@vellumai/assistant 0.3.15 → 0.3.18

package/src/memory/job-handlers/index-maintenance.ts

@@ -4,6 +4,7 @@ import { getLogger } from '../../util/logger.js';
 import { getDb, rawExec } from '../db.js';
 import { asString, BackendUnavailableError } from '../job-utils.js';
 import { enqueueMemoryJob, type MemoryJob } from '../jobs-store.js';
+import { withQdrantBreaker } from '../qdrant-circuit-breaker.js';
 import { getQdrantClient } from '../qdrant-client.js';
 import { memoryEmbeddings, memoryItems, memorySegments, memorySummaries } from '../schema.js';
 
@@ -50,6 +51,6 @@ export async function deleteQdrantVectorsJob(job: MemoryJob): Promise<void> {
     throw new BackendUnavailableError('Qdrant client not initialized');
   }
 
-  await qdrant.deleteByTarget(targetType, targetId);
+  await withQdrantBreaker(() => qdrant.deleteByTarget(targetType, targetId));
   log.info({ targetType, targetId }, 'Retried Qdrant vector deletion succeeded');
 }

package/src/memory/job-utils.ts

@@ -7,6 +7,7 @@ import { BackendUnavailableError } from '../util/errors.js';
 import { getLogger } from '../util/logger.js';
 import { getDb } from './db.js';
 import { embedWithBackend, getMemoryBackendStatus } from './embedding-backend.js';
+import { withQdrantBreaker } from './qdrant-circuit-breaker.js';
 import { getQdrantClient } from './qdrant-client.js';
 import { memoryEmbeddings } from './schema.js';
 
@@ -213,11 +214,13 @@ export async function embedAndUpsert(
   }
 
   try {
-    await qdrant.upsert(targetType, targetId, vector, {
-      text,
-      created_at: (extraPayload?.created_at as number) ?? now,
-      ...(extraPayload as Record<string, unknown> | undefined),
-    });
+    await withQdrantBreaker(() =>
+      qdrant.upsert(targetType, targetId, vector, {
+        text,
+        created_at: (extraPayload?.created_at as number) ?? now,
+        ...(extraPayload as Record<string, unknown> | undefined),
+      }),
+    );
   } catch (err) {
     log.warn({ err, targetType, targetId }, 'Failed to upsert embedding to Qdrant');
     throw err;

package/src/memory/jobs-store.ts

@@ -1,10 +1,13 @@
 import { and, asc, eq, inArray,lte, notInArray } from 'drizzle-orm';
 import { v4 as uuid } from 'uuid';
 
+import { getLogger } from '../util/logger.js';
 import { truncate } from '../util/truncate.js';
-import { getDb, rawAll,rawGet } from './db.js';
+import { getDb, rawAll, rawChanges, rawGet } from './db.js';
 import { memoryJobs } from './schema.js';
 
+const log = getLogger('memory-jobs-store');
+
 export type MemoryJobType =
   | 'embed_segment'
   | 'embed_item'
@@ -22,6 +25,7 @@ export type MemoryJobType =
   | 'build_conversation_summary'
   | 'backfill'
   | 'rebuild_index'
+  | 'reconcile_fts'
   | 'delete_qdrant_vectors'
   | 'media_processing';
 
@@ -36,6 +40,7 @@ export interface MemoryJob<T = Record<string, unknown>> {
   deferrals: number;
   runAfter: number;
   lastError: string | null;
+  startedAt: number | null;
   createdAt: number;
   updatedAt: number;
 }
@@ -244,6 +249,21 @@ export function enqueuePruneOldConversationsJob(retentionDays?: number): string
   return enqueueMemoryJob('prune_old_conversations', payload);
 }
 
