forge-workflow 0.1.0-beta.4 → 0.1.0-beta.6

package/lib/kernel/legacy-claim-repair.js

@@ -0,0 +1,442 @@
+'use strict';
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { createHash } = require('node:crypto');
+
+const { ISSUE_STATUSES } = require('./issue-command-contract');
+const { CLAIM_STATES, isClaimableType, isTerminalStatus } = require('./taxonomy-validator');
+const REQUIRED_CLAIM_COLUMNS = Object.freeze([
+	'id', 'issue_id', 'actor', 'state', 'session_id', 'worktree_id', 'claimed_at', 'expires_at',
+]);
+const REQUIRED_ISSUE_COLUMNS = Object.freeze(['id', 'status', 'type']);
+const REQUIRED_INDEXES = Object.freeze({
+	idx_kernel_claims_active_lease: Object.freeze({ columns: ['issue_id'], unique: true, partial: true }),
+	idx_kernel_claims_actor_state: Object.freeze({ columns: ['actor', 'state'], unique: false, partial: false }),
+	idx_kernel_claims_issue_state: Object.freeze({ columns: ['issue_id', 'state'], unique: false, partial: false }),
+});
+
+class ClaimRepairError extends Error {
+	constructor(code, message, details = {}) {
+		super(message);
+		this.name = 'ClaimRepairError';
+		this.code = code;
+		this.details = details;
+	}
+}
+
+function canonicalIso(value) {
+	if (typeof value !== 'string') return false;
+	const millis = Date.parse(value);
+	return Number.isFinite(millis) && new Date(millis).toISOString() === value;
+}
+
+function compareCanonical(left, right) {
+	const leftValue = String(left);
+	const rightValue = String(right);
+	if (leftValue < rightValue) return -1;
+	if (leftValue > rightValue) return 1;
+	return 0;
+}
+
+function stableValue(value) {
+	if (Array.isArray(value)) return value.map(stableValue);
+	if (!value || typeof value !== 'object') return value;
+	const sorted = {};
+	for (const key of Object.keys(value).sort(compareCanonical)) {
+		sorted[key] = stableValue(value[key]);
+	}
+	return sorted;
+}
+
+function stableStringify(value) {
+	return JSON.stringify(stableValue(value));
+}
+
+function sha256(value) {
+	return createHash('sha256').update(value).digest('hex');
+}
+
+function normalizeIndex(index = {}) {
+	return {
+		name: String(index.name || ''),
+		columns: Array.isArray(index.columns) ? index.columns.map(String) : [],
+		unique: Boolean(index.unique),
+		partial: Boolean(index.partial),
+		sql: String(index.sql || '').replace(/\s+/g, ' ').trim(),
+	};
+}
+
+function collectSchemaErrors(snapshot) {
+	const errors = [];
+	if (snapshot.integrity !== 'ok') errors.push('integrity_check');
+	if (snapshot.foreign_keys_enabled !== true) errors.push('foreign_keys_disabled');
+	if (Number(snapshot.foreign_key_faults || 0) !== 0) errors.push('foreign_key_fault');
+	if (Array.isArray(snapshot.read_errors) && snapshot.read_errors.length > 0) errors.push('schema_read_failure');
+
+	const claimColumns = new Set(snapshot.claim_columns || []);
+	const issueColumns = new Set(snapshot.issue_columns || []);
+	if (REQUIRED_CLAIM_COLUMNS.some(column => !claimColumns.has(column))) errors.push('claim_schema_columns');
+	if (REQUIRED_ISSUE_COLUMNS.some(column => !issueColumns.has(column))) errors.push('issue_schema_columns');
+
+	const foreignKeys = snapshot.claim_foreign_keys || [];
+	if (!foreignKeys.some(row => row.table === 'kernel_issues' && row.from === 'issue_id' && row.to === 'id')) {
+		errors.push('claim_issue_foreign_key');
+	}
+
+	const indexes = new Map((snapshot.claim_indexes || []).map(index => [index.name, normalizeIndex(index)]));
+	for (const [name, expected] of Object.entries(REQUIRED_INDEXES)) {
+		const actual = indexes.get(name);
