mirror-mind 0.39.5 → 0.40.0-next.1

package/.claude/hooks/log-assistant-reply.sh

@@ -74,8 +74,9 @@ ENTRY="$REPO_ROOT/bin/mirror-hook.js"
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/.claude/hooks/log-session-end.sh

@@ -74,8 +74,9 @@ ENTRY="$REPO_ROOT/bin/mirror-hook.js"
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/.claude/hooks/log-user-prompt.sh

@@ -74,8 +74,9 @@ ENTRY="$REPO_ROOT/bin/mirror-hook.js"
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/.claude/hooks/mirror-inject.sh

@@ -74,8 +74,9 @@ ENTRY="$REPO_ROOT/bin/mirror-hook.js"
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/.claude/hooks/session-start.sh

@@ -74,8 +74,9 @@ ENTRY="$REPO_ROOT/bin/mirror-hook.js"
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/docs/releases/index.md

@@ -12,6 +12,7 @@ Future release notes should use the structure defined in [Release Notes](../proc
 
 ## Releases
 
+- [v0.40.0-next.1 — A Journey Can Go, Showing What Goes With It](v0.40.0-next.1.md) — preview under npm's `next`, read by no updater, for Nautilus for Mirror (the release train): CR200, `mirror-mind/desktop` gains `previewJourneyDeletion` and `deleteJourneyWithRecords`, deleting a Journey with every record that belongs to it after a preview that counts it, by digest, behind a verified backup; child Journeys refuse. Terminal users receive it with v0.40.0. No migration.
 - [v0.39.5 — The Node You Named, or Why Not](v0.39.5.md) — patch release of CR192, from PR #47's thread (@rodrigoimmaginario): the hook wrappers, the plugin's MCP entry, and `runtime diagnose` use `MIRROR_NODE` only as an absolute path to an executable file, as the Pi extension does; a relative value is never run, and a refused one is named with its reason, once a day in `hooks.log` and on the MCP entry's stderr; the Windows installer's drive-letter path counts as absolute, in CI under Git Bash and on the installer. No migration.
 - [v0.39.4 — The Reply Finds Its Prompt](v0.39.4.md) — patch release of PR #51 (@alannascimento1), CR166 and CR196: on Claude Code, a prompt typed while a turn runs and a journey entered in plain words no longer lose the reply; `nothing_waiting` in `hooks.log` means a lost reply again. No schema change, no migration.
 - [v0.39.3 — Windows Gets Its Hooks](v0.39.3.md) — patch release of PR #53, PR #50, and PR #54 (@rodrigoimmaginario): the plugin's hook wrappers and MCP locator run the package's own bin when npm's global entry is a shell shim, so Claude Code hooks and the MCP server work on a Windows package install; `runtime diagnose` no longer counts its own verdict as a front-door error (CR139); the docs point a Windows reader to the installer in its own repository. No migration.

