eklavya 1.18.2 → 1.19.0

package/dist/memory/tokens.js

@@ -0,0 +1,55 @@
+/**
+ * Token accounting for the savings ledger (PRD MET-01).
+ *
+ * The contract is not "be exact" — it is "be the same method on both sides of
+ * the subtraction, and say which method it was". A receipt stores `method`, and
+ * a percentage is only computed from two counts that share it. That is what
+ * stops the classic dishonest number: a generous estimate of what was avoided
+ * against a tight count of what was sent.
+ */
+/** Identity of the estimator, stored on every receipt. */
+export const ESTIMATOR = 'chars4-v1';
+/**
+ * Four characters per token, the usual English-code approximation. It is an
+ * estimate and every surface that shows a number derived from it says so.
+ */
+export function estimateTokens(text) {
+    if (!text)
+        return 0;
+    return Math.ceil(text.length / 4);
+}
+export function estimateTokensOf(parts) {
+    return estimateTokens(parts.filter(Boolean).join('\n'));
+}
+/**
+ * The one place the percentage is computed. Every caller — banner, dashboard,
+ * CLI — goes through it, so they cannot drift into three different arithmetics.
+ *
+ * Negative saving is reported as overhead rather than clamped to zero: reuse
+ * that costs more than it saves is a real outcome and hiding it is how a
+ * measurement becomes marketing.
+ */
+export function savingsFrom(input) {
+    const { baseTokens: base, deliveredTokens: delivered, delivery } = input;
+    if (base <= 0 && delivered <= 0)
+        return { kind: 'none' };
+    if (delivery !== 'confirmed' || base <= 0)
+        return { kind: 'unavailable' };
+    if (delivered > base)
+        return { kind: 'overhead', tokens: delivered - base, base, delivered };
+    return { kind: 'saving', percent: Math.round((100 * (base - delivered)) / base), base, delivered };
+}
+/** The banner line for a savings result (UX-01 wording). */
+export function savingsLine(s) {
+    switch (s.kind) {
+        case 'none':
+            return 'Your savings: — no context reused yet';
+        case 'unavailable':
+            return 'Your savings: — unavailable';
+        case 'overhead':
+            return `Reuse overhead: ${s.tokens} tokens (estimated)`;
+        case 'saving':
+            return `Your savings: ${s.percent}% less context from reuse (estimated)`;
+    }
+}
+//# sourceMappingURL=tokens.js.map

package/dist/memory/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/memory/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,0DAA0D;AAC1D,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AAErC;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAA+B;IAC5D,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC;IACpB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAoC;IACnE,OAAO,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC;AAcD;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,KAAmB;IAC7C,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACzE,IAAI,IAAI,IAAI,CAAC,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACzD,IAAI,QAAQ,KAAK,WAAW,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAC1E,IAAI,SAAS,GAAG,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7F,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACrG,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,WAAW,CAAC,CAAU;IACpC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,uCAAuC,CAAC;QACjD,KAAK,aAAa;YAChB,OAAO,6BAA6B,CAAC;QACvC,KAAK,UAAU;YACb,OAAO,mBAAmB,CAAC,CAAC,MAAM,qBAAqB,CAAC;QAC1D,KAAK,QAAQ;YACX,OAAO,iBAAiB,CAAC,CAAC,OAAO,uCAAuC,CAAC;IAC7E,CAAC;AACH,CAAC"}

