@jungjaehoon/mama-core 2.4.1 → 4.0.0

package/db/migrations/077-legacy-record-kind.sql

@@ -0,0 +1,6 @@
+-- Existing decisions are legacy memory records until an explicit judgment command
+-- binds them to a judgment receipt. Migration recovery in the adapter preserves
+-- the same distinction for databases that already applied migration 075.
+
+INSERT OR IGNORE INTO schema_version (version, description)
+VALUES (77, 'Distinguish legacy memory records from agent judgments');

package/db/migrations/078-source-ingest-commands.sql

@@ -0,0 +1,18 @@
+-- Raw source ingestion commands. Every source.ingest command binds exactly one
+-- immutable observation_versions row through command_bindings; the receipt is
+-- replayed verbatim on idempotent retries so a retried ingest never duplicates.
+
+CREATE TABLE IF NOT EXISTS source_commands (
+  command_id TEXT PRIMARY KEY REFERENCES command_bindings(command_id) ON DELETE RESTRICT,
+  observation_id TEXT NOT NULL REFERENCES observation_versions(observation_id) ON DELETE RESTRICT,
+  event_id TEXT,
+  committed_watermark INTEGER NOT NULL CHECK (committed_watermark >= 0),
+  receipt_json TEXT NOT NULL CHECK (json_valid(receipt_json)),
+  created_at INTEGER NOT NULL CHECK (created_at >= 0)
+);
+
+CREATE INDEX IF NOT EXISTS idx_source_commands_observation
+  ON source_commands(observation_id, created_at DESC);
+
+INSERT OR IGNORE INTO schema_version (version, description)
+VALUES (78, 'Source ingest command receipts bound to observations');

package/db/migrations/079-twin-edge-relations.sql

@@ -0,0 +1,43 @@
+-- Extend twin_edges.edge_type with the judgment-boundary relations 'refines',
+-- 'contradicts', and 'amends'. Authored record links use these relations; the
+-- 074 shape predates them and rejects the inserts with a CHECK violation.
+-- Rebuild the table like 074 did, preserving every row and column.
+
+ALTER TABLE twin_edges RENAME TO twin_edges_legacy_079;
+CREATE TABLE twin_edges (
+  edge_id TEXT PRIMARY KEY,
+  edge_type TEXT NOT NULL CHECK (edge_type IN ('supersedes','refines','contradicts','builds_on','debates','synthesizes','mentions','derived_from','case_member','alias_of','next_action_for','blocks','amends')),
+  subject_kind TEXT NOT NULL CHECK (subject_kind IN ('memory','case','entity','report','edge','registry','observation')),
+  subject_id TEXT NOT NULL,
+  object_kind TEXT NOT NULL CHECK (object_kind IN ('memory','case','entity','report','edge','raw','registry','observation')),
+  object_id TEXT NOT NULL,
+  relation_attrs_json TEXT,
+  confidence REAL NOT NULL DEFAULT 1.0 CHECK (confidence >= 0.0 AND confidence <= 1.0),
+  source TEXT NOT NULL CHECK (source IN ('agent','human','code')),
+  agent_id TEXT,
+  model_run_id TEXT,
+  envelope_hash TEXT,
+  human_actor_id TEXT,
+  human_actor_role TEXT,
+  authority_scope_json TEXT,
+  reason_classification TEXT,
+  reason_text TEXT,
+  evidence_refs_json TEXT,
+  request_idempotency_key TEXT,
+  edge_idempotency_key TEXT,
+  content_hash BLOB NOT NULL CHECK(length(content_hash)=32),
+  created_at INTEGER NOT NULL
+);
+INSERT INTO twin_edges SELECT * FROM twin_edges_legacy_079;
+DROP TABLE twin_edges_legacy_079;
+CREATE INDEX idx_twin_edges_subject ON twin_edges(subject_kind, subject_id, created_at DESC);
+CREATE INDEX idx_twin_edges_object ON twin_edges(object_kind, object_id, created_at DESC);
+CREATE INDEX idx_twin_edges_model_run_id ON twin_edges(model_run_id, created_at DESC);
+CREATE INDEX idx_twin_edges_request_idempotency
+  ON twin_edges(model_run_id, request_idempotency_key, created_at DESC)
+  WHERE model_run_id IS NOT NULL AND request_idempotency_key IS NOT NULL;
+CREATE UNIQUE INDEX ux_twin_edges_model_run_edge_idempotency
+  ON twin_edges(model_run_id, edge_idempotency_key)
+  WHERE model_run_id IS NOT NULL AND edge_idempotency_key IS NOT NULL;
+INSERT OR IGNORE INTO schema_version (version, description)
+VALUES (79, 'Twin edge relations for judgment links (refines/contradicts/amends)');

