hippo-memory 1.69.0 → 1.71.0

package/dist/db/migrations/v17.js

@@ -30,9 +30,8 @@ export const v17 = {
         )
       `);
         db.exec(`CREATE INDEX IF NOT EXISTS idx_slack_dlq_tenant_received ON slack_dlq(tenant_id, received_at)`);
-        // Multi-tenant routing seam. Empty by default: single-
-        // tenant deployments resolve via HIPPO_TENANT fallback. Multi-workspace
-        // deployments populate this table to map team_id → tenant_id.
+        // Multi-tenant routing seam, empty by default: single-tenant deployments resolve via the HIPPO_TENANT fallback;
+        // multi-workspace deployments populate it to map team_id -> tenant_id.
         db.exec(`
         CREATE TABLE IF NOT EXISTS slack_workspaces (
           team_id TEXT PRIMARY KEY,

package/dist/db/migrations/v18.js

@@ -1,7 +1,4 @@
-export const v18 = {
-    version: 18,
-    up: (db) => {
-        db.exec(`
+const GOAL_STACK_SCHEMA_SQL = `
         CREATE TABLE IF NOT EXISTS goal_stack (
           id TEXT PRIMARY KEY,
           session_id TEXT NOT NULL,
@@ -54,7 +51,11 @@ export const v18 = {
           ON goal_recall_log(goal_id);
         CREATE UNIQUE INDEX IF NOT EXISTS uniq_goal_recall_log_memory_goal
           ON goal_recall_log(memory_id, goal_id);
-      `);
+      `;
+export const v18 = {
+    version: 18,
+    up: (db) => {
+        db.exec(GOAL_STACK_SCHEMA_SQL);
     },
 };
 //# sourceMappingURL=v18.js.map

package/dist/db/migrations/v19.js

@@ -2,11 +2,8 @@ import { tableHasColumn } from '../tables.js';
 export const v19 = {
     version: 19,
     up: (db) => {
-        // Slack hardening: widen slack_dlq with bucketing,
-        // retry tracking, and the signature/timestamp pair that lets `hippo
-        // slack dlq replay` re-verify before re-running ingest. ALTER ADD
-        // COLUMN with DEFAULT is non-destructive — legacy rows take the
-        // default values. Idempotent via tableHasColumn().
+        // Widen slack_dlq with bucketing, retry tracking and the signature/timestamp pair `hippo slack dlq replay` re-verifies;
+        // ALTER ADD COLUMN with DEFAULT is non-destructive, so legacy rows take the defaults. Idempotent via tableHasColumn().
         if (!tableHasColumn(db, 'slack_dlq', 'team_id')) {
             db.exec(`ALTER TABLE slack_dlq ADD COLUMN team_id TEXT`);
         }

package/dist/db/migrations/v20.js

@@ -1,13 +1,9 @@
+import { warnDamagedColumn } from '../../util/stored-json.js';
 export const v20 = {
     version: 20,
     up: (db) => {
-        // GDPR Path A backfill: redact every existing
-        // raw_archive.payload_json so historical archives match the new
-        // metadata-only contract from src/raw-archive.ts. Read each row, parse
-        // the existing JSON to extract tenant_id and kind (best effort), then
-        // UPDATE with the redacted shape. Rows with unparseable legacy JSON get
-        // redacted with tenant_id='unknown', kind='unknown'. The audit_log
-        // remains the compliance record.
+        // GDPR Path A backfill: redact every existing raw_archive.payload_json to the metadata-only shape (store/raw-archive.ts); unparseable legacy JSON
+        // gets tenant_id='unknown', kind='unknown'. The audit_log remains the compliance record.
         // SAFETY: rows' shape matches the four columns named in the SELECT above.
         const rows = db
             .prepare(`SELECT id, archived_at, reason, payload_json FROM raw_archive`)
@@ -25,7 +21,8 @@ export const v20 = {
                 kind = parsed.kind ?? 'unknown';
             }
             catch {
-                // Unparseable legacy payload — redact with unknowns.
+                // The row is still redacted, with unknowns; the line says which one lost its tenant and kind.
+                warnDamagedColumn({ table: 'raw_archive', id: row.id, column: 'payload_json' }, 'not valid JSON');
             }
             const redacted = JSON.stringify({
                 redacted: true,

