hippo-memory 1.60.0 → 1.61.0

package/dist/db/migrations/v25.js

@@ -0,0 +1,46 @@
+import { tableHasColumn } from '../tables.js';
+export const v25 = {
+    version: 25,
+    up: (db) => {
+        // v1.5.0 DAG-aware recall — cache summary metadata so the assembler can
+        // reason about scope without re-walking the DAG. Three additive,
+        // optional columns. No min_compatible_binary bump: these columns are
+        // pure metadata; older binaries opening this DB will see them as NULL
+        // / 0 and behave as before. See docs/plans/2026-05-05-dag-recall.md
+        // Task 1.
+        if (!tableHasColumn(db, 'memories', 'descendant_count')) {
+            db.exec(`ALTER TABLE memories ADD COLUMN descendant_count INTEGER NOT NULL DEFAULT 0`);
+        }
+        if (!tableHasColumn(db, 'memories', 'earliest_at')) {
+            db.exec(`ALTER TABLE memories ADD COLUMN earliest_at TEXT`);
+        }
+        if (!tableHasColumn(db, 'memories', 'latest_at')) {
+            db.exec(`ALTER TABLE memories ADD COLUMN latest_at TEXT`);
+        }
+        // Backfill descendant_count for existing level-2 summary rows. Use
+        // dag_parent_id pointing at the summary id. Level-3 (entity profiles)
+        // not built today; their descendant_count stays at default 0.
+        db.exec(`
+        UPDATE memories
+           SET descendant_count = (
+             SELECT COUNT(*) FROM memories AS c WHERE c.dag_parent_id = memories.id
+           )
+         WHERE dag_level >= 2
+           AND descendant_count = 0
+      `);
+        // Backfill earliest_at / latest_at from child created timestamps for
+        // existing summaries. Children of a level-2 summary are level-1 facts.
+        db.exec(`
+        UPDATE memories
+           SET earliest_at = (
+             SELECT MIN(c.created) FROM memories AS c WHERE c.dag_parent_id = memories.id
+           ),
+               latest_at = (
+             SELECT MAX(c.created) FROM memories AS c WHERE c.dag_parent_id = memories.id
+           )
+         WHERE dag_level >= 2
+           AND earliest_at IS NULL
+      `);
+    },
+};
+//# sourceMappingURL=v25.js.map

package/dist/db/migrations/v26.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from './types.js';
+export declare const v26: Migration;
+//# sourceMappingURL=v26.d.ts.map

package/dist/db/migrations/v26.js

@@ -0,0 +1,23 @@
+import { tableHasColumn, tableExists } from '../tables.js';
+export const v26 = {
+    version: 26,
+    up: (db) => {
+        // v1.12.0 A5 v2 sub-1: add role column to api_keys for the admin/member
+        // distinction that gates /v1/sleep. Additive — existing keys backfill to
+        // 'admin' via DEFAULT (single-tenant operator = admin by definition).
+        // No min_compatible_binary bump: old binaries (v1.11.x) ignore the
+        // column on SELECTs that don't name it; new binaries on old data run
+        // this migration at openHippoDb time before any createApiKey call.
+        //
+        // v1.12.7 defensive: also guard on tableExists. If a DB landed in the
+        // partial-v16-state (api_keys table missing despite schema_version >= 16),
+        // running ALTER TABLE here would crash and block all later migrations.
+        // The v27 heal below recreates api_keys with the role column already
+        // present, so this ALTER becomes a no-op anyway for that path. Defense
+        // in depth: guard so v26 never crashes on the partial-apply state.
+        if (tableExists(db, 'api_keys') && !tableHasColumn(db, 'api_keys', 'role')) {
+            db.exec(`ALTER TABLE api_keys ADD COLUMN role TEXT NOT NULL DEFAULT 'admin'`);
+        }
+    },
+};
+//# sourceMappingURL=v26.js.map

package/dist/db/migrations/v27.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from './types.js';
+export declare const v27: Migration;
+//# sourceMappingURL=v27.d.ts.map

