thinkwork-cli 0.12.17 → 0.13.1

package/dist/drizzle/0237_memory_claims_active_value_uidx.sql

@@ -0,0 +1,172 @@
+-- THINK-193 U2 (Codex concurrency finding): structural backstop against
+-- duplicate ACTIVE same-value claims. upsertClaimsForEvidence serializes
+-- writers with a per-subject transaction-scoped advisory lock; this partial
+-- unique index guarantees the invariant even if a future caller bypasses
+-- the lock. Superseded/retracted rows keep full temporal history (a value
+-- may recur later as a NEW active edition — only one can be active).
+--
+-- Codex round-5/6 P1: a bare CREATE UNIQUE INDEX cannot upgrade a database
+-- that already contains the duplicates the index forbids, and repair +
+-- index creation must be ATOMIC against concurrent writers. The whole file
+-- is ONE explicit transaction that write-locks memory_claims and
+-- memory_claim_evidence before scanning:
+--   1. ABORT loudly if any active duplicate group has the same value_hash
+--      but DIFFERENT full JSON values (sha256 collision — human decision).
+--   2. Per duplicate group, keep the EARLIEST row (created_at, id). Edge
+--      merge is PAIR-SAFE: first materialize the DISTINCT
+--      (keeper, evidence) pairs implied by all loser ACTIVE edges, then
+--      ensure exactly ONE ACTIVE keeper edge per pair (reactivating a
+--      pre-existing retracted keeper edge, inserting otherwise — never
+--      violating the (claim_id, evidence_item_id) pair unique), then
+--      retract all loser edges. Finally close the losers as 'superseded'
+--      with the duplicate-edition interval policy: zero-length at their own
+--      effective_from when the keeper is earlier-or-equal (NULL keeper
+--      counts as earliest), else closed at the keeper's effective_from; a
+--      NULL result falls back to now() so every ended interval is closed.
+--   3. Assert zero remaining active duplicates (RAISE rolls the whole
+--      transaction back).
+-- Re-running is idempotent: with no duplicates the repair is a no-op and
+-- the index CREATE is IF NOT EXISTS.
+--
+-- Hand-rolled (partial index + repair; drizzle-kit cannot express it).
+-- Apply with:
+--   psql "$DATABASE_URL" -f drizzle/0237_memory_claims_active_value_uidx.sql
+-- creates: public.memory_claims_active_value_uidx
+
+BEGIN;
+
+LOCK TABLE public.memory_claims IN SHARE ROW EXCLUSIVE MODE;
+LOCK TABLE public.memory_claim_evidence IN SHARE ROW EXCLUSIVE MODE;
+
+DO $$
+DECLARE
+  collision_groups integer;
+  remaining_duplicates integer;
+BEGIN
+  -- 1. Same hash, different value: refuse to merge automatically.
+  SELECT count(*) INTO collision_groups FROM (
+    SELECT 1
+    FROM memory_claims
+    WHERE status = 'active'
+    GROUP BY tenant_id, target_scope, target_id, subject_key,
+             ontology_predicate, value_hash
+    HAVING count(*) > 1 AND count(DISTINCT value::text) > 1
+  ) t;
+  IF collision_groups > 0 THEN
+    RAISE EXCEPTION
+      'memory_claims: % active duplicate group(s) share value_hash with DIFFERING values (hash collision) — resolve manually before applying 0237',
+      collision_groups;
+  END IF;
+
+  -- 2. Deterministic repair of identical-value active duplicates.
+  CREATE TEMP TABLE _mc_active_dupe_losers ON COMMIT DROP AS
+  SELECT id,
+         keeper_id,
+         keeper_effective_from,
+         effective_from AS own_effective_from
+  FROM (
+    SELECT id,
+           effective_from,
+           first_value(id) OVER w AS keeper_id,
