@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/src/persistence/llm-request-log-store.ts

@@ -26,6 +26,7 @@ import {
 } from "./conversation-crud.js";
 import { type DrizzleDb, getDb, getLogsDb } from "./db-connection.js";
 import { llmRequestLogs, messages } from "./schema/index.js";
+import { timeSyncSection } from "./slow-sync-log.js";
 
 /**
  * The logs connection (`assistant-logs.db`), where `llm_request_logs` lives.
@@ -167,27 +168,42 @@ export function recordRequestLog(
 ): string {
   const db = logsDb();
   const id = uuid();
-  db.insert(llmRequestLogs)
-    .values({
-      id,
+  // Synchronous insert of the full request/response payloads (an entire
+  // context window for main-agent calls) into the append-only logs DB, on the
+  // per-LLM-call critical path. Timed so an event-loop freeze the watchdog
+  // detects can be attributed to this write (see slow-sync-log).
+  timeSyncSection(
+    "llm-request-log:write",
+    () =>
+      db
+        .insert(llmRequestLogs)
+        .values({
+          id,
+          conversationId,
+          messageId: messageId ?? null,
+          provider: provider ?? null,
+          requestPayload,
+          responsePayload,
+          createdAt: Date.now(),
+          // Stamped later via setAgentLoopExitReasonOnLatestLog, once the
+          // agent loop body actually exits. Intermediate rows stay NULL.
+          agentLoopExitReason: null,
+          // Logical call site (`mainAgent`, `compactionAgent`, …). NULL when
+          // a caller hasn't been updated yet — preserves backward compat
+          // while we plumb call sites through one site at a time.
+          callSite: callSite ?? null,
+          // JSON first-token latency waterfall, supplied by `handleUsage` for
+          // main-agent calls. NULL for failed/non-instrumented call paths.
+          latencyBreakdown: latencyBreakdown ?? null,
+        })
+        .run(),
+    () => ({
       conversationId,
-      messageId: messageId ?? null,
-      provider: provider ?? null,
-      requestPayload,
-      responsePayload,
-      createdAt: Date.now(),
-      // Stamped later via setAgentLoopExitReasonOnLatestLog, once the
-      // agent loop body actually exits. Intermediate rows stay NULL.
-      agentLoopExitReason: null,
-      // Logical call site (`mainAgent`, `compactionAgent`, …). NULL when
-      // a caller hasn't been updated yet — preserves backward compat
-      // while we plumb call sites through one site at a time.
       callSite: callSite ?? null,
-      // JSON first-token latency waterfall, supplied by `handleUsage` for
-      // main-agent calls. NULL for failed/non-instrumented call paths.
-      latencyBreakdown: latencyBreakdown ?? null,
-    })
-    .run();
+      requestBytes: requestPayload.length,
+      responseBytes: responsePayload.length,
+    }),
+  );
   return id;
 }
 