package/dist/memory/worker.js

@@ -0,0 +1,207 @@
+import crypto from 'node:crypto';
+import { nowIso } from '../time.js';
+import { ProviderError, ProviderSummarizer } from './provider.js';
+import { LocalSummarizer, summarizeSession } from './summarize.js';
+import { addCandidate, batchById, batchEvents, batchSession, claimJob, failJob, finishJob, insertEntry, replaceEntry, timeline, } from './store.js';
+/**
+ * The job worker (ADR-05).
+ *
+ * There is no daemon. Hooks and the CLI call `processPending` at the seams
+ * where work naturally arrives, under a lease that makes concurrent callers
+ * safe. The failure this avoids is the reference's worst class: an orphaned
+ * background process holding a port, restarted by self-healing after the
+ * developer uninstalled it.
+ *
+ * `processPending` is bounded by `maxJobs` and never throws: a memory failure
+ * must not take a coding session with it.
+ */
+export function summarizerFor(config) {
+    return config.providers.observer ? new ProviderSummarizer(config.providers.observer) : new LocalSummarizer();
+}
+/**
+ * What governed one summarisation run (PRD MEM-01: "a versioned input batch and
+ * prompt/config identity").
+ *
+ * `generator` on an entry names the summariser, but only after the fact and
+ * only for a batch that produced something — a batch that came out wrong, or
+ * empty, leaves no row to ask. Recorded on the batch, it is what makes "re-run
+ * this batch against the prompt that produced it" an answerable question.
+ *
+ * The digest covers the three settings that change what a summary comes out as:
+ * what capture accepted, what redaction removed from it, and which model read
+ * it. `ProviderConfig` names an environment variable rather than carrying a key
+ * (SEC-01), so nothing secret is hashed.
+ *
+ * ponytail: the provider's system prompt is versioned by `provider.ts` alone —
+ * `summarizer.id` carries the model, not the prompt. Fold a prompt version into
+ * `ProviderSummarizer.id` once that prompt starts changing between releases.
+ */
+function configDigest(config) {
+    return crypto
+        .createHash('sha256')
+        .update(JSON.stringify([config.memory, config.privacy, config.providers.observer]))
+        .digest('hex')
+        .slice(0, 12);
+}
+/**
+ * The roll-up's own generator id, versioned like any other summariser, so an
+ * entry always says which code wrote it.
+ */
+const SESSION_SUMMARY_GENERATOR = 'session-rollup-v1';
+/**
+ * Writes — or refreshes — this session's summary. Returns its entry id, or null
+ * when the session has nothing worth summarising.
+ *
+ * Called at the session seam, which fires at the end of every turn rather than
+ * once at the end of a session, so the row is rewritten in place as the session
+ * grows instead of one summary being written per turn.
+ *
+ * ponytail: with `providers.observer` set, the seam only *queues* the batch, so
+ * the last turn's observations land after this ran and the summary trails them
+ * by one turn until the next seam. Move the call after `processPending` if the
+ * provider path ever stops being asynchronous.
+ */
+export function writeSessionSummary(db, project, sessionId) {
+    // Bounded: the oldest observations of a day-long session are not where it
+    // left off, and an unbounded roll-up is an unbounded row in every recall.
+    const observations = timeline(db, { project, sessionId, kind: 'observation', limit: 24 });
+    const draft = summarizeSession(observations);
+    if (!draft)
+        return null;
+    const fields = {
+        project,
+        sessionId,
+        kind: 'session_summary',
+        type: draft.type,
+        title: draft.title,
+        narrative: draft.narrative,
+        facts: draft.facts,
+        files: draft.files,
+        tags: draft.tags,
+        generator: SESSION_SUMMARY_GENERATOR,
+        confidence: draft.confidence,
+        // The newest observation's time, so the summary sorts above the work it
+        // covers instead of below the session's first batch.
+        occurredAt: observations[0].occurred_at,
+        eventIds: draft.eventIds,
+    };
+    const existing = timeline(db, { project, sessionId, kind: 'session_summary', limit: 1 })[0];
+    if (existing) {
+        replaceEntry(db, existing.id, fields);
+        return existing.id;
+    }
+    return insertEntry(db, fields);
+}
+export async function processPending(db, config, opts = {}) {
+    const owner = opts.owner ?? `${process.pid}-${crypto.randomUUID().slice(0, 8)}`;
+    const maxJobs = opts.maxJobs ?? 3;
+    const summarizer = summarizerFor(config);
+    const result = { processed: 0, entries: 0, failed: 0, skipped: 0 };
+    for (let i = 0; i < maxJobs; i++) {
+        const job = claimJob(db, owner);
+        if (!job)
+            break;
+        const batch = batchById(db, job.batch_id);
