limn-review 0.1.123

package/dist/db/migrations/0060_drop_my_turn_dismissals.sql

@@ -0,0 +1,33 @@
+-- DROP `my_turn_dismissals` — the "Done" button's table, and the whole dismissal subsystem with
+-- it. The Postgres twin is migrations-pg/0047_drop_my_turn_dismissals.sql.
+--
+-- ⚠ THIS IS DESTRUCTIVE AND ONE-WAY. There is no down migration and no archive: the rows are
+-- deleted when this runs (65 of them on the author's own database). Nothing reads them — the ball
+-- rule landed in `getMyTurn` first, so the table has already been inert for a release — but a
+-- restore from before this migration is the only way back.
+--
+-- WHY IT IS GOING. Each row said "I have seen this one", written by hand because the fold could
+-- not work it out: My Turn had no predicate for "you already acted on this PR", so a card the user
+-- had reviewed, replied to or pushed to went on claiming their turn, and the only way to clear it
+-- was to tell the app. That predicate now exists. THE BALL RULE — an action is owed only while
+-- nothing the viewer has done since the last related event discharges it — is state-derived and
+-- recomputed on every read, so a card leaves the board the moment the user does the work. The
+-- dismissal was compensation for a missing fold, and the fold is no longer missing.
+--
+-- AND IT WAS THE WRONG SHAPE ANYWAY. A dismissal never expired. Press "Done" on a review request
+-- and the request stayed dismissed while the work stayed real — the acknowledgement outlived the
+-- fact it acknowledged. That is ticket-queue behaviour: a list you maintain by hand, kept true by
+-- grooming it. This product's claim is the opposite one — the board is derived from GitHub, so it
+-- is right without being tended — and a button that let a user hide a fact from themselves was
+-- the one place the claim was false. Real evidence of this: on the author's account a PR whose
+-- ball was genuinely back in their court stayed invisible for weeks behind a stored dismissal.
+--
+-- WHAT WENT WITH IT, in the same change: POST /api/my-turn/dismiss, GET /api/my-turn/done,
+-- POST /api/my-turn/undismiss, `getCompletedDismissals`, `getActionableActivityIds` (which existed
+-- only to tell the "Done" tab whether restoring an entry would do anything), the SPA's Done button
+-- and the `dismissRefId` wire field. GET /api/my-turn is the only my-turn route left.
+--
+-- The two indexes go with the table; SQLite drops them automatically, and they are named here so
+-- a reader diffing this against 0002_famous_sersi.sql / 0008_multitenant_accounts.sql can see that
+-- nothing is left behind: `mtd_kind_ref_ux` (kind, ref_id) and `mtd_account_idx` (account_id).
+DROP TABLE `my_turn_dismissals`;

package/dist/db/migrations/0061_auto_merge_durable_anchors.sql

@@ -0,0 +1,27 @@
+-- Two anchors the auto-merge watcher DISARMS on, moved out of process memory onto the row.
+-- The Postgres twin is migrations-pg/0048_auto_merge_durable_anchors.sql.
+--
+-- WHY. Both facts lived in module-level Maps in `merge/auto-merge-runner.ts` (`pendingUpdates`,
+-- and the retarget guard's implicit reliance on a synced column read at run time). A Map is fine
+-- for a hint. It is not fine for a fact the watcher ends an intent on, because losing it does not
+-- read as "I forgot" — it reads as "something unexplained happened to this branch", and the safe
+-- response to an unexplained head move is to disarm. Under `pnpm dev` that is every file save;
+-- in cloud it is every deploy. Measured on the author's own account, 3 of 21 intents died and a
+-- further 2 were at risk from exactly this class of bookkeeping loss.
+--
+-- ⚠ BOTH ARE NULLABLE WITH NO DEFAULT, AND NULL MEANS "NOT RECORDED", NEVER A VALUE.
+-- `expected_base_ref` is null on every row armed before this migration; the retarget guard falls
+-- back to the synced base ref for those, which is exactly what it did before, so no already-armed
+-- intent changes behaviour. A DEFAULT here would assert the user consented to a branch nobody
+-- asked them about.
+
+-- The base branch the SPA was showing when the user armed. The head pin cannot see a retarget
+-- (PATCH pulls/{n} with a new `base` leaves head.sha alone), so consent to "merge into main"
+-- needs its own anchor. It was being approximated by reading `pull_requests.base_ref_name` at RUN
+-- time — a value the sync owns and may correct at any moment, at which point the watcher reports
+-- a retarget that never happened.
+ALTER TABLE `auto_merge_requests` ADD `expected_base_ref` text;--> statement-breakpoint
+-- The head SHA an in-flight update-branch was issued AGAINST. GitHub's update-branch returns 202
+-- with no handle to poll, so the head move it causes arrives on a later tick; without this the
+-- watcher cannot tell its OWN merge commit from a human push and disarms with "the branch moved".
+ALTER TABLE `auto_merge_requests` ADD `update_issued_against_oid` text;

