@lobu/cli 7.0.0 → 7.2.0

package/dist/db/migrations/20260516120000_agents_per_org_pk_swap.sql

@@ -0,0 +1,125 @@
+-- migrate:up
+-- Phase C: swap `agents` PK from globally-unique `id` to per-org composite
+-- `(organization_id, id)`. The application has always treated agents as
+-- org-scoped (every read/list filters by organization_id) but the global PK
+-- silently blocked two orgs from sharing an agent ID — for example, a stale
+-- `food-ordering` in one org would prevent `food-ordering` in another.
+--
+-- Phase A (20260515120000) added the org column + composite indexes on the
+-- 5 FK-holding child tables and backfilled values from agents. Phase B (the
+-- application-code refactor in this PR) plumbs `organization_id` through every
+-- INSERT/UPDATE/DELETE/SELECT touching these tables. This migration is the
+-- final structural swap: it drops the single-column PK + FKs, adds the
+-- composite PK + FKs, and widens the per-(agent,kind,pattern) uniques on
+-- agent_users / agent_grants / grants with organization_id.
+
+-- ── 0. Set NOT NULL on the columns Phase A backfilled.
+-- Backfill defensively in case any rows snuck in NULL (e.g. embedded PGlite
+-- installs that bypassed the dbmate runner during a partial state).
+UPDATE public.agent_grants           c SET organization_id = a.organization_id FROM public.agents a WHERE c.organization_id IS NULL AND c.agent_id = a.id;
+UPDATE public.agent_connections      c SET organization_id = a.organization_id FROM public.agents a WHERE c.organization_id IS NULL AND c.agent_id = a.id;
+UPDATE public.agent_users            c SET organization_id = a.organization_id FROM public.agents a WHERE c.organization_id IS NULL AND c.agent_id = a.id;
+UPDATE public.agent_channel_bindings c SET organization_id = a.organization_id FROM public.agents a WHERE c.organization_id IS NULL AND c.agent_id = a.id;
+UPDATE public.grants                 c SET organization_id = a.organization_id FROM public.agents a WHERE c.organization_id IS NULL AND c.agent_id = a.id;
+
+-- Drop any orphan rows (agent_id with no matching agents row). Backfill
+-- can't recover these.
+DELETE FROM public.agent_grants           WHERE organization_id IS NULL;
+DELETE FROM public.agent_connections      WHERE organization_id IS NULL;
+DELETE FROM public.agent_users            WHERE organization_id IS NULL;
+DELETE FROM public.agent_channel_bindings WHERE organization_id IS NULL;
+DELETE FROM public.grants                 WHERE organization_id IS NULL;
+
+ALTER TABLE public.agent_grants           ALTER COLUMN organization_id SET NOT NULL;
+ALTER TABLE public.agent_connections      ALTER COLUMN organization_id SET NOT NULL;
+ALTER TABLE public.agent_users            ALTER COLUMN organization_id SET NOT NULL;
+ALTER TABLE public.agent_channel_bindings ALTER COLUMN organization_id SET NOT NULL;
+ALTER TABLE public.grants                 ALTER COLUMN organization_id SET NOT NULL;
+
+-- ── 1. Drop the 6 single-column FKs into agents(id).
+ALTER TABLE public.agent_grants           DROP CONSTRAINT IF EXISTS agent_grants_agent_id_fkey;
+ALTER TABLE public.agent_connections      DROP CONSTRAINT IF EXISTS agent_connections_agent_id_fkey;
+ALTER TABLE public.agent_users            DROP CONSTRAINT IF EXISTS agent_users_agent_id_fkey;
+ALTER TABLE public.agent_channel_bindings DROP CONSTRAINT IF EXISTS agent_channel_bindings_agent_id_fkey;
+ALTER TABLE public.grants                 DROP CONSTRAINT IF EXISTS grants_agent_id_fkey;
+ALTER TABLE public.scheduled_jobs         DROP CONSTRAINT IF EXISTS scheduled_jobs_agent_fkey;
+
+-- ── 2. Drop the unique/PK constraints on child tables that scope to bare agent_id.
+ALTER TABLE public.agent_grants DROP CONSTRAINT IF EXISTS agent_grants_agent_id_pattern_key;
+ALTER TABLE public.agent_users  DROP CONSTRAINT IF EXISTS agent_users_pkey;
+ALTER TABLE public.grants       DROP CONSTRAINT IF EXISTS grants_pkey;
+
+-- ── 3. Swap the PK on agents from (id) to (organization_id, id).
+ALTER TABLE public.agents DROP CONSTRAINT IF EXISTS agents_pkey;
+ALTER TABLE public.agents ADD CONSTRAINT agents_pkey PRIMARY KEY (organization_id, id);
+
+-- ── 4. Re-add per-org-scoped uniques on the child tables.
+ALTER TABLE public.agent_grants
+  ADD CONSTRAINT agent_grants_org_agent_pattern_key UNIQUE (organization_id, agent_id, pattern);
+ALTER TABLE public.agent_users
+  ADD CONSTRAINT agent_users_pkey PRIMARY KEY (organization_id, agent_id, platform, user_id);
