@team-semicolon/semicolony-cli 4.18.104 → 4.18.106

package/migrations/203_action_item_redesign_cutover.sql

@@ -0,0 +1,1369 @@
+-- 203_action_item_redesign_cutover.sql
+--
+-- Measured on 2026-08-12 against the live operator database, the old table had
+-- 1,757 rows and could not answer who owned anything:
+--   * assignee NULL in 1,526 rows (86.8%), free text otherwise
+--   * owner_domain conflated person and project domains under one ontology FK
+--   * deadline NULL in 1,243 rows (70.7%); 334 open rows already overdue
+--   * source uncontrolled free text, 50+ values including raw Slack coordinates
+--   * runtime_source NULL in 1,429 rows and 'manual' in 328 — no provenance
+--
+-- The rename and the create live in one file on purpose: two migrations would
+-- leave a window in which slack-router and the dashboard see no action_items
+-- table at all.
+
+ALTER TABLE semicolony.action_items
+  RENAME TO action_items_archive_20260812;
+
+COMMENT ON TABLE semicolony.action_items_archive_20260812 IS
+  'Frozen pre-redesign action items (1,757 rows as of 2026-08-12). Read-only. Rollback path: run packages/cli/scripts/rollback-action-item-redesign.sql -- a bare rename-back does not work (see that file''s header: the inbound action_item_events FK, the seven archive index names, record_feedback still reading the archive, and the four write functions late-binding to the wrong table all have to be reversed together).';
+
+-- ALTER TABLE ... RENAME does not rename the table's indexes: index names
+-- live in the schema namespace, not the table's, so after the rename above
+-- these seven names still sit on the archive and collide with what this file
+-- creates below. Measured live indexes on action_items (2026-08-13, against
+-- the production schema dump taken after migrations 198-201 landed):
+-- action_items_pkey, action_items_assignee_status_idx,
+-- action_items_created_at_idx, action_items_owner_domain_status_idx,
+-- action_items_target_domain_status_idx, idx_action_items_meeting,
+-- idx_action_items_tenant. Three collide today —
+-- action_items_assignee_status_idx explicitly (CREATE INDEX fails with
+-- 42P07: relation already exists), idx_action_items_meeting explicitly for
+-- exactly the same reason now that this file recreates it on the new table
+-- (added by 198_meeting_record_canonical.sql, which is why the earlier
+-- six-index list is no longer complete), and action_items_pkey implicitly
+-- (the new table's unnamed PRIMARY KEY would silently be named
+-- action_items_pkey1 instead of erroring, leaving the live table with a
+-- mangled constraint name). Renaming all seven, not just the three that
+-- collide right now, so a future index added to either this file or the
+-- archive doesn't reopen the same trap. ALTER INDEX is catalog-only and
+-- transactional, so it belongs in this same file/transaction as the rename
+-- it depends on. idx_action_items_tenant is renamed here for the same reason
+-- but deliberately not recreated on the new table below — that gap is a
+-- separate, already-recorded deferred item, not part of this fix.
+ALTER INDEX semicolony.action_items_pkey RENAME TO action_items_pkey_archive_20260812;
+ALTER INDEX semicolony.action_items_assignee_status_idx RENAME TO action_items_assignee_status_idx_archive_20260812;
+ALTER INDEX semicolony.action_items_created_at_idx RENAME TO action_items_created_at_idx_archive_20260812;
+ALTER INDEX semicolony.action_items_owner_domain_status_idx RENAME TO action_items_owner_domain_status_idx_archive_20260812;
+ALTER INDEX semicolony.action_items_target_domain_status_idx RENAME TO action_items_target_domain_status_idx_archive_20260812;
+ALTER INDEX semicolony.idx_action_items_meeting RENAME TO idx_action_items_meeting_archive_20260812;
+ALTER INDEX semicolony.idx_action_items_tenant RENAME TO idx_action_items_tenant_archive_20260812;
+
+CREATE TABLE semicolony.action_items (
+  action_item_id     uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  description        text NOT NULL CHECK (length(btrim(description)) >= 5),
+
+  assignee_kind      text NOT NULL
+                       CHECK (assignee_kind IN ('team-member', 'agent', 'unassigned')),
+  assignee_member_id uuid REFERENCES semicolony.team_members(member_id),
+  assignee_agent_id  text REFERENCES semicolony.bot_status(bot_id),
+  assignee_device_id text,
+  external_contact   text,
+
+  project_domain     varchar(100) NOT NULL,
+  project_entity     text GENERATED ALWAYS AS ('service') STORED,
+
+  issued_at          timestamptz NOT NULL DEFAULT now(),
+  deadline           date NOT NULL,
+  completed_at       timestamptz,
+
+  status             text NOT NULL DEFAULT 'open'
+                       CHECK (status IN ('open', 'in_progress', 'blocked', 'done', 'cancelled')),
+  priority           text NOT NULL DEFAULT 'normal'
+                       CHECK (priority IN ('low', 'normal', 'high', 'urgent')),
+
+  origin_surface     text NOT NULL
+                       CHECK (origin_surface IN ('worker', 'system', 'dashboard')),
+  origin_actor_kind  text CHECK (origin_actor_kind IN ('human', 'agent')),
+  origin_member_id   uuid REFERENCES semicolony.team_members(member_id),
+  origin_agent_id    text REFERENCES semicolony.bot_status(bot_id),
+  origin_device_id   text REFERENCES semicolony.worker_devices(device_id),
+  origin_harness     text CHECK (origin_harness IN
+                       ('claude-code', 'codex', 'cli', 'slack', 'web', 'cron')),
+  origin_session_key text,
+
+  source_kind        text NOT NULL CHECK (source_kind IN
+                       ('meeting', 'feedback', 'incident', 'review',
+                        'decision', 'manual', 'cron', 'slack', 'kb')),
+  source_ref         text,
+  related_url        text,
+
+  -- Carried forward from 198_meeting_record_canonical.sql, which added this
+  -- column (and idx_action_items_meeting below) to the pre-redesign table
+  -- while this branch was in review. The typed relation is kept rather than
+  -- folded into source_kind/source_ref: source_ref is uncontrolled text and
+  -- cannot express "this row belongs to that meeting" to the planner or to a
+  -- FK, and record_meeting's idempotency (delete-and-recreate this meeting's
+  -- machine-created items, leave every human-filed item alone) is defined by
+  -- exactly this column. Same target and same nullability as 198 declared:
+  -- nullable, because the overwhelming majority of action items have no
+  -- meeting and must not be invented one. source_kind='meeting' /
+  -- source_ref=<meeting_id> is written alongside it so the untyped source
+  -- vocabulary stays complete for readers that only know that pair.
+  meeting_id         uuid REFERENCES semicolony.meetings(meeting_id),
+
+  metadata           jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at         timestamptz NOT NULL DEFAULT now(),
+  updated_at         timestamptz NOT NULL DEFAULT now(),
+
+  tenant_id          uuid,
+  scope              text NOT NULL DEFAULT 'platform-global'
+                       CHECK (scope IN ('tenant-local', 'platform-global')),
+  install_id         uuid,
+
+  FOREIGN KEY (project_domain, project_entity)
+    REFERENCES semicolony.ontology(domain, entity_type),
+  FOREIGN KEY (assignee_device_id, assignee_member_id)
+    REFERENCES semicolony.worker_devices(device_id, member_id),
+
+  -- MATCH SIMPLE skips the composite FK entirely when one column is NULL, so a
+  -- device with no member would be unverified. MATCH FULL cannot be used: it
+  -- would also reject the common (no device, member) case.
+  CONSTRAINT action_items_device_requires_member
+    CHECK (assignee_device_id IS NULL OR assignee_member_id IS NOT NULL),
+  CONSTRAINT action_items_member_assignee
+    CHECK (assignee_kind <> 'team-member' OR assignee_member_id IS NOT NULL),
+  CONSTRAINT action_items_agent_assignee
+    CHECK (assignee_kind <> 'agent' OR assignee_agent_id IS NOT NULL),
+  CONSTRAINT action_items_unassigned_is_empty
+    CHECK (assignee_kind <> 'unassigned'
+           OR (assignee_member_id IS NULL AND assignee_agent_id IS NULL)),
+  CONSTRAINT action_items_worker_origin_has_actor
+    CHECK (origin_surface <> 'worker' OR origin_actor_kind IS NOT NULL),
+  CONSTRAINT action_items_human_origin_complete
+    CHECK (origin_actor_kind <> 'human'
+           OR (origin_member_id IS NOT NULL AND origin_harness IS NOT NULL)),
+  CONSTRAINT action_items_agent_origin_complete
+    CHECK (origin_actor_kind <> 'agent' OR origin_agent_id IS NOT NULL),
+  CONSTRAINT action_items_done_has_timestamp
+    CHECK (status <> 'done' OR completed_at IS NOT NULL)
+);
+
+CREATE INDEX action_items_status_deadline_idx ON semicolony.action_items (status, deadline);
+CREATE INDEX action_items_assignee_status_idx ON semicolony.action_items (assignee_member_id, status);
+CREATE INDEX action_items_project_status_idx  ON semicolony.action_items (project_domain, status);
+CREATE INDEX action_items_open_deadline_idx   ON semicolony.action_items (deadline)
+  WHERE status IN ('open', 'in_progress', 'blocked');
+CREATE INDEX action_items_origin_idx          ON semicolony.action_items (origin_surface, origin_actor_kind);
+
+-- Recreated with 198_meeting_record_canonical.sql's exact definition (partial
+-- on meeting_id IS NOT NULL). The name was freed by the archive rename above;
+-- without that rename this statement fails with 42P07, the same way
+-- action_items_assignee_status_idx did on the first scratch-database apply.