package/dist/db/migrations/0062_blast_radius_config.sql

@@ -0,0 +1,21 @@
+-- BLAST RADIUS reading settings (CORE, free, no AI). How aggressively to read a pull request's
+-- REACH — the orthogonal companion to the large-PR flag's `large_pr_code_loc_threshold` (0057),
+-- which reads its SIZE.
+--
+-- ONE PER-ACCOUNT SETTING, for the same reason as that one: the comparison is render-time, it
+-- rides /api/me, and a per-workspace value would put a new "workspace not resolved yet"
+-- null-state on four surfaces (including the vis-timeline tooltip, which is raw HTML with no
+-- hook to read a workspace from).
+--
+-- ONE JSON COLUMN rather than six integer ones: the shape is `{sensitivity, surfacesOff[],
+-- overrides?}` — a settings blob with exactly one writer (PUT /api/me/blast-radius-config, which
+-- validates it), and nothing joins, filters or orders on any field inside it.
+--
+-- NULLABLE with NO default and NO backfill, exactly like 0057: NULL means "the user has never
+-- expressed an opinion" and the SPA resolves the product defaults. Two states, so a future change
+-- to those defaults reaches every account that never overrode them — which a backfilled blob
+-- would freeze. ⚠ The defaults are NOT mirrored backend-side: packages/shared's BLAST_THRESHOLDS
+-- is an 18-number table and `shared` is types-only on that side (PACKAGING), so /api/me echoes
+-- this column RAW and the SPA's one resolver applies it.
+-- The Postgres twin is migrations-pg/0049_blast_radius_config.sql.
+ALTER TABLE `accounts` ADD `blast_radius_config` text;

package/dist/db/migrations/0063_repo_file_coupling.sql

@@ -0,0 +1,33 @@
+-- BLAST RADIUS: the per-repo CO-CHANGE index (CORE, free, no AI, no GitHub calls).
+--
+-- "Which files in this repository does everything else change with?" — the cross-file dependency
+-- reading, derived ENTIRELY from data already stored (`pull_requests.files` on MERGED pull
+-- requests). A real import graph would need file CONTENTS, i.e. a GitHub fetch per file, and the
+-- Pending board may not fetch on mount.
+--
+-- DERIVED, so this table is a CACHE: dropping it loses nothing but a rebuild, and it carries no
+-- foreign-key cascade duty of its own. It still denormalizes `account_id` like every other anchor
+-- table, and is therefore in `accountScopedTables()`.
+--
+-- ⚠ IT STORES ONLY THE HUBS. A path below `hub_bar` is simply absent, so the JSON stays small
+-- (measured: 84 paths across 7 real repositories, vs 11,651 distinct paths seen).
+--
+-- ⚠ `hub_bar` IS max(repo p90, an absolute floor), AND BOTH HALVES ARE LOAD-BEARING. A p90 alone
+-- is exceeded by a tenth of paths by construction, so a repository with no coupling still
+-- publishes "hubs": measured, a config repo produced 77 of them — eight per-environment copies of
+-- one service's .env file. Adding the absolute floor took that repo to zero while leaving
+-- `redis.go`, `src/renderers/WebGLRenderer.js` and `crates/bevy_render/src/lib.rs` standing.
+-- The Postgres twin is migrations-pg/0050_repo_file_coupling.sql.
+CREATE TABLE `repo_file_coupling` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`account_id` integer NOT NULL,
+	`repo_id` integer NOT NULL,
+	`hub_bar` integer NOT NULL,
+	`pr_count` integer NOT NULL,
+	`hubs` text NOT NULL,
+	`built_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`account_id`) REFERENCES `accounts`(`id`) ON UPDATE no action ON DELETE no action,
+	FOREIGN KEY (`repo_id`) REFERENCES `repos`(`id`) ON UPDATE no action ON DELETE no action
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `rfc_account_repo` ON `repo_file_coupling` (`account_id`,`repo_id`);

package/dist/db/migrations/0064_pr_content_kind.sql

@@ -0,0 +1,21 @@
+-- BLAST RADIUS: what a pull request's code churn CONSISTS of (CORE, free, no AI).
+--
+-- Blast radius answers "how far can this reach" from the file PATHS, which is right about the
+-- FILE and can be wrong about the CHANGE. The case: golang/go#80721, "crypto/hpke: document
+-- sequence counter size" — one file, +4 −2, every changed line a `//` doc comment, flagged HIGH
+-- because `crypto/` is a contract surface. `content_kind` is read from the DIFF and caps that at
+-- medium (never at LOW — a comment in a crypto file is still a change to a file that matters).
+--
+-- ⚠ NULL IS "WE DID NOT LOOK", AND IT IS THE COMMON CASE BY DESIGN. Knowing this costs a REST
+-- call per pull request, so `sync/classify-change-shape.ts` fetches it only for the narrow
+-- population where it could change the level — measured at 26 of 1,566 open pull requests (1.7%).
+-- No backfill: every other row stays null forever, and no reader may treat null as 'code'.
+--
+-- ⚠ `content_kind_sha` IS NOT OPTIONAL BOOKKEEPING. A diff read is only true of the commit it
+-- read. Without it a "comments only" verdict survives a force-push that added a schema change,
+-- and the level stays capped on evidence that no longer exists. Every reader compares it against
+-- `head_sha` and treats a mismatch as null.
+-- The Postgres twin is migrations-pg/0051_pr_content_kind.sql.
+ALTER TABLE `pull_requests` ADD `content_kind` text;
+--> statement-breakpoint
+ALTER TABLE `pull_requests` ADD `content_kind_sha` text;

