@rubytech/create-sitedesk-code 0.1.340

package/payload/platform/neo4j/schema.cypher

@@ -0,0 +1,2041 @@
+// ============================================================
+// Maxy Phase 0 — Neo4j Graph Schema
+// Schema.org compliant node types
+// ============================================================
+//
+// This file declares INDEXES and CONSTRAINTS only. The legal
+// (sourceLabel, EDGE_TYPE, targetLabel) triples for the typed-edge
+// auto-extraction pass (Task 305) live in
+// `platform/plugins/memory/mcp/src/lib/typed-edge-schema.ts`
+// as the TYPED_EDGE_ALLOWLIST constant. The Haiku prompt, the inline
+// validator, and the public docs are all generated from that one
+// constant; do not duplicate the enumeration here.
+
+// ----------------------------------------------------------
+// Constraints
+// ----------------------------------------------------------
+
+// Person.email must be unique across all Person nodes.
+// Allows multiple nulls — phone-only contacts are not affected.
+CREATE CONSTRAINT person_email_unique IF NOT EXISTS
+FOR (p:Person) REQUIRE p.email IS UNIQUE;
+
+// Person.telephone must be unique (phone-first channels: WhatsApp, SMS, Telegram)
+// Allows multiple nulls — email-only contacts are not affected.
+CREATE CONSTRAINT person_telephone_unique IF NOT EXISTS
+FOR (p:Person) REQUIRE p.telephone IS UNIQUE;
+
+// Service.serviceId must be unique within the Maxy account
+CREATE CONSTRAINT service_id_unique IF NOT EXISTS
+FOR (s:Service) REQUIRE s.serviceId IS UNIQUE;
+
+// LocalBusiness.accountId must be unique
+CREATE CONSTRAINT local_business_account_unique IF NOT EXISTS
+FOR (b:LocalBusiness) REQUIRE b.accountId IS UNIQUE;
+
+// ----------------------------------------------------------
+// accountId enforcement — multi-tenancy boundary
+// Property existence constraints (IS NOT NULL) require Neo4j
+// Enterprise Edition. Community Edition enforces accountId via
+// the memory-write MCP tool (injects accountId at write time)
+// and agent schema reference files.
+// Drop any leftover existence constraints from prior seeds.
+// ----------------------------------------------------------
+DROP CONSTRAINT person_account_id_exists IF EXISTS;
+DROP CONSTRAINT order_account_id_exists IF EXISTS;
+DROP CONSTRAINT invoice_account_id_exists IF EXISTS;
+DROP CONSTRAINT event_account_id_exists IF EXISTS;
+DROP CONSTRAINT service_account_id_exists IF EXISTS;
+DROP CONSTRAINT task_account_id_exists IF EXISTS;
+
+// ----------------------------------------------------------
+// Indexes
+// ----------------------------------------------------------
+
+// LocalBusiness.businessType — determines which vertical schema to load
+CREATE INDEX local_business_type IF NOT EXISTS
+FOR (b:LocalBusiness) ON (b.businessType);
+
+// Question (schema:Question) — FAQ/Q&A nodes
+CREATE INDEX question_category IF NOT EXISTS
+FOR (q:Question) ON (q.category);
+
+// DefinedTerm (schema:DefinedTerm) — product feature/capability descriptions
+CREATE INDEX defined_term_category IF NOT EXISTS
+FOR (d:DefinedTerm) ON (d.category);
+
+CREATE INDEX person_status IF NOT EXISTS
+FOR (p:Person) ON (p.status);
+
+// Review (schema:Review) — competitor comparison assessments
+CREATE INDEX review_item_reviewed IF NOT EXISTS
+FOR (r:Review) ON (r.itemReviewed);
+
+// ----------------------------------------------------------
+// Vector indexes — dimensions configurable at install time (default: 768 for nomic-embed-text).
+// seed-neo4j.sh substitutes the dimension value from EMBED_DIMENSIONS env var.
+// HNSW algorithm for approximate nearest-neighbour search.
+// ----------------------------------------------------------
+
+// One vector index per label that participates in semantic search.
+// memory-search queries the index matching the label filter,
+// or queries all indexes when no label filter is given.
+
+CREATE VECTOR INDEX question_embedding IF NOT EXISTS
+FOR (q:Question) ON (q.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE VECTOR INDEX defined_term_embedding IF NOT EXISTS
+FOR (d:DefinedTerm) ON (d.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE VECTOR INDEX review_embedding IF NOT EXISTS
+FOR (r:Review) ON (r.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE VECTOR INDEX service_embedding IF NOT EXISTS
+FOR (s:Service) ON (s.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE VECTOR INDEX person_embedding IF NOT EXISTS
+FOR (p:Person) ON (p.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE VECTOR INDEX business_embedding IF NOT EXISTS
+FOR (b:LocalBusiness) ON (b.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// :Organization carries `embedding` from the ingest writer
+// (memory-ingest.ts writeRelatedNode). Pre-Task-483 no vector index
+// existed, so hybrid() fell through to BM25-only for Organization-only
+// queries (Task 478 made that fallback honest). The index restores
+// semantic-similarity ranking parity with the other identity labels —
+// a query like "the company that does antimicrobial coatings" surfaces
+// BioSymm via cosine similarity rather than relying on literal BM25
+// token matching. Neo4j populates the index against existing rows on
+// CREATE; no manual reindex required.
+CREATE VECTOR INDEX organization_embedding IF NOT EXISTS
+FOR (o:Organization) ON (o.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE VECTOR INDEX price_embedding IF NOT EXISTS
+FOR (p:PriceSpecification) ON (p.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// Task node — graph-backed task management (Phase 0)
+// Schema.org: schema:Action (semantic mapping; label stays Task)
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT task_id_unique IF NOT EXISTS
+FOR (t:Task) REQUIRE t.taskId IS UNIQUE;
+
+CREATE INDEX task_status IF NOT EXISTS
+FOR (t:Task) ON (t.status);
+
+CREATE INDEX task_account IF NOT EXISTS
+FOR (t:Task) ON (t.accountId);
+
+CREATE VECTOR INDEX task_embedding IF NOT EXISTS
+FOR (t:Task) ON (t.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// CreativeWork node — agent-authored documents (session summaries etc.)
+// Schema.org: schema.org/CreativeWork
+// Session summaries use `abstract` (schema.org/abstract) for the briefing text
+// and `title` (schema.org/name) for a human-readable label.
+// Written by the admin agent during context compaction via session-compact.
+// ----------------------------------------------------------
+
+CREATE VECTOR INDEX creative_work_embedding IF NOT EXISTS
+FOR (c:CreativeWork) ON (c.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// DigitalDocument node — uploaded files ingested into the graph
+// Schema.org: schema.org/DigitalDocument (subtype of CreativeWork)
+// Written by the document-specialist via document-ingest tool
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT digital_document_id_unique IF NOT EXISTS
+FOR (d:DigitalDocument) REQUIRE d.attachmentId IS UNIQUE;
+
+CREATE INDEX digital_document_account IF NOT EXISTS
+FOR (d:DigitalDocument) ON (d.accountId);
+
+CREATE INDEX digital_document_encoding_format IF NOT EXISTS
+FOR (d:DigitalDocument) ON (d.encodingFormat);
+
+CREATE VECTOR INDEX digital_document_embedding IF NOT EXISTS
+FOR (d:DigitalDocument) ON (d.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// KnowledgeDocument / ConversationArchive / Section — two parent labels,
+// one Section child shape.
+//
+// Pre-Task-397 a single `:KnowledgeDocument` label served both narrative
+// documents (`attachmentId`-keyed) and conversation transcripts
+// (`conversationIdentity`-keyed). The shared ingestion treatment
+// (sessionising + Haiku classify + :Section + :NEXT) does not justify a
+// shared label — a WhatsApp export is a transcript, not a knowledge
+// document. Task 397 split the conversation path off into its own
+// `:ConversationArchive` parent; `:KnowledgeDocument` continues to mean
+// narrative documents only (PDF/web/Obsidian/Notion/contract attachment).
+// Email threads moved onto `:ConversationArchive {source:'email'}` in
+// Task 426.
+//
+// KnowledgeDocument   -[HAS_SECTION]-> Section
+// KnowledgeDocument   -[PARTY]-> (Person|Organization)        (contracts only)
+// KnowledgeDocument   -[REFERENCES]-> (any entity)            (legacy; no new writes)
+//
+// ConversationArchive -[HAS_SECTION]-> Section
+// ConversationArchive <-[PARTICIPANT_IN]- (Person|AdminUser)
+// Section             -[NEXT]-> Section                       (reading-order chain)
+//
+// Two writer paths (see platform/plugins/memory/mcp/src/tools/memory-ingest.ts):
+//   - Document path — MERGE :KnowledgeDocument keyed on `attachmentId`
+//     (URL, file path, obsidian page, contract attachment, etc.).
+//     First-ingest re-writes sections per run; anchor edges to subject
+//     nodes; orphan-candidate related entities.
+//   - Conversation path — MERGE :ConversationArchive keyed on
+//     `conversationIdentity` (= sha256(accountId + ":" +
+//     sortedParticipantElementIds)). Source-agnostic across WhatsApp,
+//     Telegram, Signal, LinkedIn DMs, Zoom transcript, meeting minutes,
+//     iMessage, Slack, Granola, Otter, Circleback — `source` is a property
+//     on the parent, not a separate label. Delta-append after cursor
+//     lookup; :PARTICIPANT_IN edges from each operator-confirmed sender; no
+//     anchor / orphan-related discovery.
+//
+// Every classified section is one :Section node. Recognised kinds carry a
+// secondary label (Section:Position, Section:Education, Section:Chapter,
+// Section:Parties, Section:Other, etc.) — anchor edges from the document
+// subject (UserProfile/LocalBusiness) point at the multi-labeled node
+// directly. The :Chunk overflow level is gone; sections store their body
+// inline.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT knowledge_doc_id_unique IF NOT EXISTS
+FOR (k:KnowledgeDocument) REQUIRE k.attachmentId IS UNIQUE;
+
+CREATE INDEX knowledge_doc_account IF NOT EXISTS
+FOR (k:KnowledgeDocument) ON (k.accountId);
+
+// sourceUrl — lookup index for duplicate detection when re-ingesting a URL.
+// Not unique: user may re-ingest the same URL to get updated content.
+CREATE INDEX knowledge_doc_source_url IF NOT EXISTS
+FOR (k:KnowledgeDocument) ON (k.sourceUrl);
+
+// obsidianPath — natural key for vault pages MERGEd by the obsidian-import
+// plugin. Per-account by composing accountId in the MERGE pattern; the index
+// here speeds up the lookup on re-imports for the idempotency check.
+CREATE INDEX knowledge_doc_obsidian_path IF NOT EXISTS
+FOR (k:KnowledgeDocument) ON (k.obsidianPath);
+
+CREATE VECTOR INDEX knowledge_doc_embedding IF NOT EXISTS
+FOR (k:KnowledgeDocument) ON (k.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ConversationArchive — conversation-transcript parent (Task 397).
+// MERGE-keyed on conversationIdentity (sha256 over accountId +
+// sortedParticipantElementIds). Per-account by composition.
