Slice: recover Memory change Inbox events across Host restart #464

Parent

#350

What to build

As a Human who changes a PersonaBot's Memory Repository while DSH is closed, or just before its Host restarts, I want the Bot to receive an actionable memory-change Source Event in its Inbox on the next ordinary turn. The Bot should learn the net changed paths and Git state without a file edit waking it.

#352 establishes the memory-change Source Event and Inbox Admission in a running Host. This slice makes the observation checkpoint durable across Host exit and crash.

Acceptance criteria

• Persist a per-Repository observation checkpoint owned by Memory Service: repository identity, branch, HEAD, staged/index identity, and bounded content identities for dirty and untracked paths. Keep Git files as current Memory; this record is only a comparison checkpoint, not a second content authority.
• Once the Host has restored its durable stores, run a bounded startup comparison against that checkpoint and admit the Event to the Bot Inbox without waking the Bot; compare again before the next ordinary turn to cover later edits. Detect net additions, changes, removals, commits, and branch movement, including another edit to a file that was already dirty.
• In one SQLite transaction, commit the observed memory-change Source Event, its Inbox Admission, and the advanced checkpoint. A retry after a crash cannot lose or duplicate the Event.
• The Event is visible in the Bot Inbox after startup admission and selected for the next ordinary turn without an independent wake. It carries event identity, observed time, change categories, bounded relative paths, and overflow counts; file bodies and full diffs stay in Git/current files for Agent inspection.
• Describe offline or interrupted-turn changes as observed net changes with unknown actor; do not assert a Human edited them. Suppress Bot-owned changes at the normal reconcile/abort checkpoint.
• A fresh Repository with no prior checkpoint establishes its initial baseline without announcing every existing file as a new change. A pending Event remains pending independently of subsequent checkpoint advances.
• If observation fails or exceeds safe limits, do not advance the checkpoint or silently mark the Event handled; surface a bounded error/repair outcome.
• Tests cover stop/edit/restart/Inbox-visible-before-turn/next turn, same-dirty-file re-edit, crash before and after atomic commit, quiet restart, Bot-owned edits, branch movement, and untracked files. Verify the installed plugin with a real DSH model.
• Update the accepted Memory/Inbox architecture decision and ADR-0060 to document the explicit out-of-band, no-wake Inbox Event exception.

Boundary

Comparing durable checkpoints can report only net changes. An edit created and fully reverted while the Host is offline leaves no observable difference; reconstructing each intermediate operation would require an external journal or editor integration.

Blocked by

• Slice: deliver external Memory changes through Inbox #352 (establishes the memory-change Source Event and Inbox rendering).