@vellumai/assistant 0.9.1-staging.1 → 0.10.0-staging.2

package/src/memory/conversation-key-store.ts

@@ -135,7 +135,16 @@ export function resolveConversationId(idOrKey: string): string | null {
  */
 export function getOrCreateConversation(
   conversationKey: string,
-  opts?: { conversationType?: "standard" },
+  opts?: {
+    conversationType?: "standard";
+    /**
+     * Caller-supplied title for the conversation, used only when this call
+     * actually creates the row. Treated as a user-set title (`isAutoTitle = 0`)
+     * so the async LLM title generator's safe-overwrite check leaves it
+     * untouched. Ignored when the conversation already exists.
+     */
+    title?: string;
+  },
 ): {
   conversationId: string;
   conversationType: string;
@@ -205,13 +214,19 @@ export function getOrCreateConversation(
 
     const now = Date.now();
     const conversationId = uuid();
-    const title = GENERATING_TITLE;
+    const customTitle = opts?.title?.trim();
+    const title = customTitle || GENERATING_TITLE;
     const memoryScopeId = "default";
 
     tx.insert(conversations)
       .values({
         id: conversationId,
         title,
+        // A caller-supplied title is user-set: mark it non-auto (0) so the
+        // async LLM title generator's `canReplaceTitle` check won't overwrite
+        // it. Without one, omit the column so it takes its default
+        // (AUTO_TITLE_LLM) and follows the auto-generated placeholder flow.
+        ...(customTitle ? { isAutoTitle: 0 } : {}),
         createdAt: now,
         updatedAt: now,
         totalInputTokens: 0,

package/src/memory/conversation-title-service.ts

@@ -166,6 +166,7 @@ export async function generateAndPersistConversationTitle(
     const fallback = deriveFallbackTitle(context) ?? UNTITLED_FALLBACK;
     updateConversationTitle(conversationId, fallback, AUTO_TITLE_DETERMINISTIC);
     publishConversationTitleChanged(conversationId, fallback);
+    logRetryableFallback(params, "no_provider");
     return { title: fallback, updated: true };
   }
 
@@ -206,6 +207,7 @@ export async function generateAndPersistConversationTitle(
   const fallback = deriveFallbackTitle(context) ?? UNTITLED_FALLBACK;
   updateConversationTitle(conversationId, fallback, AUTO_TITLE_DETERMINISTIC);
   publishConversationTitleChanged(conversationId, fallback);
+  logRetryableFallback(params, "empty_output");
   return { title: fallback, updated: true };
 }
 
@@ -230,7 +232,7 @@ export const titleMutex = new Mutex();
 /**
  * Fire-and-forget wrapper for title generation. Failures are logged
  * but do not propagate. On failure, replaces loading placeholder with
- * a stable fallback title so loading state is never permanent.
+ * a retryable fallback title so loading state is never permanent.
  *
  * Calls are serialized via {@link titleMutex} so burst conversation
  * creation does not overwhelm the LLM provider.
@@ -244,16 +246,20 @@ export function queueGenerateConversationTitle(
     })
     .catch((err) => {
       log.warn(
-        { err, conversationId: params.conversationId },
-        "Failed to generate conversation title (non-fatal)",
+        retryableFallbackLogFields(params, "generation_error", err),
+        "Conversation title generation used retryable fallback",
       );
-      // Replace loading placeholder with stable fallback
+      // Replace loading placeholder with a retryable fallback.
       try {
         const conversation = getConversation(params.conversationId);
         if (conversation && conversation.title === GENERATING_TITLE) {
           const fallback =
             deriveFallbackTitle(params.context) ?? UNTITLED_FALLBACK;
-          updateConversationTitle(params.conversationId, fallback);
+          updateConversationTitle(
+            params.conversationId,
+            fallback,
+            AUTO_TITLE_DETERMINISTIC,
+          );
           publishConversationTitleChanged(params.conversationId, fallback);
         }
       } catch {
@@ -268,6 +274,11 @@ export interface RegenerateTitleParams {
   conversationId: string;
   provider?: Provider;
   signal?: AbortSignal;
+  /**
+   * Limit regeneration to placeholder or deterministic titles. Used for retrying
+   * failed initial generation without racing against a successful initial title.
+   */
+  onlyIfReplaceable?: boolean;
 }
 