+
+CREATE CONSTRAINT conversation_archive_identity_unique IF NOT EXISTS
+FOR (c:ConversationArchive) REQUIRE c.conversationIdentity IS UNIQUE;
+
+CREATE INDEX conversation_archive_account IF NOT EXISTS
+FOR (c:ConversationArchive) ON (c.accountId);
+
+// (accountId, source) — used by the conversation-archive writer to look up
+// "every conversation from this source for this account" without scanning
+// the full label population.
+CREATE INDEX conversation_archive_account_source IF NOT EXISTS
+FOR (c:ConversationArchive) ON (c.accountId, c.source);
+
+CREATE VECTOR INDEX conversation_archive_embedding IF NOT EXISTS
+FOR (c:ConversationArchive) ON (c.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// Task 397 migration — relabel pre-split conversation-document parents.
+//   Pass 1 — live nodes carrying conversationIdentity directly.
+//   Pass 2 — trashed nodes whose conversationIdentity was snapshotted into
+//            `_trashedKeys` (a JSON-stringified key→value map) and nulled on
+//            the live property by graph-trash. Match by string CONTAINS on
+//            the JSON key name; only legacy conversation-document parents
+//            have that key in the snapshot.
+// Idempotent: both passes filter via WHERE so re-runs on already-relabelled
+// nodes are no-ops.
+MATCH (k:KnowledgeDocument) WHERE k.conversationIdentity IS NOT NULL
+SET k:ConversationArchive REMOVE k:KnowledgeDocument;
+
+MATCH (k:KnowledgeDocument) WHERE k:Trashed
+  AND k._trashedKeys IS NOT NULL
+  AND k._trashedKeys CONTAINS 'conversationIdentity'
+SET k:ConversationArchive REMOVE k:KnowledgeDocument;
+
+// Drop legacy :KnowledgeDocument indexes/constraints that are now owned by
+// :ConversationArchive. IF EXISTS so fresh installs (where the legacy
+// constraint was never created) are no-ops.
+DROP CONSTRAINT knowledge_doc_conversation_identity_unique IF EXISTS;
+DROP INDEX knowledge_doc_account_source IF EXISTS;
+
+CREATE VECTOR INDEX section_embedding IF NOT EXISTS
+FOR (s:Section) ON (s.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// earlier:Chunk vector index — kept for backwards compatibility with
+// Sections written before the writer rewrite. New ingests do not produce
+// :Chunk nodes; the index becomes inert once landfill is purged.
+CREATE VECTOR INDEX chunk_embedding IF NOT EXISTS
+FOR (c:Chunk) ON (c.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// Universal full-text BM25 index for hybrid keyword search.
+//
+// Every operator-meaningful label written by the platform is in the index union;
+// every textual property a writer assigns is in the property union. Neo4j silently
+// ignores absent properties on a given label, so over-inclusion is harmless.
+//
+// **Doctrine.** Search is "find any node in my graph that mentions this term" —
+// not "find a knowledge document". Pre-Task-748 the index name `knowledge_fulltext`
+// covered only `KnowledgeDocument | Section | Chunk` (3 of ~40 written labels), so
+// BM25 silently returned zero hits for Person/Organization/Task/Conversation/etc.
+// regardless of query. Universal coverage is the doctrine; the doctrine test at
+// `platform/lib/graph-search/src/__tests__/fulltext-coverage.test.ts` parses this
+// declaration and asserts label-set ⊇ union(GRAPH_LABEL_COLOURS, schema-declared)
+// so future label additions cannot silently re-narrow.
+//
+// Label union — every operator-meaningful label:
+//   - Business identity: LocalBusiness, Service, PriceSpecification, OpeningHoursSpecification, Organization
+//   - Estate-agent ontology (Task 358): Listing, Property, Viewing, Offer, PostalAddress
+//   - People: Person, UserProfile, Preference, AdminUser, AccessGrant
+//   - Knowledge: KnowledgeDocument, ConversationArchive (Task 397), Section, Chunk (legacy),
+//     DigitalDocument, CreativeWork, Question, FAQPage, DefinedTerm, Review, ImageObject
+//   - Conversational: Conversation, AdminConversation, PublicConversation, Message,
+//     UserMessage, AssistantMessage, ToolCall
+//   - Tasks/projects/events: Task, Project, Event, Meeting, Attachment
+//   - Workflows: Workflow, WorkflowStep, WorkflowRun, StepResult
+//   - Email: EmailAccount (config node only — email threads land on
+//     :ConversationArchive {source:'email'} since Task 426)
+//   - CV/career sublabels: Position, Credential
+//   - Public agents: Agent (projection of file-based public agents)
+//   - Ideas + concepts: Idea, Concept (admin-twin compiledTruth subjects)
+//   - Voice mirror (Task 356): VoiceProfile, VoiceEdit
+//   - Authored content / audit: SocialPost, AEOAudit, Page
+//   - Compiled truth (Task 306/391/392): TimelineEvent, CompiledTruthRevision,
+//     Report, OrphanCandidate, CitationProposal
+//
+// Excluded by design (carry no operator-meaningful free text, asserted by
+// the doctrine test's EXCLUDED_FROM_INDEX set):
+//   - Trashed, GraphPreference                            — system flags / UI metadata
+//   - Email (legacy, retired Task 321; further retired Task 426) — replaced by :ConversationArchive {source:'email'}
+//   - Session, AnonVisitor, PageView, Click,
+//     ScrollMilestone, Recommendation                     — visitor analytics (Task 357)
+//   - Component                                           — admin-resume rehydration JSON
+//   - CloudflareTunnel, CloudflareHostname                — legacy projection (Task 288)
+//
+// Property union — every textual property the schema's writers assign:
+//   - Generic: name, title, summary, body, content, text, description, headline, abstract,
+//     note, label, value, message, preview, tagline
+//   - Person: firstName, lastName, givenName, familyName, email,
+//             currentTitle
+//             LinkedIn imports, since edge properties are invisible to a
+//             node-only fulltext index. `currentTitle` (not `title`) avoids
+//             shadowing :Position.title semantics in cross-label cypher.)
+//   - EmailAccount: agentAddress
+//   - Email-thread KnowledgeDocument: subject, body, messages (JSON) — covered
+//     by the generic body/text/description columns below.
+//   - Credential: authority
+//   - AccessGrant: contactValue
+//   - ToolCall: toolName
+//   - Agent: displayName, slug, role
+//     `displayName` = operator-facing name; `slug` = directory-name identifier;
+//     `role` = discriminator on KnowledgeDocument projections
+//     ('identity'|'soul'|'knowledge'|'knowledge-summary') so BM25 hits surface
+//     which file backed the result. Distinct from Person.role (no shadow).
+// Admin BM25 fulltext index. Task 416 split a single `entity_search` into an
+// admin index plus a public twin (`entity_search_public`) so a public read
+// ranked only against `n.compiledTruthPublic`. Task 654 retired the public twin
+// and its whole read path once public agents became toolless; `entity_search_admin`
+// is now the only fulltext index, carrying `n.compiledTruth`. Both the pre-416
+// single index and the retired public twin keep a permanent `DROP ... IF EXISTS`
+// below so existing deployments stop populating a dead index that consumes disk.
+DROP INDEX entity_search IF EXISTS;
+DROP INDEX entity_search_public IF EXISTS;
+
+// Task 397 added :ConversationArchive to the label union. DROP + recreate the
+// admin index so existing installs pick up new labels without manual reindex;
+// fresh installs no-op the DROP via IF EXISTS.
+DROP INDEX entity_search_admin IF EXISTS;
+
+CREATE FULLTEXT INDEX entity_search_admin IF NOT EXISTS
+FOR (n:LocalBusiness|Service|PriceSpecification|OpeningHoursSpecification|Organization
+    |Listing|Property|Viewing|Offer|PostalAddress
+    |Job|LineItem|Valuation|Milestone|QuoteDocument|VariationNote|InboundInvoice|CheckIn|WhatsAppGroup
+    |Person|UserProfile|Preference|AdminUser|AccessGrant
+    |KnowledgeDocument|ConversationArchive|Section|Chunk|DigitalDocument|CreativeWork|Question|FAQPage|DefinedTerm|Review|ImageObject
+    |Conversation|AdminConversation|PublicConversation|Message|UserMessage|AssistantMessage|ToolCall
+    |Task|Project|Event|Meeting|Attachment
+    |Workflow|WorkflowStep|WorkflowRun|StepResult
+    |EmailAccount
+    |Position|Credential|Agent|Idea|Concept
+    |VoiceProfile|VoiceEdit|SocialPost|AEOAudit|Page
+    |TimelineEvent|CompiledTruthRevision|Report|OrphanCandidate|CitationProposal
+    |Objective|KeyResult|Decision|Risk|Source|Finding|Hypothesis
+    |FileArtifact)
+ON EACH [n.name, n.firstName, n.lastName, n.givenName, n.familyName,
+         n.title, n.currentTitle, n.summary, n.body, n.content, n.text, n.description, n.headline, n.abstract,
+         n.email, n.note, n.label, n.value, n.message, n.preview, n.tagline,
+         n.subject, n.bodyPreview, n.fromName, n.fromAddress, n.agentAddress, n.screeningReason,
+         n.authority, n.contactValue, n.toolName,
+         n.displayName, n.slug, n.role,
+         n.client, n.address, n.supplier, n.clientName,
+         n.statement, n.decision, n.consequences,
+         n.compiledTruth];
+// `compiledTruth` (Task 306) is the authoritative admin-side summary on
+// Person/Company/Concept/Project/LocalBusiness, indexed above. Its customer-facing
+// twin `compiledTruthPublic` (Task 392) is still written, but is no longer
+// fulltext-indexed: the public index it fed was retired with the public read
+// path (Task 654), so no BM25 surface ranks against it.
+
+// Project node — a standalone creative-output node distinct from
+// :Section. Anchored via (:UserProfile)-[:CREATED]->(:Project), with optional
+// (:Project)-[:UNDER]->(:Organization) when the project was done at an org.
+// Written when a CV section classifies as `Project`.
+
+CREATE INDEX project_account IF NOT EXISTS
+FOR (p:Project) ON (p.accountId);
+
+CREATE VECTOR INDEX project_embedding IF NOT EXISTS
+FOR (p:Project) ON (p.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// Position node — a role held by a UserProfile at an Organization.
+// Each role is its own node so it can carry its own title, dates, and
+// achievement bullets. Connected via:
+//   (:UserProfile)-[:HAS_POSITION]->(:Position)-[:AT]->(:Organization)
+// Multiple Positions per UserProfile (career history); one Organization
+// may host many Positions across many UserProfiles. No unique constraint.
+// Written by the document-ingest skill when a CV section classifies as
+// `Position`.
+// ----------------------------------------------------------
+
+CREATE INDEX position_account IF NOT EXISTS
+FOR (p:Position) ON (p.accountId);
+
+CREATE VECTOR INDEX position_embedding IF NOT EXISTS
+FOR (p:Position) ON (p.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// Conversation node — persistent conversation sessions
+// One Conversation per sessionKey. Account scope is encoded by the
+// `accountId` property on the node itself — every read filters by it.
+// Public conversations carry a visitorId (browser cookie) and
+// agentSlug for session resume across page reloads and server restarts.
+// carries a `summary` string denormalised from the first
+// user-role message (first 200 chars, set once, no overwrites) to
+// provide a stable human-identifiable label on the /graph canvas.
+// Conversations that never receive a user message (assistant-only
+// seed, etc.) leave `summary` NULL; the /graph client's pickShortLabel
+// falls back to `Conv <shortId>` so empty conversations stay
+// distinguishable from each other.