package/dist/db/migrations/v22.js

@@ -1,19 +1,5 @@
 import { tableHasColumn } from '../tables.js';
-export const v22 = {
-    version: 22,
-    up: (db) => {
-        // session_events and session_handoffs predate the v16 tenant migration and were
-        // never added to it: a cross-tenant leak whenever continuity primitives are used.
-        // Adds tenant_id (NOT NULL DEFAULT 'default') with smart backfill from
-        // task_snapshots.session_id when unambiguous, plus an optional scope
-        // column so a private-channel-derived handoff can default-deny via the
-        // same rule recall already enforces.
-        //
-        // Self-heal partial-init stores: re-run the v4/v5 CREATE TABLE IF NOT
-        // EXISTS bodies before ALTERing. A silent skip would otherwise stamp
-        // schema_version=22 on a DB missing the underlying tables, leaving
-        // them permanently absent.
-        db.exec(`
+const CREATE_TABLE_SESSION_EVENTS_SQL = `
         CREATE TABLE IF NOT EXISTS session_events (
           id INTEGER PRIMARY KEY AUTOINCREMENT,
           session_id TEXT NOT NULL,
@@ -34,26 +20,8 @@ export const v22 = {
           artifacts_json TEXT NOT NULL DEFAULT '[]',
           created_at TEXT NOT NULL
         );
-      `);
-        if (!tableHasColumn(db, 'session_events', 'tenant_id')) {
-            db.exec(`ALTER TABLE session_events ADD COLUMN tenant_id TEXT NOT NULL DEFAULT 'default'`);
-        }
-        if (!tableHasColumn(db, 'session_events', 'scope')) {
-            db.exec(`ALTER TABLE session_events ADD COLUMN scope TEXT`);
-        }
-        if (!tableHasColumn(db, 'session_handoffs', 'tenant_id')) {
-            db.exec(`ALTER TABLE session_handoffs ADD COLUMN tenant_id TEXT NOT NULL DEFAULT 'default'`);
-        }
-        if (!tableHasColumn(db, 'session_handoffs', 'scope')) {
-            db.exec(`ALTER TABLE session_handoffs ADD COLUMN scope TEXT`);
-        }
-        // Smart backfill: rows whose session_id maps to exactly one tenant in
-        // task_snapshots inherit that tenant. Ambiguous or unmapped rows stay
-        // at the column default ('default'). Conservative: never crosses
-        // tenant boundaries on guesses. The COUNT(DISTINCT) gate is the load-
-        // bearing check; without it, rows with multiple tenants under the same
-        // session_id would silently pick whichever group came first.
-        db.exec(`
+      `;
+const BACKFILL_SESSION_EVENTS_TENANT_SQL = `
         UPDATE session_events
            SET tenant_id = (
              SELECT MAX(t.tenant_id) FROM task_snapshots t
@@ -62,8 +30,8 @@ export const v22 = {
          WHERE tenant_id = 'default'
            AND (SELECT COUNT(DISTINCT t.tenant_id) FROM task_snapshots t
                  WHERE t.session_id = session_events.session_id) = 1
-      `);
-        db.exec(`
+      `;
+const BACKFILL_SESSION_HANDOFFS_TENANT_SQL = `
         UPDATE session_handoffs
            SET tenant_id = (
              SELECT MAX(t.tenant_id) FROM task_snapshots t
@@ -72,7 +40,29 @@ export const v22 = {
          WHERE tenant_id = 'default'
            AND (SELECT COUNT(DISTINCT t.tenant_id) FROM task_snapshots t
                  WHERE t.session_id = session_handoffs.session_id) = 1
-      `);
+      `;
+export const v22 = {
+    version: 22,
+    up: (db) => {
+        // session_events and session_handoffs missed the v16 tenant migration (cross-tenant leak): add tenant_id (NOT NULL DEFAULT 'default') backfilled from
+        // task_snapshots when unambiguous, plus a scope column. Re-run v4/v5 CREATE IF NOT EXISTS first so a partial-init store isn't stamped v22 without tables.
+        db.exec(CREATE_TABLE_SESSION_EVENTS_SQL);
+        if (!tableHasColumn(db, 'session_events', 'tenant_id')) {
+            db.exec(`ALTER TABLE session_events ADD COLUMN tenant_id TEXT NOT NULL DEFAULT 'default'`);
+        }
+        if (!tableHasColumn(db, 'session_events', 'scope')) {
+            db.exec(`ALTER TABLE session_events ADD COLUMN scope TEXT`);
+        }
+        if (!tableHasColumn(db, 'session_handoffs', 'tenant_id')) {
+            db.exec(`ALTER TABLE session_handoffs ADD COLUMN tenant_id TEXT NOT NULL DEFAULT 'default'`);
+        }
+        if (!tableHasColumn(db, 'session_handoffs', 'scope')) {
+            db.exec(`ALTER TABLE session_handoffs ADD COLUMN scope TEXT`);
+        }
+        // Smart backfill: a row whose session_id maps to exactly one tenant in task_snapshots inherits it; ambiguous or unmapped rows keep 'default'.
+        // The COUNT(DISTINCT) gate is load-bearing: without it a session_id spanning tenants would silently pick whichever group came first.
+        db.exec(BACKFILL_SESSION_EVENTS_TENANT_SQL);
+        db.exec(BACKFILL_SESSION_HANDOFFS_TENANT_SQL);
         db.exec(`CREATE INDEX IF NOT EXISTS idx_session_events_tenant_session ON session_events(tenant_id, session_id, created_at DESC, id DESC)`);
         db.exec(`CREATE INDEX IF NOT EXISTS idx_session_handoffs_tenant_session ON session_handoffs(tenant_id, session_id, created_at DESC)`);
     },