 /**
@@ -278,12 +289,15 @@ export interface RegenerateTitleParams {
 export async function regenerateConversationTitle(
   params: RegenerateTitleParams,
 ): Promise<{ title: string; updated: boolean }> {
-  const { conversationId, signal } = params;
+  const { conversationId, onlyIfReplaceable, signal } = params;
 
   const conversation = getConversation(conversationId);
   if (!conversation || !conversation.isAutoTitle) {
     return { title: conversation?.title ?? UNTITLED_FALLBACK, updated: false };
   }
+  if (onlyIfReplaceable && !canReplaceTitle(conversation)) {
+    return { title: conversation.title ?? UNTITLED_FALLBACK, updated: false };
+  }
 
   const provider =
     params.provider ?? (await getConfiguredProvider("conversationTitle"));
@@ -317,7 +331,11 @@ export async function regenerateConversationTitle(
   if (title) {
     // Re-check isAutoTitle before persisting (race guard against manual rename)
     const current = getConversation(conversationId);
-    if (!current || !current.isAutoTitle) {
+    if (
+      !current ||
+      !current.isAutoTitle ||
+      (onlyIfReplaceable && !canReplaceTitle(current))
+    ) {
       return { title: current?.title ?? UNTITLED_FALLBACK, updated: false };
     }
 
@@ -408,6 +426,45 @@ function buildTitlePrompt(
   return parts.join("\n");
 }
 
+function titleGenerationLogFields(params: GenerateTitleParams) {
+  return {
+    conversationId: params.conversationId,
+    contextOrigin: params.context?.origin,
+    hasContext: Boolean(params.context),
+    userMessageLength: params.userMessage?.length ?? 0,
+    assistantResponseLength: params.assistantResponse?.length ?? 0,
+  };
+}
+
+type TitleGenerationFallbackReason =
+  | "no_provider"
+  | "empty_output"
+  | "generation_error";
+
+function retryableFallbackLogFields(
+  params: GenerateTitleParams,
+  reason: TitleGenerationFallbackReason,
+  err?: unknown,
+): Record<string, unknown> {
+  const fields: Record<string, unknown> = {
+    ...titleGenerationLogFields(params),
+    reason,
+    fallbackSource: params.context ? "context" : "untitled",
+  };
+  if (err) fields.err = err;
+  return fields;
+}
+
+function logRetryableFallback(
+  params: GenerateTitleParams,
+  reason: TitleGenerationFallbackReason,
+): void {
+  log.warn(
+    retryableFallbackLogFields(params, reason),
+    "Conversation title generation used retryable fallback",
+  );
+}
+
 const META_FAILURE_TITLES = new Set([
   "missing context",
   "no context",

package/src/memory/db-init.ts

@@ -40,6 +40,7 @@ import {
   createSkillLoadedEventsTable,
   createTasksAndWorkItemsTables,
   createWatchersAndLogsTables,
+  dropApprovalPromptTsTrackerTable,
   migrate230AcpSessionHistory,
   migrate231RepairMemoryGraphEventDates,
   migrateA2ATasks,
@@ -102,6 +103,7 @@ import {
   migrateDropConflicts,
   migrateDropContactInteractionColumns,
   migrateDropEntityTables,
+  migrateDropExternalUserId,
   migrateDropLegacyMemberGuardianTables,
   migrateDropLoopbackPortColumn,
   migrateDropMemoryItemsTables,
@@ -195,7 +197,9 @@ import {
   migrateRenameVerificationSessionIdColumn,
   migrateRenameVerificationTable,
   migrateRenameVoiceToPhone,
+  migrateRewriteBalancedEconomyProfilePins,
   migrateScheduleCapabilities,
+  migrateScheduleDefaultNoReuseConversation,
   migrateScheduleDescription,
   migrateScheduleInferenceProfile,
   migrateScheduleOneShotRouting,
@@ -223,6 +227,7 @@ import {
   migrateUsageLlmCallCount,
   migrateVoiceInviteColumns,
   migrateVoiceInviteDisplayMetadata,
+  migrateWorkflowJournalLeafTokens,
   migrateWorkflowRuns,
   migrateWorkflowRunTrust,
   recoverCrashedMigrations,
@@ -521,6 +526,11 @@ export function initializeDb(): void {
     migrateContactChannelsUniqueExtUser,
     migrateScheduleCapabilities,
     migrateContactChannelsRenormalizeAddresses,
+    migrateScheduleDefaultNoReuseConversation,
+    migrateWorkflowJournalLeafTokens,
+    migrateDropExternalUserId,
+    dropApprovalPromptTsTrackerTable,
+    migrateRewriteBalancedEconomyProfilePins,
   ];
 