package/db/migrations/080-restore-duration-days.sql

@@ -0,0 +1,7 @@
+-- Restore decisions.duration_days. The column is part of the original
+-- decision-graph schema (001) but the 025 kind-check rebuild omitted it while
+-- outcome projections still write it. Databases that already carry the column
+-- skip this through the runner's duplicate-column handling.
+ALTER TABLE decisions ADD COLUMN duration_days INTEGER;
+INSERT OR IGNORE INTO schema_version (version, description)
+VALUES (80, 'Restore decisions.duration_days dropped by the 025 rebuild');

package/db/migrations/081-mailbox.sql

@@ -0,0 +1,61 @@
+-- The owner-event mailbox moves into the core database.
+--
+-- These two tables have existed since the operator loop was built, but only ever
+-- inside the product's own triggers.db, created inline by the class that used them.
+-- Declaring them here is what lets the mailbox be opened against the core database
+-- like every other core store. The shape is the one the live table already has,
+-- including the three columns that were added by run-time ALTERs rather than by a
+-- migration: retry_after, unresolved_reason and event_refs_json.
+--
+-- Existing rows are NOT moved here. A .sql migration cannot name another database
+-- file, and the rows live in a path only the product knows. scripts/move-mailbox-rows.ts
+-- does that part.
+
+CREATE TABLE IF NOT EXISTS owner_event_inbox (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  channel_key TEXT NOT NULL,
+  event_ids_json TEXT NOT NULL,
+  event_refs_json TEXT NOT NULL DEFAULT '[]',
+  lines_json TEXT NOT NULL,
+  activations_json TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending'
+    CHECK (status IN ('pending','claimed','acked','dead')),
+  attempts INTEGER NOT NULL DEFAULT 0,
+  last_error TEXT,
+  created_at INTEGER NOT NULL,
+  claimed_at INTEGER,
+  acked_at INTEGER,
+  retry_after INTEGER,
+  unresolved_reason TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_owner_event_inbox_status
+  ON owner_event_inbox(status, id);
+
+-- Dedupe horizon. One row per event id ever drained, pruned on a 30-day window.
+CREATE TABLE IF NOT EXISTS owner_event_inbox_events (
+  event_id TEXT PRIMARY KEY,
+  seen_at INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE INDEX IF NOT EXISTS idx_owner_event_inbox_events_seen
+  ON owner_event_inbox_events(seen_at);
+
+-- When to wake, and for what. Nothing reads this yet: the design puts the reader
+-- in 7.3, where the cron scheduler learns to wake from this table instead of from
+-- config held in memory. The columns are only what that sentence states the table
+-- is for -- which channel, when it is due, whether it fired. Anything else would be
+-- a guess at the reader's needs, and a guess costs a second migration.
+CREATE TABLE IF NOT EXISTS mailbox_schedules (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  channel_key TEXT NOT NULL,
+  due_at INTEGER NOT NULL,
+  created_at INTEGER NOT NULL,
+  fired_at INTEGER
+);
+
+CREATE INDEX IF NOT EXISTS idx_mailbox_schedules_due
+  ON mailbox_schedules(fired_at, due_at);
+
+INSERT OR IGNORE INTO schema_version (version, description)
+VALUES (81, 'Owner-event mailbox tables move into the core database');