package/src/persistence/llm-usage-store.ts

@@ -451,6 +451,7 @@ export function getConversationUsageTotals(conversationId: string): {
     total_output: number;
     total_cost: number | null;
   }>(
+    "usage:getConversationTotals",
     /*sql*/ `
     SELECT
       COALESCE(SUM(input_tokens + COALESCE(cache_creation_input_tokens, 0) + COALESCE(cache_read_input_tokens, 0)), 0) AS total_input,
@@ -479,6 +480,7 @@ export function getUsageCostForConversationWindow({
   to: number;
 }): number {
   const rows = rawAll<{ total_cost: number | null }>(
+    "usage:costForConversationWindow",
     /*sql*/ `
     SELECT COALESCE(SUM(estimated_cost_usd), 0) AS total_cost
     FROM llm_usage_events
@@ -520,6 +522,7 @@ export function getUsageCostForRun({
     params.push(conversationId, from, to);
   }
   const rows = rawAll<{ total_cost: number | null }>(
+    "usage:costForRun",
     /*sql*/ `
     SELECT COALESCE(SUM(estimated_cost_usd), 0) AS total_cost
     FROM llm_usage_events
@@ -538,6 +541,7 @@ export function getUsageCostForRun({
  */
 export function listRunConversationIds(cronRunId: string): string[] {
   const rows = rawAll<{ conversation_id: string }>(
+    "usage:listRunConversationIds",
     /*sql*/ `
     SELECT DISTINCT conversation_id
     FROM llm_usage_events
@@ -558,6 +562,7 @@ export function getUsageTotals(
 ): UsageTotals {
   const where = buildUsageAggregationWhere(range, filter);
   const rows = rawAll<TotalsRow>(
+    "usage:getTotals",
     /*sql*/ `
     SELECT
       COALESCE(SUM(input_tokens), 0)                              AS total_input_tokens,
@@ -618,6 +623,7 @@ function fetchRawBucketRows(
 ): UsageEventBucketRow[] {
   const where = buildUsageAggregationWhere(range, filter);
   return rawAll<UsageEventBucketRow>(
+    "usage:fetchRawBucketRows",
     /*sql*/ `
     SELECT
       (created_at / ${USAGE_PREAGG_BUCKET_MS}) * ${USAGE_PREAGG_BUCKET_MS} AS created_at,
@@ -766,6 +772,7 @@ export function getUsageGroupBreakdown(
   if (groupBy === "conversation") {
     const where = buildUsageAggregationWhere(range, normalizedFilter, "e");
     const rows = rawAll<GroupRow>(
+      "usage:groupBreakdown:conversation",
       /*sql*/ `
       SELECT
         CASE WHEN e.conversation_id IS NULL THEN 'Other'
@@ -818,6 +825,7 @@ export function getUsageGroupBreakdown(
       selectExpression: "schedule_attr_runs.job_id",
     });
     const rows = rawAll<GroupRow>(
+      "usage:groupBreakdown:schedule",
       /*sql*/ `
       WITH schedule_usage AS (
         SELECT
@@ -856,6 +864,7 @@ export function getUsageGroupBreakdown(
   const column = GROUP_BY_COLUMNS[groupBy];
   const where = buildUsageAggregationWhere(range, normalizedFilter, "e");
   const rows = rawAll<GroupRow>(
+    "usage:groupBreakdown:column",
     /*sql*/ `
     SELECT
       e.${column}                                      AS group_key,
@@ -903,6 +912,7 @@ export function getUsageGroupedSeries(
       selectExpression: "schedule_attr_runs.job_id",
     });
     rows = rawAll<UsageGroupedBucketRow>(
+      "usage:groupedSeries:schedule",
       /*sql*/ `
       WITH schedule_usage AS (
         SELECT
@@ -936,6 +946,7 @@ export function getUsageGroupedSeries(
     const column = GROUP_BY_COLUMNS[groupBy];
     const where = buildUsageAggregationWhere(range, normalizedFilter, "e");
     rows = rawAll<UsageGroupedBucketRow>(
+      "usage:groupedSeries:column",
       /*sql*/ `
       SELECT
         (e.created_at / ${USAGE_PREAGG_BUCKET_MS}) * ${USAGE_PREAGG_BUCKET_MS} AS created_at,

package/src/persistence/memory-lifecycle-hooks.test.ts

@@ -23,7 +23,13 @@ const baseHooks: MemoryPersistenceHooks = {
   onConversationWiped() {
     return 0;
   },
+  onConversationDeleted() {},
+  onMessagesDeleted() {},
+  async onAllConversationsCleared() {},
   onWorkerStartup() {},
+  countMemoryBufferLines() {
+    return 0;
+  },
 };
 
 describe("memory persistence-lifecycle seam", () => {
@@ -34,6 +40,18 @@ describe("memory persistence-lifecycle seam", () => {
     await getMemoryPersistenceHooks().onMessagePersisted(event);
   });
 