   // Run each migration step, catching and logging individual failures so one

package/src/memory/embedding-backend.ts

@@ -497,6 +497,20 @@ export async function getMemoryBackendStatus(config: AssistantConfig): Promise<{
   };
 }
 
+/**
+ * Thrown by {@link embedWithBackend} when no embedding backend is configured or
+ * available. This is a PROCESS-WIDE condition (backend selection is effectively
+ * cached for the run), so a caller embedding many items should treat the first
+ * occurrence as fatal to the whole batch rather than a per-item failure — see
+ * `backfillAllSections`, which aborts on it instead of churning through deletes.
+ */
+export class EmbeddingBackendUnavailableError extends Error {
+  constructor(message = "No memory embedding backend configured") {
+    super(message);
+    this.name = "EmbeddingBackendUnavailableError";
+  }
+}
+
 export async function embedWithBackend(
   config: AssistantConfig,
   inputs: EmbeddingInput[],
@@ -514,7 +528,7 @@ export async function embedWithBackend(
 
   const selection = await selectEmbeddingBackend(config);
   if (!selection.backend) {
-    throw new Error(
+    throw new EmbeddingBackendUnavailableError(
       selection.reason ?? "No memory embedding backend configured",
     );
   }

package/src/memory/jobs-worker.ts

@@ -2,6 +2,7 @@ import { join } from "node:path";
 
 import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags.js";
 import { getConfig } from "../config/loader.js";
+import { isMemoryV3Live } from "../config/memory-v3-gate.js";
 import type { AssistantConfig } from "../config/types.js";
 import {
   checkDiskPressureBackgroundGate,
@@ -852,7 +853,7 @@ export function maybeEnqueueGraphMaintenanceJobs(
   // this guard is belt-and-suspenders that also avoids a wasted enqueue.
   if (
     isAssistantFeatureFlagEnabled("memory-v3-shadow", config) ||
-    isAssistantFeatureFlagEnabled("memory-v3-live", config)
+    isMemoryV3Live(config)
   ) {
     schedule.push({
       key: GRAPH_MAINTENANCE_CHECKPOINTS.memoryV3Maintain,

package/src/memory/lifecycle-events-store.ts

@@ -1,7 +1,7 @@
 import { and, asc, eq, gt, or } from "drizzle-orm";
 import { v4 as uuid } from "uuid";
 
-import { getConfig } from "../config/loader.js";
+import { getCachedShareAnalytics } from "../platform/consent-cache.js";
 import { getDb } from "./db-connection.js";
 import { lifecycleEvents } from "./schema.js";
 
@@ -13,7 +13,7 @@ export interface LifecycleEvent {
 
 /** Record a lifecycle event (e.g. app_open, hatch). Returns null when usage data collection is disabled. */
 export function recordLifecycleEvent(eventName: string): LifecycleEvent | null {
-  if (!getConfig().collectUsageData) return null;
+  if (!getCachedShareAnalytics()) return null;
   const db = getDb();
   const event: LifecycleEvent = {
     id: uuid(),

package/src/memory/memory-retrospective-enqueue.ts

@@ -6,6 +6,8 @@
 //   - Source conversation isn't a memory-retrospective conversation itself
 //     (recursion guard — we never run a retrospective over reflective
 //     musings from the retrospective agent's own writes).
+//   - Source isn't a `scheduled` thread or a memory-consolidation background
+//     (low yield — see `isLowYieldRetrospectiveSource`).
 //
 // All four trigger types funnel through `upsertMemoryRetrospectiveJob` which
 // coalesces rapid enqueues into a single pending row per conversation.
@@ -13,14 +15,13 @@
 // after the corresponding signal settles; `interval` and `message_count`
 // fire immediately.
 