+           first_value(effective_from) OVER w AS keeper_effective_from,
+           row_number() OVER w AS rn
+    FROM memory_claims
+    WHERE status = 'active'
+    WINDOW w AS (
+      PARTITION BY tenant_id, target_scope, target_id, subject_key,
+                   ontology_predicate, value_hash
+      ORDER BY created_at, id
+    )
+  ) ranked
+  WHERE rn > 1;
+
+  -- 2a. Materialize the DISTINCT (keeper, evidence) pairs implied by loser
+  --     ACTIVE edges — several losers sharing one evidence item collapse to
+  --     one target pair, so the merge can never violate the
+  --     (claim_id, evidence_item_id) pair unique.
+  CREATE TEMP TABLE _mc_keeper_pairs ON COMMIT DROP AS
+  SELECT DISTINCT ON (l.keeper_id, e.evidence_item_id)
+         l.keeper_id,
+         e.evidence_item_id,
+         e.tenant_id,
+         e.source_config_id
+  FROM memory_claim_evidence e
+  JOIN _mc_active_dupe_losers l ON l.id = e.claim_id
+  WHERE e.status = 'active';
+
+  -- 2b. Reactivate a pre-existing (possibly retracted) keeper edge for each
+  --     pair — the keeper must end with ACTIVE support wherever a loser had
+  --     it.
+  UPDATE memory_claim_evidence k
+  SET status = 'active', retracted_at = NULL
+  FROM _mc_keeper_pairs p
+  WHERE k.claim_id = p.keeper_id
+    AND k.evidence_item_id = p.evidence_item_id
+    AND k.status <> 'active';
+
+  -- 2c. Insert the keeper edges that do not exist at all.
+  INSERT INTO memory_claim_evidence
+    (tenant_id, claim_id, evidence_item_id, source_config_id, status)
+  SELECT p.tenant_id, p.keeper_id, p.evidence_item_id, p.source_config_id,
+         'active'
+  FROM _mc_keeper_pairs p
+  WHERE NOT EXISTS (
+    SELECT 1 FROM memory_claim_evidence k
+    WHERE k.claim_id = p.keeper_id
+      AND k.evidence_item_id = p.evidence_item_id
+  );
+
+  -- 2d. Retract ALL loser active edges (their support now lives on the
+  --     keeper).
+  UPDATE memory_claim_evidence e
+  SET status = 'retracted', retracted_at = now()
+  FROM _mc_active_dupe_losers l
+  WHERE e.claim_id = l.id
+    AND e.status = 'active';
+
+  -- 2e. Close and supersede the losers (duplicate-edition interval policy).
+  UPDATE memory_claims c
+  SET status = 'superseded',
+      effective_to = COALESCE(
+        c.effective_to,
+        CASE
+          WHEN l.keeper_effective_from IS NULL
+            OR (l.own_effective_from IS NOT NULL
+                AND l.keeper_effective_from <= l.own_effective_from)
+            THEN l.own_effective_from
+          ELSE l.keeper_effective_from
+        END,
+        now()
+      ),
+      updated_at = now()
+  FROM _mc_active_dupe_losers l
+  WHERE c.id = l.id;
+
+  -- 3. The invariant must hold before the index lands.
+  SELECT count(*) INTO remaining_duplicates FROM (
+    SELECT 1
+    FROM memory_claims
+    WHERE status = 'active'
+    GROUP BY tenant_id, target_scope, target_id, subject_key,
+             ontology_predicate, value_hash
+    HAVING count(*) > 1
+  ) t;
+  IF remaining_duplicates > 0 THEN
+    RAISE EXCEPTION
+      'memory_claims duplicate repair left % active duplicate group(s) — aborting index creation',
+      remaining_duplicates;
+  END IF;
+END $$;
+
+CREATE UNIQUE INDEX IF NOT EXISTS memory_claims_active_value_uidx
+  ON public.memory_claims (
+    tenant_id,
+    target_scope,
+    target_id,
+    subject_key,
+    ontology_predicate,
+    value_hash
+  )
+  WHERE status = 'active';
+
+COMMIT;