+  test("countMemoryBufferLines defaults to 0 when memory is not present", () => {
+    expect(getMemoryPersistenceHooks().countMemoryBufferLines()).toBe(0);
+  });
+
+  test("countMemoryBufferLines returns the registered implementation's count", () => {
+    registerMemoryPersistenceHooks({
+      ...baseHooks,
+      countMemoryBufferLines: () => 42,
+    });
+    expect(getMemoryPersistenceHooks().countMemoryBufferLines()).toBe(42);
+  });
+
   test("getMemoryPersistenceHooks returns the registered implementation", async () => {
     const seen: MessagePersistedEvent[] = [];
     registerMemoryPersistenceHooks({
@@ -78,4 +96,51 @@ describe("memory persistence-lifecycle seam", () => {
     await getMemoryPersistenceHooks().onMessagePersisted(event);
     expect(calls).toBe(0);
   });
+
+  test("onConversationDeleted defaults to a no-op and forwards the id to the registered impl", () => {
+    // No-op default — the "memory not present" path does not throw.
+    getMemoryPersistenceHooks().onConversationDeleted("conv-1");
+
+    const seen: string[] = [];
+    registerMemoryPersistenceHooks({
+      ...baseHooks,
+      onConversationDeleted(id) {
+        seen.push(id);
+      },
+    });
+    getMemoryPersistenceHooks().onConversationDeleted("conv-1");
+    expect(seen).toEqual(["conv-1"]);
+  });
+
+  test("onMessagesDeleted defaults to a no-op and forwards ids to the registered impl", () => {
+    // No-op default — the "memory not present" path does not throw.
+    getMemoryPersistenceHooks().onMessagesDeleted(["msg-a", "msg-b"]);
+
+    const seen: string[][] = [];
+    registerMemoryPersistenceHooks({
+      ...baseHooks,
+      onMessagesDeleted(ids) {
+        seen.push(ids);
+      },
+    });
+    getMemoryPersistenceHooks().onMessagesDeleted(["msg-a", "msg-b"]);
+    expect(seen).toEqual([["msg-a", "msg-b"]]);
+  });
+
+  test("onAllConversationsCleared defaults to a no-op and awaits the registered impl", async () => {
+    // No-op default resolves without throwing.
+    await getMemoryPersistenceHooks().onAllConversationsCleared();
+
+    let cleared = 0;
+    registerMemoryPersistenceHooks({
+      ...baseHooks,
+      async onAllConversationsCleared() {
+        // Yield so a non-awaiting caller would observe cleared === 0.
+        await Promise.resolve();
+        cleared++;
+      },
+    });
+    await getMemoryPersistenceHooks().onAllConversationsCleared();
+    expect(cleared).toBe(1);
+  });
 });

package/src/persistence/memory-lifecycle-hooks.ts

@@ -2,7 +2,8 @@ import type { TrustClass } from "../runtime/actor-trust-resolver.js";
 import type { DrizzleDb } from "./db-connection.js";
 
 /**
- * Seam for the memory feature to react to persistence-layer lifecycle events.
+ * Seam for the memory feature to react to persistence-layer lifecycle events
+ * and to answer memory-domain queries the persistence layer needs.
  *
  * Persistence is a layer below the memory plugin, so it cannot import memory
  * internals directly. Instead it calls into this registered-handler seam: the
@@ -80,15 +81,62 @@ export interface MemoryPersistenceHooks {
    * present). Runs before the conversation's message rows are deleted, since
    * the cancellation queries join on `messages`. Cleanup — runs even while the
    * plugin is disabled, so jobs created while it was enabled are not orphaned.
+   *
+   * Does NOT purge the conversation's per-message index — that is
+   * {@link onConversationDeleted}, fired from the shared delete primitive that
+   * `wipeConversation` delegates to (so the purge lands after this cancellation
+   * pass and cannot be swept by it).
    */
   onConversationWiped(conversationId: string): number;
 