+		if (!actual
+			|| stableStringify(actual.columns) !== stableStringify(expected.columns)
+			|| actual.unique !== expected.unique
+			|| actual.partial !== expected.partial) {
+			errors.push(`index:${name}`);
+		}
+	}
+	const activeIndex = indexes.get('idx_kernel_claims_active_lease');
+	if (activeIndex && !/\bon\s+kernel_claims\s*\(\s*issue_id\s*\)\s+where\s+state\s*=\s*'active'\s*;?$/i.test(activeIndex.sql)) {
+		errors.push('index:idx_kernel_claims_active_lease_sql');
+	}
+	return errors;
+}
+
+function exactClaimRow(row) {
+	return {
+		id: row.id,
+		issue_id: row.issue_id,
+		actor: row.actor,
+		state: row.state,
+		session_id: row.session_id ?? null,
+		worktree_id: row.worktree_id ?? null,
+		claimed_at: row.claimed_at,
+		expires_at: row.expires_at ?? null,
+	};
+}
+
+function digestSnapshot(snapshot, observedAt, claims) {
+	const indexes = (snapshot.claim_indexes || []).map(normalizeIndex)
+		.sort((left, right) => compareCanonical(left.name, right.name));
+	const referencedIssueIds = new Set(claims.map(claim => claim.issue_id));
+	const issues = (snapshot.issues || [])
+		.filter(issue => referencedIssueIds.has(issue.id))
+		.map(issue => ({ id: issue.id, status: issue.status, type: issue.type }))
+		.sort((left, right) => compareCanonical(left.id, right.id));
+	const canonicalClaims = claims.map(exactClaimRow)
+		.sort((left, right) => compareCanonical(left.id, right.id));
+	const claimsById = new Map(canonicalClaims.map(claim => [claim.id, claim]));
+	const authoritySchema = [...(snapshot.authority_schema || [])]
+		.map(row => ({ type: row.type, name: row.name, table_name: row.tbl_name, sql: row.sql ?? null }))
+		.sort((left, right) => compareCanonical(stableStringify(left), stableStringify(right)));
+	const authorityTables = [...(snapshot.authority_tables || [])]
+		.map(table => {
+			const rows = (table.rows || []).map(row => {
+				if (table.name !== 'kernel_claims') return stableValue(row);
+				const claim = claimsById.get(row.id);
+				return stableValue(claim ? { ...row, state: claim.state } : row);
+			}).sort((left, right) => compareCanonical(stableStringify(left), stableStringify(right)));
+			return { name: table.name, rows };
+		})
+		.sort((left, right) => compareCanonical(left.name, right.name));
+	return sha256(stableStringify({
+		schema_version: 'forge.claim-repair.snapshot.v2',
+		observed_at: observedAt,
+		authority: { schema: authoritySchema, tables: authorityTables },
+		schema: {
+			claim_columns: [...(snapshot.claim_columns || [])]
+				.sort(compareCanonical),
+			issue_columns: [...(snapshot.issue_columns || [])]
+				.sort(compareCanonical),
+			claim_foreign_keys: [...(snapshot.claim_foreign_keys || [])]
+				.map(row => ({ table: row.table, from: row.from, to: row.to }))
+				.sort((left, right) => compareCanonical(stableStringify(left), stableStringify(right))),
+			claim_indexes: indexes,
+		},
+		issues,
+		claims: canonicalClaims,
+	}));
+}
+
+function validateIssueRows(issues, errors) {
+	const issuesById = new Map();
+	for (const issue of issues) {
+		if (typeof issue.id !== 'string' || issue.id.length === 0 || !ISSUE_STATUSES.includes(issue.status)) {
+			errors.push('invalid_issue_state');
+		}
+		if (issuesById.has(issue.id)) errors.push('duplicate_issue_id');
+		issuesById.set(issue.id, issue);
+	}
+	return issuesById;
+}
+
+function claimRowErrors(claim, claimIds, issuesById) {
+	const errors = [];
+	if (typeof claim.id !== 'string' || claim.id.length === 0 || claimIds.has(claim.id)) {
