superlocalmemory 3.7.8 → 3.8.0

package/src/superlocalmemory/compliance/gdpr.py

@@ -19,6 +19,15 @@ from datetime import UTC, datetime
 
 logger = logging.getLogger(__name__)
 
+# Friendly export keys → canonical table names (stable Art.20 export contract).
+_EXPORT_ALIASES = {
+    "facts": "atomic_facts",
+    "entities": "canonical_entities",
+    "edges": "graph_edges",
+    "feedback": "feedback_records",
+    "scenes": "memory_scenes",
+}
+
 
 class GDPRCompliance:
     """GDPR compliance operations for memory data.
@@ -30,170 +39,146 @@ class GDPRCompliance:
     - Audit Trail: Log all data operations
     """
 
+    # Tables that carry a profile_id column but are NOT tenant memory to be
+    # erased/exported wholesale. `profiles` is the tenant record (handled
+    # separately, deleted last).
+    _NON_MEMORY_SCOPED = frozenset({"profiles"})
+
     def __init__(self, db) -> None:
         self._db = db
 
+    def _profile_scoped_tables(self) -> list[str]:
+        """Every table carrying a ``profile_id`` column — discovered live from
+        the schema so a newly-added table can never be silently missed by
+        export or erasure (the class of bug that breaks GDPR completeness)."""
+        try:
+            names = [
+                dict(r)["name"]
+                for r in self._db.execute(
+                    "SELECT name FROM sqlite_master WHERE type='table'"
+                )
+            ]
+        except Exception:
+            return []
+        out: list[str] = []
+        for t in names:
+            if t.startswith("sqlite_") or t in self._NON_MEMORY_SCOPED:
+                continue
+            try:
+                cols = {dict(c)["name"] for c in self._db.execute(f"PRAGMA table_info({t})")}
+            except Exception:
+                continue
+            if "profile_id" in cols:
+                out.append(t)
+        return out
+
     # -- Right to Access (Art. 15) -----------------------------------------
 
     def export_profile_data(self, profile_id: str) -> dict:
-        """Export ALL data for a profile in machine-readable format.
-
-        Returns a dict containing all memories, facts, entities,
-        edges, trust scores, feedback, and behavioral patterns.
-        """
+        """Export ALL data for a profile in machine-readable format (Art. 15 /
+        Art. 20). Covers every profile-scoped table discovered from the schema,
+        plus the profile record itself."""
         self._audit("export", "profile", profile_id, "Full data export")
 
         data: dict = {"profile_id": profile_id, "exported_at": _now()}
+        for table in self._profile_scoped_tables():
+            try:
+                rows = self._db.execute(
+                    f"SELECT * FROM {table} WHERE profile_id = ?", (profile_id,)
+                )
+                data[table] = [dict(r) for r in rows]
+            except Exception as exc:  # pragma: no cover — defensive per-table
+                logger.warning("export: table %s skipped: %s", table, exc)
+
+        # Profile record itself (the tenant metadata).
+        try:
+            rows = self._db.execute(
+                "SELECT * FROM profiles WHERE profile_id = ?", (profile_id,)
+            )
+            data["profile_record"] = [dict(r) for r in rows]
+        except Exception:
+            data["profile_record"] = []
 