package/docs/releases/v0.40.0-next.1.md

@@ -0,0 +1,103 @@
+---
+digest: >
+  v0.40.0-next.1 is the first preview of the release train: published under npm's `next`
+  dist-tag, read by no updater, for Nautilus for Mirror, which embeds this Core. It carries
+  CR200: a host can delete a Journey together with every record that belongs to it, after
+  a preview that counts what will go, what other Journeys keep with a link cleared, and
+  which extension tables lose rows. The deletion acts only on the preview the person saw,
+  in one transaction, behind a named backup verified before any write. Terminal users
+  receive it with v0.40.0, when the train leaves. No schema change, no migration, and no
+  model or prompt change.
+---
+
+# v0.40.0-next.1 — A Journey Can Go, Showing What Goes With It
+
+**Date:** 2026-11-06
+
+**A preview, not a release users receive.** It is staged under `next`, its GitHub Release is
+a prerelease, and `stable`, `latest`, `mirror update` and the release-notes reader all stay
+on v0.39.5. It exists so Nautilus for Mirror can ship the change below before the train
+leaves ([the release train](../process/versioning.md#the-release-train)).
+
+## Highlights
+
+- **A Journey and its records, deleted in one act**
+  ([CR200](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr200-delete-a-journey-with-its-records-after-showing-what-will-go.md)).
+  `mirror-mind/desktop` gains `previewJourneyDeletion` and `deleteJourneyWithRecords`.
+  `deleteJourney` still deletes only an empty leaf.
+- **The preview is the contract.** It counts the Journey's own records, its Conversations'
+  contents, other Journeys' records that only lose a link, and the `ext_*` rows that name
+  the Journey, by owning extension, and hashes all of it. The deletion takes that digest
+  and refuses any other.
+- **A backup first, verified.** `backups/pre-journey-deletion-<id>-<stamp>-<random>.db`,
+  owner-only, taken under the write lock and read back as the same digest before anything
+  is deleted. A refused deletion removes it; a committed one keeps it.
+- **One friction kept:** a Journey with child Journeys is refused, naming them.
+- No schema change, no migration, and no model or prompt change.
+
+## Where We Started
+
+CV24.DS8 gave a host five Journey calls, and its `deleteJourney` refuses a Journey that
+holds anything: conversations, memories, tasks, attachments, stories, change requests,
+cursors. Nautilus for Mirror's Journey management (its RS028) asked for the act a person
+means by "delete this Journey". Its Navigator decided on 2026-11-05 and 2026-11-06 that
+everything that belongs to the Journey goes, that the confirmation shows it first, and,
+where the Core cannot judge data it does not own, to trade refusal for transparency.
+
+A long-lived home showed why "belongs" needed rules: 956 memories sit under a Journey other
+than their conversation's, and 101 runtime sessions likewise. Deleting by reach would have
+erased other Journeys' history.
+
+## What Changed
+
+**Four rules.** A record that belongs to the Journey goes. What belongs to a deleted
+conversation or memory goes with it: messages, embeddings, provider call records, memory
+access records. A record of another Journey that only points at something deleted stays,
+with that link cleared. And an `ext_*` row goes when the table's `journey_id` or `journey`
+column names the Journey exactly; the preview names the extension from `_ext_migrations`,
+and a row an extension's own foreign key holds refuses the deletion as
+`extension_rows_held`, naming the table.
+
+**A closed inventory.** `JOURNEY_DELETION_INVENTORY` names every core table the deletion
+touches, keeps or detaches, and a test reads the schema against it: a table that names a
+Journey, or references a row the deletion removes, without a decision fails. Its first
+run found `journey_mutation_receipts`, kept as the audit trail.
+
+**Refusals.** `journey_changed` for a digest that no longer matches, `journey_has_children`,
+`extension_rows_held`, `backup_failed`, and as before an unknown Journey, a malformed
+request and a database that is not current. Every refusal writes nothing.
+
+**Validated** in `journeyDeletion.test.ts` (11 tests, ten mutations each caught), in CI on
+Ubuntu and macOS (PR #55), and end to end by Nautilus: its host drives both calls
+against a scratch home, and its Navigator deleted Journeys in the app on 2026-11-06.
+
+**Also in this preview.** [CR199](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr199-deliver-mirror-context-takes-three-to-seven-seconds-before-every-desktop-turn.md)
+is captured: `deliverMirrorContext` takes three to seven seconds before every Desktop
+turn, measured. And the release train itself (PR #56) is in
+[versioning](../process/versioning.md#the-release-train).
+
+## Conscious Exclusions
+
+- No CLI command deletes a Journey with its records; a host is the only caller.
+- No cascade through child Journeys: they are refused, by the Navigator's decision.
+- Files on disk are the host's to decide; the Core touches only the database.
+- An extension cannot yet take over its own cleanup; recorded for when the extension
+  mechanism exists (CV24.DS8).
+- The test suite, run with `MIRROR_HOME` or `DB_PATH` inherited from a real home, writes
+  into that home. Found while validating this change; worth its own Change Request.
+
+## What We Learned
+
+A preview that is also the contract keeps both honest: the person confirms a list, the
+digest makes the deletion that list and nothing more, and a home that changed in between
+is told so instead of deleted differently.
+
+## Upgrading
+
+Nothing to do in the terminal: this preview is not offered by `mirror update`. A host that
+embeds the Core pins `mirror-mind@0.40.0-next.1` from the registry.
+
+## Next Horizon
+
+v0.40.0 leaves with the next train, carrying this change to every install, with whatever
+else merges before it.

package/lib/desktop.js

@@ -22,6 +22,7 @@ const migration = await import("../ts/src/db/migrateHome.ts");
 const context = await import("../ts/src/mirror/deliverContext.ts");
 const learning = await import("../ts/src/conversation/learnFromConversations.ts");
 const journeys = await import("../ts/src/journey/journeyCalls.ts");
+const journeyDeletion = await import("../ts/src/journey/journeyDeletion.ts");
 
 export const DESKTOP_API_VERSION = 1;
 export const inspectMigrationState = migrationReport.inspectMigrationState;
@@ -70,3 +71,10 @@ export const setJourneyProjectPath = journeys.setJourneyProjectPath;
 export const moveJourney = journeys.moveJourney;
 export const deleteJourney = journeys.deleteJourney;
 export const JourneyCallRejectedError = journeys.JourneyCallRejectedError;
+
+// Delete a Journey with its records, after showing what will go: the preview
+// counts every record by rule and answers a digest; the deletion takes that
+// digest back, refuses a home that no longer matches it, and runs behind a
+// retained, verified backup it names. Rejections are `JourneyCallRejectedError`s.
+export const previewJourneyDeletion = journeyDeletion.previewJourneyDeletion;
+export const deleteJourneyWithRecords = journeyDeletion.deleteJourneyWithRecords;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mirror-mind",
-  "version": "0.39.5",
+  "version": "0.40.0-next.1",
   "description": "Mirror Mind: a local-first memory and identity framework for agentic AI runtimes (Pi, Claude Code, Codex, Antigravity)",
   "license": "MIT",
   "repository": {

package/plugins/mirror-mind/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mirror-mind",
-  "version": "0.39.5",
+  "version": "0.40.0-next.1",
   "description": "Mirror Mind — local-first memory and identity for agentic runtimes.",
   "author": {
     "name": "Mirror Mind"

package/plugins/mirror-mind/agy/pre-invocation.sh

@@ -100,8 +100,9 @@ fi
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/plugins/mirror-mind/agy/session-start.sh

