Flopwire memory report

Type: agentic-system-analyses/types/agentic-system-memory-report.md

Boundary and evidence

The subject is Flopwire at SRC-1 commit 057a4b87603cc878e81d9eb49298ddc4eb9eeb23, within the supplied whole-system boundary. Included memory comprises extracted transcript content, index and provenance metadata, derived digests and commit evidence, the shared archive, message bodies and delivery metadata, withdrawal controls, recovery imports and backups, and the shipped consumers and context adapters. Native transcripts are acquisition inputs; external harness context and opaque checkpoint payloads remain external in origin even when captured by Flopwire. Static skills and standing instructions supply context but are not themselves read-back of material accumulated through use.

The supplied runtime supplies the initial indexing, retrieval, upload, delivery, configuration and evaluation routes. Direct reads added the paths in the table below. All findings are implementation or doctrine/design evidence under SRC-1, as registered in boundary. No target, test, evaluation driver or external model was executed. Source HEAD was checked against the registered revision. No repository access gap was encountered. Available but uninspected variants are named locally; they prevent completeness or reliability conclusions, rather than erasing the inspected mechanisms.

Entry point or memory operation	SRC-1 paths and evidence basis	Records or remaining limit
CLI dispatch, registered MCP tools	Direct: cmd/flopwire/main.go, cmd/flopwire/mcp.go, cmd/flopwire/mcp_bus.go, cmd/flopwire/change.go	RT-RTE-history-retrieval, MEM-RTE-thread-history. Includes raw, change, messages, inbox, import, backup/restore and redact, beyond search.
Native indexing and parser generations	Supplied runtime; direct: internal/localindex/store.go, internal/localindex/text.go, internal/localindex/digest.go	RT-RTE-transcript-index, MEM-OBJ-message-text, MEM-OBJ-index-metadata. Individual Claude/Devin/opencode/database parsers were not exhaustively read; exact extraction parity is unestablished.
Local/server lexical search, sessions, address reads	Supplied runtime; direct: internal/retrieval/local/local.go, internal/retrieval/retrieval.go, internal/retrieval/format/format.go, internal/retrieval/format/render.go, internal/localindex/query.go	RT-RTE-history-retrieval. Query predicates and all ranking branches were not exhaustively audited.
Raw evidence	Direct: internal/retrieval/local/raw.go; supplied server retrieval account	MEM-OBJ-archive; local native bytes are distinct from masked extracted text. Complete server raw redaction correctness is unestablished.
Digests and outlines	Direct: internal/digest/digest.go, internal/digest/summary.go, internal/localindex/digest.go, internal/localindex/outline.go, internal/ingest/digest.go, internal/retrieval/format/summary.go	MEM-OBJ-digest, MEM-RTE-derive-navigation. Outline is a read-time projection, not a separately retained summary.
Commit evidence and change lookup	Direct: internal/digest/evidence.go, internal/localindex/change.go, internal/ingest/commit_evidence.go, internal/retrieval/change.go, cmd/flopwire/change.go	MEM-OBJ-commit-evidence, MEM-RTE-derive-navigation. All shell grammar and command-completion alternatives remain unaudited.
Codex compaction alternatives	Direct: internal/transcript/codex/parser.go, internal/transcript/codex/records.go	MEM-OBJ-compacted, MEM-RTE-capture-compaction. External summary production and encrypted contents are unresolved.
Shared upload/archive and asynchronous parsing	Supplied runtime; direct: internal/retrieval/retrieval.go, internal/ingest/commit_evidence.go, internal/backup/backup.go	RT-RTE-shared-upload, MEM-OBJ-archive. Upload acknowledgement is not parse completion. Full chunk/admission and recovery-policy enforcement remain unaudited.
Redaction and historical versions	Direct: cmd/flopwire/redact.go, internal/localindex/redact.go, internal/retrieval/redactmsg.go, internal/ingest/reparse_redaction.go, internal/ingest/archive_repair.go	MEM-OBJ-tombstone, MEM-RTE-redact-content. No universal erasure guarantee.
Collection rules, hiding, withholding, deletion	Direct: internal/agent/policy.go, internal/ingest/hidden.go, internal/store/deletion.go	MEM-RTE-withdraw-history. Distinct local purge, server hide, permanent tombstone and object purge.
Cowork provenance and recovery restrictions	Direct: internal/localindex/cowork_history.go, internal/localindex/cowork_recovery.go, internal/agent/cowork.go, internal/agent/placement.go, internal/agent/cowork_sharing.go	MEM-OBJ-cowork-history, MEM-BAP-history-restriction. Full discovery/family reconciliation and host-grant authenticity were not audited.
Message send, inbox, retained threads, expiry	Supplied runtime; direct: internal/devicebus/local.go, internal/devicebus/store.go, internal/bus/messages.go, internal/bus/delivery.go, internal/busproto/busproto.go, cmd/flopwire/messages.go	MEM-OBJ-bus-messages, MEM-OBJ-delivery-metadata, MEM-RTE-thread-history. Server thread reads differ from session inbox.
Hooks, instruction renewal, receipt evidence, alternate adapters	Supplied runtime; direct: internal/devicebus/instruct.go, internal/busrender/busrender.go, internal/agent/reads.go	RT-RTE-hook-delivery, RT-RTE-adapter-delivery. Host insertion and inference remain external.
Explicit CASS imports	Direct: cmd/flopwire/import.go, cmd/flopwire/import_receipt.go	MEM-RTE-import-recovery. Export converter and snapshot verifier internals not fully read; exact recovered-content fidelity is unresolved.
Backup and restore	Direct: internal/backup/backup.go; CLI dispatch	MEM-RTE-restore-state. Backup bytes and manifests persist; deployment/restart and deletion of older independent backups are outside the established path.
Evaluators and product updates	Supplied RT-RTE-workflow-trial, RT-RTE-binary-upgrade; direct bounded cmd/flopwire/bench_ab.go search	Evaluation reports are operator evidence; no product memory update consumer established by the supplied trial. All evaluator variants and source-native reported outcomes were not inspected; no global absence of evaluation-driven development is asserted.
Setup, web console, release and administrative surfaces	Boundary inventory and supplied runtime admission account	Configuration and binaries can be edited/replaced through explicit administration. Detailed setup/web handlers were not read; no per-action human presence or complete UI coverage claimed. They do not justify treating transcript authoring as human-approved admission.