+  /**
+   * A conversation and its messages were deleted via the shared delete
+   * primitive (`deleteConversation`/`deleteConversationGently`), which covers
+   * every caller — the HTTP route, `wipeConversation`, retrospective startup
+   * cleanup, superseded-retrospective GC, and future ones. The memory feature
+   * purges the conversation's per-message index (e.g. its lexical points, by
+   * `conversationId`). Runs after the delete commits and off the write path.
+   * Cleanup — runs even while the plugin is disabled, so points written while it
+   * was enabled are not orphaned.
+   */
+  onConversationDeleted(conversationId: string): void;
+
+  /**
+   * One or more message rows were deleted (single-message delete, undo, or
+   * assistant-message consolidation) WITHOUT wiping the whole conversation. The
+   * memory feature removes each message's per-message index entry (e.g. its
+   * lexical point). Runs after the delete transaction commits and off the write
+   * path. Cleanup — runs even while the plugin is disabled, so entries written
+   * while it was enabled are not orphaned. Empty arrays are a no-op.
+   */
+  onMessagesDeleted(messageIds: string[]): void;
+
+  /**
+   * Every conversation and its messages are being cleared ("delete all"). The
+   * memory feature drops the bulk per-message index (e.g. the whole lexical
+   * collection) — a bulk wipe leaves no ids to key per-message cleanup on.
+   * Cleanup — runs even while the plugin is disabled. Best-effort; the caller
+   * wraps it in try/catch and AWAITS it, so the drop completes before writes
+   * resume (a message created right after clear-all must not upsert into a
+   * collection that is about to be dropped).
+   */
+  onAllConversationsCleared(): Promise<void>;
+
   /**
    * The background-job worker is starting. The memory feature sweeps orphan
    * retrospective conversations left by a crash mid-job. Best-effort; the caller
    * wraps it in try/catch. Cleanup — runs even while the plugin is disabled.
    */
   onWorkerStartup(): void;
+
+  /**
+   * Current line count of the memory buffer (`memory/buffer.md`). The
+   * maintenance scheduler reads it to gate scheduled consolidation — skip a
+   * scheduled run below a floor, force one above a ceiling. Returns 0 when
+   * memory is not present, which the scheduler reads as "no buffered work" and
+   * therefore no consolidation.
+   */
+  countMemoryBufferLines(): number;
 }
 
 const NOOP: MemoryPersistenceHooks = {
@@ -97,7 +145,13 @@ const NOOP: MemoryPersistenceHooks = {
   onConversationWiped() {
     return 0;
   },
+  onConversationDeleted() {},
+  onMessagesDeleted() {},
+  async onAllConversationsCleared() {},
   onWorkerStartup() {},
+  countMemoryBufferLines() {
+    return 0;
+  },
 };
 
 let current: MemoryPersistenceHooks = NOOP;

package/src/persistence/migrations/028-call-session-mode.ts

@@ -4,7 +4,7 @@ import type { DrizzleDb } from "../db-connection.js";
  * Add call_mode and guardian_verification_session_id columns to call_sessions.
  *
  * call_mode is the persisted source of truth for deterministic flow selection
- * in the relay server. guardian_verification_session_id links the call session
+ * in the call setup router. guardian_verification_session_id links the call session
  * to the verification session for observability.
  */
 export function migrateCallSessionMode(database: DrizzleDb): void {

package/src/persistence/migrations/116-messages-fts.ts

@@ -6,6 +6,11 @@ const logger = getLogger("messages-fts");
 /**
  * FTS5 virtual table for full-text search over messages.content.
  *
+ * Every object this step creates is dropped again by the later
+ * `migrateDropMessagesFts` step (`313-drop-messages-fts.ts`) — message-content
+ * search reads the sparse Qdrant `messages_lexical` index. This step stays
+ * registered because the migration chain is append-only.
+ *
  * Content is stored as raw JSON in the messages table — the FTS tokenizer
  * handles it well enough for keyword search since the structural JSON tokens
  * (type, text, tool_use) are short common words that rarely matter as search
@@ -54,7 +59,9 @@ function isSqliteCorruptionError(err: unknown): boolean {
  * from `sqlite_schema`. Without this fallback, `CREATE VIRTUAL TABLE
  * IF NOT EXISTS` would be a no-op and the crash loop would persist.
  */
-function dropFtsShadowTables(raw: ReturnType<typeof getSqliteFrom>): void {
+export function dropFtsShadowTables(
+  raw: ReturnType<typeof getSqliteFrom>,
+): void {
   const drops = [
     `DROP TRIGGER IF EXISTS messages_fts_ai`,
     `DROP TRIGGER IF EXISTS messages_fts_ad`,

