||
CREATE TABLE IF NOT EXISTS glossary_aliases (
|
||
id INTEGER PRIMARY KEY,
|
||
book_id TEXT NOT NULL,
|
||
term_id INTEGER NOT NULL, -- logical link to glossary.id within the SAME replace tx (no hard FK — dumb storage, scoped+replaced by book_id)
|
||
alias TEXT NOT NULL, -- an alternative source surface (raw; normalized in Go for matching)
|
||
alias_type TEXT NOT NULL DEFAULT '', -- name|zi|hao|nickname|title (B3 alias-graph node type)
|
||
UNIQUE (book_id, term_id, alias)
|
||
);
|
||
CREATE INDEX IF NOT EXISTS glossary_aliases_term_idx ON glossary_aliases (term_id);
|
||
CREATE INDEX IF NOT EXISTS glossary_aliases_book_idx ON glossary_aliases (book_id);
|
||
|
||
-- B1 editorial-time axis, ORTHOGONAL to the spoiler window (since_ch/until_ch is the
|
||
-- STORY timeline; this is the EDITORIAL timeline). Append-only journal of approved-dst
|
||
-- changes so a stale first-translation-wins rendering is DETECTABLE (DelTA PNR generates
|
||
-- stale/drift; this is the substrate that catches it). Not injected → not in any hash;
|
||
-- datetime('now') here is fine (telemetry, like request_log), never feeds memoryVersion.
|
||
CREATE TABLE IF NOT EXISTS glossary_revisions (
|
||
id INTEGER PRIMARY KEY,
|
||
book_id TEXT NOT NULL,
|
||
src TEXT NOT NULL,
|
||
sense TEXT NOT NULL DEFAULT '',
|
||
old_dst TEXT NOT NULL DEFAULT '',
|
||
new_dst TEXT NOT NULL,
|
||
editorial_ts TEXT NOT NULL DEFAULT (datetime('now')),
|
||
reason TEXT NOT NULL DEFAULT ''
|
||
);
|
||
CREATE INDEX IF NOT EXISTS glossary_revisions_book_idx ON glossary_revisions (book_id, src);
|
||
|
||
-- Per-chunk retrieval-state (registry gate #4 / A1/F2/G2/E1): observability of memory
|
||
-- degradation FROM DAY ONE — the mechanism that converts silent degradation into loud.
|
||
-- Recomputed deterministically each run (the matcher is $0), so it self-heals on resume;
|
||
-- NOT wire-load-bearing (it records what the injection did, it does not change the request).
|
||
CREATE TABLE IF NOT EXISTS retrieval_state (
|
||
book_id TEXT NOT NULL,
|
||
chapter INTEGER NOT NULL,
|
||
chunk_idx INTEGER NOT NULL,
|
||
snapshot_id TEXT NOT NULL,
|
||
n_exact_hits INTEGER NOT NULL DEFAULT 0, -- entries matched by an exact key/alias in this chunk
|
||
n_sticky INTEGER NOT NULL DEFAULT 0, -- entries carried by scene-inertia (A5), not re-matched here
|
||
n_ambiguous_flagged INTEGER NOT NULL DEFAULT 0, -- injected AMBIGUOUS (auto/draft) → "unverified" + forced post-check (A2)
|
||
n_spoiler_blocked INTEGER NOT NULL DEFAULT 0, -- matched but hard-rejected by the since_ch/until_ch window (C1)
|
||
n_evicted INTEGER NOT NULL DEFAULT 0, -- dropped by the token budget (F2 — logged, never silent)
|
||
embedding_tier_used INTEGER NOT NULL DEFAULT 0, -- always 0 in v1 (no embeddings on the hot path, Р3)
|
||
n_postcheck_miss INTEGER NOT NULL DEFAULT 0, -- E1 flags: a confirmed src matched but no accepted dst form is in the output
|
||
postcheck_detail TEXT NOT NULL DEFAULT '', -- JSON [{src,dst}] of the misses, for the report / human
|
||
injected_ids TEXT NOT NULL DEFAULT '', -- JSON of exact-matched entity keys (audit + sticky reconstruction)
|
||
updated_at TEXT NOT NULL DEFAULT (datetime('now')),
|
||
PRIMARY KEY (book_id, chapter, chunk_idx)
|
||
);
|
||
`,
|
||
// v6: surface single-hop escalation on the chunk_status RESOLVE (D15.3 status/redrive).