+CREATE INDEX IF NOT EXISTS idx_action_items_meeting
+  ON semicolony.action_items (meeting_id) WHERE meeting_id IS NOT NULL;
+
+CREATE TABLE semicolony.action_item_events (
+  event_id        uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  action_item_id  uuid NOT NULL REFERENCES semicolony.action_items(action_item_id) ON DELETE CASCADE,
+  event_type      text NOT NULL CHECK (event_type IN
+                    ('created', 'assigned', 'status_changed', 'deadline_changed', 'noted', 'closed')),
+  actor_kind      text CHECK (actor_kind IN ('human', 'agent', 'system')),
+  actor_member_id uuid REFERENCES semicolony.team_members(member_id),
+  actor_agent_id  text REFERENCES semicolony.bot_status(bot_id),
+  payload         jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at      timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX action_item_events_item_idx ON semicolony.action_item_events (action_item_id, created_at);
+
+CREATE OR REPLACE VIEW semicolony.v_action_actors AS
+  SELECT 'team-member'::text AS actor_kind,
+         tm.domain           AS actor_ref,
+         tm.display_name     AS display_name,
+         coalesce(array_agg(wd.device_id) FILTER (WHERE wd.device_id IS NOT NULL), '{}') AS device_ids
+    FROM semicolony.team_members tm
+    LEFT JOIN semicolony.worker_devices wd ON wd.member_id = tm.member_id
+   WHERE tm.status = 'active'
+   GROUP BY tm.domain, tm.display_name
+  UNION ALL
+  -- F9: <> silently drops a NULL-status bot (NULL <> 'retired' is NULL, not
+  -- true, so WHERE excludes it) instead of treating "no status recorded" as
+  -- "not retired". IS DISTINCT FROM is NULL-safe: a NULL status is retained.
+  SELECT 'agent'::text, bs.bot_id, bs.name, '{}'::text[]
+    FROM semicolony.bot_status bs
+   WHERE bs.status IS DISTINCT FROM 'retired';
+
+-- STABLE, not IMMUTABLE: the function reads current_date, which changes across
+-- calls in different transactions. IMMUTABLE would be legal in index
+-- expressions/generated columns (where the date would freeze at DDL time) and
+-- invites plan-time constant folding — wrong for a moving default.
+CREATE OR REPLACE FUNCTION semicolony.action_item_default_deadline(p_priority text)
+RETURNS date
+LANGUAGE sql STABLE
+AS $$
+  SELECT current_date + CASE p_priority
+           WHEN 'urgent' THEN 1
+           WHEN 'high'   THEN 3
+           WHEN 'low'    THEN 14
+           ELSE 7
+         END;
+$$;
+
+-- F9: every other function in this file gets a REVOKE ALL ... FROM PUBLIC;
+-- this one didn't, so PostgreSQL's default EXECUTE-to-PUBLIC on a new
+-- function left it callable by any role. It doesn't touch data, but nothing
+-- else in this file leaves that gap open, so this one shouldn't either.
+REVOKE ALL ON FUNCTION semicolony.action_item_default_deadline(text) FROM PUBLIC;
+
+CREATE OR REPLACE FUNCTION semicolony.create_action_item(
+  p_description        text,
+  p_project_domain     text,
+  p_deadline           date,
+  p_assignee_kind      text,
+  p_assignee_member    text,
+  p_assignee_agent     text,
+  p_assignee_device    text,
+  p_priority           text,
+  p_source_kind        text,
+  p_source_ref         text,
+  p_related_url        text,
+  p_external_contact   text,
+  p_metadata           jsonb,
+  p_origin_surface     text,
+  p_origin_actor_kind  text,
+  p_origin_member      text,
+  p_origin_agent       text,
+  p_origin_device      text,
+  p_origin_harness     text,
+  p_origin_session_key text
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = pg_catalog
+AS $$
+DECLARE
+  v_assignee_member_id uuid;
+  v_origin_member_id   uuid;
+  v_id                 uuid;
+BEGIN
+  IF p_description IS NULL OR char_length(btrim(p_description)) < 5 THEN
+    RAISE EXCEPTION 'invalid action item description' USING ERRCODE = '22023';
+  END IF;
+  IF p_deadline IS NULL THEN
+    RAISE EXCEPTION 'action item deadline is required' USING ERRCODE = '22023';
+  END IF;
+
+  IF p_assignee_member IS NOT NULL THEN
+    SELECT member_id INTO v_assignee_member_id
+      FROM semicolony.team_members WHERE domain = p_assignee_member;
+    IF v_assignee_member_id IS NULL THEN
+      RAISE EXCEPTION 'unknown team member %', p_assignee_member USING ERRCODE = '22023';
+    END IF;
+  END IF;
+
+  IF p_origin_member IS NOT NULL THEN
+    SELECT member_id INTO v_origin_member_id
+      FROM semicolony.team_members WHERE domain = p_origin_member;
+    IF v_origin_member_id IS NULL THEN
+      RAISE EXCEPTION 'unknown origin member %', p_origin_member USING ERRCODE = '22023';
+    END IF;
+  END IF;
+
+  -- F5: give agent ids the same friendly 22023 validation the member ids
+  -- above get, instead of letting an unknown agent fall through to the raw
+  -- FK violation (23503) at INSERT time below.
+  IF p_assignee_agent IS NOT NULL THEN
+    IF NOT EXISTS (SELECT 1 FROM semicolony.bot_status WHERE bot_id = p_assignee_agent) THEN
+      RAISE EXCEPTION 'unknown assignee agent %', p_assignee_agent USING ERRCODE = '22023';
+    END IF;
+  END IF;
+
+  IF p_origin_agent IS NOT NULL THEN
+    IF NOT EXISTS (SELECT 1 FROM semicolony.bot_status WHERE bot_id = p_origin_agent) THEN
+      RAISE EXCEPTION 'unknown origin agent %', p_origin_agent USING ERRCODE = '22023';
+    END IF;
+  END IF;
+
+  INSERT INTO semicolony.action_items (
+    description, assignee_kind, assignee_member_id, assignee_agent_id,
+    assignee_device_id, external_contact, project_domain, deadline, priority,
+    origin_surface, origin_actor_kind, origin_member_id, origin_agent_id,
+    origin_device_id, origin_harness, origin_session_key,
+    source_kind, source_ref, related_url, metadata
+  ) VALUES (
+    btrim(p_description), p_assignee_kind, v_assignee_member_id, p_assignee_agent,
+    p_assignee_device, p_external_contact, p_project_domain, p_deadline,
+    coalesce(p_priority, 'normal'),
+    p_origin_surface, p_origin_actor_kind, v_origin_member_id, p_origin_agent,
+    p_origin_device, p_origin_harness, p_origin_session_key,
+    p_source_kind, p_source_ref, p_related_url, coalesce(p_metadata, '{}'::jsonb)
+  ) RETURNING action_item_id INTO v_id;
+
+  INSERT INTO semicolony.action_item_events (action_item_id, event_type, actor_kind,
+                                             actor_member_id, actor_agent_id, payload)
+  VALUES (v_id, 'created',
+          CASE WHEN p_origin_actor_kind IS NULL THEN 'system' ELSE p_origin_actor_kind END,
+          v_origin_member_id, p_origin_agent,
+          jsonb_build_object('surface', p_origin_surface, 'harness', p_origin_harness));
+
+  RETURN v_id;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION semicolony.update_action_item(
+  p_action_item_id uuid,
+  p_caller_kind    text,
+  p_caller_member  text,
+  p_caller_agent   text,
+  p_status         text,
+  p_deadline       date,
+  p_note           text,
+  p_metadata       jsonb
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = pg_catalog
+AS $$
+DECLARE
+  v_item            semicolony.action_items%ROWTYPE;
+  v_caller_member_id uuid;
+BEGIN
+  SELECT * INTO v_item FROM semicolony.action_items
+   WHERE action_item_id = p_action_item_id FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'action_item_not_found' USING ERRCODE = 'AI002';
+  END IF;
+
+  -- F1: `metadata || p_metadata` reshapes the jsonb column into an array
+  -- whenever p_metadata is anything but a JSON object (e.g. '[1,2]'::jsonb
+  -- concatenated onto '{"a":1}'::jsonb yields '[{"a":1},1,2]'), and the
+  -- column carries no object CHECK. Reachable from a dashboard PATCH route
+  -- that passes metadata straight from a request body. NULL is valid here
+  -- (it means "no metadata change"), unlike record_feedback's p_metadata,
+  -- which is required -- so this only rejects a non-NULL non-object.