+export function enqueueReconcileFtsJob(): string {
+  const db = getDb();
+  const existing = db
+    .select()
+    .from(memoryJobs)
+    .where(and(
+      eq(memoryJobs.type, 'reconcile_fts'),
+      inArray(memoryJobs.status, ['pending', 'running']),
+    ))
+    .orderBy(asc(memoryJobs.createdAt))
+    .get();
+  if (existing) return existing.id;
+  return enqueueMemoryJob('reconcile_fts', {});
+}
+
 export function claimMemoryJobs(limit: number): MemoryJob[] {
   if (limit <= 0) return [];
   const db = getDb();
@@ -275,14 +295,15 @@ export function claimMemoryJobs(limit: number): MemoryJob[] {
 
   const claimed: MemoryJob[] = [];
   for (const row of candidates) {
-    const result = db.update(memoryJobs)
-      .set({ status: 'running', updatedAt: now })
+    db.update(memoryJobs)
+      .set({ status: 'running', startedAt: now, updatedAt: now })
       .where(and(eq(memoryJobs.id, row.id), eq(memoryJobs.status, 'pending')))
-      .run() as unknown as { changes?: number };
-    if ((result.changes ?? 0) === 0) continue;
+      .run();
+    if (rawChanges() === 0) continue;
     claimed.push(parseRow({
       ...row,
       status: 'running',
+      startedAt: now,
       updatedAt: now,
     }));
   }
@@ -298,7 +319,9 @@ export function completeMemoryJob(id: string): void {
 }
 
 /** Max times a job can be deferred before it is marked as failed. */
-const MAX_DEFERRALS = 200;
+const MAX_DEFERRALS = 50;
+/** Warn when deferrals reach 80% of the limit. */
+const DEFER_WARNING_THRESHOLD = Math.floor(MAX_DEFERRALS * 0.8);
 /** Base delay in ms for deferred jobs (grows with exponential backoff). */
 const DEFER_BASE_DELAY_MS = 30_000;
 /** Maximum delay cap for deferred jobs (5 minutes). */
@@ -328,6 +351,7 @@ export function deferMemoryJob(id: string): 'deferred' | 'failed' {
   const now = Date.now();
 
   if (deferrals >= MAX_DEFERRALS) {
+    log.error({ jobId: id, type: row.type, deferrals }, 'Job exceeded max deferrals, marking as failed');
     db.update(memoryJobs)
       .set({
         status: 'failed',
@@ -340,6 +364,10 @@ export function deferMemoryJob(id: string): 'deferred' | 'failed' {
     return 'failed';
   }
 
+  if (deferrals >= DEFER_WARNING_THRESHOLD) {
+    log.warn({ jobId: id, type: row.type, deferrals, max: MAX_DEFERRALS }, 'Job approaching max deferral limit');
+  }
+
   // Exponential backoff: 30s, 60s, 120s, ... capped at 5 minutes
   const delay = Math.min(DEFER_BASE_DELAY_MS * Math.pow(2, Math.min(deferrals - 1, 10)), DEFER_MAX_DELAY_MS);
   db.update(memoryJobs)
@@ -403,6 +431,37 @@ export function resetRunningJobsToPending(): number {
   return runningRows.length;
 }
 
+/**
+ * Fail running jobs whose `startedAt` is older than `timeoutMs` ago.
+ * Returns the number of jobs that were timed out.
+ */
+export function failStalledJobs(timeoutMs: number): number {
+  const now = Date.now();
+  const cutoff = now - timeoutMs;
+  const stalled = rawAll<{ id: string; type: string }>(`
+    SELECT id, type
+    FROM memory_jobs
+    WHERE status = 'running'
+      AND started_at IS NOT NULL
+      AND started_at < ?
+  `, cutoff);
+  if (stalled.length === 0) return 0;
+
+  const db = getDb();
+  for (const row of stalled) {
+    db.update(memoryJobs)
+      .set({
+        status: 'failed',
+        updatedAt: now,
+        lastError: `Job timed out after ${Math.round(timeoutMs / 60_000)} minutes`,
+      })
+      .where(and(eq(memoryJobs.id, row.id), eq(memoryJobs.status, 'running')))
+      .run();
+    log.warn({ jobId: row.id, type: row.type, timeoutMs }, 'Failed stalled memory job due to timeout');
+  }
+  return stalled.length;
+}
+
 export function getMemoryJobCounts(): Record<string, number> {
   const rows = rawAll<{ status: string; c: number }>(`
     SELECT status, COUNT(*) AS c
@@ -432,6 +491,7 @@ function parseRow(row: typeof memoryJobs.$inferSelect): MemoryJob {
     deferrals: row.deferrals,
     runAfter: row.runAfter,
     lastError: row.lastError,
+    startedAt: row.startedAt,
     createdAt: row.createdAt,
     updatedAt: row.updatedAt,
   };