+//
+// sublabels. Conversations written later carry one
+// of two sublabels alongside `:Conversation`:
+//   :AdminConversation  — agentType='admin' (operator-facing)
+//   :PublicConversation — agentType='public' (customer-facing)
+// Neo4j labels are set-semantic; the sublabel is added at ON CREATE SET
+// time in `ensureConversation` so the node carries both `:Conversation`
+// and the sublabel. No new constraints — the existing
+// conversation_session_id_unique constraint applies to Conversations
+// regardless of sublabel. The sublabel drives /graph canvas colour
+// resolution and filter popover chips per agentType without schema
+// fragmentation.
+// Pre-Task-633 Conversations stay unlabelled and render in the base
+// :Conversation colour (sublabel backfill is a separate task).
+//
+// Task 429 — kill `conversationId`; `sessionId` is canonical. One-shot
+// migration: copy any legacy `conversationId` property onto `sessionId`
+// and remove the legacy property. Idempotent via WHERE guard: re-runs
+// against already-migrated rows are no-ops. The legacy
+// `conversation_id_unique` constraint is dropped by name; the new
+// uniqueness constraint is `conversation_session_id_unique` on
+// `:Conversation.sessionId` (disambiguated from the :Session
+// constraint that legitimately owns `session_id_unique`).
+// ----------------------------------------------------------
+
+DROP CONSTRAINT conversation_id_unique IF EXISTS;
+
+MATCH (c:Conversation) WHERE c.conversationId IS NOT NULL
+SET c.sessionId = coalesce(c.sessionId, c.conversationId)
+REMOVE c.conversationId;
+
+CREATE CONSTRAINT conversation_session_id_unique IF NOT EXISTS
+FOR (c:Conversation) REQUIRE c.sessionId IS UNIQUE;
+
+CREATE CONSTRAINT conversation_session_key_unique IF NOT EXISTS
+FOR (c:Conversation) REQUIRE c.sessionKey IS UNIQUE;
+
+CREATE INDEX conversation_account IF NOT EXISTS
+FOR (c:Conversation) ON (c.accountId);
+
+CREATE INDEX conversation_agent_type IF NOT EXISTS
+FOR (c:Conversation) ON (c.agentType);
+
+CREATE INDEX conversation_visitor IF NOT EXISTS
+FOR (c:Conversation) ON (c.visitorId);
+
+CREATE INDEX conversation_user IF NOT EXISTS
+FOR (c:Conversation) ON (c.userId);
+
+CREATE INDEX conversation_group_slug IF NOT EXISTS
+FOR (c:Conversation) ON (c.groupSlug);
+
+CREATE VECTOR INDEX conversation_embedding IF NOT EXISTS
+FOR (c:Conversation) ON (c.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// Message node — individual messages within a Conversation
+// Linked via (Message)-[:PART_OF]->(Conversation) to the parent.
+// Linked via (Message)-[:NEXT]->(Message) to the next message in
+// insertion order. The chain is linear — one outgoing
+// NEXT per message — so a Conversation with N messages has N-1
+// NEXT edges.
+//
+// sublabels. Messages written later carry one of
+// two sublabels alongside `:Message`, derived from `role`:
+//   :UserMessage      — role='user'
+//   :AssistantMessage — role='assistant'
+// system/tool role messages (not written by the current persistMessage
+// path) stay on base `:Message` only. The sublabel is set at CREATE
+// time (`CREATE (m:Message:UserMessage { ... })`) so the node carries
+// both labels atomically. No new constraints — `message_id_unique`
+// below applies to any Message node regardless of sublabel. Pre-Task-633
+// Messages stay unlabelled and render in the base :Message colour.
+//
+// Chain-fork invariant: the write path in
+// platform/ui/app/lib/neo4j-store.ts#persistMessage holds a
+// per-sessionId async mutex around the Cypher that observes
+// the tail and CREATEs the new [:NEXT] edge. Without this, two
+// concurrent writes under READ_COMMITTED both see the same tail
+// and each CREATE an outgoing NEXT → two edges from one node.
+// Scope: single node-process only; multi-replica coordination is
+// a follow-up (see .docs/neo4j.md). Any new write path that creates
+// Message nodes on the chain (bulk import, migration, rehydrate)
+// MUST go through persistMessage or hold an equivalent lock.
+//
+// Vector-indexed for semantic search over conversation history.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT message_id_unique IF NOT EXISTS
+FOR (m:Message) REQUIRE m.messageId IS UNIQUE;
+
+// Message.sessionKey is the canonical conversation pointer.
+// The legacy m.sessionId index stays until the final cutover, after the
+// full code-rename slice lands and no path reads m.sessionId.
+CREATE INDEX message_conversation IF NOT EXISTS
+FOR (m:Message) ON (m.sessionId);
+
+CREATE INDEX message_session_key IF NOT EXISTS
+FOR (m:Message) ON (m.sessionKey);
+
+CREATE VECTOR INDEX message_embedding IF NOT EXISTS
+FOR (m:Message) ON (m.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// Event node — scheduling and calendar (Phase 0)
+// Schema.org: schema:Event
+// One-time events (recurrence null) and recurring triggers
+// (recurrence = cron expression) share the same node type.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT event_id_unique IF NOT EXISTS
+FOR (e:Event) REQUIRE e.eventId IS UNIQUE;
+
+CREATE INDEX event_status IF NOT EXISTS
+FOR (e:Event) ON (e.eventStatus);
+
+CREATE INDEX event_account IF NOT EXISTS
+FOR (e:Event) ON (e.accountId);
+
+CREATE INDEX event_next_run IF NOT EXISTS
+FOR (e:Event) ON (e.nextRun);
+
+CREATE VECTOR INDEX event_embedding IF NOT EXISTS
+FOR (e:Event) ON (e.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// Meeting node — past or future calendar meetings ingested
+// from an .ics archive (scheduling/schedule-archive-ics).
+// Distinct from :Event (which models scheduled triggers /
+// recurring action dispatchers). A :Meeting carries the
+// title, start/end, location, description verbatim from the
+// source VEVENT plus the importing AdminUser's account scope.
+// Attendees are :Person nodes linked via (:Person)-[:ATTENDED]->(:Meeting).
+// ----------------------------------------------------------
+
+// Composite uniqueness so the same UID under two accounts
+// produces two distinct :Meeting nodes. Requires Neo4j 5.7+.
+CREATE CONSTRAINT meeting_account_uid_unique IF NOT EXISTS
+FOR (m:Meeting) REQUIRE (m.accountId, m.uid) IS UNIQUE;
+
+CREATE INDEX meeting_account IF NOT EXISTS
+FOR (m:Meeting) ON (m.accountId);
+
+CREATE INDEX meeting_starts_at IF NOT EXISTS
+FOR (m:Meeting) ON (m.startsAt);
+
+// ----------------------------------------------------------
+// Workflow node — persistent named workflows with structured
+// executable steps. Each workflow has WorkflowStep children
+// for validated, machine-executable step definitions.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT workflow_id_unique IF NOT EXISTS
+FOR (w:Workflow) REQUIRE w.workflowId IS UNIQUE;
+
+CREATE INDEX workflow_account IF NOT EXISTS
+FOR (w:Workflow) ON (w.accountId);
+
+CREATE INDEX workflow_status IF NOT EXISTS
+FOR (w:Workflow) ON (w.status);
+
+CREATE VECTOR INDEX workflow_embedding IF NOT EXISTS
+FOR (w:Workflow) ON (w.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// WorkflowStep — individual executable steps within a workflow.
+// Each step references a plugin tool with parameter templates.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT workflow_step_id_unique IF NOT EXISTS
+FOR (s:WorkflowStep) REQUIRE s.stepId IS UNIQUE;
+
+CREATE INDEX workflow_step_workflow IF NOT EXISTS
+FOR (s:WorkflowStep) ON (s.workflowId);
+
+CREATE INDEX workflow_step_account IF NOT EXISTS
+FOR (s:WorkflowStep) ON (s.accountId);
+
+// ----------------------------------------------------------
+// WorkflowRun — execution history for a workflow run.
+// Records trigger, status, timing, and context.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT workflow_run_id_unique IF NOT EXISTS
+FOR (r:WorkflowRun) REQUIRE r.runId IS UNIQUE;
+
+CREATE INDEX workflow_run_workflow IF NOT EXISTS
+FOR (r:WorkflowRun) ON (r.workflowId);
+
+CREATE INDEX workflow_run_account IF NOT EXISTS
+FOR (r:WorkflowRun) ON (r.accountId);
+
+// ----------------------------------------------------------
+// StepResult — per-step outcome within a workflow run.
+// ----------------------------------------------------------
+
+CREATE INDEX step_result_run IF NOT EXISTS
+FOR (sr:StepResult) ON (sr.runId);
+
+// ----------------------------------------------------------
+// UserProfile node — structured knowledge about the business owner
+// Platform-native (no Schema.org equivalent). One per (accountId, userId).
+// Linked via (AdminUser)-[:HAS_PROFILE]->(UserProfile). Account scope is
+// encoded by the `accountId` property on the node itself.
+//
+// Created automatically on first admin session start via MERGE.
+// Properties populated progressively through conversation and
+// session-end reflection. Injected into admin system prompt at
+// session start so the agent never starts from zero.
+//
+// No vector index — UserProfile is always queried by (accountId, userId)
+// composite key. Vector search deferred to Phase 1 if multi-account
+// similarity becomes a use case.
+// ----------------------------------------------------------
+
+// Composite unique constraint: one profile per admin per account.
+// Replaces the single-key accountId constraint and the
+// transitional name `user_profile_account_user_unique`
+// for grep parity with the doctrine name in .docs/neo4j.md and the
+// per-bucket dedupe script). Old name dropped in seed-neo4j.sh MIGRATE_EOF.
+CREATE CONSTRAINT user_profile_unique_per_user IF NOT EXISTS
+FOR (up:UserProfile) REQUIRE (up.accountId, up.userId) IS UNIQUE;
+
+// ----------------------------------------------------------
+// Preference node — individual observed or stated user preference
+// Platform-native. Each Preference represents a single preference
+// with confidence scoring and evidence trails.