package/src/persistence/migrations/311-create-subagents-table.ts

@@ -0,0 +1,50 @@
+import { getSqlite } from "../db-connection.js";
+
+/**
+ * Creates the `subagents` table: durable lifecycle records for subagents
+ * spawned by `SubagentManager`.
+ *
+ * Subagents run as background child conversations whose rows already persist
+ * via `bootstrapConversation`, but the manager-only fields (parent link,
+ * label, objective, role, fork flag, status, timestamps, usage) live only in
+ * the manager's in-memory maps and are lost on restart. This table persists
+ * them so a restart can rehydrate completed subagents (their output is read
+ * from the child conversation's messages) and mark any that were still in
+ * flight as `interrupted` rather than silently orphaning them.
+ *
+ * Rows are written on spawn and on every status transition, and deleted when
+ * the manager disposes the subagent during normal operation (TTL sweep or
+ * parent eviction) — never on shutdown, so in-flight rows survive the restart.
+ *
+ * Idempotent (`IF NOT EXISTS`). No backfill — pre-existing subagents predate
+ * the table and were already only in-memory.
+ */
+export function migrateCreateSubagentsTable(): void {
+  const raw = getSqlite();
+  raw.exec(`
+    CREATE TABLE IF NOT EXISTS subagents (
+      id                     TEXT PRIMARY KEY,
+      parent_conversation_id TEXT NOT NULL,
+      conversation_id        TEXT NOT NULL,
+      label                  TEXT NOT NULL,
+      objective              TEXT NOT NULL,
+      role                   TEXT NOT NULL DEFAULT 'general',
+      is_fork                INTEGER NOT NULL DEFAULT 0,
+      send_result_to_user    INTEGER,
+      status                 TEXT NOT NULL DEFAULT 'pending',
+      error                  TEXT,
+      created_at             INTEGER NOT NULL,
+      started_at             INTEGER,
+      completed_at           INTEGER,
+      input_tokens           INTEGER NOT NULL DEFAULT 0,
+      output_tokens          INTEGER NOT NULL DEFAULT 0,
+      estimated_cost         REAL NOT NULL DEFAULT 0
+    )
+  `);
+  raw.exec(
+    `CREATE INDEX IF NOT EXISTS idx_subagents_parent_conversation_id ON subagents(parent_conversation_id)`,
+  );
+  raw.exec(
+    `CREATE INDEX IF NOT EXISTS idx_subagents_status ON subagents(status)`,
+  );
+}

package/src/persistence/migrations/312-drop-inbox-conversation-state-table.ts

@@ -0,0 +1,15 @@
+import type { DrizzleDb } from "../db-connection.js";
+
+/**
+ * Drops the dead `assistant_inbox_conversation_state` table — no production
+ * code reads or writes it.
+ *
+ * Idempotent: DROP TABLE IF EXISTS.
+ */
+export function migrateDropInboxConversationStateTable(
+  database: DrizzleDb,
+): void {
+  database.run(
+    /*sql*/ `DROP TABLE IF EXISTS assistant_inbox_conversation_state`,
+  );
+}

package/src/persistence/migrations/313-drop-messages-fts.ts

@@ -0,0 +1,17 @@
+import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
+import { dropFtsShadowTables } from "./116-messages-fts.js";
+
+/**
+ * Drops the `messages_fts` FTS5 virtual table and its per-row triggers
+ * (`messages_fts_ai/ad/au`). Message-content search reads the sparse Qdrant
+ * `messages_lexical` index (see `conversation-search-lexical.ts`), so the
+ * synchronous per-row FTS maintenance — the dominant write-amplification cost
+ * on `messages` for batch forks and batch deletes — carries no reader.
+ *
+ * Idempotent: every drop is `IF EXISTS` / individually error-swallowed, and
+ * the `writable_schema` fallback inside {@link dropFtsShadowTables} handles a
+ * corrupt vtable that blocks a plain `DROP TABLE`.
+ */
+export function migrateDropMessagesFts(database: DrizzleDb): void {
+  dropFtsShadowTables(getSqliteFrom(database));
+}