package/dist/db/migrations/0065_workspace_flow_settings.sql

@@ -0,0 +1,13 @@
+-- CHRONOLOGY'S WORKING HOURS AND WAIT BUDGETS, per workspace (CORE, free, no AI).
+--
+-- Chronology charges every hour a pull request waits to whoever it is waiting on. Measured on a
+-- real workspace, 73% of those hours fell outside the team's working day — a PR opened on Friday
+-- afternoon was charged a weekend. This column holds the workspace's time zone, working days and
+-- hours, and a budget per wait ("good" / "acceptable", in working hours).
+--
+-- ⚠ OVERRIDES ONLY. NULL until someone changes something, then only the fields they changed.
+-- Every reader resolves through `resolveFlowSettings` in packages/shared/src/flow-settings.ts,
+-- so a later change to a product default reaches every workspace that never overrode it.
+-- No backfill: NULL is "every default", which is correct for every existing row.
+-- The Postgres twin is migrations-pg/0052_workspace_flow_settings.sql.
+ALTER TABLE `workspaces` ADD `flow_settings` text;

package/dist/db/migrations/0066_review_request_events.sql

@@ -0,0 +1,31 @@
+-- REVIEW-REQUEST HISTORY (CORE, free, no AI) — for Chronology's "asked to first look".
+--
+-- `review_requests` holds only OUTSTANDING requests, and GitHub removes one the moment the person
+-- reviews — so for a merged PR we could not say whether a person or a team was asked, or how long
+-- it was from the request to anyone looking. This table keeps every ReviewRequestedEvent and
+-- ReviewRequestRemovedEvent from the PR's timeline (the first 25 per PR).
+--
+-- A PR CHILD with no account_id (the review_requests precedent): deleted by deletePrSubtree AND
+-- deleteRepo, erased through the repo loop. Immutable: upserted DO NOTHING on (pr_id, node id).
+--
+-- `pull_requests.review_requests_synced_at` marks a PR whose history we actually RECEIVED. NULL is
+-- "not known", which Chronology must not read as "never requested"; it is also the one-time
+-- backfill's worklist (sync/backfill-review-requests.ts). The GraphQL selection that feeds this was
+-- measured at 0 extra points per page (15 → 15, rateLimit dryRun, pullRequests(first: 25)).
+-- The Postgres twin is migrations-pg/0053_review_request_events.sql.
+CREATE TABLE `review_request_events` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`pr_id` integer NOT NULL,
+	`github_node_id` text NOT NULL,
+	`kind` text NOT NULL,
+	`occurred_at` integer NOT NULL,
+	`reviewer_kind` text NOT NULL,
+	`reviewer_user_id` integer,
+	`team_slug` text,
+	FOREIGN KEY (`pr_id`) REFERENCES `pull_requests`(`id`) ON UPDATE no action ON DELETE no action,
+	FOREIGN KEY (`reviewer_user_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE no action
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `review_request_events_pr_node` ON `review_request_events` (`pr_id`,`github_node_id`);
+--> statement-breakpoint
+ALTER TABLE `pull_requests` ADD `review_requests_synced_at` integer;