package/dist/db/migrations/v27.js

@@ -0,0 +1,57 @@
+import { tableHasColumn, tableExists } from '../tables.js';
+export const v27 = {
+    version: 27,
+    up: (db) => {
+        // v1.12.7 self-heal — re-assert the v16 schema (api_keys + audit_log).
+        //
+        // Surfaced 2026-05-24 on Keith's ~/.hippo/hippo.db: schema_version
+        // recorded as 25 but api_keys and audit_log tables were missing from
+        // migration v16. Root cause unknown — the migration runner has wrapped
+        // each migration in BEGIN/COMMIT since the first SQLite commit, so
+        // atomicity isn't the bug. Possible causes: DROP TABLE post-migration,
+        // SQL import / restore from a pre-v16 backup over a v16+ schema_version,
+        // or some edge case the wrapping doesn't catch. Cause may be operator
+        // action; either way the practical fix is the same.
+        //
+        // All CREATE IF NOT EXISTS — zero-cost no-op for users without the
+        // bug, fixes anyone who has it. Includes the role column from the
+        // start so it matches v26's intent without needing v26 to ALTER on
+        // this heal path.
+        db.exec(`
+        CREATE TABLE IF NOT EXISTS api_keys (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          key_id TEXT UNIQUE NOT NULL,
+          key_hash TEXT NOT NULL,
+          tenant_id TEXT NOT NULL DEFAULT 'default',
+          label TEXT,
+          created_at TEXT NOT NULL,
+          revoked_at TEXT,
+          role TEXT NOT NULL DEFAULT 'admin'
+        )
+      `);
+        db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_api_keys_tenant_active
+        ON api_keys(tenant_id) WHERE revoked_at IS NULL
+      `);
+        db.exec(`
+        CREATE TABLE IF NOT EXISTS audit_log (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          ts TEXT NOT NULL,
+          tenant_id TEXT NOT NULL DEFAULT 'default',
+          actor TEXT NOT NULL,
+          op TEXT NOT NULL,
+          target_id TEXT,
+          metadata_json TEXT NOT NULL DEFAULT '{}'
+        )
+      `);
+        db.exec(`CREATE INDEX IF NOT EXISTS idx_audit_log_tenant_ts ON audit_log(tenant_id, ts DESC)`);
+        // Belt-and-braces: if api_keys existed before this migration WITHOUT
+        // the role column (i.e. v16-shape table that v26's ALTER skipped due
+        // to tableExists=false on an earlier broken run, then someone manually
+        // CREATEd it without role), backfill role.
+        if (tableExists(db, 'api_keys') && !tableHasColumn(db, 'api_keys', 'role')) {
+            db.exec(`ALTER TABLE api_keys ADD COLUMN role TEXT NOT NULL DEFAULT 'admin'`);
+        }
+    },
+};
+//# sourceMappingURL=v27.js.map

package/dist/db/migrations/v28.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from './types.js';
+export declare const v28: Migration;
+//# sourceMappingURL=v28.d.ts.map

package/dist/db/migrations/v28.js

@@ -0,0 +1,38 @@
+import { tableHasColumn } from '../tables.js';
+export const v28 = {
+    version: 28,
+    up: (db) => {
+        // E1 of 5-episode DAG live-coupling arc (docs/plans/2026-05-25-dag-e1-schema-v28.md).
+        // Adds dirty-flag persistence for the existing DAG layer's level-2
+        // summaries so E2 (child-write propagation) and E3 (sleep-cycle
+        // rebuild) have somewhere to write + read the staleness signal. Adds
+        // dag_level_3_built_at as a column (Keith Q5 pick: lets E5 entity-
+        // profile build path land without a second migration).
+        //
+        // All columns are additive + DEFAULTed/nullable, so backfill is
+        // automatic for existing rows. No min_compatible_binary bump: old
+        // binaries (v1.12.x) ignore the columns on SELECTs that don't name
+        // them; new binaries on old data hit this migration at openHippoDb
+        // time before any DAG path touches summary_dirty.
+        //
+        // Precedent for column-only guards on memories: v25 (db.ts:827),
+        // which added the DAG cache columns the same way. memories table
+        // itself comes from v1 and is always present, so the tableExists
+        // half of the v26/v27 guard pattern isn't load-bearing here.
+        if (!tableHasColumn(db, 'memories', 'summary_dirty')) {
+            db.exec(`ALTER TABLE memories ADD COLUMN summary_dirty INTEGER NOT NULL DEFAULT 0`);
+        }
+        if (!tableHasColumn(db, 'memories', 'last_rebuilt_at')) {
+            db.exec(`ALTER TABLE memories ADD COLUMN last_rebuilt_at TEXT`);
+        }
+        if (!tableHasColumn(db, 'memories', 'rebuild_count')) {
+            db.exec(`ALTER TABLE memories ADD COLUMN rebuild_count INTEGER NOT NULL DEFAULT 0`);
+        }
+        if (!tableHasColumn(db, 'memories', 'dag_level_3_built_at')) {
+            // Reserved for E5: buildEntityProfiles will set this on level-3
+            // rows when they're created. Always NULL for level 0/1/2 rows.
+            db.exec(`ALTER TABLE memories ADD COLUMN dag_level_3_built_at TEXT`);
+        }
+    },
+};
+//# sourceMappingURL=v28.js.map