package/db/migrations/082-commitments-row-id.sql

@@ -0,0 +1,12 @@
+-- The commitments rowid was called task_id.
+--
+-- A commitment is what this core knows how to hold: a record plus a revision
+-- history. "Task" is one product's word for what it puts in one. Naming the rowid
+-- after that product's word meant every other product installing this core read a
+-- column about work it does not have.
+--
+-- RENAME COLUMN keeps the data, the AUTOINCREMENT sequence (sqlite_sequence is
+-- keyed by table, not column) and every existing row id. Nothing is renumbered.
+ALTER TABLE commitments RENAME COLUMN task_id TO row_id;
+INSERT OR IGNORE INTO schema_version (version, description)
+VALUES (82, 'Rename commitments.task_id to row_id');

package/db/migrations/083-observation-is-the-evidence.sql

@@ -0,0 +1,49 @@
+-- An observation becomes the whole evidence record, and stops naming a connector.
+--
+-- Migration 030 built `connector_event_index` as the memory substrate, because at
+-- the time the only producer of evidence was a connector. Migration 072 introduced
+-- the neutral primitive, `observation_versions`, but attached it as a satellite --
+-- `connector_event_index.current_observation_id` -- and left the old table as the
+-- entry point. The foreign key has pointed the right way ever since; the reads did
+-- not follow it.
+--
+-- Two things change here, both so the reads can. The observation gains the evidence
+-- columns that only lived on the connector index, and the scope it carries as one
+-- JSON blob becomes columns a visibility filter can index. What stays behind on
+-- that index is what a polling loop needs to know about itself -- cursors,
+-- sequences, sweep times -- which is the connector framework's business and not the
+-- core's.
+--
+-- The column that named a connector is now `source`: the pair is (namespace,
+-- id-within-it), the same shape as source_id/source_at/source_locator beside it. A
+-- deployment with no connectors still has observations. That rename is made in 072
+-- itself rather than here, because the driver carries its own copy of this table's
+-- schema and rebuilds the table when the two disagree -- so a rename applied after
+-- the fact is undone before the next statement runs. Editing a shipped migration is
+-- only available because this store holds test data; see the owner's note that
+-- MAMA is a testbed and kagemusha keeps the real corpus.
+
+-- Evidence the connector index held alone. All of it describes what was observed.
+ALTER TABLE observation_versions ADD COLUMN source_type TEXT;
+ALTER TABLE observation_versions ADD COLUMN source_locator TEXT;
+ALTER TABLE observation_versions ADD COLUMN title TEXT;
+ALTER TABLE observation_versions ADD COLUMN artifact_locator TEXT;
+ALTER TABLE observation_versions ADD COLUMN artifact_title TEXT;
+ALTER TABLE observation_versions ADD COLUMN event_date TEXT;
+ALTER TABLE observation_versions ADD COLUMN source_entity_id TEXT;
+
+-- Scope out of the JSON blob. Raw visibility is decided against these four, and a
+-- filter that cannot reach a column cannot be a WHERE clause.
+ALTER TABLE observation_versions ADD COLUMN channel TEXT;
+ALTER TABLE observation_versions ADD COLUMN project_id TEXT;
+ALTER TABLE observation_versions ADD COLUMN tenant_id TEXT;
+ALTER TABLE observation_versions ADD COLUMN memory_scope_kind TEXT;
+ALTER TABLE observation_versions ADD COLUMN memory_scope_id TEXT;
+
+CREATE INDEX IF NOT EXISTS idx_observation_visibility
+  ON observation_versions(source, channel, project_id, tenant_id);
+CREATE INDEX IF NOT EXISTS idx_observation_artifact
+  ON observation_versions(artifact_locator);
+
+INSERT OR IGNORE INTO schema_version (version, description)
+VALUES (83, 'An observation is the whole evidence record and names no connector');