package/dist/db/migrations/0067_pr_security_signals.sql

@@ -0,0 +1,86 @@
+-- DEPENDENCY + SECURITY SIGNALS on a pull request (CORE, free, no AI).
+--
+-- Four small DERIVED columns, read at sync from the PR's own title, branch, labels and FULL
+-- `bodyText` by `sync/security-detect.ts`:
+--   `dependency_vendor`   — the dependency/remediation tool whose OWN marker is on the PR
+--                           (`dependabot/` branch, `[Snyk] ` title, Dependabot's commands footer…).
+--                           CONTENT ONLY, never the author login: a Snyk fix opened under a
+--                           person's token still carries Snyk's marker, and the author half is
+--                           resolved on read, per workspace.
+--   `security_fix`        — 'proven' (the tool's own security marker), 'inferred' (Dependabot's
+--                           ecosystem-named group with its truncation note), or NULL.
+--   `advisory_ids`        — the advisory ids the VENDOR-SELECTED fields name (JSON array), NULL
+--                           when there are none. Never the release notes an ordinary bump quotes.
+--   `security_checked_at` — when the classification was written. NULL is "never classified" and
+--                           is the one-shot backfill's worklist (`sync/backfill-pr-security.ts`).
+--
+-- ⚠ NO BODIES. Lean storage holds: the body is read in memory during the sync and only the
+-- verdict is kept.
+--
+-- ⚠ THE WRITE IS THREE-STATE, and the four columns move together or not at all. GitHub types
+-- `bodyText` String!, so a null can only be a partial response and an absent key a response that
+-- never carried the selection — both LEARN NOTHING and write nothing. A string, even '', is a
+-- positive statement, and the classification is written whole, NULLs included.
+--
+-- ⚠ DETECTION CANNOT USE `search_index`. It caps the body at 4,000 characters, and Dependabot's
+-- security footer is the LAST line of a body that runs to 65 KB.
+--
+-- WHY THE `workspace_reviewers` UPDATES ARE HERE. Six automation logins (and Semgrep's per-org
+-- `semgrep-code-<org>` App) joined the vocabulary in the same change. The stored role and kind
+-- win over the login seed on read, so widening the vocabulary in code alone never reaches a
+-- workspace whose Bots tab already classified these logins — the 0053/0054 precedent, with the
+-- same three load-bearing conditions: `source <> 'manual'` (a role a PERSON chose is never
+-- re-derived), `identity_source <> 'manual'` + `kind IN ('in_house','vendor')` (only an UNBRANDED
+-- identity is upgraded, and never one a person named), and `label = NULL` (the label caches the
+-- old "In-house AI" name). `[bot]` is stripped because `x` and `x[bot]` are separate `users` rows.
+-- The Postgres twin is migrations-pg/0054_pr_security_signals.sql.
+ALTER TABLE `pull_requests` ADD `dependency_vendor` text;
+--> statement-breakpoint
+ALTER TABLE `pull_requests` ADD `security_fix` text;
+--> statement-breakpoint
+ALTER TABLE `pull_requests` ADD `advisory_ids` text;
+--> statement-breakpoint
+ALTER TABLE `pull_requests` ADD `security_checked_at` integer;
+--> statement-breakpoint
+UPDATE `workspace_reviewers`
+SET `role` = 'dependency'
+WHERE `source` <> 'manual'
+  AND `author_user_id` IN (
+    SELECT `id` FROM `users` WHERE replace(lower(`github_login`), '[bot]', '') IN
+      ('snyk-io', 'aikido-autofix', 'mend-for-github-com')
+  );--> statement-breakpoint
+UPDATE `workspace_reviewers`
+SET `role` = 'quality_check'
+WHERE `source` <> 'manual'
+  AND `author_user_id` IN (
+    SELECT `id` FROM `users` WHERE replace(lower(`github_login`), '[bot]', '') IN ('endor-labs-pro')
+       OR lower(`github_login`) LIKE 'semgrep-code-%' OR lower(`github_login`) LIKE 'semgrepcode-%'
+  );--> statement-breakpoint
+UPDATE `workspace_reviewers`
+SET `role` = 'code_agent'
+WHERE `source` <> 'manual'
+  AND `author_user_id` IN (
+    SELECT `id` FROM `users` WHERE replace(lower(`github_login`), '[bot]', '') IN
+      ('step-security-bot', 'orbisai0security')
+  );--> statement-breakpoint
+UPDATE `workspace_reviewers` SET `kind` = 'snyk', `label` = NULL
+WHERE `identity_source` <> 'manual' AND `kind` IN ('in_house', 'vendor')
+  AND `author_user_id` IN (SELECT `id` FROM `users` WHERE replace(lower(`github_login`), '[bot]', '') IN ('snyk-io'));--> statement-breakpoint
+UPDATE `workspace_reviewers` SET `kind` = 'aikido', `label` = NULL
+WHERE `identity_source` <> 'manual' AND `kind` IN ('in_house', 'vendor')
+  AND `author_user_id` IN (SELECT `id` FROM `users` WHERE replace(lower(`github_login`), '[bot]', '') IN ('aikido-autofix'));--> statement-breakpoint
+UPDATE `workspace_reviewers` SET `kind` = 'mend', `label` = NULL
+WHERE `identity_source` <> 'manual' AND `kind` IN ('in_house', 'vendor')
+  AND `author_user_id` IN (SELECT `id` FROM `users` WHERE replace(lower(`github_login`), '[bot]', '') IN ('mend-for-github-com'));--> statement-breakpoint
+UPDATE `workspace_reviewers` SET `kind` = 'endor', `label` = NULL
+WHERE `identity_source` <> 'manual' AND `kind` IN ('in_house', 'vendor')
+  AND `author_user_id` IN (SELECT `id` FROM `users` WHERE replace(lower(`github_login`), '[bot]', '') IN ('endor-labs-pro'));--> statement-breakpoint
+UPDATE `workspace_reviewers` SET `kind` = 'semgrep', `label` = NULL
+WHERE `identity_source` <> 'manual' AND `kind` IN ('in_house', 'vendor')
+  AND `author_user_id` IN (SELECT `id` FROM `users` WHERE lower(`github_login`) LIKE 'semgrep-code-%' OR lower(`github_login`) LIKE 'semgrepcode-%');--> statement-breakpoint
+UPDATE `workspace_reviewers` SET `kind` = 'step_security', `label` = NULL
+WHERE `identity_source` <> 'manual' AND `kind` IN ('in_house', 'vendor')
+  AND `author_user_id` IN (SELECT `id` FROM `users` WHERE replace(lower(`github_login`), '[bot]', '') IN ('step-security-bot'));--> statement-breakpoint
+UPDATE `workspace_reviewers` SET `kind` = 'orbisai', `label` = NULL
+WHERE `identity_source` <> 'manual' AND `kind` IN ('in_house', 'vendor')
+  AND `author_user_id` IN (SELECT `id` FROM `users` WHERE replace(lower(`github_login`), '[bot]', '') IN ('orbisai0security'));