package/src/memory/jobs-worker.ts

@@ -2,6 +2,7 @@ import { getConfig } from '../config/loader.js';
 import type { AssistantConfig } from '../config/types.js';
 import { getLogger } from '../util/logger.js';
 import { rawRun } from './db.js';
+import { reconcileFtsIndexes } from './fts-reconciler.js';
 import { backfillEntityRelationsJob,backfillJob } from './job-handlers/backfill.js';
 import { checkContradictionsJob, cleanupStaleSupersededItemsJob, pruneOldConversationsJob } from './job-handlers/cleanup.js';
 import { cleanupResolvedConflictsJob,resolvePendingConflictsForMessageJob } from './job-handlers/conflict.js';
@@ -24,10 +25,13 @@ import {
   enqueueCleanupResolvedConflictsJob,
   enqueueCleanupStaleSupersededItemsJob,
   enqueuePruneOldConversationsJob,
+  enqueueReconcileFtsJob,
   failMemoryJob,
+  failStalledJobs,
   type MemoryJob,
   resetRunningJobsToPending,
 } from './jobs-store.js';
+import { QdrantCircuitOpenError } from './qdrant-circuit-breaker.js';
 import { bumpMemoryVersion } from './recall-cache.js';
 
 // Re-export public utilities consumed by tests and other modules
@@ -86,6 +90,12 @@ export async function runMemoryJobsOnce(
   // Periodic stale item sweep (throttled to at most once per hour)
   sweepStaleItems(config);
 
+  // Fail jobs that have been running longer than the configured timeout
+  const timedOut = failStalledJobs(config.memory.jobs.stalledJobTimeoutMs);
+  if (timedOut > 0) {
+    log.warn({ timedOut }, 'Timed out stalled memory jobs');
+  }
+
   const batchSize = Math.max(1, config.memory.jobs.batchSize);
   const concurrency = Math.max(1, config.memory.jobs.workerConcurrency);
   const jobs = claimMemoryJobs(batchSize);
@@ -174,10 +184,17 @@ function handleJobError(job: MemoryJob, err: unknown): void {
   if (err instanceof BackendUnavailableError) {
     const result = deferMemoryJob(job.id);
     if (result === 'failed') {
-      log.warn({ jobId: job.id, type: job.type }, 'Embedding backend unavailable, job exceeded max deferrals');
+      log.error({ jobId: job.id, type: job.type }, 'Embedding backend unavailable, job exceeded max deferrals');
     } else {
       log.debug({ jobId: job.id, type: job.type }, 'Embedding backend unavailable, deferring job');
     }
+  } else if (err instanceof QdrantCircuitOpenError) {
+    const result = deferMemoryJob(job.id);
+    if (result === 'failed') {
+      log.error({ jobId: job.id, type: job.type }, 'Qdrant circuit breaker open, job exceeded max deferrals');
+    } else {
+      log.debug({ jobId: job.id, type: job.type }, 'Qdrant circuit breaker open, deferring job');
+    }
   } else {
     const message = err instanceof Error ? err.message : String(err);
     const category = classifyError(err);
@@ -247,6 +264,9 @@ async function processJob(job: MemoryJob, config: AssistantConfig): Promise<void
     case 'rebuild_index':
       rebuildIndexJob();
       return;
+    case 'reconcile_fts':
+      reconcileFtsIndexes();
+      return;
     case 'delete_qdrant_vectors':
       await deleteQdrantVectorsJob(job);
       return;
@@ -281,11 +301,13 @@ export function maybeEnqueueScheduledCleanupJobs(config: AssistantConfig, nowMs
   const pruneConversationsJobId = cleanup.conversationRetentionDays > 0
     ? enqueuePruneOldConversationsJob(cleanup.conversationRetentionDays)
     : null;
+  const reconcileFtsJobId = enqueueReconcileFtsJob();
   lastScheduledCleanupEnqueueMs = nowMs;
   log.debug({
     resolvedConflictsJobId,
     staleSupersededItemsJobId,
     pruneConversationsJobId,
+    reconcileFtsJobId,
     enqueueIntervalMs: cleanup.enqueueIntervalMs,
     resolvedConflictRetentionMs: cleanup.resolvedConflictRetentionMs,
     supersededItemRetentionMs: cleanup.supersededItemRetentionMs,