+		errors.push('duplicate_or_invalid_claim_id');
+	}
+	if (typeof claim.issue_id !== 'string' || !issuesById.has(claim.issue_id)) errors.push('orphan_claim');
+	if (typeof claim.actor !== 'string' || claim.actor.trim() === '') errors.push('invalid_claim_actor');
+	if (!CLAIM_STATES.includes(claim.state)) errors.push('invalid_claim_state');
+	if (!canonicalIso(claim.claimed_at)) errors.push('invalid_claimed_at');
+	if (claim.expires_at !== null && claim.expires_at !== undefined && !canonicalIso(claim.expires_at)) {
+		errors.push('invalid_expires_at');
+	}
+	return errors;
+}
+
+function validateClaimRows(claims, issuesById, errors) {
+	const claimIds = new Set();
+	const activeByIssue = new Map();
+	for (const claim of claims) {
+		errors.push(...claimRowErrors(claim, claimIds, issuesById));
+		claimIds.add(claim.id);
+		if (claim.state === 'active') {
+			activeByIssue.set(claim.issue_id, Number(activeByIssue.get(claim.issue_id) || 0) + 1);
+			const issue = issuesById.get(claim.issue_id);
+			if (issue && !isClaimableType(issue.type)) errors.push('unclaimable_active_claim');
+		}
+	}
+	if ([...activeByIssue.values()].some(count => count > 1)) errors.push('duplicate_active_claim');
+}
+
+function throwClaimRepairErrors(errors) {
+	if (errors.length === 0) return;
+	const counts = Object.create(null);
+	for (const error of errors) counts[error] = Number(counts[error] || 0) + 1;
+	const labels = Object.keys(counts).sort(compareCanonical);
+	throw new ClaimRepairError(
+		'CLAIM_REPAIR_PREFLIGHT_FAILED',
+		`Claim repair preflight failed closed (${labels.join(', ')})`,
+		{ errors: counts },
+	);
+}
+
+function classifyClaimActions(claims, issuesById, observedAt) {
+	const actions = [];
+	let preservedNullExpiry = 0;
+	let preservedUnexpired = 0;
+	for (const claim of claims) {
+		if (claim.state !== 'active') continue;
+		const issue = issuesById.get(claim.issue_id);
+		if (isTerminalStatus(issue.status)) {
+			actions.push({ claim: exactClaimRow(claim), issue_status: issue.status, to_state: 'released' });
+			continue;
+		}
+		if (claim.expires_at !== null && claim.expires_at !== undefined
+			&& Date.parse(claim.expires_at) <= Date.parse(observedAt)) {
+			actions.push({ claim: exactClaimRow(claim), issue_status: issue.status, to_state: 'reclaimable' });
+			continue;
+		}
+		if (claim.expires_at === null || claim.expires_at === undefined) preservedNullExpiry += 1;
+		else preservedUnexpired += 1;
+	}
+	return { actions, preservedNullExpiry, preservedUnexpired };
+}
+
+function buildClaimRepairCounts(issues, claims, classification) {
+	const { actions, preservedNullExpiry, preservedUnexpired } = classification;
+	const released = actions.filter(action => action.to_state === 'released').length;
+	const reclaimable = actions.filter(action => action.to_state === 'reclaimable').length;
+	return Object.freeze({
+		total_issues: issues.length,
+		total_claims: claims.length,
+		active_claims: claims.filter(claim => claim.state === 'active').length,
+		non_active_claims: claims.filter(claim => claim.state !== 'active').length,
+		terminal_active_to_release: released,
+		expired_nonterminal_to_reclaimable: reclaimable,
+		preserved_null_expiry_active: preservedNullExpiry,
+		preserved_unexpired_active: preservedUnexpired,
+		planned_mutations: actions.length,
+	});
+}
+
+function buildClaimRepairPlan(snapshot, options = {}) {
+	const observedAt = options.observedAt;
+	if (!canonicalIso(observedAt)) {
+		throw new ClaimRepairError(
+			'CLAIM_REPAIR_INVALID_OBSERVED_AT',