package/dist/db/migrations/0068_my_turn_settings.sql

@@ -0,0 +1,18 @@
+-- MY TURN SETTINGS (CORE, free, no AI) + the MENTION CLOCK.
+--
+-- accounts.my_turn_settings: the reader's My Turn types, type order and ranking weights, stored as
+-- OVERRIDES ONLY. NULL = the product defaults, so a later change to a default reaches everyone who
+-- never changed it (the 0062 blast_radius_config rule). No default, no backfill. Resolved by
+-- packages/shared resolveMyTurnSettings; written only by PUT /api/me/my-turn-settings.
+--
+-- pr_mentions.mentioned_at / mentioned_by_user_id: WHEN a person last @-mentioned the viewer on the
+-- PR, and who. The My Turn mention card clears when the viewer acts AFTER this moment, which needs
+-- the moment. NULL until the mention scanner's next tick restamps every row (sync/mention-scan.ts);
+-- no backfill here, because the scanner re-derives the whole set every tick anyway. A NULL row
+-- produces no card.
+-- The Postgres twin is migrations-pg/0055_my_turn_settings.sql.
+ALTER TABLE `accounts` ADD `my_turn_settings` text;
+--> statement-breakpoint
+ALTER TABLE `pr_mentions` ADD `mentioned_at` integer;
+--> statement-breakpoint
+ALTER TABLE `pr_mentions` ADD `mentioned_by_user_id` integer;

package/dist/db/migrations/0069_my_turn_dismissals.sql

@@ -0,0 +1,41 @@
+-- MY TURN DISMISSALS (CORE, free, both modes) — "take this off my plate for now".
+--
+-- ⚠ THE SAME TABLE NAME AS THE ONE 0060 DROPPED, AND NOT THE SAME CONTRACT. 0060's table backed a
+-- "Done" button whose rows NEVER EXPIRED: press it on a review request and the request stayed
+-- hidden while the work stayed real — on the author's account a PR whose ball was genuinely back
+-- in their court sat invisible for weeks. Read 0060's header before touching this; everything it
+-- objected to is answered here by what the row does NOT decide:
+--
+--   • it holds ONE timestamp. `getMyTurn` hides a dismissed subject's items only while each item's
+--     own clock is at or before `dismissed_at`; anything that happens LATER shows again, alone;
+--   • a subject with NO My Turn item at all (you acted, it closed, the request was withdrawn)
+--     DISCHARGES its row, so a later summons starts fresh instead of arriving already dismissed.
+--
+-- So a dismissal never outlives the thing it dismissed. The ball rule still decides what is on the
+-- plate; this only lets the reader set one item down until something new happens to it.
+--
+-- ONE ROW PER SUBJECT — a pull request (`pr_id`) or, for a red default branch, a repository
+-- (`repo_id`); exactly one is set. Never per card: a PR can hold several My Turn jobs, and
+-- dismissing the one on screen must not surface the next one behind it.
+--
+-- Both ids arrive in a request path, so tenancy is STRUCTURAL: composite FKs against
+-- `(id, account_id)`. `repos_id_account` already exists (0042); `pull_requests_id_account` is new
+-- here and exists only as that parent key (`id` is the primary key, so it is never a lookup). A
+-- composite FK with a NULL member is not checked (MATCH SIMPLE), which is what lets one table carry
+-- both subject kinds. The Postgres twin is migrations-pg/0056_my_turn_dismissals.sql.
+CREATE UNIQUE INDEX IF NOT EXISTS `pull_requests_id_account` ON `pull_requests` (`id`,`account_id`);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `my_turn_dismissals` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`account_id` integer NOT NULL,
+	`pr_id` integer,
+	`repo_id` integer,
+	`dismissed_at` integer NOT NULL,
+	FOREIGN KEY (`account_id`) REFERENCES `accounts`(`id`) ON UPDATE no action ON DELETE cascade,
+	CONSTRAINT `my_turn_dismissals_pr_account_fk` FOREIGN KEY (`pr_id`,`account_id`) REFERENCES `pull_requests`(`id`,`account_id`) ON UPDATE no action ON DELETE cascade,
+	CONSTRAINT `my_turn_dismissals_repo_account_fk` FOREIGN KEY (`repo_id`,`account_id`) REFERENCES `repos`(`id`,`account_id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `my_turn_dismissals_account_pr` ON `my_turn_dismissals` (`account_id`,`pr_id`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `my_turn_dismissals_account_repo` ON `my_turn_dismissals` (`account_id`,`repo_id`);

package/dist/db/migrations/0070_claude_review_follow_up_ticket.sql

@@ -0,0 +1,22 @@
+-- CLAUDE REVIEW: FOLLOW-UP ON THE PREVIOUS REVIEW + THE OPTIONAL USER STORY (local-only feature).
+--
+-- claude_reviews.ticket: the user story or task the run was given ({title, description,
+-- acceptanceCriteria, criteria[]}, criteria = the server's AC1..n split). Written at QUEUE time,
+-- so a failed or cancelled run still prefills the panel on the next run.
+-- claude_reviews.ticket_assessment: the server-validated assessment against it (each criterion
+-- answered exactly once; one Claude skipped is 'not_checked').
+-- claude_reviews.follow_up: what this run found about the PREVIOUS succeeded review's findings
+-- (addressed / partly / not / no longer applies / not checked) + that review's id and head.
+-- claude_review_findings.prior_finding_id: the previous-review finding this one RE-RAISES. A SOFT
+-- reference with NO FK: it always points at a finding of the SAME PR, and retention.ts +
+-- deleteRepo delete a PR's findings in one statement, so an FK would only add delete-ordering risk.
+--
+-- All four are nullable with no backfill: an older run simply has none of them.
+-- The Postgres twin is migrations-pg/0057_claude_review_follow_up_ticket.sql.
+ALTER TABLE `claude_reviews` ADD `ticket` text;
+--> statement-breakpoint
+ALTER TABLE `claude_reviews` ADD `ticket_assessment` text;
+--> statement-breakpoint
+ALTER TABLE `claude_reviews` ADD `follow_up` text;
+--> statement-breakpoint
+ALTER TABLE `claude_review_findings` ADD `prior_finding_id` integer;