package/src/memory/migrations/030-guardian-action-followup.ts

@@ -0,0 +1,21 @@
+import type { DrizzleDb } from '../db-connection.js';
+
+/**
+ * Add follow-up lifecycle columns to guardian_action_requests.
+ *
+ * These columns track why a request expired (expired_reason), the
+ * post-timeout follow-up state machine (followup_state), and any
+ * late answer that arrived after the timeout.
+ *
+ * Uses ALTER TABLE ADD COLUMN with try/catch for idempotency.
+ */
+export function migrateGuardianActionFollowup(database: DrizzleDb): void {
+  try { database.run(/*sql*/ `ALTER TABLE guardian_action_requests ADD COLUMN expired_reason TEXT`); } catch { /* already exists */ }
+  try { database.run(/*sql*/ `ALTER TABLE guardian_action_requests ADD COLUMN followup_state TEXT NOT NULL DEFAULT 'none'`); } catch { /* already exists */ }
+  try { database.run(/*sql*/ `ALTER TABLE guardian_action_requests ADD COLUMN late_answer_text TEXT`); } catch { /* already exists */ }
+  try { database.run(/*sql*/ `ALTER TABLE guardian_action_requests ADD COLUMN late_answered_at INTEGER`); } catch { /* already exists */ }
+  try { database.run(/*sql*/ `ALTER TABLE guardian_action_requests ADD COLUMN followup_action TEXT`); } catch { /* already exists */ }
+  try { database.run(/*sql*/ `ALTER TABLE guardian_action_requests ADD COLUMN followup_completed_at INTEGER`); } catch { /* already exists */ }
+
+  database.run(/*sql*/ `CREATE INDEX IF NOT EXISTS idx_guardian_action_requests_followup_state ON guardian_action_requests(followup_state)`);
+}

package/src/memory/migrations/030-guardian-verification-purpose.ts

@@ -0,0 +1,17 @@
+import type { DrizzleDb } from '../db-connection.js';
+
+/**
+ * Add verification_purpose column to channel_guardian_verification_challenges.
+ * Distinguishes guardian outbound verification from trusted contact verification
+ * so the consume path knows whether to create a guardian binding.
+ *
+ * Uses ALTER TABLE ADD COLUMN which is a no-op if the column already
+ * exists (caught by try/catch).
+ */
+export function migrateGuardianVerificationPurpose(database: DrizzleDb): void {
+  try {
+    database.run(
+      /*sql*/ `ALTER TABLE channel_guardian_verification_challenges ADD COLUMN verification_purpose TEXT DEFAULT 'guardian'`,
+    );
+  } catch { /* already exists */ }
+}

package/src/memory/migrations/031-conversations-thread-type-index.ts

@@ -0,0 +1,5 @@
+import type { DrizzleDb } from '../db-connection.js';
+
+export function migrateConversationsThreadTypeIndex(database: DrizzleDb): void {
+  database.run(/*sql*/ `CREATE INDEX IF NOT EXISTS idx_conversations_thread_type ON conversations(thread_type)`);
+}

package/src/memory/migrations/032-guardian-delivery-conversation-index.ts

@@ -0,0 +1,15 @@
+import type { DrizzleDb } from '../db-connection.js';
+
+/**
+ * Add index on guardian_action_deliveries.destination_conversation_id.
+ *
+ * Several lookup paths (getPendingDeliveryByConversation,
+ * getExpiredDeliveryByConversation, getFollowupDeliveryByConversation)
+ * filter deliveries by destination_conversation_id. Without an index
+ * these degrade to full table scans as delivery history grows.
+ */
+export function migrateGuardianDeliveryConversationIndex(database: DrizzleDb): void {
+  database.run(
+    /*sql*/ `CREATE INDEX IF NOT EXISTS idx_guardian_action_deliveries_dest_conversation ON guardian_action_deliveries(destination_conversation_id)`,
+  );
+}

