@vellumai/assistant 0.9.0 → 0.10.0-staging.2

package/src/memory/migrations/291-contact-channels-renormalize-addresses.ts

@@ -0,0 +1,72 @@
+import { getLogger } from "../../util/logger.js";
+import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
+
+const log = getLogger("migration-291");
+
+/**
+ * Restores original platform-provided casing into address from external_user_id
+ * for channels where the raw platform ID is the canonical identity (Slack,
+ * Telegram, etc.). Phone and WhatsApp channels are excluded because their
+ * canonical form (E.164) may differ from the raw external_user_id.
+ *
+ * Idempotent: rows where address already equals external_user_id are no-ops.
+ */
+export function migrateContactChannelsRenormalizeAddresses(
+  database: DrizzleDb,
+): void {
+  const raw = getSqliteFrom(database);
+
+  // A later migration drops external_user_id; once it has run there is nothing
+  // to renormalize from. This step re-runs on every startup, so skip when the
+  // column is absent rather than referencing it and failing.
+  const cols = raw.prepare("PRAGMA table_info(contact_channels)").all() as {
+    name: string;
+  }[];
+  if (!cols.some((c) => c.name === "external_user_id")) {
+    return;
+  }
+
+  // Remove rows that would block normalization due to cross-column collisions.
+  raw.run(/*sql*/ `
+    DELETE FROM contact_channels
+    WHERE external_user_id IS NULL
+      AND id IN (
+        SELECT blocker.id
+        FROM contact_channels AS blocker
+        INNER JOIN contact_channels AS normalizer
+          ON normalizer.type = blocker.type
+          AND normalizer.external_user_id = blocker.address COLLATE NOCASE
+          AND normalizer.address != normalizer.external_user_id
+          AND normalizer.external_user_id IS NOT NULL
+          AND normalizer.id != blocker.id
+      )
+  `);
+
+  // Non-phone, non-email channels: restore original platform casing from
+  // external_user_id. Phone/WhatsApp are excluded because their canonical
+  // form (E.164 with '+' prefix) may differ from the raw external_user_id.
+  const nonEmailResult = raw.run(/*sql*/ `
+    UPDATE OR IGNORE contact_channels
+    SET address = external_user_id
+    WHERE external_user_id IS NOT NULL
+      AND address != external_user_id
+      AND type NOT IN ('email', 'phone', 'whatsapp')
+  `);
+
+  // Email channels: ensure address is lowercased (canonical per RFC 5321).
+  const emailResult = raw.run(/*sql*/ `
+    UPDATE OR IGNORE contact_channels
+    SET address = LOWER(external_user_id)
+    WHERE type = 'email'
+      AND external_user_id IS NOT NULL
+      AND address != LOWER(external_user_id)
+  `);
+
+  const totalChanges = nonEmailResult.changes + emailResult.changes;
+  if (totalChanges > 0) {
+    log.info(
+      { rowsUpdated: totalChanges },
+      "Re-normalized contact_channels addresses from external_user_id",
+    );
+  }
+}