package/dist/db/migrations/0071_claude_review_trigger.sql

@@ -0,0 +1,11 @@
+-- CLAUDE REVIEW: WHO STARTED THE RUN (local-only feature).
+--
+-- claude_reviews.trigger: 'manual' (a person pressed Review) or 'auto' (the per-workspace auto
+-- review sweeper in the Pro plugin started it for a newly opened human PR). NOT NULL DEFAULT
+-- 'manual', so every existing row reads as what it was: a click.
+--
+-- It is a CORE column, not a plugin table, because a CORE read needs it: `getUnactionedClaudeReviews`
+-- carries it to the My Turn "Claude review ready" card, which labels an AUTO run "Auto review".
+-- The row is core-owned already; a side table would be a second place to join for one enum.
+-- The Postgres twin is migrations-pg/0058_claude_review_trigger.sql.
+ALTER TABLE `claude_reviews` ADD `trigger` text DEFAULT 'manual' NOT NULL;

package/dist/db/migrations/0072_commit_message_headline.sql

@@ -0,0 +1,13 @@
+-- MY TURN "PUSHED SINCE": THE FIRST LINE OF EACH COMMIT MESSAGE.
+--
+-- commits.message_headline: GitHub's `messageHeadline` (the subject line), at most 200 chars.
+-- The "Pushed since" card on the Pending board lists what was pushed after your last action, and
+-- the board may not fetch on mount, so the line has to be stored.
+--
+-- It is NOT `message`. `message` is the full body, lean-gated (never fetched or stored unless
+-- PERSIST_BODIES=true) and hydrated on demand for PR detail. The headline is one short line and is
+-- fetched on EVERY walk, in both storage modes. It is written only when GitHub sent it; NULL means
+-- "not synced yet", never "empty" (the backfill in sync/backfill-commit-headlines.ts fills open
+-- PRs after a walk).
+-- The Postgres twin is migrations-pg/0059_commit_message_headline.sql.
+ALTER TABLE `commits` ADD `message_headline` text;

package/dist/db/migrations/0073_claude_review_chat.sql

@@ -0,0 +1,31 @@
+-- CLAUDE REVIEW CHAT (local-only feature): one row per chat message about one succeeded review —
+-- a general thread (`finding_id` NULL) and one thread per finding. The transcript the model sees
+-- is rebuilt SERVER-SIDE from these rows each turn. Never carried across reviews.
+--
+-- `review_id` arrives in a request path, so tenancy is STRUCTURAL: a composite FK against
+-- claude_reviews(id, account_id), whose parent key `claude_reviews_id_account` is new here (`id` is
+-- the primary key, so it is never a lookup). Both delete paths (deleteRepo, retention's
+-- deletePrSubtree) and eraseAccountData delete these rows explicitly, before their parents.
+-- The Postgres twin is migrations-pg/0060_claude_review_chat.sql.
+CREATE UNIQUE INDEX IF NOT EXISTS `claude_reviews_id_account` ON `claude_reviews` (`id`,`account_id`);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `claude_review_chat_messages` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`account_id` integer NOT NULL,
+	`review_id` integer NOT NULL,
+	`finding_id` integer,
+	`role` text NOT NULL,
+	`content` text NOT NULL,
+	`model` text,
+	`cost_usd` real,
+	`input_tokens` integer,
+	`output_tokens` integer,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`account_id`) REFERENCES `accounts`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`finding_id`) REFERENCES `claude_review_findings`(`id`) ON UPDATE no action ON DELETE cascade,
+	CONSTRAINT `crcm_review_account_fk` FOREIGN KEY (`review_id`,`account_id`) REFERENCES `claude_reviews`(`id`,`account_id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `crcm_thread_idx` ON `claude_review_chat_messages` (`review_id`,`finding_id`,`id`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `crcm_account_idx` ON `claude_review_chat_messages` (`account_id`);