+ALTER TABLE public.grants
+  ADD CONSTRAINT grants_pkey PRIMARY KEY (organization_id, agent_id, kind, pattern);
+
+-- ── 5. Re-add composite FKs (organization_id, agent_id) → agents(organization_id, id).
+ALTER TABLE public.agent_grants
+  ADD CONSTRAINT agent_grants_org_agent_fkey
+  FOREIGN KEY (organization_id, agent_id) REFERENCES public.agents(organization_id, id) ON DELETE CASCADE;
+ALTER TABLE public.agent_connections
+  ADD CONSTRAINT agent_connections_org_agent_fkey
+  FOREIGN KEY (organization_id, agent_id) REFERENCES public.agents(organization_id, id) ON DELETE CASCADE;
+ALTER TABLE public.agent_users
+  ADD CONSTRAINT agent_users_org_agent_fkey
+  FOREIGN KEY (organization_id, agent_id) REFERENCES public.agents(organization_id, id) ON DELETE CASCADE;
+ALTER TABLE public.agent_channel_bindings
+  ADD CONSTRAINT agent_channel_bindings_org_agent_fkey
+  FOREIGN KEY (organization_id, agent_id) REFERENCES public.agents(organization_id, id) ON DELETE CASCADE;
+ALTER TABLE public.grants
+  ADD CONSTRAINT grants_org_agent_fkey
+  FOREIGN KEY (organization_id, agent_id) REFERENCES public.agents(organization_id, id) ON DELETE CASCADE;
+ALTER TABLE public.scheduled_jobs
+  ADD CONSTRAINT scheduled_jobs_org_agent_fkey
+  FOREIGN KEY (organization_id, created_by_agent) REFERENCES public.agents(organization_id, id) ON DELETE CASCADE;
+
+-- migrate:down
+-- Reverse the swap. NOTE: this WILL FAIL if two orgs ended up sharing an
+-- agent ID after this migration shipped (the previous PK on (id) requires
+-- global uniqueness). That's by design — this migration's whole purpose is
+-- to allow per-org agent IDs that the old PK forbids.
+
+ALTER TABLE public.scheduled_jobs         DROP CONSTRAINT IF EXISTS scheduled_jobs_org_agent_fkey;
+ALTER TABLE public.grants                 DROP CONSTRAINT IF EXISTS grants_org_agent_fkey;
+ALTER TABLE public.agent_channel_bindings DROP CONSTRAINT IF EXISTS agent_channel_bindings_org_agent_fkey;
+ALTER TABLE public.agent_users            DROP CONSTRAINT IF EXISTS agent_users_org_agent_fkey;
+ALTER TABLE public.agent_connections      DROP CONSTRAINT IF EXISTS agent_connections_org_agent_fkey;
+ALTER TABLE public.agent_grants           DROP CONSTRAINT IF EXISTS agent_grants_org_agent_fkey;
+
+ALTER TABLE public.grants       DROP CONSTRAINT IF EXISTS grants_pkey;
+ALTER TABLE public.agent_users  DROP CONSTRAINT IF EXISTS agent_users_pkey;
+ALTER TABLE public.agent_grants DROP CONSTRAINT IF EXISTS agent_grants_org_agent_pattern_key;
+
+ALTER TABLE public.agents DROP CONSTRAINT IF EXISTS agents_pkey;
+ALTER TABLE public.agents ADD CONSTRAINT agents_pkey PRIMARY KEY (id);
+
+ALTER TABLE public.agent_grants ADD CONSTRAINT agent_grants_agent_id_pattern_key UNIQUE (agent_id, pattern);
+ALTER TABLE public.agent_users  ADD CONSTRAINT agent_users_pkey PRIMARY KEY (agent_id, platform, user_id);
+ALTER TABLE public.grants       ADD CONSTRAINT grants_pkey PRIMARY KEY (agent_id, kind, pattern);
+
+ALTER TABLE public.agent_grants
+  ADD CONSTRAINT agent_grants_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES public.agents(id) ON DELETE CASCADE;
+ALTER TABLE public.agent_connections
+  ADD CONSTRAINT agent_connections_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES public.agents(id) ON DELETE CASCADE;
+ALTER TABLE public.agent_users
+  ADD CONSTRAINT agent_users_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES public.agents(id) ON DELETE CASCADE;
+ALTER TABLE public.agent_channel_bindings
+  ADD CONSTRAINT agent_channel_bindings_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES public.agents(id) ON DELETE CASCADE;
+ALTER TABLE public.grants
+  ADD CONSTRAINT grants_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES public.agents(id) ON DELETE CASCADE;
+ALTER TABLE public.scheduled_jobs
+  ADD CONSTRAINT scheduled_jobs_agent_fkey FOREIGN KEY (created_by_agent) REFERENCES public.agents(id) ON DELETE CASCADE;
+
+ALTER TABLE public.grants                 ALTER COLUMN organization_id DROP NOT NULL;
+ALTER TABLE public.agent_channel_bindings ALTER COLUMN organization_id DROP NOT NULL;
+ALTER TABLE public.agent_users            ALTER COLUMN organization_id DROP NOT NULL;
+ALTER TABLE public.agent_connections      ALTER COLUMN organization_id DROP NOT NULL;
+ALTER TABLE public.agent_grants           ALTER COLUMN organization_id DROP NOT NULL;