package/db/migrations/084-scope-kind-is-not-the-cores-to-list.sql

@@ -0,0 +1,34 @@
+-- A scope kind is the consumer's word, not the core's list.
+--
+-- `memory_scopes` had it right in shape: a scope is a (kind, id) pair, and the
+-- pair is what the core reasons about. Then it also enumerated the kinds --
+-- global, user, channel, project -- which is a statement about one deployment's
+-- world. `channel` is a chat concept; a consumer with no chat has to satisfy a
+-- constraint naming it, and a consumer with a kind of its own cannot store one at
+-- all.
+--
+-- The core defines the question. It must not also answer it. What is kept is the
+-- only part that is the core's: a kind is nonblank text.
+--
+-- SQLite cannot drop a CHECK, so the table is rebuilt. The rows carry over.
+
+PRAGMA foreign_keys = OFF;
+
+CREATE TABLE memory_scopes_084 (
+  id TEXT PRIMARY KEY,
+  kind TEXT NOT NULL CHECK (length(trim(kind)) > 0),
+  external_id TEXT NOT NULL,
+  created_at INTEGER DEFAULT (unixepoch() * 1000),
+  UNIQUE(kind, external_id)
+);
+
+INSERT INTO memory_scopes_084 (id, kind, external_id, created_at)
+  SELECT id, kind, external_id, created_at FROM memory_scopes;
+
+DROP TABLE memory_scopes;
+ALTER TABLE memory_scopes_084 RENAME TO memory_scopes;
+
+PRAGMA foreign_keys = ON;
+
+INSERT OR IGNORE INTO schema_version (version, description)
+VALUES (84, 'A scope kind is the consumer word, not a list the core keeps');

package/db/migrations/085-a-migration-has-a-source.sql

@@ -0,0 +1,37 @@
+-- A migration belongs to whoever wrote it.
+--
+-- `schema_version` keyed migrations on a number alone, and progress was
+-- `MAX(version)`. Both assume one author. With the core at 084, no other package
+-- can number a migration: 085 is the core's next, and a package that picked 200
+-- would make every later core migration look already applied.
+--
+-- So there was nowhere for a package's own table to live except inside the core,
+-- and that is why the connector tables -- which one of four consumers has any use
+-- for -- are declared by core migrations and created in every consumer's database.
+--
+-- Identity becomes (source, version). Rows written before this belong to the core,
+-- which is the only author there has been.
+
+PRAGMA foreign_keys = OFF;
+
+CREATE TABLE schema_version_085 (
+  source TEXT NOT NULL DEFAULT 'core' CHECK (length(trim(source)) > 0),
+  version INTEGER NOT NULL,
+  applied_at INTEGER DEFAULT (unixepoch()),
+  description TEXT,
+  PRIMARY KEY (source, version)
+);
+
+-- Only (version, description) carry over. `applied_at` is not copied: a database
+-- old enough to predate it does not have the column, and when it ran is not a fact
+-- anything reads. The new table defaults it.
+INSERT INTO schema_version_085 (source, version, description)
+  SELECT 'core', version, description FROM schema_version;
+
+DROP TABLE schema_version;
+ALTER TABLE schema_version_085 RENAME TO schema_version;
+
+PRAGMA foreign_keys = ON;
+
+INSERT OR IGNORE INTO schema_version (source, version, description)
+VALUES ('core', 85, 'A migration is identified by (source, version)');