@@ -100,8 +100,9 @@ fi
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/plugins/mirror-mind/agy/stop.sh

@@ -100,8 +100,9 @@ fi
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/plugins/mirror-mind/hooks/log-assistant-reply.sh

@@ -95,8 +95,9 @@ fi
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/plugins/mirror-mind/hooks/log-session-end.sh

@@ -95,8 +95,9 @@ fi
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/plugins/mirror-mind/hooks/log-user-prompt.sh

@@ -95,8 +95,9 @@ fi
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/plugins/mirror-mind/hooks/mirror-inject.sh

@@ -95,8 +95,9 @@ fi
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/plugins/mirror-mind/hooks/session-start.sh

@@ -95,8 +95,9 @@ fi
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/plugins/mirror-mind/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mirror-mind",
   "description": "Mirror Mind — local-first memory and identity for agentic runtimes.",
-  "version": "0.39.5",
+  "version": "0.40.0-next.1",
   "mcpServers": {
     "mirror-mind": {
       "command": "/bin/sh",

package/ts/src/guards/claudePlugin.ts

@@ -87,8 +87,9 @@ export const GLOBAL_BIN_DIRS = ['"$HOME/.nvm/current/bin"', "/opt/homebrew/bin",
  * `scripts/generate_hook_wrappers.sh` and into the locator below, and held
  * equal by `mirrorNodeRule.test.ts`. It classifies exactly as
  * `path.win32.isAbsolute`, on every platform: under Git Bash the Windows
- * installer writes `C:\Program Files\nodejs\node.exe`, which a POSIX-only
- * pattern would refuse on every hook (PR #47). On POSIX a drive or backslash
+ * installer writes a drive-letter path,
+ * `C:\Users\…\AppData\Local\Programs\MirrorMind\node\node.exe`, which a
+ * POSIX-only pattern would refuse on every hook (PR #47). On POSIX a drive or backslash
  * value names no file, and is refused as missing.
  */
 export const ABSOLUTE_PATH_CASE = "/*|\\\\*|[A-Za-z]:[\\\\/]*";

package/ts/src/guards/retiredSurfaces.ts

@@ -500,8 +500,10 @@ export const RETIRED: readonly RetiredSurface[] = [
     // Windows spells `C:\...` as `/C:/...` -- and read as one it made every
     // install under such a directory `unknown` (PR #42, CR140). The fix is
     // `import.meta.dirname` or `fileURLToPath`; this row keeps the idiom from
-    // coming back in code. Tests may spell the bug to pin it, so the scope is
-    // the product and its scripts.
+    // coming back in code. The tests and smokes are in scope too (issue #44):
+    // twenty fixture and CLI paths there read a URL's pathname, so the suite
+    // failed when run from a checkout under such a directory. Only the files
+    // that spell the bug to pin it are exempt.
     surfaceId: "url-pathname-as-path",
     story: "PR #42 (CR140)",
     absentPaths: [],
@@ -509,8 +511,11 @@ export const RETIRED: readonly RetiredSurface[] = [
     // off a variable (`url.pathname`). Prose writes `URL.pathname`, capital U,
     // which neither pattern matches, so a comment may still name the cause.
     forbiddenPatterns: ["\\)\\.pathname\\b", "\\b[a-z_$][\\w$]*\\.pathname\\b"],
-    residueScope: ["ts/src/", "ts/scripts/"],
-    exemptions: {},
+    residueScope: ["ts/src/", "ts/scripts/", "ts/test/", "ts/smoke/"],
+    exemptions: {
+      "ts/test/runtime/installKind.test.ts":
+        "asserts what a URL's pathname spells for a non-ASCII checkout, the bug it pins",
+    },
   },
   {
     surfaceId: "gemini-cli",

package/ts/src/journey/journeyCalls.ts

@@ -49,12 +49,19 @@ export type JourneyCallRejection =
   | "unknown_parent"
   | "unknown_journey"
   | "journey_changed"
-  | "journey_not_empty";
+  | "journey_not_empty"
+  // `deleteJourneyWithRecords` (journeyDeletion.ts):
+  | "journey_has_children"
+  | "extension_rows_held"
+  | "backup_failed";
 