Core ideas

Flopwire preserves evidence from external work rather than automatically promoting it into validated knowledge. Stored prose remains conversation content; source and address metadata support navigation. A later user/model requests lexical retrieval, then interprets the returned passages. Static guidance asks it to read decisive messages, distinguish proposals and approvals, and respect clipping and coverage limits. The extraction and retrieval implementation does not establish correctness of the underlying conversation. RT-CLM-recovery-evidence, RT-BAP-recovery-guidance.

There is automatic trace-derived memory beyond raw logging: compact digests and commit-evidence projections persist and influence subsequent session discovery and provenance recovery. They have different checks and consumers. A digest's clipped intent/last answer is not an evidence-complete narrative; commit evidence retains command/result references rather than relying on the digest's capped commit list. This is trace-fed transformation and later reuse capacity, not demonstrated learning or a capacity improvement. MEM-RTE-derive-navigation.

Context selection has two directions. History tools respond to a user/model request with selected evidence. Pending messages are instead selected automatically at eligible harness events and supplied to the recipient. Hook insertion is bounded; the full message remains reachable through inbox while retained. Instruction renewal responds to host compaction/resume/clear without controlling the host's compaction policy. Subagent delivery is routed or suppressed by adapters; Flopwire does not own the host's separate model frames or their return values. RT-RTE-hook-delivery, RT-RTE-adapter-delivery.

Retention and authority are consumer-specific. A directly delivered own-user request receives task-like guidance, while the same retained text returned by thread history is explicitly historical evidence without authorization to act. Symbolic metadata can have stronger deterministic force: Cowork historical uncertainty and redaction tombstones constrain later sharing or rewriting even though they are not knowledge delivered to the foreground agent. MEM-RTE-thread-history, MEM-BAP-history-restriction, MEM-OBJ-tombstone.

Shared records

Components

none declared in this member

Operative objects

MEM-OBJ-message-text

Label: Extracted message text

Part of: RT-OBJ-localindex

This is the retained text part of the supplied local-index container, distinct from its access metadata. Natural-language user/assistant reasoning and answers reach later models through textual reads; tool call/result strings may encode symbolic commands or structured results, but Flopwire retrieval returns them as evidence rather than executing those stored commands. Storage is zstd-compressed SQLite message text. Lineage is parser extraction from native files, databases, exports and captured host material, not a guaranteed verbatim copy of every native byte. Retention survives loss of the original transcript for ordinary text retrieval; raw native reads have separate availability conditions. Admission is automatic parser/policy acceptance, not per-message human approval. SRC-1: internal/localindex/store.go, internal/localindex/text.go, internal/retrieval/local/raw.go; production route RT-RTE-transcript-index.

out[i] = prepared{z: compress(m.Text), text: m.Text}

--- internal/localindex/text.go

MEM-OBJ-index-metadata

Label: Index metadata

Part of: RT-OBJ-localindex

Symbolic SQLite/FTS data: identities, source generation, cursor/watermark, ordinal, kind, active-path/supersession state, repository placement, token and trigram entries. These are derived from parsers, filesystem observations and configured placement/policy, not embedding vectors. Consumers are index writers and selectors; their fixed rules determine resumability and which content is returned. A session ID addresses a source; lexical query terms, filters and ordering provide content selection. Scope metadata is not itself evidence that a retrieved utterance is true. Shard lag and sync-only mode limit what is queryable. This separates metadata from MEM-OBJ-message-text, within the same runtime container. SRC-1: internal/localindex/store.go, internal/retrieval/local/local.go, internal/retrieval/format/format.go.

// ReadOnly opens an existing index for queries only (the CLI and the // MCP server): no lock, no schema or shard writes, no FTS queue replay. // Writes return ErrReadOnly. Queries see what the agent's shards have // committed, which can lag the main database by about a second. --- internal/localindex/store.go

MEM-OBJ-digest

Label: Conversation digest

Part of: RT-OBJ-localindex

The local stored digest.Digest JSON is a material part of the index; its shared-server counterpart is stored in conversation_activity.digest by the same digest package. Prose fields hold selected intent and last assistant text; symbolic fields contain counts, tools, paths, commits and fold bookkeeping. These parts have different consumers: renderers expose clipped prose and aggregates to models, while subsequent folds consume State. No distributed-parametric storage is involved in this transformation. The local part's closest supplied referent is the index container, not the static standing instruction. SRC-1: internal/digest/digest.go, internal/localindex/digest.go, internal/ingest/digest.go.

