@vellumai/assistant 0.8.10 → 0.8.11-staging.1

package/src/memory/compaction-log-writer-clickhouse.ts

@@ -0,0 +1,418 @@
+/**
+ * ClickHouse compaction log writer.
+ *
+ * Consumes the agent loop's compaction start/end event pair
+ * (`context_compacting` / `compaction_completed`, correlated by
+ * `compactionId`) and writes one row per event to the ClickHouse table
+ * configured under `compactionLogs` in workspace config. Disabled unless
+ * `compactionLogs.destination === "clickhouse"` — there is no SQLite
+ * destination.
+ *
+ * The table is event-sourced rather than upserted: a `start` row records
+ * that an attempt began (so attempts that never complete — pipeline throw,
+ * turn abort — are still visible), and an `end` row carries the full
+ * `ContextWindowResult`. Consumers pair rows by `compaction_id`.
+ *
+ * Writes are strictly best-effort: every entry point swallows and logs
+ * failures so a ClickHouse outage can never abort a turn. URL and password
+ * come from the credential store (`clickhouse:url`, `clickhouse:password`),
+ * matching the `llmRequestLogs` mirror convention; database/table/user come
+ * from config. The table is created lazily with `CREATE TABLE IF NOT EXISTS`
+ * on first write so opting in requires no out-of-band DDL.
+ */
+import type { AgentEvent } from "../agent/loop.js";
+import { getConfig } from "../config/loader.js";
+import type { CompactionLogsClickHouseConfig } from "../config/schemas/compaction-logs.js";
+import { credentialKey } from "../security/credential-key.js";
+import { getSecureKeyAsync } from "../security/secure-keys.js";
+import { getLogger } from "../util/logger.js";
+
+const log = getLogger("compaction-log-writer");
+
+export type CompactionStartEvent = Extract<
+  AgentEvent,
+  { type: "context_compacting" }
+>;
+export type CompactionEndEvent = Extract<
+  AgentEvent,
+  { type: "compaction_completed" }
+>;
+
+/** Cap stored summary text so a pathological summary can't bloat rows. */
+const SUMMARY_TEXT_MAX_CHARS = 4000;
+
+/**
+ * Wire row written as one JSONEachRow line. Sentinels follow the
+ * llm_request_logs mirror convention: ClickHouse columns are non-Nullable,
+ * so `''` means "not set" for strings and `-1` means "unknown" for counts
+ * that only exist on one phase of the pair.
+ */
+interface CompactionLogRow {
+  assistant_id: string;
+  conversation_id: string;
+  compaction_id: string;
+  request_id: string;
+  phase: "start" | "end";
+  trigger: string;
+  started_at: number;
+  finished_at: number;
+  duration_ms: number;
+  pre_message_count: number;
+  basis_message_count: number;
+  compacted: number;
+  previous_estimated_input_tokens: number;
+  estimated_input_tokens: number;
+  max_input_tokens: number;
+  threshold_tokens: number;
+  compacted_messages: number;
+  compacted_persisted_messages: number;
+  preserved_tail_messages: number;
+  summary_calls: number;
+  summary_input_tokens: number;
+  summary_output_tokens: number;
+  summary_model: string;
+  summary_failed: number;
+  reason: string;
+  exhausted: number;
+  injection_mode: string;
+  auto_compress_applied: number;
+  summary_text: string;
+}
+
+async function readCredentialOrNull(
+  service: string,
+  field: string,
+): Promise<string | null> {
+  const value = await getSecureKeyAsync(credentialKey(service, field));
+  return value ?? null;
+}
+
+/** Injectable fetch override for tests. Defaults to globalThis.fetch. */
+export type CompactionLogFetch = typeof fetch;
+
+export interface ClickHouseCompactionLogWriterDeps {
+  /** Override the credential read for `clickhouse:url`. */
+  resolveUrl?: () => Promise<string | null>;
+  /** Override the credential read for `clickhouse:password`. */
+  resolvePassword?: () => Promise<string | null>;
+  /** Override the credential read for `vellum:platform_assistant_id`. */
+  resolveAssistantId?: () => Promise<string | null>;
+  /** Override fetch for testing. */
+  fetchImpl?: CompactionLogFetch;
+}
+
+export class ClickHouseCompactionLogWriter {
+  private cachedUrl: string | null = null;
+  private cachedPassword: string | null = null;
+  private cachedAssistantId: string | null = null;
+  private ensureTablePromise: Promise<void> | null = null;
+
+  private readonly resolveUrl: () => Promise<string | null>;
+  private readonly resolvePassword: () => Promise<string | null>;
+  private readonly resolveAssistantId: () => Promise<string | null>;
+  private readonly fetchImpl: CompactionLogFetch;
+
+  constructor(
+    private readonly config: CompactionLogsClickHouseConfig,
+    deps: ClickHouseCompactionLogWriterDeps = {},
+  ) {
+    this.resolveUrl =
+      deps.resolveUrl ?? (() => readCredentialOrNull("clickhouse", "url"));
+    this.resolvePassword =
+      deps.resolvePassword ??
+      (() => readCredentialOrNull("clickhouse", "password"));
+    this.resolveAssistantId =
