Memory accountability: retract verb (tombstone + supersession)

[lazypower]

Closes #12. Implements the design from the RFC.

Ships

• Migration Security hardening: HTTP, permissions, XSS, error sanitization #8: tombstoned_at, tombstone_reason, superseded_by columns on mem_nodes.
• continuity retract <uri> --reason "..." [--superseded-by <uri>] (CLI) and POST /api/memories/retract (HTTP).
• Read-path filters across search / find / tree / show / context-injection. --include-retracted (or ?include_retracted=true) opts in.
• Absence-not-empty for retracted reasons + content in JSON responses.
• Dedup-against-retracted with two-step URI-only signal (RetractedMatchError); --acknowledge-retracted bypass.
• Operator-facing dedup logs use SHA-256 URI hashes (16 hex), not raw URIs.
• README + CLAUDE.md (project + init template) carry the contract.

Test plan

• go test ./... — full suite green; 22 new test functions across internal/{store,engine,cli}/retract*_test.go, with absence-of-leakage assertions on dedup paths and end-to-end PII scenario.
• go vet ./..., go build ./... — clean.
• Manual: install, run retract, confirm show --include-retracted toggle and dedup gate fires + --acknowledge-retracted bypasses.

Migration

Migration #8 adds nullable columns to existing DBs — no data migration needed. First server restart applies it.

[Copilot]

Pull request overview

Implements “memory accountability” by adding a retract primitive (tombstone + optional supersession link) across the storage layer, engine, HTTP API, and CLI, with default read-path filtering and explicit opt-in to inspect retracted content.

Changes:

• Adds schema migration v8 and store-layer support for retraction fields (tombstoned_at, tombstone_reason, superseded_by) plus read APIs that include/exclude retracted nodes.
• Introduces engine + server support for retraction, including a dedup-against-retracted gate and POST /api/memories/retract.
• Adds CLI verb continuity retract, plus --include-retracted/--acknowledge-retracted flags and supporting documentation/tests.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
internal/store/retract.go	New DB methods for retracting nodes and listing children/leaves including retracted.
internal/store/retract_test.go	Store-layer tests for retraction behavior and filtering.
internal/store/nodes.go	Extends MemNode with retraction fields; updates queries and scan logic to include new columns and filter live nodes by default.
internal/store/migrations.go	Adds migration v8 to extend mem_nodes with retraction columns.
internal/store/db_test.go	Bumps expected schema version to 8.
internal/engine/retract.go	Implements engine-level retract + dedup-against-retracted primitives and error type.
internal/engine/retract_test.go	Adds unit tests for hashing, dedup-against-retracted, URI validation, and override behavior.
internal/engine/engine.go	Adds dedup-against-retracted gate + acknowledge override on Remember.
internal/engine/search.go	Excludes retracted nodes from default Find search scoring.
internal/server/server.go	Registers new POST /api/memories/retract route.
internal/server/routes.go	Implements retract handler; updates show/tree/read responses for retraction contract + include flag; adds remember conflict response for retracted matches.
internal/cli/retract.go	Adds continuity retract command (HTTP-backed).
internal/cli/retract_integration_test.go	Adds end-to-end tests for retract/show behavior and PII loop.
internal/cli/remember.go	Adds --acknowledge-retracted flag and structured handling of retracted-match conflicts.
internal/cli/show.go	Adds --include-retracted and preserves “absence-not-empty” contract in JSON output.
internal/cli/stubs.go	Adds tree --include-retracted and marks retracted nodes in output.
internal/cli/root.go	Registers the new retract command.
internal/cli/init.go	Updates onboarding text to mention retract/accountability.
README.md	Documents retract semantics and API parameters/routes.
CLAUDE.md	Adds retract/accountability guidance for agent usage.

Comments suppressed due to low confidence (1)

internal/server/routes.go:637

• When listing children, directories compute Children via CountChildren, which includes retracted nodes even when include_retracted is false. This makes the returned tree inconsistent with the filtering applied to the listing. Use a live-only count when include_retracted is false (or add a CountChildrenIncludingRetracted variant and pick based on the flag).

			if c.NodeType == "dir" {
				count, _ := s.db.CountChildren(c.URI)
				tn.Children = count

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[lazypower]

Pulled on this carefully — I think this is a false positive specific to the var x inside the loop body (vs. the classic for i := range loop-variable pattern fixed in Go 1.22).

Each iteration's var lastAccess, tombstonedAt sql.NullInt64 declaration creates a fresh variable. Taking &lastAccess.Int64 causes the compiler's escape analysis to allocate it on the heap independently per iteration; the pointers in successive nodes are distinct heap addresses, not aliases.

Verified with a focused regression test (TestScanNodes_NoPointerAliasing in 68c30e3). It seeds three retracted nodes, reads them via FindByCategoryIncludingRetracted (which uses scanNodes), and asserts every TombstonedAt pointer is a distinct address — passing test confirms each iteration gets its own allocation. Test would fail loudly if the aliasing this comment describes were happening.

If you want me to refactor anyway (e.g., v := lastAccess.Int64; n.LastAccess = &v for stylistic clarity even though the existing form is correct), happy to — but flagging that the bug as described isn't present.