-import {
-  isUntrustedTrustClass,
-  type TrustClass,
-} from "../runtime/actor-trust-resolver.js";
+import { type TrustClass } from "../runtime/actor-trust-resolver.js";
+import { resolveCapabilities } from "../runtime/capabilities.js";
 import { getLogger } from "../util/logger.js";
-import { getConversationSource } from "./conversation-crud.js";
+import { getConversation, getConversationSource } from "./conversation-crud.js";
 import { isMemoryEnabled, upsertMemoryRetrospectiveJob } from "./jobs-store.js";
 import { isMemoryRetrospectiveSource } from "./memory-retrospective-constants.js";
+import { MEMORY_V2_CONSOLIDATION_SOURCE } from "./v2/constants.js";
 
 const log = getLogger("memory-retrospective-enqueue");
 
@@ -50,6 +51,14 @@ export function enqueueMemoryRetrospectiveIfEnabled(args: {
     return;
   }
 
+  if (isLowYieldRetrospectiveSource(conversationId)) {
+    log.debug(
+      { conversationId, trigger },
+      "Skipping memory-retrospective enqueue: scheduled or consolidation source",
+    );
+    return;
+  }
+
   const runAfter =
     trigger === "compaction" ? Date.now() + COMPACTION_DEBOUNCE_MS : Date.now();
 
@@ -75,6 +84,22 @@ export function isMemoryRetrospectiveConversation(
   return source !== null && isMemoryRetrospectiveSource(source);
 }
 
+/**
+ * Scheduled task threads (location/health pulses) rarely carry anything worth
+ * remembering, and memory-consolidation conversations already persist their
+ * output to the corpus — a retrospective over either burns an inference pass
+ * for no unique gain (and, for consolidation, re-stores already-captured
+ * content). Heartbeat (`background`) and standard conversations are unaffected.
+ */
+function isLowYieldRetrospectiveSource(conversationId: string): boolean {
+  const conversation = getConversation(conversationId);
+  if (!conversation) return false;
+  return (
+    conversation.conversationType === "scheduled" ||
+    conversation.source === MEMORY_V2_CONSOLIDATION_SOURCE
+  );
+}
+
 /**
  * Fire a memory-retrospective enqueue from the compaction site. Mirrors
  * `enqueueAutoAnalysisOnCompaction` — same trust-class gate (don't run a
@@ -86,7 +111,7 @@ export function enqueueMemoryRetrospectiveOnCompaction(
   conversationId: string,
   trustClass: TrustClass | undefined,
 ): void {
-  if (isUntrustedTrustClass(trustClass)) {
+  if (!resolveCapabilities(trustClass).canAccessMemory) {
     return;
   }
   try {

package/src/memory/memory-retrospective-job.ts

@@ -65,6 +65,7 @@ import {
   getMessagesAfter,
   resolveOverrideProfile,
 } from "./conversation-crud.js";
+import { isBackgroundConversationType } from "./conversation-types.js";
 import {
   enqueueMemoryJob,
   type MemoryJob,
@@ -313,6 +314,14 @@ async function runForkBasedRetrospective(
       // {@link WakeToolContextPin}.
       toolGateMode: "execution" as const,
       toolContextPin,
+      // Reproduce the source's turn block for message-tier cache-prefix
+      // parity: background/scheduled sources ran non-interactive live turns
+      // (which carry `<background_turn>`), so the fork must run non-interactive
+      // too. Standard/user sources ran interactive (no `<background_turn>`), so
+      // the fork stays interactive — preserving their existing byte parity.
+      isNonInteractive: isBackgroundConversationType(
+        sourceConversation.conversationType,
+      ),
       // Profile forcing (model/thinking/effort parity) is a separate concern
       // and stays keyed on `matchConversationProfile` via `matchedProfile`.
       ...(matchedProfile !== undefined

package/src/memory/migrations/129-contact-channels-access-fields.ts

@@ -1,4 +1,4 @@
-import type { DrizzleDb } from "../db-connection.js";
+import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
 