+      deps.resolveAssistantId ??
+      (() => readCredentialOrNull("vellum", "platform_assistant_id"));
+    this.fetchImpl = deps.fetchImpl ?? globalThis.fetch.bind(globalThis);
+  }
+
+  async writeStart(
+    conversationId: string,
+    event: CompactionStartEvent,
+  ): Promise<void> {
+    await this.insert({
+      ...emptyRow(await this.assistantId(), conversationId, event),
+      phase: "start",
+      pre_message_count: event.messages.length,
+    });
+  }
+
+  async writeEnd(
+    conversationId: string,
+    event: CompactionEndEvent,
+  ): Promise<void> {
+    const r = event.result;
+    await this.insert({
+      ...emptyRow(await this.assistantId(), conversationId, event),
+      phase: "end",
+      finished_at: event.finishedAt,
+      duration_ms: event.finishedAt - event.startedAt,
+      basis_message_count: event.messages.length,
+      compacted: r.compacted ? 1 : 0,
+      previous_estimated_input_tokens: r.previousEstimatedInputTokens,
+      estimated_input_tokens: r.estimatedInputTokens,
+      max_input_tokens: r.maxInputTokens,
+      threshold_tokens: r.thresholdTokens,
+      compacted_messages: r.compactedMessages,
+      compacted_persisted_messages: r.compactedPersistedMessages,
+      preserved_tail_messages: r.preservedTailMessages ?? -1,
+      summary_calls: r.summaryCalls,
+      summary_input_tokens: r.summaryInputTokens,
+      summary_output_tokens: r.summaryOutputTokens,
+      summary_model: r.summaryModel,
+      summary_failed:
+        r.summaryFailed === undefined ? -1 : r.summaryFailed ? 1 : 0,
+      reason: r.reason ?? "",
+      exhausted: r.exhausted ? 1 : 0,
+      injection_mode: r.injectionMode ?? "",
+      auto_compress_applied: r.autoCompressApplied ? 1 : 0,
+      summary_text: r.summaryText.slice(0, SUMMARY_TEXT_MAX_CHARS),
+    });
+  }
+
+  private async insert(row: CompactionLogRow): Promise<void> {
+    await this.ensureTable();
+    await this.exec(
+      `INSERT INTO ${this.tableRef()} FORMAT JSONEachRow`,
+      JSON.stringify(row),
+    );
+  }
+
+  /**
+   * Create the table on first write so opting in is self-serve. Idempotent
+   * (`IF NOT EXISTS`) and memoized per writer instance; a rejected attempt
+   * clears the memo so the next write retries.
+   */
+  private ensureTable(): Promise<void> {
+    if (!this.ensureTablePromise) {
+      this.ensureTablePromise = this.exec(
+        `CREATE TABLE IF NOT EXISTS ${this.tableRef()} (
+          assistant_id String,
+          conversation_id String,
+          compaction_id String,
+          request_id String,
+          phase String,
+          trigger String,
+          started_at DateTime64(3),
+          finished_at DateTime64(3),
+          duration_ms Int64,
+          pre_message_count Int64,
+          basis_message_count Int64,
+          compacted UInt8,
+          previous_estimated_input_tokens Int64,
+          estimated_input_tokens Int64,
+          max_input_tokens Int64,
+          threshold_tokens Int64,
+          compacted_messages Int64,
+          compacted_persisted_messages Int64,
+          preserved_tail_messages Int64,
+          summary_calls Int64,
+          summary_input_tokens Int64,
+          summary_output_tokens Int64,
+          summary_model String,
+          summary_failed Int8,
+          reason String,
+          exhausted UInt8,
+          injection_mode String,
+          auto_compress_applied UInt8,
+          summary_text String,
+          created_at DateTime64(3) DEFAULT now64(3)
+        ) ENGINE = MergeTree
+        ORDER BY (assistant_id, conversation_id, started_at, compaction_id)`,
+      ).catch((err: unknown) => {
+        this.ensureTablePromise = null;
+        throw err;
+      });
+    }
+    return this.ensureTablePromise;
+  }
+
+  private tableRef(): string {
+    // Database is set via the `database=` URL param in `exec`, so only the
+    // table identifier needs quoting. Backtick-quote to tolerate
+    // non-default names with special characters.
+    return `\`${this.config.table.replace(/`/g, "``")}\``;
+  }
+
+  private async exec(sql: string, body?: string): Promise<void> {
+    const baseUrl = await this.url();
+    const password = await this.password();
+
+    let target: URL;
+    try {
+      target = new URL(baseUrl);
+    } catch (err) {
+      throw new Error(
+        `clickhouse:url is not a valid URL: ${err instanceof Error ? err.message : String(err)}`,
+      );
+    }
+    target.searchParams.set("database", this.config.database);
+    // For INSERTs the statement goes in the `query` param and the row data
+    // in the body; DDL ships as the body itself.
+    // Integer timestamps land correctly in DateTime64(3) columns: ClickHouse
+    // treats integers inserted into DateTime64 as appropriately scaled Unix
+    // timestamps, so epoch-millis map 1:1 at scale 3.