package/src/memory/migrations/032-notification-delivery-thread-decision.ts

@@ -0,0 +1,20 @@
+import type { DrizzleDb } from '../db-connection.js';
+
+/**
+ * Add thread decision audit columns to notification_deliveries.
+ *
+ * These columns record the model's per-channel thread action (start_new
+ * or reuse_existing), the target conversation ID for reuse, and whether
+ * a fallback to start_new was needed due to an invalid/stale target.
+ */
+export function migrateNotificationDeliveryThreadDecision(database: DrizzleDb): void {
+  try {
+    database.run(/*sql*/ `ALTER TABLE notification_deliveries ADD COLUMN thread_action TEXT`);
+  } catch { /* Column already exists */ }
+  try {
+    database.run(/*sql*/ `ALTER TABLE notification_deliveries ADD COLUMN thread_target_conversation_id TEXT`);
+  } catch { /* Column already exists */ }
+  try {
+    database.run(/*sql*/ `ALTER TABLE notification_deliveries ADD COLUMN thread_decision_fallback_used INTEGER`);
+  } catch { /* Column already exists */ }
+}

package/src/memory/migrations/100-core-tables.ts

@@ -28,7 +28,7 @@ export function createCoreTables(database: DrizzleDb): void {
   database.run(/*sql*/ `
     CREATE TABLE IF NOT EXISTS messages (
       id TEXT PRIMARY KEY,
-      conversation_id TEXT NOT NULL REFERENCES conversations(id),
+      conversation_id TEXT NOT NULL REFERENCES conversations(id) ON DELETE CASCADE,
       role TEXT NOT NULL,
       content TEXT NOT NULL,
       created_at INTEGER NOT NULL

package/src/memory/migrations/101-watchers-and-logs.ts

@@ -108,6 +108,10 @@ export function createWatchersAndLogsTables(database: DrizzleDb): void {
   `);
 
   // FTS table for lexical retrieval over memory_segments.text.
+  // Triggers below are atomic with the triggering statement: if the FTS
+  // operation fails, the base table write rolls back too. A corrupted FTS
+  // table will block all memory_segments writes until rebuilt. See the
+  // analogous comment in 116-messages-fts.ts for recovery steps.
   database.run(/*sql*/ `
     CREATE VIRTUAL TABLE IF NOT EXISTS memory_segment_fts USING fts5(
       segment_id UNINDEXED,

package/src/memory/migrations/108-tasks-and-work-items.ts

@@ -22,7 +22,7 @@ export function createTasksAndWorkItemsTables(database: DrizzleDb): void {
   database.run(/*sql*/ `
     CREATE TABLE IF NOT EXISTS task_runs (
       id TEXT PRIMARY KEY,
-      task_id TEXT NOT NULL REFERENCES tasks(id),
+      task_id TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
       conversation_id TEXT,
       status TEXT NOT NULL DEFAULT 'pending',
       started_at INTEGER,

package/src/memory/migrations/112-assistant-inbox.ts

@@ -40,7 +40,7 @@ export function createAssistantInboxTables(database: DrizzleDb): void {
       username TEXT,
       status TEXT NOT NULL DEFAULT 'pending',
       policy TEXT NOT NULL DEFAULT 'allow',
-      invite_id TEXT REFERENCES assistant_ingress_invites(id),
+      invite_id TEXT REFERENCES assistant_ingress_invites(id) ON DELETE CASCADE,
       created_by_session_id TEXT,
       revoked_reason TEXT,
       blocked_reason TEXT,

package/src/memory/migrations/113-late-migrations.ts

@@ -9,7 +9,7 @@ import { migrateConversationStatusIndexes } from './021-conversation-status-inde
 import { migrateAddOriginInterface } from './022-add-origin-interface.js';
 import { migrateMemoryItemSourcesIndexes } from './023-memory-item-sources-indexes.js';
 import { migrateEmbeddingVectorBlob } from './024-embedding-vector-blob.js';
-import { migrateEmbeddingsNullableVectorJson } from './026-embeddings-nullable-vector-json.js';
+import { migrateEmbeddingsNullableVectorJson } from './026a-embeddings-nullable-vector-json.js';
 