package/dist/db/migrations/v23.js

@@ -2,9 +2,7 @@ import { tableHasColumn, tableExists } from '../tables.js';
 export const v23 = {
     version: 23,
     up: (db) => {
-        // task_snapshots: add scope so all three continuity tables carry it.
-        // Self-heal partial-init stores via CREATE TABLE IF NOT EXISTS (the v22
-        // session_events / session_handoffs healing is upstream).
+        // task_snapshots: add scope so all three continuity tables carry it; self-heal partial-init stores via CREATE TABLE IF NOT EXISTS.
         db.exec(`
         CREATE TABLE IF NOT EXISTS task_snapshots (
           id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -22,17 +20,8 @@ export const v23 = {
         if (!tableHasColumn(db, 'task_snapshots', 'scope')) {
             db.exec(`ALTER TABLE task_snapshots ADD COLUMN scope TEXT`);
         }
-        // Quarantine policy: pre-existing continuity rows
-        // with NULL scope cannot be safely classified as public after the fact.
-        // Mark them 'unknown:legacy' so the api.recall + cmdRecall default-deny
-        // filter excludes them for no-scope callers. Fresh rows from new
-        // writers carry NULL when scope is unspecified (legitimate non-Slack
-        // writes); the 'unknown:legacy' marker is a v23-only one-shot for
-        // pre-upgrade rows.
-        //
-        // Run UPDATEs only on tables that exist (some test paths and edge stores
-        // skip v22's table healing). The UPDATEs are themselves idempotent via
-        // the WHERE scope IS NULL clause, so re-running is a no-op.
+        // Quarantine pre-existing continuity rows with NULL scope as 'unknown:legacy' so the recall default-deny filter excludes them for no-scope callers;
+        // new rows legitimately carry NULL. UPDATE only tables that exist (v22 healing is skipped on some paths); WHERE scope IS NULL keeps it idempotent.
         if (tableExists(db, 'task_snapshots')) {
             db.exec(`UPDATE task_snapshots SET scope = 'unknown:legacy' WHERE scope IS NULL`);
         }