+    if (body !== undefined) {
+      target.searchParams.set("query", sql);
+    }
+
+    const auth =
+      "Basic " +
+      Buffer.from(`${this.config.user}:${password}`, "utf8").toString("base64");
+
+    const res = await this.fetchImpl(target.toString(), {
+      method: "POST",
+      headers: { Authorization: auth, "Content-Type": "text/plain" },
+      body: body ?? sql,
+    });
+
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      throw new Error(
+        `ClickHouse compaction-log write failed (HTTP ${res.status}): ${text.slice(0, 500)}`,
+      );
+    }
+    // Drain the body so the connection can be reused.
+    await res.text().catch(() => "");
+  }
+
+  private async assistantId(): Promise<string> {
+    if (this.cachedAssistantId) return this.cachedAssistantId;
+    const val = await this.resolveAssistantId();
+    if (!val) {
+      throw new Error(
+        "vellum:platform_assistant_id credential is required when compactionLogs.destination=clickhouse",
+      );
+    }
+    this.cachedAssistantId = val;
+    return val;
+  }
+
+  private async url(): Promise<string> {
+    if (this.cachedUrl) return this.cachedUrl;
+    const val = await this.resolveUrl();
+    if (!val) {
+      throw new Error(
+        "clickhouse:url credential is required when compactionLogs.destination=clickhouse",
+      );
+    }
+    this.cachedUrl = val;
+    return val;
+  }
+
+  private async password(): Promise<string> {
+    if (this.cachedPassword) return this.cachedPassword;
+    const val = await this.resolvePassword();
+    if (!val) {
+      throw new Error(
+        "clickhouse:password credential is required when compactionLogs.destination=clickhouse",
+      );
+    }
+    this.cachedPassword = val;
+    return val;
+  }
+}
+
+/** Shared row scaffold with phase-dependent fields at their sentinels. */
+function emptyRow(
+  assistantId: string,
+  conversationId: string,
+  event: CompactionStartEvent | CompactionEndEvent,
+): CompactionLogRow {
+  return {
+    assistant_id: assistantId,
+    conversation_id: conversationId,
+    compaction_id: event.compactionId,
+    request_id: event.requestId,
+    phase: "start",
+    trigger: event.trigger,
+    started_at: event.startedAt,
+    finished_at: 0,
+    duration_ms: -1,
+    pre_message_count: -1,
+    basis_message_count: -1,
+    compacted: 0,
+    previous_estimated_input_tokens: -1,
+    estimated_input_tokens: -1,
+    max_input_tokens: -1,
+    threshold_tokens: -1,
+    compacted_messages: -1,
+    compacted_persisted_messages: -1,
+    preserved_tail_messages: -1,
+    summary_calls: -1,
+    summary_input_tokens: -1,
+    summary_output_tokens: -1,
+    summary_model: "",
+    summary_failed: -1,
+    reason: "",
+    exhausted: 0,
+    injection_mode: "",
+    auto_compress_applied: 0,
+    summary_text: "",
+  };
+}
+
+/**
+ * Writer cache keyed by the serialized connection config so config edits
+ * take effect on the next event without restarting, while steady-state
+ * writes reuse one instance (and its cached credentials / ensured table).
+ */
+let cachedWriter: {
+  key: string;
+  writer: ClickHouseCompactionLogWriter;
+} | null = null;
+
+function getWriter(): ClickHouseCompactionLogWriter | null {
+  const cfg = getConfig().compactionLogs;
+  if (!cfg || cfg.destination !== "clickhouse") return null;
+  const key = JSON.stringify(cfg.clickhouse);
+  if (!cachedWriter || cachedWriter.key !== key) {
+    cachedWriter = {
+      key,
+      writer: new ClickHouseCompactionLogWriter(cfg.clickhouse),
+    };
+  }
+  return cachedWriter.writer;
+}
+
+/** Test hook: drop the memoized writer so config/dep changes are picked up. */
+export function resetCompactionLogWriterForTests(): void {
+  cachedWriter = null;
+}
+
+/**
+ * Record a compaction start event. Fire-and-forget: resolves immediately
+ * when logging is disabled and never throws.
+ */
+export function recordCompactionStartBestEffort(
+  conversationId: string,
+  event: CompactionStartEvent,
+): void {
+  const writer = getWriter();
+  if (!writer) return;
+  writer.writeStart(conversationId, event).catch((err: unknown) => {
+    log.warn(
+      { err, conversationId, compactionId: event.compactionId },
+      "Failed to write compaction start log (non-fatal)",
+    );
+  });
+}
+
+/**
+ * Record a compaction end event. Fire-and-forget: resolves immediately
+ * when logging is disabled and never throws.
+ */
+export function recordCompactionEndBestEffort(
+  conversationId: string,
+  event: CompactionEndEvent,
+): void {
+  const writer = getWriter();
+  if (!writer) return;
+  writer.writeEnd(conversationId, event).catch((err: unknown) => {
+    log.warn(
+      { err, conversationId, compactionId: event.compactionId },
+      "Failed to write compaction end log (non-fatal)",
+    );
+  });
+}