 /**
  * Late-stage migrations that must run after all tables and indexes exist:

package/src/memory/migrations/116-messages-fts.ts

@@ -8,6 +8,19 @@ import type { DrizzleDb } from '../db-connection.js';
  * (type, text, tool_use) are short common words that rarely matter as search
  * terms.  The existing buildExcerpt() in conversation-store handles extracting
  * readable text from JSON for display after matching.
+ *
+ * ## Trigger atomicity and failure modes
+ *
+ * SQLite triggers execute atomically within the triggering statement's
+ * transaction. If the FTS trigger fails (e.g., corrupted FTS index), the
+ * entire statement — including the base table INSERT/UPDATE/DELETE — is
+ * rolled back. This means a trigger failure does NOT silently lose FTS
+ * data; instead, it prevents the base operation from succeeding at all.
+ *
+ * The real risk is the reverse: a corrupted FTS virtual table will cause
+ * ALL writes to the messages table to fail until the FTS table is rebuilt.
+ * If this happens, `messages_fts` should be dropped and recreated, then
+ * backfilled via `migrateMessagesFtsBackfill`.
  */
 export function createMessagesFts(database: DrizzleDb): void {
   database.run(/*sql*/ `

package/src/memory/migrations/119-schema-indexes-and-columns.ts

@@ -0,0 +1,37 @@
+import type { DrizzleDb } from '../db-connection.js';
+
+/**
+ * Add indexes, a column, and a unique constraint for schema improvements:
+ * - Index on call_sessions(status) for status-based queries
+ * - Index on llm_usage_events(conversation_id) for per-conversation usage queries
+ * - startedAt column on memory_jobs for detecting stalled jobs
+ * - Unique index on notification_deliveries(notification_decision_id, channel)
+ */
+export function migrateSchemaIndexesAndColumns(database: DrizzleDb): void {
+  database.run(/*sql*/ `CREATE INDEX IF NOT EXISTS idx_call_sessions_status ON call_sessions(status)`);
+  database.run(/*sql*/ `CREATE INDEX IF NOT EXISTS idx_llm_usage_events_conversation_id ON llm_usage_events(conversation_id)`);
+
+  try {
+    database.run(/*sql*/ `ALTER TABLE memory_jobs ADD COLUMN started_at INTEGER`);
+  } catch { /* already exists */ }
+
+  // Deduplicate before creating the unique index — the prior schema allowed
+  // multiple rows per (notification_decision_id, channel) via the wider
+  // (decision_id, channel, destination, attempt) unique index.  Keep the
+  // row with the latest updated_at for each group.
+  database.run(/*sql*/ `
+    DELETE FROM notification_deliveries
+    WHERE id NOT IN (
+      SELECT id FROM (
+        SELECT id, ROW_NUMBER() OVER (
+          PARTITION BY notification_decision_id, channel
+          ORDER BY updated_at DESC
+        ) AS rn
+        FROM notification_deliveries
+      )
+      WHERE rn = 1
+    )
+  `);
+
+  database.run(/*sql*/ `CREATE UNIQUE INDEX IF NOT EXISTS idx_notification_deliveries_decision_channel ON notification_deliveries(notification_decision_id, channel)`);
+}

