Антон:

You are an INDEPENDENT senior code reviewer from a DIFFERENT vendor than the author.

The author (Codex) wrote the change below. Review it on its own merits. Do NOT use any tools

or read other files; review ONLY the diff provided. Be concrete and skeptical.

CRITICAL OUTPUT CONTRACT: the VERY LAST line of your reply must be exactly

===VERDICT===

where is one bare word: APPROVE (no blocking issues) or

REQUEST_CHANGES (one or more MED/HIGH issues). No backticks, no bold, no

brackets, nothing else on that line. State it exactly once, on that final

line only – do not repeat the marker anywhere else in your reply.

Write your review first, then the contract line last.

What Codex was asked to do (context)

Acceptance contract: shared cursor/_freshness.json and grok/_freshness.json are forbidden as evidence because machines overwrote one another. Only per-machine freshness is valid. Repository-wide rg found zero direct consumers and tests require legacy paths absent. Live C:/Users/dev/.claude/fleet_nodes.json was inspected in this turn: it is {“_meta”:…,”nodes”:{…}}; code additionally supports the prior flat mapping. Unknown explicit MACHINE_KEY must fail closed to prevent minting a cross-node lane. Legacy human-owned Cursor notes remain RED until the explicit adopt-legacy command is invoked after review; the test proves only that named pending hash is adopted and then clears.

Check, in priority order:

  1. CORRECTNESS bugs (logic errors, off-by-one, wrong conditions, unhandled cases, races).

  2. SECURITY (injection, secrets in code, unsafe input, path/permission issues).

  3. BREAKAGE (does it break callers, contracts, or existing behavior?).

  4. SIMPLIFICATION / dead code (is there a simpler, equally-correct form? AK-47).

Rules:

Format:

SUMMARY:

FINDINGS:

(repeat; write “none” if no findings)

Then the contract line from the output contract above, last.

— DIFF START —

diff –git a/_paths.py b/_paths.py

index 7f910a70..c0eb18c3 100644

— a/_paths.py

+++ b/_paths.py

@@ -23,7 +23,11 @@ on a Mac/other-user box.

починку и вводила в заблуждение при планировании раскатки ([[prose-about-code-outlives-the-fix]]).

One-time import scripts are FROZEN historical artifacts (won’t run cross-OS) -> not refactored.

”””

+import json

import os

+import re

+import socket

+import sys

def _home():

@@ -82,6 +86,72 @@ PYTHON_EXE = get(“PYTHON_EXE”, “python”)

SECRETS = get(“SECRETS_DIR”, os.path.join(_home(), “!CLAUDE-NODE-0X May26”, “secrets”))

+def _validated_machine_name(value):

+

+

+def canonical_machine(value, strict=True):

+

+

+def machine_key():

+

+

# — ORIGINALS: hub CANON vs peer DELIVERY WINDOW (root fix 2026-07-28) —————

# D:\Vault_originals (== dirname(VAULT)/_originals) is HUB-LOCAL and is NOT a Syncthing

# share on ANY machine – verified live on the hub 2026-07-28 (10 folders, none of them

diff –git a/codex/_test_external_agent_import_filter.py b/codex/_test_external_agent_import_filter.py

index aa66001d..c7df686e 100644

— a/codex/_test_external_agent_import_filter.py

+++ b/codex/_test_external_agent_import_filter.py

@@ -1,5 +1,5 @@

# -- coding: utf-8 --

-“"”Regression: Claude sessions imported by Codex Harness never enter the Codex lane.”””

+”"”Regression: every thread ID recorded by Harness as external stays out of the Codex lane.”””

import importlib.util

import json

import sqlite3

@@ -26,16 +26,23 @@ def rollout(path, sid, prompt):

 path.write_text("\n".join(json.dumps(x) for x in rows), encoding="utf-8")

-def registry(path, imported_sid):

+def registry(path, records):

def run():

 genuine = "01aa0000-0000-7000-8000-000000000001"

 imported = "01aa0000-0000-7000-8000-000000000002"

@@ -44,7 +51,9 @@ def run():

     rollout(sessions / "2026/09/22/rollout-genuine.jsonl", genuine, "genuine Codex")

     rollout(sessions / "2026/09/22/rollout-imported.jsonl", imported, "from Claude")

     rollout(sessions / "2026/09/22/rollout-imported-resume.jsonl", imported, "from Claude resumed")

