Eilodon
diff --git a/‎CHANGELOG.md‎
Lines changed: 1 addition & 1 deletion b/‎CHANGELOG.md‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎KNOWN_LIMITATIONS.md‎
Lines changed: 0 additions & 28 deletions b/‎KNOWN_LIMITATIONS.md‎
Lines changed: 0 additions & 28 deletions
diff --git a/‎crates/calm-cli/src/bin/txn_crash_harness.rs‎
Lines changed: 14 additions & 4 deletions b/‎crates/calm-cli/src/bin/txn_crash_harness.rs‎
Lines changed: 14 additions & 4 deletions
diff --git a/‎crates/calm-cli/tests/txn_crash_injection.rs‎
Lines changed: 14 additions & 3 deletions b/‎crates/calm-cli/tests/txn_crash_injection.rs‎
Lines changed: 14 additions & 3 deletions
diff --git a/‎crates/calm-server/src/lib.rs‎
Lines changed: 11 additions & 0 deletions b/‎crates/calm-server/src/lib.rs‎
Lines changed: 11 additions & 0 deletions
@@ -27,7 +27,7 @@ git tags in [Releases](https://github.com/Eilodon/CALM/releases).
 - `calm connect --preset` now takes effect even when attaching to an already-live daemon, not just when this connection is the one that spawns it: a one-line handshake preamble ahead of the raw MCP byte stream lets each connection narrow its own effective tool ceiling (`CalmServer::narrow_connection_preset`), reusing the same `resolve_preset`/`current_visible_tool_names` machinery `set_toolset` already enforces -- a too-wide request is a no-op, never a privilege escalation, since the daemon's own `tool_router` (built once at spawn time) stays the hard ceiling
 - New `batch_status` tool: takes a caller-supplied list of `tx_id`s (the ones a set of `edit_lines`/`edit_symbol`/`format_files` calls already returned) and reports one aggregate view -- counts by state, which are missing, whether any failed -- instead of requiring a separate `edit_transaction_status` call per file for a multi-file change. Observability only: doesn't group transactions server-side or change what those write tools do (see `KNOWN_LIMITATIONS.md` "No multi-file change-set / transaction")
 - New `calm guard` CLI command: runs the exact `diff_impact` tool an MCP agent's own Stage-7 pre-commit gate uses against the staged diff (`git diff --cached`) and exits non-zero when `aggregate_risk` is at or above `--fail-on` (default `high`) -- a first Git/CI-native integration point for changes made outside any MCP session (a teammate's native editor, a bot PR), usable directly as a pre-commit hook or CI step
-- Storage-layer foundation for splitting durable state out of the rebuildable index (`KNOWN_LIMITATIONS.md` "Durable state and the rebuildable index share one SQLite file at runtime"): `db::schema::STATE_SCHEMA_SQL`/`init_state_db` define `project_memory`, `project_memory_refs`, `edit_transactions`, `tx_events`, `maintenance_jobs`, and `audit_ledger` as a schema separate from the rebuildable index's `SCHEMA_SQL`/`init_db`; `db::conn::open_state_writer` opens a `PRAGMA synchronous=FULL` connection for it; `db::schema::migrate_legacy_durable_tables` does a one-time, idempotent, copy-only migration of a pre-split `index.db`'s durable rows into a `state.db`. Not yet wired into any real `calm-server` call site -- see `KNOWN_LIMITATIONS.md` for what's left
+- Durable state (`project_memory`, `project_memory_refs`, `edit_transactions`, `tx_events`, `maintenance_jobs`, `audit_ledger`) now lives in a separate `state.db` (`PRAGMA synchronous=FULL`, `db::conn::open_state_writer`) instead of sharing the rebuildable index's `index.db` (`synchronous=NORMAL`) -- every real call site (`remember`/`recall`, `edit_transaction_status`/`batch_status`/`maintenance_status`/`retry_maintenance`/`repair_consistency`/`verify_change`, the shadow-tx paths inside `edit_lines`/`edit_symbol`/`format_files`, and the OS-level crash-injection harness) now reads and writes through it; `db::schema::migrate_legacy_durable_tables` copies any pre-split `index.db`'s durable rows into `state.db` once, idempotently, on first startup after upgrading. Closes `KNOWN_LIMITATIONS.md` "Durable state and the rebuildable index share one SQLite file at runtime"
 
 ## [0.5.0] - 2026-08-03
 
 
@@ -29,34 +29,6 @@ allowlist, resource limits) applied uniformly first — bolting each new
 language's runner directly onto today's bare `Command::new(...)` would
 just multiply the unsandboxed surface instead of closing it. Not started.
 