package/src/memory/migrations/120-fk-cascade-rebuilds.ts

@@ -0,0 +1,161 @@
+import { type DrizzleDb, getSqliteFrom } from '../db-connection.js';
+
+/**
+ * Rebuild messages, task_runs, and assistant_ingress_members tables to add
+ * ON DELETE CASCADE to their FK constraints.  SQLite does not support
+ * ALTER TABLE to change FK behavior, so a table rebuild is required.
+ *
+ * Follows the same pattern as 002-tool-invocations-fk.ts: check if the
+ * DDL already contains ON DELETE CASCADE, and skip if so.
+ */
+export function migrateFkCascadeRebuilds(database: DrizzleDb): void {
+  const raw = getSqliteFrom(database);
+
+  rebuildMessages(raw);
+  rebuildTaskRuns(raw);
+  rebuildAssistantIngressMembers(raw);
+}
+
+function hasCascade(raw: ReturnType<typeof getSqliteFrom>, tableName: string): boolean {
+  const row = raw.query(`SELECT sql FROM sqlite_master WHERE type='table' AND name=?`).get(tableName) as { sql: string } | null;
+  if (!row) return true; // table doesn't exist yet — will be created with correct DDL
+  return row.sql.includes('ON DELETE CASCADE');
+}
+
+function rebuildMessages(raw: ReturnType<typeof getSqliteFrom>): void {
+  if (hasCascade(raw, 'messages')) return;
+
+  raw.exec('PRAGMA foreign_keys = OFF');
+  try {
+    raw.exec(/*sql*/ `
+      BEGIN;
+
+      DROP TRIGGER IF EXISTS messages_fts_ai;
+      DROP TRIGGER IF EXISTS messages_fts_ad;
+      DROP TRIGGER IF EXISTS messages_fts_au;
+
+      CREATE TABLE messages_new (
+        id TEXT PRIMARY KEY,
+        conversation_id TEXT NOT NULL REFERENCES conversations(id) ON DELETE CASCADE,
+        role TEXT NOT NULL,
+        content TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        metadata TEXT
+      );
+      INSERT INTO messages_new SELECT id, conversation_id, role, content, created_at, metadata FROM messages;
+      DROP TABLE messages;
+      ALTER TABLE messages_new RENAME TO messages;
+
+      CREATE INDEX IF NOT EXISTS idx_messages_conversation_id ON messages(conversation_id);
+      CREATE INDEX IF NOT EXISTS idx_messages_created_at ON messages(created_at);
+
+      CREATE TRIGGER IF NOT EXISTS messages_fts_ai
+      AFTER INSERT ON messages
+      BEGIN
+        INSERT INTO messages_fts(message_id, content) VALUES (new.id, new.content);
+      END;
+
+      CREATE TRIGGER IF NOT EXISTS messages_fts_ad
+      AFTER DELETE ON messages
+      BEGIN
+        DELETE FROM messages_fts WHERE message_id = old.id;
+      END;
+
+      CREATE TRIGGER IF NOT EXISTS messages_fts_au
+      AFTER UPDATE ON messages
+      BEGIN
+        DELETE FROM messages_fts WHERE message_id = old.id;
+        INSERT INTO messages_fts(message_id, content) VALUES (new.id, new.content);
+      END;
+
+      COMMIT;
+    `);
+  } catch (e) {
+    try { raw.exec('ROLLBACK'); } catch { /* no active transaction */ }
+    throw e;
+  } finally {
+    raw.exec('PRAGMA foreign_keys = ON');
+  }
+}
+
+function rebuildTaskRuns(raw: ReturnType<typeof getSqliteFrom>): void {
+  if (hasCascade(raw, 'task_runs')) return;
+
+  raw.exec('PRAGMA foreign_keys = OFF');
+  try {
+    raw.exec(/*sql*/ `
+      BEGIN;
+      CREATE TABLE task_runs_new (
+        id TEXT PRIMARY KEY,
+        task_id TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+        conversation_id TEXT,
+        status TEXT NOT NULL DEFAULT 'pending',
+        started_at INTEGER,
+        finished_at INTEGER,
+        error TEXT,
+        principal_id TEXT,
+        memory_scope_id TEXT,
+        created_at INTEGER NOT NULL
+      );
+      INSERT INTO task_runs_new SELECT id, task_id, conversation_id, status, started_at, finished_at, error, principal_id, memory_scope_id, created_at FROM task_runs;
+      DROP TABLE task_runs;
+      ALTER TABLE task_runs_new RENAME TO task_runs;
+
+      CREATE INDEX IF NOT EXISTS idx_task_runs_task_id ON task_runs(task_id);
+      CREATE INDEX IF NOT EXISTS idx_task_runs_status ON task_runs(status);
+      CREATE INDEX IF NOT EXISTS idx_task_runs_conversation_status ON task_runs(conversation_id, status);
+
+      COMMIT;
+    `);
+  } catch (e) {
+    try { raw.exec('ROLLBACK'); } catch { /* no active transaction */ }
+    throw e;
+  } finally {
+    raw.exec('PRAGMA foreign_keys = ON');
+  }
+}
+
+function rebuildAssistantIngressMembers(raw: ReturnType<typeof getSqliteFrom>): void {
+  if (hasCascade(raw, 'assistant_ingress_members')) return;
+
+  raw.exec('PRAGMA foreign_keys = OFF');
+  try {
+    raw.exec(/*sql*/ `
+      BEGIN;
+      CREATE TABLE assistant_ingress_members_new (
+        id TEXT PRIMARY KEY,
+        assistant_id TEXT NOT NULL DEFAULT 'self',
+        source_channel TEXT NOT NULL,
+        external_user_id TEXT,
+        external_chat_id TEXT,
+        display_name TEXT,
+        username TEXT,
+        status TEXT NOT NULL DEFAULT 'pending',
+        policy TEXT NOT NULL DEFAULT 'allow',
+        invite_id TEXT REFERENCES assistant_ingress_invites(id) ON DELETE CASCADE,
+        created_by_session_id TEXT,
+        revoked_reason TEXT,
+        blocked_reason TEXT,
+        last_seen_at INTEGER,
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL,
+        CHECK (external_user_id IS NOT NULL OR external_chat_id IS NOT NULL)
+      );
+      INSERT INTO assistant_ingress_members_new SELECT id, assistant_id, source_channel, external_user_id, external_chat_id, display_name, username, status, policy, invite_id, created_by_session_id, revoked_reason, blocked_reason, last_seen_at, created_at, updated_at FROM assistant_ingress_members;
+      DROP TABLE assistant_ingress_members;
+      ALTER TABLE assistant_ingress_members_new RENAME TO assistant_ingress_members;
+
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_ingress_members_user ON assistant_ingress_members(assistant_id, source_channel, external_user_id) WHERE external_user_id IS NOT NULL;
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_ingress_members_chat ON assistant_ingress_members(assistant_id, source_channel, external_chat_id) WHERE external_chat_id IS NOT NULL;
+      CREATE INDEX IF NOT EXISTS idx_ingress_members_status_policy ON assistant_ingress_members(assistant_id, source_channel, status, policy);
+      CREATE INDEX IF NOT EXISTS idx_ingress_members_updated ON assistant_ingress_members(assistant_id, source_channel, updated_at);
+
+      COMMIT;
+    `);
+  } catch (e) {
+    try { raw.exec('ROLLBACK'); } catch { /* no active transaction */ }
+    throw e;
+  } finally {
+    raw.exec('PRAGMA foreign_keys = ON');
+  }
+}

