hippo-memory 1.14.0 → 1.15.0

package/dist/db.js

@@ -6,83 +6,83 @@ import { cleanupArchivedMirrors } from './raw-archive-mirror-cleanup.js';
 import { PACKAGE_VERSION, compareSemver } from './version.js';
 const require = createRequire(import.meta.url);
 const { DatabaseSync } = require('node:sqlite');
-const CURRENT_SCHEMA_VERSION = 29;
+const CURRENT_SCHEMA_VERSION = 30;
 const MIGRATIONS = [
     {
         version: 1,
         up: (db) => {
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS memories (
-          id TEXT PRIMARY KEY,
-          created TEXT NOT NULL,
-          last_retrieved TEXT NOT NULL,
-          retrieval_count INTEGER NOT NULL,
-          strength REAL NOT NULL,
-          half_life_days REAL NOT NULL,
-          layer TEXT NOT NULL,
-          tags_json TEXT NOT NULL,
-          emotional_valence TEXT NOT NULL,
-          schema_fit REAL NOT NULL,
-          source TEXT NOT NULL,
-          outcome_score REAL,
-          conflicts_with_json TEXT NOT NULL,
-          pinned INTEGER NOT NULL,
-          confidence TEXT NOT NULL,
-          content TEXT NOT NULL,
-          updated_at TEXT NOT NULL DEFAULT (datetime('now'))
-        );
-
-        CREATE INDEX IF NOT EXISTS idx_memories_layer_created ON memories(layer, created);
-        CREATE INDEX IF NOT EXISTS idx_memories_last_retrieved ON memories(last_retrieved);
-
-        CREATE TABLE IF NOT EXISTS consolidation_runs (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          timestamp TEXT NOT NULL,
-          decayed INTEGER NOT NULL,
-          merged INTEGER NOT NULL,
-          removed INTEGER NOT NULL
-        );
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS memories (
+          id TEXT PRIMARY KEY,
+          created TEXT NOT NULL,
+          last_retrieved TEXT NOT NULL,
+          retrieval_count INTEGER NOT NULL,
+          strength REAL NOT NULL,
+          half_life_days REAL NOT NULL,
+          layer TEXT NOT NULL,
+          tags_json TEXT NOT NULL,
+          emotional_valence TEXT NOT NULL,
+          schema_fit REAL NOT NULL,
+          source TEXT NOT NULL,
+          outcome_score REAL,
+          conflicts_with_json TEXT NOT NULL,
+          pinned INTEGER NOT NULL,
+          confidence TEXT NOT NULL,
+          content TEXT NOT NULL,
+          updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_memories_layer_created ON memories(layer, created);
+        CREATE INDEX IF NOT EXISTS idx_memories_last_retrieved ON memories(last_retrieved);
+
+        CREATE TABLE IF NOT EXISTS consolidation_runs (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          timestamp TEXT NOT NULL,
+          decayed INTEGER NOT NULL,
+          merged INTEGER NOT NULL,
+          removed INTEGER NOT NULL
+        );
       `);
         },
     },
     {
         version: 2,
         up: (db) => {
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS task_snapshots (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          task TEXT NOT NULL,
-          summary TEXT NOT NULL,
-          next_step TEXT NOT NULL,
-          status TEXT NOT NULL,
-          source TEXT NOT NULL,
-          created_at TEXT NOT NULL,
-          updated_at TEXT NOT NULL
-        );
-
-        CREATE INDEX IF NOT EXISTS idx_task_snapshots_status_updated
-        ON task_snapshots(status, updated_at DESC, id DESC);
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS task_snapshots (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          task TEXT NOT NULL,
+          summary TEXT NOT NULL,
+          next_step TEXT NOT NULL,
+          status TEXT NOT NULL,
+          source TEXT NOT NULL,
+          created_at TEXT NOT NULL,
+          updated_at TEXT NOT NULL
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_task_snapshots_status_updated
+        ON task_snapshots(status, updated_at DESC, id DESC);
       `);
         },
     },
     {
         version: 3,
         up: (db) => {
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS memory_conflicts (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          memory_a_id TEXT NOT NULL,
-          memory_b_id TEXT NOT NULL,
-          reason TEXT NOT NULL,
-          score REAL NOT NULL DEFAULT 0,
-          status TEXT NOT NULL,
-          detected_at TEXT NOT NULL,
-          updated_at TEXT NOT NULL,
-          UNIQUE(memory_a_id, memory_b_id)
-        );
-
-        CREATE INDEX IF NOT EXISTS idx_memory_conflicts_status_updated
-        ON memory_conflicts(status, updated_at DESC, id DESC);
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS memory_conflicts (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          memory_a_id TEXT NOT NULL,
+          memory_b_id TEXT NOT NULL,
+          reason TEXT NOT NULL,
+          score REAL NOT NULL DEFAULT 0,
+          status TEXT NOT NULL,
+          detected_at TEXT NOT NULL,
+          updated_at TEXT NOT NULL,
+          UNIQUE(memory_a_id, memory_b_id)
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_memory_conflicts_status_updated
+        ON memory_conflicts(status, updated_at DESC, id DESC);
       `);
         },
     },
@@ -92,67 +92,67 @@ const MIGRATIONS = [
             if (!tableHasColumn(db, 'task_snapshots', 'session_id')) {
                 db.exec(`ALTER TABLE task_snapshots ADD COLUMN session_id TEXT`);
             }
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS session_events (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          session_id TEXT NOT NULL,
-          task TEXT,
-          event_type TEXT NOT NULL,
-          content TEXT NOT NULL,
-          source TEXT NOT NULL,
-          metadata_json TEXT NOT NULL,
-          created_at TEXT NOT NULL
-        );
-
-        CREATE INDEX IF NOT EXISTS idx_session_events_session_created
-        ON session_events(session_id, created_at DESC, id DESC);
-
-        CREATE INDEX IF NOT EXISTS idx_session_events_task_created
-        ON session_events(task, created_at DESC, id DESC);
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS session_events (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          session_id TEXT NOT NULL,
+          task TEXT,
+          event_type TEXT NOT NULL,
+          content TEXT NOT NULL,
+          source TEXT NOT NULL,
+          metadata_json TEXT NOT NULL,
+          created_at TEXT NOT NULL
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_session_events_session_created
+        ON session_events(session_id, created_at DESC, id DESC);
+
+        CREATE INDEX IF NOT EXISTS idx_session_events_task_created