+			'Claim repair requires an exact canonical UTC timestamp (YYYY-MM-DDTHH:mm:ss.sssZ)',
+		);
+	}
+
+	const errors = collectSchemaErrors(snapshot);
+	const issues = Array.isArray(snapshot.issues) ? snapshot.issues : [];
+	const claims = Array.isArray(snapshot.claims) ? snapshot.claims : [];
+	const issuesById = validateIssueRows(issues, errors);
+	validateClaimRows(claims, issuesById, errors);
+	throwClaimRepairErrors(errors);
+	const classification = classifyClaimActions(claims, issuesById, observedAt);
+	const { actions } = classification;
+
+	const digest = digestSnapshot(snapshot, observedAt, claims);
+	const actionById = new Map(actions.map(action => [action.claim.id, action]));
+	const afterClaims = claims.map(claim => {
+		const action = actionById.get(claim.id);
+		return action ? { ...claim, state: action.to_state } : claim;
+	});
+	const afterDigest = digestSnapshot(snapshot, observedAt, afterClaims);
+	return {
+		observedAt,
+		digest,
+		afterDigest,
+		counts: buildClaimRepairCounts(issues, claims, classification),
+		actions,
+	};
+}
+
+function publicClaimRepairPreflight(plan) {
+	return Object.freeze({
+		schema_version: 'forge.claim-repair.preflight.v1',
+		mode: 'dry-run',
+		observed_at: plan.observedAt,
+		digest: plan.digest,
+		after_digest: plan.afterDigest,
+		counts: plan.counts,
+	});
+}
+
+async function hashFile(filePath) {
+	return new Promise((resolve, reject) => {
+		const hash = createHash('sha256');
+		const stream = fs.createReadStream(filePath);
+		stream.on('error', reject);
+		stream.on('data', chunk => hash.update(chunk));
+		stream.on('end', () => resolve(hash.digest('hex')));
+	});
+}
+
+function cleanupRestoreProofDirectory(directory, fsApi = fs) {
+	try {
+		fsApi.rmSync(directory, {
+			recursive: true,
+			force: true,
+			maxRetries: 5,
+			retryDelay: 100,
+		});
+	} catch {
+		// A closed SQLite handle can remain briefly locked on Windows. The proof is
+		// already valid and the private OS temp directory can be reaped later.
+	}
+}
+
+async function prepareRestoreProofSnapshot(backupPath, restoreDir, restorePath, options = {}) {
+	const fsApi = options.fsApi || fs;
+	const hardenPath = options.hardenPath;
+	const hardenPaths = options.hardenPaths;
+	if (typeof hardenPath !== 'function') {
+		throw new ClaimRepairError(
+			'CLAIM_REPAIR_BACKUP_PERMISSIONS',
+			'Restore proof requires a platform permission hardener',
+		);
+	}
+	if (!options.restoreDirHardened) {
+		if (typeof hardenPaths === 'function') await hardenPaths([restoreDir]);
+		else await hardenPath(restoreDir);
+	}
+	fsApi.copyFileSync(backupPath, restorePath, fs.constants.COPYFILE_EXCL);
+	if (typeof hardenPaths === 'function') await hardenPaths([restorePath]);
+	else await hardenPath(restorePath);
+}
+
+async function verifyClaimRepairBackup(options = {}) {
+	const { backupPath, observedAt, openDriver, hardenPath, hardenPaths } = options;
+	const batchHardenPath = hardenPaths || hardenPath?.batch;
+	if (!backupPath || typeof openDriver !== 'function' || !fs.existsSync(backupPath)) {
+		throw new ClaimRepairError('CLAIM_REPAIR_BACKUP_REQUIRED', 'A readable separate SQLite backup is required');
+	}
+	if (typeof hardenPath !== 'function') {
+		throw new ClaimRepairError(
+			'CLAIM_REPAIR_BACKUP_PERMISSIONS',
+			'Backup verification requires a platform permission hardener',
+		);
+	}
+	const restoreDir = fs.mkdtempSync(path.join(os.tmpdir(), 'forge-claim-restore-proof-'));
+	const restorePath = path.join(restoreDir, 'kernel.restored.sqlite');
+	let restoreDriver;
+	try {