package/db/migrations/086-the-mailbox-is-generic.sql

@@ -0,0 +1,110 @@
+-- The mailbox that any consumer can use.
+--
+-- Migration 081 declared the owner-event inbox in the core database: its display
+-- lines, its frozen procedure activations, its `OwnerEvent` name. Those are one
+-- consumer's vocabulary, and a core that requires them makes "receive something
+-- durably" unusable without MAMA's trigger loop. The design's own §5.2 measures
+-- exactly that, so W6 was corrected: the mechanism of intake is the core's, the
+-- words for what it carries are the product's.
+--
+-- 081 IS NOT EDITED. It is applied history, and editing an applied migration makes
+-- the file and the databases that already ran it say different things. Its two
+-- tables stay where they are, and the product's compatibility inbox
+-- (standalone/src/operator/owner-event-inbox.ts) keeps draining its own rows from
+-- its own store. This migration goes forward instead.
+--
+-- WHAT TRANSFERS, AND WHAT DELIBERATELY DOES NOT.
+--
+--   The dedupe horizon transfers. "This id already came in" is a purely mechanical
+--   fact with no vocabulary in it, and losing it means a connector's redelivery
+--   walks in through the new door as if it were new. Copied INSERT OR IGNORE, so
+--   re-running changes nothing.
+--
+--   The rows do not transfer -- and that is how their attempts and receipts are
+--   preserved, not how they are lost. A generic intake has nowhere to put a
+--   procedure activation, and moving a row while dropping one would lose a contract
+--   the producer froze before its cursor advanced. The compatibility inbox keeps
+--   every row, every attempt count and every ack exactly where it already is;
+--   producers move to the new door one slice at a time, and each slice's old rows
+--   are already drained by the loop that owns them before its caller is deleted.
+--   Measured 2026-09-22: core owner_event_inbox 0 rows, operator pending 0 rows,
+--   owner_event_inbox_events 12 rows -- those 12 are the whole transfer.
+
+CREATE TABLE IF NOT EXISTS mailbox_inputs (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  -- Identity: what the producer calls this stimulus.
+  stimulus_id TEXT NOT NULL,
+  -- Stated by the producer, one of owner_message / source_delta / scheduled.
+  -- NULLABLE with no DEFAULT: a row whose producer stated none reads back as
+  -- "not stated", which is true. The host never derives it from the content --
+  -- reading a message body to decide what kind of work it is is the
+  -- classification this contract removes.
+  kind TEXT,
+  -- Principal: whose stimulus this is.
+  principal_id TEXT NOT NULL,
+  -- Source: where it came from, canonical at the producer.
+  channel_key TEXT NOT NULL,
+  -- Content: the bounded change notice. Never the whole context.
+  preview_json TEXT NOT NULL DEFAULT '[]',
+  -- Reply: where an answer goes back, when the producer can name one.
+  reply_to TEXT,
+  -- Coalesce: what may mechanically merge with what, while both are pending.
+  coalesce_key TEXT,
+  -- Time: when it happened, as against when it was accepted.
+  occurred_at INTEGER NOT NULL,
+  created_at INTEGER NOT NULL,
+  -- Delivery state, and nothing about the work.
+  status TEXT NOT NULL DEFAULT 'pending'
+    CHECK (status IN ('pending','claimed','acked','dead')),
+  attempts INTEGER NOT NULL DEFAULT 0,
+  last_error TEXT,
+  claimed_at INTEGER,
+  acked_at INTEGER,
+  retry_after INTEGER
+);
+
+CREATE INDEX IF NOT EXISTS idx_mailbox_inputs_status
+  ON mailbox_inputs(status, id);
+CREATE INDEX IF NOT EXISTS idx_mailbox_inputs_coalesce
+  ON mailbox_inputs(status, coalesce_key);
+
+-- Preserved observation identity, one row per ref. A separate table because refs
+-- are the dedupe and cause set: they are queried, not just displayed.
+CREATE TABLE IF NOT EXISTS mailbox_input_refs (
+  input_id INTEGER NOT NULL REFERENCES mailbox_inputs(id) ON DELETE CASCADE,
+  ref_id TEXT NOT NULL,
+  observation_ref TEXT,
+  PRIMARY KEY (input_id, ref_id)
+);
+
+-- The 30-day dedupe horizon. One row per ref ever accepted.
+CREATE TABLE IF NOT EXISTS mailbox_seen (
+  ref_id TEXT PRIMARY KEY,
+  seen_at INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE INDEX IF NOT EXISTS idx_mailbox_seen_at ON mailbox_seen(seen_at);
+
+-- When to wake, and for what channel. 081 declared this one already and it was
+-- generic from the start -- this daemon's own alarm clock, not anyone's calendar
+-- (design §6.3). Repeated IF NOT EXISTS so the generic contract stands on its own
+-- rather than on a migration written for one consumer.
+CREATE TABLE IF NOT EXISTS mailbox_schedules (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  channel_key TEXT NOT NULL,
+  due_at INTEGER NOT NULL,
+  created_at INTEGER NOT NULL,
+  fired_at INTEGER
+);
+
+CREATE INDEX IF NOT EXISTS idx_mailbox_schedules_due
+  ON mailbox_schedules(fired_at, due_at);
+
+-- Carry the horizon forward. 081 created owner_event_inbox_events in this same
+-- database, so it is always present here; on an install that never drained a
+-- single event it is empty and this is a no-op.
+INSERT OR IGNORE INTO mailbox_seen (ref_id, seen_at)
+  SELECT event_id, seen_at FROM owner_event_inbox_events;
+
+INSERT OR IGNORE INTO schema_version (source, version, description)
+VALUES ('core', 86, 'the mailbox is generic: durable intake, schedule, delivery and ack only');