+  IF p_metadata IS NOT NULL AND jsonb_typeof(p_metadata) <> 'object' THEN
+    RAISE EXCEPTION 'invalid action item metadata' USING ERRCODE = '22023';
+  END IF;
+
+  IF p_caller_member IS NOT NULL THEN
+    SELECT member_id INTO v_caller_member_id
+      FROM semicolony.team_members WHERE domain = p_caller_member;
+  END IF;
+
+  -- Ownership is decided here, not in the route: any other caller of this
+  -- function must face the same gate. coalesce(..., false) is load-bearing:
+  -- an unassigned item has assignee_member_id/assignee_agent_id NULL, so the
+  -- bare comparison evaluates to NULL (not false) and a bare `IF NOT (...)`
+  -- would treat NULL as false-y and silently skip the RAISE, letting any
+  -- caller "own" an unassigned item. Every item record_feedback creates is
+  -- unassigned, so this was reachable from production traffic.
+  IF NOT coalesce(
+       (p_caller_kind = 'team-member' AND v_caller_member_id IS NOT NULL
+        AND v_item.assignee_member_id = v_caller_member_id)
+    OR (p_caller_kind = 'agent' AND p_caller_agent IS NOT NULL
+        AND v_item.assignee_agent_id = p_caller_agent),
+    false
+  ) THEN
+    RAISE EXCEPTION 'action_item_not_owned' USING ERRCODE = 'AI001';
+  END IF;
+
+  -- completed_at tracks the *current* status, not just the first time it hit
+  -- 'done': clear it on any move to a different non-NULL status, so
+  -- reopening an item (done -> in_progress) doesn't leave a stale completion
+  -- timestamp that a `completed_at IS NOT NULL` consumer would misread as
+  -- still-done. p_status IS NULL means "leave status unchanged," so
+  -- completed_at is left unchanged too in that case. p_metadata (last
+  -- parameter, so the existing 7-argument call sites are easy to update)
+  -- merges into the row's metadata with ||; NULL means no change — this
+  -- keeps JSON detail out of the free-text p_note field.
+  UPDATE semicolony.action_items
+     SET status       = coalesce(p_status, status),
+         deadline     = coalesce(p_deadline, deadline),
+         -- F7: only stamp completed_at on an actual transition into 'done'.
+         -- `status` here is the table's own pre-update column value (single-
+         -- table UPDATE SET-list expressions see the OLD row), so a done ->
+         -- done no-op re-save leaves the original completion time alone
+         -- instead of silently bumping it to now().
+         completed_at = CASE
+                           WHEN p_status = 'done' AND status IS DISTINCT FROM 'done' THEN now()
+                           WHEN p_status = 'done' THEN completed_at
+                           WHEN p_status IS NOT NULL THEN NULL
+                           ELSE completed_at
+                         END,
+         metadata     = CASE WHEN p_metadata IS NULL THEN metadata ELSE metadata || p_metadata END,
+         updated_at   = now()
+   WHERE action_item_id = p_action_item_id;
+
+  INSERT INTO semicolony.action_item_events (action_item_id, event_type, actor_kind,
+                                             actor_member_id, actor_agent_id, payload)
+  VALUES (p_action_item_id,
+          CASE WHEN p_status = 'done' THEN 'closed'
+               WHEN p_status IS NOT NULL THEN 'status_changed'
+               WHEN p_deadline IS NOT NULL THEN 'deadline_changed'
+               ELSE 'noted' END,
+          CASE WHEN p_caller_kind = 'agent' THEN 'agent' ELSE 'human' END,
+          v_caller_member_id, p_caller_agent,
+          jsonb_build_object('status', p_status, 'deadline', p_deadline, 'note', p_note, 'metadata', p_metadata));
+
+  RETURN p_action_item_id;
+END;
+$$;
+
+-- Authority is separated by GRANT, never by a caller-supplied string:
+-- assign_action_item and operator_update_action_item below carry no
+-- ownership check and are never granted to sc_app (the worker Gateway
+-- role) — only to app and semo_ops_bot. A p_caller_kind='operator' bypass
+-- on update_action_item would have let sc_app simply claim it, so authority
+-- is separated by which role can execute which function instead.
+--
+-- record_feedback creates every item with p_assignee_kind => 'unassigned'
+-- (feedback is unassigned until triaged), and neither create_action_item nor
+-- update_action_item can set an assignee after creation — update_action_item
+-- can't, because its ownership gate above denies every caller when both
+-- assignee_member_id and assignee_agent_id are NULL. Without this function
+-- the entire feedback backlog is permanently unclosable by anyone, and the
+-- dashboard's "담당자 없음" triage flow has no action behind it.
+CREATE OR REPLACE FUNCTION semicolony.assign_action_item(
+  p_action_item_id  uuid,
+  p_assignee_kind   text,
+  p_assignee_member text,
+  p_assignee_agent  text,
+  p_assignee_device text,
+  p_actor_kind      text,
+  p_actor_member    text,
+  p_actor_agent     text
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = pg_catalog
+AS $$
+DECLARE
+  v_assignee_member_id uuid;
+  v_actor_member_id    uuid;
+BEGIN
+  PERFORM 1 FROM semicolony.action_items WHERE action_item_id = p_action_item_id FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'action_item_not_found' USING ERRCODE = 'AI002';
+  END IF;
+
+  IF p_assignee_member IS NOT NULL THEN
+    SELECT member_id INTO v_assignee_member_id
+      FROM semicolony.team_members WHERE domain = p_assignee_member;
+    IF v_assignee_member_id IS NULL THEN
+      RAISE EXCEPTION 'unknown team member %', p_assignee_member USING ERRCODE = '22023';
+    END IF;
+  END IF;
+
+  -- F4: on this ungated path the event row's actor is the only
+  -- accountability control, so an unknown actor domain must not silently
+  -- resolve to a NULL actor. Same friendly-error form create_action_item
+  -- already uses for p_origin_member.
+  IF p_actor_member IS NOT NULL THEN
+    SELECT member_id INTO v_actor_member_id
+      FROM semicolony.team_members WHERE domain = p_actor_member;
+    IF v_actor_member_id IS NULL THEN
+      RAISE EXCEPTION 'unknown actor member %', p_actor_member USING ERRCODE = '22023';
+    END IF;
+  END IF;
+
+  -- assignee_kind/assignee_member_id/assignee_agent_id/assignee_device_id
+  -- consistency (team-member needs a member, agent needs an agent,
+  -- unassigned needs neither, a device needs a member) is enforced by the
+  -- table's own CHECK/FK constraints — the same ones create_action_item's
+  -- INSERT is subject to — so this UPDATE doesn't duplicate that logic.
+  UPDATE semicolony.action_items
+     SET assignee_kind      = p_assignee_kind,
+         assignee_member_id = v_assignee_member_id,
+         assignee_agent_id  = p_assignee_agent,
+         assignee_device_id = p_assignee_device,
+         updated_at         = now()
+   WHERE action_item_id = p_action_item_id;
+
+  INSERT INTO semicolony.action_item_events (action_item_id, event_type, actor_kind,
+                                             actor_member_id, actor_agent_id, payload)
+  VALUES (p_action_item_id, 'assigned',
+          -- F4: match create_action_item's actor_kind default (NULL ->
+          -- 'system'), not a bare "anything but 'agent' is 'human'" that
+          -- silently mislabels an unspecified actor as a person.
+          CASE WHEN p_actor_kind IS NULL THEN 'system' ELSE p_actor_kind END,
+          v_actor_member_id, p_actor_agent,
+          jsonb_build_object('assignee_kind', p_assignee_kind,
+                              'assignee_member', p_assignee_member,
+                              'assignee_agent', p_assignee_agent,
+                              'assignee_device', p_assignee_device));
+
+  RETURN p_action_item_id;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION semicolony.operator_update_action_item(
+  p_action_item_id uuid,
+  p_status         text,
+  p_deadline       date,
+  p_note           text,
+  p_metadata       jsonb,
+  p_actor_kind     text,
+  p_actor_member   text,
+  p_actor_agent    text
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = pg_catalog
+AS $$
+DECLARE
+  v_actor_member_id uuid;
+BEGIN
+  PERFORM 1 FROM semicolony.action_items WHERE action_item_id = p_action_item_id FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'action_item_not_found' USING ERRCODE = 'AI002';
+  END IF;
+
+  -- F1: same non-object metadata guard as update_action_item -- see that
+  -- function's comment. NULL still means "no metadata change".
