@stigmer/server 3.22.1-dev.20260922095755 → 3.22.1

package/src/store/postgres/__tests__/migrations.test.ts

@@ -4,10 +4,7 @@
  * idempotent, a mid-chain database resumes (v1 → v2 picks up the sweep
  * index), and concurrent first boots serialize on the advisory lock
  * instead of racing the chain — the multi-instance failure class sqlite's
- * single-file lock never had. v5, the chain's first row-decoding step,
- * moves every row of the seven kinds that held the retired public level to
- * org and leaves every other row's bytes as they were; a row it cannot
- * decode fails the step and leaves the database at v4.
+ * single-file lock never had.
  *
  * Gated on TEST_DATABASE_URL (see support.ts): visible skips without a
  * database, always exercised in CI via the ci.stigmer-server service
@@ -17,14 +14,7 @@ import { afterEach, beforeEach, describe, expect, it } from "vitest";
 
 import pg from "pg";
 
-import { create, fromJson, toBinary } from "@bufbuild/protobuf";
-import type { DescMessage } from "@bufbuild/protobuf";
-
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
-
-import { PUBLIC_ROW_KINDS_AT_RETIREMENT } from "../../public-visibility-retired.js";
-import { CURRENT_SCHEMA_VERSION, SCHEMA_VERSION_5 } from "../migrations.js";
+import { CURRENT_SCHEMA_VERSION } from "../migrations.js";
 import { PostgresStore } from "../store.js";
 import {
   createTestDatabase,
@@ -115,7 +105,7 @@ describe.skipIf(testDatabaseAdminUrl() === undefined)(
         await client.query(`DROP INDEX idx_wfee_created_at`);
         await client.query(`DROP INDEX idx_oauth_grant_resource`);
         await client.query(
-          `DELETE FROM schema_version WHERE version IN (2, 3, 4, 5)`,
+          `DELETE FROM schema_version WHERE version IN (2, 3, 4)`,
         );
         await client.query(
           `INSERT INTO resources (kind, id, data) VALUES ('project', 'prj_seeded', '\\x00'), ('organization', 'acme', '\\x00')`,
@@ -130,10 +120,9 @@ describe.skipIf(testDatabaseAdminUrl() === undefined)(
         const remaining = await client.query(
           `SELECT kind, id FROM resources ORDER BY kind`,
         );
-        expect(
-          remaining.rows,
-          "v4 removed the Project row and kept the rest",
-        ).toEqual([{ kind: "organization", id: "acme" }]);
+        expect(remaining.rows, "v4 removed the Project row and kept the rest").toEqual([
+          { kind: "organization", id: "acme" },
+        ]);
         const projectAudit = await client.query(
           `SELECT count(*)::int AS n FROM resource_audit WHERE kind = 'project'`,
         );
@@ -201,175 +190,5 @@ describe.skipIf(testDatabaseAdminUrl() === undefined)(
         await client.end();
       }
     });
-
-    describe("v5: the retired public level leaves every row", () => {
-      /** A row of `schema` carrying only the envelope every kind shares, at `visibility`. */
-      function envelopeBytes(
-        schema: DescMessage,
-        id: string,
-        visibility: ApiResourceVisibility,
-      ): Buffer {
-        return Buffer.from(
-          toBinary(
-            schema,
-            fromJson(schema, {
-              metadata: {
-                id,
-                name: id,
-                slug: id,
-                org: "acme",
-                visibility: ApiResourceVisibility[visibility],
-              },
-            }),
-          ),
-        );
-      }
-
-      function agentBytes(
-        id: string,
-        visibility: ApiResourceVisibility,
-      ): Buffer {
-        return Buffer.from(
-          toBinary(
-            AgentSchema,
-            create(AgentSchema, {
-              apiVersion: "agentic.stigmer.ai/v1",
-              kind: "Agent",
-              metadata: { id, name: id, slug: id, org: "acme", visibility },
-              spec: { instructions: "a conformant instruction body" },
-            }),
-          ),
-        );
-      }
-
-      /** Opens the store once (the chain replays), then rewinds to v4 for the seeding. */
-      async function v4Client(): Promise<pg.Client> {
-        const store = await PostgresStore.open(db.databaseUrl);
-        await store.close();
-        const client = new pg.Client({ connectionString: db.databaseUrl });
-        await client.connect();
-        await client.query(`DELETE FROM schema_version WHERE version = $1`, [
-          SCHEMA_VERSION_5,
-        ]);
-        return client;
-      }
-
-      async function row(
-        client: pg.Client,
-        kind: string,
-        id: string,
-      ): Promise<{ data: Buffer; updated_at: Date }> {