 /** A call's refusal, named with the administration's codes where it had one. Nothing was written. */
 export class JourneyCallRejectedError extends Error {
   readonly reason: JourneyCallRejection;
-  /** For `journey_not_empty`: the association classes that hold records. */
+  /**
+   * For `journey_not_empty`: the association classes that hold records. For
+   * `journey_has_children`: the child Journeys. For `extension_rows_held`: the table.
+   */
   readonly populated: string[];
 
   constructor(reason: JourneyCallRejection, populated: string[] = []) {

package/ts/src/journey/journeyDeletion.ts

@@ -0,0 +1,602 @@
+// Delete a Journey with its records — for a host that shows what will go first.
+//
+// `deleteJourney` (CV24.DS8) takes only an empty leaf: `removeJourney` refuses a
+// Journey with any associated record, so a Journey no longer needed has to be
+// emptied by hand. Mirror Desktop's RS028 asked for one act instead, and its
+// Navigator decided what each record does (2026-11-05/06). Those decisions are
+// the four rules below, and the principle under them is transparency rather than
+// refusal: the host shows everything that will change, and the act refuses only
+// what it cannot do safely.
+//
+//   1. A record that is the Journey's own is deleted: its row, its journey path,
+//      a `journey:<id>` scene orientation, its identity integrations,
+//      conversations, memories, tasks, attachments, runtime sessions, explorer
+//      and refinement stories, change requests and refinement cursor.
+//   2. What belongs to a deleted conversation or memory goes with it: messages,
+//      summary embeddings, provider calls and memory access log entries.
+//      Discarding ONE conversation keeps its provider calls
+//      (`conversationDeletion.ts`: "a provider call still happened"); deleting a
+//      Journey takes them, because their prompts are the Journey's own words and
+//      the person asked for the Journey to be gone.
+//   3. Another Journey's record that only points at something deleted is kept,
+//      its link cleared. Memories are filed under the Journey they are about, not
+//      the conversation they came from: in one long-lived home, 956 memories
+//      came from a conversation of a different Journey. Deleting them with the
+//      conversation would delete other Journeys' history.
+//   4. An extension row that names the Journey -- in a column called exactly
+//      `journey_id` or `journey` of an `ext_*` table -- is deleted, and the
+//      preview names the extension that owns the table. The core does not know
+//      what the row means; it does not need to, because the person sees it named
+//      before confirming. A table without such a column is never searched.
+//
+// One friction is kept: a Journey with child Journeys is refused, naming them,
+// so the act never cascades silently through the tree.
+//
+// Two calls. `previewJourneyDeletion` reads, and answers every count with a
+// digest. `deleteJourneyWithRecords` takes that digest back and refuses with
+// `journey_changed` when the home no longer matches it, so the act deletes what
+// the person was shown and nothing else. Under one immediate transaction it
+// re-reads the preview, takes a backup with a name never reused
+// (`backups/pre-journey-deletion-<id>-<UTC stamp>-<random>.db`, 0600) and
+// verifies that the backup reads as the same preview, and only then deletes.
+// The front door's fixed-name pre-write snapshot is replaced by the next write,
+// a turn's append included, so it cannot be the undo for a deletion. The core
+// never deletes the named backup.
+
+import { createHash, randomBytes } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, rmSync, statSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { deleteConversation } from "#conversation/conversationDeletion.ts";
+import { DatabaseNotCurrentError } from "#conversation/hostCalls.ts";
+import {
+  type Database,
+  openDatabaseReadOnly,
+  prepareArchiveSnapshot,
+  snapshotDatabaseTo,
+  type WritableDatabase,
+  withTransaction,
+} from "#db/database.ts";
+import { inspectMigrationState } from "#db/migrationReport.ts";
+import { openLiveWriteDatabase } from "#frontDoor/liveBackup.ts";
+import { JourneyCallRejectedError, type JourneyCallResult } from "#journey/journeyCalls.ts";
+import { buildJourneyTree, type JourneyTree, type JourneyTreeRow } from "#journey/journeyTree.ts";
+
+/** Rule 1: the Journey's own records, deleted with it. */
+export interface JourneyOwnRecords {
+  journey_paths: number;
+  scene_orientations: number;
+  identity_integrations: number;
+  conversations: number;
+  memories: number;
+  tasks: number;
+  attachments: number;