package/db/migrations/087-mailbox-payload.sql

@@ -0,0 +1,5 @@
+-- Consumer-owned input data. NULL denotes an old input with no preserved payload;
+-- a JSON null is the text 'null'. Never reconstruct missing data from a preview.
+ALTER TABLE mailbox_inputs ADD COLUMN payload_json TEXT;
+CREATE INDEX IF NOT EXISTS idx_mailbox_inputs_identity
+  ON mailbox_inputs(principal_id, stimulus_id);

package/db/migrations/088-native-input-journal.sql

@@ -0,0 +1,14 @@
+-- Native input facts are separate from both work judgments and external effects.
+CREATE TABLE IF NOT EXISTS native_input_deliveries (
+  input_id INTEGER PRIMARY KEY REFERENCES mailbox_inputs(id) ON DELETE CASCADE,
+  invocation_id TEXT UNIQUE,
+  state TEXT NOT NULL CHECK (state IN ('prepared','dispatching','accepted','settled','uncertain')),
+  dispatch_json TEXT,
+  receipt_json TEXT,
+  error TEXT,
+  updated_at INTEGER NOT NULL
+);
+-- Earlier claims did not record whether native execution had begun. Do not replay them on a guess.
+INSERT OR IGNORE INTO native_input_deliveries (input_id, state, error, updated_at)
+  SELECT id, 'uncertain', 'Legacy input has no native dispatch record', created_at
+  FROM mailbox_inputs WHERE status = 'claimed' OR (status = 'pending' AND attempts > 0);

package/db/migrations/089-native-turn-receipt-lookup.sql

@@ -0,0 +1,3 @@
+-- One native turn may accept several independently journaled inputs.
+CREATE INDEX IF NOT EXISTS idx_native_input_receipt_lookup
+  ON native_input_deliveries(receipt_json, input_id);

package/db/migrations/090-model-run-native-inputs.sql

@@ -0,0 +1,29 @@
+-- A model run's first accepted input names its native turn. Every later steer
+-- shares that turn receipt, so membership is projected from the durable journal
+-- instead of copied into a second queue or fabricated for historical runs.
+CREATE INDEX IF NOT EXISTS idx_mailbox_inputs_identity
+  ON mailbox_inputs(principal_id, stimulus_id);
+
+CREATE VIEW IF NOT EXISTS model_run_native_inputs AS
+SELECT
+  mr.model_run_id,
+  child.id AS input_id,
+  child.stimulus_id,
+  child.kind,
+  child.principal_id,
+  child.channel_key,
+  child.occurred_at,
+  child.status,
+  child_delivery.state AS native_state
+FROM model_runs mr
+JOIN mailbox_inputs root
+  ON root.stimulus_id = CASE WHEN json_valid(mr.input_refs_json)
+    THEN json_extract(mr.input_refs_json, '$.sourceMessageRef') ELSE NULL END
+ AND root.principal_id = CASE WHEN json_valid(mr.input_refs_json)
+    THEN json_extract(mr.input_refs_json, '$.principalId') ELSE NULL END
+JOIN native_input_deliveries root_delivery
+  ON root_delivery.input_id = root.id AND root_delivery.receipt_json IS NOT NULL
+JOIN native_input_deliveries child_delivery
+  ON child_delivery.receipt_json = root_delivery.receipt_json
+JOIN mailbox_inputs child
+  ON child.id = child_delivery.input_id AND child.principal_id = root.principal_id;

package/db/migrations/091-native-turn-results.sql

@@ -0,0 +1,11 @@
+-- One final native response belongs to the turn receipt, even when several
+-- accepted mailbox inputs shared that turn. Keep it beyond mailbox pruning so
+-- a later input can reconcile without replaying the model or external effects.
+CREATE TABLE IF NOT EXISTS native_turn_results (
+  receipt_json TEXT NOT NULL,
+  principal_id TEXT NOT NULL,
+  primary_stimulus_id TEXT NOT NULL,
+  result_json TEXT NOT NULL CHECK (json_valid(result_json)),
+  created_at INTEGER NOT NULL,
+  PRIMARY KEY (receipt_json, principal_id)
+);