package/dist/db/migrations/v29.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from './types.js';
+export declare const v29: Migration;
+//# sourceMappingURL=v29.d.ts.map

package/dist/db/migrations/v29.js

@@ -0,0 +1,78 @@
+import { tableExists } from '../tables.js';
+export const v29 = {
+    version: 29,
+    up: (db) => {
+        // E2 prediction first-class object (docs/plans/2026-05-26-e2-prediction-object.md).
+        // Adds a canonical predictions table for J3 reference-class /
+        // planning-fallacy detector (a follow-up episode). Predictions
+        // duplicate claim_text in the table itself so memory deletion
+        // (forget/consolidate/archive) does not lose prediction data; FK
+        // memory_id is NULLABLE with ON DELETE SET NULL.
+        //
+        // Cross-tenant safety: BEFORE INSERT + BEFORE UPDATE triggers
+        // enforce tenant_id match against the referenced memory. SQLite's
+        // ON DELETE SET NULL is incompatible with composite FK where one
+        // side is NOT NULL, so the trigger pattern replaces a composite
+        // FK target. Precedent: v14 memories.kind trigger pair at db.ts:298-322.
+        //
+        // CHECK constraint pins closure_state to (open|closed|closed-unknown).
+        // J3 computes accuracy (clean vs regressed) from (estimate_value,
+        // actual_value) at query time.
+        if (!tableExists(db, 'predictions')) {
+            db.exec(`
+          CREATE TABLE predictions (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            memory_id TEXT,
+            tenant_id TEXT NOT NULL,
+            class_tag TEXT NOT NULL,
+            claim_text TEXT NOT NULL,
+            estimate_value REAL,
+            estimate_unit TEXT,
+            target_date TEXT,
+            actual_value REAL,
+            closure_state TEXT NOT NULL DEFAULT 'open'
+              CHECK (closure_state IN ('open', 'closed', 'closed-unknown')),
+            closed_at TEXT,
+            closure_note TEXT,
+            created_at TEXT NOT NULL,
+            FOREIGN KEY (memory_id) REFERENCES memories(id) ON DELETE SET NULL
+          )
+        `);
+            db.exec(`
+          CREATE INDEX IF NOT EXISTS idx_predictions_tenant_class
+          ON predictions(tenant_id, class_tag, closure_state)
+        `);
+            db.exec(`
+          CREATE INDEX IF NOT EXISTS idx_predictions_memory
+          ON predictions(memory_id) WHERE memory_id IS NOT NULL
+        `);
+            // Cross-tenant safety: tenant_id must match the referenced memory's
+            // tenant_id when memory_id IS NOT NULL. INSERT + UPDATE pair, mirroring
+            // v14 memories.kind enforcement (db.ts:298-322).
+            db.exec(`
+          CREATE TRIGGER IF NOT EXISTS trg_predictions_tenant_match_insert
+          BEFORE INSERT ON predictions
+          WHEN NEW.memory_id IS NOT NULL
+          BEGIN
+            SELECT CASE
+              WHEN NEW.tenant_id != (SELECT tenant_id FROM memories WHERE id = NEW.memory_id)
+              THEN RAISE(ABORT, 'predictions.tenant_id must match memories.tenant_id for the referenced memory')
+            END;
+          END
+        `);
+            db.exec(`
+          CREATE TRIGGER IF NOT EXISTS trg_predictions_tenant_match_update
+          BEFORE UPDATE ON predictions
+          WHEN NEW.memory_id IS NOT NULL
+            AND (NEW.memory_id IS NOT OLD.memory_id OR NEW.tenant_id IS NOT OLD.tenant_id)
+          BEGIN
+            SELECT CASE
+              WHEN NEW.tenant_id != (SELECT tenant_id FROM memories WHERE id = NEW.memory_id)
+              THEN RAISE(ABORT, 'predictions.tenant_id must match memories.tenant_id for the referenced memory')
+            END;
+          END
+        `);
+        }
+    },
+};
+//# sourceMappingURL=v29.js.map