package/dist/db/migrations/v24.js

@@ -1,9 +1,4 @@
-export const v24 = {
-    version: 24,
-    up: (db) => {
-        // GitHub connector schema.
-        // Six tables + a min_compatible_binary meta row for rollback safety.
-        db.exec(`
+const CREATE_TABLE_GITHUB_EVENT_LOG_SQL = `
         CREATE TABLE IF NOT EXISTS github_event_log (
           idempotency_key TEXT PRIMARY KEY,
           delivery_id TEXT NOT NULL,
@@ -11,10 +6,8 @@ export const v24 = {
           ingested_at TEXT NOT NULL,
           memory_id TEXT
         )
-      `);
-        db.exec(`CREATE INDEX IF NOT EXISTS idx_github_event_log_memory ON github_event_log(memory_id) WHERE memory_id IS NOT NULL`);
-        db.exec(`CREATE INDEX IF NOT EXISTS idx_github_event_log_delivery ON github_event_log(delivery_id)`);
-        db.exec(`
+      `;
+const CREATE_TABLE_GITHUB_CURSORS_SQL = `
         CREATE TABLE IF NOT EXISTS github_cursors (
           tenant_id TEXT NOT NULL,
           repo_full_name TEXT NOT NULL,
@@ -24,8 +17,8 @@ export const v24 = {
           updated_at TEXT NOT NULL,
           PRIMARY KEY (tenant_id, repo_full_name)
         )
-      `);
-        db.exec(`
+      `;
+const CREATE_TABLE_GITHUB_DLQ_SQL = `
         CREATE TABLE IF NOT EXISTS github_dlq (
           id INTEGER PRIMARY KEY AUTOINCREMENT,
           tenant_id TEXT NOT NULL,
@@ -41,27 +34,37 @@ export const v24 = {
           retried_at TEXT,
           bucket TEXT NOT NULL DEFAULT 'parse_error'
         )
-      `);
-        db.exec(`CREATE INDEX IF NOT EXISTS idx_github_dlq_tenant_received ON github_dlq(tenant_id, received_at)`);
-        db.exec(`
+      `;
+const CREATE_TABLE_GITHUB_INSTALLATIONS_SQL = `
         CREATE TABLE IF NOT EXISTS github_installations (
           installation_id TEXT PRIMARY KEY,
           tenant_id TEXT NOT NULL,
           added_at TEXT NOT NULL
         )
-      `);
-        // PAT-mode multi-tenant routing. Maps repo_full_name to
-        // tenant when the webhook envelope has no `installation` field. Composite
-        // PK so the same repo can intentionally be visible to multiple tenants
-        // (e.g., shared tooling accounts) — collision is on (repo, tenant) pair.
-        db.exec(`
+      `;
+const CREATE_TABLE_GITHUB_REPOSITORIES_SQL = `
         CREATE TABLE IF NOT EXISTS github_repositories (
           repo_full_name TEXT NOT NULL,
           tenant_id TEXT NOT NULL,
           added_at TEXT NOT NULL,
           PRIMARY KEY (repo_full_name, tenant_id)
         )
-      `);
+      `;
+export const v24 = {
+    version: 24,
+    up: (db) => {
+        // GitHub connector schema.
+        // Six tables + a min_compatible_binary meta row for rollback safety.
+        db.exec(CREATE_TABLE_GITHUB_EVENT_LOG_SQL);
+        db.exec(`CREATE INDEX IF NOT EXISTS idx_github_event_log_memory ON github_event_log(memory_id) WHERE memory_id IS NOT NULL`);
+        db.exec(`CREATE INDEX IF NOT EXISTS idx_github_event_log_delivery ON github_event_log(delivery_id)`);
+        db.exec(CREATE_TABLE_GITHUB_CURSORS_SQL);
+        db.exec(CREATE_TABLE_GITHUB_DLQ_SQL);
+        db.exec(`CREATE INDEX IF NOT EXISTS idx_github_dlq_tenant_received ON github_dlq(tenant_id, received_at)`);
+        db.exec(CREATE_TABLE_GITHUB_INSTALLATIONS_SQL);
+        // PAT-mode multi-tenant routing: maps repo_full_name to a tenant when the webhook envelope has no `installation` field.
+        // Composite PK so one repo can be visible to several tenants; the collision is on the (repo, tenant) pair.
+        db.exec(CREATE_TABLE_GITHUB_REPOSITORIES_SQL);
         // Rollback-safety guard: an older binary lacks the *:private:* default-deny and would leak
         // github:private:* rows; the startup guard refuses a DB whose min_compatible_binary is newer.
         db.prepare(`INSERT INTO meta(key, value) VALUES('min_compatible_binary', ?) ON CONFLICT(key) DO UPDATE SET value=excluded.value`).run('1.2.1');

package/dist/db/migrations/v25.js

@@ -2,11 +2,8 @@ import { tableHasColumn } from '../tables.js';
 export const v25 = {
     version: 25,
     up: (db) => {
-        // DAG-aware recall: cache summary metadata so the assembler can
-        // reason about scope without re-walking the DAG. Three additive,
-        // optional columns. No min_compatible_binary bump: these columns are
-        // pure metadata; older binaries opening this DB will see them as NULL
-        // / 0 and behave as before.
+        // DAG-aware recall: three additive optional columns cache summary metadata so the assembler need not re-walk the DAG.
+        // No min_compatible_binary bump: older binaries see them as NULL / 0 and behave as before.
         if (!tableHasColumn(db, 'memories', 'descendant_count')) {
             db.exec(`ALTER TABLE memories ADD COLUMN descendant_count INTEGER NOT NULL DEFAULT 0`);
         }
@@ -16,9 +13,7 @@ export const v25 = {
         if (!tableHasColumn(db, 'memories', 'latest_at')) {
             db.exec(`ALTER TABLE memories ADD COLUMN latest_at TEXT`);
         }
-        // Backfill descendant_count for existing level-2 summary rows. Use
-        // dag_parent_id pointing at the summary id. Level-3 (entity profiles)
-        // not built today; their descendant_count stays at default 0.
+        // Backfill descendant_count for existing level-2 summary rows via dag_parent_id = summary id; level-3 (entity profiles) is not built, so it stays 0.
         db.exec(`
         UPDATE memories
            SET descendant_count = (

