@vellumai/assistant 0.5.5 → 0.5.7

package/src/memory/migrations/024-embedding-vector-blob.ts

@@ -71,3 +71,77 @@ export function migrateEmbeddingVectorBlob(database: DrizzleDb): void {
       .run(checkpointKey, Date.now());
   }
 }
+
+/**
+ * Drop the vector_blob column from memory_embeddings.
+ *
+ * NOTE: Binary embedding data stored in vector_blob is lost on rollback.
+ * Rows that still have vector_json will continue to work; rows that only
+ * had vector_blob will lose their embedding vectors.
+ *
+ * SQLite does not support DROP COLUMN on all versions, so we rebuild the table.
+ */
+export function downEmbeddingVectorBlob(database: DrizzleDb): void {
+  const raw = getSqliteFrom(database);
+
+  // Check if vector_blob column exists
+  const hasColumn = raw
+    .query(
+      `SELECT 1 FROM pragma_table_info('memory_embeddings') WHERE name = 'vector_blob'`,
+    )
+    .get();
+  if (!hasColumn) return;
+
+  raw.exec("PRAGMA foreign_keys = OFF");
+  try {
+    raw.exec("BEGIN");
+
+    // Get the current columns minus vector_blob
+    const columns = raw
+      .query(`SELECT name FROM pragma_table_info('memory_embeddings')`)
+      .all() as Array<{ name: string }>;
+    const keepColumns = columns
+      .map((c) => c.name)
+      .filter((n) => n !== "vector_blob");
+
+    // Get the current DDL to understand the table structure
+    const ddl = raw
+      .query(
+        `SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'memory_embeddings'`,
+      )
+      .get() as { sql: string } | null;
+    if (!ddl) {
+      raw.exec("ROLLBACK");
+      return;
+    }
+
+    // Remove the vector_blob column definition from the DDL
+    const newDdl = ddl.sql
+      .replace(/,\s*vector_blob\s+BLOB/i, "")
+      .replace("memory_embeddings", "memory_embeddings_new");
+
+    raw.exec(newDdl);
+
+    const colList = keepColumns.join(", ");
+    raw.exec(/*sql*/ `
+      INSERT INTO memory_embeddings_new (${colList})
+      SELECT ${colList} FROM memory_embeddings
+    `);
+
+    raw.exec(/*sql*/ `DROP TABLE memory_embeddings`);
+    raw.exec(
+      /*sql*/ `ALTER TABLE memory_embeddings_new RENAME TO memory_embeddings`,
+    );
+
+    raw.exec("COMMIT");
+  } catch (e) {
+    try {
+      raw.exec("ROLLBACK");
+    } catch {
+      /* no active transaction */
+    }
+    throw e;
+  } finally {
+    raw.exec("PRAGMA foreign_keys = ON");
+  }
+}

package/src/memory/migrations/026a-embeddings-nullable-vector-json.ts

@@ -105,6 +105,88 @@ export function migrateEmbeddingsNullableVectorJson(database: DrizzleDb): void {
   }
 }
 