package/dist/db/migrations/v30.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from './types.js';
+export declare const v30: Migration;
+//# sourceMappingURL=v30.d.ts.map

package/dist/db/migrations/v30.js

@@ -0,0 +1,92 @@
+import { tableExists } from '../tables.js';
+const DECISIONS_TABLE = `
+          CREATE TABLE decisions (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            memory_id TEXT,
+            tenant_id TEXT NOT NULL,
+            decision_text TEXT NOT NULL,
+            context TEXT,
+            status TEXT NOT NULL DEFAULT 'active'
+              CHECK (status IN ('active', 'superseded', 'closed')),
+            superseded_by INTEGER,
+            superseded_at TEXT,
+            closed_at TEXT,
+            created_at TEXT NOT NULL,
+            FOREIGN KEY (memory_id) REFERENCES memories(id) ON DELETE SET NULL,
+            FOREIGN KEY (superseded_by) REFERENCES decisions(id) ON DELETE SET NULL
+          )
+        `;
+const IDX_DECISIONS_TENANT_STATUS = `
+          CREATE INDEX IF NOT EXISTS idx_decisions_tenant_status
+          ON decisions(tenant_id, status)
+        `;
+const IDX_DECISIONS_MEMORY = `
+          CREATE INDEX IF NOT EXISTS idx_decisions_memory
+          ON decisions(memory_id) WHERE memory_id IS NOT NULL
+        `;
+// Cross-tenant safety vs the referenced memory (mirrors predictions v29).
+const TRG_DECISIONS_TENANT_MATCH_INSERT = `
+          CREATE TRIGGER IF NOT EXISTS trg_decisions_tenant_match_insert
+          BEFORE INSERT ON decisions
+          WHEN NEW.memory_id IS NOT NULL
+          BEGIN
+            SELECT CASE
+              WHEN NEW.tenant_id != (SELECT tenant_id FROM memories WHERE id = NEW.memory_id)
+              THEN RAISE(ABORT, 'decisions.tenant_id must match memories.tenant_id for the referenced memory')
+            END;
+          END
+        `;
+const TRG_DECISIONS_TENANT_MATCH_UPDATE = `
+          CREATE TRIGGER IF NOT EXISTS trg_decisions_tenant_match_update
+          BEFORE UPDATE ON decisions
+          WHEN NEW.memory_id IS NOT NULL
+            AND (NEW.memory_id IS NOT OLD.memory_id OR NEW.tenant_id IS NOT OLD.tenant_id)
+          BEGIN
+            SELECT CASE
+              WHEN NEW.tenant_id != (SELECT tenant_id FROM memories WHERE id = NEW.memory_id)
+              THEN RAISE(ABORT, 'decisions.tenant_id must match memories.tenant_id for the referenced memory')
+            END;
+          END
+        `;
+// Cross-tenant safety vs the successor decision (self-FK). superseded_by
+// is set only via UPDATE (the supersede path); the successor must share
+// the tenant. The successor row already exists in the same transaction
+// when this fires, so the subquery resolves.
+const TRG_DECISIONS_SUPERSEDE_TENANT_MATCH_UPDATE = `
+          CREATE TRIGGER IF NOT EXISTS trg_decisions_supersede_tenant_match_update
+          BEFORE UPDATE ON decisions
+          WHEN NEW.superseded_by IS NOT NULL
+            AND NEW.superseded_by IS NOT OLD.superseded_by
+          BEGIN
+            SELECT CASE
+              WHEN NEW.tenant_id != (SELECT tenant_id FROM decisions WHERE id = NEW.superseded_by)
+              THEN RAISE(ABORT, 'decisions.superseded_by must reference a decision in the same tenant')
+            END;
+          END
+        `;
+export const v30 = {
+    version: 30,
+    up: (db) => {
+        // E2 decision first-class object (docs/plans/2026-05-28-e2-decision-object.md).
+        // Promotes `hippo decide` from a tagged memory (which decayed on a 90-day
+        // half-life even while the decision was still in force) to a canonical
+        // decisions table that is the source of truth. The memory mirror is kept
+        // for recall but is no longer authoritative; memory_id is NULLABLE with
+        // ON DELETE SET NULL so forget/consolidate/archive does not lose a
+        // decision. Mirrors the v29 predictions tenant-match trigger pattern.
+        //
+        // status (active|superseded|closed): superseded carries a self-FK
+        // superseded_by to the successor decision; closed is a terminal
+        // retire-without-successor. A superseded_by same-tenant trigger makes
+        // cross-tenant supersession unrepresentable at the schema level.
+        if (!tableExists(db, 'decisions')) {
+            db.exec(DECISIONS_TABLE);
+            db.exec(IDX_DECISIONS_TENANT_STATUS);
+            db.exec(IDX_DECISIONS_MEMORY);
+            db.exec(TRG_DECISIONS_TENANT_MATCH_INSERT);
+            db.exec(TRG_DECISIONS_TENANT_MATCH_UPDATE);
+            db.exec(TRG_DECISIONS_SUPERSEDE_TENANT_MATCH_UPDATE);
+        }
+    },
+};
+//# sourceMappingURL=v30.js.map