package/dist/db/migrations/0074_adopt_agentic_tables.sql

@@ -0,0 +1,98 @@
+-- ADOPT THE AGENTIC TABLES INTO CORE (Claude Review memory + AI Fix), and give each workspace its
+-- auto-review switch. Claude Review, review memory and AI Fix moved from the private plugin into
+-- core (free, local-only); their two tables move with them. The Postgres twin is
+-- migrations-pg/0061_adopt_agentic_tables.sql.
+--
+-- ⚠ ADOPTED IN PLACE, NEVER RENAMED. On an install where the plugin already created them
+-- (plugin migrations 0001 / 0002 / 0003 / 0024) every CREATE below is a no-op and the rows stay as
+-- they are. On a fresh or plugin-less install this creates them. The DDL is the plugin's FINAL
+-- shape, minus the eight dormant `resolved_*` / `resolve_error` columns of plugin 0003 (AI Fix's
+-- removed rebase artifact): nothing declares or reads them, and an adopted table that still carries
+-- them reads identically. Same types, same defaults, same index names, and NO foreign keys — SQLite
+-- cannot add one to an existing table without a rebuild, so a fresh and an adopted install would
+-- otherwise differ. Tenancy is query-layer (every read filters account_id) plus verify:isolation;
+-- no id in either table arrives in a request body.
+--
+-- ⚠ THE PLUGIN'S OWN COPIES OF THIS DDL WERE STRIPPED IN THE SAME CHANGE (plugin 0001's
+-- review_learnings half, 0002's ai_fixes half, 0003 and 0024 entirely). Core migrations run BEFORE
+-- the plugin binds, so on a fresh SQLite install core creates the full ai_fixes first — and the
+-- plugin's bare `ALTER TABLE ai_fixes ADD COLUMN` would throw "duplicate column", which drops the
+-- WHOLE plugin to OSS mode silently.
+--
+-- Known gap: an install whose plugin stopped before 0024 (pre-apiVersion 19) keeps an ai_fixes
+-- without comment_targets/comment_verdicts — SQLite has no ADD COLUMN IF NOT EXISTS. No such
+-- install is known; the pg twin adds them idempotently.
+CREATE TABLE IF NOT EXISTS `review_learnings` (
+	`id` integer PRIMARY KEY AUTOINCREMENT,
+	`account_id` integer NOT NULL,
+	`repo_id` integer NOT NULL,
+	`pr_id` integer NOT NULL,
+	`source_review_id` integer NOT NULL,
+	`finding_id` integer,
+	`head_sha` text NOT NULL,
+	`kind` text NOT NULL,
+	`path` text,
+	`dir_path` text,
+	`ext` text,
+	`category` text,
+	`claude_verdict` text,
+	`user_verdict` text,
+	`claude_title` text,
+	`claude_text` text,
+	`user_text` text,
+	`posted_comment_kind` text,
+	`dedupe_key` text NOT NULL,
+	`created_at` integer NOT NULL DEFAULT (unixepoch())
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `rl_account_dedupe` ON `review_learnings` (`account_id`,`dedupe_key`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `rl_account_repo_category` ON `review_learnings` (`account_id`,`repo_id`,`category`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `rl_account_repo_dir` ON `review_learnings` (`account_id`,`repo_id`,`dir_path`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `rl_account_source_review` ON `review_learnings` (`account_id`,`source_review_id`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `rl_account_repo_created` ON `review_learnings` (`account_id`,`repo_id`,`created_at`);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `ai_fixes` (
+	`id` integer PRIMARY KEY AUTOINCREMENT,
+	`account_id` integer NOT NULL,
+	`repo_id` integer NOT NULL,
+	`pr_id` integer NOT NULL,
+	`source_review_id` integer,
+	`base_sha` text NOT NULL,
+	`status` text NOT NULL,
+	`model` text NOT NULL,
+	`seed` text NOT NULL,
+	`prompt` text,
+	`summary` text,
+	`commit_message` text,
+	`patch` text,
+	`files_changed` text,
+	`cost_usd` real,
+	`input_tokens` integer,
+	`output_tokens` integer,
+	`num_turns` integer,
+	`error` text,
+	`pushed_branch` text,
+	`pushed_pr_number` integer,
+	`pushed_pr_url` text,
+	`pushed_at` integer,
+	`created_at` integer NOT NULL DEFAULT (unixepoch()),
+	`finished_at` integer,
+	`comment_targets` text,
+	`comment_verdicts` text
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `af_account_pr_created` ON `ai_fixes` (`account_id`,`pr_id`,`created_at`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `af_account_status` ON `ai_fixes` (`account_id`,`status`);
+--> statement-breakpoint
+-- AUTO CLAUDE REVIEW, PER WORKSPACE (moved off the plugin's pro_workspace_settings, plugin 0036).
+-- NULL/0 = off. `auto_review_enabled_at` is when it was last switched ON: the sweeper reviews only
+-- PRs OPENED at or after it. The plugin's migration 0037 copies existing values across — a core
+-- statement naming pro_workspace_settings would fail on every install that never had the plugin.
+ALTER TABLE `workspaces` ADD `auto_review_enabled` integer;
+--> statement-breakpoint
+ALTER TABLE `workspaces` ADD `auto_review_enabled_at` integer;

package/dist/db/migrations/0075_review_lens_drop_learnings.sql

@@ -0,0 +1,15 @@
+-- CLAUDE REVIEW: A FINDING'S LENS, AND REVIEW MEMORY DELETED.
+--
+-- claude_review_findings.lens: which specialist angle raised the finding — 'design', 'tests',
+-- 'impact', 'accessibility', 'security' or 'performance' — set on deep (worktree) reviews, where
+-- the lead agent may consult up to five specialist sub-agents. NULL is a general finding, and every
+-- older row is NULL (no backfill).
+--
+-- review_learnings is DROPPED. Review memory (capture of what the reader did with each finding,
+-- the "past reviews" panel and the prompt block built from it) was removed: it never improved a
+-- review. Adopted into core by 0074; the plugin's own DDL for it was already stripped, so nothing
+-- recreates it. DROP TABLE takes its five rl_* indexes with it.
+-- The Postgres twin is migrations-pg/0062_review_lens_drop_learnings.sql.
+ALTER TABLE `claude_review_findings` ADD `lens` text;
+--> statement-breakpoint
+DROP TABLE IF EXISTS `review_learnings`;