package/dist/db/migrations/20260516200000_events_search_tsv.sql

@@ -0,0 +1,134 @@
+-- migrate:up
+
+-- Materialize the fulltext search vector as a STORED column.
+--
+-- Why a real column instead of the previous expression-indexed `to_tsvector(payload_text)`:
+--   1. It includes both `title` (weight A) and `payload_text` (weight B) — the
+--      same shape buildSearchDocumentExpr() in content-search.ts uses for
+--      ranking. Retrieval (@@) and ts_rank_cd now read the same vector, so
+--      title-only hits surface correctly and ranking doesn't recompute the
+--      vector per matched row at query time.
+--   2. Planner-stable: `search_tsv @@ to_tsquery(...)` is a plain column
+--      reference — no expression-shape matching, no aliasing risk where the
+--      GIN gets skipped because the WHERE expression isn't byte-identical to
+--      the indexed expression.
+--   3. The new GIN strictly subsumes the old payload-only one (same lexemes
+--      plus title's), so we drop the old index and recover its write
+--      amplification on every events insert.
+--
+-- Operational note: ADD COLUMN ... GENERATED STORED rewrites the events
+-- table under ACCESS EXCLUSIVE. On a 1M-row table expect on the order of a
+-- minute; run during a quiet window. CONCURRENTLY does not apply to ADD
+-- COLUMN; it only applies to CREATE INDEX, which is a separate statement
+-- below.
+
+ALTER TABLE public.events
+    ADD COLUMN search_tsv tsvector GENERATED ALWAYS AS (
+        setweight(to_tsvector('english', COALESCE(title, '')), 'A') ||
+        setweight(to_tsvector('english', COALESCE(payload_text, '')), 'B')
+    ) STORED;
+
+CREATE INDEX idx_events_search_tsv ON public.events USING gin (search_tsv);
+
+DROP INDEX IF EXISTS public.idx_events_fulltext;
+
+-- Recreate the current_event_records view so it exposes search_tsv to
+-- callers that go through the supersession filter (the view materializes
+-- its column list at create time, so `e.*`-style auto-pickup doesn't
+-- apply). buildSearchDocumentExpr() reads `f.search_tsv` / `fi.search_tsv`
+-- where f and fi are this view's aliases, so without this the view-backed
+-- queries fail with "column ... does not exist".
+
+DROP VIEW IF EXISTS public.current_event_records;
+CREATE VIEW public.current_event_records AS
+ SELECT e.id,
+    e.organization_id,
+    e.entity_ids,
+    e.origin_id,
+    e.title,
+    e.payload_type,
+    e.payload_text,
+    e.payload_data,
+    e.payload_template,
+    e.attachments,
+    e.metadata,
+    e.score,
+    emb.embedding,
+    e.author_name,
+    e.source_url,
+    e.occurred_at,
+    e.created_at,
+    e.origin_parent_id,
+    COALESCE(length(e.payload_text), 0) AS content_length,
+    e.search_tsv,
+    e.origin_type,
+    e.connector_key,
+    e.connection_id,
+    e.feed_key,
+    e.feed_id,
+    e.run_id,
+    e.semantic_type,
+    e.client_id,
+    e.created_by,
+    e.interaction_type,
+    e.interaction_status,
+    e.interaction_input_schema,
+    e.interaction_input,
+    e.interaction_output,
+    e.interaction_error,
+    e.supersedes_event_id
+   FROM (public.events e
+     LEFT JOIN public.event_embeddings emb ON ((emb.event_id = e.id)))
+  WHERE (NOT (EXISTS ( SELECT 1
+           FROM public.events newer
+          WHERE (newer.supersedes_event_id = e.id))));
+
+-- migrate:down
+
+DROP VIEW IF EXISTS public.current_event_records;
+CREATE VIEW public.current_event_records AS
+ SELECT e.id,
+    e.organization_id,
+    e.entity_ids,
+    e.origin_id,
+    e.title,
+    e.payload_type,
+    e.payload_text,
+    e.payload_data,
+    e.payload_template,
+    e.attachments,
+    e.metadata,
+    e.score,
+    emb.embedding,
+    e.author_name,
+    e.source_url,
+    e.occurred_at,
+    e.created_at,
+    e.origin_parent_id,
+    COALESCE(length(e.payload_text), 0) AS content_length,
+    e.origin_type,
+    e.connector_key,
+    e.connection_id,
+    e.feed_key,
+    e.feed_id,
+    e.run_id,
+    e.semantic_type,
+    e.client_id,
+    e.created_by,
+    e.interaction_type,
+    e.interaction_status,
+    e.interaction_input_schema,
+    e.interaction_input,
+    e.interaction_output,
+    e.interaction_error,
+    e.supersedes_event_id
+   FROM (public.events e
+     LEFT JOIN public.event_embeddings emb ON ((emb.event_id = e.id)))
+  WHERE (NOT (EXISTS ( SELECT 1
+           FROM public.events newer
+          WHERE (newer.supersedes_event_id = e.id))));
+
+CREATE INDEX idx_events_fulltext ON public.events
+    USING gin (to_tsvector('english'::regconfig, COALESCE(payload_text, ''::text)));
+DROP INDEX IF EXISTS public.idx_events_search_tsv;
+ALTER TABLE public.events DROP COLUMN search_tsv;