+        ON session_events(task, created_at DESC, id DESC);
       `);
         },
     },
     {
         version: 5,
         up: (db) => {
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS session_handoffs (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          session_id TEXT NOT NULL,
-          repo_root TEXT,
-          task_id TEXT,
-          summary TEXT NOT NULL,
-          next_action TEXT,
-          artifacts_json TEXT NOT NULL DEFAULT '[]',
-          created_at TEXT NOT NULL
-        );
-
-        CREATE INDEX IF NOT EXISTS idx_session_handoffs_session
-        ON session_handoffs(session_id, created_at DESC);
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS session_handoffs (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          session_id TEXT NOT NULL,
+          repo_root TEXT,
+          task_id TEXT,
+          summary TEXT NOT NULL,
+          next_action TEXT,
+          artifacts_json TEXT NOT NULL DEFAULT '[]',
+          created_at TEXT NOT NULL
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_session_handoffs_session
+        ON session_handoffs(session_id, created_at DESC);
       `);
         },
     },
     {
         version: 6,
         up: (db) => {
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS working_memory (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          scope TEXT NOT NULL,
-          session_id TEXT,
-          task_id TEXT,
-          importance REAL NOT NULL DEFAULT 0,
-          content TEXT NOT NULL,
-          metadata_json TEXT NOT NULL DEFAULT '{}',
-          created_at TEXT NOT NULL,
-          updated_at TEXT NOT NULL
-        );
-
-        CREATE INDEX IF NOT EXISTS idx_working_memory_scope
-        ON working_memory(scope, importance DESC, created_at DESC);
-
-        CREATE INDEX IF NOT EXISTS idx_working_memory_session
-        ON working_memory(session_id, created_at DESC);
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS working_memory (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          scope TEXT NOT NULL,
+          session_id TEXT,
+          task_id TEXT,
+          importance REAL NOT NULL DEFAULT 0,
+          content TEXT NOT NULL,
+          metadata_json TEXT NOT NULL DEFAULT '{}',
+          created_at TEXT NOT NULL,
+          updated_at TEXT NOT NULL
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_working_memory_scope
+        ON working_memory(scope, importance DESC, created_at DESC);
+
+        CREATE INDEX IF NOT EXISTS idx_working_memory_session
+        ON working_memory(session_id, created_at DESC);
       `);
         },
     },
@@ -193,9 +193,9 @@ const MIGRATIONS = [
             if (!tableHasColumn(db, 'memories', 'source_session_id')) {
                 db.exec(`ALTER TABLE memories ADD COLUMN source_session_id TEXT`);
             }
-            db.exec(`
-        CREATE INDEX IF NOT EXISTS idx_memories_source_session_id
-        ON memories(source_session_id) WHERE source_session_id IS NOT NULL
+            db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_memories_source_session_id
+        ON memories(source_session_id) WHERE source_session_id IS NOT NULL
       `);
         },
     },
@@ -257,44 +257,44 @@ const MIGRATIONS = [
             db.exec(`UPDATE memories SET kind = 'superseded' WHERE kind IS NULL AND superseded_by IS NOT NULL`);
             db.exec(`UPDATE memories SET kind = 'distilled' WHERE kind IS NULL`);
             // raw_archive: legitimate path for kind='raw' removal (used by archiveRawMemory).
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS raw_archive (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          memory_id TEXT NOT NULL,
-          archived_at TEXT NOT NULL,
-          reason TEXT NOT NULL,
-          archived_by TEXT,
-          payload_json TEXT NOT NULL
-        )
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS raw_archive (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          memory_id TEXT NOT NULL,
+          archived_at TEXT NOT NULL,
+          reason TEXT NOT NULL,
+          archived_by TEXT,
+          payload_json TEXT NOT NULL
+        )
       `);
             db.exec(`CREATE INDEX IF NOT EXISTS idx_raw_archive_memory_id ON raw_archive(memory_id)`);
             // Append-only invariant: kind='raw' rows cannot be deleted directly.
             // Use raw_archive flow: archive-then-update-then-delete (see src/raw-archive.ts).
-            db.exec(`
-        CREATE TRIGGER IF NOT EXISTS trg_memories_raw_append_only
-        BEFORE DELETE ON memories
-        WHEN OLD.kind = 'raw'
-        BEGIN
-          SELECT RAISE(ABORT, 'raw is append-only');
-        END
+            db.exec(`
+        CREATE TRIGGER IF NOT EXISTS trg_memories_raw_append_only
+        BEFORE DELETE ON memories
+        WHEN OLD.kind = 'raw'
+        BEGIN
+          SELECT RAISE(ABORT, 'raw is append-only');
+        END
       `);
             // CHECK substitute: ALTER TABLE cannot add CHECK, so enforce kind allowed-set
             // via INSERT/UPDATE triggers.
-            db.exec(`
-        CREATE TRIGGER IF NOT EXISTS trg_memories_kind_check_insert
-        BEFORE INSERT ON memories
-        WHEN NEW.kind IS NOT NULL AND NEW.kind NOT IN ('raw','distilled','superseded','archived')
-        BEGIN
-          SELECT RAISE(ABORT, 'invalid kind: must be raw|distilled|superseded|archived');
-        END
+            db.exec(`
+        CREATE TRIGGER IF NOT EXISTS trg_memories_kind_check_insert
+        BEFORE INSERT ON memories
+        WHEN NEW.kind IS NOT NULL AND NEW.kind NOT IN ('raw','distilled','superseded','archived')
+        BEGIN
+          SELECT RAISE(ABORT, 'invalid kind: must be raw|distilled|superseded|archived');
+        END
       `);
-            db.exec(`
-        CREATE TRIGGER IF NOT EXISTS trg_memories_kind_check_update
-        BEFORE UPDATE ON memories
-        WHEN NEW.kind IS NOT NULL AND NEW.kind NOT IN ('raw','distilled','superseded','archived')
-        BEGIN
-          SELECT RAISE(ABORT, 'invalid kind: must be raw|distilled|superseded|archived');
-        END
+            db.exec(`
+        CREATE TRIGGER IF NOT EXISTS trg_memories_kind_check_update
+        BEFORE UPDATE ON memories
+        WHEN NEW.kind IS NOT NULL AND NEW.kind NOT IN ('raw','distilled','superseded','archived')
+        BEGIN
+          SELECT RAISE(ABORT, 'invalid kind: must be raw|distilled|superseded|archived');
+        END
       `);
         },
     },
@@ -312,30 +312,30 @@ const MIGRATIONS = [
             //     allowed (different timestamps).