-        const result = await client.query<{ data: Buffer; updated_at: Date }>(
-          `SELECT data, updated_at FROM resources WHERE kind = $1 AND id = $2`,
-          [kind, id],
-        );
-        return result.rows[0]!;
-      }
-
-      it("moves a public row of every kind in the frozen table to org, and leaves an org row and a private row byte-for-byte", async () => {
-        const client = await v4Client();
-        const seededAt = new Date("2026-09-01T00:00:00Z");
-        try {
-          for (const entry of PUBLIC_ROW_KINDS_AT_RETIREMENT) {
-            await client.query(
-              `INSERT INTO resources (kind, id, data, updated_at) VALUES ($1, $2, $3, $4)`,
-              [
-                entry.kind,
-                `${entry.kind}_public`,
-                envelopeBytes(
-                  entry.schema,
-                  `${entry.kind}_public`,
-                  ApiResourceVisibility.visibility_public,
-                ),
-                seededAt,
-              ],
-            );
-          }
-          const orgBytes = agentBytes(
-            "agt_org",
-            ApiResourceVisibility.visibility_org,
-          );
-          const privateBytes = agentBytes(
-            "agt_private",
-            ApiResourceVisibility.visibility_private,
-          );
-          await client.query(
-            `INSERT INTO resources (kind, id, data, updated_at) VALUES ('agent', 'agt_org', $1, $3), ('agent', 'agt_private', $2, $3)`,
-            [orgBytes, privateBytes, seededAt],
-          );
-
-          const reopened = await PostgresStore.open(db.databaseUrl);
-          await reopened.close();
-
-          const version = await client.query(
-            `SELECT COALESCE(MAX(version), 0) AS version FROM schema_version`,
-          );
-          expect(Number((version.rows[0] as { version: string }).version)).toBe(
-            CURRENT_SCHEMA_VERSION,
-          );
-          for (const entry of PUBLIC_ROW_KINDS_AT_RETIREMENT) {
-            const moved = await row(client, entry.kind, `${entry.kind}_public`);
-            expect(
-              moved.data.equals(
-                envelopeBytes(
-                  entry.schema,
-                  `${entry.kind}_public`,
-                  ApiResourceVisibility.visibility_org,
-                ),
-              ),
-              entry.kind,
-            ).toBe(true);
-            expect(
-              moved.updated_at.getTime(),
-              `${entry.kind} updated_at bumped`,
-            ).toBeGreaterThan(seededAt.getTime());
-          }
-          const org = await row(client, "agent", "agt_org");
-          expect(org.data.equals(orgBytes)).toBe(true);
-          expect(org.updated_at.getTime()).toBe(seededAt.getTime());
-          const priv = await row(client, "agent", "agt_private");
-          expect(priv.data.equals(privateBytes)).toBe(true);
-          expect(priv.updated_at.getTime()).toBe(seededAt.getTime());
-        } finally {
-          await client.end();
-        }
-      });
-
-      it("a row of a table kind that does not decode fails the step, names the row, and leaves the database at v4 with every row untouched", async () => {
-        const client = await v4Client();
-        try {
-          const publicBytes = agentBytes(
-            "agt_public",
-            ApiResourceVisibility.visibility_public,
-          );
-          await client.query(
-            `INSERT INTO resources (kind, id, data) VALUES ('agent', 'agt_public', $1), ('agent', 'agt_broken', '\\xffffff'), ('session', 'ses_opaque', '\\xffff')`,
-            [publicBytes],
-          );
-
-          await expect(PostgresStore.open(db.databaseUrl)).rejects.toThrow(
-            /migrate to v5: .*agent 'agt_broken' cannot be moved off the retired public level/,
-          );
-
-          const version = await client.query(
-            `SELECT COALESCE(MAX(version), 0) AS version FROM schema_version`,
-          );
-          expect(Number((version.rows[0] as { version: string }).version)).toBe(
-            SCHEMA_VERSION_5 - 1,
-          );
-          expect(
-            (await row(client, "agent", "agt_public")).data.equals(publicBytes),
-          ).toBe(true);
-          // A kind outside the frozen table is never decoded, whatever it holds.
-          expect(
-            (await row(client, "session", "ses_opaque")).data.equals(
-              Buffer.from([0xff, 0xff]),
-            ),
-          ).toBe(true);
-        } finally {
-          await client.end();
-        }
-      });
-    });
   },
 );