package/src/memory/conversation-crud.ts

@@ -28,6 +28,11 @@ import { findDisplayTurnEndIndex } from "../conversations/message-consolidation.
 import { conversationMetadataSyncTag } from "../daemon/message-types/sync.js";
 import type { TrustContext } from "../daemon/trust-context.js";
 import { clearAllConversationIds } from "../home/feed-writer.js";
+import {
+  forkEverInjected,
+  MEMORY_V3_INJECTED_BLOCK_METADATA_KEY,
+  seedEverInjectedFromSlugs,
+} from "../plugins/defaults/memory-v3-shadow/ever-injected-store.js";
 import { publishSyncInvalidation } from "../runtime/sync/sync-publisher.js";
 import { UserError } from "../util/errors.js";
 import { safeParseRecord } from "../util/json.js";
@@ -67,10 +72,15 @@ import {
   memorySummaries,
   messageAttachments,
   messages,
+  skillLoadedEvents,
   toolInvocations,
 } from "./schema.js";
 import { cancelPendingJobsForConversation } from "./task-memory-cleanup.js";
-import { forkActivationState } from "./v2/activation-store.js";
+import {
+  forkActivationState,
+  seedForkActivationState,
+} from "./v2/activation-store.js";
+import { extractInjectedConceptSlugs } from "./v2/injected-block-slugs.js";
 
 const log = getLogger("conversation-store");
 