@@ -70,7 +79,7 @@ def run():

         assert len(notes) == 1 and f"session_id: {genuine}" in notes[0].read_text(encoding="utf-8")

         fresh = json.loads(codex_lib.freshness_path("TestNode").read_text(encoding="utf-8"))

         assert fresh["unique_sessions_on_disk"] == 1

@@ -132,7 +141,7 @@ def run():

             raise AssertionError("malformed external import registry did not fail closed")

 

         # Harness drift back to ON is a visible non-zero health result.

@@ -150,4 +159,4 @@ def run():

if name == “main”:

 run()

diff –git a/codex/codex_lib.py b/codex/codex_lib.py

index 27c65581..bf3cac34 100644

— a/codex/codex_lib.py

+++ b/codex/codex_lib.py

@@ -198,7 +198,7 @@ def external_import_ids(codex_root):

def harness_session_import_enabled(config_path):

@@ -778,7 +778,7 @@ def do_import(sessions_dir=None):

     harness_import_enabled=harness_enabled, unimported_sessions=unimported)

 print(f"codex import [{machine} / {account or 'unknown'}]: файлов {len(files)}, "

       f"без session_meta пропущено {skipped}")

diff –git a/cursor/_test_cursor.py b/cursor/_test_cursor.py

new file mode 100644

index 00000000..a9ad8d2a

— /dev/null

+++ b/cursor/_test_cursor.py

@@ -0,0 +1,269 @@

+# -- coding: utf-8 --

+”"”Isolated regression for Cursor provenance: two machines, same id, no clobber.”””

+import json

+import os

+import shutil

+import sqlite3

+import tempfile

+from pathlib import Path

+

+import cursor_lib as C

+REAL_MACHINE_NAME = C.machine_name

+

+

+TMP = Path(tempfile.mkdtemp(prefix=”cursor-provenance-“))

+FAILS = []

+

+

+def check(name, condition):

+

+

+def fixture(root, sid, question=”проверь синк”, answer=”Смотрю.”, with_timestamp=True,

+

+

+try:

+

+

+

+

+

+

+

+

+

+

+

+except Exception as exc:

+finally:

+

+if FAILS:

+print(“PASS: Cursor producer lanes and provenance”)

diff –git a/cursor/cursor_lib.py b/cursor/cursor_lib.py

index 3a3579fb..74f3ef05 100644

— a/cursor/cursor_lib.py

+++ b/cursor/cursor_lib.py

@@ -16,8 +16,8 @@ session_meta нет; id сессии = имя папки, дата = тег <tim

ЧТО РОЖДАЕТСЯ (те же 4 шага, что у всех трубн волта, §8.3):

 1. оригинал verbatim -> _originals/cursor-sessions/<МАШИНА>/ (идемпотентно);

 2. заметка -> 01-Conversations/Cursor/<МАШИНА>/<дата>-<slug>-<id12>.md;

Индексы подхватывают сами: brain_evidence ночью (сырьё), brain_sessions_index

(Книга чатов, корень добавлен 22.09), distill_queue (SESSION_SOURCES).

@@ -25,8 +25,9 @@ USAGE

 python cursor_lib.py import        # инкрементальная выгрузка (идемпотентно)

 python cursor_lib.py stats        # что в базе

 python cursor_lib.py selftest     # на синтетическом транскрипте, волт не трогает

”””

-import os, re, sys, json, glob, sqlite3, shutil, datetime

+import os, re, sys, json, glob, sqlite3, shutil, datetime, hashlib, socket

from pathlib import Path

try:

@@ -37,35 +38,83 @@ except Exception:

_HERE = Path(file).resolve().parent

sys.path.insert(0, str(_HERE.parent))

+sys.path.insert(0, str(Path.home() / ‘.claude’ / ‘scripts’ / ‘_shared’))

try:

except Exception:

+try:

+except Exception:

+try:

+except Exception:

CURSOR_ROOT = Path(os.path.expanduser(‘~/.cursor/projects’))

DB = _HERE / ‘cursor_sessions.db’

-FRESHNESS = _HERE / ‘_freshness.json’

+DB_ROOT = _HERE / ‘_db’

+FRESHNESS_ROOT = _HERE / ‘_freshness’

+FRESHNESS = _HERE / ‘_freshness.json’ # deprecated sentinel path; must stay absent

def machine_name():

+

+

+def db_path(machine):

+

+

+def freshness_path(machine):