             db.exec(`DROP TRIGGER IF EXISTS trg_memories_kind_check_insert`);
             db.exec(`DROP TRIGGER IF EXISTS trg_memories_kind_check_update`);
-            db.exec(`
-        CREATE TRIGGER trg_memories_kind_check_insert
-        BEFORE INSERT ON memories
-        WHEN NEW.kind IS NULL OR NEW.kind NOT IN ('raw','distilled','superseded','archived')
-        BEGIN
-          SELECT RAISE(ABORT, 'invalid kind: must be raw|distilled|superseded|archived (not null)');
-        END
+            db.exec(`
+        CREATE TRIGGER trg_memories_kind_check_insert
+        BEFORE INSERT ON memories
+        WHEN NEW.kind IS NULL OR NEW.kind NOT IN ('raw','distilled','superseded','archived')
+        BEGIN
+          SELECT RAISE(ABORT, 'invalid kind: must be raw|distilled|superseded|archived (not null)');
+        END
       `);
-            db.exec(`
-        CREATE TRIGGER trg_memories_kind_check_update
-        BEFORE UPDATE ON memories
-        WHEN NEW.kind IS NULL OR NEW.kind NOT IN ('raw','distilled','superseded','archived')
-        BEGIN
-          SELECT RAISE(ABORT, 'invalid kind: must be raw|distilled|superseded|archived (not null)');
-        END
+            db.exec(`
+        CREATE TRIGGER trg_memories_kind_check_update
+        BEFORE UPDATE ON memories
+        WHEN NEW.kind IS NULL OR NEW.kind NOT IN ('raw','distilled','superseded','archived')
+        BEGIN
+          SELECT RAISE(ABORT, 'invalid kind: must be raw|distilled|superseded|archived (not null)');
+        END
       `);
             // Defensive: any rows that somehow have NULL kind get fixed (shouldn't exist post-v14
             // backfill, but cheap insurance).
             db.exec(`UPDATE memories SET kind = 'distilled' WHERE kind IS NULL`);
             // raw_archive uniqueness. SQLite cannot ADD CONSTRAINT, but a partial unique index
             // on (memory_id, archived_at) is equivalent for INSERT-time enforcement.
-            db.exec(`
-        CREATE UNIQUE INDEX IF NOT EXISTS idx_raw_archive_id_at
-        ON raw_archive(memory_id, archived_at)
+            db.exec(`
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_raw_archive_id_at
+        ON raw_archive(memory_id, archived_at)
       `);
         },
     },
@@ -369,31 +369,31 @@ const MIGRATIONS = [
             // A5 stub auth: api_keys (scrypt-hashed; plaintext returned to caller exactly once)
             // and audit_log (append-only mutation trail). Both carry tenant_id from day 1 so
             // future multi-tenant enforcement is a config flip, not a re-migration.
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS api_keys (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          key_id TEXT UNIQUE NOT NULL,
-          key_hash TEXT NOT NULL,
-          tenant_id TEXT NOT NULL DEFAULT 'default',
-          label TEXT,
-          created_at TEXT NOT NULL,
-          revoked_at TEXT
-        )
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS api_keys (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          key_id TEXT UNIQUE NOT NULL,
+          key_hash TEXT NOT NULL,
+          tenant_id TEXT NOT NULL DEFAULT 'default',
+          label TEXT,
+          created_at TEXT NOT NULL,
+          revoked_at TEXT
+        )
       `);
-            db.exec(`
-        CREATE INDEX IF NOT EXISTS idx_api_keys_tenant_active
-        ON api_keys(tenant_id) WHERE revoked_at IS NULL
+            db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_api_keys_tenant_active
+        ON api_keys(tenant_id) WHERE revoked_at IS NULL
       `);
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS audit_log (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          ts TEXT NOT NULL,
-          tenant_id TEXT NOT NULL DEFAULT 'default',
-          actor TEXT NOT NULL,
-          op TEXT NOT NULL,
-          target_id TEXT,
-          metadata_json TEXT NOT NULL DEFAULT '{}'
-        )
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS audit_log (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          ts TEXT NOT NULL,
+          tenant_id TEXT NOT NULL DEFAULT 'default',
+          actor TEXT NOT NULL,
+          op TEXT NOT NULL,
+          target_id TEXT,
+          metadata_json TEXT NOT NULL DEFAULT '{}'
+        )
       `);
             db.exec(`CREATE INDEX IF NOT EXISTS idx_audit_log_tenant_ts ON audit_log(tenant_id, ts DESC)`);
         },
@@ -403,102 +403,102 @@ const MIGRATIONS = [
         up: (db) => {
             // E1.3 Slack ingestion: idempotency log, per-channel backfill cursors, DLQ.
             // See docs/plans/2026-04-29-e1.3-slack-ingestion.md.
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS slack_event_log (
-          event_id TEXT PRIMARY KEY,
-          ingested_at TEXT NOT NULL,
-          memory_id TEXT
-        )
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS slack_event_log (
+          event_id TEXT PRIMARY KEY,
+          ingested_at TEXT NOT NULL,
+          memory_id TEXT
+        )
       `);
             db.exec(`CREATE INDEX IF NOT EXISTS idx_slack_event_log_memory ON slack_event_log(memory_id) WHERE memory_id IS NOT NULL`);
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS slack_cursors (
-          tenant_id TEXT NOT NULL,
-          channel_id TEXT NOT NULL,
-          latest_ts TEXT NOT NULL,
-          updated_at TEXT NOT NULL,
-          PRIMARY KEY (tenant_id, channel_id)
-        )
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS slack_cursors (
+          tenant_id TEXT NOT NULL,
+          channel_id TEXT NOT NULL,
+          latest_ts TEXT NOT NULL,
+          updated_at TEXT NOT NULL,
+          PRIMARY KEY (tenant_id, channel_id)
+        )
       `);
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS slack_dlq (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          tenant_id TEXT NOT NULL,
-          raw_payload TEXT NOT NULL,
-          error TEXT NOT NULL,
-          received_at TEXT NOT NULL,
-          retried_at TEXT
-        )
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS slack_dlq (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          tenant_id TEXT NOT NULL,
+          raw_payload TEXT NOT NULL,
+          error TEXT NOT NULL,
+          received_at TEXT NOT NULL,
+          retried_at TEXT
+        )
       `);
             db.exec(`CREATE INDEX IF NOT EXISTS idx_slack_dlq_tenant_received ON slack_dlq(tenant_id, received_at)`);
             // Multi-tenant routing seam (review patch #6). Empty by default — single-
             // tenant deployments resolve via HIPPO_TENANT fallback. Multi-workspace
             // deployments populate this table to map team_id → tenant_id.