package/dist/db/migrations/20260516200100_events_lifecycle_changes_index.sql

@@ -0,0 +1,25 @@
+-- migrate:up
+
+-- Partial index for the dashboard's 14-day lifecycle-cumulative-stats query
+-- (lifecycleCumulativeStatsSql in packages/owletto/src/lib/api/metric-series.ts).
+--
+-- The query reads events older than `now() - interval '14 days'` and
+-- aggregates by date_trunc('day', created_at), with every COUNT FILTER
+-- already gated on semantic_type='change' AND metadata->>'category'='lifecycle'.
+-- A partial index whose predicate matches that gate prunes the scan from
+-- "all events in the last 14 days for the org" to "just the lifecycle
+-- changes" — typically a small slice of total events. The aggregation
+-- itself is cheap once the row set is narrow.
+--
+-- Why not a materialized view: at current scale the bottleneck is the row
+-- scan, not the per-bucket COUNT FILTER work. A partial index removes the
+-- scan cost without introducing a refresh job or staleness. Revisit if the
+-- post-prune row count grows into the millions.
+
+CREATE INDEX idx_events_lifecycle_changes
+    ON public.events (organization_id, created_at)
+    WHERE semantic_type = 'change' AND metadata->>'category' = 'lifecycle';
+
+-- migrate:down
+
+DROP INDEX IF EXISTS public.idx_events_lifecycle_changes;