+  IF p_metadata IS NOT NULL AND jsonb_typeof(p_metadata) <> 'object' THEN
+    RAISE EXCEPTION 'invalid action item metadata' USING ERRCODE = '22023';
+  END IF;
+
+  -- F4: this is the other ungated path -- same unknown-actor guard as
+  -- assign_action_item above, for the same reason (the event row is the
+  -- only accountability control here).
+  IF p_actor_member IS NOT NULL THEN
+    SELECT member_id INTO v_actor_member_id
+      FROM semicolony.team_members WHERE domain = p_actor_member;
+    IF v_actor_member_id IS NULL THEN
+      RAISE EXCEPTION 'unknown actor member %', p_actor_member USING ERRCODE = '22023';
+    END IF;
+  END IF;
+
+  -- No ownership check — same completed_at-clearing semantics as
+  -- update_action_item above (J3), so an operator reopening an item doesn't
+  -- leave a stale completion timestamp either.
+  UPDATE semicolony.action_items
+     SET status       = coalesce(p_status, status),
+         deadline     = coalesce(p_deadline, deadline),
+         -- F7: only stamp completed_at on an actual transition into 'done'.
+         -- `status` here is the table's own pre-update column value (single-
+         -- table UPDATE SET-list expressions see the OLD row), so a done ->
+         -- done no-op re-save leaves the original completion time alone
+         -- instead of silently bumping it to now().
+         completed_at = CASE
+                           WHEN p_status = 'done' AND status IS DISTINCT FROM 'done' THEN now()
+                           WHEN p_status = 'done' THEN completed_at
+                           WHEN p_status IS NOT NULL THEN NULL
+                           ELSE completed_at
+                         END,
+         metadata     = CASE WHEN p_metadata IS NULL THEN metadata ELSE metadata || p_metadata END,
+         updated_at   = now()
+   WHERE action_item_id = p_action_item_id;
+
+  -- The acting operator is still named in the event row even though there is
+  -- no ownership gate, so the audit trail keeps a person attached to the
+  -- change.
+  INSERT INTO semicolony.action_item_events (action_item_id, event_type, actor_kind,
+                                             actor_member_id, actor_agent_id, payload)
+  VALUES (p_action_item_id,
+          CASE WHEN p_status = 'done' THEN 'closed'
+               WHEN p_status IS NOT NULL THEN 'status_changed'
+               WHEN p_deadline IS NOT NULL THEN 'deadline_changed'
+               ELSE 'noted' END,
+          -- F4: match create_action_item's actor_kind default (NULL ->
+          -- 'system'), same as assign_action_item above.
+          CASE WHEN p_actor_kind IS NULL THEN 'system' ELSE p_actor_kind END,
+          v_actor_member_id, p_actor_agent,
+          jsonb_build_object('status', p_status, 'deadline', p_deadline, 'note', p_note, 'metadata', p_metadata));
+
+  RETURN p_action_item_id;
+END;
+$$;
+
+REVOKE ALL ON TABLE
+  semicolony.action_items,
+  semicolony.action_item_events,
+  semicolony.team_members,
+  semicolony.v_action_actors,
+  semicolony.action_items_archive_20260812
+FROM PUBLIC, sc_app;
+
+GRANT SELECT ON TABLE
+  semicolony.action_items,
+  semicolony.action_item_events,
+  semicolony.team_members,
+  semicolony.v_action_actors
+TO sc_app;
+
+-- F2: the table comment above calls the archive 'Read-only.', but ALTER
+-- TABLE ... RENAME carries the *entire* ACL from the old live table onto it
+-- -- including app's DELETE/TRUNCATE and semo_ops_bot's INSERT/UPDATE/DELETE,
+-- exactly the write access "read-only" promises does not exist. Nothing in
+-- this repository writes to the archive; the only reference anywhere is the
+-- SELECT inside record_feedback below. Revoke every write verb and leave
+-- SELECT for the roles that already had it, using the same REVOKE ALL /
+-- GRANT SELECT shape as the sc_app block above. semo_ops_bot is guarded
+-- inside the same pg_roles existence check its other grants below use (no
+-- creating migration for that role in this repo, so a bare statement
+-- referencing it would abort the whole migration where it was never
+-- provisioned); app is revoked unguarded since it is always present, same
+-- precedent as the GRANT ALL ... TO app below.
+REVOKE ALL ON TABLE semicolony.action_items_archive_20260812 FROM app;
+GRANT SELECT ON TABLE semicolony.action_items_archive_20260812 TO app;
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'semo_ops_bot') THEN
+    EXECUTE 'REVOKE ALL ON TABLE semicolony.action_items_archive_20260812 FROM semo_ops_bot';
+    EXECUTE 'GRANT SELECT ON TABLE semicolony.action_items_archive_20260812 TO semo_ops_bot';
+  END IF;
+END
+$$;
+
+-- The archive also still carries the BEFORE UPDATE trigger inherited from
+-- 069_action_items_sot.sql (trg_action_items_updated). A table the comment
+-- calls read-only has no business running an updated_at-maintaining trigger.
+DROP TRIGGER IF EXISTS trg_action_items_updated ON semicolony.action_items_archive_20260812;
+
+-- Reproduce the grant surface the live production action_items table carried
+-- before the rename (measured 2026-08-12): app full DML (table owner), sc_app
+-- SELECT-only, sc_fleet_board SELECT for the /ops control room board
+-- (migration 196 — that board once broke with "permission denied for table
+-- action_items" when this grant was missing), and semo_ops_bot's four DML
+-- verbs. RENAME carries this matrix onto the archive automatically, but the
+-- fresh CREATE TABLE above starts with none of it, so every grantee besides
+-- sc_app must be restated here. sc_app staying SELECT/EXECUTE-only is the one
+-- invariant this migration tightens; the other three roles are unaffected.
+-- app is granted unguarded, matching precedent
+-- (186_worker_agent_decision_capture.sql:308,313 also grants to app unguarded)
+-- since app is the migration-running/owning role and is always present.
+GRANT ALL ON TABLE semicolony.action_items TO app;
+
+-- sc_fleet_board and semo_ops_bot are NOT created by this migration (or by
+-- any migration in this repo, in semo_ops_bot's case), so a bare GRANT to
+-- either fails with "role ... does not exist" on any database where that
+-- role was never provisioned — e.g. the throwaway Docker instance a later
+-- task applies this file to. Because the runner wraps the whole migration in
+-- one transaction, that failure would roll back the entire cutover. Guarded
+-- the same way 174/176/135 guard role creation, but skipping the grant
+-- instead of creating the role: this migration doesn't own either role's
+-- lifecycle, so it shouldn't fabricate one.
+--
+-- team_members and v_action_actors SELECT added here for the same two roles
+-- (the same class of gap migration 196 exists to repair): the dashboard port
+-- added `LEFT JOIN semicolony.team_members` on the pool that connects as
+-- sc_fleet_board, and that role's twelve-table grant list measured live
+-- doesn't include team_members — every /ops action-board request would fail
+-- 42501 permission denied. Other dashboard reads go through either app or
+-- semo_ops_bot and which one couldn't be determined from here, so both are
+-- covered. v_action_actors is granted alongside it for a later plan's
+-- assignee-picker work, since a second grant-gap round costs a full cycle
+-- and adding it now costs nothing. action_item_events is deliberately not
+-- granted here — no current reader needs it.
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'sc_fleet_board') THEN
+    RAISE NOTICE 'sc_fleet_board role not found; skipping action_items/team_members/v_action_actors grants';
+  ELSE
+    EXECUTE 'GRANT SELECT ON TABLE semicolony.action_items, semicolony.team_members, semicolony.v_action_actors TO sc_fleet_board';
+  END IF;
+
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'semo_ops_bot') THEN
+    RAISE NOTICE 'semo_ops_bot role not found; skipping action_items/team_members/v_action_actors grants';
+  ELSE
+    EXECUTE 'GRANT INSERT, SELECT, UPDATE, DELETE ON TABLE semicolony.action_items TO semo_ops_bot';
+    EXECUTE 'GRANT SELECT ON TABLE semicolony.team_members, semicolony.v_action_actors TO semo_ops_bot';
+  END IF;
+END
+$$;
+
+REVOKE ALL ON FUNCTION
+  semicolony.create_action_item(text, text, date, text, text, text, text, text, text,
+                                text, text, text, jsonb, text, text, text, text, text, text, text),
+  semicolony.update_action_item(uuid, text, text, text, text, date, text, jsonb)
+FROM PUBLIC;
+
+GRANT EXECUTE ON FUNCTION
+  semicolony.create_action_item(text, text, date, text, text, text, text, text, text,
+                                text, text, text, jsonb, text, text, text, text, text, text, text),
+  semicolony.update_action_item(uuid, text, text, text, text, date, text, jsonb)
+TO sc_app;
+
+-- assign_action_item and operator_update_action_item carry no ownership
+-- check (see the comment above assign_action_item), so sc_app — the worker
+-- Gateway role — must appear in no grant for either. Granted to app
+-- unguarded, matching the table grant precedent above and
+-- 186_worker_agent_decision_capture.sql:308,313, and to semo_ops_bot inside
+-- the same pg_roles existence guard already used for the table grants (that
+-- role has no creating migration in this repo, so a bare grant would abort
+-- the whole migration on a database where it was never provisioned).