package/src/memory/migrations/index.ts

@@ -23,12 +23,17 @@ export { migrateAddOriginInterface } from './022-add-origin-interface.js';
 export { migrateMemoryItemSourcesIndexes } from './023-memory-item-sources-indexes.js';
 export { migrateEmbeddingVectorBlob } from './024-embedding-vector-blob.js';
 export { migrateMessagesFtsBackfill } from './025-messages-fts-backfill.js';
-export { migrateEmbeddingsNullableVectorJson } from './026-embeddings-nullable-vector-json.js';
 export { migrateGuardianVerificationSessions } from './026-guardian-verification-sessions.js';
-export { migrateGuardianBootstrapToken } from './027-guardian-bootstrap-token.js';
+export { migrateEmbeddingsNullableVectorJson } from './026a-embeddings-nullable-vector-json.js';
 export { migrateNotificationDeliveryPairingColumns } from './027-notification-delivery-pairing-columns.js';
+export { migrateGuardianBootstrapToken } from './027a-guardian-bootstrap-token.js';
 export { migrateCallSessionMode } from './028-call-session-mode.js';
 export { migrateChannelInboundDeliveredSegments } from './029-channel-inbound-delivered-segments.js';
+export { migrateGuardianActionFollowup } from './030-guardian-action-followup.js';
+export { migrateGuardianVerificationPurpose } from './030-guardian-verification-purpose.js';
+export { migrateConversationsThreadTypeIndex } from './031-conversations-thread-type-index.js';
+export { migrateGuardianDeliveryConversationIndex } from './032-guardian-delivery-conversation-index.js';
+export { migrateNotificationDeliveryThreadDecision } from './032-notification-delivery-thread-decision.js';
 export { createCoreTables } from './100-core-tables.js';
 export { createWatchersAndLogsTables } from './101-watchers-and-logs.js';
 export { addCoreColumns } from './102-alter-table-columns.js';
@@ -48,9 +53,11 @@ export { createSequenceTables } from './115-sequences.js';
 export { createMessagesFts } from './116-messages-fts.js';
 export { createConversationAttentionTables } from './117-conversation-attention.js';
 export { migrateReminderRoutingIntent } from './118-reminder-routing-intent.js';
+export { migrateSchemaIndexesAndColumns } from './119-schema-indexes-and-columns.js';
+export { migrateFkCascadeRebuilds } from './120-fk-cascade-rebuilds.js';
 export {
   MIGRATION_REGISTRY,
   type MigrationRegistryEntry,
   type MigrationValidationResult,
 } from './registry.js';
-export { validateMigrationState } from './validate-migration-state.js';
+export { recoverCrashedMigrations, validateMigrationState, withCrashRecovery } from './validate-migration-state.js';