package/dist/db/migrations/20260517010000_drop_unused_indexes.sql

@@ -0,0 +1,49 @@
+-- migrate:up
+
+-- Drop 4 indexes that pg_stat_user_indexes reported `idx_scan = 0` after 28h
+-- of prod uptime AND are not referenced from any active code path.
+--
+-- A larger set (4 more, ~5 GB combined) was originally bundled here but
+-- review caught they're not actually unused — they're dormant. The three
+-- big search indexes (`idx_events_embedding`, `idx_events_raw_content_trgm`,
+-- `idx_events_search_tsv`) are explicitly used by the ANN/fulltext/trigram
+-- branches of `approximate_candidate_search` in
+-- `packages/server/src/utils/content-search.ts:1707-1733`. The `search()`
+-- agent tool path threads through there; prod just hasn't called it in
+-- 28h, but a single user-initiated search would now time out at 6s and
+-- return empty results without those indexes (`content-search.ts:1850-1863`).
+-- Similarly `idx_events_run_id` backs the "view in memory" filter
+-- (`content-query-filters.ts:197-201`); rare, but a real path.
+--
+-- Keep those four until either (a) the dormant features are removed in
+-- code, or (b) measured prod traffic confirms they're abandoned.
+--
+-- What remains is small but still real write amplification: each kept
+-- INSERT into events updates these btrees. Combined size ~66 MB —
+-- modest reclaim, but zero downside since the underlying queries don't
+-- exist anywhere in the codebase today (verified by grep).
+--
+-- Plain `DROP INDEX` (not CONCURRENTLY) is used because dbmate's
+-- `transaction:false` directive doesn't actually exit the transaction
+-- block against the `pq` driver — see the comment in
+-- 20260426130001_db_integrity_cleanup_concurrent.sql. These 4 indexes
+-- are all small btrees so the ACCESS EXCLUSIVE on `events` during the
+-- drop is sub-second; no operator runbook needed.
+
+DROP INDEX IF EXISTS public.idx_events_entity_ids_occurred_at;
+DROP INDEX IF EXISTS public.idx_events_origin_parent_id;
+DROP INDEX IF EXISTS public.idx_events_thread_lookup;
+DROP INDEX IF EXISTS public.idx_events_type;
+
+-- migrate:down
+
+CREATE INDEX IF NOT EXISTS idx_events_entity_ids_occurred_at
+    ON public.events USING btree ((entity_ids[1]), occurred_at DESC, id DESC)
+    WHERE ((entity_ids IS NOT NULL) AND (entity_ids <> '{}'::bigint[]));
+CREATE INDEX IF NOT EXISTS idx_events_origin_parent_id
+    ON public.events USING btree (origin_parent_id);
+CREATE INDEX IF NOT EXISTS idx_events_thread_lookup
+    ON public.events USING btree (origin_parent_id, occurred_at)
+    WHERE (origin_parent_id IS NOT NULL);
+CREATE INDEX IF NOT EXISTS idx_events_type
+    ON public.events USING btree (origin_type) WHERE (origin_type IS NOT NULL);

package/dist/db/migrations/20260517020000_softdelete_orphan_feeds.sql

@@ -0,0 +1,56 @@
+-- migrate:up
+
+-- Soft-delete feeds whose (connector_key, organization_id) has no active
+-- connector_definition row.
+--
+-- Why: the 2026-05-16 audit found feeds 117-155 (and others) referencing
+-- connector_key='website' in orgs that have no active definition for it
+-- (only one org has `website` active; one definition is archived). Every
+-- CheckDueFeeds tick (every minute) tried to materialize a sync run for
+-- these feeds and threw "No active connector definition found for X." —
+-- producing ~380 error logs / minute that masked real signal in stdout.
+--
+-- The app-side code path now warns + skips (no throw) for the same case
+-- so future orphans don't spam logs either. This migration is the one-time
+-- cleanup of the existing data.
+--
+-- Conservative criteria — match exactly the set CheckDueFeeds processes
+-- (so we only soft-delete feeds that actually produce the error stream).
+--   - feed has no pinned_version (= would have looked up connector_definitions)
+--   - feed.deleted_at IS NULL (still considered active)
+--   - feed.status = 'active' (CheckDueFeeds filters on this — see
+--     packages/server/src/scheduled/check-due-feeds.ts:36-43)
+--   - connection.deleted_at IS NULL AND connection.status = 'active' (same)
+--   - NO active connector_definition exists for that (key, organization) pair
+--
+-- Feeds in paused / pending_auth / error / revoked states are left alone
+-- — operators may be mid-recovery on them and they don't contribute to
+-- the error spam (CheckDueFeeds skips them anyway).
+--
+-- The same feed remains recoverable: clearing `deleted_at` + reinstalling
+-- the connector definition for the org restores it.
+
+UPDATE public.feeds f
+SET deleted_at = now()
+FROM public.connections c
+WHERE f.connection_id = c.id
+  AND f.deleted_at IS NULL
+  AND f.pinned_version IS NULL
+  AND f.status = 'active'
+  AND c.deleted_at IS NULL
+  AND c.status = 'active'
+  AND NOT EXISTS (
+    SELECT 1
+    FROM public.connector_definitions cd
+    WHERE cd.key = c.connector_key
+      AND cd.organization_id = f.organization_id
+      AND cd.status = 'active'
+  );
+
+-- migrate:down
+
+-- No-op: re-attaching the orphan feeds would require knowing which were
+-- soft-deleted by this migration vs. by an operator action. The original
+-- error condition is fixed in code; this migration is a one-shot data
+-- cleanup. To recover specific feeds in prod, clear `deleted_at` on the
+-- targeted rows manually and re-install the connector definition.