+REVOKE ALL ON FUNCTION
+  semicolony.assign_action_item(uuid, text, text, text, text, text, text, text),
+  semicolony.operator_update_action_item(uuid, text, date, text, jsonb, text, text, text)
+FROM PUBLIC;
+
+GRANT EXECUTE ON FUNCTION
+  semicolony.assign_action_item(uuid, text, text, text, text, text, text, text),
+  semicolony.operator_update_action_item(uuid, text, date, text, jsonb, text, text, text)
+TO app;
+
+-- create_action_item is also granted to semo_ops_bot here — same class of gap
+-- as L1 (team_members/v_action_actors), this time on a function grant instead
+-- of a table grant. Both the dashboard (lib/core/action-items.ts) and the
+-- Slack router (packages/slack-router/src/action-items.ts) call
+-- create_action_item, and neither connects as the worker Gateway role above;
+-- which of app/semo_ops_bot either deployment's DATABASE_URL actually
+-- resolves to could not be measured, so both are covered rather than guessed
+-- at. This confers nothing new in substance: semo_ops_bot already holds
+-- INSERT/SELECT/UPDATE/DELETE directly on action_items (see the table grant
+-- above), so it could already write the rows — create_action_item is the
+-- constrained, provenance-stamping path we would rather it use instead of
+-- raw DML. update_action_item is deliberately NOT granted here: it is the
+-- ownership-gated worker function, and operator surfaces have
+-- operator_update_action_item (already granted above) for the same job.
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'semo_ops_bot') THEN
+    RAISE NOTICE 'semo_ops_bot role not found; skipping assign_action_item/operator_update_action_item/create_action_item grants';
+  ELSE
+    EXECUTE 'GRANT EXECUTE ON FUNCTION semicolony.assign_action_item(uuid, text, text, text, text, text, text, text) TO semo_ops_bot';
+    EXECUTE 'GRANT EXECUTE ON FUNCTION semicolony.operator_update_action_item(uuid, text, date, text, jsonb, text, text, text) TO semo_ops_bot';
+    EXECUTE 'GRANT EXECUTE ON FUNCTION semicolony.create_action_item(text, text, date, text, text, text, text, text, text, text, text, text, jsonb, text, text, text, text, text, text, text) TO semo_ops_bot';
+  END IF;
+END
+$$;
+
+-- record_feedback rewritten onto the redesigned model. Signature reproduced
+-- exactly (p_embedding before p_worker_id, same RETURNS TABLE) so this
+-- CREATE OR REPLACE replaces the existing function instead of adding a second
+-- overload the Gateway would never call. search_path stays pg_catalog only,
+-- matching the function as it runs in production today: retargetSchemaSql's
+-- qualifier rewrite requires a trailing dot ("semicolony." not bare
+-- "semicolony"), so a bare schema name placed here would NOT be retargeted to
+-- semo_ops and would point at a schema that doesn't exist there. The inner
+-- semicolony.create_action_item(...) call below resolves correctly regardless
+-- of search_path only because it is itself schema-qualified, not because of
+-- anything set here.
+CREATE OR REPLACE FUNCTION semicolony.record_feedback(
+  p_slug text,
+  p_summary text,
+  p_content text,
+  p_metadata jsonb,
+  p_embedding text,
+  p_worker_id text,
+  p_device_id text
+)
+RETURNS TABLE(kb_id bigint, action_item_id uuid, duplicate boolean)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+  v_kb_id bigint;
+  v_action_item_id uuid;
+  v_duplicate boolean := false;
+  v_metadata jsonb;
+  v_priority text;
+  v_source text;
+BEGIN
+  IF p_slug IS NULL
+     OR char_length(p_slug) < 3
+     OR char_length(p_slug) > 60
+     OR p_slug !~ '^[[:alnum:]가-힣][[:alnum:]가-힣-]*$' THEN
+    RAISE EXCEPTION 'invalid feedback slug' USING ERRCODE = '22023';
+  END IF;
+  IF p_summary IS NULL OR char_length(btrim(p_summary)) < 8 OR char_length(p_summary) > 500 THEN
+    RAISE EXCEPTION 'invalid feedback summary' USING ERRCODE = '22023';
+  END IF;
+  IF p_content IS NULL OR char_length(p_content) < 30 OR char_length(p_content) > 30000 THEN
+    RAISE EXCEPTION 'invalid feedback content' USING ERRCODE = '22023';
+  END IF;
+  IF p_metadata IS NULL OR jsonb_typeof(p_metadata) <> 'object' THEN
+    RAISE EXCEPTION 'invalid feedback metadata' USING ERRCODE = '22023';
+  END IF;
+  IF p_metadata ->> 'category' NOT IN ('context-failure', 'env-drift', 'policy-gap', 'tooling') THEN
+    RAISE EXCEPTION 'invalid feedback category' USING ERRCODE = '22023';
+  END IF;
+  v_priority := coalesce(p_metadata ->> 'severity', 'normal');
+  IF v_priority NOT IN ('low', 'normal', 'high', 'urgent') THEN
+    RAISE EXCEPTION 'invalid feedback severity' USING ERRCODE = '22023';
+  END IF;
+  IF p_worker_id IS NULL OR p_worker_id !~ '^[a-z][a-z0-9-]{0,63}$'
+     OR p_device_id IS NULL
+     OR (p_device_id !~ '^[a-z][a-z0-9-]{0,99}$'
+         AND p_device_id <> 'hermes-principals@hermes') THEN
+    RAISE EXCEPTION 'invalid worker/device binding' USING ERRCODE = '22023';
+  END IF;
+
+  v_source := coalesce(p_metadata ->> 'source', 'session-hook');
+  IF v_source NOT IN ('session-hook', 'runtime-native-tool') THEN
+    RAISE EXCEPTION 'invalid feedback source' USING ERRCODE = '22023';
+  END IF;
+  IF v_source = 'runtime-native-tool' AND NOT (
+    p_worker_id IN ('semi', 'colony')
+    AND p_device_id = 'hermes-principals@hermes'
+    AND p_metadata ->> 'reported_by' = p_worker_id
+    AND p_metadata ->> 'installation_id' = 'hermes-principals@hermes'
+    AND p_metadata ->> 'runtime_kind' = 'hermes-cli'
+    AND p_metadata ->> 'profile_id' = 'semo-ops-worker-agent'
+    AND (
+      (p_worker_id = 'semi' AND p_metadata ->> 'runtime_profile' = 'semo-semi')
+      OR (p_worker_id = 'colony' AND p_metadata ->> 'runtime_profile' = 'semo-colony')
+    )
+  ) THEN
+    RAISE EXCEPTION 'invalid runtime-native feedback attribution' USING ERRCODE = '22023';
+  END IF;
+
+  PERFORM p_embedding::public.vector;
+  PERFORM pg_advisory_xact_lock(hashtextextended('feedback:' || p_slug, 0));
+
+  v_metadata := p_metadata || jsonb_build_object(
+    'status', 'open',
+    'source', v_source,
+    'worker_id', p_worker_id,
+    'device_id', p_device_id
+  );
+
+  INSERT INTO semicolony.knowledge_base AS kb (
+    domain, key, sub_key, content, created_by, embedding, metadata
+  ) VALUES (
+    'semicolon',
+    'feedback',
+    p_slug,
+    p_content,
+    'feedback-pipeline:' || p_worker_id,
+    p_embedding::public.vector,
+    v_metadata
+  )
+  ON CONFLICT (domain, key, sub_key) DO UPDATE SET
+    content = EXCLUDED.content,
+    embedding = EXCLUDED.embedding,
+    metadata = coalesce(kb.metadata, '{}'::jsonb) || EXCLUDED.metadata,
+    archived = false,
+    updated_at = clock_timestamp()
+  RETURNING kb.kb_id INTO v_kb_id;
+
+  -- Duplicate check now spans the archive: 637 feedback items were resolved
+  -- before the redesign, and ignoring them would recreate every one of them on
+  -- the next capture.
+  SELECT ai.action_item_id INTO v_action_item_id
+    FROM semicolony.action_items AS ai
+   WHERE ai.source_kind = 'feedback'
+     AND ai.status IN ('open', 'in_progress', 'blocked')
+     AND ai.source_ref = p_slug
+   ORDER BY ai.created_at DESC
+   LIMIT 1
+   FOR UPDATE;
+
+  IF v_action_item_id IS NULL THEN
+    -- Only a *resolved* archived item suppresses a new capture. An archived
+    -- item still open at cutover time is unfinished work, not a duplicate —
+    -- filtering only on slug (with no status check) would freeze it forever
+    -- and silently drop every future re-report of that same failure.