// State is the fold's bookkeeping; renderers ignore it. State *State json:"state,omitempty" --- internal/digest/digest.go

IntentLen = 120 LastLen = 160 maxFiles = 25 maxPRs = 10 maxCommit = 20 maxIssues = 10 maxRepos = 4 --- internal/digest/digest.go

MEM-OBJ-commit-evidence

Label: Commit evidence projection

Part of: RT-OBJ-localindex

Local change_events are the distinct symbolic provenance part of the index; server commit_evidence is the corresponding projection from retained server rows. Entries retain observed hash, operation, command/result references, optional revealing-command references, captured directory and execution outcome. Source-generation scope and message identity supply lineage. Local/server change lookup consumes these entries and returns addresses; the model must read the supporting content. A hash observation does not establish complete authorship or unique identity of an abbreviation. Unlike MEM-OBJ-digest, the extractor has no summary-list cap; server rebuilding has its own finite work bounds. SRC-1: internal/digest/evidence.go, internal/localindex/change.go, internal/ingest/commit_evidence.go, internal/retrieval/change.go.

// It deliberately has no summary cap and never pairs by text containing a call ID. --- internal/digest/evidence.go

const CommitEvidenceMessageLimit = 100000 const CommitEvidenceTextLimit = 64 << 20 --- internal/ingest/commit_evidence.go

MEM-OBJ-archive

Label: Shared archive

Source-native generations, manifests, compressed content-addressed chunks and provisional tails retain uploaded source bytes in Postgres plus object storage. The manifest/hash/offset layer is symbolic. Payloads mix transcript prose, tool JSON and potentially opaque provider material; compression does not change their representational forms. Raw-byte consumers reconstruct evidence, while server parsers derive readable rows and projections. This is distinct from the local-index container; its closest supplied route is RT-RTE-shared-upload. Native uploads are redacted before transport in that route; extracted local text and archived bytes are not interchangeable. Raw server retrieval and backup consume archived material, but neither implies model use. SRC-1: internal/retrieval/retrieval.go, internal/backup/backup.go, internal/ingest/archive_repair.go.

// grep over pg_trgm verified in Go, ranked search over the tsvector, // sessions, read by address (SESSION/ORDINAL[:LINE], a session, a message // id, a transcript path:line), and raw bytes by manifest arithmetic.

--- internal/retrieval/retrieval.go

MEM-OBJ-compacted

Label: Captured Codex compaction

Readable compacted.message, strings collected from retained_context, and newly encountered replacement-history messages can become retained indexed text. This is a source-native acquisition object distinct from RT-OBJ-localindex, which stores its extraction. External Codex owns original summary/checkpoint production and its admission; Flopwire owns subsequent deterministic extraction. The typed payload is symbolic JSON with natural-language strings, and replacement history may also carry encrypted compaction summaries whose content/form and derivation are uninspected. A readable display is not the complete opaque checkpoint. Persistence includes the original source/archive when captured, plus readable extracted rows. Later Flopwire retrieval is established by MEM-RTE-capture-compaction; exact host reuse of the opaque checkpoint is not established. SRC-1: internal/transcript/codex/records.go, internal/transcript/codex/parser.go.

Message string json:"message" ReplacementHistory []item json:"replacement_history" RetainedContext json.RawMessage json:"retained_context"

--- internal/transcript/codex/records.go

continue // encrypted compaction summary, tool items --- internal/transcript/codex/parser.go

MEM-OBJ-bus-messages

Label: Retained bus message content

Source-native envelope bodies and refs persist in local SQLite devbus_messages and, when enrolled, server Postgres bus_messages. Message prose is natural-language sender content; refs and routing/intent fields are symbolic addresses/labels. Human versus computational authorship depends on the sender; invoking send does not require per-message human approval. Cleaning, redaction, recipient eligibility and transport acceptance are software admission. These records are distinct from RT-OBJ-standing-instruction, the static interpretation policy. They feed direct delivery, inbox rereads and server retained-thread reads, with different authority at each consumer. SRC-1: internal/devicebus/local.go, internal/devicebus/store.go, internal/bus/messages.go; supplied delivery is RT-RTE-hook-delivery.

// Inbox lists a session's messages, received and sent, newest first. --- internal/devicebus/local.go

MEM-OBJ-delivery-metadata

Label: Delivery and instruction metadata

SQLite instruction leases, attempt/confirmation state and message receipt/retry state, with server delivery/acceptance/audit records, are symbolic state. They decide redelivery, visibility, expiry and renewal; they are distinct from body content and do not contain a synthesized lesson. A transcript sighting of wrappers in a recognized hook-context row can update read receipts after parsing saves. Arbitrary tool output containing a wrapper does not qualify. This is a trace-fed metadata update with later bus consumers, not proof of model comprehension. The closest supplied referents are RT-RTE-hook-delivery and RT-RTE-policy-admission, neither an object declaration. SRC-1: internal/devicebus/instruct.go, internal/devicebus/store.go, internal/agent/reads.go.

// markRead hands a parse's sightings to the message bus, after the parse // was saved. A failure is logged: the sightings are not parsed again, and // the messages stay delivered (never wrongly read). --- internal/agent/reads.go

MEM-OBJ-tombstone

Label: Local message tombstones

Local redaction sidecar JSONL plus a separate random-key file retain symbolic masking rules beside the SQLite database. Hashes are HMAC-SHA256; clear fields include session/native IDs, line range/lengths and any remaining masked-title text. The writer reapplies masks on later row writes/rebuilds; this state differs from the rebuild-owned index and from conversation-deletion tombstones. It originates in an explicit content-redaction request, not automatic lesson extraction. Its consumer is the local writer/reconciliation path, whose force is deterministic masking. Closest supplied record RT-OBJ-localindex is the affected store, not the external sidecar referent. SRC-1: internal/localindex/redact.go.