+		if (typeof batchHardenPath === 'function') await batchHardenPath([backupPath, restoreDir]);
+		else {
+			await hardenPath(backupPath);
+			await hardenPath(restoreDir);
+		}
+		for (const suffix of ['-wal', '-shm', '-journal']) {
+			if (fs.existsSync(`${backupPath}${suffix}`)) {
+				throw new ClaimRepairError('CLAIM_REPAIR_BACKUP_DRIFT', 'Backup sidecars are not allowed during restore proof');
+			}
+		}
+		await prepareRestoreProofSnapshot(backupPath, restoreDir, restorePath, {
+			hardenPath,
+			hardenPaths: batchHardenPath,
+			restoreDirHardened: typeof batchHardenPath === 'function',
+		});
+		restoreDriver = openDriver(restorePath);
+		const restored = await restoreDriver.preflightLegacyClaimRepair({ observedAt });
+		const restoredHash = await hashFile(restorePath);
+		const currentBackupHash = await hashFile(backupPath);
+		if (currentBackupHash !== restoredHash) {
+			throw new ClaimRepairError(
+				'CLAIM_REPAIR_BACKUP_DRIFT',
+				'Backup changed while its isolated restore proof was being verified',
+			);
+		}
+		return Object.freeze({
+			schema_version: 'forge.claim-repair.backup-proof.v1',
+			integrity: 'ok',
+			backup_sha256: restoredHash,
+			plan_digest: restored.digest,
+			restore_digest: restored.digest,
+		});
+	} finally {
+		if (restoreDriver && typeof restoreDriver.close === 'function') restoreDriver.close();
+		cleanupRestoreProofDirectory(restoreDir);
+	}
+}
+
+async function createVerifiedClaimRepairBackup(options = {}) {
+	const { sourceDriver, backupPath, observedAt, openDriver, hardenPath, hardenPaths } = options;
+	if (!sourceDriver || typeof sourceDriver.preflightLegacyClaimRepair !== 'function'
+		|| typeof sourceDriver.backup !== 'function') {
+		throw new ClaimRepairError('CLAIM_REPAIR_BACKUP_UNAVAILABLE', 'Source driver cannot create a verified SQLite backup');
+	}
+	if (!backupPath) {
+		throw new ClaimRepairError('CLAIM_REPAIR_BACKUP_REQUIRED', 'A separate SQLite backup path is required');
+	}
+	if (fs.existsSync(backupPath)) {
+		throw new ClaimRepairError(
+			'CLAIM_REPAIR_BACKUP_EXISTS',
+			'Refusing to overwrite an existing claim-repair backup; choose a new immutable path',
+		);
+	}
+	const source = await sourceDriver.preflightLegacyClaimRepair({ observedAt });
+	try {
+		await sourceDriver.backup(backupPath, {}, { noReplace: true });
+	} catch (error) {
+		if (error?.code === 'EEXIST') {
+			throw new ClaimRepairError(
+				'CLAIM_REPAIR_BACKUP_EXISTS',
+				'Refusing to overwrite a claim-repair backup path created during publication',
+			);
+		}
+		throw error;
+	}
+	const proof = await verifyClaimRepairBackup({ backupPath, observedAt, openDriver, hardenPath, hardenPaths });
+	if (proof.restore_digest !== source.digest) {
+		throw new ClaimRepairError(
+			'CLAIM_REPAIR_BACKUP_DRIFT',
+			'Backup does not restore to the exact preflight snapshot digest',
+		);
+	}
+	return Object.freeze({ ...proof, plan_digest: source.digest });
+}
+
+module.exports = {
+	CLAIM_STATES,
+	ClaimRepairError,
+	buildClaimRepairPlan,
+	cleanupRestoreProofDirectory,
+	createVerifiedClaimRepairBackup,
+	prepareRestoreProofSnapshot,
+	publicClaimRepairPreflight,
+	verifyClaimRepairBackup,
+};

package/lib/kernel/live-claim-projection.js

@@ -0,0 +1,26 @@
+'use strict';
+
+const { isLeaseExpired, isValidExpiresAt } = require('./lease-enforcer');
+const { isTerminalStatus } = require('./taxonomy-validator');
+
+// One authority definition for every user-facing lease projection. Null expiry is
+// the compatibility form for a durable lease; malformed expiry cannot prove liveness.