+    --
+    -- F6: deliberately NOT selecting old.action_item_id into v_action_item_id
+    -- here. That id lives in action_items_archive_20260812, not
+    -- action_items -- handing it back as action_item_id would give the
+    -- caller a UUID that 404s on every later lookup against the live table.
+    -- v_action_item_id stays NULL (its DECLARE default); duplicate=true with
+    -- a NULL id is the unambiguous signal instead: "already handled, no live
+    -- row to point you at."
+    SELECT true INTO v_duplicate
+      FROM semicolony.action_items_archive_20260812 AS old
+     WHERE old.source = 'feedback'
+       AND old.status IN ('completed', 'cancelled')
+       AND old.metadata ->> 'feedback_slug' = p_slug
+     LIMIT 1;
+    v_duplicate := coalesce(v_duplicate, false);
+  ELSE
+    v_duplicate := true;
+  END IF;
+
+  IF NOT v_duplicate THEN
+    v_action_item_id := semicolony.create_action_item(
+      p_description        => '[SEMO Ops feedback] ' || btrim(p_summary),
+      -- 'semicolon' is entity_type='organization' and is not a valid project.
+      p_project_domain     => 'semo-ops',
+      p_deadline           => semicolony.action_item_default_deadline(v_priority),
+      -- Feedback is unassigned until triaged; 'unassigned' is explicit, not NULL.
+      p_assignee_kind      => 'unassigned',
+      p_assignee_member    => NULL,
+      p_assignee_agent     => NULL,
+      p_assignee_device    => NULL,
+      p_priority           => v_priority,
+      p_source_kind        => 'feedback',
+      p_source_ref         => p_slug,
+      -- Preserved from the live function: the KB backlink, not NULL.
+      p_related_url        => 'semo kb get semicolon feedback ' || p_slug,
+      p_external_contact   => NULL,
+      p_metadata           => p_metadata,
+      p_origin_surface     => 'worker',
+      p_origin_actor_kind  => CASE WHEN v_source = 'runtime-native-tool' THEN 'agent' ELSE 'human' END,
+      p_origin_member      => CASE WHEN v_source = 'runtime-native-tool' THEN NULL ELSE p_worker_id END,
+      p_origin_agent       => CASE WHEN v_source = 'runtime-native-tool' THEN p_worker_id ELSE NULL END,
+      p_origin_device      => p_device_id,
+      p_origin_harness     => CASE WHEN v_source = 'runtime-native-tool' THEN NULL ELSE 'cli' END,
+      p_origin_session_key => p_metadata ->> 'session_key'
+    );
+  END IF;
+
+  RETURN QUERY SELECT v_kb_id, v_action_item_id, v_duplicate;
+END;
+$function$;
+
+-- Y1: a place to record an action item that was never created.
+--
+-- Every other fallback record_meeting takes below lands on the action item it
+-- produced, in that row's own metadata. A *skipped* item has no row, so the
+-- only surface left that can carry the evidence is the meeting itself — and
+-- 198_meeting_record_canonical.sql made the meetings table the canonical
+-- meeting record, so an integrity fact about a meeting's follow-up list
+-- belongs there rather than in the derived Knowledge Fabric projection.
+-- The table had no metadata column; this adds one, additively and with a
+-- non-NULL default, so the UPDATE inside record_meeting below never has to
+-- reason about NULL and no existing row changes meaning.
+--
+-- Deliberately not reversed by packages/cli/scripts/rollback-action-item-
+-- redesign.sql: that script's contract was verified as-is, and an unread
+-- defaulted jsonb column left behind by a rollback is inert. Recorded here
+-- rather than fixed silently.
+ALTER TABLE semicolony.meetings
+  ADD COLUMN IF NOT EXISTS metadata jsonb NOT NULL DEFAULT '{}'::jsonb;
+
+-- record_meeting rewritten onto the redesigned model.
+--
+-- 199_meeting_record_capability.sql created this function on dev while this
+-- branch was in review, and it is live: packages/cli/src/commands/meetings.ts
+-- and packages/kb-gateway/src/lib/meeting-service.ts both call it positionally
+-- on every meeting-record write. Its action-item INSERT named
+-- owner_domain/target_domain/assignee/source/status — five columns this file
+-- removes — so leaving it untouched would break meeting recording through the
+-- running kb-gateway at first use, not at migration time (a PL/pgSQL body's
+-- column references are resolved at first execution, not at CREATE).
+--
+-- The 13-argument signature and the RETURNS TABLE shape are reproduced
+-- byte-identically from 199 on purpose: a different argument list would create
+-- a second overload instead of replacing the function, and both callers would
+-- keep resolving to the old one. Every validation, the meetings upsert, the
+-- Knowledge Fabric projection with its restricted-classification metadata, the
+-- delete-and-recreate idempotency, and the receipt are ported unchanged from
+-- 199. Only the action-item creation changed, and only because it had to.
+--
+-- Mapping from 199's INSERT onto the new contract (each item of
+-- p_action_items):
+--
+--   * description — unchanged, except that the new table requires >= 5
+--     characters where 199 required only non-empty. A shorter description is
+--     skipped with a WARNING rather than raised: aborting the transaction
+--     would discard the whole meeting record, which is the exact failure
+--     198-201 exist to prevent, and record_meeting is the only place the
+--     minutes still exist at that point.
+--   * item->>'target', then item->>'owner', then p_target_domain — first one
+--     that is an entity_type='service' ontology domain becomes project_domain.
+--     'owner' is in that list because the pre-redesign owner_domain conflated
+--     person and project domains under one ontology FK; when it holds a
+--     project it is the right project. Falls back to 'semo-ops' (the same
+--     service domain record_feedback uses) rather than raising, because
+--     project_domain is NOT NULL here while 199 allowed NULL, and a meeting
+--     that names no project must still record its follow-ups.
+--   * item->>'assignee', then item->>'owner' — first one matching
+--     team_members.domain becomes assignee_kind='team-member', else first one
+--     matching bot_status.bot_id becomes assignee_kind='agent'. Neither
+--     matching leaves assignee_kind='unassigned' with the raw
+--     item->>'assignee' text in external_contact, which is what that column is
+--     for (spec §7: non-team people such as '기백' or 'Space CL (박희원)' are
+--     external_contact text, not assignees). item->>'owner' is never written
+--     to external_contact — it is a domain field, not a person's name.
+--   * item->>'deadline' — cast exactly as 199 cast it, then defaulted through
+--     action_item_default_deadline(priority) when absent, because the new
+--     deadline column is NOT NULL where 199 allowed NULL.
+--   * item->>'priority' — 199's coalesce(..., 'normal') is preserved, then
+--     clamped to the new CHECK's vocabulary. The pre-redesign column was
+--     unconstrained varchar(10), so a meeting that said 'medium' used to
+--     insert cleanly and would now raise 23514 and lose the record; it is
+--     recorded as 'normal' with a WARNING instead.
+--   * status/source — 199 wrote 'open'/'meeting' literally. status='open' is
+--     now the column default, and source becomes source_kind='meeting' with
+--     source_ref carrying the meeting id, alongside the typed meeting_id.
+--   * provenance — origin_surface='system' with a NULL origin_actor_kind. The
+--     meeting recorder is not a person and not a registered bot, and
+--     origin_device_id is an FK to worker_devices: stamping p_device_id there
+--     would raise 23503 on exactly the headless host 199 was written for.
+--     p_worker_id/p_device_id/p_record_source are kept in the item's metadata
+--     instead, together with the raw owner/target/assignee strings, so nothing
+--     the caller sent is discarded by the mapping.
+--
+-- Y1 — every one of those fallbacks is recorded as queryable data, not only as
+-- a log line. None of them raises, for the reason above: aborting would discard
+-- the meeting record. But a silent substitution is the same failure this whole
+-- redesign exists to end — an item filed under the wrong project, or one that
+-- vanishes entirely, with nothing in the database saying so. A RAISE WARNING is
+-- not a substitute: neither packages/kb-gateway/src/lib/meeting-service.ts nor
+-- packages/cli/src/commands/meetings.ts subscribes to pg's `notice` event, so a
+-- warning reaches nobody who is not attached with psql by hand. The warnings
+-- are kept, and the evidence is written twice over:
+--
+--   * an item that took a fallback carries it in its own row, at
+--     metadata -> 'meeting_import' -> 'fallbacks' — an array naming the field,
+--     the reason, what was substituted, and the original value. The key is
+--     always present (empty array when the item mapped cleanly) so a consumer
+--     can filter on jsonb_array_length without distinguishing absent from
+--     empty.