package/src/memory/migrations/292-schedule-default-no-reuse-conversation.test.ts

@@ -0,0 +1,67 @@
+import { Database } from "bun:sqlite";
+import { describe, expect, test } from "bun:test";
+
+import { drizzle } from "drizzle-orm/bun-sqlite";
+
+import * as schema from "../schema.js";
+import { migrateScheduleDefaultNoReuseConversation } from "./292-schedule-default-no-reuse-conversation.js";
+
+function createTestDb() {
+  const sqlite = new Database(":memory:");
+  // Post-210 shape: reuse_conversation column present (trimmed to the columns
+  // the migration and assertions touch).
+  sqlite.exec(/*sql*/ `
+    CREATE TABLE cron_jobs (
+      id TEXT PRIMARY KEY,
+      name TEXT NOT NULL,
+      message TEXT NOT NULL,
+      next_run_at INTEGER NOT NULL,
+      created_by TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      reuse_conversation INTEGER NOT NULL DEFAULT 0
+    )
+  `);
+  return { sqlite, db: drizzle(sqlite, { schema }) };
+}
+
+function insertJob(sqlite: Database, id: string, reuse: number) {
+  sqlite
+    .query(
+      /*sql*/ `INSERT INTO cron_jobs
+        (id, name, message, next_run_at, created_by, created_at, updated_at, reuse_conversation)
+        VALUES (?, ?, 'msg', 1000, 'agent', 1000, 1000, ?)`,
+    )
+    .run(id, id, reuse);
+}
+
+function reuseValue(sqlite: Database, id: string): number {
+  return (
+    sqlite
+      .query("SELECT reuse_conversation FROM cron_jobs WHERE id = ?")
+      .get(id) as { reuse_conversation: number }
+  ).reuse_conversation;
+}
+
+describe("migration 292: schedules default to no conversation reuse", () => {
+  test("flips existing reuse_conversation=1 rows to 0", () => {
+    const { sqlite, db } = createTestDb();
+    insertJob(sqlite, "reusing", 1);
+    insertJob(sqlite, "already-fresh", 0);
+
+    migrateScheduleDefaultNoReuseConversation(db);
+
+    expect(reuseValue(sqlite, "reusing")).toBe(0);
+    expect(reuseValue(sqlite, "already-fresh")).toBe(0);
+  });
+
+  test("is idempotent — re-run is a no-op", () => {
+    const { sqlite, db } = createTestDb();
+    insertJob(sqlite, "reusing", 1);
+
+    migrateScheduleDefaultNoReuseConversation(db);
+    expect(() => migrateScheduleDefaultNoReuseConversation(db)).not.toThrow();
+
+    expect(reuseValue(sqlite, "reusing")).toBe(0);
+  });
+});

package/src/memory/migrations/292-schedule-default-no-reuse-conversation.ts

@@ -0,0 +1,25 @@
+import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
+
+/**
+ * Disable conversation reuse on all existing schedules.
+ *
+ * Recurring schedules previously defaulted to `reuse_conversation = 1`, so
+ * every fire appended to one long-lived conversation. That unbounded,
+ * self-similar transcript is a drift hazard for weaker models (it primes them
+ * to repeat or extend the prior run) and grows per-fire token cost without
+ * adding correctness — durable cross-run state already lives in workspace files
+ * and memory. Schedules now default to a fresh conversation per fire; this
+ * aligns existing rows with that contract.
+ *
+ * Idempotent: the guarded UPDATE matches nothing once every row is already 0.
+ */
+export function migrateScheduleDefaultNoReuseConversation(
+  database: DrizzleDb,
+): void {
+  const raw = getSqliteFrom(database);
+  raw
+    .query(
+      /*sql*/ `UPDATE cron_jobs SET reuse_conversation = 0 WHERE reuse_conversation != 0`,
+    )
+    .run();
+}

package/src/memory/migrations/293-workflow-journal-leaf-tokens.ts

@@ -0,0 +1,32 @@
+import type { DrizzleDb } from "../db-connection.js";
+import { getSqliteFrom } from "../db-connection.js";
+
+/**
+ * Add nullable `input_tokens` / `output_tokens` columns to `workflow_journal`.
+ *
+ * Persists per-leaf token usage so the journal route can attribute usage to each
+ * leaf. The client then computes run-level token metrics from the per-leaf sum
+ * (a single source of truth), counting each leaf exactly once regardless of
+ * whether its usage arrives via a live `leaf_finished` event or a journal
+ * backfill — which avoids the undercount that arose when a mid-run journal
+ * aggregate counted a leaf the journal could not itself attribute.
+ *
+ * Nullable — legacy rows and non-completed leaves (failures, nested
+ * `workflow`-kind entries) stay NULL and contribute zero to the sum.
+ *
+ * Idempotent — each ALTER is wrapped so a re-run (column already present) is a
+ * no-op.
+ */
+export function migrateWorkflowJournalLeafTokens(database: DrizzleDb): void {
+  const raw = getSqliteFrom(database);
+  try {
+    raw.exec(`ALTER TABLE workflow_journal ADD COLUMN input_tokens INTEGER`);
+  } catch {
+    /* Column already exists */
+  }
+  try {
+    raw.exec(`ALTER TABLE workflow_journal ADD COLUMN output_tokens INTEGER`);
+  } catch {
+    /* Column already exists */
+  }
+}