package/dist/db/migrations/v31.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from './types.js';
+export declare const v31: Migration;
+//# sourceMappingURL=v31.d.ts.map

package/dist/db/migrations/v31.js

@@ -0,0 +1,74 @@
+import { tableExists } from '../tables.js';
+export const v31 = {
+    version: 31,
+    up: (db) => {
+        // E2 incident first-class object (docs/plans/2026-05-29-e2-incident-object.md).
+        // Mirrors the v30 decisions block but for an open -> resolved -> closed
+        // lifecycle (NOT supersede): there is no superseded_by self-FK and no
+        // supersede trigger. An incident is a postmortem capsule: a recorded
+        // operational event with a lifecycle and optional linked receipts (the
+        // memories that are its evidence, stored as a JSON array of ids in
+        // linked_memory_ids). The memory mirror is kept for recall but is not
+        // authoritative; memory_id is NULLABLE with ON DELETE SET NULL so
+        // forget/consolidate/archive does not lose an incident.
+        //
+        // status (open|resolved|closed): resolved records a resolution_text +
+        // resolved_at and stays on record; closed is a terminal retire reachable
+        // from open or resolved. Cross-tenant safety: BEFORE INSERT + BEFORE
+        // UPDATE triggers enforce incidents.tenant_id == the referenced memory's
+        // tenant_id (verbatim mirror of the v30 decisions tenant-match triggers).
+        if (!tableExists(db, 'incidents')) {
+            db.exec(`
+          CREATE TABLE incidents (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            memory_id TEXT,
+            tenant_id TEXT NOT NULL,
+            incident_text TEXT NOT NULL,
+            context TEXT,
+            status TEXT NOT NULL DEFAULT 'open'
+              CHECK (status IN ('open', 'resolved', 'closed')),
+            resolution_text TEXT,
+            resolved_at TEXT,
+            closed_at TEXT,
+            linked_memory_ids TEXT NOT NULL DEFAULT '[]',
+            created_at TEXT NOT NULL,
+            FOREIGN KEY (memory_id) REFERENCES memories(id) ON DELETE SET NULL
+          )
+        `);
+            db.exec(`
+          CREATE INDEX IF NOT EXISTS idx_incidents_tenant_status
+          ON incidents(tenant_id, status)
+        `);
+            db.exec(`
+          CREATE INDEX IF NOT EXISTS idx_incidents_memory
+          ON incidents(memory_id) WHERE memory_id IS NOT NULL
+        `);
+            // Cross-tenant safety vs the referenced memory (verbatim mirror of the
+            // v30 decisions tenant-match triggers; no supersede trigger).
+            db.exec(`
+          CREATE TRIGGER IF NOT EXISTS trg_incidents_tenant_match_insert
+          BEFORE INSERT ON incidents
+          WHEN NEW.memory_id IS NOT NULL
+          BEGIN
+            SELECT CASE
+              WHEN NEW.tenant_id != (SELECT tenant_id FROM memories WHERE id = NEW.memory_id)
+              THEN RAISE(ABORT, 'incidents.tenant_id must match memories.tenant_id for the referenced memory')
+            END;
+          END
+        `);
+            db.exec(`
+          CREATE TRIGGER IF NOT EXISTS trg_incidents_tenant_match_update
+          BEFORE UPDATE ON incidents
+          WHEN NEW.memory_id IS NOT NULL
+            AND (NEW.memory_id IS NOT OLD.memory_id OR NEW.tenant_id IS NOT OLD.tenant_id)
+          BEGIN
+            SELECT CASE
+              WHEN NEW.tenant_id != (SELECT tenant_id FROM memories WHERE id = NEW.memory_id)
+              THEN RAISE(ABORT, 'incidents.tenant_id must match memories.tenant_id for the referenced memory')
+            END;
+          END
+        `);
+        }
+    },
+};
+//# sourceMappingURL=v31.js.map