package/dist/drizzle/0238_memory_erase_generation_fence.sql

@@ -0,0 +1,97 @@
+-- THINK-193 U2 (Codex rounds 3-6): erase write-fence, per-generation child
+-- scoping, durable bounded-cleanup progress, and DB-level integrity for the
+-- retraction saga.
+-- Contents:
+--   * memory_source_configs.erase_generation — the erase write-fence. Bumped
+--     in the SAME transaction that disables the source and persists the
+--     durable 'erase' marker (beginSourceErase). Stage writers capture it
+--     with the source row; internal writes CAS on it inside their own
+--     transaction and external writes (Hindsight upsert, S3 put) check it
+--     immediately before AND after the call (with compensation on movement),
+--     so an in-flight acquire/project/retain cannot resurrect
+--     claims/snapshots/documents after an erase starts.
+--   * memory_retraction_attempts.erase_generation — tags 'erase' markers and
+--     their 'source'-scoped children with the generation they belong to, so
+--     aggregate child accounting never counts dead-lettered children from a
+--     PREVIOUS (remediated) erase. Constrained to 0 for derivation-scoped
+--     rows.
+--   * memory_retraction_attempts.cleanup_phase / cleanup_cursor — durable
+--     bounded-cleanup progress on the 'erase' marker (NULL →
+--     'snapshots_deleted' → 'evidence_purged'; checkpoints last, then
+--     terminal). Closed CHECK domain, valid only on scope='erase'.
+--   * Composite accounting index for the per-generation child queries.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0238_memory_erase_generation_fence.sql
+-- creates-column: public.memory_source_configs.erase_generation
+-- creates-column: public.memory_retraction_attempts.erase_generation
+-- creates-column: public.memory_retraction_attempts.cleanup_phase
+-- creates-column: public.memory_retraction_attempts.cleanup_cursor
+-- creates-constraint: public.memory_source_configs.memory_source_configs_erase_generation_nonnegative
+-- creates-constraint: public.memory_retraction_attempts.memory_retraction_attempts_erase_generation_nonnegative
+-- creates-constraint: public.memory_retraction_attempts.memory_retraction_attempts_derivation_generation_check
+-- creates-constraint: public.memory_retraction_attempts.memory_retraction_attempts_cleanup_phase_check
+-- creates: public.memory_retraction_attempts_erase_accounting_idx
+
+ALTER TABLE public.memory_source_configs
+  ADD COLUMN IF NOT EXISTS erase_generation integer NOT NULL DEFAULT 0;
+
+ALTER TABLE public.memory_retraction_attempts
+  ADD COLUMN IF NOT EXISTS erase_generation integer NOT NULL DEFAULT 0;
+
+ALTER TABLE public.memory_retraction_attempts
+  ADD COLUMN IF NOT EXISTS cleanup_phase text;
+
+ALTER TABLE public.memory_retraction_attempts
+  ADD COLUMN IF NOT EXISTS cleanup_cursor text;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'memory_source_configs_erase_generation_nonnegative'
+      AND conrelid = 'public.memory_source_configs'::regclass
+  ) THEN
+    ALTER TABLE public.memory_source_configs
+      ADD CONSTRAINT memory_source_configs_erase_generation_nonnegative
+      CHECK (erase_generation >= 0);
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'memory_retraction_attempts_erase_generation_nonnegative'
+      AND conrelid = 'public.memory_retraction_attempts'::regclass
+  ) THEN
+    ALTER TABLE public.memory_retraction_attempts
+      ADD CONSTRAINT memory_retraction_attempts_erase_generation_nonnegative
+      CHECK (erase_generation >= 0);
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'memory_retraction_attempts_derivation_generation_check'
+      AND conrelid = 'public.memory_retraction_attempts'::regclass
+  ) THEN
+    ALTER TABLE public.memory_retraction_attempts
+      ADD CONSTRAINT memory_retraction_attempts_derivation_generation_check
+      CHECK (scope <> 'derivation' OR erase_generation = 0);
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'memory_retraction_attempts_cleanup_phase_check'
+      AND conrelid = 'public.memory_retraction_attempts'::regclass
+  ) THEN
+    ALTER TABLE public.memory_retraction_attempts
+      ADD CONSTRAINT memory_retraction_attempts_cleanup_phase_check
+      CHECK (
+        cleanup_phase IS NULL
+        OR (scope = 'erase'
+            AND cleanup_phase IN ('snapshots_deleted', 'evidence_purged'))
+      );
+  END IF;
+END $$;
+
+CREATE INDEX IF NOT EXISTS memory_retraction_attempts_erase_accounting_idx
+  ON public.memory_retraction_attempts
+    (source_config_id, erase_generation, scope, status);