package/src/memory/migrations/294-drop-external-user-id.ts

@@ -0,0 +1,31 @@
+import { getLogger } from "../../util/logger.js";
+import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
+
+const log = getLogger("migration-294");
+
+/**
+ * Drops the `external_user_id` column and its index from `contact_channels`.
+ *
+ * `address` is the single canonical identity column; `external_user_id` is
+ * redundant. The index `idx_contact_channels_type_ext_user` must be dropped
+ * first — SQLite refuses to drop a column referenced by an index.
+ *
+ * Idempotent: skips if the column has already been dropped.
+ */
+export function migrateDropExternalUserId(database: DrizzleDb): void {
+  const raw = getSqliteFrom(database);
+
+  const cols = raw.prepare("PRAGMA table_info(contact_channels)").all() as {
+    name: string;
+  }[];
+  const hasColumn = cols.some((c) => c.name === "external_user_id");
+
+  if (!hasColumn) {
+    log.info("external_user_id column already absent — skipping");
+    return;
+  }
+
+  raw.run("DROP INDEX IF EXISTS idx_contact_channels_type_ext_user");
+  raw.run("ALTER TABLE contact_channels DROP COLUMN external_user_id");
+  log.info("Dropped external_user_id column from contact_channels");
+}

package/src/memory/migrations/295-drop-approval-prompt-ts-tracker.ts

@@ -0,0 +1,20 @@
+import { getLogger } from "../../util/logger.js";
+import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
+
+const log = getLogger("migration-295");
+
+/**
+ * Drops the `approval_prompt_ts_tracker` table.
+ *
+ * Guardian approval-by-reaction no longer scopes reactions through a bespoke
+ * `(channel, chat, ts)` tracker. The canonical guardian delivery record
+ * (`canonical_guardian_deliveries.destination_message_id`) is now the single
+ * mapping from a delivered approval card to its request, so this table is dead.
+ *
+ * Idempotent: `DROP TABLE IF EXISTS` is a no-op once the table is gone.
+ */
+export function dropApprovalPromptTsTrackerTable(database: DrizzleDb): void {
+  const raw = getSqliteFrom(database);
+  raw.run("DROP TABLE IF EXISTS approval_prompt_ts_tracker");
+  log.info("Dropped approval_prompt_ts_tracker table");
+}