// transcript file on disk still holds the text, so every write of a row // re-applies the tombstone: the sidecar file keeps them across reindexes // and index rebuilds (it sits beside the database, not in it). --- internal/localindex/redact.go

MEM-OBJ-cowork-history

Label: Cowork historical uncertainty

Part of: RT-OBJ-localindex

cowork_history(device_id,session_id) is a durable symbolic provenance part outside rebuild-owned tables. Historical uncertainty is recorded from capture/index evidence or prior provenance, not inferred solely from current metadata or readiness. It survives removal of source/index rows and is consumed on later placement loading/refresh to preserve restrictive origin classification. The content is access/provenance metadata, not a natural-language memory of what the user did. Related recovery sources require agreement between retained provenance, local association and acknowledged device-sync generation; they add restrictions rather than granting sharing. SRC-1: internal/localindex/cowork_history.go, internal/localindex/cowork_recovery.go, internal/agent/placement.go, internal/agent/cowork_sharing.go.

// to these native identities preceded complete host-scope proof. This table is // deliberately outside rebuild-owned index tables: deleting rows, generations, // or source paths must not erase historical provenance. --- internal/localindex/cowork_history.go

Routes

MEM-RTE-derive-navigation

Label: Derive retained navigation

Distinct from native acquisition in RT-RTE-transcript-index and transport in RT-RTE-shared-upload: store/ingest code automatically folds accepted trace rows into MEM-OBJ-digest and projects command/result evidence into MEM-OBJ-commit-evidence. No human approves individual derived fields; parser eligibility, live-row rules and deterministic extraction admit them. Model judgment and expected-answer oracles are not part of this production transformation. The open-ended external transcript supplies original inputs, including mixed user/model/tool outcomes, rather than a Flopwire-owned training curriculum.

• implementation conclusion status: wired
• operation conclusion status: uninspected
• Immediate return: Stored digest/projection and updated bookkeeping, or an error; ordinary source ingestion may finish separately from deferred server projection.
• Later read-back: Session summaries and outlines expose digest fields; change lookup reads provenance events and supplies supporting addresses for later model reads.
• Delegated visibility: Parent digest can count subagents; outline exposes spawned session IDs, not whole child contexts.
• Selection predicate: Fold order, first/last ordinals, recognized edits/commands/results, live-row counts, source-generation identity and configured caps; change lookup selects by full supplied commit IDs and repository scope.
• Invalidation or expiry: Supersession/reparse/rebuild and redaction refresh projections; fold version invalidates older commit bookkeeping; server dirty/limited state reports unfinished work.
• Activation or effect: Derived retained state can change what later discovery/provenance tools deliver; successful inference, historical attribution and benefit remain unobserved.
• Evidence limits: Partial grammar inspection cannot establish completeness for every command shape; projected observations are not independent verification against Git.

Reasons and lineage: the digest keeps selected snippets and counts, not a complete rationale. Its private State is for subsequent folding and is ignored by renderers. Commit evidence keeps command/result references and optional reveal references, so later read can recover those reasons while rows remain accessible. A returned address establishes recoverability, not that a later agent actually read it. SRC-1: internal/digest/digest.go, internal/digest/evidence.go, internal/localindex/change.go, internal/ingest/commit_evidence.go, internal/retrieval/change.go, cmd/flopwire/change.go.

// refreshChangeEvents replaces the derived projection in the same transaction // as source rows and watermarks. Unchanged events retain their ingestion IDs. --- internal/localindex/change.go

// refreshDigest folds msgs, the rows a flush wrote for conversation conv, // into its stored digest and updates its parent's subagent count, in the // flush's transaction. A conversation without a digest yet is recounted. --- internal/ingest/digest.go

MEM-RTE-capture-compaction

Label: Capture host compaction

Flopwire's Codex parser, reached by transcript extraction, transforms MEM-OBJ-compacted into readable retained rows. This is a material alternate acquisition path within RT-RTE-transcript-index, with distinct treatment of summary, replayed messages and opaque items. External host production/admission is unresolved; Flopwire's subsequent transformation is known and automatic. Starting Codex is not evidence of human approval of each summary.

• implementation conclusion status: wired
• operation conclusion status: uninspected
• Immediate return: Emitted parser rows for one unseen window summary and previously unseen supported replacement messages.
• Later read-back: Extracted rows reach later retrieval invocations; the summary is a system row. The inspected search/grep default excludes injected rows, not all system rows, so this summary is not excluded merely by being system-kind; ordinary filters and addressed reads still determine visibility.
• Delegated visibility: inapplicable — this parser branch captures a host checkpoint and does not create or return a subagent frame.
• Selection predicate: Non-inherited compaction, non-empty joined message/retained strings, unseen window, and unseen replacement message/agent_message identity; unsupported item types are skipped.
• Invalidation or expiry: Window and replay bookkeeping avoid duplicate extraction; normal source-generation, redaction and withdrawal rules govern stored results.
• Activation or effect: Preserves externally derived summary text for later interpretation; does not perform host compaction or prove later host reliance on a particular summary.
• Evidence limits: Encrypted summaries/tool items are not represented by the readable extraction; no supplied run establishes what the host retained or discarded internally.