+        const events = batchEvents(db, job.batch_id);
+        if (!batch || events.length === 0) {
+            // A batch with no events cannot produce anything and will never succeed.
+            finishJob(db, job.id, owner);
+            result.skipped++;
+            continue;
+        }
+        // Before the call, not after it: a batch that fails is the one whose
+        // provenance someone comes looking for.
+        db.prepare('UPDATE memory_batches SET summarizer = ?, config_digest = ? WHERE id = ?').run(summarizer.id, configDigest(config), batch.id);
+        try {
+            const drafts = await summarizer.summarize({
+                project: batch.project,
+                sessionId: batch.session_id,
+                events,
+            });
+            // One transaction for the entries, the candidates and the event status:
+            // a crash between them would leave events marked done with nothing to
+            // show for them, which is the one loss the batch cannot recover from.
+            db.transaction(() => {
+                for (const draft of drafts) {
+                    const entryId = insertEntry(db, {
+                        project: batch.project,
+                        sessionId: batch.session_id,
+                        batchId: batch.id,
+                        type: draft.type,
+                        title: draft.title,
+                        narrative: draft.narrative,
+                        facts: draft.facts,
+                        files: draft.files,
+                        tags: draft.tags,
+                        generator: summarizer.id,
+                        confidence: draft.confidence,
+                        occurredAt: events[0].occurred_at,
+                        eventIds: draft.eventIds,
+                    });
+                    result.entries++;
+                    for (const concept of draft.concepts ?? []) {
+                        addCandidate(db, {
+                            entryId,
+                            slug: concept.slug,
+                            name: concept.name,
+                            domain: concept.domain,
+                            confidence: draft.confidence,
+                            project: batch.project,
+                        });
+                    }
+                }
+                db.prepare("UPDATE evidence_events SET status = 'summarized' WHERE batch_id = ?").run(batch.id);
+            })();
+            finishJob(db, job.id, owner);
+            result.processed++;
+        }
+        catch (error) {
+            const errorClass = error instanceof ProviderError ? error.errorClass : 'transient';
+            failJob(db, job.id, owner, errorClass, error instanceof Error ? error.message : String(error));
+            result.failed++;
+            // A paused provider will fail the next job the same way; stop rather than
+            // burn the remaining budget re-learning that the key is rejected.
+            if (errorClass === 'auth' || errorClass === 'quota')
+                break;
+        }
+    }
+    return result;
+}
+/**
+ * The session seam: close the open batch and drain the queue.
+ *
+ * Called by the Stop hook and by `eklavya memory flush`. Batching at the seam
+ * rather than per tool call is what keeps one provider request from riding on
+ * every edit (PRD MEM-01).
+ */
+export async function flushSession(db, config, project, sessionId, reason = 'session_seam') {
+    batchSession(db, { project, sessionId, reason, maxEvents: config.memory.batch_max_events });
+    return processPending(db, config, { maxJobs: 4 });
+}
+/** Age of the oldest unprocessed job, for the health surfaces. */
+export function queueDepth(db) {
+    const row = db
+        .prepare(`SELECT
+         COALESCE(SUM(CASE WHEN status IN ('pending','claimed') THEN 1 ELSE 0 END), 0) AS pending,
+         COALESCE(SUM(CASE WHEN status = 'paused' THEN 1 ELSE 0 END), 0) AS paused,
+         COALESCE(SUM(CASE WHEN status = 'failed' THEN 1 ELSE 0 END), 0) AS failed,
+         MIN(CASE WHEN status IN ('pending','claimed') THEN created_at END) AS oldest
+       FROM memory_jobs`)
+        .get();
+    return row;
+}
+/** Retention sweep (PRD SEC-02). Raw evidence ages out; entries are kept. */
+export function pruneEvidence(db, config) {
+    const days = config.memory.retention_days;
+    if (!days)
+        return 0;
+    const cutoff = new Date(Date.now() - days * 86_400_000).toISOString();
+    const info = db
+        .prepare(`DELETE FROM evidence_events
+       WHERE occurred_at < ? AND status = 'summarized'
+         AND id NOT IN (SELECT event_id FROM memory_entry_events)`)
+        .run(cutoff);
+    db.prepare("INSERT OR REPLACE INTO meta (key, value) VALUES ('memory_pruned_at', ?)").run(nowIso());
+    return info.changes;
+}
+//# sourceMappingURL=worker.js.map