-        # Memories
-        rows = self._db.execute(
-            "SELECT * FROM memories WHERE profile_id = ?", (profile_id,)
-        )
-        data["memories"] = [dict(r) for r in rows]
-
-        # Facts
-        rows = self._db.execute(
-            "SELECT * FROM atomic_facts WHERE profile_id = ?", (profile_id,)
-        )
-        data["facts"] = [dict(r) for r in rows]
-
-        # Entities
-        rows = self._db.execute(
-            "SELECT * FROM canonical_entities WHERE profile_id = ?", (profile_id,)
-        )
-        data["entities"] = [dict(r) for r in rows]
-
-        # Graph edges
-        rows = self._db.execute(
-            "SELECT * FROM graph_edges WHERE profile_id = ?", (profile_id,)
-        )
-        data["edges"] = [dict(r) for r in rows]
-
-        # Trust scores
-        rows = self._db.execute(
-            "SELECT * FROM trust_scores WHERE profile_id = ?", (profile_id,)
-        )
-        data["trust_scores"] = [dict(r) for r in rows]
-
-        # Feedback
-        rows = self._db.execute(
-            "SELECT * FROM feedback_records WHERE profile_id = ?", (profile_id,)
-        )
-        data["feedback"] = [dict(r) for r in rows]
-
-        # Entity profiles
-        rows = self._db.execute(
-            "SELECT * FROM entity_profiles WHERE profile_id = ?", (profile_id,)
-        )
-        data["entity_profiles"] = [dict(r) for r in rows]
-
-        # Memory scenes
-        rows = self._db.execute(
-            "SELECT * FROM memory_scenes WHERE profile_id = ?", (profile_id,)
-        )
-        data["scenes"] = [dict(r) for r in rows]
-
-        # Temporal events
-        rows = self._db.execute(
-            "SELECT * FROM temporal_events WHERE profile_id = ?", (profile_id,)
-        )
-        data["temporal_events"] = [dict(r) for r in rows]
-
-        # Consolidation log
-        rows = self._db.execute(
-            "SELECT * FROM consolidation_log WHERE profile_id = ?", (profile_id,)
-        )
-        data["consolidation_log"] = [dict(r) for r in rows]
-
-        # Behavioral patterns
-        rows = self._db.execute(
-            "SELECT * FROM behavioral_patterns WHERE profile_id = ?", (profile_id,)
-        )
-        data["behavioral_patterns"] = [dict(r) for r in rows]
-
-        # Action outcomes
-        rows = self._db.execute(
-            "SELECT * FROM action_outcomes WHERE profile_id = ?", (profile_id,)
-        )
-        data["action_outcomes"] = [dict(r) for r in rows]
-
-        # Compliance audit trail
-        rows = self._db.execute(
-            "SELECT * FROM compliance_audit WHERE profile_id = ?", (profile_id,)
-        )
-        data["compliance_audit"] = [dict(r) for r in rows]
-
-        # Provenance (data lineage — EU AI Act Art. 10)
-        rows = self._db.execute(
-            "SELECT * FROM provenance WHERE profile_id = ?", (profile_id,)
-        )
-        data["provenance"] = [dict(r) for r in rows]
-
-        # Entity aliases (indirect PII via entity relationships)
-        rows = self._db.execute(
-            "SELECT ea.* FROM entity_aliases ea "
-            "JOIN canonical_entities ce ON ea.entity_id = ce.entity_id "
-            "WHERE ce.profile_id = ?", (profile_id,)
-        )
-        data["entity_aliases"] = [dict(r) for r in rows]
-
-        # Profile record itself
-        rows = self._db.execute(
-            "SELECT * FROM profiles WHERE profile_id = ?", (profile_id,)
-        )
-        data["profile_record"] = [dict(r) for r in rows]
-
+        # total_items counts the canonical (table-name) keys only, before
+        # friendly aliases are added, so it is not double-counted.
         data["total_items"] = sum(
             len(v) for v in data.values() if isinstance(v, list)
         )
 
+        # Backward-compatible friendly aliases for the well-known keys (stable
+        # export contract) — they reference the same lists, not copies.
+        for friendly, table in _EXPORT_ALIASES.items():
+            if table in data:
+                data[friendly] = data[table]
+
         logger.info("Exported %d items for profile '%s'", data["total_items"], profile_id)
         return data
 
     # -- Right to Erasure (Art. 17) ----------------------------------------
 
     def forget_profile(self, profile_id: str) -> dict:
-        """Delete ALL data for a profile (right to be forgotten).
+        """Delete ALL data for a profile (right to be forgotten, Art. 17).
 
-        CASCADE deletes handle most cleanup via foreign keys.
-        Returns counts of deleted items.
+        Erases every profile-scoped table discovered from the live schema, so a
+        newly-added table is covered automatically. The erasure is recorded in
+        the tamper-proof audit chain BEFORE any deletion (Art. 5(2)
+        accountability) — the in-DB compliance_audit row is itself erased, so
+        the chain in a separate DB is the durable evidence.
         """
         if profile_id == "default":
             raise ValueError("Cannot delete the default profile via GDPR erasure. "
                              "Use profile deletion instead.")
 