The raw-to-derived chain is external turns → host compacted payload → Flopwire joined summary/novel replacement rows → retained index → requested read. Original compaction reasons, token budget, deciding model/code and fidelity are uninspected; the code comment calling retained strings “verified answers” does not establish verification. Host replacement history and opaque summary are alternative forms, not interchangeable copies. SRC-1: internal/transcript/codex/parser.go, internal/transcript/codex/records.go, internal/retrieval/format/format.go.

summary := strings.TrimSpace(strings.Join(nonEmpty(c.Message, retainedText(c.RetainedContext)), "\n\n")) --- internal/transcript/codex/parser.go

w.Role, w.Window = "compaction", window --- internal/transcript/codex/parser.go

MEM-RTE-redact-content

Label: Redact retained content

Explicit owner/admin requests propose whole-message, line-range and optional identical-copy masking. Credentials, ownership, address validity and copy reach constrain admission; software can reject, and local versus server actions have separate outcomes. redact --local affects this device's index; otherwise the command requests server redaction first and then local masking. No transaction spanning both is established. This content-specific editing route is distinct from configuration in RT-RTE-policy-admission.

• implementation conclusion status: wired
• operation conclusion status: uninspected
• Immediate return: Counts/errors from server rewrite and local masking; server old-chunk purge can continue as a deletion job.
• Later read-back: Local text, FTS, titles, digest and commit events are updated; server stored text/summaries and archive repair affect subsequent retrieval. Local raw reads still read native files.
• Delegated visibility: Copy targeting can include forks/subagents with explicit all-copies; not proof of reaching independent users, devices or already exposed contexts.
• Selection predicate: Address/range, native versions, content hashes, optional copies, ownership/admin scope and first-upload rules; line catalog and sidecars protect later writes.
• Invalidation or expiry: Tombstones reapply locally across reindex/rebuild; server old objects are queued for purge and later uploads are masked/redirected. Automatic restoration of hidden original text is not established.
• Activation or effect: Changes retained content and discoverability; does not recall evidence already delivered to a model or erase the native harness file.
• Evidence limits: Shared/server race and archive machinery were read selectively; universal secret removal, complete erasure and successful physical purge are unobserved.

Admission agency is explicit request content plus automatic validation/masking. Generic credentials do not prove a human physically selected the lines. Recovery uses idempotent repair/retry and durable masks rather than an established undo operation. Separate automatic rule-version maintenance masks historical versions and cached titles/digests; it explicitly does not rewrite the archive in that particular pass, whereas targeted redaction queues archive repair. SRC-1: cmd/flopwire/redact.go, internal/localindex/redact.go, internal/retrieval/redactmsg.go, internal/ingest/reparse_redaction.go, internal/ingest/archive_repair.go.

// Batch commits are idempotent. Only derived data changes, never the archive. --- internal/ingest/reparse_redaction.go

if err := w.refreshChangeEvents(t.conv); err != nil { return Tombstone{}, err } --- internal/localindex/redact.go

MEM-RTE-withdraw-history

Label: Withdraw retained history

This maintenance route acts on the material indexed/uploaded by RT-RTE-transcript-index and RT-RTE-shared-upload. Configured rules can deny local collection or restrict sharing. Server admin-rule enforcement hides existing history, may restore it when no longer covered, then purges after confirmation or seven days hidden. Explicit deletion creates permanent session tombstones and a separate object-purge job. These are different admission/rejection mechanisms, not one global TTL.

• implementation conclusion status: wired
• operation conclusion status: uninspected
• Immediate return: Policy enforcement/hide or deletion-job result; physical object purge is asynchronous and retryable.
• Later read-back: Local deny purges index rows; hidden server conversations are excluded including raw tools; deleted conversations cascade messages and leave tombstones rejecting later ingestion.
• Delegated visibility: Server hide/delete scope includes descendants and relevant copies; device-bound withholding must not be promoted to user-wide deletion.
• Selection predicate: User/admin rules, placement/provenance, explicit owner/admin deletion, unreferenced-source checks and last-manifest-reference checks before object removal.
• Invalidation or expiry: Hidden history is restorable before purge when current rules permit; permanent deletion tombstones survive payload removal; failed purges retry and can require administrator retry after five attempts.
• Activation or effect: Constrains future storage and retrieval, without retracting prior model context, native files or independent old backups.
• Evidence limits: A local rule edit does not universally delete server copies; complete policy/family reconciliation and deployed purge completion remain unverified.

Proposer/decider/veto: authorized principals edit policy or request deletion; source policy, ownership validation and worker checks decide the operation. Automatic rule enforcement is not per-content human review. The counterexample to “deny removes everything everywhere” is explicit in the device policy contract: ordinary rule changes purge locally while already uploaded content remains until separately deleted; later-discovered working-directory restriction has a specific withholding path. SRC-1: internal/agent/policy.go, internal/ingest/hidden.go, internal/store/deletion.go.

// are purged from the local index, and the agent logs that copies already // uploaded stay on the server until the owner or an admin deletes them // there. The one exception is a session a directory it named later moves // to local or deny after some of it was uploaded: the agent asks the // server to delete that session (recordCwds, sendWithholds). --- internal/agent/policy.go

// Request (one transaction): take the conversation's natural-key lock, write // the tombstone and a queued job, delete the conversation (messages cascade), // audit. Search and context stop seeing it at commit. --- internal/store/deletion.go

MEM-RTE-thread-history

Label: Read retained coordination

Distinct from direct delivery in RT-RTE-hook-delivery and inbox rereads, CLI/MCP messages requests read retained server threads across devices and ended sessions. The caller supplies repository and optional participants/time/thread filters. Enrolled credentials and current per-row acceptance checks admit the read. The caller owns interpretation and any further request; there is no expected-answer oracle. SRC-1: cmd/flopwire/messages.go, cmd/flopwire/mcp_bus.go, internal/bus/messages.go.