package/dist/db/migrations/v26.js

@@ -2,19 +2,8 @@ import { tableHasColumn, tableExists } from '../tables.js';
 export const v26 = {
     version: 26,
     up: (db) => {
-        // Add role column to api_keys for the admin/member
-        // distinction that gates /v1/sleep. Additive — existing keys backfill to
-        // 'admin' via DEFAULT (single-tenant operator = admin by definition).
-        // No min_compatible_binary bump: old binaries ignore the
-        // column on SELECTs that don't name it; new binaries on old data run
-        // this migration at openHippoDb time before any createApiKey call.
-        //
-        // Defensive: also guard on tableExists. If a DB landed in the
-        // partial-v16-state (api_keys table missing despite schema_version >= 16),
-        // running ALTER TABLE here would crash and block all later migrations.
-        // The v27 heal below recreates api_keys with the role column already
-        // present, so this ALTER becomes a no-op anyway for that path. Defense
-        // in depth: guard so v26 never crashes on the partial-apply state.
+        // Add api_keys.role for the admin/member split gating /v1/sleep; existing keys backfill to 'admin' via DEFAULT. No min_compatible_binary bump.
+        // Guard on tableExists: a partial-v16 DB without api_keys would crash this ALTER and block later migrations (v27 heals it with role present).
         if (tableExists(db, 'api_keys') && !tableHasColumn(db, 'api_keys', 'role')) {
             db.exec(`ALTER TABLE api_keys ADD COLUMN role TEXT NOT NULL DEFAULT 'admin'`);
         }

package/dist/db/migrations/v27.js

@@ -2,13 +2,8 @@ import { tableHasColumn, tableExists } from '../tables.js';
 export const v27 = {
     version: 27,
     up: (db) => {
-        // Self-heal: re-assert the v16 schema (api_keys + audit_log) on stores stamped past
-        // v16 whose tables are missing anyway (a dropped table or an old-backup restore).
-        //
-        // All CREATE IF NOT EXISTS — zero-cost no-op for users without the
-        // bug, fixes anyone who has it. Includes the role column from the
-        // start so it matches v26's intent without needing v26 to ALTER on
-        // this heal path.
+        // Self-heal: re-assert the v16 schema (api_keys + audit_log) on stores stamped past v16 whose tables are missing (dropped table or old-backup restore).
+        // All CREATE IF NOT EXISTS, so a no-op for healthy stores; includes the role column so v26's ALTER is not needed on this path.
         db.exec(`
         CREATE TABLE IF NOT EXISTS api_keys (
           id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -37,10 +32,7 @@ export const v27 = {
         )
       `);
         db.exec(`CREATE INDEX IF NOT EXISTS idx_audit_log_tenant_ts ON audit_log(tenant_id, ts DESC)`);
-        // Belt-and-braces: if api_keys existed before this migration WITHOUT
-        // the role column (i.e. v16-shape table that v26's ALTER skipped due
-        // to tableExists=false on an earlier broken run, then someone manually
-        // CREATEd it without role), backfill role.
+        // Belt-and-braces: backfill role on an api_keys table that exists without it (v16-shape table that v26's ALTER skipped on an earlier broken run).
         if (tableExists(db, 'api_keys') && !tableHasColumn(db, 'api_keys', 'role')) {
             db.exec(`ALTER TABLE api_keys ADD COLUMN role TEXT NOT NULL DEFAULT 'admin'`);
         }

package/dist/db/migrations/v28.js

@@ -2,20 +2,8 @@ import { tableHasColumn } from '../tables.js';
 export const v28 = {
     version: 28,
     up: (db) => {
-        // Dirty-flag persistence for level-2 DAG summaries, so child-write propagation and the
-        // sleep-cycle rebuild can write + read the staleness signal. dag_level_3_built_at lands
-        // now so the entity-profile build path needs no second migration.
-        //
-        // All columns are additive + DEFAULTed/nullable, so backfill is
-        // automatic for existing rows. No min_compatible_binary bump: old
-        // binaries ignore the columns on SELECTs that don't name
-        // them; new binaries on old data hit this migration at openHippoDb
-        // time before any DAG path touches summary_dirty.
-        //
-        // Precedent for column-only guards on memories: v25 (db.ts:827),
-        // which added the DAG cache columns the same way. memories table
-        // itself comes from v1 and is always present, so the tableExists
-        // half of the v26/v27 guard pattern isn't load-bearing here.
+        // Dirty-flag persistence for level-2 DAG summaries; dag_level_3_built_at lands now so the entity-profile path needs no second migration.
+        // Columns are additive and DEFAULTed/nullable, so no min_compatible_binary bump. Column-only guard: memories comes from v1 and always exists.
         if (!tableHasColumn(db, 'memories', 'summary_dirty')) {
             db.exec(`ALTER TABLE memories ADD COLUMN summary_dirty INTEGER NOT NULL DEFAULT 0`);
         }