+//
+// Relationships:
+//   (UserProfile)-[:HAS_PREFERENCE]->(Preference)
+//   (Preference)-[:OBSERVED_IN]->(Conversation)  — evidence trail
+//
+// Categories: communication, scheduling, decision, workflow,
+//             content, interaction
+//
+// Recognised optional properties:
+//   notApplicable (boolean). When `true`, the Preference
+//     records that the user explicitly declared the (category, key)
+//     does not apply to them. Counted as covered for the field-level
+//     Coverage signal in `formatProfileSummary`; filtered from the
+//     user-facing body (no value to render). Immutable on the tool
+//     surface (`profile-update` rejects mode merge|contradict). Always
+//     written with confidence: 1.0. No constraint, no index — the
+//     read query in loadUserProfile / profile-read widens the WHERE
+//     to include `OR pref.notApplicable = true`.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT preference_id_unique IF NOT EXISTS
+FOR (pref:Preference) REQUIRE pref.preferenceId IS UNIQUE;
+
+CREATE INDEX preference_account IF NOT EXISTS
+FOR (pref:Preference) ON (pref.accountId);
+
+CREATE INDEX preference_user IF NOT EXISTS
+FOR (pref:Preference) ON (pref.accountId, pref.userId);
+
+CREATE INDEX preference_category IF NOT EXISTS
+FOR (pref:Preference) ON (pref.accountId, pref.userId, pref.category);
+
+CREATE VECTOR INDEX preference_embedding IF NOT EXISTS
+FOR (pref:Preference) ON (pref.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// EmailAccount — managed by the email plugin (credentials.ts)
+// Created via MERGE by email-setup. Properties:
+//   accountId, email, agentAddress, imapHost, imapPort,
+//   imapSecurity, smtpHost, smtpPort, smtpSecurity, updatedAt
+//
+// Poll state (written by email-ingest after each successful fetch):
+//   agentSlug, pollIntervalMinutes, lastFetchedUid, lastPollAt,
+//   uidValidity
+// ----------------------------------------------------------
+
+// ----------------------------------------------------------
+// Email threads — :ConversationArchive {source:'email'}
+//
+// Task 426 retargeted email threads off :KnowledgeDocument onto the
+// conversation-archive pipeline. The email plugin's email-ingest tool
+// dispatches `conversation-archive-ingest.sh --source email` once per
+// thread; each invocation MERGEs one :ConversationArchive
+// (conversationIdentity-keyed, source-scoped) and writes :Section
+// chunks via :HAS_SECTION + :NEXT.
+//
+// No email-specific constraints or indexes are declared. The general
+// ConversationArchive constraints + indexes (above) cover uniqueness,
+// accountId lookup, and Section embedding search. Email-specific
+// filtering (source='email') uses the generic accountId + source path.
+// ----------------------------------------------------------
+
+// ----------------------------------------------------------
+// AccessGrant node — per-agent, time-bound access credentials
+// Platform-native. Each AccessGrant represents a single
+// person's access to a single gated public agent.
+//
+// Relationships:
+//   (Person)-[:HAS_ACCESS]->(AccessGrant)
+//
+// One Person can have multiple AccessGrants (different agents,
+// different time windows). Grants are created by the admin
+// agent via memory-write and consumed by the access gate API.
+//
+// No vector index — AccessGrant is always queried
+// deterministically (by token, by contact+agent, by status).
+// ----------------------------------------------------------
+
+// Composite uniqueness: one grant per contact+agent+account.
+// Prevents duplicate invitations for the same person to the
+// same agent. Also serves as a lookup index for login.
+CREATE CONSTRAINT access_grant_unique IF NOT EXISTS
+FOR (ag:AccessGrant) REQUIRE (ag.contactValue, ag.agentSlug, ag.accountId) IS UNIQUE;
+
+// Magic link token lookup — one-time use tokens for email invitations.
+CREATE INDEX access_grant_token IF NOT EXISTS
+FOR (ag:AccessGrant) ON (ag.magicToken);
+
+// Status filtering — admin listing of active/expired/revoked grants.
+CREATE INDEX access_grant_status IF NOT EXISTS
+FOR (ag:AccessGrant) ON (ag.status);
+
+// Slice token (Task 485) — per-visitor ringfence key for gated public agents.
+// Indexed on AccessGrant for revoke-eviction lookups and on every label that
+// the session-end reviewer writes through (via database-operator), so
+// memory-search can filter `n.sliceToken = $sliceToken OR n.scope = "public"`
+// without a label scan. New labels added to the reviewer's surface gain a
+// twin index here.
+CREATE INDEX access_grant_slice_token IF NOT EXISTS
+FOR (ag:AccessGrant) ON (ag.sliceToken);
+
+CREATE INDEX person_slice_token IF NOT EXISTS
+FOR (n:Person) ON (n.sliceToken);
+
+CREATE INDEX preference_slice_token IF NOT EXISTS
+FOR (n:Preference) ON (n.sliceToken);
+
+CREATE INDEX idea_slice_token IF NOT EXISTS
+FOR (n:Idea) ON (n.sliceToken);
+
+// ----------------------------------------------------------
+// Agent node — projection of file-based public agents
+//
+// Source of truth remains the filesystem: accountDir/agents/<slug>/
+// {config.json, IDENTITY.md, SOUL.md, KNOWLEDGE.md, KNOWLEDGE-SUMMARY.md}.
+// The Agent node is a graph projection so operators can see, on /graph,
+// which public agents exist, what knowledge they have access to, and
+// which conversations they have handled. Re-running the projector
+// is idempotent and never mutates the on-disk files.
+//
+// Properties (mirrored from config.json + filesystem mtime):
+//   slug              — directory name; immutable identifier within an account
+//   displayName       — operator-facing name from config.json
+//   status            — 'active' | 'inactive' | <other> per config.json
+//   model             — Anthropic model id used by the public agent
+//   knowledgeKeywords — string[] used by update-knowledge to broaden the
+//                       refresh query alongside operator-tagged nodes
+//   role              — always 'agent' (mirrors KnowledgeDocument.role
+//                       discriminator; surfaces in BM25 hits)
+//   createdAt         — ISO 8601, set on first projection
+//   updatedAt         — ISO 8601, set on every projection
+//
+// Owned KnowledgeDocument projections (deleted on agent delete):
+//   (Agent)-[:HAS_IDENTITY]->(:KnowledgeDocument {role:'identity'})
+//   (Agent)-[:HAS_SOUL    ]->(:KnowledgeDocument {role:'soul'})
+//   (Agent)-[:HAS_KNOWLEDGE]->(:KnowledgeDocument {role:'knowledge'})
+//   (Agent)-[:HAS_KNOWLEDGE]->(:KnowledgeDocument {role:'knowledge-summary'})
+// attachmentId is namespaced as "agent:<accountId>:<slug>:<role>" so the
+// projection reuses the existing knowledge_doc_id_unique constraint without
+// a parallel uniqueness scheme. The accountId segment is load-bearing —
+// without it, two accounts with the same agent slug would collide on the
+// global unique constraint and the second projection would silently
+// re-parent the first account's doc via the MERGE+SET path. Account
+// isolation is doctrine.
+//
+// Operator-tagged docs (NOT deleted on agent delete — only edges removed):
+//   (Agent)-[:USES_KNOWLEDGE]->(:KnowledgeDocument)
+// where slug ∈ KnowledgeDocument.agents. Materialised at projection time
+// only; the runtime memory-search path continues to read k.agents directly,
+// so a doc tagged after the last projection becomes graph-visible at the
+// next re-projection but is reachable at runtime immediately. The runtime
+// path is unchanged — see [public-agent.ts:130-160].
+//
+// Conversation→Agent edge (written by ensureConversation when
+// agentType='public' and agentSlug is set):
+//   (Conversation)-[:HANDLED_BY]->(Agent)
+// OPTIONAL MATCH on the Agent so a public conversation with an orphan
+// slug still writes (single `[agent-graph] handled-by-skip` log line).
+//
+// Composite uniqueness: one Agent per (accountId, slug) — the directory
+// name is the natural key within an account, slugs collide across
+// accounts and that's allowed.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT agent_account_slug_unique IF NOT EXISTS
+FOR (a:Agent) REQUIRE (a.accountId, a.slug) IS UNIQUE;
+
+CREATE INDEX agent_account IF NOT EXISTS
+FOR (a:Agent) ON (a.accountId);
+
+// ----------------------------------------------------------
+// AdminUser node — device-level admin identity
+// Platform-native. Represents a human who administers one or
+// more accounts via the admin agent. Exists at the device level
+// (not account-scoped). Linked to accounts via ADMIN_OF.
+//
+// Properties:
+//   userId     — UUID, matches entry in ~/<brand.configDir>/users.json (earlier path was platform/config/users.json)
+//   name       — display name (e.g. "Adam")
+//   createdAt  — ISO 8601 timestamp
+//
+// Relationships:
+//   (AdminUser)-[:ADMIN_OF {role, grantedAt}]->(LocalBusiness)
+//   role: "owner" | "admin" — label only, no enforcement
+//   grantedAt: ISO 8601 timestamp
+//
+// No vector index — AdminUser is always queried deterministically
+// by userId. Semantic search over admin users is not a use case.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT admin_user_id_unique IF NOT EXISTS
+FOR (au:AdminUser) REQUIRE au.userId IS UNIQUE;
+
+// ----------------------------------------------------------
+// GraphPreference — per-(accountId, userId) UI metadata for /graph
+//
+// Carries the operator's persisted default filter view (labels +
+// includeTrashed) so the /graph page opens with the chosen filter
+// applied on next pageload. Never a user-facing node type — hidden
+// from filter chips via HIDDEN_BY_DEFAULT_LABELS.
+//
+// MERGE-keyed on the composite (accountId, userId). No UNIQUE
+// constraint — the composite MERGE keys are idempotent and the
+// preference is UI metadata, not load-bearing data. A constraint
+// would require both keys in a single composite, which Neo4j
+// supports but adds schema surface for no behavioural benefit.
+// ----------------------------------------------------------
+
+CREATE INDEX graph_preference_account_user IF NOT EXISTS
+FOR (p:GraphPreference) ON (p.accountId, p.userId);
+
+// ----------------------------------------------------------
+// ToolCall — durable audit trail for agent tool invocations
+//
+// Every tool_use / tool_result pair parsed from the agent stream
+// produces one ToolCall node linked to the Conversation that
+// triggered it. Workflow-dispatched tool calls (StepResult) are
+// excluded — no duplication.
+//
+// (:Conversation)-[:HAS_TOOL_CALL]->(:ToolCall)
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT tool_call_id_unique IF NOT EXISTS
+FOR (tc:ToolCall) REQUIRE tc.callId IS UNIQUE;
+
+CREATE INDEX tool_call_account_started IF NOT EXISTS
+FOR (tc:ToolCall) ON (tc.accountId, tc.startedAt);
+
+// ----------------------------------------------------------
+// Component admin-resume rehydration.
+//
+// Each legacy component event emitted on an assistant turn (pre-066
+// admin agent surface only) produced one Component node linked to its
+// parent Message via (Message)-[:HAS_COMPONENT]->(Component). New
+// conversations never write to this table; the rehydration path keeps
+// the rows in place so historical conversations replay intact. The
+// agent's narrative
+// text stays on Message.content; component name + data JSON +
+// position-relative-to-text live here. Sibling-node design (not
+// JSON-on-Message) avoids Neo4j's 128KB property soft-limit when
+// document-editor bodies are large.
+//
+// Atomicity: persisted in the same Cypher transaction as the
+// parent Message — no orphan Component possible. Reader is a
+// single round-trip via OPTIONAL MATCH + collect (sort-before-
+// collect: WITH m, c ORDER BY c.ordinal ASC, then collect).
+//
+// Properties:
+//   componentId  — UUID, primary key
+//   sessionId / accountId / messageId — denormalised for
+//     account-scoped reads and cross-account isolation audits
+//   name         — component name (document-editor, action-buttons,
+//                   single-select, etc.)
+//   data         — JSON-encoded payload string. Validated structurally
+//                   on read (parseable, non-null object); per-component
+//                   schema validation lives in validateComponentData.
+//   ordinal      — 0-indexed sequence within the parent Message,
+//                   tiebreak for components with the same textOffset.
+//   textOffset   — length of Message.content at the moment this
+//                   component arrived in the SSE stream. Reader uses
+//                   it to interleave text-runs and components when
+//                   reconstructing events: AdminEvent[].
+//   submitted    — true once a PERSISTENT_COMPONENT (action-list,
+//                   document-editor, rich-content-editor, grid-editor)
+//                   was submitted by the user. Server-side detection
+//                   of `_componentDone:true` user turns flips this.
