[abrichr]

The frame now diffs the whole database by default when a contract declares frame.database, not only the tables the contract reads.

Why: on #1580's blind held-out suite, the read-list frame passed three bot writes as verified. Each wrote somewhere the contract never read: a column on the new chart, a field on its history row, and a calendar row. Adding those reads one case at a time would only cover the cases already seen.

What it does:

• Snapshot: reads every table and column before and after the save. It takes three statements however many tables there are (schema, row counts, then every row as JSON), so a slow channel such as docker exec stays fast. Tables over max_rows are fingerprinted instead (CHECKSUM TABLE on MySQL and MariaDB, a row hash on SQLite).
• Judging: each table is one more slice for judge_frame. A row added, removed or changed is collateral unless a declared effect, a declared side record, or a concurrent writer the audit log names explains it.
• New rows: a new declared or side row that sets a column the effects don't name is collateral, unless the column is in new_row_fields or holds its default. The primary key and database-computed defaults (CURRENT_TIMESTAMP) count as defaults.
• Allow-list: allow_tables is the reviewed list of tables the app writes on its own (logs, sessions, id registries). It replaces the read-list.
• Linking fields: attribution.record_keys lets a table name its record through another field (OpenEMR's contact.foreign_id).
• Fail-closed: an unreadable snapshot, or a table created, dropped or altered in the window, leaves the frame not checked or collateral. It never holds.

Stacked on #1570 (side records and record keys).

Tests: tests/test_frame_database.py covers a clean save, five kinds of stray write, the allow-list, an unreadable database, the three-statement read and a table wider than SQLite's 127-argument limit. One more case is in test_frame_links.py. Locally, 110 tests pass across the frame, frame-links, verify-run and collateral-change suites.

Measured (#1580, stand-in): the whole-database candidate gets 17/17 on both the original suite and the first held-out suite. The first held-out set shaped this design, so its score doesn't count. A second blind held-out set will be the measurement.

🤖 Generated with Claude Code