package/dist/db/migrations/v29.js

@@ -1,24 +1,5 @@
 import { tableExists } from '../tables.js';
-export const v29 = {
-    version: 29,
-    up: (db) => {
-        // Prediction first-class object: a predictions table for the reference-class /
-        // planning-fallacy detector. Predictions
-        // duplicate claim_text in the table itself so memory deletion
-        // (forget/consolidate/archive) does not lose prediction data; FK
-        // memory_id is NULLABLE with ON DELETE SET NULL.
-        //
-        // Cross-tenant safety: BEFORE INSERT + BEFORE UPDATE triggers
-        // enforce tenant_id match against the referenced memory. SQLite's
-        // ON DELETE SET NULL is incompatible with composite FK where one
-        // side is NOT NULL, so the trigger pattern replaces a composite
-        // FK target. Precedent: v14 memories.kind trigger pair at db.ts:298-322.
-        //
-        // CHECK constraint pins closure_state to (open|closed|closed-unknown).
-        // Accuracy (clean vs regressed) is computed from (estimate_value,
-        // actual_value) at query time.
-        if (!tableExists(db, 'predictions')) {
-            db.exec(`
+const CREATE_TABLE_PREDICTIONS_SQL = `
           CREATE TABLE predictions (
             id INTEGER PRIMARY KEY AUTOINCREMENT,
             memory_id TEXT,
@@ -36,19 +17,16 @@ export const v29 = {
             created_at TEXT NOT NULL,
             FOREIGN KEY (memory_id) REFERENCES memories(id) ON DELETE SET NULL
           )
-        `);
-            db.exec(`
+        `;
+const CREATE_INDEX_IDX_PREDICTIONS_TENANT_CLASS_SQL = `
           CREATE INDEX IF NOT EXISTS idx_predictions_tenant_class
           ON predictions(tenant_id, class_tag, closure_state)
-        `);
-            db.exec(`
+        `;
+const CREATE_INDEX_IDX_PREDICTIONS_MEMORY_SQL = `
           CREATE INDEX IF NOT EXISTS idx_predictions_memory
           ON predictions(memory_id) WHERE memory_id IS NOT NULL
-        `);
-            // Cross-tenant safety: tenant_id must match the referenced memory's
-            // tenant_id when memory_id IS NOT NULL. INSERT + UPDATE pair, mirroring
-            // v14 memories.kind enforcement (db.ts:298-322).
-            db.exec(`
+        `;
+const CREATE_TRIGGER_TRG_PREDICTIONS_TENANT_MATCH_INSERT_SQL = `
           CREATE TRIGGER IF NOT EXISTS trg_predictions_tenant_match_insert
           BEFORE INSERT ON predictions
           WHEN NEW.memory_id IS NOT NULL
@@ -58,8 +36,8 @@ export const v29 = {
               THEN RAISE(ABORT, 'predictions.tenant_id must match memories.tenant_id for the referenced memory')
             END;
           END
-        `);
-            db.exec(`
+        `;
+const CREATE_TRIGGER_TRG_PREDICTIONS_TENANT_MATCH_UPDATE_SQL = `
           CREATE TRIGGER IF NOT EXISTS trg_predictions_tenant_match_update
           BEFORE UPDATE ON predictions
           WHEN NEW.memory_id IS NOT NULL
@@ -70,7 +48,20 @@ export const v29 = {
               THEN RAISE(ABORT, 'predictions.tenant_id must match memories.tenant_id for the referenced memory')
             END;
           END
-        `);
+        `;
+export const v29 = {
+    version: 29,
+    up: (db) => {
+        // Prediction first-class object: claim_text is duplicated so deleting the memory loses nothing; memory_id is NULLABLE ON DELETE SET NULL.
+        // Tenant-match triggers replace a composite FK, which is incompatible with ON DELETE SET NULL; closure_state is CHECKed to open|closed|closed-unknown.
+        if (!tableExists(db, 'predictions')) {
+            db.exec(CREATE_TABLE_PREDICTIONS_SQL);
+            db.exec(CREATE_INDEX_IDX_PREDICTIONS_TENANT_CLASS_SQL);
+            db.exec(CREATE_INDEX_IDX_PREDICTIONS_MEMORY_SQL);
+            // Cross-tenant safety: tenant_id must match the referenced memory's tenant_id when memory_id IS NOT NULL;
+            // INSERT + UPDATE pair, mirroring the v14 memories.kind enforcement.
+            db.exec(CREATE_TRIGGER_TRG_PREDICTIONS_TENANT_MATCH_INSERT_SQL);
+            db.exec(CREATE_TRIGGER_TRG_PREDICTIONS_TENANT_MATCH_UPDATE_SQL);
         }
     },
 };