-## Durable state and the rebuildable index share one SQLite file at runtime
-
-`.calm/index.db` holds the symbol/call-graph index (rebuildable from
-source, `PRAGMA synchronous=NORMAL` is a deliberate tradeoff for it) *and*
-the edit-transaction journal, audit ledger, and project-memory notes
-(none of which are rebuildable). All of it currently shares that same
-`synchronous=NORMAL` posture and the same physical file. A hard
-power-loss can only lose the last few committed rows under WAL+NORMAL,
-never corrupt the file — an acceptable cost for a cache, less obviously
-so for a journal used as evidence.
-
-The storage-layer foundation for a split now exists in `calm-core`:
-`db::schema::STATE_SCHEMA_SQL`/`init_state_db` define the durable tables
-(`project_memory`, `project_memory_refs`, `edit_transactions`, `tx_events`,
-`maintenance_jobs`, `audit_ledger`) as a schema separate from the
-rebuildable `SCHEMA_SQL`/`init_db`; `db::conn::open_state_writer` opens a
-connection at `PRAGMA synchronous=FULL`; and
-`db::schema::migrate_legacy_durable_tables` does a one-time, idempotent,
-copy-only migration of any pre-split `index.db`'s durable rows into a
-`state.db`. All of this is unit-tested but **not yet wired up** — every
-real call site in `calm-server` (`edit.rs`, `txn.rs`, `memory.rs`,
-`common.rs`, `lib.rs`, and others) still opens and writes through the one
-shared `index.db`/`open_writer` connection. Rewiring those call sites to
-actually use `state.db` for durable writes is a separate follow-up, scoped
-by `open_writer`'s own blast radius (~320 transitively-affected files per
-`diff_impact`) rather than attempted alongside the schema/migration
-groundwork.
-
 ## No multi-file change-set / transaction
 
 Every `edit_lines`/`edit_symbol`/`format_files` call gets its own,
 
@@ -26,6 +26,7 @@ use std::path::PathBuf;
 
 fn main() {
     let mut db_path: Option<PathBuf> = None;
+    let mut state_db_path: Option<PathBuf> = None;
     let mut file_path: Option<PathBuf> = None;
     let mut crash_after: Option<String> = None;
     let mut new_content = String::from("new content\n");
@@ -34,6 +35,7 @@ fn main() {
     while let Some(arg) = args.next() {
         match arg.as_str() {
             "--db" => db_path = args.next().map(PathBuf::from),
+            "--state-db" => state_db_path = args.next().map(PathBuf::from),
             "--file" => file_path = args.next().map(PathBuf::from),
             "--crash-after" => crash_after = args.next(),
             "--new-content" => new_content = args.next().unwrap_or(new_content),
@@ -44,6 +46,7 @@ fn main() {
         }
     }
     let db_path = db_path.expect("--db required");
+    let state_db_path = state_db_path.expect("--state-db required");
     let file_path = file_path.expect("--file required");
 
     // SIGKILL, not `std::process::exit` -- `exit` runs libc atexit handlers
@@ -62,11 +65,18 @@ fn main() {
 
     let original = std::fs::read_to_string(&file_path).unwrap_or_default();
 
+    // index.db: schema init only in this harness (it deliberately skips a
+    // real reindex -- see module doc), kept for parity with a real
+    // process's own startup. All durable txn::begin/advance calls below go
+    // through state_conn/state.db instead (docs/plans/2026-08-05-state-db-
+    // rewiring-execution-plan.md).
     let conn = calm_core::db::conn::open_writer(&db_path).expect("open db");
     calm_core::db::schema::init_db(&conn).expect("init db");
+    let state_conn = calm_core::db::conn::open_state_writer(&state_db_path).expect("open state db");
+    calm_core::db::schema::init_state_db(&state_conn).expect("init state db");
 
     let tx = calm_core::txn::begin(
-        &conn,
+        &state_conn,
         "crash-harness-project",
         file_path.file_name().unwrap().to_str().unwrap(),
         &calm_core::digest::evidence_digest(original.as_bytes()),
@@ -77,7 +87,7 @@ fn main() {
 
     calm_core::edit::atomic_write(&file_path, &new_content).expect("atomic_write");
     calm_core::txn::advance(
-        &conn,
+        &state_conn,
         &tx.tx_id,
         calm_core::txn::TxState::FileCommitted,
         "system",
@@ -87,7 +97,7 @@ fn main() {
     crash_here("file_committed");
 
     calm_core::txn::advance(
-        &conn,
+        &state_conn,
         &tx.tx_id,
         calm_core::txn::TxState::IndexCommitted,
         "system",
@@ -97,7 +107,7 @@ fn main() {
     crash_here("index_committed");
 
     calm_core::txn::advance(
-        &conn,
+        &state_conn,
         &tx.tx_id,
         calm_core::txn::TxState::Done,
         "system",
 