+        # 1) Durable, tamper-evident record FIRST — survives the erasure.
+        try:
+            from superlocalmemory.compliance.audit import AuditChain
+            from superlocalmemory.infra.data_root import state_path
+            AuditChain(str(state_path("audit_chain.db"))).log(
+                "gdpr_erase", agent_id="gdpr", profile_id=profile_id,
+                metadata={"basis": "GDPR Art.17 right-to-erasure"},
+            )
+        except Exception as exc:
+            logger.warning("GDPR erase: audit-chain log failed: %s", exc)
         self._audit("delete", "profile", profile_id, "GDPR erasure request")
 
         counts: dict[str, int] = {}
-        tables = [
-            "compliance_audit", "action_outcomes", "behavioral_patterns",
-            "feedback_records", "trust_scores", "provenance",
-            "consolidation_log", "graph_edges", "temporal_events",
-            "memory_scenes", "entity_profiles", "bm25_tokens",
-            "atomic_facts", "memories", "canonical_entities",
-        ]
+        tables = self._profile_scoped_tables()
+        # Pass 1 — count every table BEFORE any deletion, so a CASCADE that
+        # removes a child (e.g. atomic_facts via memories) does not zero the
+        # attribution. Completeness is independent of this.
         for table in tables:
-            rows = self._db.execute(
-                f"SELECT COUNT(*) AS c FROM {table} WHERE profile_id = ?",
-                (profile_id,),
-            )
-            counts[table] = int(dict(rows[0])["c"]) if rows else 0
-            self._db.execute(
-                f"DELETE FROM {table} WHERE profile_id = ?", (profile_id,)
-            )
-
-        # Delete entity aliases (orphan PII via entity relationships)
-        self._db.execute(
-            "DELETE FROM entity_aliases WHERE entity_id IN "
-            "(SELECT entity_id FROM canonical_entities WHERE profile_id = ?)",
-            (profile_id,),
-        )
-
-        # Delete profile itself
-        self._db.execute(
-            "DELETE FROM profiles WHERE profile_id = ?", (profile_id,)
-        )
-        counts["profiles"] = 1
+            try:
+                rows = self._db.execute(
+                    f"SELECT COUNT(*) AS c FROM {table} WHERE profile_id = ?",
+                    (profile_id,),
+                )
+                counts[table] = int(dict(rows[0])["c"]) if rows else 0
+            except Exception as exc:  # pragma: no cover
+                logger.warning("GDPR erase: count %s failed: %s", table, exc)
+                counts[table] = 0
+        # Pass 2 — full-tenant wipe with FK enforcement OFF so table order is
+        # irrelevant (every profile row in every table goes). FTS shadow rows
+        # are still removed by the base-table delete triggers.
+        try:
+            self._db.execute("PRAGMA foreign_keys=OFF")
+        except Exception:
+            pass
+        try:
+            for table in tables:
+                try:
+                    self._db.execute(
+                        f"DELETE FROM {table} WHERE profile_id = ?", (profile_id,)
+                    )
+                except Exception as exc:  # pragma: no cover — defensive per-table
+                    logger.warning("GDPR erase: delete %s failed: %s", table, exc)
+            # Delete the profile record itself.
+            self._db.execute("DELETE FROM profiles WHERE profile_id = ?", (profile_id,))
+            counts["profiles"] = 1
+        finally:
+            try:
+                self._db.execute("PRAGMA foreign_keys=ON")
+            except Exception:
+                pass
 
         # Erase learning database (separate DB file)
         try:
@@ -211,7 +196,7 @@ class GDPRCompliance:
         except Exception:
             pass
 
-        logger.info("GDPR erasure for '%s': %s", profile_id, counts)
+        logger.info("GDPR erasure for '%s': %d tables, %s", profile_id, len(tables), counts)
         return counts
 
     def forget_entity(self, entity_name: str, profile_id: str) -> dict:
@@ -254,9 +239,14 @@ class GDPRCompliance:
             (eid, profile_id),
         )
 
-        # Delete aliases + entity
-        self._db.execute("DELETE FROM entity_aliases WHERE entity_id = ?", (eid,))
-        self._db.execute("DELETE FROM canonical_entities WHERE entity_id = ?", (eid,))
+        # Delete aliases + entity (profile-scoped — entity_id is UUID-global but
+        # keep the tenant predicate for consistent Art.17 isolation).
+        self._db.execute(
+            "DELETE FROM entity_aliases WHERE entity_id = ? AND profile_id = ?",
+            (eid, profile_id))
+        self._db.execute(
+            "DELETE FROM canonical_entities WHERE entity_id = ? AND profile_id = ?",
+            (eid, profile_id))
         counts["entity"] = 1
 
         logger.info("Entity erasure '%s' in '%s': %s", entity_name, profile_id, counts)

package/src/superlocalmemory/compliance/retention.py

@@ -13,6 +13,7 @@ independently of the main memory lifecycle system.
 