package/dist/db/migrations/0076_claude_review_threads.sql

@@ -0,0 +1,17 @@
+-- CLAUDE REVIEW: OTHER REVIEWERS' THREADS, AND THE COMMENT HALF OF THE AUTO RE-REVIEW KEY.
+--
+-- claude_reviews.thread_assessments (JSON array): every OTHER open review thread on the PR when the
+-- run loaded it — comments from people and from other review bots, never Limn's own posted
+-- findings (the follow-up covers those) — with Claude's two answers per thread: is the comment
+-- right (valid / partly_valid / not_valid / unclear) and has the code dealt with it (addressed /
+-- partly_addressed / not_addressed / unclear), plus 'not_checked' written only by the server.
+-- NULL on every older row (the wire reads it as "did not assess threads"; no backfill).
+--
+-- claude_reviews.comments_through (unix seconds): the newest qualifying review-thread comment the
+-- run saw. The auto-review sweeper re-reviews the same head when a newer one arrives (after the
+-- same 5-minute settle as a moved head). NULL ⇒ the row's created_at stands in, so a deploy does
+-- not re-review every PR that already has comments.
+-- The Postgres twin is migrations-pg/0063_claude_review_threads.sql.
+ALTER TABLE `claude_reviews` ADD `thread_assessments` text;
+--> statement-breakpoint
+ALTER TABLE `claude_reviews` ADD `comments_through` integer;

package/dist/db/migrations/0077_claude_review_ci_failures.sql

@@ -0,0 +1,10 @@
+-- CLAUDE REVIEW: FAILED CI ON THE REVIEWED HEAD.
+--
+-- claude_reviews.ci_failures (JSON object): the head's CI state when the run looked
+-- ({ state, checkCount, failures[] }) and, per failing check, what Claude found — cause,
+-- explanation, category (code / test / flaky_or_infra / config / unclear), the related files and
+-- whether it can be fixed in the pull request — or 'not_checked' written only by the server (no
+-- Actions log, the log could not be read, over the cap, or Claude did not report on it).
+-- NULL on every older row (the wire reads it as "did not look at CI"; no backfill).
+-- The Postgres twin is migrations-pg/0064_claude_review_ci_failures.sql.
+ALTER TABLE `claude_reviews` ADD `ci_failures` text;

package/dist/db/migrations/0078_ai_fix_change_report.sql

@@ -0,0 +1,17 @@
+-- AI FIX: TWO ENTRY POINTS, A PER-CHANGE REPORT, AND WHO STARTED THE RUN.
+--
+-- ai_fixes.trigger (text): 'manual' | 'auto' — 'auto' is the auto-review agent calling
+-- startReviewFix. NULL on older rows reads as 'manual'.
+-- ai_fixes.review_items (JSON AiFixReviewItem[]): seed 'review' only — every item of the Claude
+-- review the run was given, each with the ref the agent must cite (F1, P1, T1, S1-AC2, S1-M1, C1)
+-- and `included: false` for the ones left out for the prompt budget. Written at insert.
+-- ai_fixes.change_report (JSON AiFixChangeReport): the agent's per-file report (what changed, why,
+-- which refs) plus the refs it deliberately did not fix, validated server-side. Written on success.
+-- All nullable, no backfill. The removed 'comments' seed's comment_targets / comment_verdicts stay
+-- (old rows keep their data; nothing reads them).
+-- The Postgres twin is migrations-pg/0065_ai_fix_change_report.sql.
+ALTER TABLE `ai_fixes` ADD `trigger` text;
+--> statement-breakpoint
+ALTER TABLE `ai_fixes` ADD `review_items` text;
+--> statement-breakpoint
+ALTER TABLE `ai_fixes` ADD `change_report` text;

package/dist/db/migrations/0079_claude_finding_story.sql

@@ -0,0 +1,16 @@
+-- USER-STORY RESULTS BECOME FINDINGS.
+--
+-- Every acceptance criterion a Claude Review judged not met / partly met, and every "Not done"
+-- item of its user-story assessment, is now a normal row of claude_review_findings, made by the
+-- server from the reconciled assessment (review/claude-review/ticket.ts `storyFindingsFrom`) — so
+-- it posts, rewords, ignores and is followed up exactly like any other finding. The per-ticket
+-- "Post as comment" is retired (an old row's stored `posted` record is ignored on read).
+--
+-- claude_review_findings.story_index (integer): the ticket's 0-based position on the run.
+-- claude_review_findings.story_ref (text): the criterion's ref ('AC2') or a not-done item's ('M1').
+-- Both NULL on an ordinary finding. Nullable, no backfill: older reviews keep their story results
+-- in the stories section only.
+-- The Postgres twin is migrations-pg/0066_claude_finding_story.sql.
+ALTER TABLE `claude_review_findings` ADD `story_index` integer;
+--> statement-breakpoint
+ALTER TABLE `claude_review_findings` ADD `story_ref` text;