 /**
  * Add verification and access-control columns to contact_channels for
@@ -9,13 +9,20 @@ import type { DrizzleDb } from "../db-connection.js";
  * Uses ALTER TABLE ADD COLUMN with try/catch for idempotency.
  */
 export function migrateContactChannelsAccessFields(database: DrizzleDb): void {
-  // Channel-native user ID (e.g., Telegram numeric ID, E.164 phone) — machine identifier for trust resolution
-  try {
+  // external_user_id: only add on first run. migration 294 drops this column;
+  // if it's absent but other 129-era columns already exist, 294 has run and
+  // we must not re-add it (avoids a table-rewrite cycle on every startup).
+  const raw = getSqliteFrom(database);
+  const cols = raw.prepare("PRAGMA table_info(contact_channels)").all() as {
+    name: string;
+  }[];
+  const colNames = new Set(cols.map((c) => c.name));
+  const needsExternalUserId =
+    !colNames.has("external_user_id") && !colNames.has("status");
+  if (needsExternalUserId) {
     database.run(
       /*sql*/ `ALTER TABLE contact_channels ADD COLUMN external_user_id TEXT`,
     );
-  } catch {
-    /* already exists */
   }
   // Delivery/notification routing address (e.g., Telegram chat ID for DMs)
   try {
@@ -98,8 +105,10 @@ export function migrateContactChannelsAccessFields(database: DrizzleDb): void {
     /* already exists */
   }
 
-  // Composite index for trust resolution lookups by channel type + external user ID
-  database.run(
-    /*sql*/ `CREATE INDEX IF NOT EXISTS idx_contact_channels_type_ext_user ON contact_channels(type, external_user_id)`,
-  );
+  // Only create the index when the column exists (migration 294 drops both).
+  if (needsExternalUserId || colNames.has("external_user_id")) {
+    database.run(
+      /*sql*/ `CREATE INDEX IF NOT EXISTS idx_contact_channels_type_ext_user ON contact_channels(type, external_user_id)`,
+    );
+  }
 }

package/src/memory/migrations/131-drop-legacy-member-guardian-tables.ts

@@ -16,6 +16,18 @@ export function migrateDropLegacyMemberGuardianTables(
 ): void {
   const raw = getSqliteFrom(database);
 
+  // The safety-sync below reads and writes contact_channels.external_user_id.
+  // A later migration drops that column; this step re-runs on every startup,
+  // so once the column is gone the sync cannot run (and is moot —
+  // identities live in `address`). Skip the sync in that case but still
+  // drop the legacy tables, so this step completes instead of failing every
+  // boot. Reaching here with the tables still present means the sync never
+  // succeeded, so nothing synced is lost.
+  const cols = raw.prepare(`PRAGMA table_info(contact_channels)`).all() as {
+    name: string;
+  }[];
+  const hasExternalUserId = cols.some((c) => c.name === "external_user_id");
+
   // ── Safety sync: guardian bindings → contacts ─────────────────────
   const guardianTableExists = raw
     .prepare(
@@ -23,7 +35,7 @@ export function migrateDropLegacyMemberGuardianTables(
     )
     .get();
 
-  if (guardianTableExists) {
+  if (guardianTableExists && hasExternalUserId) {
     // Insert any active guardian bindings not already present in contacts.
     // We match on (type, external_user_id) to avoid duplicating existing rows.
     raw.exec(/*sql*/ `
@@ -77,7 +89,7 @@ export function migrateDropLegacyMemberGuardianTables(
     )
     .get();
 
-  if (membersTableExists) {
+  if (membersTableExists && hasExternalUserId) {
     // Insert non-pending members not already present in contacts.
     raw.exec(/*sql*/ `
       INSERT INTO contacts (id, display_name, created_at, updated_at)

package/src/memory/migrations/289-contact-channels-unique-ext-user.ts

@@ -18,6 +18,16 @@ const log = getLogger("migration-289");
 export function migrateContactChannelsUniqueExtUser(database: DrizzleDb): void {
   const raw = getSqliteFrom(database);
 