package/src/store/postgres/__tests__/store-contract.test.ts

@@ -111,6 +111,8 @@ describe.skipIf(testDatabaseAdminUrl() === undefined)(
             kinds: ["agent"],
             terms: ["billing"],
             orgFilter: "",
+            crossOrgPublic: false,
+            excludePublic: false,
             limit: 20,
             offset: 0,
           });

package/src/store/postgres/migrations.ts

@@ -38,21 +38,14 @@
  */
 import type { PoolClient } from "pg";
 
-import {
-  PUBLIC_ROW_KINDS_AT_RETIREMENT,
-  movePublicRowToOrg,
-} from "../public-visibility-retired.js";
-
 export const SCHEMA_VERSION_1 = 1;
 export const SCHEMA_VERSION_2 = 2;
 export const SCHEMA_VERSION_3 = 3;
 /** v4: the rows of the removed Project kind deleted. */
 export const SCHEMA_VERSION_4 = 4;
-/** v5: every row holding the retired public visibility level moved to org. */
-export const SCHEMA_VERSION_5 = 5;
 
 /** Target version for new databases. */
-export const CURRENT_SCHEMA_VERSION = SCHEMA_VERSION_5;
+export const CURRENT_SCHEMA_VERSION = SCHEMA_VERSION_4;
 
 /**
  * Advisory lock key for the migration chain. Arbitrary but stable 64-bit
@@ -86,7 +79,6 @@ export async function runMigrations(client: PoolClient): Promise<void> {
       [SCHEMA_VERSION_2, migrateToV2],
       [SCHEMA_VERSION_3, migrateToV3],
       [SCHEMA_VERSION_4, migrateToV4],
-      [SCHEMA_VERSION_5, migrateToV5],
     ];
 
     for (const [version, migrate] of chain) {
@@ -323,42 +315,3 @@ async function migrateToV4(client: PoolClient): Promise<void> {
   await client.query(`DELETE FROM resources WHERE kind = 'project'`);
   await client.query(`DELETE FROM resource_audit WHERE kind = 'project'`);
 }
-
-/**
- * v5: the public visibility level is retired, so every row that still
- * holds it is moved to org visibility — the same step as the sqlite
- * driver's v10 (public-visibility-retired.ts says why a migration, why the
- * kind table is frozen there, and why an undecodable row fails the step).
- * The rows are read FOR UPDATE inside applyInTransaction's transaction,
- * under the chain's advisory lock, so a second instance booting against
- * the same database waits rather than moving a row twice; `updated_at` is
- * bumped the way saveResource bumps it; rows that hold any other level are
- * left byte-for-byte as they are. On the hosted edition every such row was
- * moved through the API before this release deployed, so this step finds
- * none and records its version.
- */
-async function migrateToV5(client: PoolClient): Promise<void> {
-  for (const entry of PUBLIC_ROW_KINDS_AT_RETIREMENT) {
-    const result = await client.query<{ id: string; data: Buffer }>(
-      `SELECT id, data FROM resources WHERE kind = $1 FOR UPDATE`,
-      [entry.kind],
-    );
-    for (const row of result.rows) {
-      let moved: Uint8Array | undefined;
-      try {
-        moved = movePublicRowToOrg(entry, new Uint8Array(row.data));
-      } catch (error) {
-        throw new Error(
-          `${entry.kind} '${row.id}' cannot be moved off the retired public level: ${String(error)}`,
-          { cause: error },
-        );
-      }
-      if (moved !== undefined) {
-        await client.query(
-          `UPDATE resources SET data = $1, updated_at = now() WHERE kind = $2 AND id = $3`,
-          [Buffer.from(moved), entry.kind, row.id],
-        );
-      }
-    }
-  }
-}