+  runtime_sessions: number;
+  explorer_stories: number;
+  refinement_stories: number;
+  change_requests: number;
+  refinement_cursors: number;
+}
+
+/** Rule 2: what belongs to the deleted conversations and memories, deleted with them. */
+export interface JourneyOwnedContents {
+  messages: number;
+  conversation_embeddings: number;
+  llm_calls: number;
+  memory_access_log: number;
+}
+
+/** Rule 3: other Journeys' rows that point at a deleted row, kept with the link cleared. */
+export interface JourneyDetachedRecords {
+  memories: number;
+  runtime_sessions: number;
+  identity_integrations: number;
+  change_requests: number;
+  refinement_cursors: number;
+}
+
+/** Rule 4: one extension table's rows that name the Journey. */
+export interface JourneyExtensionRows {
+  /** The installed extension whose `ext_<id>_` prefix the table carries, or null when none does. */
+  extension: string | null;
+  table: string;
+  rows: number;
+}
+
+export interface JourneyDeletionPreview {
+  journeyId: string;
+  /** Child Journeys, by key. Any child refuses the deletion. */
+  children: string[];
+  records: JourneyOwnRecords;
+  contents: JourneyOwnedContents;
+  detached: JourneyDetachedRecords;
+  /** Only tables with at least one row naming the Journey, ordered by table. */
+  extensions: JourneyExtensionRows[];
+  /** SHA-256 over everything above and the Journey's row. The deletion refuses any other. */
+  digest: string;
+}
+
+export interface JourneyDeletionBackup {
+  path: string;
+  sha256: string;
+  sizeBytes: number;
+}
+
+export interface JourneyDeletionReceipt extends JourneyCallResult {
+  /** The preview the deletion acted on: the one the person confirmed. */
+  deleted: JourneyDeletionPreview;
+  backup: JourneyDeletionBackup;
+}
+
+/**
+ * The closed inventory, read by `journeyDeletion.test.ts` against the schema:
+ * a core table that names a Journey, or that references a row the deletion
+ * removes, without a decision here fails that test.
+ */
+export const JOURNEY_DELETION_INVENTORY = {
+  /** Core tables that name a Journey, and how. */
+  journeyColumns: {
+    identity: "key, in the journey and journey_path layers; journey:<id> in scene_orientation",
+    identity_integrations: "key, in the journey layer",
+    conversations: "journey",
+    memories: "journey",
+    tasks: "journey",
+    attachments: "journey_id",
+    runtime_sessions: "journey",
+    exploratory_stories: "journey",
+    builder_refinement_stories: "journey",
+    builder_change_requests: "journey",
+    builder_refinement_cursors: "journey",
+  },
+  /**
+   * Core tables that name a Journey and are deliberately left alone:
+   * `journey_mutation_receipts` is the administration's audit of what was done
+   * to the tree, a deletion included.
+   */
+  kept: ["journey_mutation_receipts"],
+  /** Tables whose rows the deletion removes, so references into them need a decision. */
+  deletedTables: [
+    "conversations",
+    "memories",
+    "builder_refinement_stories",
+    "builder_change_requests",
+    "identity",
+    "identity_integrations",
+  ],
+  references: {
+    /** Deleted with the row they reference (rule 2). */
+    deleted: [
+      "messages.conversation_id",
+      "conversation_embeddings.conversation_id",
+      "llm_calls.conversation_id",
+      "memory_access_log.memory_id",
+    ],
+    /** Kept, the reference cleared, when the row is another Journey's (rule 3). */
+    unlinked: [
+      "memories.conversation_id",
+      "runtime_sessions.conversation_id",
+      "identity_integrations.conversation_id",
+      "identity_integrations.journal_id",
+      "builder_change_requests.refinement_story_id",
+      "builder_refinement_cursors.active_refinement_story_id",
+      "builder_refinement_cursors.active_change_request_id",
+    ],
+  },
+} as const;
+
+const EXTENSION_JOURNEY_COLUMNS = ["journey_id", "journey"] as const;
+
+function reject(
+  reason: ConstructorParameters<typeof JourneyCallRejectedError>[0],
+  populated?: string[],
+): never {
+  throw new JourneyCallRejectedError(reason, populated);
+}
+
+function text(value: unknown): string {
+  if (typeof value !== "string" || value.length === 0) reject("invalid_request");
+  return value;
+}
+
+function number(db: Database, sql: string, ...params: string[]): number {
+  const value = db.prepare(sql).get(...params)?.n;
+  if (typeof value === "number") return value;
+  if (typeof value === "bigint") return Number(value);
+  throw new Error("journey deletion count did not return a number");
+}
+
+function ids(db: Database, sql: string, journeyId: string): string[] {
+  return db
+    .prepare(sql)
+    .all(journeyId)
+    .map((row) => String(row.id));