@@ -129,6 +139,9 @@ export const messageMetadataSchema = z
     /** Image source paths from desktop attachments, keyed by filename. */
     imageSourcePaths: z.record(z.string(), z.string()).optional(),
     memoryInjectedBlock: z.string().optional(),
+    /** Memory-v3 frozen net-new card block (unwrapped) — the v3 counterpart
+     *  of `memoryInjectedBlock`. A row carries at most one of the two. */
+    [MEMORY_V3_INJECTED_BLOCK_METADATA_KEY]: z.string().optional(),
     turnContextBlock: z.string().optional(),
     pkbSystemReminderBlock: z.string().optional(),
     workspaceBlock: z.string().optional(),
@@ -166,6 +179,30 @@ function cloneForkMessageMetadata(
   return JSON.stringify({ forkSourceMessageId: sourceMessageId });
 }
 
+/**
+ * Read a persisted memory-injection block off a message's metadata JSON, or
+ * `null` when absent/malformed. `key` selects the injection layer: v2's
+ * `memoryInjectedBlock` or memory-v3's card block
+ * (`MEMORY_V3_INJECTED_BLOCK_METADATA_KEY`). The block is what the request
+ * builder re-attaches as the message's `<memory>` content each turn.
+ */
+function readInjectedBlock(
+  metadata: string | null,
+  key: string,
+): string | null {
+  if (!metadata) return null;
+  try {
+    const parsed: unknown = JSON.parse(metadata);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      const block = (parsed as Record<string, unknown>)[key];
+      if (typeof block === "string") return block;
+    }
+  } catch {
+    // Malformed metadata — treat as no block.
+  }
+  return null;
+}
+
 /**
  * Extract provenance metadata fields from a TrustContext.
  * When no guardian context is provided, defaults to 'unknown' because the
@@ -227,6 +264,7 @@ export interface ConversationRow {
   scheduleJobId: string | null;
   lastMessageAt: number | null;
   archivedAt: number | null;
+  surfacedAt: number | null;
   inferenceProfile: string | null;
   inferenceProfileSessionId: string | null;
   inferenceProfileExpiresAt: number | null;
@@ -261,6 +299,7 @@ export const parseConversation = createRowMapper<
   scheduleJobId: "scheduleJobId",
   lastMessageAt: "lastMessageAt",
   archivedAt: "archivedAt",
+  surfacedAt: "surfacedAt",
   inferenceProfile: "inferenceProfile",
   inferenceProfileSessionId: "inferenceProfileSessionId",
   inferenceProfileExpiresAt: "inferenceProfileExpiresAt",
@@ -1033,7 +1072,52 @@ export function forkConversation(params: {
     const isFullHistoryFork = copyBoundaryIndex === sourceMessages.length - 1;
     if (isFullHistoryFork) {
       forkActivationState(db, sourceConversation.id, fc.id);
+      forkEverInjected(db, sourceConversation.id, fc.id);
       forkGraphMemoryState(sourceConversation.id, fc.id);
+    } else {
+      // Truncated fork: the wholesale copy above would over-claim, but
+      // seeding nothing makes the child re-select and re-attach every page
+      // whose `<memory>` attachment it already inherited (observed in
+      // production: 89 duplicate page injections on one fork). Derive
+      // `everInjected` from the inherited attachments themselves — scoped to
+      // the child's visible window, since attachments behind an inherited
+      // compaction boundary are not rendered and must stay re-injectable.
+      // The v2 and v3 layers persist under separate metadata keys with the
+      // same `# memory/concepts/<slug>.md` header convention, so each seeds
+      // its own dedup record from its own blocks.
+      const visibleStartIndex = preserveSourceCompactionState
+        ? visibleWindowStartIndex
+        : 0;
+      const inheritedSlugs = new Set<string>();
+      const inheritedV3Slugs = new Set<string>();
+      for (const message of messagesToCopy.slice(visibleStartIndex)) {
+        const block = readInjectedBlock(
+          message.metadata,
+          "memoryInjectedBlock",
+        );
+        if (block) {
+          for (const slug of extractInjectedConceptSlugs(block)) {
+            inheritedSlugs.add(slug);
+          }
+        }
+        const v3Block = readInjectedBlock(
+          message.metadata,
+          MEMORY_V3_INJECTED_BLOCK_METADATA_KEY,
+        );
+        if (v3Block) {
+          for (const slug of extractInjectedConceptSlugs(v3Block)) {
+            inheritedV3Slugs.add(slug);
+          }
+        }
+      }
+      seedForkActivationState(db, fc.id, [...inheritedSlugs]);
+      seedEverInjectedFromSlugs(
+        db,
+        sourceConversation.id,
+        fc.id,
+        [...inheritedV3Slugs],
+        Date.now(),
+      );
     }
     forkRetrospectiveState({
       database: db,
@@ -1104,6 +1188,9 @@ export function deleteConversation(id: string): DeletedMemoryIds {
       tx.delete(toolInvocations)
         .where(eq(toolInvocations.conversationId, id))
         .run();
+      tx.delete(skillLoadedEvents)
+        .where(eq(skillLoadedEvents.conversationId, id))
+        .run();
       // Cascade deletes memory_segments, message_attachments.
       tx.delete(messages).where(eq(messages.conversationId, id)).run();
 