+//   submittedAt  — datetime when submitted=true was set (null otherwise)
+//   createdAt    — datetime when the component was persisted
+//
+// (:Message)-[:HAS_COMPONENT]->(:Component)
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT component_id_unique IF NOT EXISTS
+FOR (c:Component) REQUIRE c.componentId IS UNIQUE;
+
+CREATE INDEX component_message IF NOT EXISTS
+FOR (c:Component) ON (c.messageId);
+
+CREATE INDEX component_account IF NOT EXISTS
+FOR (c:Component) ON (c.accountId);
+
+// ----------------------------------------------------------
+//:Attachment. Sibling node hung off a:Message via
+// [:HAS_ATTACHMENT] capturing user-side file uploads (image, pdf,
+// text/markdown/csv/html, calendar, zip; see attachments.ts
+// SUPPORTED_MIME_TYPES). Mirrors:Component.
+//
+// Properties:
+//   attachmentId   — UUID assigned at storeAttachment time; matches
+//                     the on-disk directory + Neo4j node id.
+//   sessionId — denormalised for filtered scans + cascade delete.
+//   accountId      — account-isolation. Reads MUST scope by this.
+//   messageId      — back-pointer to parent :Message.
+//   filename       — original upload name (kept for chip render).
+//   mimeType       — validated MIME (assertSupportedMime).
+//   sizeBytes      — original byte size at upload.
+//   storagePath    — absolute on-disk path. Server-only — never
+//                     surfaced to the client (chip click resolves
+//                     via attachmentId, not path).
+//   ordinal        — upload-order index within the parent turn (0-based).
+//                     Reader uses it to re-render chips in upload order.
+//   createdAt      — datetime when persisted.
+//
+// (:Message)-[:HAS_ATTACHMENT]->(:Attachment)
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT attachment_id_unique IF NOT EXISTS
+FOR (a:Attachment) REQUIRE a.attachmentId IS UNIQUE;
+
+CREATE INDEX attachment_message IF NOT EXISTS
+FOR (a:Attachment) ON (a.messageId);
+
+CREATE INDEX attachment_account IF NOT EXISTS
+FOR (a:Attachment) ON (a.accountId);
+
+// ----------------------------------------------------------
+//:Trashed soft-delete primitive.
+//
+// Any node soft-deleted via memory-delete / contact-delete carries this
+// label plus trashedAt / trashedBy / trashReason / _trashedKeys properties.
+// memory-empty-trash hard-deletes by `MATCH (n:Trashed) WHERE n.trashedAt < cutoff`,
+// and the trash-census + read-filter probes in memory-search hit the same
+// label. The accountId index supports per-tenant census reads — accountId-as-
+// unique-key labels (LocalBusiness) have their accountId nulled on trash and
+// are missed by accountId-scoped reads, but those are 1-per-account labels
+// and rare in trash.
+// ----------------------------------------------------------
+
+CREATE INDEX trashed_account IF NOT EXISTS
+FOR (n:Trashed) ON (n.accountId);
+
+CREATE INDEX trashed_at IF NOT EXISTS
+FOR (n:Trashed) ON (n.trashedAt);
+
+// ----------------------------------------------------------
+// Person.linkedinUrl — natural key for LinkedIn-origin Persons.
+// Indexed (not uniquely constrained) so a Person can appear
+// first from another source (email-first) and later have its
+// linkedinUrl filled in without collision. Schema-base requires
+// `email or telephone` on :Person, but LinkedIn basic exports
+// rarely emit either for connections; `linkedinUrl` is the
+// reliable dedup key for the linkedin-import skill.
+// ----------------------------------------------------------
+CREATE INDEX person_linkedin_url IF NOT EXISTS
+FOR (p:Person) ON (p.linkedinUrl);
+
+// ----------------------------------------------------------
+// Credential — schema:EducationalOccupationalCredential.
+// Professional certifications (e.g. LinkedIn's Certifications.csv,
+// or credentials entered through memory-write). Natural key is
+// the triple (accountId, name, authority) — a credential is
+// identified by what it is and who issued it, within a tenant.
+// No existing Maxy label covers this semantics, so a new label
+// is warranted (unlike articles → :CreativeWork, recommendations
+// → :Review, skills → :DefinedTerm, which all reuse existing labels).
+// ----------------------------------------------------------
+CREATE CONSTRAINT credential_unique IF NOT EXISTS
+FOR (c:Credential) REQUIRE (c.accountId, c.name, c.authority) IS UNIQUE;
+
+CREATE INDEX credential_account IF NOT EXISTS
+FOR (c:Credential) ON (c.accountId);
+
+// ----------------------------------------------------------
+// Provenance indexes — back the shim's per-write
+// orphan check. the `executeWrite` runs an unanchored
+// `MATCH (n) WHERE n.createdBySession = $autoSession AND
+// n.createdAt >= $autoStartTimestamp AND NOT (n)--()` after
+// every operator write. Without an index this is `AllNodesScan`
+// — sub-millisecond on the current ~10K-node graph, but a
+// per-write tax that grows with graph size.
+//
+// Neo4j 5 property indexes require a label clause; there is no
+// label-free range/text/point index. The orphan check is
+// unanchored, so the planner relies on `UnionNodeByLabelsScan`
+// (Neo4j 5.6+) to combine per-label seeks. If a future EXPLAIN
+// shows `AllNodesScan` despite these indexes, the orphan-check
+// Cypher in `cypher-shim-write.ts` should be anchored with an
+// explicit label union — that's the structural fallback.
+//
+// Coverage: the five labels written most often through the raw
+// Cypher write path (Person, Organization, KnowledgeDocument,
+// Section, Task). Other written labels (Project, Position,
+// Credential, ToolCall, Conversation, etc.) still hit
+// `AllNodesScan` for the orphan check; extending coverage is a
+// separate decision, not a default.
+// ----------------------------------------------------------
+
+CREATE INDEX person_created_by_session IF NOT EXISTS
+FOR (n:Person) ON (n.createdBySession);
+
+CREATE INDEX organization_created_by_session IF NOT EXISTS
+FOR (n:Organization) ON (n.createdBySession);
+
+CREATE INDEX knowledge_doc_created_by_session IF NOT EXISTS
+FOR (n:KnowledgeDocument) ON (n.createdBySession);
+
+CREATE INDEX conversation_archive_created_by_session IF NOT EXISTS
+FOR (n:ConversationArchive) ON (n.createdBySession);
+
+CREATE INDEX section_created_by_session IF NOT EXISTS
+FOR (n:Section) ON (n.createdBySession);
+
+CREATE INDEX task_created_by_session IF NOT EXISTS
+FOR (n:Task) ON (n.createdBySession);
+
+// ----------------------------------------------------------
+// CloudflareTunnel / CloudflareHostname — graph audit of
+// the tunnel-login flow. Historically written by the
+// /api/admin/cloudflare/setup endpoint after setup-tunnel.sh exits 0;
+// after Task 288 (PTY-native cloudflared) both the endpoint and the
+// wrapper script are gone. The constraints below remain so legacy
+// projections stay queryable, but no current writer emits these nodes.
+// Linked via (Task {kind:'cloudflare-tunnel-login'})-[:PRODUCED]->.
+// CloudflareHostname carries the routed FQDN; CloudflareTunnel
+// carries the connector identity. Source of truth remains the on-disk
+// cert.pem + tunnel.state + config.yml — these nodes are the graph
+// projection so operators can MATCH from a Conversation to "which
+// cloudflare resources did this onboarding produce?"
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT cloudflare_tunnel_id_unique IF NOT EXISTS
+FOR (t:CloudflareTunnel) REQUIRE t.tunnelId IS UNIQUE;
+
+CREATE INDEX cloudflare_tunnel_account IF NOT EXISTS
+FOR (t:CloudflareTunnel) ON (t.accountId);
+
+CREATE CONSTRAINT cloudflare_hostname_unique IF NOT EXISTS
+FOR (h:CloudflareHostname) REQUIRE (h.accountId, h.hostnameValue) IS UNIQUE;
+
+CREATE INDEX cloudflare_hostname_account IF NOT EXISTS
+FOR (h:CloudflareHostname) ON (h.accountId);
+
+// ----------------------------------------------------------
+// Estate-agent ontology (Task 358) — Property-centric model
+// documented at platform/plugins/memory/references/schema-estate-agent.md.
+//
+// :Property is the obligatory top-level node: the physical property, with
+// its listing events beneath it. It carries the agency parent edge
+// (:Property)-[:LISTED_BY]->(:Organization {brandSlug}) (the ≥1-adjacency
+// write-gate parent) and (:Property)-[:HAS_LISTING]->(:Listing) to each of
+// its listing events. The pre-inversion (:Listing)-[:FOR_PROPERTY]->(:Property)
+// and (:Listing)-[:LISTED_BY]->(:Organization) edges are retired.
+//
+// These declarations exist primarily so the memory-write validator's
+// parseLabelsFromSchemaCypher() registers each label on a fresh deploy
+// where no node of the label has yet landed — without them, the first
+// :Property/:Listing write from the listing-curator agent is rejected as
+// "unknown label" against an empty db.labels() set.
+//
+// Idempotency contracts mirror schema-estate-agent.md:
+//   :Property                    — (accountId, slug) on the address-normalised
+//                                  slug; the obligatory hub.
+//   :Listing / :Viewing / :Offer — (accountId, sourceSystem, sourceId)
+//   :ImageObject                 — (accountId, listingSlug, url) for the
+//                                  estate-agent variant, (accountId, name,
+//                                  contentUrl) for the brand-asset variant.
+//                                  Because the two writers use different
+//                                  natural keys, only an accountId index is
+//                                  declared at the schema level — uniqueness
+//                                  is enforced at write time by the curator
+//                                  / brand-asset writer's MERGE clause.
+//
+// :Property already carries the account index, the (accountId, slug) unique
+// constraint, and a slot in the entity_search_admin fulltext union (its
+// n.address is in the ON EACH list) — no new index is added for the hub
+// inversion. The marketing embedding stays on :Listing; semantic search
+// targets the listing blurb/description, not the structural hub.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT listing_account_source_unique IF NOT EXISTS
+FOR (l:Listing) REQUIRE (l.accountId, l.sourceSystem, l.sourceId) IS UNIQUE;
+
+CREATE INDEX listing_account IF NOT EXISTS
+FOR (l:Listing) ON (l.accountId);
+
+CREATE INDEX listing_status IF NOT EXISTS
+FOR (l:Listing) ON (l.status);
+
+CREATE INDEX listing_type IF NOT EXISTS
+FOR (l:Listing) ON (l.listingType);
+
+CREATE VECTOR INDEX listing_embedding IF NOT EXISTS
+FOR (l:Listing) ON (l.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE CONSTRAINT property_account_slug_unique IF NOT EXISTS
+FOR (p:Property) REQUIRE (p.accountId, p.slug) IS UNIQUE;
+
+CREATE INDEX property_account IF NOT EXISTS
+FOR (p:Property) ON (p.accountId);
+
+// Property-hub backfill — relink listing-only estate data deployed before
+// :Property became obligatory. Three idempotent passes, mirroring the
+// conversationId one-shot migration pattern above. Installs with no :Listing
+// nodes (every non-estate brand) match nothing in any pass. The standing
+// reconcile that proves orphanListings reached 0 is emitted per-deploy by
+// platform/scripts/seed-neo4j.sh.