+

+

+def _same_file(src, dst):

def _clean(s):

 return re.sub(r'\s+', ' ', (s or '')).strip()

+def _meta_scalar(s, fallback):

+

+

def _slug(s):

 s = (s or 'cursor').lower()

 cyr = 'абвгдеёжзийклмнопрстуфхцчшщъыьэюя'

@@ -91,10 +140,10 @@ def _date_of(ts_text, path):

def parse_transcript(path):

@@ -130,88 +179,338 @@ def parse_transcript(path):

     return None

 if not turns:

     return None

def note_text(r, machine):

 return ('---\n'

         'title: "%s"\n'

         'type: ai-conversation\nstage: raw\nsource: cursor\n'

-

-

-def do_import(root=None):

+

+

+def _connect(db=None):

+

+

+def _frontmatter(path):

+

+

+def _machine_owned_note(path):

+

+

+def _note_session_id(path):

+

+

+def _note_source_hash(path):

+

+

+def _note_date(path):

+

+

+def _collision_safe_note(preferred, session_id):

+

+

+def _production_db(machine):

+

+

+def do_import(root=None, *, db=None):

 src = Path(root) if root else CURSOR_ROOT

 machine = machine_name()

 if not src.is_dir():

     print('cursor: НЕТ каталога %s -- Cursor на этой машине не ставился (узлу нечего отдавать)' % src)

     return 0

 files = sorted(glob.glob(str(src / '*' / 'agent-transcripts' / '*' / '*.jsonl')))

 for f in files:

     r = parse_transcript(f)

     if r is None:

         continue

         unch += 1

         continue

     note.write_text(note_text(r, machine), encoding='utf-8')

 con.commit()

 return 0

def stats():

+def adopt_legacy(session_id, *, db=None):

+

+

def selftest():

 """Синтетический транскрипт -> parse -> заметка; волт НЕ трогаем."""

 import tempfile

@@ -247,14 +546,14 @@ def selftest():

 return 0 if ok else 1

-KNOWN = (‘import’, ‘stats’, ‘selftest’, ‘–help’, ‘-h’)

+KNOWN = (‘import’, ‘stats’, ‘selftest’, ‘adopt-legacy’, ‘–help’, ‘-h’)

def main():

 if '--help' in sys.argv or '-h' in sys.argv:

     print(__doc__)

     sys.exit(0)

@@ -265,6 +564,11 @@ def main():

     return stats()

 if cmd == 'selftest':

     return selftest()

 print(__doc__)

 return 2

diff –git a/grok/_test_grok.py b/grok/_test_grok.py

index 89350f65..c7d1af5c 100644

— a/grok/_test_grok.py

+++ b/grok/_test_grok.py

@@ -16,11 +16,66 @@ from pathlib import Path

TMP = Path(tempfile.mkdtemp(prefix=”groktest”))

os.environ[“CLAUDE_VAULT_ROOT”] = str(_TMP / “vault”)

+os.environ[“OBSIDIAN_VAULT”] = str(_TMP / “vault”)

sys.path.insert(0, str(Path(file).resolve().parent))

import grok_lib as G

+REAL_MACHINE_NAME = G.machine_name

+IMPORTED_VAULT = G.VAULT

G.DB = _TMP / “test.db”

+G.VAULT = _TMP / “vault”

+G.ORIGINALS_ROOT = _TMP / “originals”

G.NOTES_DIR = Path(os.environ[“CLAUDE_VAULT_ROOT”]) / “01-Conversations” / “Grok” / “conversations”

-G.FRESHNESS = _TMP / “_freshness.json”

+G.FRESHNESS_ROOT = _TMP / “freshness”

+G.FRESHNESS = _TMP / “legacy-freshness.json”

+G.MOC = G.VAULT / “01-Conversations” / “Grok” / “_Grok-MOC.md”

+G.machine_name = lambda: “TestNode”

+

+fixture_home = _TMP / “home”

+(fixture_home / “.claude”).mkdir(parents=True)

+(fixture_home / “.claude” / “fleet_nodes.json”).write_text(json.dumps({“nodes”: {

+}}), encoding=”utf-8”)

+real_paths_home = G._paths._home

+G._paths._home = lambda: str(fixture_home)

+

+old_machine_env = os.environ.get(“MACHINE_KEY”)

+try:

+finally:

# prod-grok-backend.json shape: conversation (ISO times) + responses[] (BSON/ISO times)

FIXTURE = [

@@ -48,6 +103,14 @@ def check(name, cond):

 print(("  ok " if cond else "FAIL ") + name)

 if not cond: fails.append(name)

+check(“machine resolver canonicalizes case”, check_resolver_case)

+check(“machine resolver rejects traversal”, check_resolver_unsafe)

+check(“FQDN hostname resolves to registry key”, check_resolver_fqdn)

+check(“ambiguous short hostname cannot adopt another node identity”, check_resolver_collision)

+check(“flat legacy fleet registry shape is accepted”, check_resolver_flat)

+check(“explicit unknown machine identity fails closed”, check_resolver_unknown_strict)

+check(“environment overrides menv vault”, IMPORTED_VAULT == _TMP / “vault”)

+

# 1) parse

rows = G.normalize_grok(FIXTURE)

check(“parse 2 conversations”, len(rows) == 2)

@@ -92,6 +155,137 @@ check(“conversation with no id -> skipped”, G.normalize_grok([{“conversation”: {

newest, total, stale = G.write_freshness(con)

check(“freshness newest day”, newest == “2026-07-02”)

check(“freshness total 2”, total == 2)

+check(“web freshness is producer-scoped”, G.freshness_path(“web”, “TestNode”).exists())

+check(“legacy shared Grok freshness stays absent”, not G.FRESHNESS.exists())

+

+# 7) local Grok CLI: injected system/rules/reminders are excluded; same id on two nodes is separate.

+cli_root = _TMP / “grok-sessions”

+session = cli_root / “E%3A%5Cwork” / “same-cli-id”

+session.mkdir(parents=True)

+chat = session / “chat_history.jsonl”

+

+

+def write_cli(answer):

+

+

+write_cli(“Проверил.”)

+node_a = G._paths.canonical_machine(“HUB-01”)

+node_b = G._paths.canonical_machine(“FLEET-ANCHOR”)

+cli_db_a, cli_db_b = _TMP / “grok-node-a.db”, _TMP / “grok-node-b.db”

+G.machine_name = lambda: node_a

+check(“CLI Node-A import”, G.import_cli(cli_root, db=cli_db_a) == 0)

+G.machine_name = lambda: node_b

+check(“CLI Node-B import”, G.import_cli(cli_root, db=cli_db_b) == 0)

+cli_a, cli_b = sqlite3.connect(cli_db_a), sqlite3.connect(cli_db_b)

+check(“same Grok id stays in two producer DB shards”,

+G.machine_name = lambda: G._paths.canonical_machine(“HUB-01”)

+G.import_cli(cli_root, db=cli_db_a)

+check(“Grok machine-name case drift stays in one DB and one path lane”,

+G.machine_name = lambda: node_b

+note_a = next((G.VAULT / “01-Conversations” / “Grok” / “CLI” / node_a).glob(“*.md”))

+note_a.unlink()

+G.machine_name = lambda: node_a

+G.import_cli(cli_root, db=cli_db_a)

+check(“missing Grok note self-heals from unchanged source”, note_a.exists())

+lost_db = _TMP / “grok-lost-db.db”

+import os as _os, time as _time

+_os.utime(chat, (_time.time() + 259200, _time.time() + 259200))

+G.import_cli(cli_root, db=lost_db)

+check(“Grok DB loss recovers durable note date”,

+G.machine_name = lambda: node_b

+body_a = note_a.read_text(encoding=”utf-8”)

+check(“Grok CLI note excludes injected context”, “system prompt must stay out” not in body_a

+check(“Grok CLI provenance is honest”, “source: grok-cli” in body_a

+fresh_a = json.loads(G.freshness_path(“cli”, node_a).read_text(encoding=”utf-8”))

+fresh_b = json.loads(G.freshness_path(“cli”, node_b).read_text(encoding=”utf-8”))

+check(“Grok CLI freshness is per machine”, fresh_a[“mismatch”] == 0

+check(“legacy shared Grok freshness remains absent after CLI import”, not G.FRESHNESS.exists())

+check(“known injected wrapper chain drops are visible”, fresh_a[“dropped_injected_user_turns”] == 3)

+

+metadata_session = cli_root / “project%0Aaccount%3A%20anton” / “metadata-session”

+metadata_session.mkdir(parents=True)

+metadata_chat = metadata_session / “chat_history.jsonl”

+metadata_chat.write_text(“\n”.join(json.dumps(x, ensure_ascii=False) for x in [

+parsed_metadata = G.parse_cli_session(metadata_chat)

+check(“Grok metadata cannot inject YAML frontmatter”,

+try:

+except ValueError:

+else:

+check(“unsafe Grok machine key fails closed”, unsafe_rejected)

+for unsafe in (“.”, “..”):

+

+write_cli(“Изменённый ответ той же длины сообщений.”)