package/dist/memory/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../../src/memory/worker.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAmB,MAAM,gBAAgB,CAAC;AACpF,OAAO,EACL,YAAY,EACZ,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,OAAO,EACP,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,GACT,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;GAWG;AAEH,MAAM,UAAU,aAAa,CAAC,MAAqB;IACjD,OAAO,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;AAC/G,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,YAAY,CAAC,MAAqB;IACzC,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;SAClF,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,yBAAyB,GAAG,mBAAmB,CAAC;AAEtD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAM,EAAE,OAAe,EAAE,SAAiB;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,YAAY,GAAG,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,MAAM,GAAG;QACb,OAAO;QACP,SAAS;QACT,IAAI,EAAE,iBAA0B;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,yBAAyB;QACpC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,wEAAwE;QACxE,qDAAqD;QACrD,UAAU,EAAE,YAAY,CAAC,CAAC,CAAE,CAAC,WAAW;QACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;IAEF,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,IAAI,QAAQ,EAAE,CAAC;QACb,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACtC,OAAO,QAAQ,CAAC,EAAE,CAAC;IACrB,CAAC;IACD,OAAO,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;AACjC,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAM,EACN,MAAqB,EACrB,OAA6C,EAAE;IAE/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAChF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAEjF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,MAAM;QAEhB,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,yEAAyE;YACzE,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC7B,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QAED,qEAAqE;QACrE,wCAAwC;QACxC,EAAE,CAAC,OAAO,CAAC,0EAA0E,CAAC,CAAC,GAAG,CACxF,UAAU,CAAC,EAAE,EACb,YAAY,CAAC,MAAM,CAAC,EACpB,KAAK,CAAC,EAAE,CACT,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC;gBACxC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,UAAU;gBAC3B,MAAM;aACP,CAAC,CAAC;YAEH,wEAAwE;YACxE,sEAAsE;YACtE,sEAAsE;YACtE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;gBAClB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,EAAE;wBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,SAAS,EAAE,KAAK,CAAC,UAAU;wBAC3B,OAAO,EAAE,KAAK,CAAC,EAAE;wBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,SAAS,EAAE,UAAU,CAAC,EAAE;wBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;wBAC5B,UAAU,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,WAAW;wBAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;qBACzB,CAAC,CAAC;oBACH,MAAM,CAAC,OAAO,EAAE,CAAC;oBAEjB,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;wBAC3C,YAAY,CAAC,EAAE,EAAE;4BACf,OAAO;4BACP,IAAI,EAAE,OAAO,CAAC,IAAI;4BAClB,IAAI,EAAE,OAAO,CAAC,IAAI;4BAClB,MAAM,EAAE,OAAO,CAAC,MAAM;4BACtB,UAAU,EAAE,KAAK,CAAC,UAAU;4BAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;yBACvB,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBACD,EAAE,CAAC,OAAO,CAAC,qEAAqE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClG,CAAC,CAAC,EAAE,CAAC;YAEL,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC7B,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,KAAK,YAAY,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;YACnF,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/F,MAAM,CAAC,MAAM,EAAE,CAAC;YAChB,0EAA0E;YAC1E,kEAAkE;YAClE,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,OAAO;gBAAE,MAAM;QAC7D,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAM,EACN,MAAqB,EACrB,OAAe,EACf,SAAiB,EACjB,MAAM,GAAG,cAAc;IAEvB,YAAY,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC5F,OAAO,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,UAAU,CAAC,EAAM;IAC/B,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CACN;;;;;wBAKkB,CACnB;SACA,GAAG,EAAgF,CAAC;IACvF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,EAAM,EAAE,MAAqB;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC;IACpB,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACtE,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CACN;;kEAE4D,CAC7D;SACA,GAAG,CAAC,MAAM,CAAC,CAAC;IACf,EAAE,CAAC,OAAO,CAAC,yEAAyE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACpG,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC"}