+//
+// Pass 1 — convert any pre-inversion (:Listing)-[:FOR_PROPERTY]->(:Property)
+// to the parent-down (:Property)-[:HAS_LISTING]->(:Listing), reusing the
+// existing :Property, then drop the retired edge. Idempotent: once
+// FOR_PROPERTY is deleted a re-run matches nothing.
+MATCH (l:Listing)-[fp:FOR_PROPERTY]->(p:Property)
+MERGE (p)-[:HAS_LISTING]->(l)
+DELETE fp;
+
+// Pass 2 — for every :Listing still lacking a :Property parent, synthesise a
+// :Property from the listing's address slug and attach
+// (:Property)-[:HAS_LISTING]->(:Listing). Idempotent: the HAS_LISTING guard
+// makes re-runs and already-migrated listings no-ops. Listings with a null
+// slug are deliberately excluded — there is no address key to MERGE on, and a
+// {slug: null} MERGE would collapse every slug-less listing into one bogus
+// (accountId, null) :Property. Such listings (a malformed pre-inversion write)
+// stay visible as orphanListings in the seed-neo4j.sh reconcile; recovering
+// them needs an address backfill, tracked in .tasks/996-estate-null-slug-listing-property-backfill.md.
+MATCH (l:Listing)
+WHERE l.slug IS NOT NULL AND NOT ( (:Property)-[:HAS_LISTING]->(l) )
+MERGE (p:Property {accountId: l.accountId, slug: l.slug})
+  ON CREATE SET p.address = coalesce(l.displayName, l.addressLine),
+                p.postcode = l.postcode
+MERGE (p)-[:HAS_LISTING]->(l);
+
+// Pass 3 — relocate the agency edge from each :Listing onto its :Property
+// parent. Bound per LISTED_BY edge (one row per edge), so the DELETE never
+// double-fires on a single relationship regardless of how many listings share
+// a :Property or how many edges a listing carries. Idempotent: once a
+// listing's LISTED_BY is moved, a re-run matches nothing.
+MATCH (p:Property)-[:HAS_LISTING]->(l:Listing)-[old:LISTED_BY]->(o:Organization)
+MERGE (p)-[:LISTED_BY]->(o)
+DELETE old;
+
+CREATE CONSTRAINT viewing_account_source_unique IF NOT EXISTS
+FOR (v:Viewing) REQUIRE (v.accountId, v.sourceSystem, v.sourceId) IS UNIQUE;
+
+CREATE INDEX viewing_account IF NOT EXISTS
+FOR (v:Viewing) ON (v.accountId);
+
+CREATE CONSTRAINT offer_account_source_unique IF NOT EXISTS
+FOR (o:Offer) REQUIRE (o.accountId, o.sourceSystem, o.sourceId) IS UNIQUE;
+
+CREATE INDEX offer_account IF NOT EXISTS
+FOR (o:Offer) ON (o.accountId);
+
+CREATE INDEX image_object_account IF NOT EXISTS
+FOR (i:ImageObject) ON (i.accountId);
+
+// :PostalAddress (schema:PostalAddress) — shared address nodes documented in
+// schema-base.md. Address rows are deliberately accountId-free (one address
+// can be shared across customers / orders / listings); writers MERGE on the
+// formatted address triple. Declared here so a fresh deploy registers the
+// label before the first :PostalAddress write lands.
+CREATE INDEX postal_address_postcode IF NOT EXISTS
+FOR (a:PostalAddress) ON (a.postalCode);
+
+// ----------------------------------------------------------
+// Construction ontology (Task 650) — Job-centric model for the
+// sitedesk-code brand, documented at
+// platform/plugins/memory/references/schema-construction.md.
+//
+// Active vertical: brand.json#vertical = "schema-construction". Declared
+// here so a fresh deploy registers each label before its first write
+// (same fresh-install bootstrap contract as the estate-agent block above).
+//
+// Uniqueness constraints where a clean natural key exists; accountId-index-
+// only for child nodes whose uniqueness is a write-time MERGE (LineItem,
+// Milestone, CheckIn) — mirrors :ImageObject. :Worker is an
+// additional label on :Person (no standalone node), so it carries no line of
+// its own here, same as :Applicant in the estate-agent block.
+//
+// Search quality (Task 652). The four text-bearing labels — :Job (client +
+// address), :LineItem (trade + description), :QuoteDocument, :VariationNote
+// (description) — carry a vector index on `.embedding` (below), so the
+// graph-write chokepoint auto-embeds them on write and they rank in the
+// vector half of memory-search. The four are mirrored in
+// graph-write's VECTOR_INDEXED_LABELS (pinned by the memory-plugin
+// vector-indexed-labels-drift test). The distinctive back-office text fields
+// (Job.client, Job.address, InboundInvoice.supplier, WhatsAppGroup.clientName)
+// are added to the entity_search_admin ON EACH list ONLY — they are operator
+// data, deliberately kept out of the public-agent BM25 surface. The
+// construction labels remain in the public union, so a public read still
+// matches them on generic name/description.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT job_account_jobid_unique IF NOT EXISTS
+FOR (j:Job) REQUIRE (j.accountId, j.jobId) IS UNIQUE;
+
+CREATE INDEX job_account IF NOT EXISTS
+FOR (j:Job) ON (j.accountId);
+
+CREATE INDEX job_status IF NOT EXISTS
+FOR (j:Job) ON (j.status);
+
+CREATE VECTOR INDEX job_embedding IF NOT EXISTS
+FOR (j:Job) ON (j.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE INDEX line_item_account IF NOT EXISTS
+FOR (li:LineItem) ON (li.accountId);
+
+CREATE VECTOR INDEX line_item_embedding IF NOT EXISTS
+FOR (li:LineItem) ON (li.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE CONSTRAINT valuation_account_job_num_unique IF NOT EXISTS
+FOR (v:Valuation) REQUIRE (v.accountId, v.jobId, v.valuationNumber) IS UNIQUE;
+
+CREATE INDEX valuation_account IF NOT EXISTS
+FOR (v:Valuation) ON (v.accountId);
+
+CREATE INDEX milestone_account IF NOT EXISTS
+FOR (m:Milestone) ON (m.accountId);
+
+CREATE CONSTRAINT quote_document_account_ref_unique IF NOT EXISTS
+FOR (q:QuoteDocument) REQUIRE (q.accountId, q.ref) IS UNIQUE;
+
+CREATE INDEX quote_document_account IF NOT EXISTS
+FOR (q:QuoteDocument) ON (q.accountId);
+
+CREATE VECTOR INDEX quote_document_embedding IF NOT EXISTS
+FOR (q:QuoteDocument) ON (q.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE CONSTRAINT variation_note_account_job_num_unique IF NOT EXISTS
+FOR (vn:VariationNote) REQUIRE (vn.accountId, vn.jobId, vn.variationNumber) IS UNIQUE;
+
+CREATE INDEX variation_note_account IF NOT EXISTS
+FOR (vn:VariationNote) ON (vn.accountId);
+
+CREATE VECTOR INDEX variation_note_embedding IF NOT EXISTS
+FOR (vn:VariationNote) ON (vn.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// Task 802 renamed the key property invoiceNumber -> confirmationNumber
+// (Schema.org canonical). The constraint gets a NEW name because
+// CREATE ... IF NOT EXISTS matches by constraint name: re-using the old
+// name would silently skip creation on databases seeded before the rename,
+// leaving the key unprotected. The old-name DROP retires the stale
+// invoiceNumber constraint on those databases; both statements are
+// idempotent on fresh installs.
+DROP CONSTRAINT inbound_invoice_account_supplier_num_unique IF EXISTS;
+CREATE CONSTRAINT inbound_invoice_account_supplier_confirmation_unique IF NOT EXISTS
+FOR (ii:InboundInvoice) REQUIRE (ii.accountId, ii.supplier, ii.confirmationNumber) IS UNIQUE;
+
+CREATE INDEX inbound_invoice_account IF NOT EXISTS
+FOR (ii:InboundInvoice) ON (ii.accountId);
+
+CREATE INDEX checkin_account IF NOT EXISTS
+FOR (ci:CheckIn) ON (ci.accountId);
+
+CREATE CONSTRAINT whatsapp_group_account_groupid_unique IF NOT EXISTS
+FOR (wg:WhatsAppGroup) REQUIRE (wg.accountId, wg.groupId) IS UNIQUE;
+
+CREATE INDEX whatsapp_group_account IF NOT EXISTS
+FOR (wg:WhatsAppGroup) ON (wg.accountId);
+
+// ----------------------------------------------------------
+// Voice Mirror (Task 356 + Task 462) — authorial-voice capture + application
+// ----------------------------------------------------------
+// :VoiceProfile holds the distilled style card for one (AdminUser, format).
+// Task 462: one profile per (accountId, userId, format); format ∈
+// {text, email, social-post, article, marketing-copy, note}.
+// The old (accountId, adminUserId) unique constraint is dropped and replaced.
+//
+// :VoiceEdit captures operator edits on agent drafts as feedback,
+// stamped with a Haiku-summarised intent; many edits feed back into
+// the next distillation. VoiceEdit now carries `format` to route
+// FEEDBACK_FOR edges to the matching per-format :VoiceProfile.
+//
+// `authorshipMode` is an enum property on content-bearing labels
+// (`:KnowledgeDocument`, `:ConversationArchive` (Task 397 — every chat
+// transcript, including email threads under `source:'email'` post-Task-426),
+// `:Message`, `:SocialPost`) with
+// values `human-only | human-led-agent-assisted | agent-led-human-reviewed
+// | agent-only | unknown`. Legacy nodes default to `unknown` until
+// reviewed via the voice-mirror backfill flow. The per-label authorship
+// index lets the distillation walk filter cheaply.
+//
+// `format` is an enum property on corpus nodes (same label set) and on
+// :VoiceProfile nodes. The per-label format index lets per-format corpus
+// walks and profile reads avoid full-label scans.
+
+// Task 676 — :VoiceProfile.scope ∈ {'personal','org'} discriminates the two
+// profile kinds. Personal: key (accountId, userId, format), scope='personal',
+// anchored on :AdminUser via HAS_VOICE_PROFILE. Org: key (accountId,
+// userId='__org__', format), scope='org', anchored on :LocalBusiness. The
+// reserved sentinel userId '__org__' keeps the (accountId, userId, format)
+// UNIQUE constraint below valid with NO migration — exactly one org profile
+// per (account, format). A real :AdminUser must never hold userId='__org__'
+// (voice-distil-profile surfaces, never swallows, the resulting constraint
+// error). Corpus nodes carry voiceAuthor (a userId): org walks are
+// account-wide, personal walks filter n.voiceAuthor = the operator. :VoiceEdit
+// also carries scope + the profile-key userId so feedback routes to the
+// matching profile; the real editor is preserved via :AUTHORED.
+
+// Task 462 — drop the old (accountId, adminUserId) constraint before
+// creating the new (accountId, userId, format) three-key constraint.
+// `IF EXISTS` makes the DROP idempotent on fresh installs.