package/dist/db/migrations/20260517030000_pat_worker_id_binding.sql

@@ -0,0 +1,27 @@
+-- migrate:up
+
+-- Bind PATs minted via /api/me/devices/mint-child-token to a specific
+-- worker_id. Without this, a chrome-extension child PAT could post any
+-- worker_id at /api/workers/poll and register a new device_workers row
+-- under a different platform, bypassing the gateway's capability
+-- authorization. The poll handler now refuses a request whose body's
+-- `worker_id` doesn't match the PAT's bound `worker_id` (when non-NULL).
+--
+-- Legacy PATs (CLI tokens, OAuth-issued bearers via dynamic client
+-- registration on the Mac/iOS bridges) keep worker_id = NULL; the poll
+-- handler treats NULL as "no binding" and lets the body's value pass.
+
+ALTER TABLE public.personal_access_tokens
+  ADD COLUMN IF NOT EXISTS worker_id text;
+
+CREATE INDEX IF NOT EXISTS idx_personal_access_tokens_worker_id
+  ON public.personal_access_tokens (worker_id)
+  WHERE worker_id IS NOT NULL;
+
+COMMENT ON COLUMN public.personal_access_tokens.worker_id IS
+  'Optional binding to a specific device_workers.worker_id. Set by /api/me/devices/mint-child-token. When non-NULL, /api/workers/poll requires the request body''s worker_id to match.';
+
+-- migrate:down
+
+DROP INDEX IF EXISTS public.idx_personal_access_tokens_worker_id;
+ALTER TABLE public.personal_access_tokens DROP COLUMN IF EXISTS worker_id;

package/dist/db/migrations/20260517040000_archive_orphan_watchers.sql

@@ -0,0 +1,30 @@
+-- migrate:up
+
+-- Archive watchers that are flagged `status = 'active'` but have no `agent_id`.
+-- The scheduler (packages/server/src/watchers/automation.ts:469) already
+-- filters them out with `WHERE w.agent_id IS NOT NULL`, so these rows are
+-- zombies — visible in the API, redirect-bounced on the watcher detail
+-- route, never actually executing.
+--
+-- 2026-05-17 prod audit: 28 active orphans across 11 orgs (most originated
+-- from older create paths before `agent_id` was wired in). Archiving them
+-- aligns the stored status with their actual execution state and lets the
+-- `/$owner/watchers/$watcherId` redirect logic stop silently sending users
+-- to /agents.
+--
+-- The write-time guard (this same PR, manage_watchers.ts) rejects new
+-- watcher creates/updates that set a schedule without an agent, so the
+-- orphan set can't grow again.
+
+UPDATE public.watchers
+SET status = 'archived',
+    updated_at = now()
+WHERE status = 'active'
+  AND agent_id IS NULL;
+
+-- migrate:down
+
+-- No-op: this is a one-shot data cleanup. The original rows can be restored
+-- manually if needed by assigning an agent_id and flipping status back to
+-- 'active'; without an agent, status='active' is meaningless to the
+-- scheduler.

package/dist/db/migrations/20260517050000_watcher_agent_id_not_null.sql

@@ -0,0 +1,34 @@
+-- migrate:up
+
+-- Delete every watcher with `agent_id IS NULL` and enforce the column at
+-- the schema level. These rows are leftovers from before the watcher
+-- scheduler required `agent_id` (see watchers/automation.ts:469) — they
+-- couldn't fire and the prior migration 20260517040000 had already
+-- archived the active subset. Their dependent rows (windows, reactions,
+-- versions, classifiers, field feedback) describe runtime state for
+-- watchers that will never execute; ON DELETE CASCADE clears them.
+-- `runs.watcher_id` is ON DELETE SET NULL, so the 21k historical run
+-- records remain — they just lose the watcher linkage.
+--
+-- Application-level guards in manage_watchers.ts (handleCreate +
+-- handleCreateFromVersion) reject new inserts without `agent_id`; the
+-- NOT NULL constraint below is the matching DB-level enforcement so
+-- bypass paths can't reintroduce the zombie state.
+
+DELETE FROM public.watchers WHERE agent_id IS NULL;
+
+ALTER TABLE public.watchers
+  ALTER COLUMN agent_id SET NOT NULL;
+
+-- The existing index is partial (`WHERE agent_id IS NOT NULL`), which is
+-- a tautology once the column is NOT NULL. Replace it with an unconditional
+-- index so explain plans don't show the dead predicate.
+DROP INDEX IF EXISTS public.idx_watchers_agent_id;
+CREATE INDEX idx_watchers_agent_id ON public.watchers USING btree (agent_id);
+
+-- migrate:down
+
+ALTER TABLE public.watchers
+  ALTER COLUMN agent_id DROP NOT NULL;
+
+-- No restoring deleted rows — this is forward-only data cleanup.