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS slack_workspaces (
-          team_id TEXT PRIMARY KEY,
-          tenant_id TEXT NOT NULL,
-          added_at TEXT NOT NULL
-        )
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS slack_workspaces (
+          team_id TEXT PRIMARY KEY,
+          tenant_id TEXT NOT NULL,
+          added_at TEXT NOT NULL
+        )
       `);
         },
     },
     {
         version: 18,
         up: (db) => {
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS goal_stack (
-          id TEXT PRIMARY KEY,
-          session_id TEXT NOT NULL,
-          tenant_id TEXT NOT NULL DEFAULT 'default',
-          goal_name TEXT NOT NULL,
-          level INTEGER NOT NULL DEFAULT 0
-            CHECK (level BETWEEN 0 AND 2),
-          parent_goal_id TEXT REFERENCES goal_stack(id) ON DELETE SET NULL,
-          status TEXT NOT NULL CHECK (status IN ('active','suspended','completed')),
-          success_condition TEXT,
-          retrieval_policy_id TEXT,
-          created_at TEXT NOT NULL,
-          completed_at TEXT,
-          outcome_score REAL
-            CHECK (outcome_score IS NULL OR (outcome_score >= 0 AND outcome_score <= 1))
-        );
-
-        CREATE INDEX IF NOT EXISTS idx_goal_stack_tenant_session_status
-          ON goal_stack(tenant_id, session_id, status, created_at);
-
-        CREATE TABLE IF NOT EXISTS retrieval_policy (
-          id TEXT PRIMARY KEY,
-          goal_id TEXT NOT NULL REFERENCES goal_stack(id) ON DELETE CASCADE,
-          policy_type TEXT NOT NULL CHECK (policy_type IN
-            ('schema-fit-biased','error-prioritized','recency-first','hybrid')),
-          weight_schema_fit REAL NOT NULL DEFAULT 1.0
-            CHECK (weight_schema_fit >= 0 AND weight_schema_fit <= 100),
-          weight_recency REAL NOT NULL DEFAULT 1.0
-            CHECK (weight_recency >= 0 AND weight_recency <= 100),
-          weight_outcome REAL NOT NULL DEFAULT 1.0
-            CHECK (weight_outcome >= 0 AND weight_outcome <= 100),
-          error_priority REAL NOT NULL DEFAULT 1.0
-            CHECK (error_priority >= 0 AND error_priority <= 100)
-        );
-
-        CREATE INDEX IF NOT EXISTS idx_retrieval_policy_goal
-          ON retrieval_policy(goal_id);
-
-        CREATE TABLE IF NOT EXISTS goal_recall_log (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          goal_id TEXT NOT NULL REFERENCES goal_stack(id) ON DELETE CASCADE,
-          memory_id TEXT NOT NULL REFERENCES memories(id) ON DELETE CASCADE,
-          tenant_id TEXT NOT NULL DEFAULT 'default',
-          session_id TEXT NOT NULL,
-          recalled_at TEXT NOT NULL,
-          score REAL NOT NULL
-        );
-
-        CREATE INDEX IF NOT EXISTS idx_goal_recall_log_goal
-          ON goal_recall_log(goal_id);
-        CREATE UNIQUE INDEX IF NOT EXISTS uniq_goal_recall_log_memory_goal
-          ON goal_recall_log(memory_id, goal_id);
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS goal_stack (
+          id TEXT PRIMARY KEY,
+          session_id TEXT NOT NULL,
+          tenant_id TEXT NOT NULL DEFAULT 'default',
+          goal_name TEXT NOT NULL,
+          level INTEGER NOT NULL DEFAULT 0
+            CHECK (level BETWEEN 0 AND 2),
+          parent_goal_id TEXT REFERENCES goal_stack(id) ON DELETE SET NULL,
+          status TEXT NOT NULL CHECK (status IN ('active','suspended','completed')),
+          success_condition TEXT,
+          retrieval_policy_id TEXT,
+          created_at TEXT NOT NULL,
+          completed_at TEXT,
+          outcome_score REAL
+            CHECK (outcome_score IS NULL OR (outcome_score >= 0 AND outcome_score <= 1))
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_goal_stack_tenant_session_status
+          ON goal_stack(tenant_id, session_id, status, created_at);
+
+        CREATE TABLE IF NOT EXISTS retrieval_policy (
+          id TEXT PRIMARY KEY,
+          goal_id TEXT NOT NULL REFERENCES goal_stack(id) ON DELETE CASCADE,
+          policy_type TEXT NOT NULL CHECK (policy_type IN
+            ('schema-fit-biased','error-prioritized','recency-first','hybrid')),
+          weight_schema_fit REAL NOT NULL DEFAULT 1.0
+            CHECK (weight_schema_fit >= 0 AND weight_schema_fit <= 100),
+          weight_recency REAL NOT NULL DEFAULT 1.0
+            CHECK (weight_recency >= 0 AND weight_recency <= 100),
+          weight_outcome REAL NOT NULL DEFAULT 1.0
+            CHECK (weight_outcome >= 0 AND weight_outcome <= 100),
+          error_priority REAL NOT NULL DEFAULT 1.0
+            CHECK (error_priority >= 0 AND error_priority <= 100)
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_retrieval_policy_goal
+          ON retrieval_policy(goal_id);
+
+        CREATE TABLE IF NOT EXISTS goal_recall_log (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          goal_id TEXT NOT NULL REFERENCES goal_stack(id) ON DELETE CASCADE,
+          memory_id TEXT NOT NULL REFERENCES memories(id) ON DELETE CASCADE,
+          tenant_id TEXT NOT NULL DEFAULT 'default',
+          session_id TEXT NOT NULL,
+          recalled_at TEXT NOT NULL,
+          score REAL NOT NULL
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_goal_recall_log_goal
+          ON goal_recall_log(goal_id);
+        CREATE UNIQUE INDEX IF NOT EXISTS uniq_goal_recall_log_memory_goal
+          ON goal_recall_log(memory_id, goal_id);
       `);
         },
     },
@@ -595,27 +595,27 @@ const MIGRATIONS = [
             // EXISTS bodies before ALTERing. A silent skip would otherwise stamp
             // schema_version=22 on a DB missing the underlying tables, leaving
             // them permanently absent.