package/src/persistence/migrations/314-add-conversation-enabled-plugins.ts

@@ -0,0 +1,25 @@
+import type { DrizzleDb } from "../db-connection.js";
+import { tableHasColumn } from "./schema-introspection.js";
+
+const COLUMN_NAME = "enabled_plugins";
+const COLUMN_DEFINITION = "enabled_plugins TEXT";
+
+/**
+ * Add the nullable `enabled_plugins` column to the `conversations` table.
+ *
+ * Stores a JSON-encoded `string[]` of plugin ids scoping the chat, or NULL
+ * (the default) meaning no per-chat restriction — all globally-enabled
+ * plugins apply. No backfill is needed: existing rows default to NULL.
+ *
+ * Idempotent: guarded with `tableHasColumn` so a crash between the `ALTER
+ * TABLE` and the checkpoint write doesn't cause a duplicate-column error on
+ * the next boot.
+ */
+export function migrateAddConversationEnabledPlugins(
+  database: DrizzleDb,
+): void {
+  if (tableHasColumn(database, "conversations", COLUMN_NAME)) {
+    return;
+  }
+  database.run(`ALTER TABLE conversations ADD COLUMN ${COLUMN_DEFINITION}`);
+}

package/src/persistence/migrations/315-create-a2a-invites.ts

@@ -0,0 +1,58 @@
+import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
+
+/**
+ * Creates the `a2a_invites` table: daemon-local store for A2A invite tokens.
+ *
+ * A2A invites are peer-assistant bindings outside the human-trust ACL model,
+ * so they live in the assistant DB rather than the gateway's `ingress_invites`
+ * table. The table carries exactly the columns the A2A flow uses.
+ *
+ * Existing A2A rows are copied from `assistant_ingress_invites` (guarded on
+ * the source table's existence) so in-flight invites survive. Source rows are
+ * left in place — that table is dropped wholesale by a later migration.
+ *
+ * Idempotent: `IF NOT EXISTS` table creation and `INSERT OR IGNORE` copy.
+ */
+export function migrateCreateA2aInvitesTable(db: DrizzleDb): void {
+  const raw = getSqliteFrom(db);
+
+  raw.exec(/*sql*/ `
+    CREATE TABLE IF NOT EXISTS a2a_invites (
+      id                           TEXT PRIMARY KEY,
+      token_hash                   TEXT NOT NULL,
+      contact_id                   TEXT NOT NULL,
+      max_uses                     INTEGER NOT NULL DEFAULT 1,
+      use_count                    INTEGER NOT NULL DEFAULT 0,
+      expires_at                   INTEGER NOT NULL,
+      status                       TEXT NOT NULL DEFAULT 'active',
+      redeemed_by_external_user_id TEXT,
+      redeemed_at                  INTEGER,
+      created_at                   INTEGER NOT NULL,
+      updated_at                   INTEGER NOT NULL
+    )
+  `);
+  raw.exec(
+    `CREATE INDEX IF NOT EXISTS idx_a2a_invites_token_hash ON a2a_invites(token_hash)`,
+  );
+
+  const sourceExists = raw
+    .prepare(
+      `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'assistant_ingress_invites'`,
+    )
+    .get();
+  if (!sourceExists) {
+    return;
+  }
+
+  raw.exec(/*sql*/ `
+    INSERT OR IGNORE INTO a2a_invites (
+      id, token_hash, contact_id, max_uses, use_count, expires_at, status,
+      redeemed_by_external_user_id, redeemed_at, created_at, updated_at
+    )
+    SELECT
+      id, token_hash, contact_id, max_uses, use_count, expires_at, status,
+      redeemed_by_external_user_id, redeemed_at, created_at, updated_at
+    FROM assistant_ingress_invites
+    WHERE source_channel = 'a2a'
+  `);
+}