package/dist/db/migrations/v32.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from './types.js';
+export declare const v32: Migration;
+//# sourceMappingURL=v32.d.ts.map

package/dist/db/migrations/v32.js

@@ -0,0 +1,102 @@
+import { tableExists } from '../tables.js';
+const PROCESSES_TABLE = `
+          CREATE TABLE processes (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            memory_id TEXT,
+            tenant_id TEXT NOT NULL,
+            process_name TEXT NOT NULL,
+            description TEXT,
+            steps TEXT NOT NULL DEFAULT '[]',
+            version INTEGER NOT NULL DEFAULT 1,
+            status TEXT NOT NULL DEFAULT 'active'
+              CHECK (status IN ('active', 'superseded', 'closed')),
+            superseded_by INTEGER,
+            superseded_at TEXT,
+            change_summary TEXT,
+            closed_at TEXT,
+            created_at TEXT NOT NULL,
+            FOREIGN KEY (memory_id) REFERENCES memories(id) ON DELETE SET NULL,
+            FOREIGN KEY (superseded_by) REFERENCES processes(id) ON DELETE SET NULL
+          )
+        `;
+const IDX_PROCESSES_TENANT_STATUS = `
+          CREATE INDEX IF NOT EXISTS idx_processes_tenant_status
+          ON processes(tenant_id, status)
+        `;
+const IDX_PROCESSES_MEMORY = `
+          CREATE INDEX IF NOT EXISTS idx_processes_memory
+          ON processes(memory_id) WHERE memory_id IS NOT NULL
+        `;
+// Cross-tenant safety vs the referenced memory (verbatim mirror of the
+// v31 incidents / v30 decisions tenant-match triggers).
+const TRG_PROCESSES_TENANT_MATCH_INSERT = `
+          CREATE TRIGGER IF NOT EXISTS trg_processes_tenant_match_insert
+          BEFORE INSERT ON processes
+          WHEN NEW.memory_id IS NOT NULL
+          BEGIN
+            SELECT CASE
+              WHEN NEW.tenant_id != (SELECT tenant_id FROM memories WHERE id = NEW.memory_id)
+              THEN RAISE(ABORT, 'processes.tenant_id must match memories.tenant_id for the referenced memory')
+            END;
+          END
+        `;
+const TRG_PROCESSES_TENANT_MATCH_UPDATE = `
+          CREATE TRIGGER IF NOT EXISTS trg_processes_tenant_match_update
+          BEFORE UPDATE ON processes
+          WHEN NEW.memory_id IS NOT NULL
+            AND (NEW.memory_id IS NOT OLD.memory_id OR NEW.tenant_id IS NOT OLD.tenant_id)
+          BEGIN
+            SELECT CASE
+              WHEN NEW.tenant_id != (SELECT tenant_id FROM memories WHERE id = NEW.memory_id)
+              THEN RAISE(ABORT, 'processes.tenant_id must match memories.tenant_id for the referenced memory')
+            END;
+          END
+        `;
+// Cross-tenant safety vs the successor process (self-FK; verbatim mirror
+// of the v30 decisions supersede trigger). superseded_by is set only via
+// the supersede UPDATE; the successor must share the tenant. The successor
+// row already exists in the same transaction when this fires.
+const TRG_PROCESSES_SUPERSEDE_TENANT_MATCH_UPDATE = `
+          CREATE TRIGGER IF NOT EXISTS trg_processes_supersede_tenant_match_update
+          BEFORE UPDATE ON processes
+          WHEN NEW.superseded_by IS NOT NULL
+            AND NEW.superseded_by IS NOT OLD.superseded_by
+          BEGIN
+            SELECT CASE
+              WHEN NEW.tenant_id != (SELECT tenant_id FROM processes WHERE id = NEW.superseded_by)
+              THEN RAISE(ABORT, 'processes.superseded_by must reference a process in the same tenant')
+            END;
+          END
+        `;
+export const v32 = {
+    version: 32,
+    up: (db) => {
+        // E2 process first-class object (docs/plans/2026-05-29-e2-process-object.md).
+        // A process is a "living process map": a named, ordered list of steps that
+        // evolves. Unlike incident (open->resolved->closed, no supersede), process
+        // REUSES the v30 decisions supersede path as its delta mechanism: a process
+        // evolves by being superseded by a NEW VERSION that records what changed
+        // (change_summary) and the full new state (steps), carrying a derived
+        // version counter. So this table combines the v31 incidents tenant-match
+        // trigger pair (vs the referenced memory) WITH the v30 decisions
+        // superseded_by self-FK + supersede tenant-match trigger.
+        //
+        // status (active|superseded|closed): superseded carries a self-FK
+        // superseded_by to the successor version; closed is a terminal
+        // retire-without-successor (only an active head closes). The memory mirror
+        // is kept for recall but is not authoritative; memory_id is NULLABLE with
+        // ON DELETE SET NULL so forget/consolidate/archive does not lose a process.
+        // steps is a JSON-encoded array of step strings (scoped v1; a normalized
+        // process_steps table is deferred). version is server-derived
+        // (predecessor.version + 1); change_summary is set on a successor row only.
+        if (!tableExists(db, 'processes')) {
+            db.exec(PROCESSES_TABLE);
+            db.exec(IDX_PROCESSES_TENANT_STATUS);
+            db.exec(IDX_PROCESSES_MEMORY);
+            db.exec(TRG_PROCESSES_TENANT_MATCH_INSERT);
+            db.exec(TRG_PROCESSES_TENANT_MATCH_UPDATE);
+            db.exec(TRG_PROCESSES_SUPERSEDE_TENANT_MATCH_UPDATE);
+        }
+    },
+};
+//# sourceMappingURL=v32.js.map