@@ -1126,6 +1213,9 @@ export function deleteConversation(id: string): DeletedMemoryIds {
       tx.delete(toolInvocations)
         .where(eq(toolInvocations.conversationId, id))
         .run();
+      tx.delete(skillLoadedEvents)
+        .where(eq(skillLoadedEvents.conversationId, id))
+        .run();
     }
 
     tx.delete(conversations).where(eq(conversations.id, id)).run();
@@ -1183,7 +1273,7 @@ export function wipeConversation(id: string): WipeConversationResult {
 
   // Step D — Delegate to deleteConversation which handles messages (cascade
   // segments, attachments), llmRequestLogs, toolInvocations,
-  // embeddings, and the conversation row.
+  // skillLoadedEvents, embeddings, and the conversation row.
   const deletedMemoryIds = deleteConversation(id);
 
   // Step E — Return the combined result.
@@ -1771,6 +1861,36 @@ export function unarchiveConversation(id: string): boolean {
   return true;
 }
 
+/**
+ * Set or clear the `surfaced_at` promotion marker for a conversation.
+ *
+ * A non-null `surfaced_at` promotes a background/scheduled conversation
+ * into the default ("standard") conversation listing so clients show it in
+ * the Recents sidebar grouping. Promotion is always explicit — callers are
+ * product flows that decide a background run deserves foreground visibility
+ * (e.g. the user sent a follow-up message in it). Nothing sets this
+ * automatically.
+ *
+ * Returns `null` when the conversation does not exist; otherwise the new
+ * `surfacedAt` value (`number` when surfacing, `null` when clearing).
+ */
+export function setConversationSurfaced(
+  id: string,
+  surfaced: boolean,
+): { surfacedAt: number | null } | null {
+  const conv = getConversation(id);
+  if (!conv) return null;
+  const now = Date.now();
+  const surfacedAt = surfaced ? now : null;
+  rawRun(
+    "UPDATE conversations SET surfaced_at = ?, updated_at = ? WHERE id = ?",
+    surfacedAt,
+    now,
+    id,
+  );
+  return { surfacedAt };
+}
+
 /**
  * Set or clear the inference profile override for a conversation.
  * Pass `null` to clear the override and fall back to the workspace
@@ -2024,6 +2144,7 @@ export async function clearAll(): Promise<{
   await runOrThrow("DELETE FROM message_attachments");
   await runOrThrow("DELETE FROM attachments");
   await runOrThrow("DELETE FROM tool_invocations");
+  await runOrThrow("DELETE FROM skill_loaded_events");
   let messagesFtsCorrupted = false;
   const ftsResult = await runAsyncSqlite("DELETE FROM messages_fts");
   if (!ftsResult.ok) {
@@ -2492,8 +2613,18 @@ export function batchSetDisplayOrders(
         ) {
           safeGroupId = "system:all";
         }
+        // Moving a conversation into the Scheduled/Background system groups
+        // is an explicit demotion out of Recents, so clear any `surfaced_at`
+        // promotion in the same write — otherwise the surfaced marker would
+        // keep the row in the standard listing and the move would appear to
+        // do nothing.
+        const clearsSurfaced =
+          safeGroupId === "system:background" ||
+          safeGroupId === "system:scheduled";
         rawRun(
-          "UPDATE conversations SET display_order = ?, is_pinned = ?, group_id = ? WHERE id = ?",
+          `UPDATE conversations SET display_order = ?, is_pinned = ?, group_id = ?${
+            clearsSurfaced ? ", surfaced_at = NULL" : ""
+          } WHERE id = ?`,
           update.displayOrder,
           safeGroupId === "system:pinned" ? 1 : 0,
           safeGroupId,