+DROP CONSTRAINT voice_profile_admin_unique IF EXISTS;
+
+CREATE CONSTRAINT voice_profile_format_unique IF NOT EXISTS
+FOR (v:VoiceProfile) REQUIRE (v.accountId, v.userId, v.format) IS UNIQUE;
+
+CREATE INDEX voice_profile_account IF NOT EXISTS
+FOR (v:VoiceProfile) ON (v.accountId);
+
+CREATE INDEX voice_profile_format IF NOT EXISTS
+FOR (v:VoiceProfile) ON (v.format);
+
+CREATE INDEX voice_edit_user IF NOT EXISTS
+FOR (e:VoiceEdit) ON (e.userId);
+
+CREATE INDEX knowledge_document_authorship IF NOT EXISTS
+FOR (k:KnowledgeDocument) ON (k.authorshipMode);
+
+CREATE INDEX knowledge_document_format IF NOT EXISTS
+FOR (k:KnowledgeDocument) ON (k.format);
+
+CREATE INDEX conversation_archive_authorship IF NOT EXISTS
+FOR (c:ConversationArchive) ON (c.authorshipMode);
+
+CREATE INDEX conversation_archive_format IF NOT EXISTS
+FOR (c:ConversationArchive) ON (c.format);
+
+CREATE INDEX message_authorship IF NOT EXISTS
+FOR (m:Message) ON (m.authorshipMode);
+
+CREATE INDEX message_format IF NOT EXISTS
+FOR (m:Message) ON (m.format);
+
+// contentHash index — deduplication MERGE in voice-ingest-session-text uses
+// MERGE (n:Message {contentHash: $hash, accountId: $accountId}). Without this
+// index, each MERGE scans all :Message nodes for the account. The index on
+// contentHash alone lets neo4j narrow the lookup before applying the
+// accountId predicate.
+CREATE INDEX message_content_hash IF NOT EXISTS
+FOR (m:Message) ON (m.contentHash);
+
+CREATE INDEX social_post_authorship IF NOT EXISTS
+FOR (s:SocialPost) ON (s.authorshipMode);
+
+CREATE INDEX social_post_format IF NOT EXISTS
+FOR (s:SocialPost) ON (s.format);
+
+// :Section authorshipMode — the corpus walk includes conversation-archive
+// :Section chunks (parent :ConversationArchive) alongside ordinary
+// document sections under :KnowledgeDocument. Index on the :Section label
+// so the authorshipMode filter is cheap; the conversation-vs-document
+// split is applied at query time via the parent label.
+CREATE INDEX section_authorship IF NOT EXISTS
+FOR (s:Section) ON (s.authorshipMode);
+
+CREATE INDEX section_format IF NOT EXISTS
+FOR (s:Section) ON (s.format);
+
+CREATE INDEX social_post_account IF NOT EXISTS
+FOR (s:SocialPost) ON (s.accountId);
+
+// ----------------------------------------------------------
+// AEOAudit — Answer Engine Optimisation audit history (Task 354).
+// Written by the aeo plugin's aeo-audit-page tool when invoked
+// with persist=true. Append-only audit trail; each invocation
+// produces a new node. Linked via
+// (KnowledgeDocument)-[:HAS_AEO_AUDIT]->(AEOAudit) when the audit
+// targets a stored document, otherwise standalone keyed on
+// (accountId, target, runAt).
+//
+// Properties: accountId, auditId (uuid), target (url or
+// '(inline html)'), score (0-100), heuristicsJson (serialized
+// per-heuristic result), runAt, createdByAgent, createdBySession,
+// createdAt.
+//
+// Monitor-related labels (:AEOPrompt, :AEOCheck, :AEOCitation) are
+// intentionally NOT declared in v1 — the multi-engine monitor is
+// filed as a follow-up task and the schema will land with it.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT aeo_audit_id_unique IF NOT EXISTS
+FOR (a:AEOAudit) REQUIRE a.auditId IS UNIQUE;
+
+CREATE INDEX aeo_audit_account IF NOT EXISTS
+FOR (a:AEOAudit) ON (a.accountId);
+
+CREATE INDEX aeo_audit_target IF NOT EXISTS
+FOR (a:AEOAudit) ON (a.target);
+
+CREATE INDEX aeo_audit_run_at IF NOT EXISTS
+FOR (a:AEOAudit) ON (a.runAt);
+
+// ----------------------------------------------------------
+// Visitor graph (Task 357)
+//
+// Pixel emits pageview/click/scroll/dwell to POST /v/event. Events land
+// under :Session, attributed to :Person (via signed-token cookie) or
+// :AnonVisitor (cookie-less). When a previously anonymous browser
+// completes its first signed-token click, the AnonVisitor merges into
+// the Person and prior :Session edges reattribute. Schema-org-ish:
+// Session/PageView/Click are bespoke (no schema.org coverage of analytics);
+// Page is `schema:WebPage`-shaped (url, name).
+//
+// Multi-tenancy: every node carries accountId. Uniqueness constraints
+// are composite (accountId, idKey) — sessionId/visitorId/url collisions
+// across accounts are valid.
+//
+// Cascade: contact-erase on :Person trashes (:Session)-[:HAS_EVENT]->(*)
+// the same way profile-delete cascades preferences. :Page and :Listing
+// are content metadata and intentionally survive (no PII).
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT session_id_unique IF NOT EXISTS
+FOR (s:Session) REQUIRE (s.accountId, s.sessionId) IS UNIQUE;
+
+CREATE INDEX session_account IF NOT EXISTS
+FOR (s:Session) ON (s.accountId);
+
+CREATE INDEX session_started_at IF NOT EXISTS
+FOR (s:Session) ON (s.startedAt);
+
+CREATE CONSTRAINT anon_visitor_id_unique IF NOT EXISTS
+FOR (av:AnonVisitor) REQUIRE (av.accountId, av.visitorId) IS UNIQUE;
+
+CREATE INDEX anon_visitor_account IF NOT EXISTS
+FOR (av:AnonVisitor) ON (av.accountId);
+
+CREATE CONSTRAINT page_url_unique IF NOT EXISTS
+FOR (pg:Page) REQUIRE (pg.accountId, pg.url) IS UNIQUE;
+
+CREATE INDEX page_account IF NOT EXISTS
+FOR (pg:Page) ON (pg.accountId);
+
+// PageView/Click/ScrollMilestone/Recommendation: no uniqueness, just
+// accountId index. ScrollMilestone is a roll-up (one per PageView,
+// updated in place) so a uniqueness constraint on (sessionId, pageViewId)
+// would also work — left as index until a write pattern needs it.
+CREATE INDEX pageview_account IF NOT EXISTS
+FOR (pv:PageView) ON (pv.accountId);
+
+CREATE INDEX pageview_occurred_at IF NOT EXISTS
+FOR (pv:PageView) ON (pv.occurredAt);
+
+CREATE INDEX click_account IF NOT EXISTS
+FOR (cl:Click) ON (cl.accountId);
+
+CREATE INDEX click_occurred_at IF NOT EXISTS
+FOR (cl:Click) ON (cl.occurredAt);
+
+CREATE INDEX scroll_milestone_account IF NOT EXISTS
+FOR (sm:ScrollMilestone) ON (sm.accountId);
+
+CREATE INDEX recommendation_account IF NOT EXISTS
+FOR (rec:Recommendation) ON (rec.accountId);
+
+CREATE INDEX recommendation_session_key IF NOT EXISTS
+FOR (rec:Recommendation) ON (rec.sessionKey);
+
+// ----------------------------------------------------------
+// Idea (Task 352) — original-thinking candidates extracted by
+// the pre-turn graph pass from admin-side conversations and written
+// by `database-operator` per-write briefs admin dispatches. Written
+// via memory-write(labels:["Idea"], ...) with one edge
+// (:Conversation)-[:HAS_IDEA]->(:Idea). Forward-only write surface:
+// no historical backfill, no dedup, no clustering — let the brain
+// accumulate first. Declared here so memory-write's label validator
+// (db.labels() ∪ schema.cypher) registers the label on a fresh
+// deploy where no :Idea node has yet landed; without this, the
+// first write is rejected as "unknown label" and the specialist's
+// LOUD-FAIL surfaces the rejection without anything landing.
+// ----------------------------------------------------------
+
+CREATE INDEX idea_account IF NOT EXISTS
+FOR (i:Idea) ON (i.accountId);
+
+CREATE VECTOR INDEX idea_embedding IF NOT EXISTS
+FOR (i:Idea) ON (i.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// Compiled-truth + timeline knowledge model (Task 306, extended Task 392) —
+// gbrain's "compiled truth above the rule, append-only timeline
+// below" pattern. Every entity subject in the admin-twin set
+// (:Person | :Organization | :Concept | :Project | :LocalBusiness) carries
+// an agent-rewritten summary (`compiledTruth`, ≤2000 chars) plus
+// a history of dated `:TimelineEvent` rows path-anchored via
+// `(entity)-[:HAS_TIMELINE_EVENT]->(:TimelineEvent)`. The
+// compiledTruth is what the agent reads when it needs a summary;
+// the timeline is what it cites and appends to.
+//
+// Public-twin (Task 392): four of the five subject labels also carry
+// `compiledTruthPublic` (≤2000 chars) — the customer-facing summary
+// the public agent surfaces. The public-twin set is
+// :Organization | :Concept | :Project | :LocalBusiness. :Person is
+// deliberately excluded: an operator's notes on a contact are private
+// by definition and have no neutral customer-facing form. The
+// public-agent `memory-search` projection (scope='public') rewrites
+// the returned property bag so `compiledTruth` is renamed to
+// `compiledTruthPublic` on public-twin labels and stripped entirely
+// on :Person.
+//
+// Naming:
+//   :TimelineEvent — distinct from :Event (scheduling plugin's
+//     schema:Event with eventId-unique). Collisions were the reason
+//     to fork; do not blend.
+//   :HAS_TIMELINE_EVENT — distinct from :HAS_EVENT (visitor analytics
+//     Session→PageView/Click/ScrollMilestone).
+//
+// MERGE doctrine: writers MUST path-anchor from the entity to defend
+// cross-account collisions, e.g.
+//   MATCH (e) WHERE elementId(e) = $entityId AND e.accountId = $accountId
+//   MERGE (e)-[:HAS_TIMELINE_EVENT]->(t:TimelineEvent {timelineEventId: $id})
+// Never label-only MERGE on :TimelineEvent.
+//
+// `kind` enum (5 values, no catch-all):
+//   mentioned | met | quoted | attended | transacted
+// Extractor refuses on ambiguity rather than collapsing to "other".
+//
+// `learnedAt` — datetime(), transaction-time: when this event was ingested.
+//   Distinct from `occurredAt` (valid-time: when the fact was true in the world).
+//   Enables bi-temporal queries: "events ingested on date X about something that
+//   happened in 1990". Backfilled from `createdAt` on pre-existing nodes; nodes
+//   without `createdAt` fall back to `datetime()` (safe approximation).
+//   Task 597.
+//
+// `compiledTruth` source:
+//   compiledTruthSource = "rewriter" (default) — compiled-truth-rewriter
+//     library wrote it.
+//   compiledTruthSource = "operator" — operator overrode via the graph UI
+//     (legacy admin-server only) or via memory-update direct-write.
+//     Rewriter refuses to overwrite for 7 days unless forceRewrite=true.
+//
+// `compiledTruthPublic` source (Task 392):
+//   compiledTruthPublicSource = "rewriter" (default) — compiled-truth-rewriter
+//     `mode: 'public'` pass wrote it. Fires inline after a successful admin
+//     pass when the label is in the public-twin set and the admin pass was
+//     not a no-op.