package/db/migrations/092-restore-decision-fts.sql

@@ -0,0 +1,34 @@
+-- 025 rebuilt decisions after 015 installed these triggers. SQLite drops a
+-- table's triggers with that table, leaving the external-content FTS index
+-- readable from decisions but no longer synchronized with new writes.
+CREATE VIRTUAL TABLE IF NOT EXISTS decisions_fts USING fts5(
+  topic, decision, reasoning,
+  content='decisions',
+  content_rowid='rowid'
+);
+
+DROP TRIGGER IF EXISTS decisions_ai;
+DROP TRIGGER IF EXISTS decisions_ad;
+DROP TRIGGER IF EXISTS decisions_au;
+DROP TRIGGER IF EXISTS decisions_au2;
+
+CREATE TRIGGER decisions_ai AFTER INSERT ON decisions BEGIN
+  INSERT INTO decisions_fts(rowid, topic, decision, reasoning)
+  VALUES (new.rowid, new.topic, new.decision, new.reasoning);
+END;
+CREATE TRIGGER decisions_ad BEFORE DELETE ON decisions BEGIN
+  INSERT INTO decisions_fts(decisions_fts, rowid, topic, decision, reasoning)
+  VALUES ('delete', old.rowid, old.topic, old.decision, old.reasoning);
+END;
+CREATE TRIGGER decisions_au BEFORE UPDATE ON decisions BEGIN
+  INSERT INTO decisions_fts(decisions_fts, rowid, topic, decision, reasoning)
+  VALUES ('delete', old.rowid, old.topic, old.decision, old.reasoning);
+END;
+CREATE TRIGGER decisions_au2 AFTER UPDATE ON decisions BEGIN
+  INSERT INTO decisions_fts(rowid, topic, decision, reasoning)
+  VALUES (new.rowid, new.topic, new.decision, new.reasoning);
+END;
+
+INSERT INTO decisions_fts(decisions_fts) VALUES ('rebuild');
+INSERT OR IGNORE INTO schema_version(version, description)
+VALUES (92, 'Restore decisions FTS synchronization after the table rebuild');

package/db/migrations/093-native-turn-primary-kind.sql

@@ -0,0 +1,14 @@
+-- The reply owner may be a background input, not a messenger message. Preserve
+-- the producer-stated kind beyond mailbox pruning so recovery never invents a
+-- Telegram shared-reply target from a source delta or scheduled turn.
+ALTER TABLE native_turn_results ADD COLUMN primary_kind TEXT
+  CHECK (primary_kind IS NULL OR primary_kind IN
+    ('owner_message', 'source_delta', 'scheduled', 'native_event'));
+
+UPDATE native_turn_results
+SET primary_kind = (
+  SELECT m.kind FROM mailbox_inputs m
+  WHERE m.stimulus_id = native_turn_results.primary_stimulus_id
+    AND m.principal_id = native_turn_results.principal_id
+  ORDER BY m.id ASC LIMIT 1
+);

package/db/migrations/094-commitment-run-provenance.sql

@@ -0,0 +1,9 @@
+-- A commitment's current head and each historical revision retain the run and
+-- agent that authored them. Existing rows remain unknown; do not infer origins.
+ALTER TABLE commitments ADD COLUMN agent_id TEXT;
+ALTER TABLE commitments ADD COLUMN model_run_id TEXT;
+ALTER TABLE commitment_assignments ADD COLUMN agent_id TEXT;
+ALTER TABLE commitment_assignments ADD COLUMN model_run_id TEXT;
+
+INSERT OR IGNORE INTO schema_version (version, description)
+VALUES (94, 'Commitment run and agent provenance');