package/dist/drizzle/0239_canonical_entity_identity.sql

@@ -0,0 +1,257 @@
+-- THINK-193 U4: canonical entity identity.
+-- Contents:
+--   * identity.* schema (greenfield pgSchema per the feature-schema
+--     extraction pattern — no compat views needed for new tables):
+--       - identity.canonical_entities — stable instance registry with
+--         merged-redirect invariant CHECK.
+--       - identity.entity_source_mappings — exact mapping wins; unique per
+--         (tenant, source_system, namespace, external_id).
+--       - identity.entity_identity_claims — natural-key evidence; plain
+--         lookup index (per-rule uniqueness enforced in the matcher).
+--       - identity.entity_resolution_cases — operator ambiguity queue;
+--         partial unique coalesces open cases by signature.
+--       - identity.entity_resolution_events — append-only audit (no split).
+--   * knowledge_graph_entities.canonical_entity_id + resolution_state.
+--   * wiki.pages.canonical_entity_id + partial unique for tenant Entity pages.
+--   * ontology.entity_types.identity_rules + identity_rules_version.
+--   * memory_claims.canonical_subject_id FK (column landed in 0234).
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0239_canonical_entity_identity.sql
+-- creates: identity.canonical_entities
+-- creates: identity.entity_source_mappings
+-- creates: identity.entity_identity_claims
+-- creates: identity.entity_resolution_cases
+-- creates: identity.entity_resolution_events
+-- creates: identity.uq_entity_source_mappings_source_identity
+-- creates: identity.uq_entity_resolution_cases_open_signature
+-- creates-column: public.knowledge_graph_entities.canonical_entity_id
+-- creates-column: public.knowledge_graph_entities.resolution_state
+-- creates-column: wiki.pages.canonical_entity_id
+-- creates-column: ontology.entity_types.identity_rules
+-- creates-column: ontology.entity_types.identity_rules_version
+-- creates: public.idx_kg_entities_tenant_canonical
+-- creates: wiki.uq_pages_tenant_canonical_entity
+-- creates-constraint: public.knowledge_graph_entities.knowledge_graph_entities_resolution_state_allowed
+-- creates-constraint: public.memory_claims.memory_claims_canonical_subject_id_fk
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SELECT pg_advisory_xact_lock(hashtext('canonical_entity_identity_0239'));
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '60s';
+
+CREATE SCHEMA IF NOT EXISTS identity;
+COMMENT ON SCHEMA identity IS
+  'Canonical entity instance registry (THINK-193 U4): mappings, natural-key claims, and operator resolution queue.';
+
+-- ---------------------------------------------------------------------------
+-- identity.canonical_entities
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS identity.canonical_entities (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  entity_type_slug text NOT NULL,
+  display_name text NOT NULL,
+  normalized_name text NOT NULL,
+  status text NOT NULL DEFAULT 'active',
+  merged_into_id uuid REFERENCES identity.canonical_entities(id) ON DELETE SET NULL,
+  version integer NOT NULL DEFAULT 1,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT canonical_entities_status_allowed
+    CHECK (status IN ('active','merged','archived')),
+  CONSTRAINT canonical_entities_merged_redirect_required
+    CHECK ((status = 'merged') = (merged_into_id IS NOT NULL))
+);
+
+CREATE INDEX IF NOT EXISTS idx_canonical_entities_tenant_status
+  ON identity.canonical_entities (tenant_id, status);
+
+CREATE INDEX IF NOT EXISTS idx_canonical_entities_tenant_type_name
+  ON identity.canonical_entities (tenant_id, entity_type_slug, normalized_name);
+
+-- ---------------------------------------------------------------------------
+-- identity.entity_source_mappings
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS identity.entity_source_mappings (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  canonical_entity_id uuid NOT NULL
+    REFERENCES identity.canonical_entities(id) ON DELETE CASCADE,
+  source_system text NOT NULL,
+  namespace text NOT NULL DEFAULT '',
+  external_id text NOT NULL,
+  visibility text NOT NULL DEFAULT 'tenant',
+  created_by text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT entity_source_mappings_visibility_allowed
+    CHECK (visibility IN ('tenant','private')),
+  CONSTRAINT entity_source_mappings_created_by_allowed
+    CHECK (created_by IN ('rule','operator','backfill'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_entity_source_mappings_source_identity
+  ON identity.entity_source_mappings (tenant_id, source_system, namespace, external_id);
+
+CREATE INDEX IF NOT EXISTS idx_entity_source_mappings_canonical
+  ON identity.entity_source_mappings (canonical_entity_id);
+
+-- ---------------------------------------------------------------------------
+-- identity.entity_identity_claims
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS identity.entity_identity_claims (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  canonical_entity_id uuid NOT NULL
+    REFERENCES identity.canonical_entities(id) ON DELETE CASCADE,
+  rule_slug text NOT NULL,
+  rule_version integer NOT NULL DEFAULT 1,
+  key_kind text NOT NULL,
+  normalized_value text NOT NULL,
+  value_hash text NOT NULL,
+  confidence numeric(5,4),
+  precedence integer NOT NULL DEFAULT 0,