package/dist/db/migrations/20260517060000_watcher_schema_additions.sql

@@ -0,0 +1,78 @@
+-- migrate:up
+
+-- Adds the columns needed by the device-aware watcher dispatcher (see
+-- lobu-ai/lobu#798 / #799):
+--
+-- * device_worker_id        — pin a watcher to a specific device worker
+--                              (when its inputs live on that device).
+-- * agent_kind              — overrides the owning agent's default kind for
+--                              this watcher (e.g. "background", "notifier").
+-- * notification_channel    — where firings surface: canvas, OS notification,
+--                              or both.
+-- * notification_priority   — priority class used by the dispatcher's
+--                              interrupt budget.
+-- * min_cooldown_seconds    — minimum seconds between two firings of the
+--                              same watcher (0 = no cooldown).
+-- * last_fired_at           — last time this watcher actually dispatched
+--                              a notification/canvas item.
+--
+-- Also adds device_workers.notification_budget_per_day for the per-device
+-- global interrupt budget. 10/day is a placeholder default; tune later.
+
+ALTER TABLE public.watchers
+  ADD COLUMN device_worker_id uuid REFERENCES public.device_workers(id),
+  ADD COLUMN agent_kind text,
+  ADD COLUMN notification_channel text NOT NULL DEFAULT 'canvas',
+  ADD COLUMN notification_priority text NOT NULL DEFAULT 'normal',
+  ADD COLUMN min_cooldown_seconds integer NOT NULL DEFAULT 0,
+  ADD COLUMN last_fired_at timestamp with time zone;
+
+ALTER TABLE public.watchers
+  ADD CONSTRAINT watchers_notification_channel_check
+    CHECK (notification_channel IN ('canvas', 'notification', 'both'));
+
+ALTER TABLE public.watchers
+  ADD CONSTRAINT watchers_notification_priority_check
+    CHECK (notification_priority IN ('low', 'normal', 'high'));
+
+ALTER TABLE public.watchers
+  ADD CONSTRAINT watchers_min_cooldown_seconds_nonneg
+    CHECK (min_cooldown_seconds >= 0);
+
+CREATE INDEX IF NOT EXISTS idx_watchers_device_worker_id
+  ON public.watchers (device_worker_id)
+  WHERE device_worker_id IS NOT NULL;
+
+ALTER TABLE public.device_workers
+  ADD COLUMN notification_budget_per_day integer NOT NULL DEFAULT 10;
+
+ALTER TABLE public.device_workers
+  ADD CONSTRAINT device_workers_notification_budget_per_day_nonneg
+    CHECK (notification_budget_per_day >= 0);
+
+-- migrate:down
+
+ALTER TABLE public.device_workers
+  DROP CONSTRAINT IF EXISTS device_workers_notification_budget_per_day_nonneg;
+
+ALTER TABLE public.device_workers
+  DROP COLUMN IF EXISTS notification_budget_per_day;
+
+DROP INDEX IF EXISTS public.idx_watchers_device_worker_id;
+
+ALTER TABLE public.watchers
+  DROP CONSTRAINT IF EXISTS watchers_min_cooldown_seconds_nonneg;
+
+ALTER TABLE public.watchers
+  DROP CONSTRAINT IF EXISTS watchers_notification_priority_check;
+
+ALTER TABLE public.watchers
+  DROP CONSTRAINT IF EXISTS watchers_notification_channel_check;
+
+ALTER TABLE public.watchers
+  DROP COLUMN IF EXISTS last_fired_at,
+  DROP COLUMN IF EXISTS min_cooldown_seconds,
+  DROP COLUMN IF EXISTS notification_priority,
+  DROP COLUMN IF EXISTS notification_channel,
+  DROP COLUMN IF EXISTS agent_kind,
+  DROP COLUMN IF EXISTS device_worker_id;