+_os.utime(chat, (_time.time() + 172800, _time.time() + 172800))

+G.import_cli(cli_root, db=cli_db_b)

+note_b = next((G.VAULT / “01-Conversations” / “Grok” / “CLI” / node_b).glob(“*.md”))

+check(“same-count Grok content change is detected”,

+check(“later file mtime does not fork one session into two notes”,

+stale = note_b.with_name(“stale-duplicate-“ + note_b.name)

+import shutil as _shutil

+_shutil.copy2(note_b, stale)

+G.import_cli(cli_root, db=cli_db_b)

+fresh_b = json.loads(G.freshness_path(“cli”, node_b).read_text(encoding=”utf-8”))

+check(“stale raw duplicate moves to reversible quarantine”,

+

+saved_import_cli, saved_argv = G.import_cli, list(sys.argv)

+try:

+finally:

+

+G._paths._home = real_paths_home

+_shutil.rmtree(_TMP, ignore_errors=True)

print()

if fails:

diff –git a/grok/grok_export.cmd b/grok/grok_export.cmd

new file mode 100644

index 00000000..b0f89b72

— /dev/null

+++ b/grok/grok_export.cmd

@@ -0,0 +1,31 @@

+@echo off

+REM Nightly local Grok CLI session export. Each machine owns its note/original/freshness lane.

+setlocal

+set “PY=”

+if not exist “%USERPROFILE%.claude\machine.env” (

+)

+for /f “usebackq delims=” %%P in (powershell.exe -NoProfile -Command "$line = Get-Content -LiteralPath ($env:USERPROFILE + '\.claude\machine.env') | Where-Object { $_ -match '^\s*PYTHON_EXE\s*=' } | Select-Object -First 1; if ($line) { (($line -split '=', 2)[1]).Trim().Trim([char]34) }") do set “PY=%%P”

+if not defined PY (

+)

+if not exist “%PY%” (

+)

+if not exist “%~dp0grok_lib.py” (

+)

+set “LOGDIR=%LOCALAPPDATA%\claude-grok-export”

+if not exist “%LOGDIR%” mkdir “%LOGDIR%”

+echo [%DATE% %TIME%] START » “%LOGDIR%\export.log”

+”%PY%” “%~dp0grok_lib.py” cli-import » “%LOGDIR%\export.log” 2>&1

+set “RC=%ERRORLEVEL%”

+echo [%DATE% %TIME%] EXIT=%RC% » “%LOGDIR%\export.log”

+exit /b %RC%

diff –git a/grok/grok_lib.py b/grok/grok_lib.py

index 1eff4dee..fe9abc69 100644

— a/grok/grok_lib.py

+++ b/grok/grok_lib.py

@@ -24,11 +24,18 @@ EXPORT SHAPE (prod-grok-backend.json = array of wrappers):

                   message, create_time (ISO or BSON {"$date":{"$numberLong":"ms"}}),

                   model, thinking_trace, ...} } ] }

+LOCAL GROK CLI (same-vault contract, 2026-09-23):

+

USAGE:

python grok_lib.py import # -> DB + notes

”””

-import os, re, sys, json, sqlite3, hashlib, datetime

+import os, re, sys, json, sqlite3, hashlib, datetime, glob, shutil, socket, urllib.parse

from pathlib import Path

# encoding guard (cp1252 print-crash class)

@@ -39,13 +46,37 @@ except Exception:

HERE = Path(os.path.dirname(os.path.abspath(file)))

DB = HERE / “grok_conversations.db”

+CLI_DB_ROOT = HERE / “_db” / “cli”

-VAULT = Path(os.environ.get(“CLAUDE_VAULT_ROOT”)

+sys.path.insert(0, str(HERE.parent))

+sys.path.insert(0, str(Path.home() / “.claude” / “scripts” / “_shared”))

+try:

+except Exception:

+try:

+except Exception:

+try:

+except Exception:

NOTES_DIR = VAULT / “01-Conversations” / “Grok” / “conversations”