+  // A later migration drops external_user_id; once it has run this historical
+  // dedup is obsolete (Steps 2–3 below reference the column). This step re-runs
+  // on every startup, so skip when the column is absent rather than failing.
+  const cols = raw.prepare("PRAGMA table_info(contact_channels)").all() as {
+    name: string;
+  }[];
+  if (!cols.some((c) => c.name === "external_user_id")) {
+    return;
+  }
+
   // Step 1: Deduplicate historical case collisions. After this, the existing
   // case-sensitive UNIQUE(type, address) constraint remains valid because
   // only one row per case-insensitive group survives.

package/src/memory/migrations/291-contact-channels-renormalize-addresses.ts

@@ -16,6 +16,16 @@ export function migrateContactChannelsRenormalizeAddresses(
 ): void {
   const raw = getSqliteFrom(database);
 
+  // A later migration drops external_user_id; once it has run there is nothing
+  // to renormalize from. This step re-runs on every startup, so skip when the
+  // column is absent rather than referencing it and failing.
+  const cols = raw.prepare("PRAGMA table_info(contact_channels)").all() as {
+    name: string;
+  }[];
+  if (!cols.some((c) => c.name === "external_user_id")) {
+    return;
+  }
+
   // Remove rows that would block normalization due to cross-column collisions.
   raw.run(/*sql*/ `
     DELETE FROM contact_channels

package/src/memory/migrations/292-schedule-default-no-reuse-conversation.test.ts

@@ -0,0 +1,67 @@
+import { Database } from "bun:sqlite";
+import { describe, expect, test } from "bun:test";
+
+import { drizzle } from "drizzle-orm/bun-sqlite";
+
+import * as schema from "../schema.js";
+import { migrateScheduleDefaultNoReuseConversation } from "./292-schedule-default-no-reuse-conversation.js";
+
+function createTestDb() {
+  const sqlite = new Database(":memory:");
+  // Post-210 shape: reuse_conversation column present (trimmed to the columns
+  // the migration and assertions touch).
+  sqlite.exec(/*sql*/ `
+    CREATE TABLE cron_jobs (
+      id TEXT PRIMARY KEY,
+      name TEXT NOT NULL,
+      message TEXT NOT NULL,
+      next_run_at INTEGER NOT NULL,
+      created_by TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      reuse_conversation INTEGER NOT NULL DEFAULT 0
+    )
+  `);
+  return { sqlite, db: drizzle(sqlite, { schema }) };
+}
+
+function insertJob(sqlite: Database, id: string, reuse: number) {
+  sqlite
+    .query(
+      /*sql*/ `INSERT INTO cron_jobs
+        (id, name, message, next_run_at, created_by, created_at, updated_at, reuse_conversation)
+        VALUES (?, ?, 'msg', 1000, 'agent', 1000, 1000, ?)`,
+    )
+    .run(id, id, reuse);
+}
+
+function reuseValue(sqlite: Database, id: string): number {
+  return (
+    sqlite
+      .query("SELECT reuse_conversation FROM cron_jobs WHERE id = ?")
+      .get(id) as { reuse_conversation: number }
+  ).reuse_conversation;
+}
+
+describe("migration 292: schedules default to no conversation reuse", () => {
+  test("flips existing reuse_conversation=1 rows to 0", () => {
+    const { sqlite, db } = createTestDb();
+    insertJob(sqlite, "reusing", 1);
+    insertJob(sqlite, "already-fresh", 0);
+
+    migrateScheduleDefaultNoReuseConversation(db);
+
+    expect(reuseValue(sqlite, "reusing")).toBe(0);
+    expect(reuseValue(sqlite, "already-fresh")).toBe(0);
+  });
+
+  test("is idempotent — re-run is a no-op", () => {
+    const { sqlite, db } = createTestDb();
+    insertJob(sqlite, "reusing", 1);
+
+    migrateScheduleDefaultNoReuseConversation(db);
+    expect(() => migrateScheduleDefaultNoReuseConversation(db)).not.toThrow();
+
+    expect(reuseValue(sqlite, "reusing")).toBe(0);
+  });
+});