package/src/store/postgres/store.ts

@@ -814,13 +814,20 @@ export class PostgresStore implements Store {
     // right side").
     const kindParam = `${push(query.kinds as string[])}::text[]`;
 
-    // The scope-filter fragments — same composition as the sqlite driver:
-    // the org filter, strict (visibility never widens or narrows the
-    // scope), then the authorized-id allowlist.
+    // The scope-filter fragments — same composition as the sqlite driver's
+    // port of Go's buildScopeFilter: org (strict or public-widened) and
+    // the independent public subtraction.
     const scopeClauses: string[] = [];
     if (query.orgFilter !== "") {
       const orgParam = push(query.orgFilter);
-      scopeClauses.push(`AND org = ${orgParam}`);
+      scopeClauses.push(
+        query.crossOrgPublic
+          ? `AND (org = ${orgParam} OR visibility = 'visibility_public')`
+          : `AND org = ${orgParam}`,
+      );
+    }
+    if (query.excludePublic) {
+      scopeClauses.push(`AND visibility != 'visibility_public'`);
     }
     if (query.authorizedIdsByKind !== undefined) {
       // The 20260830.01 scoping arm: per-kind resource_id allowlists.

package/src/store/sqlite/__tests__/migrations.test.ts

@@ -6,10 +6,7 @@
  * predates Go's idempotent ALTERs gains its columns; a legacy pre-v2
  * database gets its prefix-based audit rows migrated. Rollback safety
  * (DD-006): a v7 database re-opened by Go-shaped version checks
- * (< 6) runs nothing. v10, the chain's first row-decoding step, moves
- * every row of the seven kinds that held the retired public level to org
- * and leaves every other row's bytes as they were; a row it cannot decode
- * fails the step and leaves the database at v9.
+ * (< 6) runs nothing.
  */
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -18,20 +15,12 @@ import { DatabaseSync } from "node:sqlite";
 
 import { afterEach, describe, expect, it } from "vitest";
 
-import { create, fromBinary, fromJson, toBinary } from "@bufbuild/protobuf";
-import type { DescMessage } from "@bufbuild/protobuf";
-
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
-
 import { SqliteStore } from "../store.js";
 import {
   CURRENT_SCHEMA_VERSION,
-  SCHEMA_VERSION_10,
   getSchemaVersion,
   runMigrations,
 } from "../migrations.js";
-import { PUBLIC_ROW_KINDS_AT_RETIREMENT } from "../../public-visibility-retired.js";
 import { materializeGoFixture } from "./support.js";
 
 const cleanups: Array<() => void | Promise<void>> = [];
@@ -92,9 +81,7 @@ describe("fresh database", () => {
     const rows = db
       .prepare(`SELECT version FROM schema_version ORDER BY version`)
       .all() as Array<{ version: number }>;
-    expect(rows.map((row) => row.version)).toEqual([
-      1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
-    ]);
+    expect(rows.map((row) => row.version)).toEqual([1, 2, 3, 4, 5, 6, 7, 8, 9]);
   });
 
   it("re-opening an already-migrated database is a no-op", async () => {
@@ -151,9 +138,7 @@ describe("Go-created v6 database adoption (DD-002 fixture)", () => {
     expect(org.id).toBe("acme");
 
     const audit = db
-      .prepare(
-        `SELECT version_hash, tag FROM resource_audit WHERE kind = 'organization'`,
-      )
+      .prepare(`SELECT version_hash, tag FROM resource_audit WHERE kind = 'organization'`)
       .get() as { version_hash: string; tag: string };
     expect(audit).toEqual({ version_hash: "hash-v1", tag: "stable" });
 