package/dist/db/migrations/v30.js

@@ -48,10 +48,8 @@ const TRG_DECISIONS_TENANT_MATCH_UPDATE = `
             END;
           END
         `;
-// Cross-tenant safety vs the successor decision (self-FK). superseded_by
-// is set only via UPDATE (the supersede path); the successor must share
-// the tenant. The successor row already exists in the same transaction
-// when this fires, so the subquery resolves.
+// Cross-tenant safety vs the successor decision (self-FK): superseded_by is set only via the supersede UPDATE and the successor,
+// which already exists in the same transaction when this fires, must share the tenant.
 const TRG_DECISIONS_SUPERSEDE_TENANT_MATCH_UPDATE = `
           CREATE TRIGGER IF NOT EXISTS trg_decisions_supersede_tenant_match_update
           BEFORE UPDATE ON decisions
@@ -67,18 +65,8 @@ const TRG_DECISIONS_SUPERSEDE_TENANT_MATCH_UPDATE = `
 export const v30 = {
     version: 30,
     up: (db) => {
-        // Decision first-class object.
-        // Promotes `hippo decide` from a tagged memory (which decayed on a 90-day
-        // half-life even while the decision was still in force) to a dedicated
-        // decisions table that is the source of truth. The memory mirror is kept
-        // for recall but is no longer authoritative; memory_id is NULLABLE with
-        // ON DELETE SET NULL so forget/consolidate/archive does not lose a
-        // decision. Mirrors the v29 predictions tenant-match trigger pattern.
-        //
-        // status (active|superseded|closed): superseded carries a self-FK
-        // superseded_by to the successor decision; closed is a terminal
-        // retire-without-successor. A superseded_by same-tenant trigger makes
-        // cross-tenant supersession unrepresentable at the schema level.
+        // Decision first-class object, the source of truth for `hippo decide`; the memory mirror serves recall only, memory_id NULLABLE ON DELETE SET NULL.
+        // status active|superseded|closed (closed = retired without successor); a same-tenant trigger on superseded_by blocks cross-tenant supersession.
         if (!tableExists(db, 'decisions')) {
             db.exec(DECISIONS_TABLE);
             db.exec(IDX_DECISIONS_TENANT_STATUS);

package/dist/db/migrations/v31.js

@@ -1,24 +1,5 @@
 import { tableExists } from '../tables.js';
-export const v31 = {
-    version: 31,
-    up: (db) => {
-        // Incident first-class object.
-        // Mirrors the v30 decisions block but for an open -> resolved -> closed
-        // lifecycle (NOT supersede): there is no superseded_by self-FK and no
-        // supersede trigger. An incident is a postmortem capsule: a recorded
-        // operational event with a lifecycle and optional linked receipts (the
-        // memories that are its evidence, stored as a JSON array of ids in
-        // linked_memory_ids). The memory mirror is kept for recall but is not
-        // authoritative; memory_id is NULLABLE with ON DELETE SET NULL so
-        // forget/consolidate/archive does not lose an incident.
-        //
-        // status (open|resolved|closed): resolved records a resolution_text +
-        // resolved_at and stays on record; closed is a terminal retire reachable
-        // from open or resolved. Cross-tenant safety: BEFORE INSERT + BEFORE
-        // UPDATE triggers enforce incidents.tenant_id == the referenced memory's
-        // tenant_id (verbatim mirror of the v30 decisions tenant-match triggers).
-        if (!tableExists(db, 'incidents')) {
-            db.exec(`
+const CREATE_TABLE_INCIDENTS_SQL = `
           CREATE TABLE incidents (
             id INTEGER PRIMARY KEY AUTOINCREMENT,
             memory_id TEXT,
@@ -34,18 +15,16 @@ export const v31 = {
             created_at TEXT NOT NULL,
             FOREIGN KEY (memory_id) REFERENCES memories(id) ON DELETE SET NULL
           )
-        `);
-            db.exec(`
+        `;
+const CREATE_INDEX_IDX_INCIDENTS_TENANT_STATUS_SQL = `
           CREATE INDEX IF NOT EXISTS idx_incidents_tenant_status
           ON incidents(tenant_id, status)
-        `);
-            db.exec(`
+        `;
+const CREATE_INDEX_IDX_INCIDENTS_MEMORY_SQL = `
           CREATE INDEX IF NOT EXISTS idx_incidents_memory
           ON incidents(memory_id) WHERE memory_id IS NOT NULL
-        `);
-            // Cross-tenant safety vs the referenced memory (verbatim mirror of the
-            // v30 decisions tenant-match triggers; no supersede trigger).
-            db.exec(`
+        `;
+const CREATE_TRIGGER_TRG_INCIDENTS_TENANT_MATCH_INSERT_SQL = `
           CREATE TRIGGER IF NOT EXISTS trg_incidents_tenant_match_insert
           BEFORE INSERT ON incidents
           WHEN NEW.memory_id IS NOT NULL
@@ -55,8 +34,8 @@ export const v31 = {
               THEN RAISE(ABORT, 'incidents.tenant_id must match memories.tenant_id for the referenced memory')
             END;
           END
-        `);
-            db.exec(`
+        `;
+const CREATE_TRIGGER_TRG_INCIDENTS_TENANT_MATCH_UPDATE_SQL = `
           CREATE TRIGGER IF NOT EXISTS trg_incidents_tenant_match_update
           BEFORE UPDATE ON incidents
           WHEN NEW.memory_id IS NOT NULL
@@ -67,7 +46,20 @@ export const v31 = {
               THEN RAISE(ABORT, 'incidents.tenant_id must match memories.tenant_id for the referenced memory')
             END;
           END
-        `);
+        `;
+export const v31 = {
+    version: 31,
+    up: (db) => {
+        // Incident first-class object: a postmortem capsule with an open -> resolved -> closed lifecycle (no supersede) and linked receipts (JSON ids).
+        // Memory mirror is for recall only (memory_id NULLABLE ON DELETE SET NULL); BEFORE INSERT/UPDATE triggers mirror the v30 tenant-match triggers.
+        if (!tableExists(db, 'incidents')) {
+            db.exec(CREATE_TABLE_INCIDENTS_SQL);
+            db.exec(CREATE_INDEX_IDX_INCIDENTS_TENANT_STATUS_SQL);
+            db.exec(CREATE_INDEX_IDX_INCIDENTS_MEMORY_SQL);
+            // Cross-tenant safety vs the referenced memory (verbatim mirror of the
+            // v30 decisions tenant-match triggers; no supersede trigger).
+            db.exec(CREATE_TRIGGER_TRG_INCIDENTS_TENANT_MATCH_INSERT_SQL);
+            db.exec(CREATE_TRIGGER_TRG_INCIDENTS_TENANT_MATCH_UPDATE_SQL);
         }
     },
 };