package/src/memory/migrations/296-rewrite-balanced-economy-profile-pins.test.ts

@@ -0,0 +1,110 @@
+import { existsSync, rmSync, writeFileSync } from "node:fs";
+import { Database } from "bun:sqlite";
+import { afterEach, describe, expect, test } from "bun:test";
+
+import { drizzle } from "drizzle-orm/bun-sqlite";
+
+import { getWorkspaceConfigPath } from "../../util/platform.js";
+import * as schema from "../schema.js";
+import { migrateRewriteBalancedEconomyProfilePins } from "./296-rewrite-balanced-economy-profile-pins.js";
+
+function writeWorkspaceConfig(config: Record<string, unknown>): void {
+  writeFileSync(getWorkspaceConfigPath(), JSON.stringify(config));
+}
+
+afterEach(() => {
+  const path = getWorkspaceConfigPath();
+  if (existsSync(path)) rmSync(path);
+});
+
+function createTestDb(withColumns = true) {
+  const sqlite = new Database(":memory:");
+  sqlite.exec(/*sql*/ `
+    CREATE TABLE conversations (
+      id TEXT PRIMARY KEY
+      ${withColumns ? ", inference_profile TEXT" : ""}
+    )
+  `);
+  sqlite.exec(/*sql*/ `
+    CREATE TABLE cron_jobs (
+      id TEXT PRIMARY KEY
+      ${withColumns ? ", inference_profile TEXT" : ""}
+    )
+  `);
+  return { sqlite, db: drizzle(sqlite, { schema }) };
+}
+
+function pin(sqlite: Database, table: string, id: string): string | null {
+  return (
+    sqlite
+      .query(`SELECT inference_profile FROM ${table} WHERE id = ?`)
+      .get(id) as { inference_profile: string | null }
+  ).inference_profile;
+}
+
+describe("migration 296: rewrite balanced-economy profile pins", () => {
+  test("rewrites balanced-economy pins to balanced on conversations and schedules", () => {
+    const { sqlite, db } = createTestDb();
+    sqlite.run(
+      `INSERT INTO conversations (id, inference_profile) VALUES ('c1', 'balanced-economy'), ('c2', 'quality-optimized'), ('c3', NULL)`,
+    );
+    sqlite.run(
+      `INSERT INTO cron_jobs (id, inference_profile) VALUES ('j1', 'balanced-economy'), ('j2', 'balanced')`,
+    );
+
+    migrateRewriteBalancedEconomyProfilePins(db);
+
+    expect(pin(sqlite, "conversations", "c1")).toBe("balanced");
+    // Unrelated pins and NULLs are left untouched.
+    expect(pin(sqlite, "conversations", "c2")).toBe("quality-optimized");
+    expect(pin(sqlite, "conversations", "c3")).toBeNull();
+    expect(pin(sqlite, "cron_jobs", "j1")).toBe("balanced");
+    expect(pin(sqlite, "cron_jobs", "j2")).toBe("balanced");
+  });
+
+  test("is idempotent — re-run is a no-op", () => {
+    const { sqlite, db } = createTestDb();
+    sqlite.run(
+      `INSERT INTO conversations (id, inference_profile) VALUES ('c1', 'balanced-economy')`,
+    );
+
+    migrateRewriteBalancedEconomyProfilePins(db);
+    expect(() => migrateRewriteBalancedEconomyProfilePins(db)).not.toThrow();
+    expect(pin(sqlite, "conversations", "c1")).toBe("balanced");
+  });
+
+  test("skips a table that has no inference_profile column", () => {
+    const { db } = createTestDb(false);
+    expect(() => migrateRewriteBalancedEconomyProfilePins(db)).not.toThrow();
+  });
+
+  test("leaves pins alone when balanced-economy is a user-owned profile", () => {
+    // The workspace migration keeps a user-owned profile of this name, so its
+    // pins still resolve and must not be switched to balanced.
+    writeWorkspaceConfig({
+      llm: { profiles: { "balanced-economy": { source: "user" } } },
+    });
+    const { sqlite, db } = createTestDb();
+    sqlite.run(
+      `INSERT INTO conversations (id, inference_profile) VALUES ('c1', 'balanced-economy')`,
+    );
+
+    migrateRewriteBalancedEconomyProfilePins(db);
+
+    expect(pin(sqlite, "conversations", "c1")).toBe("balanced-economy");
+  });
+
+  test("rewrites pins when balanced-economy is the managed profile in config", () => {
+    writeWorkspaceConfig({
+      llm: { profiles: { "balanced-economy": { source: "managed" } } },
+    });
+    const { sqlite, db } = createTestDb();
+    sqlite.run(
+      `INSERT INTO conversations (id, inference_profile) VALUES ('c1', 'balanced-economy')`,
+    );
+
+    migrateRewriteBalancedEconomyProfilePins(db);
+
+    expect(pin(sqlite, "conversations", "c1")).toBe("balanced");
+  });
+});

package/src/memory/migrations/296-rewrite-balanced-economy-profile-pins.ts

@@ -0,0 +1,68 @@
+import { loadRawConfig } from "../../config/loader.js";
+import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
+
+const OLD_PROFILE = "balanced-economy";
+const NEW_PROFILE = "balanced";
+
+// Active inference-profile pin columns: the per-conversation override and the
+// per-schedule override. Audit/telemetry tables (tool_invocations,
+// llm_usage_events, skill_loaded_events) also carry an `inference_profile`, but
+// those record what actually ran and must keep their historical value.
+const PIN_TABLES = ["conversations", "cron_jobs"] as const;
+
+/**
+ * Rewrite persisted `balanced-economy` inference-profile pins to `balanced`.
+ *
+ * The managed `balanced-economy` profile folds into `balanced` (both resolve to
+ * MiniMax M3 on Fireworks). The workspace-config migration removes the profile
+ * definition, but a profile key can also be pinned outside config.json — on a
+ * conversation (`conversations.inference_profile`) or a schedule
+ * (`cron_jobs.inference_profile`). Left unrewritten those pins dangle, and
+ * `resolveCallSiteConfig` treats an unresolvable override as a silent
+ * fall-through to the active/default profile — dropping the user's intended
+ * MiniMax route. `balanced-economy` is a reserved managed-profile key, so every
+ * persisted pin refers to the now-folded profile.
+ *
+ * Ownership guard: the companion workspace migration keeps a `balanced-economy`
+ * profile the user owns (`source !== "managed"`) intact, so its pins still
+ * resolve and must not be touched. Memory migrations run before workspace
+ * migrations on boot, so the profile is still in config here either way; gate on
+ * its source rather than its presence. A reserved managed key (or no profile at
+ * all) means every pin is stale and safe to rewrite.
+ *
+ * Idempotent: the WHERE clause matches nothing once rewritten. The PRAGMA guard
+ * skips a table an install hasn't created the column on yet.
+ */
+export function migrateRewriteBalancedEconomyProfilePins(
+  database: DrizzleDb,
+): void {
+  if (isUserOwnedEconomyProfile()) return;
+
+  const raw = getSqliteFrom(database);
+
+  for (const table of PIN_TABLES) {
+    const cols = raw.prepare(`PRAGMA table_info(${table})`).all() as {
+      name: string;
+    }[];
+    if (!cols.some((c) => c.name === "inference_profile")) continue;
+
+    raw
+      .prepare(
+        `UPDATE ${table} SET inference_profile = ? WHERE inference_profile = ?`,
+      )
+      .run(NEW_PROFILE, OLD_PROFILE);
+  }
+}
+
+/** True when `balanced-economy` exists in config as a user-owned profile. */
+function isUserOwnedEconomyProfile(): boolean {
+  const llm = asObject(loadRawConfig().llm);
+  const profile = asObject(asObject(llm?.profiles)?.[OLD_PROFILE]);
+  return profile !== null && profile.source !== "managed";
+}
+
+function asObject(value: unknown): Record<string, unknown> | null {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : null;
+}