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS session_events (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          session_id TEXT NOT NULL,
-          task TEXT,
-          event_type TEXT NOT NULL,
-          content TEXT NOT NULL,
-          source TEXT NOT NULL,
-          metadata_json TEXT NOT NULL,
-          created_at TEXT NOT NULL
-        );
-        CREATE TABLE IF NOT EXISTS session_handoffs (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          session_id TEXT NOT NULL,
-          repo_root TEXT,
-          task_id TEXT,
-          summary TEXT NOT NULL,
-          next_action TEXT,
-          artifacts_json TEXT NOT NULL DEFAULT '[]',
-          created_at TEXT NOT NULL
-        );
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS session_events (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          session_id TEXT NOT NULL,
+          task TEXT,
+          event_type TEXT NOT NULL,
+          content TEXT NOT NULL,
+          source TEXT NOT NULL,
+          metadata_json TEXT NOT NULL,
+          created_at TEXT NOT NULL
+        );
+        CREATE TABLE IF NOT EXISTS session_handoffs (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          session_id TEXT NOT NULL,
+          repo_root TEXT,
+          task_id TEXT,
+          summary TEXT NOT NULL,
+          next_action TEXT,
+          artifacts_json TEXT NOT NULL DEFAULT '[]',
+          created_at TEXT NOT NULL
+        );
       `);
             if (!tableHasColumn(db, 'session_events', 'tenant_id')) {
                 db.exec(`ALTER TABLE session_events ADD COLUMN tenant_id TEXT NOT NULL DEFAULT 'default'`);
@@ -635,25 +635,25 @@ const MIGRATIONS = [
             // tenant boundaries on guesses. The COUNT(DISTINCT) gate is the load-
             // bearing check; without it, rows with multiple tenants under the same
             // session_id would silently pick whichever group came first.
-            db.exec(`
-        UPDATE session_events
-           SET tenant_id = (
-             SELECT MAX(t.tenant_id) FROM task_snapshots t
-              WHERE t.session_id = session_events.session_id
-           )
-         WHERE tenant_id = 'default'
-           AND (SELECT COUNT(DISTINCT t.tenant_id) FROM task_snapshots t
-                 WHERE t.session_id = session_events.session_id) = 1
+            db.exec(`
+        UPDATE session_events
+           SET tenant_id = (
+             SELECT MAX(t.tenant_id) FROM task_snapshots t
+              WHERE t.session_id = session_events.session_id
+           )
+         WHERE tenant_id = 'default'
+           AND (SELECT COUNT(DISTINCT t.tenant_id) FROM task_snapshots t
+                 WHERE t.session_id = session_events.session_id) = 1
       `);
-            db.exec(`
-        UPDATE session_handoffs
-           SET tenant_id = (
-             SELECT MAX(t.tenant_id) FROM task_snapshots t
-              WHERE t.session_id = session_handoffs.session_id
-           )
-         WHERE tenant_id = 'default'
-           AND (SELECT COUNT(DISTINCT t.tenant_id) FROM task_snapshots t
-                 WHERE t.session_id = session_handoffs.session_id) = 1
+            db.exec(`
+        UPDATE session_handoffs
+           SET tenant_id = (
+             SELECT MAX(t.tenant_id) FROM task_snapshots t
+              WHERE t.session_id = session_handoffs.session_id
+           )
+         WHERE tenant_id = 'default'
+           AND (SELECT COUNT(DISTINCT t.tenant_id) FROM task_snapshots t
+                 WHERE t.session_id = session_handoffs.session_id) = 1
       `);
             db.exec(`CREATE INDEX IF NOT EXISTS idx_session_events_tenant_session ON session_events(tenant_id, session_id, created_at DESC, id DESC)`);
             db.exec(`CREATE INDEX IF NOT EXISTS idx_session_handoffs_tenant_session ON session_handoffs(tenant_id, session_id, created_at DESC)`);
@@ -665,19 +665,19 @@ const MIGRATIONS = [
             // task_snapshots: add scope so all three continuity tables carry it.
             // Self-heal partial-init stores via CREATE TABLE IF NOT EXISTS (the v22
             // session_events / session_handoffs healing is upstream).
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS task_snapshots (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          task TEXT NOT NULL,
-          summary TEXT NOT NULL,
-          next_step TEXT NOT NULL,
-          status TEXT NOT NULL,
-          source TEXT NOT NULL,
-          session_id TEXT,
-          tenant_id TEXT NOT NULL DEFAULT 'default',
-          created_at TEXT NOT NULL,
-          updated_at TEXT NOT NULL
-        )
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS task_snapshots (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          task TEXT NOT NULL,
+          summary TEXT NOT NULL,
+          next_step TEXT NOT NULL,
+          status TEXT NOT NULL,
+          source TEXT NOT NULL,
+          session_id TEXT,
+          tenant_id TEXT NOT NULL DEFAULT 'default',
+          created_at TEXT NOT NULL,
+          updated_at TEXT NOT NULL
+        )
       `);
             if (!tableHasColumn(db, 'task_snapshots', 'scope')) {
                 db.exec(`ALTER TABLE task_snapshots ADD COLUMN scope TEXT`);
@@ -710,64 +710,64 @@ const MIGRATIONS = [
         up: (db) => {
             // v1.3.0 GitHub connector schema (codex round 1, 2026-05-04).
             // Six tables + a min_compatible_binary meta row for rollback safety.