+  visibility text NOT NULL DEFAULT 'tenant',
+  state text NOT NULL DEFAULT 'active',
+  evidence jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT entity_identity_claims_visibility_allowed
+    CHECK (visibility IN ('tenant','private')),
+  CONSTRAINT entity_identity_claims_state_allowed
+    CHECK (state IN ('active','superseded','rejected'))
+);
+
+-- Plain lookup index: per-rule uniqueness scope is enforced by the matcher
+-- against the approved rule's `unique` flag, not one global unique index.
+CREATE INDEX IF NOT EXISTS idx_entity_identity_claims_lookup
+  ON identity.entity_identity_claims (tenant_id, key_kind, value_hash);
+
+CREATE INDEX IF NOT EXISTS idx_entity_identity_claims_canonical
+  ON identity.entity_identity_claims (canonical_entity_id);
+
+-- ---------------------------------------------------------------------------
+-- identity.entity_resolution_cases
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS identity.entity_resolution_cases (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  signature_hash text NOT NULL,
+  entity_type_slug text NOT NULL,
+  display_hint text,
+  candidates jsonb NOT NULL DEFAULT '[]'::jsonb,
+  conflicting_claims jsonb NOT NULL DEFAULT '[]'::jsonb,
+  impact_summary jsonb NOT NULL DEFAULT '{}'::jsonb,
+  item_count integer NOT NULL DEFAULT 1,
+  status text NOT NULL DEFAULT 'open',
+  decision text,
+  decided_by_user_id uuid REFERENCES public.users(id) ON DELETE SET NULL,
+  resolved_canonical_entity_id uuid
+    REFERENCES identity.canonical_entities(id) ON DELETE SET NULL,
+  decided_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT entity_resolution_cases_status_allowed
+    CHECK (status IN ('open','resolved','expired')),
+  CONSTRAINT entity_resolution_cases_decision_allowed
+    CHECK (decision IS NULL OR decision IN ('link','create','defer','reject','merge'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_entity_resolution_cases_open_signature
+  ON identity.entity_resolution_cases (tenant_id, signature_hash)
+  WHERE status = 'open';
+
+CREATE INDEX IF NOT EXISTS idx_entity_resolution_cases_tenant_status_created
+  ON identity.entity_resolution_cases (tenant_id, status, created_at);
+
+-- ---------------------------------------------------------------------------
+-- identity.entity_resolution_events — append-only audit
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS identity.entity_resolution_events (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  case_id uuid REFERENCES identity.entity_resolution_cases(id) ON DELETE SET NULL,
+  canonical_entity_id uuid
+    REFERENCES identity.canonical_entities(id) ON DELETE SET NULL,
+  event_type text NOT NULL,
+  actor_user_id uuid REFERENCES public.users(id) ON DELETE SET NULL,
+  payload jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT entity_resolution_events_type_allowed
+    CHECK (event_type IN ('create','link','defer','reject','merge'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_entity_resolution_events_tenant_created
+  ON identity.entity_resolution_events (tenant_id, created_at);
+
+CREATE INDEX IF NOT EXISTS idx_entity_resolution_events_case
+  ON identity.entity_resolution_events (case_id);
+
+-- ---------------------------------------------------------------------------
+-- Projection columns
+-- ---------------------------------------------------------------------------
+
+ALTER TABLE public.knowledge_graph_entities
+  ADD COLUMN IF NOT EXISTS canonical_entity_id uuid
+    REFERENCES identity.canonical_entities(id) ON DELETE SET NULL;
+
+ALTER TABLE public.knowledge_graph_entities
+  ADD COLUMN IF NOT EXISTS resolution_state text NOT NULL DEFAULT 'legacy';
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'knowledge_graph_entities_resolution_state_allowed'
+      AND conrelid = 'public.knowledge_graph_entities'::regclass
+  ) THEN
+    ALTER TABLE public.knowledge_graph_entities
+      ADD CONSTRAINT knowledge_graph_entities_resolution_state_allowed
+      CHECK (resolution_state IN ('resolved','deferred','private','legacy'));
+  END IF;
+END $$;
+
+CREATE INDEX IF NOT EXISTS idx_kg_entities_tenant_canonical
+  ON public.knowledge_graph_entities (tenant_id, canonical_entity_id)
+  WHERE canonical_entity_id IS NOT NULL;
+
+ALTER TABLE wiki.pages
+  ADD COLUMN IF NOT EXISTS canonical_entity_id uuid
+    REFERENCES identity.canonical_entities(id) ON DELETE SET NULL;
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_pages_tenant_canonical_entity
+  ON wiki.pages (tenant_id, canonical_entity_id)
+  WHERE owner_id IS NULL AND canonical_entity_id IS NOT NULL AND type = 'entity';
+
+ALTER TABLE ontology.entity_types
+  ADD COLUMN IF NOT EXISTS identity_rules jsonb NOT NULL DEFAULT '[]'::jsonb;
+
+ALTER TABLE ontology.entity_types
+  ADD COLUMN IF NOT EXISTS identity_rules_version integer NOT NULL DEFAULT 0;
+
+-- memory_claims.canonical_subject_id landed as a bare uuid in 0234; the
+-- identity registry now exists, so wire the FK.
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'memory_claims_canonical_subject_id_fk'
+      AND conrelid = 'public.memory_claims'::regclass
+  ) THEN
+    ALTER TABLE public.memory_claims
+      ADD CONSTRAINT memory_claims_canonical_subject_id_fk
+      FOREIGN KEY (canonical_subject_id)
+      REFERENCES identity.canonical_entities(id) ON DELETE SET NULL;
+  END IF;
+END $$;
+
+COMMIT;