@@ -63,19 +63,29 @@ fn db_path_for(dir: &Path, run_key: &str) -> std::path::PathBuf {
     dir.join(format!("index-{run_key}.db"))
 }
 
+/// state.db counterpart of `db_path_for` -- edit_transactions/tx_events now
+/// live there (docs/plans/2026-08-05-state-db-rewiring-execution-plan.md),
+/// not in the rebuildable index.db `db_path_for` points at.
+fn state_db_path_for(dir: &Path, run_key: &str) -> std::path::PathBuf {
+    dir.join(format!("state-{run_key}.db"))
+}
+
 /// Spawns one `txn_crash_harness` subprocess with `--crash-after step` (or
 /// no crash at all if `step` is `None`), waits for it to die, and returns
 /// what's observable afterward. Panics if a crash was requested but the
 /// process didn't actually die by SIGKILL -- that would mean this test
 /// stopped testing what it claims to.
 fn run_one(dir: &Path, run_key: &str, step: Option<&str>) -> CrashOutcome {
     let db_path = db_path_for(dir, run_key);
+    let state_db_path = state_db_path_for(dir, run_key);
     let file_path = dir.join(format!("a-{run_key}.txt"));
     std::fs::write(&file_path, ORIGINAL_CONTENT).unwrap();
 
     let mut cmd = Command::new(env!("CARGO_BIN_EXE_txn_crash_harness"));
     cmd.arg("--db")
         .arg(&db_path)
+        .arg("--state-db")
+        .arg(&state_db_path)
         .arg("--file")
         .arg(&file_path)
         .arg("--new-content")
@@ -108,7 +118,7 @@ fn run_one(dir: &Path, run_key: &str, step: Option<&str>) -> CrashOutcome {
         // crash run, recover it from the DB directly the way a real
         // recovering process would (there's exactly one transaction ever
         // created against this DB, now that db_path is unique per run_key).
-        let conn = calm_core::db::conn::open_writer(&db_path).ok();
+        let conn = calm_core::db::conn::open_state_writer(&state_db_path).ok();
         conn.and_then(|c| {
             c.query_row("SELECT tx_id FROM edit_transactions LIMIT 1", [], |r| {
                 r.get::<_, String>(0)
@@ -154,8 +164,9 @@ fn assert_journal_consistent(
          synchronous, not partial"
     );
 
-    let db_path = db_path_for(dir, run_key);
-    let conn = calm_core::db::conn::open_writer(&db_path).expect("reopen db after crash");
+    let state_db_path = state_db_path_for(dir, run_key);
+    let conn = calm_core::db::conn::open_state_writer(&state_db_path)
+        .expect("reopen state db after crash");
 
     let cached = calm_core::txn::get(&conn, tx_id)
         .expect("txn::get")
 
@@ -723,6 +723,17 @@ pub fn default_db_path(project_root: &std::path::Path) -> PathBuf {
     project_root.join(".calm").join("index.db")
 }
 
+/// Sibling of `default_db_path` for the durable-state split
+/// (`KNOWN_LIMITATIONS.md` "Durable state and the rebuildable index share
+/// one SQLite file at runtime", `docs/plans/2026-08-05-state-db-rewiring-
+/// execution-plan.md`): `project_memory`/`edit_transactions`/`tx_events`/
+/// `maintenance_jobs`/`audit_ledger` live here (`db::conn::open_state_writer`,
+/// `PRAGMA synchronous=FULL`), separate from the rebuildable index/call-graph
+/// data in `default_db_path`'s `index.db` (`synchronous=NORMAL`).
+pub fn default_state_db_path(project_root: &std::path::Path) -> PathBuf {
+    project_root.join(".calm").join("state.db")
+}
+
 pub fn doctor(project_root: &std::path::Path, fix: bool) -> Result<()> {
     use calm_core::db::schema::init_db;