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS github_event_log (
-          idempotency_key TEXT PRIMARY KEY,
-          delivery_id TEXT NOT NULL,
-          event_name TEXT NOT NULL,
-          ingested_at TEXT NOT NULL,
-          memory_id TEXT
-        )
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS github_event_log (
+          idempotency_key TEXT PRIMARY KEY,
+          delivery_id TEXT NOT NULL,
+          event_name TEXT NOT NULL,
+          ingested_at TEXT NOT NULL,
+          memory_id TEXT
+        )
       `);
             db.exec(`CREATE INDEX IF NOT EXISTS idx_github_event_log_memory ON github_event_log(memory_id) WHERE memory_id IS NOT NULL`);
             db.exec(`CREATE INDEX IF NOT EXISTS idx_github_event_log_delivery ON github_event_log(delivery_id)`);
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS github_cursors (
-          tenant_id TEXT NOT NULL,
-          repo_full_name TEXT NOT NULL,
-          issues_hwm TEXT,
-          issue_comments_hwm TEXT,
-          pr_review_comments_hwm TEXT,
-          updated_at TEXT NOT NULL,
-          PRIMARY KEY (tenant_id, repo_full_name)
-        )
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS github_cursors (
+          tenant_id TEXT NOT NULL,
+          repo_full_name TEXT NOT NULL,
+          issues_hwm TEXT,
+          issue_comments_hwm TEXT,
+          pr_review_comments_hwm TEXT,
+          updated_at TEXT NOT NULL,
+          PRIMARY KEY (tenant_id, repo_full_name)
+        )
       `);
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS github_dlq (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          tenant_id TEXT NOT NULL,
-          raw_payload TEXT NOT NULL,
-          error TEXT NOT NULL,
-          event_name TEXT,
-          delivery_id TEXT,
-          signature TEXT,
-          installation_id TEXT,
-          repo_full_name TEXT,
-          retry_count INTEGER NOT NULL DEFAULT 0,
-          received_at TEXT NOT NULL,
-          retried_at TEXT,
-          bucket TEXT NOT NULL DEFAULT 'parse_error'
-        )
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS github_dlq (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          tenant_id TEXT NOT NULL,
+          raw_payload TEXT NOT NULL,
+          error TEXT NOT NULL,
+          event_name TEXT,
+          delivery_id TEXT,
+          signature TEXT,
+          installation_id TEXT,
+          repo_full_name TEXT,
+          retry_count INTEGER NOT NULL DEFAULT 0,
+          received_at TEXT NOT NULL,
+          retried_at TEXT,
+          bucket TEXT NOT NULL DEFAULT 'parse_error'
+        )
       `);
             db.exec(`CREATE INDEX IF NOT EXISTS idx_github_dlq_tenant_received ON github_dlq(tenant_id, received_at)`);
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS github_installations (
-          installation_id TEXT PRIMARY KEY,
-          tenant_id TEXT NOT NULL,
-          added_at TEXT NOT NULL
-        )
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS github_installations (
+          installation_id TEXT PRIMARY KEY,
+          tenant_id TEXT NOT NULL,
+          added_at TEXT NOT NULL
+        )
       `);
             // PAT-mode multi-tenant routing (codex P0 #4). Maps repo_full_name to
             // tenant when the webhook envelope has no `installation` field. Composite
             // PK so the same repo can intentionally be visible to multiple tenants
             // (e.g., shared tooling accounts) — collision is on (repo, tenant) pair.
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS github_repositories (
-          repo_full_name TEXT NOT NULL,
-          tenant_id TEXT NOT NULL,
-          added_at TEXT NOT NULL,
-          PRIMARY KEY (repo_full_name, tenant_id)
-        )
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS github_repositories (
+          repo_full_name TEXT NOT NULL,
+          tenant_id TEXT NOT NULL,
+          added_at TEXT NOT NULL,
+          PRIMARY KEY (repo_full_name, tenant_id)
+        )
       `);
             // Rollback-safety guard (codex P0 #2). Any binary < 1.2.1 lacks the
             // generic *:private:* default-deny and would leak github:private:* rows
@@ -797,26 +797,26 @@ const MIGRATIONS = [
             // Backfill descendant_count for existing level-2 summary rows. Use
             // dag_parent_id pointing at the summary id. Level-3 (entity profiles)
             // not built today; their descendant_count stays at default 0.
-            db.exec(`
-        UPDATE memories
-           SET descendant_count = (
-             SELECT COUNT(*) FROM memories AS c WHERE c.dag_parent_id = memories.id
-           )
-         WHERE dag_level >= 2
-           AND descendant_count = 0
+            db.exec(`
+        UPDATE memories
+           SET descendant_count = (
+             SELECT COUNT(*) FROM memories AS c WHERE c.dag_parent_id = memories.id
+           )
+         WHERE dag_level >= 2
+           AND descendant_count = 0
       `);
             // Backfill earliest_at / latest_at from child created timestamps for
             // existing summaries. Children of a level-2 summary are level-1 facts.
-            db.exec(`
-        UPDATE memories
-           SET earliest_at = (
-             SELECT MIN(c.created) FROM memories AS c WHERE c.dag_parent_id = memories.id
-           ),
-               latest_at = (
-             SELECT MAX(c.created) FROM memories AS c WHERE c.dag_parent_id = memories.id
-           )
-         WHERE dag_level >= 2
-           AND earliest_at IS NULL
+            db.exec(`
+        UPDATE memories
+           SET earliest_at = (
+             SELECT MIN(c.created) FROM memories AS c WHERE c.dag_parent_id = memories.id
+           ),
+               latest_at = (
+             SELECT MAX(c.created) FROM memories AS c WHERE c.dag_parent_id = memories.id
+           )
+         WHERE dag_level >= 2
+           AND earliest_at IS NULL
       `);
         },
     },
@@ -859,32 +859,32 @@ const MIGRATIONS = [
             // bug, fixes anyone who has it. Includes the role column from the
             // start so it matches v26's intent without needing v26 to ALTER on
             // this heal path.