package/dist/db/migrations/20260517150000_goals_primitive.sql

@@ -0,0 +1,55 @@
+-- migrate:up
+
+-- Goals primitive — a top-level handle that groups watchers under a single
+-- user-facing intent (e.g. "Keep my CRM clean", "Watch competitors"). Each
+-- watcher may optionally point at a goal; goals are the surface the
+-- canvas/UI (#801) hangs off, while watchers stay the executable unit.
+--
+-- Schema notes:
+-- - organization_id is `text` (the better-auth `organization.id`) to match
+--   the rest of the schema; the issue body called it `integer`, but every
+--   other org-scoped table (watchers, feeds, connections, …) uses text.
+-- - `(organization_id, slug)` is unique so `lobu apply` can upsert by slug
+--   the same way it does for watchers/agents.
+-- - Goal-template loading from YAML is out of scope here; `template_key`
+--   is just a free-form pointer for the future loader to claim.
+-- - `metadata` is jsonb for forward-compat (icon, color, owner, etc.)
+--   without another migration each time the UI grows a knob.
+
+CREATE TABLE public.goals (
+    id              bigserial PRIMARY KEY,
+    organization_id text NOT NULL REFERENCES public.organization(id) ON DELETE CASCADE,
+    slug            text NOT NULL,
+    name            text NOT NULL,
+    description     text,
+    status          text NOT NULL DEFAULT 'active',
+    template_key    text,
+    metadata        jsonb NOT NULL DEFAULT '{}'::jsonb,
+    created_at      timestamp with time zone NOT NULL DEFAULT now(),
+    updated_at      timestamp with time zone NOT NULL DEFAULT now(),
+
+    CONSTRAINT goals_status_check
+        CHECK (status IN ('active', 'paused', 'archived')),
+    CONSTRAINT goals_org_slug_unique
+        UNIQUE (organization_id, slug)
+);
+
+CREATE INDEX idx_goals_organization_id
+    ON public.goals (organization_id);
+
+-- Watcher → goal link. NULL means "ungrouped" (today's behavior). ON DELETE
+-- SET NULL keeps the watcher alive when its goal is archived/deleted; the
+-- watcher just becomes ungrouped.
+ALTER TABLE public.watchers
+    ADD COLUMN goal_id bigint REFERENCES public.goals(id) ON DELETE SET NULL;
+
+CREATE INDEX idx_watchers_goal_id
+    ON public.watchers (goal_id)
+    WHERE goal_id IS NOT NULL;
+
+-- migrate:down
+
+ALTER TABLE public.watchers
+    DROP COLUMN IF EXISTS goal_id;
+
+DROP TABLE IF EXISTS public.goals;

package/dist/db/migrations/20260517160000_drop_goals_primitive.sql

@@ -0,0 +1,45 @@
+-- migrate:up
+
+-- Revert the goals primitive added in 20260517150000_goals_primitive.sql.
+-- Agents already encapsulate the watcher-grouping use case via
+-- watchers.agent_id; goals were a redundant nullable FK + parallel CRUD with
+-- zero behavioral value. The primitive never shipped in a release.
+
+DROP INDEX IF EXISTS idx_watchers_goal_id;
+
+ALTER TABLE public.watchers
+    DROP COLUMN IF EXISTS goal_id;
+
+DROP INDEX IF EXISTS idx_goals_organization_id;
+
+DROP TABLE IF EXISTS public.goals;
+
+-- migrate:down
+
+CREATE TABLE public.goals (
+    id              bigserial PRIMARY KEY,
+    organization_id text NOT NULL REFERENCES public.organization(id) ON DELETE CASCADE,
+    slug            text NOT NULL,
+    name            text NOT NULL,
+    description     text,
+    status          text NOT NULL DEFAULT 'active',
+    template_key    text,
+    metadata        jsonb NOT NULL DEFAULT '{}'::jsonb,
+    created_at      timestamp with time zone NOT NULL DEFAULT now(),
+    updated_at      timestamp with time zone NOT NULL DEFAULT now(),
+
+    CONSTRAINT goals_status_check
+        CHECK (status IN ('active', 'paused', 'archived')),
+    CONSTRAINT goals_org_slug_unique
+        UNIQUE (organization_id, slug)
+);
+
+CREATE INDEX idx_goals_organization_id
+    ON public.goals (organization_id);
+
+ALTER TABLE public.watchers
+    ADD COLUMN goal_id bigint REFERENCES public.goals(id) ON DELETE SET NULL;
+
+CREATE INDEX idx_watchers_goal_id
+    ON public.watchers (goal_id)
+    WHERE goal_id IS NOT NULL;