|
||
// The fallback fact lived only on the checkpoint (escalation flag, v3); folding it into
|
||
// chunk_status lets `tmctl status` project escalation-on-flagged-resume WITHOUT re-reading
|
||
// checkpoints (the deferred Milestone-2.5 finding #6 — the escalation column the status
|
||
// read-model needs). Derivable from checkpoints, so a lost/rebuilt row self-heals on the
|
||
// next resolve. escalation_model is the fallback that answered (empty when not escalated).
|
||
`
|
||
ALTER TABLE chunk_status ADD COLUMN escalated INTEGER NOT NULL DEFAULT 0;
|
||
ALTER TABLE chunk_status ADD COLUMN escalation_model TEXT NOT NULL DEFAULT '';
|
||
`,
|
||
// v7: the cheap deterministic style flaggers (dialogue-dash, yofikator, translit-interjection
|
||
// blocklist, 万/億 magnitude gate — cheapgates.go) ride the same per-chunk observability row as
|
||
// the glossary post-check. n_style_flags is the total hit count; style_detail is the JSON
|
||
// breakdown for the report. Recomputed deterministically each run (self-heals on resume), NOT
|
||
// wire-load-bearing (observability, never a disposition).
|
||
`
|
||
ALTER TABLE retrieval_state ADD COLUMN n_style_flags INTEGER NOT NULL DEFAULT 0;
|
||
ALTER TABLE retrieval_state ADD COLUMN style_detail TEXT NOT NULL DEFAULT '';
|
||
`,
|
||
// v8 (D39 layer 4): the disposition-gated suppressor's LOUD record. n_trust_gated_suppress counts
|
||
// the times a longer but LOWER-trust glossary key (draft/ambiguous) was REFUSED from suppressing a
|
||
// nested HIGHER-trust key (approved/confirmed) — the term-drift code root, converted from a silent
|
||
// drop into a visible signal (research/13 §7). A nonzero count means the seed has a draft term
|
||
// nesting over an approved one to reconcile. trust_gate_detail is the JSON of the refused pairs.
|
||
// Recomputed deterministically each run (self-heals on resume), NOT wire-load-bearing.
|
||
`
|
||
ALTER TABLE retrieval_state ADD COLUMN n_trust_gated_suppress INTEGER NOT NULL DEFAULT 0;
|
||
ALTER TABLE retrieval_state ADD COLUMN trust_gate_detail TEXT NOT NULL DEFAULT '';
|
||
`,
|
||
// v9 (WS4): the banknote channel's per-chunk telemetry (integration point 10) — the accepted line
|
||
// count and the parse-fail / truncation flags of the translator draft's ⟦TM-BANK-v1⟧ block, riding
|
||
// the same per-chunk observability row as the glossary post-check and the cheap style flaggers.
|
||
// Recomputed deterministically each run (self-heals on resume), NOT wire-load-bearing (observability,
|
||
// never a disposition). Zero for every channel-off / non-banknote chunk (the common case).
|
||
`
|
||
ALTER TABLE retrieval_state ADD COLUMN n_banknote_lines INTEGER NOT NULL DEFAULT 0;
|
||
ALTER TABLE retrieval_state ADD COLUMN banknote_parse_fail INTEGER NOT NULL DEFAULT 0;
|
||
ALTER TABLE retrieval_state ADD COLUMN banknote_truncated INTEGER NOT NULL DEFAULT 0;
|
||
`,
|
||
// v10 (pack-13 point-9, research/21 §1.10): the CostSource marker on the telemetry row. When a paid
|
||
// 2xx settles at the RESERVATION ESTIMATE (a billed decode failure, or a paid-but-zero-usage 2xx) the
|
||
// row's cost_usd is an estimate, not provider-reported. Without a flag those rows are indistinguishable
|
||
// from real zero-token calls and skew token-based COGS analytics. estimated=1 makes the estimated share
|
||
// queryable; est_tokens is a DISPLAY-ONLY fertility (est_out) estimate of the output tokens (never the
|
||
// char/4 CJK-mine). Additive columns, default 0 → every prior row and the WIRE are unchanged (the pack
|
||
// invariant); an estimated row keeps its real settled cost_usd — the flag/estimate are display-only.