package/src/memory/migrations/__tests__/131-drop-legacy-member-guardian-tables.test.ts

@@ -0,0 +1,154 @@
+import { Database } from "bun:sqlite";
+import { describe, expect, test } from "bun:test";
+
+import { drizzle } from "drizzle-orm/bun-sqlite";
+
+import { getSqliteFrom } from "../../db-connection.js";
+import * as schema from "../../schema.js";
+import { migrateDropLegacyMemberGuardianTables } from "../131-drop-legacy-member-guardian-tables.js";
+
+function createTestDb() {
+  const sqlite = new Database(":memory:");
+  sqlite.exec("PRAGMA journal_mode=WAL");
+  return drizzle(sqlite, { schema });
+}
+
+function bootstrap(db: ReturnType<typeof createTestDb>): void {
+  const raw = getSqliteFrom(db);
+  raw.exec(/*sql*/ `
+    CREATE TABLE contacts (
+      id TEXT PRIMARY KEY,
+      display_name TEXT NOT NULL,
+      role TEXT NOT NULL DEFAULT 'contact',
+      principal_id TEXT,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    )
+  `);
+  raw.exec(/*sql*/ `
+    CREATE TABLE contact_channels (
+      id TEXT PRIMARY KEY,
+      contact_id TEXT NOT NULL,
+      type TEXT NOT NULL,
+      address TEXT NOT NULL,
+      external_user_id TEXT,
+      external_chat_id TEXT,
+      status TEXT NOT NULL DEFAULT 'unverified',
+      policy TEXT NOT NULL DEFAULT 'allow',
+      invite_id TEXT,
+      revoked_reason TEXT,
+      blocked_reason TEXT,
+      last_seen_at INTEGER,
+      verified_at INTEGER,
+      verified_via TEXT,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER
+    )
+  `);
+  raw.exec(/*sql*/ `
+    CREATE INDEX idx_contact_channels_type_ext_user
+      ON contact_channels(type, external_user_id)
+  `);
+}
+
+function createLegacyTables(raw: Database): void {
+  raw.exec(/*sql*/ `
+    CREATE TABLE channel_guardian_bindings (
+      id TEXT PRIMARY KEY,
+      channel TEXT NOT NULL,
+      status TEXT NOT NULL,
+      guardian_external_user_id TEXT,
+      guardian_principal_id TEXT,
+      guardian_delivery_chat_id TEXT,
+      metadata_json TEXT,
+      verified_at INTEGER,
+      verified_via TEXT,
+      created_at INTEGER NOT NULL
+    )
+  `);
+  raw.exec(/*sql*/ `
+    CREATE TABLE assistant_ingress_members (
+      id TEXT PRIMARY KEY,
+      source_channel TEXT NOT NULL,
+      external_user_id TEXT,
+      external_chat_id TEXT,
+      display_name TEXT,
+      username TEXT,
+      status TEXT NOT NULL,
+      policy TEXT,
+      invite_id TEXT,
+      revoked_reason TEXT,
+      blocked_reason TEXT,
+      last_seen_at INTEGER,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER
+    )
+  `);
+}
+
+function tableExists(raw: Database, name: string): boolean {
+  return !!raw
+    .prepare(`SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?`)
+    .get(name);
+}
+
+function seedLegacyRows(raw: Database): void {
+  raw.run(
+    `INSERT INTO channel_guardian_bindings
+       (id, channel, status, guardian_external_user_id, guardian_principal_id,
+        guardian_delivery_chat_id, metadata_json, verified_at, verified_via, created_at)
+     VALUES ('g1','telegram','active','U-guardian','prin-1','chat-1',NULL,1000,'telegram',1000)`,
+  );
+  raw.run(
+    `INSERT INTO assistant_ingress_members
+       (id, source_channel, external_user_id, external_chat_id, display_name,
+        username, status, policy, invite_id, revoked_reason, blocked_reason,
+        last_seen_at, created_at, updated_at)
+     VALUES ('m1','slack','U-member',NULL,'Member One','member1','active','allow',
+        NULL,NULL,NULL,2000,2000,2000)`,
+  );
+}
+
+describe("migration 131 — drop legacy member/guardian tables", () => {
+  test("syncs stragglers then drops the legacy tables when the column is present", () => {
+    const db = createTestDb();
+    const raw = getSqliteFrom(db);
+    bootstrap(db);
+    createLegacyTables(raw);
+    seedLegacyRows(raw);
+
+    migrateDropLegacyMemberGuardianTables(db);
+
+    // The straggler rows were synced into contact_channels.
+    const synced = raw
+      .prepare(`SELECT external_user_id FROM contact_channels ORDER BY id`)
+      .all() as { external_user_id: string | null }[];
+    expect(synced.map((r) => r.external_user_id).sort()).toEqual([
+      "U-guardian",
+      "U-member",
+    ]);
+
+    // The legacy tables were removed.
+    expect(tableExists(raw, "channel_guardian_bindings")).toBe(false);
+    expect(tableExists(raw, "assistant_ingress_members")).toBe(false);
+  });
+
+  test("drops the legacy tables without throwing when external_user_id is absent (re-run after migration 294)", () => {
+    const db = createTestDb();
+    const raw = getSqliteFrom(db);
+    bootstrap(db);
+    createLegacyTables(raw);
+    seedLegacyRows(raw);
+
+    // Simulate a later startup where migration 294 has already dropped the
+    // index + column. The sync references external_user_id, so 131 must skip it
+    // and still drop the tables rather than failing on every boot.
+    raw.run("DROP INDEX IF EXISTS idx_contact_channels_type_ext_user");
+    raw.run("ALTER TABLE contact_channels DROP COLUMN external_user_id");
+
+    expect(() => migrateDropLegacyMemberGuardianTables(db)).not.toThrow();
+
+    expect(tableExists(raw, "channel_guardian_bindings")).toBe(false);
+    expect(tableExists(raw, "assistant_ingress_members")).toBe(false);
+  });
+});