+}
+
+/** The keys of the rows rule 2 and rule 3 follow from, as JSON arrays for `json_each`. */
+interface DeletedKeys {
+  conversations: string;
+  memories: string;
+  stories: string;
+  changeRequests: string;
+}
+
+function deletedKeys(db: Database, journeyId: string): DeletedKeys {
+  return {
+    conversations: JSON.stringify(
+      ids(db, "SELECT id FROM conversations WHERE journey = ?", journeyId),
+    ),
+    memories: JSON.stringify(ids(db, "SELECT id FROM memories WHERE journey = ?", journeyId)),
+    stories: JSON.stringify(
+      ids(db, "SELECT id FROM builder_refinement_stories WHERE journey = ?", journeyId),
+    ),
+    changeRequests: JSON.stringify(
+      ids(db, "SELECT id FROM builder_change_requests WHERE journey = ?", journeyId),
+    ),
+  };
+}
+
+const IN = (param: string) => `IN (SELECT value FROM json_each(${param}))`;
+
+/** `ext_*` tables with a Journey column, each with its owning extension when one is installed. */
+function extensionTables(
+  db: Database,
+): { table: string; columns: string[]; extension: string | null }[] {
+  const installed = db
+    .prepare("SELECT DISTINCT extension_id AS id FROM _ext_migrations")
+    .all()
+    .map((row) => String(row.id));
+  const owners = installed
+    .map((id) => ({ id, prefix: `ext_${id.replaceAll("-", "_")}_` }))
+    .sort((a, b) => b.prefix.length - a.prefix.length);
+  return db
+    .prepare(
+      "SELECT name FROM sqlite_master WHERE type = 'table' AND name LIKE 'ext\\_%' ESCAPE '\\' ORDER BY name",
+    )
+    .all()
+    .map((row) => String(row.name))
+    .map((table) => {
+      const present = new Set(
+        db
+          .prepare(`PRAGMA table_info("${table.replaceAll('"', '""')}")`)
+          .all()
+          .map((row) => String(row.name)),
+      );
+      return {
+        table,
+        columns: EXTENSION_JOURNEY_COLUMNS.filter((column) => present.has(column)),
+        extension: owners.find((owner) => table.startsWith(owner.prefix))?.id ?? null,
+      };
+    })
+    .filter((entry) => entry.columns.length > 0);
+}
+
+function extensionWhere(columns: readonly string[]): string {
+  return columns.map((column) => `"${column}" = ?`).join(" OR ");
+}
+
+function journeyRow(db: Database, journeyId: string): { updatedAt: string } | undefined {
+  const row = db
+    .prepare("SELECT updated_at FROM identity WHERE layer = 'journey' AND key = ?")
+    .get(journeyId);
+  return row === undefined ? undefined : { updatedAt: String(row.updated_at) };
+}
+
+/** Read everything the deletion would change. Shared by the preview, the act and the backup check. */
+function readPreview(db: Database, journeyId: string): JourneyDeletionPreview {
+  const row = journeyRow(db, journeyId);
+  if (!row) reject("unknown_journey");
+  const keys = deletedKeys(db, journeyId);
+  const j = journeyId;
+  const children = db
+    .prepare(
+      `SELECT key FROM identity
+       WHERE layer = 'journey'
+         AND CASE WHEN json_valid(metadata) THEN json_extract(metadata, '$.parent_journey') END = ?
+       ORDER BY key`,
+    )
+    .all(j)
+    .map((child) => String(child.key));
+  const records: JourneyOwnRecords = {
+    journey_paths: number(
+      db,
+      "SELECT COUNT(*) AS n FROM identity WHERE layer = 'journey_path' AND key = ?",
+      j,
+    ),
+    scene_orientations: number(
+      db,
+      "SELECT COUNT(*) AS n FROM identity WHERE layer = 'scene_orientation' AND key = 'journey:' || ?",
+      j,
+    ),
+    identity_integrations: number(
+      db,
+      "SELECT COUNT(*) AS n FROM identity_integrations WHERE layer = 'journey' AND key = ?",
+      j,
+    ),
+    conversations: number(db, "SELECT COUNT(*) AS n FROM conversations WHERE journey = ?", j),
+    memories: number(db, "SELECT COUNT(*) AS n FROM memories WHERE journey = ?", j),
+    tasks: number(db, "SELECT COUNT(*) AS n FROM tasks WHERE journey = ?", j),
+    attachments: number(db, "SELECT COUNT(*) AS n FROM attachments WHERE journey_id = ?", j),
+    runtime_sessions: number(db, "SELECT COUNT(*) AS n FROM runtime_sessions WHERE journey = ?", j),
+    explorer_stories: number(
+      db,
+      "SELECT COUNT(*) AS n FROM exploratory_stories WHERE journey = ?",
+      j,
+    ),
+    refinement_stories: number(
+      db,
+      "SELECT COUNT(*) AS n FROM builder_refinement_stories WHERE journey = ?",
+      j,
+    ),
+    change_requests: number(
+      db,
+      "SELECT COUNT(*) AS n FROM builder_change_requests WHERE journey = ?",
+      j,
+    ),
+    refinement_cursors: number(
+      db,
+      "SELECT COUNT(*) AS n FROM builder_refinement_cursors WHERE journey = ?",
+      j,
+    ),
+  };
+  const contents: JourneyOwnedContents = {