+--   * an item that was skipped has no row to carry anything, so the whole
+--     submitted item lands on the meeting, at
+--     meetings.metadata -> 'meeting_import' -> 'skipped_action_items'. The
+--     meeting then carries the evidence that its own follow-up list is
+--     incomplete, which is the only place an operator could still find it.
+--
+-- The return shape is deliberately NOT extended: both callers depend on the
+-- 13-argument signature and the four-column receipt, and neither may change.
+-- packages/cli/scripts/verify-action-item-redesign.sql asserts the recorded
+-- evidence, not merely the behaviour, and carries the two queries an operator
+-- actually runs: every item filed by fallback, and every meeting with skips.
+CREATE OR REPLACE FUNCTION semicolony.record_meeting(
+  p_title text,
+  p_meeting_date date,
+  p_meeting_type text,
+  p_adhoc_subtype text,
+  p_visibility text,
+  p_target_domain text,
+  p_attendees jsonb,
+  p_record_body text,
+  p_transcript text,
+  p_action_items jsonb,
+  p_record_source text,
+  p_worker_id text,
+  p_device_id text
+)
+RETURNS TABLE(meeting_id uuid, kb_id bigint, action_item_ids uuid[], duplicate boolean)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+  v_meeting_id uuid;
+  v_kb_id bigint;
+  v_existing uuid;
+  v_norm text;
+  v_sensitivity text;
+  v_sub_key text;
+  v_item jsonb;
+  v_item_id uuid;
+  v_description text;
+  v_priority text;
+  v_project text;
+  v_candidate text;
+  v_assignee_kind text;
+  v_assignee_member text;
+  v_assignee_agent text;
+  v_external_contact text;
+  v_deadline date;
+  -- Y1: fallbacks are recorded as data, not only as a log line. v_fallbacks
+  -- accumulates per item and lands in that item's own metadata; v_skipped
+  -- accumulates items that produced no row at all and lands on the meeting.
+  v_fallbacks jsonb;
+  v_skipped jsonb;
+BEGIN
+  IF p_title IS NULL OR length(btrim(p_title)) < 3 THEN
+    RAISE EXCEPTION 'title must be at least 3 characters';
+  END IF;
+  IF p_meeting_date IS NULL THEN
+    RAISE EXCEPTION 'meeting_date is required';
+  END IF;
+  IF p_visibility IS NULL OR p_visibility NOT IN ('team', 'restricted') THEN
+    RAISE EXCEPTION 'visibility must be team or restricted, got %', p_visibility;
+  END IF;
+  IF p_record_source IS NULL
+     OR p_record_source NOT IN ('slack-worker', 'operator', 'backfill-discussion') THEN
+    RAISE EXCEPTION 'invalid record_source %', p_record_source;
+  END IF;
+  IF p_record_body IS NULL OR length(btrim(p_record_body)) = 0 THEN
+    RAISE EXCEPTION 'record_body is required';
+  END IF;
+
+  v_norm := lower(regexp_replace(btrim(p_title), '\s+', ' ', 'g'));
+  v_sensitivity := CASE WHEN p_visibility = 'restricted' THEN 'restricted' ELSE 'internal' END;
+
+  SELECT m.meeting_id INTO v_existing
+    FROM semicolony.meetings m
+   WHERE m.meeting_date = p_meeting_date
+     AND lower(regexp_replace(m.title, '\s+', ' ', 'g')) = v_norm;
+
+  IF v_existing IS NOT NULL THEN
+    UPDATE semicolony.meetings m
+       SET record_body = COALESCE(p_record_body, m.record_body),
+           mapped_transcript = COALESCE(p_transcript, m.mapped_transcript),
+           visibility = p_visibility,
+           record_source = p_record_source,
+           target_domain = COALESCE(p_target_domain, m.target_domain),
+           attendees = COALESCE(p_attendees, m.attendees),
+           updated_at = now()
+     WHERE m.meeting_id = v_existing;
+    v_meeting_id := v_existing;
+  ELSE
+    INSERT INTO semicolony.meetings (
+      meeting_id, title, meeting_type, adhoc_subtype, meeting_date, attendees,
+      visibility, record_body, mapped_transcript, record_source, target_domain,
+      transcription_status, speaker_map, created_at, updated_at
+    ) VALUES (
+      gen_random_uuid(), btrim(p_title), p_meeting_type, p_adhoc_subtype, p_meeting_date,
+      COALESCE(p_attendees, '[]'::jsonb), p_visibility, p_record_body,
+      p_transcript, p_record_source, p_target_domain,
+      'completed', '{}'::jsonb, now(), now()
+    ) RETURNING meetings.meeting_id INTO v_meeting_id;
+  END IF;
+
+  v_sub_key := to_char(p_meeting_date, 'YYYY-MM-DD') || '-' || left(v_norm, 60);
+
+  INSERT INTO semicolony.knowledge_base (
+    domain, key, sub_key, content, metadata, created_by, created_at, updated_at
+  ) VALUES (
+    COALESCE(p_target_domain, 'semicolon'),
+    'meeting',
+    v_sub_key,
+    p_record_body,
+    jsonb_build_object(
+      'classification', jsonb_build_object('sensitivity', v_sensitivity),
+      'meeting_id', v_meeting_id,
+      'meeting_date', to_char(p_meeting_date, 'YYYY-MM-DD'),
+      'record_source', p_record_source
+    ),
+    COALESCE(p_worker_id, 'meeting-worker'),
+    now(), now()
+  )
+  ON CONFLICT (domain, key, sub_key) DO UPDATE
+    SET content = EXCLUDED.content,
+        metadata = semicolony.knowledge_base.metadata || EXCLUDED.metadata,
+        updated_at = now()
+  RETURNING semicolony.knowledge_base.kb_id INTO v_kb_id;
+
+  -- Re-recording the same meeting must not duplicate its follow-ups. Existing
+  -- machine-created items for this meeting are replaced; anything a human filed
+  -- separately carries no meeting_id and is untouched. Unchanged from 199,
+  -- including the fact that the DELETE only runs when the caller actually sent
+  -- items -- a record submitted with an empty action-item list must not silently
+  -- erase the follow-ups an earlier submission of the same meeting created.
+  -- action_item_events rows disappear with their item through the events
+  -- table's ON DELETE CASCADE, so no orphan history is left behind.
+  IF p_action_items IS NOT NULL AND jsonb_typeof(p_action_items) = 'array'
+     AND jsonb_array_length(p_action_items) > 0 THEN
+    DELETE FROM semicolony.action_items a WHERE a.meeting_id = v_meeting_id;
+
+    v_skipped := '[]'::jsonb;
+
+    FOR v_item IN
+      SELECT item FROM jsonb_array_elements(p_action_items) AS item
+    LOOP
+      v_description := btrim(COALESCE(v_item ->> 'description', ''));
+      IF char_length(v_description) < 5 THEN
+        RAISE WARNING 'record_meeting: skipping meeting % action item, description shorter than 5 characters (%)',
+          v_meeting_id, v_description;
+        -- Y1: the RAISE alone is not evidence. Neither meeting-service.ts nor
+        -- meetings.ts subscribes to pg's `notice` event, so a WARNING is
+        -- visible only to someone attached with psql by hand. This item
+        -- produces no row to carry its own record, so the whole submitted
+        -- item is preserved on the meeting instead — an operator can then see
+        -- that the meeting's follow-up list is incomplete, and what was lost.
+        v_skipped := v_skipped || jsonb_build_array(jsonb_build_object(
+          'reason', 'description_shorter_than_5_characters',
+          'description', v_item ->> 'description',
+          'owner', v_item ->> 'owner',
+          'target', v_item ->> 'target',
+          'assignee', v_item ->> 'assignee',
+          'deadline', v_item ->> 'deadline',
+          'priority', v_item ->> 'priority'
+        ));
+        CONTINUE;
+      END IF;
+
+      -- Y1: reset per item. Anything appended here lands in the created row's
+      -- metadata under meeting_import.fallbacks, so the row itself answers
+      -- "why is this filed under semo-ops / due then / unassigned?".
+      v_fallbacks := '[]'::jsonb;
+
+      v_priority := COALESCE(NULLIF(btrim(v_item ->> 'priority'), ''), 'normal');
+      IF v_priority NOT IN ('low', 'normal', 'high', 'urgent') THEN
+        RAISE WARNING 'record_meeting: meeting % action item priority % is not one of low/normal/high/urgent, recording as normal',
+          v_meeting_id, v_priority;
+        v_fallbacks := v_fallbacks || jsonb_build_array(jsonb_build_object(
+          'field', 'priority',
+          'reason', 'not_in_low_normal_high_urgent',
+          'substituted', 'normal',
+          'original', v_priority
+        ));
+        v_priority := 'normal';
+      END IF;
+
+      v_project := NULL;
+      FOREACH v_candidate IN ARRAY ARRAY[
+        NULLIF(btrim(v_item ->> 'target'), ''),
+        NULLIF(btrim(v_item ->> 'owner'), ''),
+        NULLIF(btrim(p_target_domain), '')
+      ]
+      LOOP
+        CONTINUE WHEN v_candidate IS NULL;
+        IF EXISTS (SELECT 1 FROM semicolony.ontology o
+                    WHERE o.domain = v_candidate AND o.entity_type = 'service') THEN
+          v_project := v_candidate;
+          EXIT;
+        END IF;
+      END LOOP;
+      -- Y1: record the substitution before it is applied, while the rejected
+      -- candidates are still distinguishable from a deliberate 'semo-ops'.