+function isLiveClaim(claim, issue, now) {
+	if (!claim || !issue) return false;
+	if (claim.state !== 'active') return false;
+	if (isTerminalStatus(issue.status)) return false;
+	if (!isValidExpiresAt(claim.expires_at)) return false;
+	return !isLeaseExpired(claim, now);
+}
+
+function projectLiveClaims(claims, issues, now) {
+	const claimRows = claims ?? [];
+	const issueRows = issues ?? [];
+	const issuesById = new Map(issueRows.map(issue => [issue.id, issue]));
+	return claimRows.filter(claim => isLiveClaim(claim, issuesById.get(claim.issue_id), now));
+}
+
+module.exports = {
+	isLiveClaim,
+	projectLiveClaims,
+};

package/lib/kernel/migrations.js

@@ -1,4 +1,5 @@
 const { getKernelSchema, validateKernelSchema } = require('./schema');
+const { USAGE_EVIDENCE_MIGRATION } = require('../../packages/memory');
 
 function assertIdentifier(identifier, label) {
 	if (!/^[a-z][a-z0-9_]*$/.test(identifier)) {
@@ -24,12 +25,21 @@ function renderColumn(field) {
 	if (field.primaryKey) parts.push('PRIMARY KEY');
 	if (field.default !== undefined) parts.push(`DEFAULT ${field.default}`);
 	if (field.references) parts.push(renderReference(field.references));
+	if (field.check) parts.push(`CHECK (${field.check})`);
 	return parts.join(' ');
 }
 
 function renderCreateTable(table) {
 	assertIdentifier(table.sqlName, 'table');
-	const columns = table.fields.map(field => `  ${renderColumn(field)}`).join(',\n');
+	const definitions = table.fields.map(field => `  ${renderColumn(field)}`);
+	if (table.primaryKey) {
+		const columns = table.primaryKey.map(column => {
+			assertIdentifier(column, 'primary key column');
+			return column;
+		}).join(', ');
+		definitions.push(`  PRIMARY KEY (${columns})`);
+	}
+	const columns = definitions.join(',\n');
 	return `CREATE TABLE IF NOT EXISTS ${table.sqlName} (\n${columns}\n);`;
 }
 
@@ -57,8 +67,13 @@ function renderDropTable(table) {
 // stays the full current schema; the named tables are filtered out of 001 so they are
 // created exactly once by their dedicated migration (both on a fresh DB and, via the
 // ledger, on an existing DB). KEEP IN SYNC with every new table-creating migration.
-//   memories → 005 ; pr → 009
-const MIGRATION_ADDED_TABLES = ['memories', 'pr'];
+//   memories → 005 ; pr → 009 ; PR watch ownership → 012
+const MIGRATION_ADDED_TABLES = [
+	'memories',
+	'pr',
+	'pr_watch_owners',
+	'pr_watch_migration_gate',
+];
 
 function getInitialKernelSchema() {
 	const schema = getKernelSchema();
@@ -304,6 +319,100 @@ function buildPrLinkageMigration() {
 	};
 }
 
+// 010: Memory-owned durable monitor evidence. This is intentionally additive and
+// isolated from Kernel authority tables. Rollback is non-destructive: it turns off
+// new monitor writes while retaining every event, outbox row, receipt, and cursor.
+function buildMonitorDurabilityMigration() {
+	return {
+		id: '010_memory_monitor_durability',
+		apply: [
+			`CREATE TABLE IF NOT EXISTS memory_monitor_writer_state (
+  singleton INTEGER NOT NULL PRIMARY KEY CHECK (singleton = 1),
+  enabled INTEGER NOT NULL CHECK (enabled IN (0, 1))
+);`,
+			'INSERT OR IGNORE INTO memory_monitor_writer_state (singleton, enabled) VALUES (1, 1);',
+			`CREATE TABLE IF NOT EXISTS memory_monitor_events (
+  event_id TEXT NOT NULL PRIMARY KEY,
+  monitor_id TEXT NOT NULL,
+  sequence INTEGER NOT NULL,
+  content_hash TEXT NOT NULL,
+  envelope_json TEXT NOT NULL,
+  artifact_digest TEXT,
+  created_at TEXT NOT NULL,
+  UNIQUE (monitor_id, sequence)
+);`,
+			`CREATE TABLE IF NOT EXISTS memory_monitor_outbox (
+  id TEXT NOT NULL PRIMARY KEY,