+    messages: number(
+      db,
+      `SELECT COUNT(*) AS n FROM messages WHERE conversation_id ${IN("?")}`,
+      keys.conversations,
+    ),
+    conversation_embeddings: number(
+      db,
+      `SELECT COUNT(*) AS n FROM conversation_embeddings WHERE conversation_id ${IN("?")}`,
+      keys.conversations,
+    ),
+    llm_calls: number(
+      db,
+      `SELECT COUNT(*) AS n FROM llm_calls WHERE conversation_id ${IN("?")}`,
+      keys.conversations,
+    ),
+    memory_access_log: number(
+      db,
+      `SELECT COUNT(*) AS n FROM memory_access_log WHERE memory_id ${IN("?")}`,
+      keys.memories,
+    ),
+  };
+  const detached: JourneyDetachedRecords = {
+    memories: number(
+      db,
+      `SELECT COUNT(*) AS n FROM memories WHERE conversation_id ${IN("?")} AND journey IS NOT ?`,
+      keys.conversations,
+      j,
+    ),
+    runtime_sessions: number(
+      db,
+      `SELECT COUNT(*) AS n FROM runtime_sessions WHERE conversation_id ${IN("?")} AND journey IS NOT ?`,
+      keys.conversations,
+      j,
+    ),
+    identity_integrations: number(
+      db,
+      `SELECT COUNT(*) AS n FROM identity_integrations
+       WHERE (conversation_id ${IN("?")} OR journal_id ${IN("?")})
+         AND NOT (layer = 'journey' AND key = ?)`,
+      keys.conversations,
+      keys.memories,
+      j,
+    ),
+    change_requests: number(
+      db,
+      `SELECT COUNT(*) AS n FROM builder_change_requests WHERE refinement_story_id ${IN("?")} AND journey IS NOT ?`,
+      keys.stories,
+      j,
+    ),
+    refinement_cursors: number(
+      db,
+      `SELECT COUNT(*) AS n FROM builder_refinement_cursors
+       WHERE (active_refinement_story_id ${IN("?")} OR active_change_request_id ${IN("?")})
+         AND journey IS NOT ?`,
+      keys.stories,
+      keys.changeRequests,
+      j,
+    ),
+  };
+  const extensions = extensionTables(db)
+    .map(({ table, columns, extension }) => ({
+      extension,
+      table,
+      rows: number(
+        db,
+        `SELECT COUNT(*) AS n FROM "${table}" WHERE ${extensionWhere(columns)}`,
+        ...columns.map(() => j),
+      ),
+    }))
+    .filter((entry) => entry.rows > 0);
+  const body = {
+    journeyId,
+    updatedAt: row.updatedAt,
+    children,
+    records,
+    contents,
+    detached,
+    extensions,
+  };
+  const digest = createHash("sha256").update(JSON.stringify(body)).digest("hex");
+  return { journeyId, children, records, contents, detached, extensions, digest };
+}
+
+function readTree(db: Database): JourneyTree {
+  return buildJourneyTree(
+    db
+      .prepare(
+        "SELECT key, content, updated_at, metadata FROM identity WHERE layer = 'journey' ORDER BY key",
+      )
+      .all() as unknown as JourneyTreeRow[],
+  );
+}
+
+function requireCurrent(dbPath: string): void {
+  const report = inspectMigrationState(dbPath);
+  if (report.state !== "current") throw new DatabaseNotCurrentError(report);
+}
+
+/** What deleting `journeyId` would change, without changing anything. */
+export function previewJourneyDeletion(
+  dbPath: string,
+  request: { journeyId: string },
+): JourneyDeletionPreview {
+  const journeyId = text(request?.journeyId);
+  requireCurrent(dbPath);
+  const db = openDatabaseReadOnly(dbPath);
+  try {
+    return readPreview(db, journeyId);
+  } finally {
+    db.close();
+  }
+}
+
+function stamp(date: Date): string {
+  return date
+    .toISOString()
+    .replace(/[-:]/g, "")
+    .replace(/\.\d{3}Z$/, "Z");
+}
+
+function removeBackup(path: string): void {
+  for (const file of [path, `${path}-wal`, `${path}-shm`]) rmSync(file, { force: true });
+}
+
+/**
+ * Take the named backup and verify that it reads as `expected`: the home the
+ * person was shown. Runs while the caller holds the write lock and has written
+ * nothing, so the snapshot is the state the deletion is about to change; only a
+ * defective snapshot can read differently. Exported so that check has a test.
+ */
+export function verifiedJourneyDeletionBackup(
+  dbPath: string,
+  expected: JourneyDeletionPreview,
+): JourneyDeletionBackup {
+  const dir = join(dirname(dbPath), "backups");
+  const path = join(
+    dir,
+    `pre-journey-deletion-${expected.journeyId}-${stamp(new Date())}-${randomBytes(6).toString("hex")}.db`,
+  );
+  const fail = (): never => {
+    removeBackup(path);
+    return reject("backup_failed");
+  };
+  try {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    snapshotDatabaseTo(dbPath, path);
+    chmodSync(path, 0o600);
+  } catch {
+    return fail();
+  }
+  if (!prepareArchiveSnapshot(path).ok) return fail();
+  let image: JourneyDeletionPreview | undefined;
+  const db = openDatabaseReadOnly(path);
+  try {