+/**
+ * Reverse v13: rebuild memory_embeddings with NOT NULL on vector_json.
+ *
+ * WARNING: Any rows with NULL vector_json will be lost — they cannot satisfy
+ * the NOT NULL constraint. This is acceptable because the forward migration
+ * only relaxed the constraint; rows written after the forward migration may
+ * have NULL vector_json (relying on vector_blob instead).
+ */
+export function downEmbeddingsNullableVectorJson(database: DrizzleDb): void {
+  const raw = getSqliteFrom(database);
+
+  const tableExists = raw
+    .query(
+      `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'memory_embeddings'`,
+    )
+    .get();
+  if (!tableExists) return;
+
+  // Check if vector_json already has NOT NULL — already rolled back
+  const ddl = raw
+    .query(
+      `SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'memory_embeddings'`,
+    )
+    .get() as { sql: string } | null;
+  if (ddl && isColumnNotNull(ddl.sql, "vector_json")) return;
+
+  raw.exec("PRAGMA foreign_keys = OFF");
+  try {
+    raw.exec("BEGIN");
+
+    raw.exec(/*sql*/ `
+      CREATE TABLE memory_embeddings_new (
+        id TEXT PRIMARY KEY,
+        target_type TEXT NOT NULL,
+        target_id TEXT NOT NULL,
+        provider TEXT NOT NULL,
+        model TEXT NOT NULL,
+        dimensions INTEGER NOT NULL,
+        vector_json TEXT NOT NULL,
+        vector_blob BLOB,
+        content_hash TEXT,
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL,
+        UNIQUE (target_type, target_id, provider, model)
+      )
+    `);
+    // Only copy rows where vector_json is NOT NULL — rows with NULL cannot
+    // satisfy the restored constraint and are lost.
+    raw.exec(/*sql*/ `
+      INSERT OR IGNORE INTO memory_embeddings_new (
+        id, target_type, target_id, provider, model, dimensions,
+        vector_json, vector_blob, content_hash, created_at, updated_at
+      )
+      SELECT
+        id, target_type, target_id, provider, model, dimensions,
+        vector_json, vector_blob, content_hash, created_at, updated_at
+      FROM memory_embeddings
+      WHERE vector_json IS NOT NULL
+      ORDER BY updated_at DESC
+    `);
+    raw.exec(/*sql*/ `DROP TABLE memory_embeddings`);
+    raw.exec(
+      /*sql*/ `ALTER TABLE memory_embeddings_new RENAME TO memory_embeddings`,
+    );
+
+    raw.exec(
+      /*sql*/ `CREATE INDEX IF NOT EXISTS idx_memory_embeddings_content_hash ON memory_embeddings(content_hash, provider, model)`,
+    );
+
+    raw.exec("COMMIT");
+  } catch (e) {
+    try {
+      raw.exec("ROLLBACK");
+    } catch {
+      /* no active transaction */
+    }
+    throw e;
+  } finally {
+    raw.exec("PRAGMA foreign_keys = ON");
+  }
+}
+
 /** Check whether a column is declared NOT NULL in a CREATE TABLE DDL string. */
 function isColumnNotNull(ddl: string, column: string): boolean {
   const pattern = new RegExp(`${column}\\s+\\w+.*?NOT\\s+NULL`, "i");

package/src/memory/migrations/036-normalize-phone-identities.ts

@@ -336,3 +336,14 @@ export function migrateNormalizePhoneIdentities(database: DrizzleDb): void {
     throw e;
   }
 }
+
+/**
+ * Reverse v14: no-op — original non-E.164 phone formats are not recoverable.
+ *
+ * The forward migration normalised phone numbers to E.164. The original
+ * formatting (parentheses, dashes, spaces, country-code variants) was
+ * discarded during normalisation and cannot be reconstructed.
+ */
+export function downNormalizePhoneIdentities(_database: DrizzleDb): void {
+  // Lossy — original phone formats are not recoverable.
+}

package/src/memory/migrations/116-messages-fts.ts

@@ -1,4 +1,7 @@
-import type { DrizzleDb } from "../db-connection.js";
+import { getLogger } from "../../util/logger.js";
+import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
+
+const logger = getLogger("messages-fts");
 