 from __future__ import annotations
 
+import json
 import logging
 import sqlite3
 from datetime import datetime, timezone
@@ -27,11 +28,24 @@ CREATE TABLE IF NOT EXISTS retention_rules (
     rule_name TEXT NOT NULL,
     days INTEGER NOT NULL,
     description TEXT DEFAULT '',
+    framework TEXT NOT NULL DEFAULT 'custom',
+    action TEXT NOT NULL DEFAULT 'archive',
+    applies_to TEXT NOT NULL DEFAULT '{}',
     created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
     UNIQUE(profile_id, rule_name)
 )
 """
 
+# Terminal lifecycle zone each action moves an expired fact into. 'notify'
+# changes nothing — it only surfaces the count so an operator can act.
+# atomic_facts.lifecycle CHECK allows only active/warm/cold/archived, so both
+# retention actions land in the 'archived' lifecycle zone. 'tombstone' is
+# additionally flagged purgeable via archive_status so a purge job can find it —
+# this avoids a risky rebuild of the (large) atomic_facts CHECK constraint.
+_ACTION_LIFECYCLE = {"archive": "archived", "tombstone": "archived"}
+_TOMBSTONE_ACTIONS = frozenset({"tombstone"})
+_VALID_ACTIONS = ("archive", "tombstone", "notify")
+
 _FACTS_TABLE_CHECK = """
 SELECT name FROM sqlite_master
 WHERE type='table' AND name='atomic_facts'
@@ -54,8 +68,22 @@ class RetentionEngine:
     # ------------------------------------------------------------------
 
     def _ensure_table(self) -> None:
-        """Create the retention_rules table if it does not exist."""
+        """Create the retention_rules table, self-migrating older schemas.
+
+        Pre-GDPR-model tables had only (rule_name, days, description). Add the
+        framework/action/applies_to columns in place so existing rules keep
+        working (defaults: framework='custom', action='archive').
+        """
         self._db.execute(_RETENTION_RULES_TABLE)
+        cols = {r[1] for r in self._db.execute(
+            "PRAGMA table_info(retention_rules)").fetchall()}
+        for col, ddl in (
+            ("framework", "framework TEXT NOT NULL DEFAULT 'custom'"),
+            ("action", "action TEXT NOT NULL DEFAULT 'archive'"),
+            ("applies_to", "applies_to TEXT NOT NULL DEFAULT '{}'"),
+        ):
+            if col not in cols:
+                self._db.execute(f"ALTER TABLE retention_rules ADD COLUMN {ddl}")
         self._db.commit()
 
     def _has_facts_table(self) -> bool:
@@ -128,29 +156,89 @@ class RetentionEngine:
         )
 
     def get_rules(self, profile_id: str) -> list[dict[str, Any]]:
-        """Get all retention rules for a profile.
+        """Get all retention rules for a profile (full GDPR shape)."""
+        rows = self._db.execute(
+            "SELECT id, rule_name, days, description, framework, action, "
+            "applies_to, created_at FROM retention_rules "
+            "WHERE profile_id = ? ORDER BY id",
+            (profile_id,),
+        ).fetchall()
+        out: list[dict[str, Any]] = []
+        for r in rows:
+            try:
+                applies = json.loads(r[6]) if r[6] else {}
+            except (ValueError, TypeError):
+                applies = {}
+            out.append({
+                "id": r[0],
+                "name": r[1],
+                "rule_name": r[1],          # legacy alias
+                "retention_days": r[2],
+                "days": r[2],               # legacy alias
+                "description": r[3],
+                "framework": r[4],
+                "action": r[5],
+                "applies_to": applies,
+                "created_at": r[7],
+            })
+        return out
 
-        Args:
-            profile_id: Profile to query rules for.
+    # ------------------------------------------------------------------
+    # GDPR-model API (used by the compliance route + dashboard)
+    # ------------------------------------------------------------------
 