+    image = readPreview(db, expected.journeyId);
+  } catch {
+    image = undefined;
+  } finally {
+    db.close();
+  }
+  // The read-only open leaves empty sidecars beside a WAL file; this file is
+  // private to this call, so they are removed to leave one file.
+  rmSync(`${path}-wal`, { force: true });
+  rmSync(`${path}-shm`, { force: true });
+  if (image?.digest !== expected.digest) return fail();
+  return {
+    path,
+    sha256: createHash("sha256").update(readFileSync(path)).digest("hex"),
+    sizeBytes: statSync(path).size,
+  };
+}
+
+/** Rules 1 to 4, in an order every foreign key accepts. The caller holds the transaction. */
+function deleteRecords(db: WritableDatabase, preview: JourneyDeletionPreview): void {
+  const j = preview.journeyId;
+  const keys = deletedKeys(db, j);
+  const run = (sql: string, ...params: string[]) => db.prepare(sql).run(...params);
+
+  // Rule 2 before rule 1, for what the rows to delete still hold.
+  run(`DELETE FROM llm_calls WHERE conversation_id ${IN("?")}`, keys.conversations);
+  run(`DELETE FROM memory_access_log WHERE memory_id ${IN("?")}`, keys.memories);
+  run("DELETE FROM identity_integrations WHERE layer = 'journey' AND key = ?", j);
+  // Rule 3: an integration of another Journey keeps its place in the identity.
+  run(
+    `UPDATE identity_integrations SET journal_id = NULL WHERE journal_id ${IN("?")}`,
+    keys.memories,
+  );
+  run("DELETE FROM runtime_sessions WHERE journey = ?", j);
+  run("DELETE FROM memories WHERE journey = ?", j);
+  // Messages and embeddings go; what still points at the conversation is another Journey's, unlinked.
+  for (const conversationId of JSON.parse(keys.conversations) as string[]) {
+    deleteConversation(db, conversationId);
+  }
+
+  run("DELETE FROM builder_refinement_cursors WHERE journey = ?", j);
+  run(
+    `UPDATE builder_refinement_cursors SET active_refinement_story_id = NULL WHERE active_refinement_story_id ${IN("?")}`,
+    keys.stories,
+  );
+  run(
+    `UPDATE builder_refinement_cursors SET active_change_request_id = NULL WHERE active_change_request_id ${IN("?")}`,
+    keys.changeRequests,
+  );
+  run("DELETE FROM builder_change_requests WHERE journey = ?", j);
+  run(
+    `UPDATE builder_change_requests SET refinement_story_id = NULL WHERE refinement_story_id ${IN("?")}`,
+    keys.stories,
+  );
+  run("DELETE FROM builder_refinement_stories WHERE journey = ?", j);
+  run("DELETE FROM exploratory_stories WHERE journey = ?", j);
+  run("DELETE FROM tasks WHERE journey = ?", j);
+  run("DELETE FROM attachments WHERE journey_id = ?", j);
+
+  run("DELETE FROM identity WHERE layer = 'journey_path' AND key = ?", j);
+  run("DELETE FROM identity WHERE layer = 'scene_orientation' AND key = 'journey:' || ?", j);
+  run("DELETE FROM identity WHERE layer = 'journey' AND key = ?", j);
+
+  // Rule 4. A row another row still holds is the extension's to release, not the core's.
+  for (const { table, columns } of extensionTables(db)) {
+    try {
+      run(`DELETE FROM "${table}" WHERE ${extensionWhere(columns)}`, ...columns.map(() => j));
+    } catch (error) {
+      if (error instanceof Error && /FOREIGN KEY constraint failed/.test(error.message)) {
+        reject("extension_rows_held", [table]);
+      }
+      throw error;
+    }
+  }
+}
+
+/** Delete `journeyId` and its records, as `previewJourneyDeletion` showed them, behind a named backup. */
+export function deleteJourneyWithRecords(
+  dbPath: string,
+  request: { journeyId: string; expectedDigest: string },
+): JourneyDeletionReceipt {
+  const journeyId = text(request?.journeyId);
+  const expectedDigest = text(request?.expectedDigest);
+  requireCurrent(dbPath);
+  const db = openLiveWriteDatabase(dbPath);
+  let backup: JourneyDeletionBackup | undefined;
+  let committed = false;
+  try {
+    const deleted = withTransaction(db, () => {
+      const preview = readPreview(db, journeyId);
+      if (preview.digest !== expectedDigest) reject("journey_changed");
+      if (preview.children.length > 0) reject("journey_has_children", preview.children);
+      backup = verifiedJourneyDeletionBackup(dbPath, preview);
+      deleteRecords(db, preview);
+      return preview;
+    });
+    committed = true;
+    if (!backup) throw new Error("journey deletion committed without a backup");
+    return { journeyId, tree: readTree(db), deleted, backup };
+  } catch (error) {
+    // Nothing was deleted: a backup of an unchanged home is only a large file. Once the
+    // deletion has committed, the backup is the only way back, whatever fails after it.
+    if (backup && !committed) removeBackup(backup.path);
+    throw error;
+  } finally {
+    db.close();
+  }
+}