package/dist/db/migrations/v33.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from './types.js';
+export declare const v33: Migration;
+//# sourceMappingURL=v33.d.ts.map

package/dist/db/migrations/v33.js

@@ -0,0 +1,104 @@
+import { tableExists } from '../tables.js';
+const POLICIES_TABLE = `
+          CREATE TABLE policies (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            memory_id TEXT,
+            tenant_id TEXT NOT NULL,
+            policy_name TEXT NOT NULL,
+            policy_text TEXT NOT NULL,
+            valid_from TEXT NOT NULL,
+            valid_to TEXT,
+            version INTEGER NOT NULL DEFAULT 1,
+            status TEXT NOT NULL DEFAULT 'active'
+              CHECK (status IN ('active', 'superseded', 'closed')),
+            superseded_by INTEGER,
+            superseded_at TEXT,
+            change_summary TEXT,
+            closed_at TEXT,
+            created_at TEXT NOT NULL,
+            FOREIGN KEY (memory_id) REFERENCES memories(id) ON DELETE SET NULL,
+            FOREIGN KEY (superseded_by) REFERENCES policies(id) ON DELETE SET NULL
+          )
+        `;
+const IDX_POLICIES_TENANT_STATUS = `
+          CREATE INDEX IF NOT EXISTS idx_policies_tenant_status
+          ON policies(tenant_id, status)
+        `;
+const IDX_POLICIES_MEMORY = `
+          CREATE INDEX IF NOT EXISTS idx_policies_memory
+          ON policies(memory_id) WHERE memory_id IS NOT NULL
+        `;
+// Supports the as-of query (active policies in force at a valid-time).
+const IDX_POLICIES_ASOF = `
+          CREATE INDEX IF NOT EXISTS idx_policies_asof
+          ON policies(tenant_id, valid_from)
+        `;
+// Cross-tenant safety vs the referenced memory (verbatim mirror of the
+// v32 processes tenant-match triggers).
+const TRG_POLICIES_TENANT_MATCH_INSERT = `
+          CREATE TRIGGER IF NOT EXISTS trg_policies_tenant_match_insert
+          BEFORE INSERT ON policies
+          WHEN NEW.memory_id IS NOT NULL
+          BEGIN
+            SELECT CASE
+              WHEN NEW.tenant_id != (SELECT tenant_id FROM memories WHERE id = NEW.memory_id)
+              THEN RAISE(ABORT, 'policies.tenant_id must match memories.tenant_id for the referenced memory')
+            END;
+          END
+        `;
+const TRG_POLICIES_TENANT_MATCH_UPDATE = `
+          CREATE TRIGGER IF NOT EXISTS trg_policies_tenant_match_update
+          BEFORE UPDATE ON policies
+          WHEN NEW.memory_id IS NOT NULL
+            AND (NEW.memory_id IS NOT OLD.memory_id OR NEW.tenant_id IS NOT OLD.tenant_id)
+          BEGIN
+            SELECT CASE