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS api_keys (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          key_id TEXT UNIQUE NOT NULL,
-          key_hash TEXT NOT NULL,
-          tenant_id TEXT NOT NULL DEFAULT 'default',
-          label TEXT,
-          created_at TEXT NOT NULL,
-          revoked_at TEXT,
-          role TEXT NOT NULL DEFAULT 'admin'
-        )
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS api_keys (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          key_id TEXT UNIQUE NOT NULL,
+          key_hash TEXT NOT NULL,
+          tenant_id TEXT NOT NULL DEFAULT 'default',
+          label TEXT,
+          created_at TEXT NOT NULL,
+          revoked_at TEXT,
+          role TEXT NOT NULL DEFAULT 'admin'
+        )
       `);
-            db.exec(`
-        CREATE INDEX IF NOT EXISTS idx_api_keys_tenant_active
-        ON api_keys(tenant_id) WHERE revoked_at IS NULL
+            db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_api_keys_tenant_active
+        ON api_keys(tenant_id) WHERE revoked_at IS NULL
       `);
-            db.exec(`
-        CREATE TABLE IF NOT EXISTS audit_log (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          ts TEXT NOT NULL,
-          tenant_id TEXT NOT NULL DEFAULT 'default',
-          actor TEXT NOT NULL,
-          op TEXT NOT NULL,
-          target_id TEXT,
-          metadata_json TEXT NOT NULL DEFAULT '{}'
-        )
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS audit_log (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          ts TEXT NOT NULL,
+          tenant_id TEXT NOT NULL DEFAULT 'default',
+          actor TEXT NOT NULL,
+          op TEXT NOT NULL,
+          target_id TEXT,
+          metadata_json TEXT NOT NULL DEFAULT '{}'
+        )
       `);
             db.exec(`CREATE INDEX IF NOT EXISTS idx_audit_log_tenant_ts ON audit_log(tenant_id, ts DESC)`);
             // Belt-and-braces: if api_keys existed before this migration WITHOUT
@@ -952,58 +952,142 @@ const MIGRATIONS = [
             // J3 computes accuracy (clean vs regressed) from (estimate_value,
             // actual_value) at query time.
             if (!tableExists(db, 'predictions')) {
-                db.exec(`
-          CREATE TABLE predictions (
-            id INTEGER PRIMARY KEY AUTOINCREMENT,
-            memory_id TEXT,
-            tenant_id TEXT NOT NULL,
-            class_tag TEXT NOT NULL,
-            claim_text TEXT NOT NULL,
-            estimate_value REAL,
-            estimate_unit TEXT,
-            target_date TEXT,
-            actual_value REAL,
-            closure_state TEXT NOT NULL DEFAULT 'open'
-              CHECK (closure_state IN ('open', 'closed', 'closed-unknown')),
-            closed_at TEXT,
-            closure_note TEXT,
-            created_at TEXT NOT NULL,
-            FOREIGN KEY (memory_id) REFERENCES memories(id) ON DELETE SET NULL
-          )
+                db.exec(`
+          CREATE TABLE predictions (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            memory_id TEXT,
+            tenant_id TEXT NOT NULL,
+            class_tag TEXT NOT NULL,
+            claim_text TEXT NOT NULL,
+            estimate_value REAL,
+            estimate_unit TEXT,
+            target_date TEXT,
+            actual_value REAL,
+            closure_state TEXT NOT NULL DEFAULT 'open'
+              CHECK (closure_state IN ('open', 'closed', 'closed-unknown')),
+            closed_at TEXT,
+            closure_note TEXT,
+            created_at TEXT NOT NULL,
+            FOREIGN KEY (memory_id) REFERENCES memories(id) ON DELETE SET NULL
+          )
         `);
-                db.exec(`
-          CREATE INDEX IF NOT EXISTS idx_predictions_tenant_class
-          ON predictions(tenant_id, class_tag, closure_state)
+                db.exec(`
+          CREATE INDEX IF NOT EXISTS idx_predictions_tenant_class
+          ON predictions(tenant_id, class_tag, closure_state)
         `);
-                db.exec(`
-          CREATE INDEX IF NOT EXISTS idx_predictions_memory
-          ON predictions(memory_id) WHERE memory_id IS NOT NULL
+                db.exec(`
+          CREATE INDEX IF NOT EXISTS idx_predictions_memory
+          ON predictions(memory_id) WHERE memory_id IS NOT NULL
         `);
                 // Cross-tenant safety: tenant_id must match the referenced memory's
                 // tenant_id when memory_id IS NOT NULL. INSERT + UPDATE pair, mirroring
                 // v14 memories.kind enforcement (db.ts:298-322).
-                db.exec(`
-          CREATE TRIGGER IF NOT EXISTS trg_predictions_tenant_match_insert
-          BEFORE INSERT ON predictions
-          WHEN NEW.memory_id IS NOT NULL
-          BEGIN
-            SELECT CASE
-              WHEN NEW.tenant_id != (SELECT tenant_id FROM memories WHERE id = NEW.memory_id)
-              THEN RAISE(ABORT, 'predictions.tenant_id must match memories.tenant_id for the referenced memory')
-            END;
-          END
+                db.exec(`
+          CREATE TRIGGER IF NOT EXISTS trg_predictions_tenant_match_insert
+          BEFORE INSERT ON predictions
+          WHEN NEW.memory_id IS NOT NULL
+          BEGIN
+            SELECT CASE
+              WHEN NEW.tenant_id != (SELECT tenant_id FROM memories WHERE id = NEW.memory_id)
+              THEN RAISE(ABORT, 'predictions.tenant_id must match memories.tenant_id for the referenced memory')
+            END;
+          END
         `);
-                db.exec(`
-          CREATE TRIGGER IF NOT EXISTS trg_predictions_tenant_match_update
-          BEFORE UPDATE ON predictions
-          WHEN NEW.memory_id IS NOT NULL
-            AND (NEW.memory_id IS NOT OLD.memory_id OR NEW.tenant_id IS NOT OLD.tenant_id)
-          BEGIN
-            SELECT CASE
-              WHEN NEW.tenant_id != (SELECT tenant_id FROM memories WHERE id = NEW.memory_id)
-              THEN RAISE(ABORT, 'predictions.tenant_id must match memories.tenant_id for the referenced memory')
-            END;
-          END
+                db.exec(`
+          CREATE TRIGGER IF NOT EXISTS trg_predictions_tenant_match_update
+          BEFORE UPDATE ON predictions
+          WHEN NEW.memory_id IS NOT NULL
+            AND (NEW.memory_id IS NOT OLD.memory_id OR NEW.tenant_id IS NOT OLD.tenant_id)
+          BEGIN
+            SELECT CASE
+              WHEN NEW.tenant_id != (SELECT tenant_id FROM memories WHERE id = NEW.memory_id)
+              THEN RAISE(ABORT, 'predictions.tenant_id must match memories.tenant_id for the referenced memory')
+            END;
+          END
+        `);
+            }
+        },
+    },
+    {
+        version: 30,
+        up: (db) => {
+            // E2 decision first-class object (docs/plans/2026-05-28-e2-decision-object.md).