• implementation conclusion status: wired
• operation conclusion status: uninspected
• Immediate return: Latest eligible row per thread as preview, or eligible full stored rows/refs when opening a thread, newest first and bounded by whole-row byte budget.
• Later read-back: Retained bus bodies from previous sessions reach a later requesting model without claiming messages or updating receipts/presence.
• Delegated visibility: Eligible observed team rows may be returned beyond the original recipient; this is historical visibility, not a delegated task.
• Selection predicate: Resolved recorded repository identities, row authority/acceptance, participant/session filters, times, cursor and thread; default 20, maximum 200 rows, default/MCP maximum 24000 bytes.
• Invalidation or expiry: Acceptance is checked at the request snapshot; final-state server retention defaults to seven days past expiry, and parents/rows can disappear between pages.
• Activation or effect: Supplies evidence and navigation; instructions explicitly withhold action/reply authorization even for past own-user requests.
• Evidence limits: Preview/participant clipping and missing rows prevent complete-thread or completion inference; local-only machines must use inbox or enroll, with no team-wide fallback.

// Messages reads retained evidence without claims, receipts, presence or writes. --- internal/bus/messages.go

Reading retained threads does not address their requests to you or authorize action or reply. --- cmd/flopwire/mcp_bus.go

MEM-RTE-import-recovery

Label: Import recovered history

An explicit caller supplies a CASS snapshot, origin and selected conversation IDs to export, then supplies an export directory to upload. This is an alternate admission path within the broader RT-RTE-shared-upload, distinct from native parsed-watermark upload. Export content originates in an external history database; the caller's selection is explicit, but human control of that selection is unresolved. Manifest/snapshot validation, enrolled credentials, server policy and subsequent parser admission are software controls. SRC-1: cmd/flopwire/import.go, cmd/flopwire/import_receipt.go.

• implementation conclusion status: wired
• operation conclusion status: uninspected
• Immediate return: Export counts without upload, or uploaded/unreconciled-source counts; server parsing remains asynchronous.
• Later read-back: Accepted parsed recovered history joins shared retrieval; persisted device-bound receipts can later support restrictions on already-shared recovered sources.
• Delegated visibility: Recovery can cross devices through the server, without automatically injecting history into a model context.
• Selection predicate: Caller-selected conversation IDs and manifest entries; normalized server/device binding; provenance needed for a qualifying restriction receipt.
• Invalidation or expiry: Credential binding changes reject continued import; acknowledgement state is scoped per server/device; an uploaded snapshot without qualifying provenance remains unreconciled.
• Activation or effect: Creates retained history and restriction provenance; upload alone establishes neither query visibility nor permission to share native history.
• Evidence limits: Converter, snapshot verification and downstream server-policy internals were not fully inspected; exact fidelity and end-to-end restriction completeness are unestablished.

Recovery is not a content-improvement pipeline. A nonqualifying receipt can be reported after upload succeeded; automatic semantic review/approval of each recovered utterance is not established. No explicit undo is traced beyond general deletion/withdrawal. The later restrictive consumer is partly traced through recoveryPolicyEvidence and MEM-BAP-history-restriction.

return client.Config{}, errors.New("recovery upload credential device/server changed; restart import with that device") --- cmd/flopwire/import_receipt.go

MEM-RTE-restore-state

Label: Restore durable state

Explicit backup/restore commands preserve Postgres plus referenced compressed chunk objects in a database dump, manifest, object files and state file. This route differs from RT-RTE-shared-upload: it restores server state rather than admitting new transcript messages. The caller selects input/destination; software verifies hashes/inventory and refuses non-empty database/bucket targets. Backup requires encrypted-destination acknowledgement, which is a caller assertion rather than encryption performed here. SRC-1: internal/backup/backup.go, cmd/flopwire/main.go.

• implementation conclusion status: wired
• operation conclusion status: uninspected
• Immediate return: Backup manifest or restore completion/error plus durable operation state.
• Later read-back: Restored database and archive can supply normal server retrieval after external deployment/startup; a backup directory alone is storage, not an automatic model consumer.
• Delegated visibility: inapplicable — this path restores server state and does not create an agent delegation.
• Selection predicate: Coordinated database snapshot and committed-object inventory; tombstoned-only references and deletion-owned objects are excluded; restore verifies the matching inventory.
• Invalidation or expiry: No automatic expiry of independently retained backup copies was established; restore errors can leave partial state, and non-empty-target refusal prevents blind retry over it.
• Activation or effect: Reconstitutes state for later service operation; target deployment and actual subsequent retrieval remain unobserved.
• Evidence limits: The optional pending-redaction override can retain sensitive old archive bytes in the backup; no global deletion or restore-success guarantee follows.

Admission/rejection concerns state integrity, not the truth of conversation content. No model proposes a replacement memory or evaluates a knowledge revision. Backup refuses pending at-rest redaction repair by default; an explicit override weakens that property and leaves repair to restored read masks/work rows. No automatic rollback to a previous database is established.

// AllowPendingRedactionRepair takes the backup even while archived // bytes still wait for a message redaction's at-rest repair. The // backup's objects may then hold redacted text. A restored server // masks it on read and repairs it again from the restored work rows, // but the backup itself keeps it. --- internal/backup/backup.go

Claims

none declared in this member

Evidenced absences

none declared in this member

Behavioral-authority paths

MEM-BAP-history-restriction

Label: Historical provenance restricts sharing

Consumer: daemon placement loading, Cowork refresh and recovery-policy evidence selection. Channel: retained cowork_history, placements and device-bound receipt/source associations. Force: fixed code sets unknown-origin classification, holds sharing on historical-provenance read errors, and selects restrictions rather than inferring folder grants. Horizon: subsequent sweeps and process restarts, even after source disappearance/index-row removal. This is distinct from model interpretation authority in RT-BAP-recovery-guidance and RT-BAP-message-guidance. The route from retained metadata to a code decision is inspected; all remote enforcement/family branches and actual operation remain unobserved. SRC-1: internal/localindex/cowork_history.go, internal/localindex/cowork_recovery.go, internal/agent/cowork.go, internal/agent/placement.go, internal/agent/cowork_sharing.go.