package/dist/migrations/009_memory.sql

@@ -0,0 +1,226 @@
+-- Memory: the evidence half of the unified plugin (.plan/unified-memory-learning).
+--
+-- Learning already records what the developer was *asked* and what they knew.
+-- These tables record what actually *happened* -- the prompts, tool uses, edits
+-- and failures a session produced -- and the observations distilled from them.
+-- They live in the same file as the learning tables (ADR-02) so one transaction
+-- can say "this evidence produced this concept candidate", and they hold no
+-- foreign key into learning except that one explicit link table.
+--
+-- Nothing here is trusted instruction material. Everything an observer or an
+-- import writes is derived data with provenance, quoted back to the model as
+-- evidence and never as a system prompt (PRD SEC-01).
+
+-- Raw accepted evidence. One row per host event that survived exclusion and
+-- sanitisation. `event_uid` is the idempotency key: hooks and transcript replay
+-- both converge here and must not record the same turn twice (PRD CAP-02).
+CREATE TABLE IF NOT EXISTS evidence_events (
+  id          INTEGER PRIMARY KEY,
+  event_uid   TEXT NOT NULL UNIQUE,
+  project     TEXT NOT NULL,              -- projectKey: worktrees folded into their checkout
+  checkout    TEXT,                       -- the unfolded root, so a worktree stays distinguishable
+  session_id  TEXT NOT NULL,
+  agent_id    TEXT,                       -- subagent identity, NULL for the main thread
+  host        TEXT NOT NULL DEFAULT 'claude-code',
+  source      TEXT NOT NULL DEFAULT 'hook', -- 'hook' | 'replay' | 'manual' | 'import'
+  kind        TEXT NOT NULL,              -- prompt|tool_use|tool_error|file_edit|file_read|assistant|lifecycle|note
+  tool        TEXT,
+  title       TEXT,
+  body        TEXT NOT NULL DEFAULT '',
+  files       TEXT,                       -- JSON array of repo-relative paths
+  occurred_at TEXT NOT NULL,              -- when it happened on the host
+  received_at TEXT NOT NULL DEFAULT (datetime('now')),
+  redacted    INTEGER NOT NULL DEFAULT 0, -- 1 when the privacy filter removed something
+  batch_id    INTEGER,                    -- set once a batch claims it
+  status      TEXT NOT NULL DEFAULT 'accepted' -- accepted|batched|summarized
+);
+
+-- The immutable input to one observation job. A provider request must be
+-- reconstructible from storage after a crash, not from a lost in-memory
+-- conversation (PRD DATA-03), so the batch is written before the job runs.
+CREATE TABLE IF NOT EXISTS memory_batches (
+  id          INTEGER PRIMARY KEY,
+  project     TEXT NOT NULL,
+  session_id  TEXT NOT NULL,
+  reason      TEXT NOT NULL,              -- 'size' | 'time' | 'session_seam' | 'manual'
+  event_count INTEGER NOT NULL DEFAULT 0,
+  byte_count  INTEGER NOT NULL DEFAULT 0,
+  created_at  TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+-- Durable jobs with claim leases. A crashed worker's lease expires and the job
+-- is retried; `attempts` and `last_error` classify why, so a permanent failure
+-- (bad auth) is distinguishable from a transient one (timeout).
+CREATE TABLE IF NOT EXISTS memory_jobs (
+  id          INTEGER PRIMARY KEY,
+  batch_id    INTEGER NOT NULL REFERENCES memory_batches(id) ON DELETE CASCADE,
+  kind        TEXT NOT NULL DEFAULT 'summarize',
+  status      TEXT NOT NULL DEFAULT 'pending', -- pending|claimed|done|failed|paused
+  attempts    INTEGER NOT NULL DEFAULT 0,
+  lease_owner TEXT,
+  lease_until TEXT,
+  last_error  TEXT,
+  error_class TEXT,                       -- transient|auth|quota|overflow|malformed|permanent
+  created_at  TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at  TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+-- An observation: the distilled, searchable unit of memory. `kind` separates a
+-- generated observation from a session summary and from a note the developer
+-- wrote by hand. Corrections supersede rather than overwrite, so the audit
+-- trail survives (PRD MEM-03).
+CREATE TABLE IF NOT EXISTS memory_entries (
+  id            INTEGER PRIMARY KEY,
+  entry_uid     TEXT NOT NULL UNIQUE,
+  project       TEXT NOT NULL,
+  session_id    TEXT,
+  batch_id      INTEGER REFERENCES memory_batches(id) ON DELETE SET NULL,
+  kind          TEXT NOT NULL DEFAULT 'observation', -- observation|session_summary|note
+  type          TEXT,                     -- bugfix|feature|refactor|decision|discovery|...
+  title         TEXT NOT NULL,
+  narrative     TEXT NOT NULL DEFAULT '',
+  facts         TEXT,                     -- JSON array of strings
+  files         TEXT,                     -- JSON array of repo-relative paths
+  generator     TEXT NOT NULL DEFAULT 'local', -- summarizer id, e.g. 'local-v1' or a provider id
+  confidence    REAL,
+  occurred_at   TEXT NOT NULL,
+  created_at    TEXT NOT NULL DEFAULT (datetime('now')),
+  superseded_by INTEGER REFERENCES memory_entries(id) ON DELETE SET NULL,
+  deleted_at    TEXT,
+  import_source TEXT                      -- provenance when the row came from an importer
+);
+
+-- Which raw events an entry came from. Drill-down from an observation to the
+-- evidence behind it, and the reason an entry can be rebuilt after a bad batch.
+CREATE TABLE IF NOT EXISTS memory_entry_events (
+  entry_id INTEGER NOT NULL REFERENCES memory_entries(id) ON DELETE CASCADE,
+  event_id INTEGER NOT NULL REFERENCES evidence_events(id) ON DELETE CASCADE,
+  PRIMARY KEY (entry_id, event_id)
+);
+
+-- Tags are a table rather than JSON because filtering by tag is a first-class
+-- retrieval path and `json_each` over the whole corpus is not an index.
+CREATE TABLE IF NOT EXISTS memory_entry_tags (
+  entry_id INTEGER NOT NULL REFERENCES memory_entries(id) ON DELETE CASCADE,
+  tag      TEXT NOT NULL,
+  PRIMARY KEY (entry_id, tag)
+);
+
+-- Keyword retrieval. Contentless FTS5: the row content lives in memory_entries
+-- and the index stores only the terms, so there is one copy of the text.