@@ -298,10 +283,8 @@ describe("legacy pre-v2 database", () => {
       CREATE TABLE schema_version (version INTEGER PRIMARY KEY, applied_at TEXT NOT NULL DEFAULT (datetime('now')));
       INSERT INTO schema_version (version) VALUES (1);
       CREATE TABLE resources (kind TEXT NOT NULL, id TEXT NOT NULL, data BLOB NOT NULL, updated_at TEXT NOT NULL DEFAULT (datetime('now')), PRIMARY KEY (kind, id)) WITHOUT ROWID;
-      -- Field 1 (api_version) holding one ASCII byte: bytes v10 can decode
-      -- as a Skill, since it walks every live row of that kind.
-      INSERT INTO resources (kind, id, data) VALUES ('skill', 'skl_1', X'0a0176');
-      INSERT INTO resources (kind, id, data) VALUES ('skill', 'skill_audit/skl_1/1706123456789', X'0a0177');
+      INSERT INTO resources (kind, id, data) VALUES ('skill', 'skl_1', X'0a01aa');
+      INSERT INTO resources (kind, id, data) VALUES ('skill', 'skill_audit/skl_1/1706123456789', X'0a01bb');
     `);
     setup.close();
 
@@ -347,172 +330,3 @@ describe("rollback safety (DD-006)", () => {
     expect(version.v).toBeGreaterThanOrEqual(6);
   });
 });
-
-describe("v10: the retired public level leaves every row", () => {
-  /** A v9 database: the chain replayed, then v10's version row removed. */
-  function v9Database(): { dbPath: string; db: DatabaseSync } {
-    const dbPath = tempDbPath();
-    const setup = new DatabaseSync(dbPath);
-    runMigrations(setup);
-    setup
-      .prepare(`DELETE FROM schema_version WHERE version = ?`)
-      .run(SCHEMA_VERSION_10);
-    expect(getSchemaVersion(setup)).toBe(SCHEMA_VERSION_10 - 1);
-    return { dbPath, db: setup };
-  }
-
-  function agentBytes(
-    id: string,
-    visibility: ApiResourceVisibility,
-  ): Uint8Array {
-    return toBinary(
-      AgentSchema,
-      create(AgentSchema, {
-        apiVersion: "agentic.stigmer.ai/v1",
-        kind: "Agent",
-        metadata: { id, name: id, slug: id, org: "acme", visibility },
-        spec: { instructions: "a conformant instruction body" },
-      }),
-    );
-  }
-
-  /** A row of `schema` carrying only the envelope every kind shares, at `visibility`. */
-  function envelopeBytes(
-    schema: DescMessage,
-    id: string,
-    visibility: ApiResourceVisibility,
-  ): Uint8Array {
-    return toBinary(
-      schema,
-      fromJson(schema, {
-        metadata: {
-          id,
-          name: id,
-          slug: id,
-          org: "acme",
-          visibility: ApiResourceVisibility[visibility],
-        },
-      }),
-    );
-  }
-
-  function insert(
-    db: DatabaseSync,
-    kind: string,
-    id: string,
-    data: Uint8Array,
-  ): void {
-    db.prepare(
-      `INSERT INTO resources (kind, id, data, updated_at) VALUES (?, ?, ?, '2026-09-01 00:00:00')`,
-    ).run(kind, id, data);
-  }
-
-  function row(
-    db: DatabaseSync,
-    kind: string,
-    id: string,
-  ): { data: Uint8Array; updated_at: string } {
-    return db
-      .prepare(
-        `SELECT data, updated_at FROM resources WHERE kind = ? AND id = ?`,
-      )
-      .get(kind, id) as { data: Uint8Array; updated_at: string };
-  }
-
-  it("moves a public row of every kind in the frozen table to org, and leaves an org row and a private row byte-for-byte", () => {
-    const { dbPath, db: setup } = v9Database();
-    // One public row per kind the level could live under, each encoded
-    // through its own schema.