// and an acknowledged device-sync generation must all agree. It never infers // folder grants from an export or qualifies recovered history for sharing. --- internal/localindex/cowork_recovery.go

a.coworkError = "Cowork historical provenance unavailable; Claude sharing held" --- internal/agent/cowork.go

Annotations

On RT-RTE-history-retrieval

Read-back is request-driven: a user/model chooses query/filter/address, code selects lexical candidates or addressed retained rows, and the renderer supplies bounded tool text/JSON. Local FTS/BM25 and server tsvector/pg_trgm are symbolic retrieval operations; no embedding component is required by these inspected routes. Default search/grep keeps active unsuperseded rows and excludes injected-kind material unless kinds are requested; it does not categorically exclude system-kind compaction summaries. Kind and branch/supersession widening changes what history is visible, independently of caller self-exclusion. Read focus defaults to 4000 bytes and permits 24000; neighbors receive a quarter, outline defaults to 200 entries with maximum 2000, and MCP normal rendered output is budgeted at 24000 bytes. These are delivery budgets, not the external model's total context budget. SRC-1: internal/retrieval/local/local.go, internal/retrieval/retrieval.go, internal/retrieval/format/format.go, cmd/flopwire/mcp.go, internal/retrieval/format/render.go.

// MaxOutput is the budget of an MCP answer: about 6-8k tokens, under --- internal/retrieval/format/render.go

Ordinary index reads can recover extracted text after native deletion. Local raw instead verifies source generation/file identity or indexed hashes and fails when original bytes cannot be verified; it does not substitute archived bytes for local-generation ranges. This raw path reads the unchanged native file rather than the local redaction sidecar's masked row. Thus neither successful text read nor index redaction proves raw-byte availability or erasure. SRC-1: internal/retrieval/local/raw.go, cmd/flopwire/redact.go.

// Archive generations are independent of local generations, so a path lookup // cannot safely substitute archived bytes for a local byte range. --- internal/retrieval/local/raw.go

On RT-RTE-hook-delivery

The automatic push selector takes pending retained envelopes for the recipient at an eligible hook, with instruction ordering, message-count and encoded-byte limits. Hook budget constants are 9000 encoded bytes and five messages, with at most five displayed refs and 160-byte excerpts. Surplus messages wait; oversized bodies can be cut, while inbox retains full stored content until expiry. Instruction renewal recovers static policy after host resume/compact/clear; it does not reconstruct discarded conversation or summarize it. Message state and attempt bookkeeping live in SQLite. Server-origin local copies are normally retained an hour past expiry, subject to owed acknowledgements, while local messages remain a week past expiry. SRC-1: internal/busrender/busrender.go, internal/devicebus/instruct.go, internal/devicebus/store.go.

HookBytes = 9000 --- internal/busrender/busrender.go

HookMessages = 5 --- internal/busrender/busrender.go

Transcript-derived read sightings add receipt evidence but are not comprehension or task completion. The path explicitly excludes ordinary tool-result wrapper sightings. SRC-1: internal/agent/reads.go; MEM-OBJ-delivery-metadata.

On RT-RTE-adapter-delivery

Opencode's stored message parts can cross into later model calls; its root mapping and subagent suppression control Flopwire delivery, while host-managed child context and return values remain uninspected. System guidance insertion on each model call is static instruction supply, distinct from stored message read-back. Cloud pushes include separate instruction text and a cut-to-budget payload; no host-wide compaction/eviction policy follows from either adapter. Evidence for adapter details remains the supplied record; the source-native frame/pop metaphor applies only to the external host, not an implemented Flopwire memory stack.

Write side

Routine acquisition is automatic under configured collection policy; native content can come from human prompts, model outputs, tools, injected material or host checkpoints. User authorship of some content is separate from admission of its capture. User/admin rules supply explicit control over collection scope, without per-utterance review. Parser generations, replacement and reparse provide structural curation and recovery. RT-RTE-transcript-index, RT-RTE-policy-admission.

Trace-fed transformation includes deterministic digests, commit projections, captured external summaries, delivery sightings and retained provenance restrictions. These have different results and later consumers: summaries support navigation; provenance points to evidence; receipts affect delivery bookkeeping; historical scope facts restrict sharing. None alone establishes a learned improvement in future capacity. External checkpoint initialization, opaque content and exact summary-admission agency remain unresolved alongside the known subsequent extraction. MEM-RTE-derive-navigation, MEM-RTE-capture-compaction, MEM-OBJ-delivery-metadata, MEM-BAP-history-restriction.

Material editing is explicit redaction, policy editing, deletion, import, restore or product installation; routine captured text is not automatically adopted as standing method. Rejection can occur through structural errors, unknown/deny policy, ownership/credential failure, quarantined parse work or invalid recovery state. Withdrawal has several horizons: index masking, server hiding/restoration, permanent session rejection, asynchronous object purge, and independent backup copies. Treating them as a single memory deletion guarantee would be false. MEM-RTE-redact-content, MEM-RTE-withdraw-history, MEM-RTE-import-recovery, MEM-RTE-restore-state, RT-RTE-binary-upgrade.