package/dist/db/migrations/v32.js

@@ -52,10 +52,8 @@ const TRG_PROCESSES_TENANT_MATCH_UPDATE = `
             END;
           END
         `;
-// Cross-tenant safety vs the successor process (self-FK; verbatim mirror
-// of the v30 decisions supersede trigger). superseded_by is set only via
-// the supersede UPDATE; the successor must share the tenant. The successor
-// row already exists in the same transaction when this fires.
+// Cross-tenant safety vs the successor process (self-FK; mirrors the v30 supersede trigger): superseded_by is set only via the supersede UPDATE
+// and the successor, already present in the same transaction, must share the tenant.
 const TRG_PROCESSES_SUPERSEDE_TENANT_MATCH_UPDATE = `
           CREATE TRIGGER IF NOT EXISTS trg_processes_supersede_tenant_match_update
           BEFORE UPDATE ON processes
@@ -71,24 +69,8 @@ const TRG_PROCESSES_SUPERSEDE_TENANT_MATCH_UPDATE = `
 export const v32 = {
     version: 32,
     up: (db) => {
-        // Process first-class object.
-        // A process is a "living process map": a named, ordered list of steps that
-        // evolves. Unlike incident (open->resolved->closed, no supersede), process
-        // REUSES the v30 decisions supersede path as its delta mechanism: a process
-        // evolves by being superseded by a NEW VERSION that records what changed
-        // (change_summary) and the full new state (steps), carrying a derived
-        // version counter. So this table combines the v31 incidents tenant-match
-        // trigger pair (vs the referenced memory) WITH the v30 decisions
-        // superseded_by self-FK + supersede tenant-match trigger.
-        //
-        // status (active|superseded|closed): superseded carries a self-FK
-        // superseded_by to the successor version; closed is a terminal
-        // retire-without-successor (only an active head closes). The memory mirror
-        // is kept for recall but is not authoritative; memory_id is NULLABLE with
-        // ON DELETE SET NULL so forget/consolidate/archive does not lose a process.
-        // steps is a JSON-encoded array of step strings (scoped v1; a normalized
-        // process_steps table is deferred). version is server-derived
-        // (predecessor.version + 1); change_summary is set on a successor row only.
+        // Process first-class object (living process map): it evolves via the v30 supersede path, each version recording change_summary and full steps (JSON).
+        // Combines the v31 tenant-match trigger pair with the v30 superseded_by self-FK; version is server-derived (predecessor + 1); only an active head closes.
         if (!tableExists(db, 'processes')) {
             db.exec(PROCESSES_TABLE);
             db.exec(IDX_PROCESSES_TENANT_STATUS);