-    for (const entry of PUBLIC_ROW_KINDS_AT_RETIREMENT) {
-      insert(
-        setup,
-        entry.kind,
-        `${entry.kind}_public`,
-        envelopeBytes(
-          entry.schema,
-          `${entry.kind}_public`,
-          ApiResourceVisibility.visibility_public,
-        ),
-      );
-    }
-    const orgBytes = agentBytes(
-      "agt_org",
-      ApiResourceVisibility.visibility_org,
-    );
-    const privateBytes = agentBytes(
-      "agt_private",
-      ApiResourceVisibility.visibility_private,
-    );
-    insert(setup, "agent", "agt_org", orgBytes);
-    insert(setup, "agent", "agt_private", privateBytes);
-    setup.close();
-
-    const store = SqliteStore.open(dbPath);
-    cleanups.push(() => store.close());
-    const db = new DatabaseSync(dbPath);
-    cleanups.push(() => db.close());
-
-    expect(getSchemaVersion(db)).toBe(CURRENT_SCHEMA_VERSION);
-    for (const entry of PUBLIC_ROW_KINDS_AT_RETIREMENT) {
-      const moved = row(db, entry.kind, `${entry.kind}_public`);
-      expect(moved.data, entry.kind).toEqual(
-        envelopeBytes(
-          entry.schema,
-          `${entry.kind}_public`,
-          ApiResourceVisibility.visibility_org,
-        ),
-      );
-      expect(moved.updated_at, `${entry.kind} updated_at bumped`).not.toBe(
-        "2026-09-01 00:00:00",
-      );
-    }
-    expect(row(db, "agent", "agt_org")).toEqual({
-      data: orgBytes,
-      updated_at: "2026-09-01 00:00:00",
-    });
-    expect(row(db, "agent", "agt_private")).toEqual({
-      data: privateBytes,
-      updated_at: "2026-09-01 00:00:00",
-    });
-    const publicLeft = db
-      .prepare(`SELECT count(*) AS n FROM resources WHERE kind = 'agent'`)
-      .get() as { n: number };
-    expect(publicLeft.n).toBe(3);
-  });
-
-  it("a row of a kind outside the frozen table is never decoded", () => {
-    const { dbPath, db: setup } = v9Database();
-    // Bytes no schema decodes, under a kind the level never applied to.
-    insert(setup, "session", "ses_opaque", new Uint8Array([0xff, 0xff]));
-    setup.close();
-
-    const store = SqliteStore.open(dbPath);
-    cleanups.push(() => store.close());
-    const db = new DatabaseSync(dbPath);
-    cleanups.push(() => db.close());
-    expect(getSchemaVersion(db)).toBe(CURRENT_SCHEMA_VERSION);
-    expect(row(db, "session", "ses_opaque").data).toEqual(
-      new Uint8Array([0xff, 0xff]),
-    );
-  });
-
-  it("a row of a table kind that does not decode fails the step, names the row, and leaves the database at v9 with every row untouched", () => {
-    const { dbPath, db: setup } = v9Database();
-    const publicBytes = agentBytes(
-      "agt_public",
-      ApiResourceVisibility.visibility_public,
-    );
-    insert(setup, "agent", "agt_public", publicBytes);
-    insert(setup, "agent", "agt_broken", new Uint8Array([0xff, 0xff, 0xff]));
-    setup.close();
-
-    expect(() => SqliteStore.open(dbPath)).toThrow(
-      /migrate to v10: .*agent 'agt_broken' cannot be moved off the retired public level/,
-    );
-
-    const db = new DatabaseSync(dbPath);
-    cleanups.push(() => db.close());
-    expect(getSchemaVersion(db)).toBe(SCHEMA_VERSION_10 - 1);
-    expect(row(db, "agent", "agt_public").data).toEqual(publicBytes);
-  });
-});

package/src/store/sqlite/migrations.ts

@@ -32,11 +32,6 @@
  */
 import type { DatabaseSync } from "node:sqlite";
 