package/src/memory/migrations/__tests__/289-contact-channels-unique-ext-user.test.ts

@@ -568,4 +568,35 @@ describe("migration 287 — dedup case collisions + drop ext_user indexes", () =
     // Original casing preserved
     expect(channels[0]!.address).toBe("U999");
   });
+
+  test("no-op when external_user_id column is absent (re-run after migration 294)", () => {
+    const db = createTestDb();
+    const raw = getSqliteFrom(db);
+    bootstrap(db);
+
+    insertContact(raw, "c1");
+    insertChannel(raw, {
+      id: "ch1",
+      contactId: "c1",
+      type: "slack",
+      address: "U999",
+      externalUserId: "U999",
+      status: "active",
+      updatedAt: 1000,
+    });
+
+    // Simulate a later startup where migration 294 has already dropped the
+    // index and column. Migration steps re-run on every startup, so this must
+    // tolerate the dropped column rather than throwing "no such column".
+    raw.run("DROP INDEX IF EXISTS idx_contact_channels_type_ext_user");
+    raw.run("ALTER TABLE contact_channels DROP COLUMN external_user_id");
+
+    expect(() => migrateContactChannelsUniqueExtUser(db)).not.toThrow();
+
+    const rows = raw
+      .prepare("SELECT id, address FROM contact_channels")
+      .all() as { id: string; address: string }[];
+    expect(rows).toHaveLength(1);
+    expect(rows[0]!.address).toBe("U999");
+  });
 });