package/dist/drizzle/0240_memory_personal_scope.sql

@@ -0,0 +1,45 @@
+-- THINK-193 U6: personal (user-scoped) external-memory evidence + claims.
+-- The Gmail email tracer writes evidence and claims into the owner's User
+-- Bank (target_scope 'user'); the U1/U2 CHECK constraints only allowed the
+-- shared scopes. Replace both constraints with _v2 versions that include
+-- 'user'. Shared-only surfaces stay guarded in code (SharedTargetScope,
+-- graph/wiki hard-reject user_* banks).
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0240_memory_personal_scope.sql
+-- creates-constraint: public.memory_evidence_items.memory_evidence_items_target_scope_check_v2
+-- drops-constraint: public.memory_evidence_items.memory_evidence_items_target_scope_check
+-- creates-constraint: public.memory_claims.memory_claims_target_scope_check_v2
+-- drops-constraint: public.memory_claims.memory_claims_target_scope_check
+
+ALTER TABLE public.memory_evidence_items
+  DROP CONSTRAINT IF EXISTS memory_evidence_items_target_scope_check;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'memory_evidence_items_target_scope_check_v2'
+      AND conrelid = 'public.memory_evidence_items'::regclass
+  ) THEN
+    ALTER TABLE public.memory_evidence_items
+      ADD CONSTRAINT memory_evidence_items_target_scope_check_v2
+      CHECK (target_scope IN ('user', 'space', 'tenant'));
+  END IF;
+END $$;
+
+ALTER TABLE public.memory_claims
+  DROP CONSTRAINT IF EXISTS memory_claims_target_scope_check;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'memory_claims_target_scope_check_v2'
+      AND conrelid = 'public.memory_claims'::regclass
+  ) THEN
+    ALTER TABLE public.memory_claims
+      ADD CONSTRAINT memory_claims_target_scope_check_v2
+      CHECK (target_scope IN ('user', 'space', 'tenant'));
+  END IF;
+END $$;