The supplied qualification trial retains results for inspection but establishes no automatic admission into a revised production memory or release. No evaluation result was adopted as observation here. This preserves the distinction between evaluator evidence, selected product changes and operative retained content. RT-RTE-workflow-trial.

Read-back

The established consumers are CLI/MCP retrieval and the external models receiving their bounded output; direct hook/adapter recipients; later folds/projection builders and delivery workers; provenance/policy code; and restored server services when deployed. Store methods alone are not counted as consumer routes. The history request chain is user/model query → symbolic selection → clipped evidence/navigation → tool result → external interpretation. Full-message/address reads can close clipping gaps while content remains available. The automatic message chain is retained envelope → eligible recipient event → lease/budget selection → hook/host context insertion → external interpretation. Request-driven thread history has a different, evidence-only authority contract. RT-RTE-history-retrieval, RT-RTE-hook-delivery, RT-RTE-adapter-delivery, MEM-RTE-thread-history.

Working-context control here selects how much material is supplied and leaves reload addresses or inbox routes; it does not own host eviction or global model-window size. Outlines remove assistant answers and tool output from navigation rather than deleting those stored rows. Codex compaction capture can preserve a host-generated summary and novel replacement messages; Flopwire does not choose what the original host removed. Subagent transcripts can be retained and discovered after their frames end, but no Flopwire parent-frame reconstruction follows. Delivery establishes exposure capacity; no supplied trace proves activation, compliance, accurate historical inference or benefit.

Integration issues

1. Scope addition to RT-RTE-history-retrieval: flopwire_messages is a distinct server-directed historical read, beyond ordinary retrieval and current-session inbox. MEM-RTE-thread-history and its content/metadata objects should be connected to the runtime's bus-handler branch. This is added coverage, not a correction of its dispatch claim.
2. Container/part identities: MEM-OBJ-message-text, MEM-OBJ-index-metadata, MEM-OBJ-digest, MEM-OBJ-commit-evidence and MEM-OBJ-cowork-history are declared parts of RT-OBJ-localindex. The digest/provenance records also describe their server counterparts explicitly. MEM-RTE-derive-navigation and MEM-RTE-capture-compaction overlap indexing in progression but have narrower transformations, differing outputs and checks; they do not replace the indexing route. No separate same-referent duplicate was identified.
3. Qualify the local-index “unredacted” description in RT-OBJ-localindex: it describes baseline capture, not an invariant after explicit redaction. MEM-RTE-redact-content establishes masking of stored text, FTS, summaries and commit events. Conversely, local raw retrieval still reads the native file, as described in the history-route annotation. A universal claim that all local evidence is erased by index redaction would be unsupported. SRC-1: internal/localindex/redact.go, internal/retrieval/local/raw.go.
4. The supplied RT-RTE-shared-upload flags recovery receipt logic as uninspected. MEM-RTE-import-recovery adds device/server-bound acknowledgement and restriction-receipt wiring, including successful upload without qualifying provenance. Full converter/snapshot/policy enforcement remains unresolved, so no universal bounded-upload or recovered-sharing guarantee is established.
5. MEM-OBJ-compacted retains the opaque alternative alongside the readable extraction. External compaction policy, deciding model/code, initial summary admission, reasons, exact token budget and host read-back remain uninspected. MEM-RTE-capture-compaction establishes only subsequent Flopwire extraction and requested reuse, not checkpoint completeness or validation of “verified answers.”
6. MEM-RTE-withdraw-history qualifies any reading of policy denial as immediate global deletion. Local purge, server hide/restore, device-specific withholding and permanent deletion differ. MEM-RTE-restore-state additionally preserves the explicit pending-redaction backup override. Full race correctness, independent old-backup erasure and remote family enforcement remain unresolved; these prevent global erasure claims.
7. MEM-BAP-history-restriction establishes a retained metadata consumer separate from model-facing memory. Full Cowork discovery/family reconciliation and external host-grant authenticity remain unaudited; the known restrictive path should not be suppressed because these surrounding mechanisms are unresolved.
8. Check repair: a draft conflated injected rows with all system rows. Direct inspection of SRC-1 internal/localindex/query.go (hitWhere) and internal/retrieval/retrieval.go (hitFilters) restricts the default exclusion to injected-kind rows. The compaction route and retrieval annotation now preserve system-kind summary visibility; this corrects this report, not the supplied runtime.
9. MEM-OBJ-delivery-metadata adds transcript sightings as a receipt update route to RT-RTE-hook-delivery. Receipt source and implementation limits remain distinct from model comprehension. All source-native evaluator outcomes and alternate evaluator/report consumers were not inspected; neither observed successful delivery nor a global absence of evaluation-driven revision is established.

Limitations and checks

All source-dependent conclusions are bounded to SRC-1 at the registered revision. HEAD identity matched the boundary before inspection; the source was treated read-only. The invocation, supplied types, collection, worker rules and both bounded record-contract ranges were read completely before source analysis, as were both runtime ranges. No prior characterization was read, no source ID was added, and no target execution or fresh experiment occurred. A failed attempt to read nonexistent internal/devicebus/read.go returned exit 2; its unseen content supports no claim, and actual inbox/retention code was subsequently read at the paths listed above.

The coverage table names unresolved operative variants and prevents claims of extraction completeness, archive/redaction correctness, deployed retention success, opaque-checkpoint fidelity, total human control or model compliance. Positive wiring findings do not establish observed exercise or causal benefit. No absence record is inferred from an open-ended search miss.

Validation: passed with the required role-scoped commonplace-validate command; this deterministic result checks form, references and quotation occurrence, not semantic correctness or acceptance.