 /**
  * FTS5 virtual table for full-text search over messages.content.
@@ -21,7 +24,81 @@ import type { DrizzleDb } from "../db-connection.js";
  * ALL writes to the messages table to fail until the FTS table is rebuilt.
  * If this happens, `messages_fts` should be dropped and recreated, then
  * backfilled via `migrateMessagesFtsBackfill`.
+ *
+ * ## Auto-recovery from corruption
+ *
+ * After creating (or finding an existing) messages_fts table, we probe it
+ * with a lightweight MATCH query that exercises the FTS inverted index
+ * in O(1). If the probe throws SQLITE_CORRUPT_VTAB or SQLITE_CORRUPT,
+ * we force-remove all shadow tables and the vtable entry (falling back
+ * to `PRAGMA writable_schema` if DROP TABLE itself fails on the corrupt
+ * vtable) and recreate it from scratch. The subsequent
+ * `migrateMessagesFtsBackfill` call in db-init.ts will repopulate the
+ * index from the messages table — no message data is lost.
+ */
+function isSqliteCorruptionError(err: unknown): boolean {
+  const code =
+    err != null && typeof err === "object" && "code" in err
+      ? (err as { code: string }).code
+      : undefined;
+  return code === "SQLITE_CORRUPT_VTAB" || code === "SQLITE_CORRUPT";
+}
+
+/**
+ * Force-remove all FTS5 shadow tables, triggers, and the vtable entry.
+ *
+ * We drop each artifact individually so that a corrupt shadow table
+ * doesn't block cleanup of the others. If `DROP TABLE messages_fts`
+ * itself fails (FTS5's xDestroy hits a corrupt shadow table), we fall
+ * back to `PRAGMA writable_schema` to delete the vtable entry directly
+ * from `sqlite_schema`. Without this fallback, `CREATE VIRTUAL TABLE
+ * IF NOT EXISTS` would be a no-op and the crash loop would persist.
  */
+function dropFtsShadowTables(raw: ReturnType<typeof getSqliteFrom>): void {
+  const drops = [
+    `DROP TRIGGER IF EXISTS messages_fts_ai`,
+    `DROP TRIGGER IF EXISTS messages_fts_ad`,
+    `DROP TRIGGER IF EXISTS messages_fts_au`,
+    `DROP TABLE IF EXISTS messages_fts_config`,
+    `DROP TABLE IF EXISTS messages_fts_docsize`,
+    `DROP TABLE IF EXISTS messages_fts_content`,
+    `DROP TABLE IF EXISTS messages_fts_idx`,
+    `DROP TABLE IF EXISTS messages_fts_data`,
+  ];
+  for (const sql of drops) {
+    try {
+      raw.exec(sql);
+    } catch {
+      // Shadow table may itself be corrupt — ignore and continue
+    }
+  }
+
+  // Try the normal DROP TABLE path first (lets FTS5 clean up properly).
+  try {
+    raw.exec(`DROP TABLE IF EXISTS messages_fts`);
+  } catch {
+    // FTS5's xDestroy failed — force-remove the vtable entry from
+    // sqlite_schema so CREATE VIRTUAL TABLE isn't a no-op.
+    logger.warn(
+      "[messages-fts] DROP TABLE messages_fts failed — removing vtable entry via writable_schema",
+    );
+    raw.exec(`PRAGMA writable_schema = ON`);
+    try {
+      raw.exec(
+        `DELETE FROM sqlite_schema WHERE type = 'table' AND name = 'messages_fts'`,
+      );
+    } catch (schemaErr) {
+      logger.error(
+        { err: schemaErr },
+        "[messages-fts] Failed to remove vtable entry from sqlite_schema",
+      );
+      throw schemaErr;
+    } finally {
+      raw.exec(`PRAGMA writable_schema = OFF`);
+    }
+  }
+}
+
 export function createMessagesFts(database: DrizzleDb): void {
   database.run(/*sql*/ `
     CREATE VIRTUAL TABLE IF NOT EXISTS messages_fts USING fts5(
@@ -30,6 +107,34 @@ export function createMessagesFts(database: DrizzleDb): void {
     )
   `);
 
+  // Probe the FTS inverted index for corruption. A MATCH query exercises
+  // the index structures (not just the content store), so it catches
+  // corruption in shadow tables like _idx and _data. On empty tables
+  // this returns null gracefully. O(1) with LIMIT 1.
+  const raw = getSqliteFrom(database);
+  try {
+    raw
+      .query(`SELECT * FROM messages_fts WHERE messages_fts MATCH 'a' LIMIT 1`)
+      .get();
+  } catch (err: unknown) {
+    if (!isSqliteCorruptionError(err)) {
+      throw err;
+    }
+    logger.warn(
+      { err },
+      "[messages-fts] Detected corrupt messages_fts virtual table — dropping and recreating",
+    );
+    // DROP TABLE on a corrupt vtable can itself throw, so drop the
+    // FTS5 shadow tables directly to guarantee cleanup.
+    dropFtsShadowTables(raw);
+    database.run(/*sql*/ `
+      CREATE VIRTUAL TABLE messages_fts USING fts5(
+        message_id UNINDEXED,
+        content
+      )
+    `);
+  }
+
   database.run(/*sql*/ `
     CREATE TRIGGER IF NOT EXISTS messages_fts_ai
     AFTER INSERT ON messages

package/src/memory/migrations/126-backfill-guardian-principal-id.ts

@@ -1,6 +1,58 @@
 import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
 import { withCrashRecovery } from "./validate-migration-state.js";
 