+              WHEN NEW.tenant_id != (SELECT tenant_id FROM memories WHERE id = NEW.memory_id)
+              THEN RAISE(ABORT, 'policies.tenant_id must match memories.tenant_id for the referenced memory')
+            END;
+          END
+        `;
+// Cross-tenant safety vs the successor policy (self-FK; verbatim mirror of
+// the v32 processes supersede trigger).
+const TRG_POLICIES_SUPERSEDE_TENANT_MATCH_UPDATE = `
+          CREATE TRIGGER IF NOT EXISTS trg_policies_supersede_tenant_match_update
+          BEFORE UPDATE ON policies
+          WHEN NEW.superseded_by IS NOT NULL
+            AND NEW.superseded_by IS NOT OLD.superseded_by
+          BEGIN
+            SELECT CASE
+              WHEN NEW.tenant_id != (SELECT tenant_id FROM policies WHERE id = NEW.superseded_by)
+              THEN RAISE(ABORT, 'policies.superseded_by must reference a policy in the same tenant')
+            END;
+          END
+        `;
+export const v33 = {
+    version: 33,
+    up: (db) => {
+        // E2 policy first-class object (docs/plans/2026-05-30-e2-policy-object.md).
+        // The "bi-temporal-first" object type: a named rule/statement that is in
+        // force over an EFFECTIVE-TIME range (valid_from required, valid_to nullable
+        // = open-ended) and evolves via the v32 processes supersede machinery
+        // (superseded_by self-FK + supersede tenant-match trigger + version +
+        // change_summary). This table = the v32 processes table MINUS `steps`
+        // (a policy has policy_text, not an ordered step list) PLUS the first-class
+        // effective-time columns valid_from/valid_to. Valid-time is the queryable
+        // axis (the as-of query loadPoliciesAsOf); transaction-time is present via
+        // created_at + the supersede chain's superseded_at (time-travel deferred).
+        //
+        // All date inputs are normalized to canonical ISO-8601 datetime
+        // (toISOString) at the store boundary before persist/compare, so the
+        // fixed-width values sort lexically and the half-open [valid_from, valid_to)
+        // as-of comparison is correct (plan-eng-critic round-1 CRIT fix).
+        if (!tableExists(db, 'policies')) {
+            db.exec(POLICIES_TABLE);
+            db.exec(IDX_POLICIES_TENANT_STATUS);
+            db.exec(IDX_POLICIES_MEMORY);
+            db.exec(IDX_POLICIES_ASOF);
+            db.exec(TRG_POLICIES_TENANT_MATCH_INSERT);
+            db.exec(TRG_POLICIES_TENANT_MATCH_UPDATE);
+            db.exec(TRG_POLICIES_SUPERSEDE_TENANT_MATCH_UPDATE);
+        }
+    },
+};
+//# sourceMappingURL=v33.js.map