+//   compiledTruthPublicSource = "operator" — operator overrode via chat
+//     (memory-update `compiledTruthPublic` direct-write argument). Public
+//     rewriter refuses to overwrite for 7 days unless forceRewrite=true.
+//     Cooldown is independent of the admin cooldown.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT timeline_event_id_unique IF NOT EXISTS
+FOR (t:TimelineEvent) REQUIRE t.timelineEventId IS UNIQUE;
+
+CREATE INDEX timeline_event_account IF NOT EXISTS
+FOR (t:TimelineEvent) ON (t.accountId);
+
+CREATE INDEX timeline_event_occurred_at IF NOT EXISTS
+FOR (t:TimelineEvent) ON (t.occurredAt);
+
+CREATE INDEX timeline_event_kind IF NOT EXISTS
+FOR (t:TimelineEvent) ON (t.kind);
+
+CREATE INDEX timeline_event_learned_at IF NOT EXISTS
+FOR (t:TimelineEvent) ON (t.learnedAt);
+
+CREATE VECTOR INDEX timeline_event_embedding IF NOT EXISTS
+FOR (t:TimelineEvent) ON (t.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// Task 597 migration — backfill learnedAt on :TimelineEvent nodes written
+// before transaction-time was tracked. Uses createdAt as the best available
+// proxy; nodes without createdAt get datetime() (safe: they predate the field).
+// CALL IN TRANSACTIONS avoids a single large write lock on installs with many nodes.
+CALL {
+  MATCH (t:TimelineEvent) WHERE t.learnedAt IS NULL
+  WITH t LIMIT 500
+  SET t.learnedAt = coalesce(t.createdAt, datetime())
+} IN TRANSACTIONS OF 500 ROWS;
+
+// `compiledTruthUpdatedAt` indices for stale-detection scans
+// (e.g. "find :Person with truth older than 7 days that has new events").
+CREATE INDEX person_compiled_truth_updated_at IF NOT EXISTS
+FOR (p:Person) ON (p.compiledTruthUpdatedAt);
+
+CREATE INDEX organization_compiled_truth_updated_at IF NOT EXISTS
+FOR (o:Organization) ON (o.compiledTruthUpdatedAt);
+
+CREATE INDEX concept_compiled_truth_updated_at IF NOT EXISTS
+FOR (c:Concept) ON (c.compiledTruthUpdatedAt);
+
+// Admin-twin extension (Task 392) — :Project and :LocalBusiness joined the
+// admin-twin set when the public-twin landed. Same stale-detection index.
+CREATE INDEX project_compiled_truth_updated_at IF NOT EXISTS
+FOR (p:Project) ON (p.compiledTruthUpdatedAt);
+
+CREATE INDEX local_business_compiled_truth_updated_at IF NOT EXISTS
+FOR (b:LocalBusiness) ON (b.compiledTruthUpdatedAt);
+
+// Public-twin stale-detection indexes (Task 392). Same role as the admin
+// indexes above — find public-twin nodes whose public summary lags the
+// admin summary by N days. :Person omitted by design (no public twin).
+CREATE INDEX organization_compiled_truth_public_updated_at IF NOT EXISTS
+FOR (o:Organization) ON (o.compiledTruthPublicUpdatedAt);
+
+CREATE INDEX concept_compiled_truth_public_updated_at IF NOT EXISTS
+FOR (c:Concept) ON (c.compiledTruthPublicUpdatedAt);
+
+CREATE INDEX project_compiled_truth_public_updated_at IF NOT EXISTS
+FOR (p:Project) ON (p.compiledTruthPublicUpdatedAt);
+
+CREATE INDEX local_business_compiled_truth_public_updated_at IF NOT EXISTS
+FOR (b:LocalBusiness) ON (b.compiledTruthPublicUpdatedAt);
+
+// ----------------------------------------------------------
+// :CompiledTruthRevision (Task 391, twin discriminator added in
+// Task 436) — audit history of every `compiledTruth` /
+// `compiledTruthPublic` value an entity has ever held. Captured in
+// the same transaction as the writer's SET so revision history can
+// never desync from the live property. Pruned by dream-cycle
+// phase 5 (keep newest 20 per entity) — never written-and-pruned
+// in the same TX as the main rewrite.
+//
+// Read-only after write: graph-write-gate rejects property
+// updates and label-anchored MERGE on this label. The dream-cycle
+// prune is the only mutation path.
+//
+// MERGE doctrine: writers MUST path-anchor from the entity to
+// defend cross-account collisions:
+//   MATCH (e) WHERE elementId(e) = $entityId AND e.accountId = $accountId
+//   MERGE (e)-[:HAS_REVISION]->(r:CompiledTruthRevision {revisionId: $id})
+// Never label-only MERGE on :CompiledTruthRevision.
+//
+// `twin` enum: 'compiledTruth' (private/admin twin) or
+// 'compiledTruthPublic' (public twin). One revision row per twin
+// per write; the specialist calls `memory-update` once per twin.
+//
+// `source` enum (exact, no catch-all):
+//   'rewriter' — compiled-truth-rewriter specialist wrote the truth.
+//   'operator' — operator hint overrode the rewriter for this twin.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT compiled_truth_revision_id_unique IF NOT EXISTS
+FOR (r:CompiledTruthRevision) REQUIRE r.revisionId IS UNIQUE;
+
+CREATE INDEX compiled_truth_revision_account IF NOT EXISTS
+FOR (r:CompiledTruthRevision) ON (r.accountId);
+
+CREATE INDEX compiled_truth_revision_written_at IF NOT EXISTS
+FOR (r:CompiledTruthRevision) ON (r.writtenAt);
+
+CREATE INDEX compiled_truth_revision_twin IF NOT EXISTS
+FOR (r:CompiledTruthRevision) ON (r.twin);
+
+// ----------------------------------------------------------
+// :Report node — durable, keyword-routed output of admin
+// workflows (daily briefing, dream cycle, ad-hoc analyses).
+// Task 332. Append-only by design: reports are not edited
+// after write. Parented to the active :AdminConversation
+// (via :PRODUCED, injected at write time) or to the
+// account's :AdminUser when no conversation context exists.
+// `keywords` is a string array; `sourceWorkflow` names the
+// originating skill or scheduled workflow (e.g.
+// "daily-briefing", "dream-cycle"). Embedded so the existing
+// `memory-search` hybrid pipeline can surface reports
+// alongside other knowledge.
+//
+// Dream-cycle queues (Task 327): :OrphanCandidate and
+// :CitationProposal hold phase-1 and phase-4 candidates the
+// operator triages via `memory-review-queue`. Edges to
+// `:Trashed` targets get a `staleTarget: true` property
+// from phase 3 (audit preserved; no deletion). :TimelineEvent
+// citations are written additively as `citations: [string]`
+// — no new label needed.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT report_id_unique IF NOT EXISTS
+FOR (r:Report) REQUIRE r.reportId IS UNIQUE;
+
+CREATE INDEX report_account IF NOT EXISTS
+FOR (r:Report) ON (r.accountId);
+
+CREATE INDEX report_occurred_at IF NOT EXISTS
+FOR (r:Report) ON (r.occurredAt);
+
+CREATE INDEX report_source_workflow IF NOT EXISTS
+FOR (r:Report) ON (r.sourceWorkflow);
+
+CREATE INDEX report_title IF NOT EXISTS
+FOR (r:Report) ON (r.title);
+
+CREATE VECTOR INDEX report_embedding IF NOT EXISTS
+FOR (r:Report) ON (r.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// Task 514: physical files on disk indexed as :FileArtifact so the /data
+// search box runs the same hybrid (vector + BM25) retrieval over files that
+// the agent runs over the graph. discoverIndexes() enrols this at boot; the
+// file-index reconciler populates f.embedding (768-d nomic-embed-text over
+// name + extracted content).
+CREATE VECTOR INDEX file_artifact_embedding IF NOT EXISTS
+FOR (f:FileArtifact) ON (f.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE CONSTRAINT orphan_candidate_id_unique IF NOT EXISTS
+FOR (o:OrphanCandidate) REQUIRE o.orphanCandidateId IS UNIQUE;
+
+CREATE INDEX orphan_candidate_account IF NOT EXISTS
+FOR (o:OrphanCandidate) ON (o.accountId);
+
+CREATE INDEX orphan_candidate_target IF NOT EXISTS
+FOR (o:OrphanCandidate) ON (o.targetElementId);
+
+CREATE CONSTRAINT citation_proposal_id_unique IF NOT EXISTS
+FOR (p:CitationProposal) REQUIRE p.citationProposalId IS UNIQUE;
+
+CREATE INDEX citation_proposal_account IF NOT EXISTS
+FOR (p:CitationProposal) ON (p.accountId);
+
+CREATE INDEX citation_proposal_target IF NOT EXISTS
+FOR (p:CitationProposal) ON (p.timelineEventId);
+
+// ----------------------------------------------------------
+// Knowledge-work vertical (the Maxy brand; schema-knowledge-work.md).
+// Seven labels that fill the gaps the base schema leaves for knowledge
+// workers — goals/OKRs, decision records, risk, and the
+// research/citation/evidence layer. Everything else (Person, Project,
+// Task, Meeting, DefinedTerm, Concept, Idea, CreativeWork,
+// KnowledgeDocument) is reused from base unchanged.
+//
+// Each label carries an `accountId` index (account scoping) and a 768-dim
+// cosine vector index on `.embedding` so the graph-write chokepoint
+// auto-embeds it on write and it ranks in the vector half of
+// memory-search. All seven are in the entity_search_admin FULLTEXT union
+// above, so they also rank in BM25. Their distinctive text fields
+// (statement, decision, consequences) were added to that index's ON EACH
+// list. Top-level operator-entry labels; no child labels in this vertical.
+// ----------------------------------------------------------
+
+CREATE INDEX objective_account IF NOT EXISTS
+FOR (o:Objective) ON (o.accountId);
+
+CREATE VECTOR INDEX objective_embedding IF NOT EXISTS
+FOR (o:Objective) ON (o.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE INDEX key_result_account IF NOT EXISTS
+FOR (k:KeyResult) ON (k.accountId);
+
+CREATE VECTOR INDEX key_result_embedding IF NOT EXISTS
+FOR (k:KeyResult) ON (k.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE INDEX decision_account IF NOT EXISTS
+FOR (d:Decision) ON (d.accountId);
+
+CREATE VECTOR INDEX decision_embedding IF NOT EXISTS
+FOR (d:Decision) ON (d.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE INDEX risk_account IF NOT EXISTS
+FOR (r:Risk) ON (r.accountId);
+
+CREATE VECTOR INDEX risk_embedding IF NOT EXISTS
+FOR (r:Risk) ON (r.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE INDEX source_account IF NOT EXISTS
+FOR (s:Source) ON (s.accountId);
+
+CREATE VECTOR INDEX source_embedding IF NOT EXISTS
+FOR (s:Source) ON (s.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE INDEX finding_account IF NOT EXISTS
+FOR (f:Finding) ON (f.accountId);
+
+CREATE VECTOR INDEX finding_embedding IF NOT EXISTS
+FOR (f:Finding) ON (f.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE INDEX hypothesis_account IF NOT EXISTS
+FOR (h:Hypothesis) ON (h.accountId);
+
+CREATE VECTOR INDEX hypothesis_embedding IF NOT EXISTS
+FOR (h:Hypothesis) ON (h.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};