+CREATE VIRTUAL TABLE IF NOT EXISTS memory_fts USING fts5(
+  title, narrative, facts, files,
+  content = 'memory_entries',
+  content_rowid = 'id',
+  tokenize = 'unicode61 remove_diacritics 2'
+);
+
+-- Semantic retrieval (ADR-03). One row per entry per embedder: switching
+-- embedders re-embeds in the background and vectors of different models are
+-- never compared, because `embedder_id` is part of the read filter.
+CREATE TABLE IF NOT EXISTS memory_vectors (
+  entry_id    INTEGER NOT NULL REFERENCES memory_entries(id) ON DELETE CASCADE,
+  embedder_id TEXT NOT NULL,
+  dim         INTEGER NOT NULL,
+  vec         BLOB NOT NULL,              -- float32 little-endian, L2-normalised
+  PRIMARY KEY (entry_id, embedder_id)
+);
+
+-- The savings ledger (PRD MET-01). One receipt per injection: what would have
+-- been read (`base_tokens`), what was actually delivered (`delivered_tokens`),
+-- how both were counted, and whether delivery was confirmed. A percentage the
+-- dashboard or the banner shows must be derivable from these rows alone.
+CREATE TABLE IF NOT EXISTS context_receipts (
+  id               INTEGER PRIMARY KEY,
+  receipt_uid      TEXT NOT NULL UNIQUE,
+  project          TEXT NOT NULL,
+  session_id       TEXT,
+  scope            TEXT NOT NULL,         -- 'session_start' | 'search' | 'resume' | ...
+  method           TEXT NOT NULL,         -- tokenizer/estimator identity
+  base_tokens      INTEGER NOT NULL DEFAULT 0,
+  delivered_tokens INTEGER NOT NULL DEFAULT 0,
+  item_count       INTEGER NOT NULL DEFAULT 0,
+  delivery         TEXT NOT NULL DEFAULT 'unknown', -- confirmed|unknown|prepared
+  created_at       TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+-- Per-item accounting, so a later detail fetch updates the same episode's total
+-- instead of leaving the optimistic index-only percentage standing.
+CREATE TABLE IF NOT EXISTS context_receipt_items (
+  receipt_id    INTEGER NOT NULL REFERENCES context_receipts(id) ON DELETE CASCADE,
+  entry_id      INTEGER NOT NULL REFERENCES memory_entries(id) ON DELETE CASCADE,
+  source_tokens INTEGER NOT NULL DEFAULT 0,
+  sent_tokens   INTEGER NOT NULL DEFAULT 0,
+  stage         TEXT NOT NULL DEFAULT 'index', -- 'index' | 'detail'
+  PRIMARY KEY (receipt_id, entry_id, stage)
+);
+
+-- The one explicit bridge between the two halves (PRD LRN-02, DATA-01).
+-- An evidence-derived concept candidate. `status` is the gate: a candidate is
+-- not a concept, and no row here ever records an attempt or moves mastery.
+CREATE TABLE IF NOT EXISTS learning_sources (
+  id         INTEGER PRIMARY KEY,
+  entry_id   INTEGER REFERENCES memory_entries(id) ON DELETE CASCADE,
+  event_id   INTEGER REFERENCES evidence_events(id) ON DELETE CASCADE,
+  concept_id INTEGER REFERENCES concepts(id),
+  slug       TEXT,                        -- proposed slug before validation
+  name       TEXT,
+  domain     TEXT,
+  confidence REAL NOT NULL DEFAULT 0,
+  status     TEXT NOT NULL DEFAULT 'candidate', -- candidate|accepted|rejected|duplicate
+  project    TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+-- Saved focused knowledge collections (PRD RET-04). The filter is stored so a
+-- rebuild reproduces the same query; membership is materialised so a failed
+-- rebuild can be discarded without losing the last good set.
+CREATE TABLE IF NOT EXISTS memory_collections (
+  id          INTEGER PRIMARY KEY,
+  name        TEXT NOT NULL UNIQUE,
+  description TEXT,
+  filter      TEXT NOT NULL DEFAULT '{}', -- JSON query descriptor
+  project     TEXT,
+  built_at    TEXT,
+  status      TEXT NOT NULL DEFAULT 'ready', -- ready|building|failed
+  created_at  TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE TABLE IF NOT EXISTS memory_collection_items (
+  collection_id INTEGER NOT NULL REFERENCES memory_collections(id) ON DELETE CASCADE,
+  entry_id      INTEGER NOT NULL REFERENCES memory_entries(id) ON DELETE CASCADE,
+  rank          REAL NOT NULL DEFAULT 0,
+  PRIMARY KEY (collection_id, entry_id)
+);
+
+-- Read paths on a user's critical path: the SessionStart recall, the dashboard
+-- timeline, and the worker's claim scan.
+CREATE INDEX IF NOT EXISTS idx_events_project_time  ON evidence_events(project, occurred_at DESC);
+CREATE INDEX IF NOT EXISTS idx_events_session       ON evidence_events(session_id, occurred_at DESC);
+CREATE INDEX IF NOT EXISTS idx_events_status        ON evidence_events(status, project);
+CREATE INDEX IF NOT EXISTS idx_entries_project_time ON memory_entries(project, occurred_at DESC);
+CREATE INDEX IF NOT EXISTS idx_entries_session      ON memory_entries(session_id);
+CREATE INDEX IF NOT EXISTS idx_jobs_status          ON memory_jobs(status, lease_until);
+CREATE INDEX IF NOT EXISTS idx_receipts_project     ON context_receipts(project, created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_sources_status       ON learning_sources(status, project);
+CREATE INDEX IF NOT EXISTS idx_tags_tag             ON memory_entry_tags(tag);
+
+-- FTS stays in step through triggers rather than through every call site
+-- remembering to update it. External-content FTS5 needs the old values on
+-- delete, which only a trigger has to hand.
+CREATE TRIGGER IF NOT EXISTS memory_entries_ai AFTER INSERT ON memory_entries BEGIN
+  INSERT INTO memory_fts(rowid, title, narrative, facts, files)
+  VALUES (new.id, new.title, new.narrative, new.facts, new.files);
+END;
+
+CREATE TRIGGER IF NOT EXISTS memory_entries_ad AFTER DELETE ON memory_entries BEGIN
+  INSERT INTO memory_fts(memory_fts, rowid, title, narrative, facts, files)
+  VALUES ('delete', old.id, old.title, old.narrative, old.facts, old.files);
+END;
+
+CREATE TRIGGER IF NOT EXISTS memory_entries_au AFTER UPDATE ON memory_entries BEGIN
+  INSERT INTO memory_fts(memory_fts, rowid, title, narrative, facts, files)
+  VALUES ('delete', old.id, old.title, old.narrative, old.facts, old.files);
+  INSERT INTO memory_fts(rowid, title, narrative, facts, files)
+  VALUES (new.id, new.title, new.narrative, new.facts, new.files);
+END;