-        Returns:
-            List of rule dicts with keys: rule_name, days, description.
+    def create_rule(
+        self,
+        *,
+        name: str,
+        framework: str,
+        retention_days: int,
+        action: str,
+        applies_to: dict | None,
+        profile_id: str,
+    ) -> int:
+        """Create a retention rule and return its row id.
+
+        ``action`` is one of archive | tombstone | notify. Raises ValueError on
+        an invalid action so the route returns a clear 4xx rather than storing
+        an unenforceable rule.
         """
+        if action not in _VALID_ACTIONS:
+            raise ValueError(f"action must be one of {_VALID_ACTIONS}")
+        cur = self._db.execute(
+            "INSERT OR REPLACE INTO retention_rules "
+            "(profile_id, rule_name, days, description, framework, action, applies_to) "
+            "VALUES (?, ?, ?, ?, ?, ?, ?)",
+            (profile_id, name, int(retention_days), "", framework, action,
+             json.dumps(applies_to or {})),
+        )
+        self._db.commit()
+        logger.info(
+            "Created retention rule '%s' (%dd, %s/%s) for profile '%s'",
+            name, retention_days, framework, action, profile_id,
+        )
+        return int(cur.lastrowid or 0)
+
+    def list_rules(self, profile_id: str | None = None) -> list[dict[str, Any]]:
+        """List rules for one profile, or all rules when profile_id is None."""
+        if profile_id is not None:
+            return self.get_rules(profile_id)
         rows = self._db.execute(
-            "SELECT rule_name, days, description, created_at "
-            "FROM retention_rules WHERE profile_id = ? "
-            "ORDER BY id",
-            (profile_id,),
+            "SELECT DISTINCT profile_id FROM retention_rules"
         ).fetchall()
-        return [
-            {
-                "rule_name": r[0],
-                "days": r[1],
-                "description": r[2],
-                "created_at": r[3],
-            }
-            for r in rows
-        ]
+        out: list[dict[str, Any]] = []
+        for r in rows:
+            out.extend(self.get_rules(r[0]))
+        return out
+
+    def delete_rule(self, profile_id: str, name: str) -> bool:
+        """Delete a rule by (profile_id, name). Returns True if a row was removed."""
+        cur = self._db.execute(
+            "DELETE FROM retention_rules WHERE profile_id = ? AND rule_name = ?",
+            (profile_id, name),
+        )
+        self._db.commit()
+        return cur.rowcount > 0
 
     # ------------------------------------------------------------------
     # Expiration detection
@@ -174,14 +262,14 @@ class RetentionEngine:
             return []
 
         # Use the shortest retention period (most restrictive)
-        min_days = min(r["days"] for r in rules)
+        min_days = min(r["retention_days"] for r in rules)
 
         if not self._has_facts_table():
             return []
 
+        # atomic_facts is keyed by fact_id (TEXT hex), NOT an integer id.
         rows = self._db.execute(
-            "SELECT id, created_at FROM atomic_facts "
-            "WHERE profile_id = ?",
+            "SELECT fact_id, created_at FROM atomic_facts WHERE profile_id = ?",
             (profile_id,),
         ).fetchall()
 
@@ -199,34 +287,77 @@ class RetentionEngine:
     # ------------------------------------------------------------------
 
     def enforce(self, profile_id: str) -> dict[str, Any]:
-        """Enforce retention rules — delete expired facts.
+        """Enforce every retention rule for a profile, honoring each action.
 
-        Finds all expired facts for the profile and deletes them.
+        For each rule, facts in the profile older than its retention_days are
+        moved to the rule's terminal lifecycle zone:
+          * archive   → lifecycle 'archived'  (retained, hidden from recall)
+          * tombstone → lifecycle 'tombstoned' (soft-deleted, purgeable)
+          * notify    → unchanged (only counted, so an operator can act)
 
-        Args:
-            profile_id: Profile to enforce rules on.
+        GDPR-safe: soft-state transitions, never a raw DELETE — erasure is an
+        explicit separate operation. All updates are scoped to ``profile_id``
+        and keyed by ``fact_id`` (TEXT), fixing the prior ``id``/int() bug that
+        made enforcement crash outright.
 
-        Returns:
-            Dict with keys: deleted_count, expired_ids, profile_id.
+        Returns per-action counts + the affected fact ids.
         """
-        expired_ids = self.get_expired_facts(profile_id)
-        deleted_count = 0
+        rules = self.get_rules(profile_id)
+        result: dict[str, Any] = {
+            "profile_id": profile_id,
+            "archived": 0, "tombstoned": 0, "notified": 0,
+            "deleted_count": 0,  # legacy alias (== tombstoned)
+            "affected_ids": [],
+        }
+        if not rules or not self._has_facts_table():
+            return result
+
+        rows = self._db.execute(
+            "SELECT fact_id, created_at FROM atomic_facts WHERE profile_id = ?",
+            (profile_id,),
+        ).fetchall()
 