+      IF v_project IS NULL THEN
+        RAISE WARNING 'record_meeting: meeting % action item names no entity_type=service domain (target %, owner %, meeting target %), filing under semo-ops',
+          v_meeting_id, v_item ->> 'target', v_item ->> 'owner', p_target_domain;
+        v_fallbacks := v_fallbacks || jsonb_build_array(jsonb_build_object(
+          'field', 'project_domain',
+          'reason', 'no_service_domain_among_candidates',
+          'substituted', 'semo-ops',
+          'original', jsonb_build_object(
+            'target', v_item ->> 'target',
+            'owner', v_item ->> 'owner',
+            'meeting_target_domain', p_target_domain
+          )
+        ));
+      END IF;
+      v_project := COALESCE(v_project, 'semo-ops');
+
+      v_assignee_kind   := 'unassigned';
+      v_assignee_member := NULL;
+      v_assignee_agent  := NULL;
+      FOREACH v_candidate IN ARRAY ARRAY[
+        NULLIF(btrim(v_item ->> 'assignee'), ''),
+        NULLIF(btrim(v_item ->> 'owner'), '')
+      ]
+      LOOP
+        CONTINUE WHEN v_candidate IS NULL;
+        IF EXISTS (SELECT 1 FROM semicolony.team_members tm WHERE tm.domain = v_candidate) THEN
+          v_assignee_kind   := 'team-member';
+          v_assignee_member := v_candidate;
+          EXIT;
+        ELSIF EXISTS (SELECT 1 FROM semicolony.bot_status bs WHERE bs.bot_id = v_candidate) THEN
+          v_assignee_kind  := 'agent';
+          v_assignee_agent := v_candidate;
+          EXIT;
+        END IF;
+      END LOOP;
+
+      v_external_contact := CASE WHEN v_assignee_kind = 'unassigned'
+                                 THEN NULLIF(btrim(v_item ->> 'assignee'), '')
+                                 ELSE NULL END;
+
+      -- Y1: only a *supplied* name that failed to resolve is a fallback. An
+      -- item that named nobody is simply unassigned, not a substitution, and
+      -- recording it as one would bury the real cases in noise.
+      IF v_assignee_kind = 'unassigned'
+         AND (NULLIF(btrim(v_item ->> 'assignee'), '') IS NOT NULL
+              OR NULLIF(btrim(v_item ->> 'owner'), '') IS NOT NULL) THEN
+        RAISE WARNING 'record_meeting: meeting % action item assignee (assignee %, owner %) is neither a team member nor an agent, leaving it unassigned',
+          v_meeting_id, v_item ->> 'assignee', v_item ->> 'owner';
+        v_fallbacks := v_fallbacks || jsonb_build_array(jsonb_build_object(
+          'field', 'assignee',
+          'reason', 'not_a_team_member_or_agent',
+          'substituted', 'unassigned',
+          'original', jsonb_build_object(
+            'assignee', v_item ->> 'assignee',
+            'owner', v_item ->> 'owner'
+          ),
+          'external_contact', v_external_contact
+        ));
+      END IF;
+
+      v_deadline := COALESCE(
+        NULLIF(btrim(v_item ->> 'deadline'), '')::date,
+        semicolony.action_item_default_deadline(v_priority)
+      );
+
+      -- Y1: the COALESCE above is deliberately left byte-identical (its shape
+      -- is pinned by the migration test); the fallback is detected separately
+      -- on the same condition rather than by restructuring it.
+      IF NULLIF(btrim(v_item ->> 'deadline'), '') IS NULL THEN
+        RAISE WARNING 'record_meeting: meeting % action item has no deadline, defaulting to % for priority %',
+          v_meeting_id, v_deadline, v_priority;
+        v_fallbacks := v_fallbacks || jsonb_build_array(jsonb_build_object(
+          'field', 'deadline',
+          'reason', 'absent',
+          'substituted', to_char(v_deadline, 'YYYY-MM-DD'),
+          'original', v_item ->> 'deadline',
+          'derived_from_priority', v_priority
+        ));
+      END IF;
+
+      v_item_id := semicolony.create_action_item(
+        p_description        => v_description,
+        p_project_domain     => v_project,
+        p_deadline           => v_deadline,
+        p_assignee_kind      => v_assignee_kind,
+        p_assignee_member    => v_assignee_member,
+        p_assignee_agent     => v_assignee_agent,
+        p_assignee_device    => NULL,
+        p_priority           => v_priority,
+        p_source_kind        => 'meeting',
+        p_source_ref         => v_meeting_id::text,
+        p_related_url        => NULL,
+        p_external_contact   => v_external_contact,
+        p_metadata           => jsonb_build_object(
+                                  'meeting_id', v_meeting_id,
+                                  'meeting_date', to_char(p_meeting_date, 'YYYY-MM-DD'),
+                                  'record_source', p_record_source,
+                                  'worker_id', p_worker_id,
+                                  'device_id', p_device_id,
+                                  'raw_owner', v_item ->> 'owner',
+                                  'raw_target', v_item ->> 'target',
+                                  'raw_assignee', v_item ->> 'assignee',
+                                  -- Y1: always present, empty array when the
+                                  -- item mapped cleanly, so a consumer can
+                                  -- filter on jsonb_array_length() without
+                                  -- having to distinguish absent from empty.
+                                  'meeting_import', jsonb_build_object(
+                                    'fallbacks', v_fallbacks
+                                  )
+                                ),
+        p_origin_surface     => 'system',
+        p_origin_actor_kind  => NULL,
+        p_origin_member      => NULL,
+        p_origin_agent       => NULL,
+        p_origin_device      => NULL,
+        p_origin_harness     => NULL,
+        p_origin_session_key => NULL
+      );
+
+      -- The typed relation 198 added. create_action_item deliberately has no
+      -- meeting_id parameter: meetings are one source among nine and the
+      -- function's parameter list is already twenty wide, so the linkage is
+      -- stamped here, in the same transaction, rather than widening every
+      -- caller's signature for one of them.
+      UPDATE semicolony.action_items
+         SET meeting_id = v_meeting_id
+       WHERE action_item_id = v_item_id;
+    END LOOP;
+
+    -- Y1: publish the skip list on the meeting, inside the same IF that owns
+    -- the delete-and-recreate. `||` replaces the whole meeting_import key
+    -- rather than merging into it, so a re-record with the descriptions fixed
+    -- writes back an empty array instead of leaving a stale accusation on a
+    -- meeting whose follow-up list is now complete — the evidence follows the
+    -- same idempotency rule as the items it describes. Keeping it inside the
+    -- IF also means an empty submission leaves both the items and their
+    -- evidence untouched, which is the behaviour 199 defined and verification
+    -- confirmed.
+    UPDATE semicolony.meetings m
+       SET metadata = COALESCE(m.metadata, '{}'::jsonb)
+                      || jsonb_build_object('meeting_import', jsonb_build_object(
+                           'skipped_action_items', v_skipped,
+                           'skipped_count', jsonb_array_length(v_skipped),
+                           'submitted_count', jsonb_array_length(p_action_items),
+                           'recorded_at', now(),
+                           'record_source', p_record_source
+                         )),
+           updated_at = now()
+     WHERE m.meeting_id = v_meeting_id;
+  END IF;
+
+  RETURN QUERY
+  SELECT v_meeting_id,
+         v_kb_id,
+         COALESCE(ARRAY(SELECT a.action_item_id
+                          FROM semicolony.action_items a
+                         WHERE a.meeting_id = v_meeting_id
+                         ORDER BY a.created_at), '{}'::uuid[]),
+         (v_existing IS NOT NULL);
+END;
+$function$;
+
+-- Restated from 199 unchanged. CREATE OR REPLACE preserves the existing ACL,
+-- so these are a no-op on the live database; they are kept so that a fresh
+-- install applying 203 without 199 having ever run ends with the same grant
+-- surface, and so the sc_app contract (EXECUTE only, still no DML anywhere)
+-- is legible in the file that now owns the function body.
+REVOKE ALL ON FUNCTION semicolony.record_meeting(
+  text, date, text, text, text, text, jsonb, text, text, jsonb, text, text, text
+) FROM PUBLIC;
+
+GRANT EXECUTE ON FUNCTION semicolony.record_meeting(
+  text, date, text, text, text, text, jsonb, text, text, jsonb, text, text, text
+) TO sc_app;