-import {
-  PUBLIC_ROW_KINDS_AT_RETIREMENT,
-  movePublicRowToOrg,
-} from "../public-visibility-retired.js";
-
 export const SCHEMA_VERSION_1 = 1;
 export const SCHEMA_VERSION_2 = 2;
 export const SCHEMA_VERSION_3 = 3;
@@ -49,11 +44,9 @@ export const SCHEMA_VERSION_7 = 7;
 export const SCHEMA_VERSION_8 = 8;
 /** v9: the rows of the removed Project kind deleted. */
 export const SCHEMA_VERSION_9 = 9;
-/** v10: every row holding the retired public visibility level moved to org. */
-export const SCHEMA_VERSION_10 = 10;
 
 /** Target version for new databases. */
-export const CURRENT_SCHEMA_VERSION = SCHEMA_VERSION_10;
+export const CURRENT_SCHEMA_VERSION = SCHEMA_VERSION_9;
 
 /** Applies all pending migrations in order. */
 export function runMigrations(db: DatabaseSync): void {
@@ -76,7 +69,6 @@ export function runMigrations(db: DatabaseSync): void {
     [SCHEMA_VERSION_7, migrateToV7],
     [SCHEMA_VERSION_8, migrateToV8],
     [SCHEMA_VERSION_9, migrateToV9],
-    [SCHEMA_VERSION_10, migrateToV10],
   ];
 
   for (const [version, migrate] of chain) {
@@ -387,39 +379,3 @@ function migrateToV9(db: DatabaseSync): void {
     DELETE FROM resource_audit WHERE kind = 'project';
   `);
 }
-
-/**
- * v10: the public visibility level is retired, so every row that still
- * holds it is moved to org visibility — the chain's first migration that
- * decodes a row (public-visibility-retired.ts says why a migration, why
- * the kind table is frozen there, and why an undecodable row fails the
- * step). This step owns the SQL: one read per kind in the frozen table,
- * one UPDATE per moved row with `updated_at` bumped the way saveResource
- * bumps it, rows that hold any other level left byte-for-byte as they
- * are. Runs inside applyInTransaction's BEGIN, so a throw from the mover
- * rolls the whole step back and the boot stops on the row it names.
- */
-function migrateToV10(db: DatabaseSync): void {
-  const update = db.prepare(
-    `UPDATE resources SET data = ?, updated_at = datetime('now') WHERE kind = ? AND id = ?`,
-  );
-  for (const entry of PUBLIC_ROW_KINDS_AT_RETIREMENT) {
-    const rows = db
-      .prepare(`SELECT id, data FROM resources WHERE kind = ?`)
-      .all(entry.kind) as Array<{ id: string; data: Uint8Array }>;
-    for (const row of rows) {
-      let moved: Uint8Array | undefined;
-      try {
-        moved = movePublicRowToOrg(entry, row.data);
-      } catch (error) {
-        throw new Error(
-          `${entry.kind} '${row.id}' cannot be moved off the retired public level: ${String(error)}`,
-          { cause: error },
-        );
-      }
-      if (moved !== undefined) {
-        update.run(moved, entry.kind, row.id);
-      }
-    }
-  }
-}

package/src/store/sqlite/store.ts

@@ -820,15 +820,21 @@ export class SqliteStore implements Store {
     const kindPlaceholders = query.kinds.map(() => "?").join(",");
     const kindArgs = [...query.kinds];
 
-    // The scope-filter fragments: the org filter, strict (a row is in the
-    // requested org or it is not; visibility never widens or narrows the
-    // scope), then the authorized-id allowlist.
+    // The scope-filter fragments, byte-identical to Go's buildScopeFilter:
+    // org (strict or public-widened) and the independent public subtraction.
     const scopeClauses: string[] = [];
     const scopeArgs: string[] = [];
     if (query.orgFilter !== "") {
-      scopeClauses.push(`AND org = ?`);
+      scopeClauses.push(
+        query.crossOrgPublic
+          ? `AND (org = ? OR visibility = 'visibility_public')`
+          : `AND org = ?`,
+      );
       scopeArgs.push(query.orgFilter);
     }
+    if (query.excludePublic) {
+      scopeClauses.push(`AND visibility != 'visibility_public'`);
+    }
     if (query.authorizedIdsByKind !== undefined) {
       // The 20260830.01 scoping arm: per-kind resource_id allowlists.
       // An empty set contributes NO clause — that kind matches nothing —