-        if expired_ids and self._has_facts_table():
-            placeholders = ",".join("?" for _ in expired_ids)
+        affected: set[str] = set()
+        for rule in rules:
+            action = rule.get("action", "archive")
+            days = rule.get("retention_days", rule.get("days", 0))
+            expired = [
+                str(r[0]) for r in rows
+                if r[1] and self._age_in_days(r[1]) > days
+            ]
+            if not expired:
+                continue
+            if action == "notify":
+                result["notified"] += len(expired)
+                affected.update(expired)
+                continue
+            zone = _ACTION_LIFECYCLE.get(action)
+            if zone is None:
+                continue
+            placeholders = ",".join("?" for _ in expired)
             self._db.execute(
-                f"DELETE FROM atomic_facts WHERE id IN ({placeholders})",
-                [int(fid) for fid in expired_ids],
-            )
-            self._db.commit()
-            deleted_count = len(expired_ids)
-            logger.info(
-                "Retention enforcement: deleted %d facts from profile '%s'",
-                deleted_count, profile_id,
+                f"UPDATE atomic_facts SET lifecycle = ? "
+                f"WHERE profile_id = ? AND fact_id IN ({placeholders})",
+                [zone, profile_id, *expired],
             )
+            if action in _TOMBSTONE_ACTIONS:
+                # Flag purgeable without violating the lifecycle CHECK.
+                try:
+                    self._db.execute(
+                        f"UPDATE atomic_facts SET archive_status = 'tombstoned' "
+                        f"WHERE profile_id = ? AND fact_id IN ({placeholders})",
+                        [profile_id, *expired],
+                    )
+                except Exception:
+                    pass
+            result["archived" if action == "archive" else "tombstoned"] += len(expired)
+            affected.update(expired)
 
-        return {
-            "profile_id": profile_id,
-            "deleted_count": deleted_count,
-            "expired_ids": expired_ids,
-        }
+        self._db.commit()
+        result["affected_ids"] = sorted(affected)
+        result["deleted_count"] = result["tombstoned"]  # legacy alias
+        logger.info(
+            "Retention enforcement for '%s': archived=%d tombstoned=%d notified=%d",
+            profile_id, result["archived"], result["tombstoned"], result["notified"],
+        )
+        return result

package/src/superlocalmemory/core/backend_orchestrator.py

@@ -17,8 +17,6 @@ Part of Qualixar | Author: Varun Pratap Bhardwaj
 from __future__ import annotations
 
 import logging
-import sqlite3
-import threading
 from pathlib import Path
 from typing import TYPE_CHECKING, Any
 
@@ -366,47 +364,11 @@ class BackendOrchestrator:
             logger.warning("LanceDB init failed: %s", exc)
             self._lancedb = None
 
-    # ------------------------------------------------------------------
-    # Internal: Migration
-    # ------------------------------------------------------------------
-
-    def _migrate_cozo(self) -> None:
-        self._update_status("cozo", "migrating")
-
-        def _run():
-            conn = sqlite3.connect(str(self._data_dir / "memory.db"))
-            conn.execute("PRAGMA journal_mode=WAL")
-            conn.execute("PRAGMA query_only=ON")  # F-07: read-only in migration thread
-            try:
-                count = self._cozo.bulk_import_from_sqlite(conn)
-                self._update_status("cozo", "active", count)
-                logger.info("CozoDB migration complete: %d edges", count)
-            except Exception as exc:
-                logger.error("CozoDB migration failed: %s", exc)
-                self._update_status("cozo", "failed", error=str(exc))
-            finally:
-                conn.close()
-
-        threading.Thread(target=_run, daemon=True).start()
-
-    def _migrate_lancedb(self) -> None:
-        self._update_status("lancedb", "migrating")
-
-        def _run():
-            conn = sqlite3.connect(str(self._data_dir / "memory.db"))
-            conn.execute("PRAGMA journal_mode=WAL")
-            conn.execute("PRAGMA query_only=ON")
-            try:
-                count = self._lancedb.bulk_import_from_sqlite(conn)
-                self._update_status("lancedb", "active", count)
-                logger.info("LanceDB migration complete: %d vectors", count)
-            except Exception as exc:
-                logger.error("LanceDB migration failed: %s", exc)
-                self._update_status("lancedb", "failed", error=str(exc))
-            finally:
-                conn.close()
-
-        threading.Thread(target=_run, daemon=True).start()
+    # v3.7.9 (scale MEDIUM-2): _migrate_cozo/_migrate_lancedb were dead code —
+    # never called anywhere — and bypassed the staged prepare→verify→promote
+    # safety envelope (no fingerprint, no parity, no backup). Removed so a future
+    # caller cannot re-import outside the lifecycle. Emergency re-imports must go
+    # through the Scale Engine lifecycle.
 
     # ------------------------------------------------------------------
     # Internal: Status