+/**
+ * Reverse v15: set guardian_principal_id back to NULL on all rows in
+ * channel_guardian_bindings and canonical_guardian_requests.
+ *
+ * Also un-expires requests that the forward migration expired (sets them
+ * back to 'pending'). This is a best-effort reversal — the original status
+ * of expired requests cannot be perfectly reconstructed if they were already
+ * expired before the forward migration ran, but the forward migration only
+ * expired requests that had NULL guardian_principal_id and status = 'pending'.
+ */
+export function downBackfillGuardianPrincipalId(database: DrizzleDb): void {
+  const raw = getSqliteFrom(database);
+
+  // Null out guardian_principal_id on channel_guardian_bindings
+  const bindingsExists = raw
+    .query(
+      `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'channel_guardian_bindings'`,
+    )
+    .get();
+  if (bindingsExists) {
+    const colExists = raw
+      .query(
+        `SELECT 1 FROM pragma_table_info('channel_guardian_bindings') WHERE name = 'guardian_principal_id'`,
+      )
+      .get();
+    if (colExists) {
+      raw.exec(
+        /*sql*/ `UPDATE channel_guardian_bindings SET guardian_principal_id = NULL`,
+      );
+    }
+  }
+
+  // Null out guardian_principal_id on canonical_guardian_requests
+  const requestsExists = raw
+    .query(
+      `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'canonical_guardian_requests'`,
+    )
+    .get();
+  if (requestsExists) {
+    const colExists = raw
+      .query(
+        `SELECT 1 FROM pragma_table_info('canonical_guardian_requests') WHERE name = 'guardian_principal_id'`,
+      )
+      .get();
+    if (colExists) {
+      raw.exec(
+        /*sql*/ `UPDATE canonical_guardian_requests SET guardian_principal_id = NULL`,
+      );
+    }
+  }
+}
+
 /**
  * Backfill guardianPrincipalId for existing channel_guardian_bindings and
  * canonical_guardian_requests rows.

package/src/memory/migrations/127-guardian-principal-id-not-null.ts

@@ -1,6 +1,83 @@
 import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
 import { withCrashRecovery } from "./validate-migration-state.js";
 
+/**
+ * Reverse v16: rebuild channel_guardian_bindings to make guardian_principal_id
+ * nullable again (removing the NOT NULL constraint added by the forward migration).
+ */
+export function downGuardianPrincipalIdNotNull(database: DrizzleDb): void {
+  const raw = getSqliteFrom(database);
+
+  const tableExists = raw
+    .query(
+      `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'channel_guardian_bindings'`,
+    )
+    .get();
+  if (!tableExists) return;
+
+  // Check if guardian_principal_id has NOT NULL — if not, already rolled back
+  const colInfo = raw
+    .query(
+      `SELECT "notnull" FROM pragma_table_info('channel_guardian_bindings') WHERE name = 'guardian_principal_id'`,
+    )
+    .get() as { notnull: number } | null;
+  if (!colInfo || colInfo.notnull === 0) return;
+
+  raw.exec("PRAGMA foreign_keys = OFF");
+  try {
+    raw.exec("BEGIN");
+
+    raw.exec(/*sql*/ `
+      CREATE TABLE channel_guardian_bindings_new (
+        id TEXT PRIMARY KEY,
+        assistant_id TEXT NOT NULL,
+        channel TEXT NOT NULL,
+        guardian_external_user_id TEXT NOT NULL,
+        guardian_delivery_chat_id TEXT NOT NULL,
+        guardian_principal_id TEXT,
+        status TEXT NOT NULL DEFAULT 'active',
+        verified_at INTEGER NOT NULL,
+        verified_via TEXT NOT NULL DEFAULT 'challenge',
+        metadata_json TEXT,
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL
+      )
+    `);
+
+    raw.exec(/*sql*/ `
+      INSERT INTO channel_guardian_bindings_new
+      SELECT id, assistant_id, channel, guardian_external_user_id,
+             guardian_delivery_chat_id, guardian_principal_id,
+             status, verified_at, verified_via, metadata_json,
+             created_at, updated_at
+      FROM channel_guardian_bindings
+    `);
+
+    raw.exec(/*sql*/ `DROP TABLE channel_guardian_bindings`);
+    raw.exec(
+      /*sql*/ `ALTER TABLE channel_guardian_bindings_new RENAME TO channel_guardian_bindings`,
+    );
+
+    // Recreate the unique index for active bindings
+    raw.exec(/*sql*/ `
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_channel_guardian_bindings_active
+      ON channel_guardian_bindings(assistant_id, channel)
+      WHERE status = 'active'
+    `);
+
+    raw.exec("COMMIT");
+  } catch (e) {
+    try {
+      raw.exec("ROLLBACK");
+    } catch {
+      /* no active transaction */
+    }
+    throw e;
+  } finally {
+    raw.exec("PRAGMA foreign_keys = ON");
+  }
+}
+
 /**
  * Enforce NOT NULL on channel_guardian_bindings.guardian_principal_id.
  *

package/src/memory/migrations/134-contacts-notes-column.ts

@@ -2,6 +2,19 @@ import { getLogger } from "../../util/logger.js";
 import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
 import { withCrashRecovery } from "./validate-migration-state.js";
 