package/src/persistence/migrations/316-drop-contact-channels-invite-id.ts

@@ -0,0 +1,28 @@
+import { getLogger } from "../../util/logger.js";
+import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
+import { tableHasColumn } from "./schema-introspection.js";
+
+const log = getLogger("migration-316");
+
+/**
+ * Drops the `contact_channels.invite_id` column.
+ *
+ * The gateway's `ingress_invites` table owns the invite lifecycle (A2A invites
+ * live in the daemon's `a2a_invites` table), so the assistant-side column is
+ * dead weight. The `assistant_ingress_invites` table is dropped by gateway
+ * data migration m0010 — not here — because gateway m0009 must backfill its
+ * rows first, and assistant migrations run at daemon boot, before the
+ * gateway's post-assistant-ready data-migration pass.
+ *
+ * No DROP INDEX needed: `invite_id` is not covered by any contact_channels
+ * index and carries no FK. Idempotent via the column-presence guard.
+ */
+export function migrateDropContactChannelInviteId(database: DrizzleDb): void {
+  const raw = getSqliteFrom(database);
+
+  if (!tableHasColumn(database, "contact_channels", "invite_id")) {
+    return;
+  }
+  raw.run(/*sql*/ `ALTER TABLE contact_channels DROP COLUMN invite_id`);
+  log.info("Dropped invite_id column from contact_channels");
+}

package/src/persistence/migrations/317-canonical-guardian-requester-signals.ts

@@ -0,0 +1,24 @@
+import type { DrizzleDb } from "../db-connection.js";
+
+/**
+ * Add requester_signals column to canonical_guardian_requests.
+ *
+ * Stores the JSON-encoded platform identity signals for the requester
+ * (isBot / isStranger / isRestricted) at request-creation time, so the
+ * introduction-card decision path derives binding strength and bot handling
+ * from the same facts the card was rendered from.
+ *
+ * Uses ALTER TABLE ADD COLUMN with try/catch for idempotency — no registry
+ * entry needed.
+ */
+export function migrateCanonicalGuardianRequesterSignals(
+  database: DrizzleDb,
+): void {
+  try {
+    database.run(
+      /*sql*/ `ALTER TABLE canonical_guardian_requests ADD COLUMN requester_signals TEXT`,
+    );
+  } catch {
+    /* already exists */
+  }
+}

package/src/persistence/migrations/318-drop-contact-channel-telemetry.ts

@@ -0,0 +1,32 @@
+import { getLogger } from "../../util/logger.js";
+import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
+import { tableHasColumn } from "./schema-introspection.js";
+
+const log = getLogger("migration-318");
+
+const TELEMETRY_COLUMNS = [
+  "last_seen_at",
+  "interaction_count",
+  "last_interaction",
+] as const;
+
+/**
+ * Drops the `contact_channels` interaction-telemetry columns
+ * (`last_seen_at`, `interaction_count`, `last_interaction`).
+ *
+ * Interaction telemetry is gateway-owned: reads source it from the stamped
+ * trust verdict and the gateway rich-read relay, and writes go only to the
+ * gateway DB. The assistant-side columns are dead weight.
+ *
+ * No DROP INDEX needed: none of these columns are covered by a contact_channels
+ * index and they carry no FK. Idempotent via the per-column presence guard.
+ */
+export function migrateDropContactChannelTelemetry(database: DrizzleDb): void {
+  const raw = getSqliteFrom(database);
+
+  for (const column of TELEMETRY_COLUMNS) {
+    if (!tableHasColumn(database, "contact_channels", column)) continue;
+    raw.run(/*sql*/ `ALTER TABLE contact_channels DROP COLUMN ${column}`);
+    log.info(`Dropped ${column} column from contact_channels`);
+  }
+}