+            // Promotes `hippo decide` from a tagged memory (which decayed on a 90-day
+            // half-life even while the decision was still in force) to a canonical
+            // decisions table that is the source of truth. The memory mirror is kept
+            // for recall but is no longer authoritative; memory_id is NULLABLE with
+            // ON DELETE SET NULL so forget/consolidate/archive does not lose a
+            // decision. Mirrors the v29 predictions tenant-match trigger pattern.
+            //
+            // status (active|superseded|closed): superseded carries a self-FK
+            // superseded_by to the successor decision; closed is a terminal
+            // retire-without-successor. A superseded_by same-tenant trigger makes
+            // cross-tenant supersession unrepresentable at the schema level.
+            if (!tableExists(db, 'decisions')) {
+                db.exec(`
+          CREATE TABLE decisions (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            memory_id TEXT,
+            tenant_id TEXT NOT NULL,
+            decision_text TEXT NOT NULL,
+            context TEXT,
+            status TEXT NOT NULL DEFAULT 'active'
+              CHECK (status IN ('active', 'superseded', 'closed')),
+            superseded_by INTEGER,
+            superseded_at TEXT,
+            closed_at TEXT,
+            created_at TEXT NOT NULL,
+            FOREIGN KEY (memory_id) REFERENCES memories(id) ON DELETE SET NULL,
+            FOREIGN KEY (superseded_by) REFERENCES decisions(id) ON DELETE SET NULL
+          )
+        `);
+                db.exec(`
+          CREATE INDEX IF NOT EXISTS idx_decisions_tenant_status
+          ON decisions(tenant_id, status)
+        `);
+                db.exec(`
+          CREATE INDEX IF NOT EXISTS idx_decisions_memory
+          ON decisions(memory_id) WHERE memory_id IS NOT NULL
+        `);
+                // Cross-tenant safety vs the referenced memory (mirrors predictions v29).
+                db.exec(`
+          CREATE TRIGGER IF NOT EXISTS trg_decisions_tenant_match_insert
+          BEFORE INSERT ON decisions
+          WHEN NEW.memory_id IS NOT NULL
+          BEGIN
+            SELECT CASE
+              WHEN NEW.tenant_id != (SELECT tenant_id FROM memories WHERE id = NEW.memory_id)
+              THEN RAISE(ABORT, 'decisions.tenant_id must match memories.tenant_id for the referenced memory')
+            END;
+          END
+        `);
+                db.exec(`
+          CREATE TRIGGER IF NOT EXISTS trg_decisions_tenant_match_update
+          BEFORE UPDATE ON decisions
+          WHEN NEW.memory_id IS NOT NULL
+            AND (NEW.memory_id IS NOT OLD.memory_id OR NEW.tenant_id IS NOT OLD.tenant_id)
+          BEGIN
+            SELECT CASE
+              WHEN NEW.tenant_id != (SELECT tenant_id FROM memories WHERE id = NEW.memory_id)
+              THEN RAISE(ABORT, 'decisions.tenant_id must match memories.tenant_id for the referenced memory')
+            END;
+          END
+        `);
+                // Cross-tenant safety vs the successor decision (self-FK). superseded_by
+                // is set only via UPDATE (the supersede path); the successor must share
+                // the tenant. The successor row already exists in the same transaction
+                // when this fires, so the subquery resolves.
+                db.exec(`
+          CREATE TRIGGER IF NOT EXISTS trg_decisions_supersede_tenant_match_update
+          BEFORE UPDATE ON decisions
+          WHEN NEW.superseded_by IS NOT NULL
+            AND NEW.superseded_by IS NOT OLD.superseded_by
+          BEGIN
+            SELECT CASE
+              WHEN NEW.tenant_id != (SELECT tenant_id FROM decisions WHERE id = NEW.superseded_by)
+              THEN RAISE(ABORT, 'decisions.superseded_by must reference a decision in the same tenant')
+            END;
+          END
         `);
             }
         },
@@ -1101,11 +1185,11 @@ function runMigrations(db) {
     ensureOptionalFts(db);
 }
 function ensureMetaTable(db) {
-    db.exec(`
-    CREATE TABLE IF NOT EXISTS meta (
-      key TEXT PRIMARY KEY,
-      value TEXT NOT NULL
-    );
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS meta (
+      key TEXT PRIMARY KEY,
+      value TEXT NOT NULL
+    );
   `);
 }
 export function getSchemaVersion(db) {
@@ -1148,17 +1232,17 @@ function backfillFtsIndex(db) {
     const ftsCount = db.prepare(`SELECT COUNT(*) AS c FROM memories_fts`).get()?.c ?? 0;
     if (memCount === ftsCount)
         return;
-    db.exec(`
-    INSERT INTO memories_fts(id, content, tags)
-    SELECT m.id, m.content, m.tags_json
-    FROM memories m
-    WHERE NOT EXISTS (
-      SELECT 1 FROM memories_fts f WHERE f.id = m.id
-    )
+    db.exec(`
+    INSERT INTO memories_fts(id, content, tags)
+    SELECT m.id, m.content, m.tags_json
+    FROM memories m
+    WHERE NOT EXISTS (
+      SELECT 1 FROM memories_fts f WHERE f.id = m.id
+    )
   `);
-    db.exec(`
-    DELETE FROM memories_fts
-    WHERE id NOT IN (SELECT id FROM memories)
+    db.exec(`
+    DELETE FROM memories_fts
+    WHERE id NOT IN (SELECT id FROM memories)
   `);
 }
 export function closeHippoDb(db) {
@@ -1175,13 +1259,13 @@ export function isFtsAvailable(db) {
     return getMeta(db, 'fts5_available', '0') === '1';
 }
 export function pruneConsolidationRuns(db, keep = 50) {
-    db.prepare(`
-    DELETE FROM consolidation_runs
-    WHERE id NOT IN (
-      SELECT id FROM consolidation_runs
-      ORDER BY timestamp DESC, id DESC
-      LIMIT ?
-    )
+    db.prepare(`
+    DELETE FROM consolidation_runs
+    WHERE id NOT IN (
+      SELECT id FROM consolidation_runs
+      ORDER BY timestamp DESC, id DESC
+      LIMIT ?
+    )
   `).run(keep);
 }
 //# sourceMappingURL=db.js.map