+/**
+ * Reverse v17: no-op — the original separate columns (relationship, importance,
+ * response_expectation, preferred_tone) cannot be reliably restored from the
+ * consolidated notes TEXT column.
+ *
+ * The forward migration concatenated multiple typed fields into a single
+ * free-text notes field and then dropped the original columns. Parsing the
+ * notes back into structured fields would be lossy and error-prone.
+ */
+export function downContactsNotesColumn(_database: DrizzleDb): void {
+  // Lossy — original structured columns cannot be restored from notes text.
+}
+
 const log = getLogger("migration-134");
 
 export function migrateContactsNotesColumn(database: DrizzleDb): void {

package/src/memory/migrations/135-backfill-contact-interaction-stats.ts

@@ -1,6 +1,26 @@
 import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
 import { withCrashRecovery } from "./validate-migration-state.js";
 
+/**
+ * Reverse v18: set contacts.last_interaction back to NULL.
+ *
+ * The forward migration backfilled last_interaction from channel data.
+ * Rolling back simply clears the column — the data can be re-derived by
+ * re-running the forward migration.
+ */
+export function downBackfillContactInteractionStats(database: DrizzleDb): void {
+  const raw = getSqliteFrom(database);
+
+  const colExists = raw
+    .query(
+      `SELECT 1 FROM pragma_table_info('contacts') WHERE name = 'last_interaction'`,
+    )
+    .get();
+  if (!colExists) return;
+
+  raw.exec(/*sql*/ `UPDATE contacts SET last_interaction = NULL`);
+}
+
 /**
  * Backfill contacts.last_interaction from the max lastSeenAt across each
  * contact's channels. interactionCount cannot be reliably derived from

package/src/memory/migrations/136-drop-assistant-id-columns.ts

@@ -2,6 +2,58 @@ import { getLogger } from "../../util/logger.js";
 import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
 import { withCrashRecovery } from "./validate-migration-state.js";
 
+/**
+ * Reverse v19: add assistant_id columns back to all 16 tables via
+ * ALTER TABLE ADD COLUMN, defaulting to 'self'.
+ *
+ * This restores the column that the forward migration dropped. All rows
+ * get assistant_id = 'self' since that was the only value before dropping.
+ */
+export function downDropAssistantIdColumns(database: DrizzleDb): void {
+  const raw = getSqliteFrom(database);
+
+  const tables = [
+    "contacts",
+    "assistant_ingress_invites",
+    "assistant_inbox_thread_state",
+    "call_sessions",
+    "channel_guardian_verification_challenges",
+    "channel_guardian_approval_requests",
+    "channel_guardian_rate_limits",
+    "guardian_action_requests",
+    "scoped_approval_grants",
+    "notification_events",
+    "notification_preferences",
+    "notification_deliveries",
+    "conversation_attention_events",
+    "conversation_assistant_attention_state",
+    "actor_token_records",
+    "actor_refresh_token_records",
+  ];
+
+  for (const table of tables) {
+    // Skip if table doesn't exist
+    const tableExists = raw
+      .query(`SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?`)
+      .get(table);
+    if (!tableExists) continue;
+
+    // Skip if column already exists (idempotent)
+    const colExists = raw
+      .query(`SELECT 1 FROM pragma_table_info(?) WHERE name = 'assistant_id'`)
+      .get(table);
+    if (colExists) continue;
+
+    try {
+      raw.exec(
+        /*sql*/ `ALTER TABLE ${table} ADD COLUMN assistant_id TEXT NOT NULL DEFAULT 'self'`,
+      );
+    } catch {
+      /* column may already exist from partial run */
+    }
+  }
+}
+
 const log = getLogger("migration-136");
 
 /**

package/src/memory/migrations/140-backfill-usage-cache-accounting.ts

@@ -8,6 +8,19 @@ import { resolvePricingForUsageWithOverrides } from "../../util/pricing.js";
 import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
 import { withCrashRecovery } from "./validate-migration-state.js";
 