package/dist/migrations/010_import.sql

@@ -0,0 +1,26 @@
+-- Import provenance: the durable id map that makes an import resumable and
+-- idempotent (PRD MIG-02).
+--
+-- Without it, a run interrupted halfway has no way to tell what it already
+-- wrote, and the only safe second attempt is a full re-import that duplicates
+-- everything. Entry and event uids are deterministic, so duplication is already
+-- prevented at the row level -- but "already present" and "just written" are
+-- indistinguishable without a map, and a report that cannot say which is which
+-- cannot validate its own counts.
+--
+-- Keyed by (source, source_db, source_table, source_id) rather than by source
+-- id alone: two Claude Mem databases (a laptop's and a restored backup) share
+-- their autoincrement ids, and folding them together would silently drop half
+-- of the second import.
+CREATE TABLE IF NOT EXISTS import_id_map (
+  source       TEXT NOT NULL,     -- importer id, e.g. 'claude-mem'
+  source_db    TEXT NOT NULL,     -- identity of the source file, not its path of the day
+  source_table TEXT NOT NULL,
+  source_id    TEXT NOT NULL,
+  target_table TEXT NOT NULL,     -- 'memory_entries' | 'evidence_events' | 'learning_sources'
+  target_id    INTEGER NOT NULL,
+  imported_at  TEXT NOT NULL DEFAULT (datetime('now')),
+  PRIMARY KEY (source, source_db, source_table, source_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_import_target ON import_id_map(target_table, target_id);

package/dist/migrations/011_sync.sql

@@ -0,0 +1,76 @@
+-- Multi-device sync (ADR-09): a shared *directory*, never a server.
+--
+-- Two devices point at one folder -- Dropbox, iCloud, Syncthing, a mounted
+-- share, a git repo -- and exchange revision records as files. None of those is
+-- a dependency, because the target is a path. The hosted team server in the
+-- PRD's Phase 6 is deliberately not built.
+--
+-- What crosses is memory entries, their tags and their tombstones. Attempts,
+-- mastery, gates, receipts and raw `evidence_events` never do (PRD SEC-02): a
+-- developer's assessment history is theirs, and pointing a team at one shared
+-- folder must not hand them everyone's quiz record. `src/memory/sync.ts`
+-- enforces that with a column allowlist; these tables simply have nowhere to
+-- put anything else.
+
+-- Per-device high-water marks, including this device's own counter.
+--
+-- One uniform meaning for every row: "revisions from this device up to and
+-- including `last_revision` are reflected in this database". For a peer that
+-- makes a pull incremental -- only files above the mark are read. For the local
+-- device it is the last revision handed out, so `revision` is monotonic per
+-- device and a pair (device_id, revision) names one version for ever.
+CREATE TABLE IF NOT EXISTS sync_state (
+  device_id     TEXT PRIMARY KEY,
+  last_revision INTEGER NOT NULL DEFAULT 0,
+  last_sync_at  TEXT
+);
+
+-- The version vector, one row per entry uid: which device wrote the version
+-- this database currently holds, at which revision, and what it descended from.
+--
+-- Keyed by `entry_uid` and not by the entry's integer id, and with no foreign
+-- key, on purpose. Row ids are local; `entry_uid` is the only name two devices
+-- agree on. And a tombstone has to outlive the row it buries -- without a
+-- record that survives the delete, the next pull from a device that still had
+-- the entry would resurrect it, which is the exact bug this table prevents.
+--
+-- `base` is the version this one replaced, spelled `<device>:<revision>` (NULL
+-- for a first write). An incoming record whose `base` is what we already hold
+-- is a fast-forward and applies. Anything else is divergence, and divergence is
+-- quarantined rather than merged.
+--
+-- `hash` covers the payload, so the push scan can tell a changed entry from an
+-- untouched one without a write-time hook in `memory/store.ts`.
+CREATE TABLE IF NOT EXISTS sync_records (
+  entry_uid  TEXT PRIMARY KEY,
+  device_id  TEXT NOT NULL,
+  revision   INTEGER NOT NULL,
+  base       TEXT,
+  op         TEXT NOT NULL DEFAULT 'upsert',  -- 'upsert' | 'delete' (a tombstone)
+  hash       TEXT NOT NULL,
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+-- Losing versions, kept readable rather than dropped.
+--
+-- Two devices editing one entry between syncs is not something a timestamp can
+-- adjudicate, so nothing here is overwritten silently: the local version stays
+-- live, the incoming one lands here with its whole payload, and a repair call
+-- picks a side. `payload` is the wire record verbatim so that choosing the
+-- remote side needs nothing from the target directory, which may be offline by
+-- the time somebody looks.
+CREATE TABLE IF NOT EXISTS sync_conflicts (
+  id          INTEGER PRIMARY KEY,
+  entry_uid   TEXT NOT NULL,
+  device_id   TEXT NOT NULL,             -- the device whose version lost
+  revision    INTEGER NOT NULL,
+  base        TEXT,
+  local_ref   TEXT NOT NULL,             -- `<device>:<revision>` held at the time
+  payload     TEXT NOT NULL,             -- the incoming record, as JSON
+  detected_at TEXT NOT NULL DEFAULT (datetime('now')),
+  resolved_at TEXT,
+  resolution  TEXT                       -- 'local' | 'remote' | 'superseded'
+);
+
+CREATE INDEX IF NOT EXISTS idx_sync_records_device ON sync_records(device_id, revision);
+CREATE INDEX IF NOT EXISTS idx_sync_conflicts_open ON sync_conflicts(resolved_at, entry_uid);