|
||
`
|
||
ALTER TABLE request_log ADD COLUMN estimated INTEGER NOT NULL DEFAULT 0;
|
||
ALTER TABLE request_log ADD COLUMN est_tokens INTEGER NOT NULL DEFAULT 0;
|
||
`,
|
||
// v11 (mini-run findings Д1 + Д4, 25.07): two facts the mini-run proved are produced and then lost.
|
||
//
|
||
// • chunk_status.first_flag_reason — the disposition reason of the FIRST attempt, kept when a later
|
||
// attempt (a regenerate or the single-hop escalation) recovered the chunk. Without it a recovered
|
||
// row is written `ok` with an empty flag_reason and the primary failure vanishes from every
|
||
// durable surface: the mini-run's echo (1 of 20 drafts, cjk_artifact, escalation-recovered) was
|
||
// reported as echo_draft=0.0%. Since the echo rate is the only numeric watchman of the DeepSeek
|
||
// echo mine (D18/D19), losing it hides the class it exists to watch. Re-derived every run from the
|
||
// stored checkpoints (self-heals on resume); observability only, never a verdict, never wire.
|
||
//
|
||
// • retrieval_state.banknote_detail — the PARSED ⟦TM-BANK-v1⟧ entries (src/dst/type) of the chunk,
|
||
// the WHAT channel D39.36 found is parsed and thrown into `_`. It mirrors the three *_detail
|
||
// JSON columns already on this row (postcheck / style / trust-gate): re-derived deterministically
|
||
// each run from the raw checkpoint, self-healing, never wire-load-bearing. The bank-mining stop
|
||
// reads it to attach the model's PROPOSED dst to the owner's signature map — proposals stay
|
||
// status:auto, so delivering the WHAT grants no trust (the owner still signs).
|
||
//
|
||
// Both are additive with defaults ⇒ every prior row and the WIRE are unchanged.
|
||
`
|
||
ALTER TABLE chunk_status ADD COLUMN first_flag_reason TEXT NOT NULL DEFAULT '';
|
||
ALTER TABLE retrieval_state ADD COLUMN banknote_detail TEXT NOT NULL DEFAULT '';
|
||
`,
|
||
// v12 (pack-20 / D39.42 п.4): the $0 observability channel of the UNVERIFIED wire.
|
||
//
|
||
// In the auto mode the bank legitimately carries renderings nobody signed, and the owner's decision is
|
||
// that they reach the model marked ⟨проверить⟩. That makes a question answerable that never was: when
|
||
// an unsigned rendering is actually PUT IN FRONT of the model, does the model go along with it?
|
||
//
|
||
// • n_unverified_shown — unsigned rows whose src fired in THIS chunk (the denominator);
|
||
// • n_unverified_followed — of those, the ones whose rendering appears in the output.
|
||
//
|
||
// The pair is deliberately measured ON THE WIRE THAT SHOWED THE ROW: before pack-20 the ambiguous
|
||
// counter was collected on the editor wire, whose block was CONFIRMED-only — it counted deviations
|
||
// from something the editor was never shown. Neither number gates anything: an unverified row is a
|
||
// candidate the model is entitled to reject (external-review major #1), so this is a measurement of
|
||
// the channel, never a judgement of the output. Additive with defaults ⇒ prior rows and the WIRE are
|
||
// unchanged.
|
||
`
|
||
ALTER TABLE retrieval_state ADD COLUMN n_unverified_shown INTEGER NOT NULL DEFAULT 0;
|
||
ALTER TABLE retrieval_state ADD COLUMN n_unverified_followed INTEGER NOT NULL DEFAULT 0;
|
||
`,
|
||
// v13 (pack-19 / D39.55): the two D21 record types the bank was missing — the per-character VOICE
|
||
// profile and the ordered ADDRESS pair. They are TABLES rather than glossary columns for one hard
|
||
// reason: a character's term row and its voice profile share (src, sense, since_ch, until_ch), which
|
||
// is the glossary UNIQUE key, so the profile could not coexist with the term it describes without
|
||
// rebuilding that constraint — forbidden by the append-only discipline above.
|
||
//
|
||
// They are nevertheless BANK CONTENT, not a store beside the bank: their rows are replaced in the SAME
|
||
// transaction as the glossary and fold into the SAME memory_version (conditionally — see
|
||
// membank.ComputeVersionScopedIn). Giving them a snapshot key of their own would classify a signature
|
||
// as moveOther and cost a whole edit wave instead of the touched units (pipeline/repin.go).