package/dist/drizzle/0241_knowledge_base_document_manifest.sql

@@ -0,0 +1,67 @@
+-- THINK-193 U7: Bedrock Knowledge Base document-projection manifest.
+-- Contents:
+--   * public.knowledge_base_documents — ONE row per (knowledge_base_id,
+--     data_source_id, document_key). The row id is the document's stable
+--     manifest identity across editions; `edition` increments on etag/content
+--     change; effective_to closes only at verified deletion
+--     (ingest_status 'absent_verified'). Edition history lives in
+--     memory_evidence_items.source_version (edition + content hash).
+--   * uq_kb_documents_identity — the manifest key.
+--   * idx_kb_documents_kb_updated — the bedrock_kb adapter's acquisition
+--     cursor (changed editions since (updated_at, id)).
+--   * idx_kb_documents_kb_ingest_status — settlement scan for 'deleting'.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0241_knowledge_base_document_manifest.sql
+-- creates: public.knowledge_base_documents
+-- creates: public.uq_kb_documents_identity
+-- creates: public.idx_kb_documents_tenant
+-- creates: public.idx_kb_documents_kb_updated
+-- creates: public.idx_kb_documents_kb_ingest_status
+-- creates-constraint: public.knowledge_base_documents.knowledge_base_documents_ingest_status_check
+-- creates-constraint: public.knowledge_base_documents.knowledge_base_documents_projection_status_check
+-- creates-constraint: public.knowledge_base_documents.knowledge_base_documents_edition_positive
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS public.knowledge_base_documents (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id),
+  knowledge_base_id uuid NOT NULL REFERENCES public.knowledge_bases(id) ON DELETE CASCADE,
+  data_source_id text NOT NULL,
+  document_key text NOT NULL,
+  s3_version_id text,
+  etag text,
+  content_hash text,
+  edition integer NOT NULL DEFAULT 1,
+  effective_from timestamptz,
+  effective_to timestamptz,
+  ingest_status text NOT NULL DEFAULT 'pending',
+  projection_status text NOT NULL DEFAULT 'pending',
+  last_error text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT knowledge_base_documents_ingest_status_check CHECK (
+    ingest_status IN ('pending', 'ingesting', 'indexed', 'failed', 'deleting', 'absent_verified')
+  ),
+  CONSTRAINT knowledge_base_documents_projection_status_check CHECK (
+    projection_status IN ('pending', 'projected', 'skipped', 'failed', 'retracting', 'retracted')
+  ),
+  CONSTRAINT knowledge_base_documents_edition_positive CHECK (edition >= 1)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_kb_documents_identity
+  ON public.knowledge_base_documents (knowledge_base_id, data_source_id, document_key);
+
+CREATE INDEX IF NOT EXISTS idx_kb_documents_tenant
+  ON public.knowledge_base_documents (tenant_id);
+
+CREATE INDEX IF NOT EXISTS idx_kb_documents_kb_updated
+  ON public.knowledge_base_documents (knowledge_base_id, updated_at, id);
+
+CREATE INDEX IF NOT EXISTS idx_kb_documents_kb_ingest_status
+  ON public.knowledge_base_documents (knowledge_base_id, ingest_status);
+
+COMMIT;

package/dist/drizzle/0242_search_queries.sql

@@ -0,0 +1,28 @@
+-- THINK-263 R15/KTD-8: search-query telemetry (the flywheel sensor).
+-- One append-only row per broker query with per-leg hit counts and statuses.
+-- Raw query text is retained as the future wiki-compile demand-queue input;
+-- retention policy: rows older than 180 days are eligible for deletion
+-- (operational sweep, not enforced in-schema). Operator read paths must be
+-- tenant-scoped. Additive — safe to apply ahead of code deploy.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0242_search_queries.sql
+-- creates: public.search_queries
+
+CREATE TABLE IF NOT EXISTS public.search_queries (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  user_id uuid,
+  query_id uuid,
+  query_text text NOT NULL,
+  sources jsonb NOT NULL,
+  leg_hit_counts jsonb NOT NULL,
+  leg_statuses jsonb NOT NULL,
+  total_hits integer NOT NULL DEFAULT 0,
+  escalated boolean NOT NULL DEFAULT false,
+  duration_ms integer,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_search_queries_tenant_created
+  ON public.search_queries (tenant_id, created_at DESC);

package/dist/drizzle/0243_section_sources_thread_refs.sql

@@ -0,0 +1,12 @@
+-- THINK-263 U2/R14: thread backpointers on wiki section provenance.
+-- Nullable text[] stamped at compile time from cited memory records'
+-- provenance (U1 write-time stamps); backfilled for historical rows by
+-- packages/api/scripts/backfill-section-source-thread-refs.mts. Additive — safe to apply
+-- ahead of code deploy.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0243_section_sources_thread_refs.sql
+-- creates-column: wiki.section_sources.source_thread_ids
+
+ALTER TABLE wiki.section_sources
+  ADD COLUMN IF NOT EXISTS source_thread_ids text[];