package/dist/migrations/012_job_backoff.sql

@@ -0,0 +1,13 @@
+-- Retry backoff for the observation queue.
+--
+-- A transient provider failure returned the job straight to 'pending', which
+-- the very next hook reclaimed -- so a job failing against a timing-out or
+-- rate-limited provider spun against it once per tool call until it burned its
+-- five attempts, turning one bad minute into a permanent loss. `next_attempt`
+-- is the floor under the next claim: `failJob` sets it, `claimJob` skips a job
+-- whose floor is still in the future (quality.md, "Failure containment").
+--
+-- Nullable, and NULL means claimable now: every job that already exists was
+-- claimable when this ran, and a migration that invented a cooldown for them
+-- would stall a healthy queue on upgrade.
+ALTER TABLE memory_jobs ADD COLUMN next_attempt TEXT;

package/dist/migrations/013_batch_provenance.sql

@@ -0,0 +1,18 @@
+-- Batch provenance (PRD MEM-01: "a versioned input batch and prompt/config
+-- identity").
+--
+-- 009 made the input reconstructible -- the events, the reason, the counts --
+-- but not the run. `memory_entries.generator` records the summariser after the
+-- fact and only when the batch produced something, so a batch that came out
+-- wrong, or produced nothing at all, left no way to know which summariser or
+-- which configuration had read it. Both are written when the job is claimed,
+-- which is the point at which they are known and before the call that may fail.
+--
+-- Nullable because every batch written before this migration ran genuinely has
+-- no answer, and a backfilled guess would be worse than an honest NULL.
+ALTER TABLE memory_batches ADD COLUMN summarizer TEXT;
+
+-- Digest over the settings that change what a summary comes out as: what
+-- capture accepted, what redaction removed, which model read it. Never a key --
+-- a provider config names an environment variable, not its value (SEC-01).
+ALTER TABLE memory_batches ADD COLUMN config_digest TEXT;

package/dist/migrations/014_batch_events_index.sql

@@ -0,0 +1,18 @@
+-- The worker reads and retires a batch by `batch_id`, and nothing indexed it.
+--
+-- `batchEvents` (`SELECT … WHERE batch_id = ?`) and the worker's
+-- `UPDATE … SET status = 'summarized' WHERE batch_id = ?` both reported
+-- `SCAN evidence_events`, so summarising one forty-event batch cost a full scan
+-- of every event ever captured. The batch does not grow; the table does, which
+-- makes the total summarising work over a database's life quadratic in its own
+-- history. Measured at the fixture `quality.md` asks for: 1.2ms per batch at
+-- 2,000 events, 26ms at 200,000, 613ms at 1,000,000 -- for identical input.
+--
+-- It stayed hidden because the 2k and 20k perf runs wrote a fixed ~2,000 events
+-- whatever the entry count, pinning the one axis that drives it.
+--
+-- `memory.retention_days` defaults to null, so evidence never shrinks by itself
+-- and the curve has nothing to flatten it. This is on the worker's path, at a
+-- session seam, not on a human's -- which is why it was slow rather than
+-- visible.
+CREATE INDEX IF NOT EXISTS idx_events_batch ON evidence_events(batch_id);