ocbrain v0.3.3

ocbrain v0.3.3

This patch is a live-data and watchdog durability release. It fixes defects
found by auditing the production scheduler, 1.9 GB SQLite ledger, append-only
event chain, FTS index, dataset factory, and stall pager together.

The tripwire scanner previously kept only an updated_at watermark while
ordering by (updated_at, id). A batch boundary could therefore skip remaining
rows that shared the last timestamp. It now persists the complete composite
cursor and advances only after a row's predicates finish. The hard-correction
predicate also stopped deserializing the full event log once per knowledge row;
an indexed JSON target lookup preserves the same decision. A live clean
1,000-row page fell from 301.2534 seconds to 0.0351 seconds, and the historical
backlog was drained to the current eligible head.

New FTS parents now insert directly instead of first scanning the unindexed
FTS doc_id column for a row that cannot exist. Existing parents still delete
and replace their exact index row. The live repair removed 5,202 parentless
legacy index rows and left zero FTS orphans.

The stall ledger now distinguishes delivery from deliberate retirement. Four
old findings that were outside the steady-state paging window had remained
new for 300 aggregate sightings; they are now durably retired once. Failed
delivery remains eligible for retry. Autopilot maintenance independently reads
stallcheck's self-heartbeat, unchanged deadman states emit one evidence record,
and malformed deadlines emit an explicit tripwire instead of disappearing.
Autopilot now commits a visible running row and profile deadman before its
first stage, checkpoints both after every stage, and clears the deadline only
at finalization. Stallcheck reads that deadline, making the two scheduled
processes independent witnesses of one another. Dry-run inspection opens the
brain read-only and reports those producer deadmen without writing.

The release build also found that Hatch's default source archive could sweep an
untracked local logs/ directory into the tarball even though git would not
publish it. The build configuration now excludes runtime data, logs, caches,
build output, and the untracked lock file explicitly. The rebuilt source and
wheel inventories contain none of those paths.

Five legacy retrieval-use rows carried old candidate/event ids in a canonical
knowledge foreign-key column. The migration now retains those ids in
task_ref, clears the invalid optional FK, and preserves every retrieval row.
The live database now has zero foreign-key violations. Its valid 306,974-event
hash chain reproduced the 101,641-row belief projection byte-for-byte, allowing
the missing incremental cursor to be repaired at the verified head without a
long writer transaction.

No corpus text, runtime path, credential, identity id, human label, prompt,
reference, rating, database, local config, model weight, or adapter is part of
this release.

Verification

• 494 source tests and Ruff
• changed-file formatting and compileall
• wheel/sdist metadata and tracked-tree public-safety checks
• live SQLite quick_check=ok, event-chain verification, zero FK violations,
  zero FTS orphans, and projection cursor at the event head
• two consecutive live stall passes (retired=4, then new=0)
• independent liveness pass followed by an idempotent zero-change pass
• post-restore launchd light cycle completed ok