|
||
//
|
||
// address_pairs is the MATERIALIZATION of the ты/вы transition journal (D7-Amendment-1, D21 п.2), not a
|
||
// second source of truth: a row IS a journal entry (register valid from since_ch to until_ch) and the
|
||
// "current register at chapter N" is the projection membank computes, never a stored state. A ты↔вы
|
||
// switch is a second row with a non-overlapping window, exactly like a spoiler handoff.
|
||
//
|
||
// Both reference characters by the STABLE key (src, sense) rather than glossary.id: that id is a fresh
|
||
// autoincrement on every replace (see v5), so an id link would silently re-point after any re-seed.
|
||
`
|
||
CREATE TABLE IF NOT EXISTS voice_profiles (
|
||
id INTEGER PRIMARY KEY,
|
||
book_id TEXT NOT NULL,
|
||
src TEXT NOT NULL, -- character identity, half 1 (the glossary term's src)
|
||
sense TEXT NOT NULL DEFAULT '', -- character identity, half 2
|
||
register TEXT NOT NULL DEFAULT '', -- one line: register + tone
|
||
self_ref TEXT NOT NULL DEFAULT '', -- the character's own self-designation (D7 first_person)
|
||
address_default TEXT NOT NULL DEFAULT '', -- informal|formal|'' — the T/V default outside the pair registry
|
||
lexicon_markers TEXT NOT NULL DEFAULT '', -- JSON []string: characteristic words
|
||
ng_lexicon TEXT NOT NULL DEFAULT '', -- JSON []string: words this character never says
|
||
exemplars TEXT NOT NULL DEFAULT '', -- JSON []string: 3-5 approved target replies
|
||
brightness TEXT NOT NULL DEFAULT '', -- injection priority hint (D21 п.1в: hypothesis, not a rule)
|
||
since_ch INTEGER NOT NULL DEFAULT 0, -- manner-change window, same axis as the glossary spoiler window
|
||
until_ch INTEGER NOT NULL DEFAULT 0,
|
||
UNIQUE (book_id, src, sense, since_ch, until_ch)
|
||
);
|
||
CREATE INDEX IF NOT EXISTS voice_profiles_book_idx ON voice_profiles (book_id);
|
||
|
||
CREATE TABLE IF NOT EXISTS address_pairs (
|
||
id INTEGER PRIMARY KEY,
|
||
book_id TEXT NOT NULL,
|
||
speaker_src TEXT NOT NULL,
|
||
speaker_sense TEXT NOT NULL DEFAULT '',
|
||
addressee_src TEXT NOT NULL,
|
||
addressee_sense TEXT NOT NULL DEFAULT '',
|
||
register TEXT NOT NULL, -- informal|formal — ABSTRACT; the surfaces are target data
|
||
form TEXT NOT NULL DEFAULT '', -- the address form («молодой господин», a title)
|
||
closeness TEXT NOT NULL DEFAULT '', -- one word of hierarchy/closeness (why the register is what it is)
|
||
since_ch INTEGER NOT NULL DEFAULT 0, -- a ты<->вы switch is a STORY event: a second row, new window
|
||
until_ch INTEGER NOT NULL DEFAULT 0,
|
||
UNIQUE (book_id, speaker_src, speaker_sense, addressee_src, addressee_sense, since_ch, until_ch)
|
||
);
|
||
CREATE INDEX IF NOT EXISTS address_pairs_book_idx ON address_pairs (book_id);
|
||
`,
|
||
// v14 (pack-19): the per-chunk observability of the two new $0 flaggers, riding the same
|
||
// recomputed-every-run row as the glossary post-check and the cheap style gates.
|
||
//
|
||
// • n_voice_flags / voice_detail — the deterministic T/V + voice-marker flagger (gates.voice);
|
||
// • n_spoiler_leaks / spoiler_leak_detail — a rendering the spoiler window REJECTED for this
|
||
// chapter that appeared in the output anyway (the reveal half of D21 п.3).
|
||
//
|
||
// Neither is ever a disposition, and both are re-derived deterministically each run (self-healing on
|
||
// resume), so they are observability exactly like their siblings. Additive with defaults ⇒ every prior
|
||
// row and the WIRE are unchanged.