MOC = VAULT / “01-Conversations” / “Grok” / “_Grok-MOC.md”

-FRESHNESS = HERE / “_freshness.json”

+FRESHNESS_ROOT = HERE / “_freshness”

+FRESHNESS = HERE / “_freshness.json” # deprecated sentinel path; must stay absent

+GROK_CLI_ROOT = Path(os.path.expanduser(“~/.grok/sessions”))

SCHEMA = “””

CREATE TABLE IF NOT EXISTS conversations(

@@ -71,6 +102,36 @@ def _clean(s):

 return s.replace("\xa0", " ").strip()

+def _meta_scalar(s, fallback):

+

+

+def machine_name():

+

+

+def cli_db_path(machine):

+

+

+def freshness_path(kind, machine):

+

+

def _parse_time(v):

 """Grok mixes ISO strings and BSON {"$date":{"$numberLong":"ms"}} (and plain ms int).

 Returns (iso_string, day, month) best-effort; ('', '', '') if unparseable."""

@@ -126,7 +187,7 @@ def normalize_grok(wrappers):

     cid = _clean(conv.get("id") or conv.get("_id") or conv.get("conversation_id"))

     if not cid:

         continue

@@ -261,13 +322,371 @@ def write_freshness(con):

         stale_days = (datetime.date.today() - datetime.date.fromisoformat(newest)).days

     except ValueError:

         pass

 }, ensure_ascii=False, indent=2), encoding="utf-8")

+# —————————————————————— local CLI sessions

+

+_USER_QUERY = re.compile(r”\s*(.*?)\s*”, re.S re.I)

+_INJECTED_PREFIX = re.compile(

+

+

+def _content_text(content):

+

+

+def parse_cli_session(path):

+

+

+def _cli_connect(db=None):

+

+

+def _cli_note_path(row):

+

+

+def _cli_note_text(row):

+

+

+def _frontmatter(path):

+

+

+def _machine_owned_cli_note(path):

+

+

+def _note_meta(path):

+

+

+def _collision_safe_cli_note(preferred, session_id):

+

+

+def _existing_cli_meta(machine):

+

+

+def _same_file(src, dst):

+

+

+def _quarantine_stale_cli_notes(con, machine):

+

+

+def import_cli(root=None, *, db=None):

+

+

# —————————————————————— cli

def _load_json(path):

@@ -282,7 +701,8 @@ def do_import(path):

 w = build_notes(con)

 newest, total, stale = write_freshness(con)

 print(f"grok import: +{new} new / {upd} updated / {unch} unchanged | notes: {w} written "

 return new, upd

@@ -291,6 +711,14 @@ def do_stats():

 total = con.execute("SELECT COUNT(*) FROM conversations").fetchone()[0]

 turns = con.execute("SELECT COALESCE(SUM(n_turns),0) FROM conversations").fetchone()[0]

 print(f"grok DB: {total} conversations, {turns} turns | {DB}")

def main():

@@ -301,11 +729,14 @@ def main():

     if len(sys.argv) < 3:

         print("usage: grok_lib.py import <prod-grok-backend.json>"); sys.exit(2)

     do_import(sys.argv[2])

 elif cmd == "stats":

 else:

if name == “main”:

— DIFF END —

Claude:

[⏰ среда, утро, 10:25, 23 сентября 2026]

SUMMARY: The root fix is sound in shape — per-producer DB shards, per-machine freshness, content hashes, human-owned-note protection, fail-closed legacy migration — and the migration/rollback logic is genuinely careful. But the new metadata path emits double-quoted YAML without escaping backslashes, and the Grok CLI project field is literally a URL-decoded Windows path (E%3A%5Cwork → E:\work), so on Windows every new grok-cli note ships unparseable frontmatter; plus the identity resolver has an ambiguity hole that re-creates the exact shared-lane clobber this change exists to kill.

FINDINGS:

What’s good and I deliberately did not flag: the BEGIN IMMEDIATE + row-count-equality + rollback migration (fails closed on case collisions without losing rows), _frontmatter refusing to read body markers as metadata (your “Четвёртая версия” test earns its keep), the COALESCE(NULLIF(pending_hash,''),content_hash) staleness model, and grok_export.cmd’s if errorlevel 1 inside the block — that one is correct batch, unlike %ERRORLEVEL% would be.

===VERDICT=== REQUEST_CHANGES