package/src/memory/migrations/292-schedule-default-no-reuse-conversation.ts

@@ -0,0 +1,25 @@
+import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
+
+/**
+ * Disable conversation reuse on all existing schedules.
+ *
+ * Recurring schedules previously defaulted to `reuse_conversation = 1`, so
+ * every fire appended to one long-lived conversation. That unbounded,
+ * self-similar transcript is a drift hazard for weaker models (it primes them
+ * to repeat or extend the prior run) and grows per-fire token cost without
+ * adding correctness — durable cross-run state already lives in workspace files
+ * and memory. Schedules now default to a fresh conversation per fire; this
+ * aligns existing rows with that contract.
+ *
+ * Idempotent: the guarded UPDATE matches nothing once every row is already 0.
+ */
+export function migrateScheduleDefaultNoReuseConversation(
+  database: DrizzleDb,
+): void {
+  const raw = getSqliteFrom(database);
+  raw
+    .query(
+      /*sql*/ `UPDATE cron_jobs SET reuse_conversation = 0 WHERE reuse_conversation != 0`,
+    )
+    .run();
+}

package/src/memory/migrations/293-workflow-journal-leaf-tokens.ts

@@ -0,0 +1,32 @@
+import type { DrizzleDb } from "../db-connection.js";
+import { getSqliteFrom } from "../db-connection.js";
+
+/**
+ * Add nullable `input_tokens` / `output_tokens` columns to `workflow_journal`.
+ *
+ * Persists per-leaf token usage so the journal route can attribute usage to each
+ * leaf. The client then computes run-level token metrics from the per-leaf sum
+ * (a single source of truth), counting each leaf exactly once regardless of
+ * whether its usage arrives via a live `leaf_finished` event or a journal
+ * backfill — which avoids the undercount that arose when a mid-run journal
+ * aggregate counted a leaf the journal could not itself attribute.
+ *
+ * Nullable — legacy rows and non-completed leaves (failures, nested
+ * `workflow`-kind entries) stay NULL and contribute zero to the sum.
+ *
+ * Idempotent — each ALTER is wrapped so a re-run (column already present) is a
+ * no-op.
+ */
+export function migrateWorkflowJournalLeafTokens(database: DrizzleDb): void {
+  const raw = getSqliteFrom(database);
+  try {
+    raw.exec(`ALTER TABLE workflow_journal ADD COLUMN input_tokens INTEGER`);
+  } catch {
+    /* Column already exists */
+  }
+  try {
+    raw.exec(`ALTER TABLE workflow_journal ADD COLUMN output_tokens INTEGER`);
+  } catch {
+    /* Column already exists */
+  }
+}

package/src/memory/migrations/294-drop-external-user-id.ts

@@ -0,0 +1,31 @@
+import { getLogger } from "../../util/logger.js";
+import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
+
+const log = getLogger("migration-294");
+
+/**
+ * Drops the `external_user_id` column and its index from `contact_channels`.
+ *
+ * `address` is the single canonical identity column; `external_user_id` is
+ * redundant. The index `idx_contact_channels_type_ext_user` must be dropped
+ * first — SQLite refuses to drop a column referenced by an index.
+ *
+ * Idempotent: skips if the column has already been dropped.
+ */
+export function migrateDropExternalUserId(database: DrizzleDb): void {
+  const raw = getSqliteFrom(database);
+
+  const cols = raw.prepare("PRAGMA table_info(contact_channels)").all() as {
+    name: string;
+  }[];
+  const hasColumn = cols.some((c) => c.name === "external_user_id");
+
+  if (!hasColumn) {
+    log.info("external_user_id column already absent — skipping");
+    return;
+  }
+
+  raw.run("DROP INDEX IF EXISTS idx_contact_channels_type_ext_user");
+  raw.run("ALTER TABLE contact_channels DROP COLUMN external_user_id");
+  log.info("Dropped external_user_id column from contact_channels");
+}