|
||
`
|
||
ALTER TABLE retrieval_state ADD COLUMN n_voice_flags INTEGER NOT NULL DEFAULT 0;
|
||
ALTER TABLE retrieval_state ADD COLUMN voice_detail TEXT NOT NULL DEFAULT '';
|
||
ALTER TABLE retrieval_state ADD COLUMN n_spoiler_leaks INTEGER NOT NULL DEFAULT 0;
|
||
ALTER TABLE retrieval_state ADD COLUMN spoiler_leak_detail TEXT NOT NULL DEFAULT '';
|
||
`,
|
||
}
|
||
|
||
// DESIGN NOTE (D21.10 → BUILT by pack-19 / D39.55; kept as the record of what each type is FOR).
|
||
//
|
||
// research/15 (D21) ratified three memory MECHANISMS extending the bank. Two are now schema (v13); the
|
||
// third turned out to need none.
|
||
//
|
||
// • voice_profile (D21.1) — BUILT as `voice_profiles` (v13), keyed by the STABLE (src, sense) rather
|
||
// than the reserved (book_id, term_id): glossary.id is a fresh autoincrement per replace. Still
|
||
// FROZEN per-job (self-populating exemplars = mid-run memory append = book re-pay under D8/D15.1);
|
||
// the condition for lifting it — D15.2 landing — has NOT happened (verdictSnapshotID/guard_hash do
|
||
// not exist in this engine, only in comments).
|
||
//
|
||
// • address_pair (D21.2) — BUILT as `address_pairs` (v13). The reserved shape guessed a derived
|
||
// projection over a separate `speech_transitions` journal; the built one collapses the two, because a
|
||
// windowed row IS a journal entry and the "register at chapter N" projection is computed, never
|
||
// stored. So there is still exactly one source of truth, with one table instead of two.
|
||
// `glossary.speech` (the static v5 note) is superseded and DEPRECATED — see its column comment.
|
||
//
|
||
// • reveal_ch + pre/post-reveal aliases (D21.3) — NOT built, and deliberately: the pre/post rendering
|
||
// pair is already expressible as two glossary rows with NON-OVERLAPPING windows (the UNIQUE key
|
||
// admits them, membank.windowsOverlap permits them, spoilerBlocked picks exactly one), and aliases
|
||
// inherit their row's window, so a phase tag would be a third way to say what two already say. What
|
||
// was genuinely missing is the LEAK CHECK — a rejected rendering appearing in the output anyway —
|
||
// which is membank.SpoilerLeaks over the selection's Rejected set, no schema at all. Scope amended
|
||
// by D39.55 (form, not intent).
|
||
|
||
// migrate runs all pending migrations on the write pool, one transaction per
|
||
// step, recording each in schema_version.
|
||
func (s *Store) migrate(ctx context.Context) error {
|
||
if _, err := s.w.ExecContext(ctx, `CREATE TABLE IF NOT EXISTS schema_version (version INTEGER PRIMARY KEY)`); err != nil {
|
||
return fmt.Errorf("store: schema_version: %w", err)
|
||
}
|
||
var current int
|
||
if err := s.w.QueryRowContext(ctx, `SELECT COALESCE(MAX(version), 0) FROM schema_version`).Scan(¤t); err != nil {
|
||
return fmt.Errorf("store: read version: %w", err)
|
||
}
|
||
for v := current; v < len(migrations); v++ {
|
||
tx, err := s.w.BeginTx(ctx, nil)
|
||
if err != nil {
|
||
return fmt.Errorf("store: begin migration %d: %w", v+1, err)
|
||
}
|
||
if _, err := tx.ExecContext(ctx, migrations[v]); err != nil {
|
||
_ = tx.Rollback()
|
||
return fmt.Errorf("store: apply migration %d: %w", v+1, err)
|
||
}
|
||
if _, err := tx.ExecContext(ctx, `INSERT INTO schema_version (version) VALUES (?)`, v+1); err != nil {
|
||
_ = tx.Rollback()
|
||
return fmt.Errorf("store: record migration %d: %w", v+1, err)
|
||
}
|
||
if err := tx.Commit(); err != nil {
|
||
return fmt.Errorf("store: commit migration %d: %w", v+1, err)
|
||
}
|
||
}
|
||
return nil
|
||
}
|