+  event_id TEXT NOT NULL REFERENCES memory_monitor_events(event_id),
+  target TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending',
+  attempts INTEGER NOT NULL DEFAULT 0,
+  next_attempt_at TEXT,
+  created_at TEXT NOT NULL,
+  UNIQUE (event_id, target)
+);`,
+			`CREATE TABLE IF NOT EXISTS memory_monitor_delivery_receipts (
+  event_id TEXT NOT NULL REFERENCES memory_monitor_events(event_id),
+  target TEXT NOT NULL,
+  attempt INTEGER NOT NULL,
+  content_hash TEXT NOT NULL,
+  envelope_json TEXT NOT NULL,
+  acknowledged INTEGER NOT NULL,
+  delivered_at TEXT NOT NULL,
+  outcome TEXT NOT NULL,
+  PRIMARY KEY (event_id, target, attempt)
+);`,
+			`CREATE TABLE IF NOT EXISTS memory_monitor_cursors (
+  monitor_id TEXT NOT NULL,
+  target TEXT NOT NULL,
+  sequence INTEGER NOT NULL,
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (monitor_id, target)
+);`,
+			`CREATE TABLE IF NOT EXISTS memory_monitor_receipts (
+  monitor_id TEXT NOT NULL PRIMARY KEY,
+  content_hash TEXT NOT NULL,
+  envelope_json TEXT NOT NULL,
+  owner_run_id TEXT NOT NULL,
+  terminal_state TEXT NOT NULL,
+  last_sequence INTEGER NOT NULL,
+  evidence_digest TEXT NOT NULL,
+  undelivered_cursor INTEGER,
+  created_at TEXT NOT NULL
+);`,
+			'CREATE INDEX IF NOT EXISTS idx_memory_monitor_events_monitor_sequence ON memory_monitor_events (monitor_id, sequence);',
+			'CREATE INDEX IF NOT EXISTS idx_memory_monitor_outbox_pending ON memory_monitor_outbox (target, status, next_attempt_at, created_at);',
+			'CREATE INDEX IF NOT EXISTS idx_memory_monitor_delivery_receipts_event_target_attempt ON memory_monitor_delivery_receipts (event_id, target, attempt);',
+		],
+		rollback: [
+			'UPDATE memory_monitor_writer_state SET enabled = 0 WHERE singleton = 1;',
+		],
+	};
+}
+
+// 011: usage evidence is append-only and rollback-retained. The public Memory
+// contract owns the DDL; Kernel only places it in its ledgered migration sequence.
+function buildUsageEvidenceMigration() {
+	return {
+		id: USAGE_EVIDENCE_MIGRATION.id,
+		apply: [...USAGE_EVIDENCE_MIGRATION.apply],
+		rollback: [...USAGE_EVIDENCE_MIGRATION.rollback],
+	};
+}
+
+function buildPrWatchOwnershipMigration() {
+	const ownerTableNames = new Set(['pr_watch_owners', 'pr_watch_migration_gate']);
+	const tables = getKernelSchema().tables.filter(table => ownerTableNames.has(table.name));
+	const migration = buildSchemaMigration({ version: 1, tables });
+	return {
+		id: '012_kernel_pr_watch_ownership',
+		apply: migration.apply,
+		rollback: [
+			"INSERT INTO kernel_pr_watch_migration_gate (singleton, state, snapshot_hash, conflict_code, updated_at) VALUES (1, 'quarantined', NULL, NULL, strftime('%Y-%m-%dT%H:%M:%fZ', 'now')) ON CONFLICT(singleton) DO UPDATE SET state = 'quarantined', conflict_code = NULL, updated_at = excluded.updated_at;",
+		],
+	};
+}
+
 function validateKernelMigrations(migrations) {
 	const ids = new Set();
 	for (const migration of migrations) {
@@ -335,6 +444,9 @@ function buildKernelMigrationPlan(migrations = [
 	buildWorktreeLinkageColumnsMigration(),
 	buildMemoryFtsMigration(),
 	buildPrLinkageMigration(),
+	buildMonitorDurabilityMigration(),
+	buildUsageEvidenceMigration(),
+	buildPrWatchOwnershipMigration(),
 ]) {
 	validateKernelMigrations(migrations);
 
@@ -353,6 +465,9 @@ module.exports = {
 	buildKernelMigrationPlan,
 	buildMemoryFtsMigration,
 	buildMemoryProjectionMigration,
+	buildMonitorDurabilityMigration,
+	buildPrWatchOwnershipMigration,
+	buildUsageEvidenceMigration,
 	buildPrLinkageMigration,
 	buildSchemaMigration,
 	buildWorktreeLinkageColumnsMigration,