+/**
+ * Reverse v20: no-op — cannot reliably identify which llm_usage_events rows
+ * were updated by the backfill vs already had correct cache accounting.
+ *
+ * The forward migration updated input_tokens, output_tokens, cache token
+ * columns, estimated_cost_usd, and pricing_status based on request logs.
+ * There is no marker distinguishing backfilled rows from naturally-written
+ * ones, so a reversal cannot be performed without risking data corruption.
+ */
+export function downBackfillUsageCacheAccounting(_database: DrizzleDb): void {
+  // Lossy — cannot identify which rows were backfilled.
+}
+
 const log = getLogger("memory-db");
 
 const CHECKPOINT_KEY = "migration_backfill_usage_cache_accounting_v1";

package/src/memory/migrations/141-rename-verification-table.ts

@@ -1,6 +1,60 @@
 import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
 import { withCrashRecovery } from "./validate-migration-state.js";
 
+/**
+ * Reverse v21: rename channel_verification_sessions back to
+ * channel_guardian_verification_challenges and recreate old indexes.
+ */
+export function downRenameVerificationTable(database: DrizzleDb): void {
+  const raw = getSqliteFrom(database);
+
+  // Check the new table exists before attempting anything
+  const newTableExists = raw
+    .query(
+      `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'channel_verification_sessions'`,
+    )
+    .get();
+  if (!newTableExists) return;
+
+  // If the old table already exists, skip (already rolled back)
+  const oldTableExists = raw
+    .query(
+      `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'channel_guardian_verification_challenges'`,
+    )
+    .get();
+  if (oldTableExists) return;
+
+  // Rename back to old name
+  raw.exec(
+    /*sql*/ `ALTER TABLE channel_verification_sessions RENAME TO channel_guardian_verification_challenges`,
+  );
+
+  // Drop new-style indexes and recreate old-style ones
+  raw.exec(/*sql*/ `DROP INDEX IF EXISTS idx_verification_sessions_lookup`);
+  raw.exec(/*sql*/ `DROP INDEX IF EXISTS idx_verification_sessions_active`);
+  raw.exec(/*sql*/ `DROP INDEX IF EXISTS idx_verification_sessions_identity`);
+  raw.exec(
+    /*sql*/ `DROP INDEX IF EXISTS idx_verification_sessions_destination`,
+  );
+  raw.exec(/*sql*/ `DROP INDEX IF EXISTS idx_verification_sessions_bootstrap`);
+
+  raw.exec(
+    /*sql*/ `CREATE INDEX IF NOT EXISTS idx_channel_guardian_challenges_lookup ON channel_guardian_verification_challenges(channel, challenge_hash, status)`,
+  );
+  raw.exec(
+    /*sql*/ `CREATE INDEX IF NOT EXISTS idx_guardian_sessions_active ON channel_guardian_verification_challenges(channel, status)`,
+  );
+  raw.exec(
+    /*sql*/ `CREATE INDEX IF NOT EXISTS idx_guardian_sessions_identity ON channel_guardian_verification_challenges(channel, expected_external_user_id, expected_chat_id, status)`,
+  );
+  raw.exec(
+    /*sql*/ `CREATE INDEX IF NOT EXISTS idx_guardian_sessions_destination ON channel_guardian_verification_challenges(channel, destination_address)`,
+  );
+  raw.exec(
+    /*sql*/ `CREATE INDEX IF NOT EXISTS idx_guardian_sessions_bootstrap ON channel_guardian_verification_challenges(channel, bootstrap_token_hash, status)`,
+  );
+}
+
 /**
  * One-shot migration: rename channel_guardian_verification_challenges →
  * channel_verification_sessions, including all indexes that reference the

package/src/memory/migrations/142-rename-verification-session-id-column.ts

@@ -1,6 +1,31 @@
 import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
 import { withCrashRecovery } from "./validate-migration-state.js";
 
+/**
+ * Reverse v22: rename verification_session_id back to
+ * guardian_verification_session_id in call_sessions.
+ */
+export function downRenameVerificationSessionIdColumn(
+  database: DrizzleDb,
+): void {
+  const raw = getSqliteFrom(database);
+
+  const columns = raw.query(`PRAGMA table_info(call_sessions)`).all() as Array<{
+    name: string;
+  }>;
+  const hasNewColumn = columns.some(
+    (c) => c.name === "verification_session_id",
+  );
+  const hasOldColumn = columns.some(
+    (c) => c.name === "guardian_verification_session_id",
+  );
+  if (!hasNewColumn || hasOldColumn) return;
+
+  raw.exec(
+    /*sql*/ `ALTER TABLE call_sessions RENAME COLUMN verification_session_id TO guardian_verification_session_id`,
+  );
+}
+
 /**
  * One-shot migration: rename the guardian_verification_session_id column
  * in call_sessions to verification_session_id, dropping the "guardian_"