package/db/migrations/095-model-run-native-input-identity.sql

@@ -0,0 +1,39 @@
+-- A model run's native invocation ID is the core-owned identity of its first
+-- accepted input. sourceMessageRef may be a product effect occurrence, not the
+-- mailbox stimulus ID. Preserve the old ref join only for historical rows that
+-- predate nativeInputId; never fall back from a stated but unmatched native ID.
+DROP VIEW IF EXISTS model_run_native_inputs;
+CREATE VIEW model_run_native_inputs AS
+SELECT
+  mr.model_run_id,
+  child.id AS input_id,
+  child.stimulus_id,
+  child.kind,
+  child.principal_id,
+  child.channel_key,
+  child.occurred_at,
+  child.status,
+  child_delivery.state AS native_state
+FROM model_runs mr
+JOIN native_input_deliveries root_delivery
+  ON root_delivery.input_id = CASE WHEN json_valid(mr.input_refs_json) THEN
+    CASE WHEN json_type(mr.input_refs_json, '$.nativeInputId') IS NOT NULL THEN
+      (SELECT input_id FROM native_input_deliveries
+       WHERE invocation_id = json_extract(mr.input_refs_json, '$.nativeInputId'))
+    ELSE
+      (SELECT id FROM mailbox_inputs
+       WHERE principal_id = json_extract(mr.input_refs_json, '$.principalId')
+         AND stimulus_id = json_extract(mr.input_refs_json, '$.sourceMessageRef'))
+    END
+  ELSE NULL END
+ AND root_delivery.receipt_json IS NOT NULL
+JOIN mailbox_inputs root
+  ON root.id = root_delivery.input_id
+ AND root.principal_id = json_extract(mr.input_refs_json, '$.principalId')
+JOIN native_input_deliveries child_delivery
+  ON child_delivery.receipt_json = root_delivery.receipt_json
+JOIN mailbox_inputs child
+  ON child.id = child_delivery.input_id AND child.principal_id = root.principal_id;
+
+INSERT OR IGNORE INTO schema_version (version, description)
+VALUES (95, 'Model-run cohort follows accepted native input identity');

package/db/migrations/096-drop-connector-event-index-fts.sql

@@ -0,0 +1,9 @@
+-- Stored source search scans literal substrings in connector_event_index.
+-- Other core consumers never created this product index, so absence is expected.
+DROP TRIGGER IF EXISTS trg_connector_event_index_ai;
+DROP TRIGGER IF EXISTS trg_connector_event_index_au;
+DROP TRIGGER IF EXISTS trg_connector_event_index_ad;
+DROP TABLE IF EXISTS connector_event_index_fts;
+
+INSERT OR IGNORE INTO schema_version (version, description)
+VALUES (96, 'Drop the unused connector event full-text index');

package/db/migrations/097-native-input-json-validity.sql

@@ -0,0 +1,37 @@
+-- Each JSON expression must be guarded independently: SQLite may reorder joins.
+DROP VIEW IF EXISTS model_run_native_inputs;
+CREATE VIEW model_run_native_inputs AS
+SELECT
+  mr.model_run_id,
+  child.id AS input_id,
+  child.stimulus_id,
+  child.kind,
+  child.principal_id,
+  child.channel_key,
+  child.occurred_at,
+  child.status,
+  child_delivery.state AS native_state
+FROM model_runs mr
+JOIN native_input_deliveries root_delivery
+  ON root_delivery.input_id = CASE WHEN json_valid(mr.input_refs_json) THEN
+    CASE WHEN json_type(mr.input_refs_json, '$.nativeInputId') IS NOT NULL THEN
+      (SELECT input_id FROM native_input_deliveries
+       WHERE invocation_id = json_extract(mr.input_refs_json, '$.nativeInputId'))
+    ELSE
+      (SELECT id FROM mailbox_inputs
+       WHERE principal_id = json_extract(mr.input_refs_json, '$.principalId')
+         AND stimulus_id = json_extract(mr.input_refs_json, '$.sourceMessageRef'))
+    END
+  ELSE NULL END
+ AND root_delivery.receipt_json IS NOT NULL
+JOIN mailbox_inputs root
+  ON root.id = root_delivery.input_id
+ AND root.principal_id = CASE WHEN json_valid(mr.input_refs_json)
+   THEN json_extract(mr.input_refs_json, '$.principalId') ELSE NULL END
+JOIN native_input_deliveries child_delivery
+  ON child_delivery.receipt_json = root_delivery.receipt_json
+JOIN mailbox_inputs child
+  ON child.id = child_delivery.input_id AND child.principal_id = root.principal_id;
+
+INSERT OR IGNORE INTO schema_version (version, description)
+VALUES (97, 'Guard native input view joins against malformed historical JSON');