thinkwork-cli 0.13.0 → 0.13.2

package/dist/drizzle/0233_workflow_memory_stage_tokens.sql

@@ -0,0 +1,20 @@
+-- THINK-193 U1: widen workflow_task_tokens purpose domain with
+-- 'memory_stage' (task tokens held while a memory pipeline stage runs).
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0233_workflow_memory_stage_tokens.sql
+-- creates-constraint: public.workflow_task_tokens.workflow_task_tokens_purpose_check_v2
+--
+-- The constraint is RENAMED (_v2), not redefined in place: the drift
+-- reporter probes constraints by NAME only, so redefining under the old
+-- name would report APPLIED on environments still carrying the narrow
+-- 0221 list. The _v2 name makes an unapplied widening visible as MISSING.
+
+ALTER TABLE public.workflow_task_tokens
+  DROP CONSTRAINT IF EXISTS workflow_task_tokens_purpose_check;
+ALTER TABLE public.workflow_task_tokens
+  DROP CONSTRAINT IF EXISTS workflow_task_tokens_purpose_check_v2;
+ALTER TABLE public.workflow_task_tokens
+  ADD CONSTRAINT workflow_task_tokens_purpose_check_v2 CHECK (
+    purpose IN ('agent_step', 'approval', 'memory_stage')
+  );

package/dist/drizzle/0234_memory_claim_lifecycle.sql

@@ -0,0 +1,160 @@
+-- THINK-193 U2: external-memory claim lifecycle.
+-- Contents:
+--   * memory_source_authorizations — explicit grant, the MAXIMUM readable
+--     envelope per (processor, family, binding) (partial unique on active).
+--   * memory_claims — durable ontology-shaped claims with a null-safe
+--     fingerprint unique index (COALESCE folds NULL effective_from).
+--   * memory_claim_evidence — many-to-many claim <- evidence support edges.
+--   * memory_retraction_attempts — idempotent multi-system retraction ledger
+--     (retain-attempts-shaped: status/attempt/lock columns, partial unique so
+--     a completed retraction can be re-queued later).
+--   * memory_evidence_items.snapshot_expires_at — app-enforced S3 snapshot TTL.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0234_memory_claim_lifecycle.sql
+-- creates: public.memory_source_authorizations
+-- creates: public.memory_claims
+-- creates: public.memory_claim_evidence
+-- creates: public.memory_retraction_attempts
+-- creates-column: public.memory_evidence_items.snapshot_expires_at
+
+CREATE TABLE IF NOT EXISTS public.memory_source_authorizations (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  processor_config_id uuid NOT NULL
+    REFERENCES public.memory_processor_configs(id) ON DELETE CASCADE,
+  source_family text NOT NULL,
+  source_binding_key text NOT NULL,
+  boundary jsonb NOT NULL DEFAULT '{}'::jsonb,
+  granted_by_user_id uuid REFERENCES public.users(id) ON DELETE SET NULL,
+  grant_version integer NOT NULL DEFAULT 1,
+  status text NOT NULL DEFAULT 'active',
+  expires_at timestamptz,
+  revoked_at timestamptz,
+  sensitivity jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT memory_source_authorizations_source_family_check
+    CHECK (source_family IN ('twenty', 'firecrawl', 'email', 'bedrock_kb')),
+  CONSTRAINT memory_source_authorizations_status_check
+    CHECK (status IN ('active', 'revoked', 'expired'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS memory_source_authorizations_active_uidx
+  ON public.memory_source_authorizations (processor_config_id, source_family, source_binding_key)
+  WHERE status = 'active';
+
+CREATE INDEX IF NOT EXISTS memory_source_authorizations_tenant_idx
+  ON public.memory_source_authorizations (tenant_id);
+
+CREATE TABLE IF NOT EXISTS public.memory_claims (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  target_scope text NOT NULL,
+  target_id uuid NOT NULL,
+  canonical_subject_id uuid,
+  subject_key text NOT NULL,
+  subject_entity_type text NOT NULL DEFAULT 'customer',
+  ontology_predicate text NOT NULL,
+  value jsonb NOT NULL,
+  value_hash text NOT NULL,
+  effective_from timestamptz,
+  effective_to timestamptz,
+  status text NOT NULL DEFAULT 'active',
+  conflict_state text NOT NULL DEFAULT 'none',
+  extraction_version text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT memory_claims_target_scope_check
+    CHECK (target_scope IN ('space', 'tenant')),
+  CONSTRAINT memory_claims_status_check
+    CHECK (status IN ('active', 'superseded', 'retracted')),
+  CONSTRAINT memory_claims_conflict_state_check
+    CHECK (conflict_state IN ('none', 'conflicted'))
+);
+
+-- Null-safe fingerprint: COALESCE folds NULL effective_from into '-infinity'
+-- so duplicate open-ended claims collide instead of coexisting.
+CREATE UNIQUE INDEX IF NOT EXISTS memory_claims_fingerprint_uidx
+  ON public.memory_claims (
+    tenant_id,
+    target_scope,
+    target_id,
+    subject_key,
+    ontology_predicate,
+    value_hash,
+    COALESCE(effective_from, '-infinity'::timestamptz)
+  );
+
+CREATE INDEX IF NOT EXISTS memory_claims_target_subject_idx
+  ON public.memory_claims (tenant_id, target_scope, target_id, subject_key);
+
+CREATE INDEX IF NOT EXISTS memory_claims_tenant_status_idx
+  ON public.memory_claims (tenant_id, status);
+
+CREATE TABLE IF NOT EXISTS public.memory_claim_evidence (
+  id bigserial PRIMARY KEY,
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  claim_id uuid NOT NULL
+    REFERENCES public.memory_claims(id) ON DELETE CASCADE,
+  evidence_item_id uuid NOT NULL
+    REFERENCES public.memory_evidence_items(id) ON DELETE CASCADE,
+  source_config_id uuid NOT NULL
+    REFERENCES public.memory_source_configs(id) ON DELETE CASCADE,
+  status text NOT NULL DEFAULT 'active',
+  created_at timestamptz NOT NULL DEFAULT now(),
+  retracted_at timestamptz,
+  CONSTRAINT memory_claim_evidence_status_check
+    CHECK (status IN ('active', 'retracted'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS memory_claim_evidence_pair_uidx
+  ON public.memory_claim_evidence (claim_id, evidence_item_id);
+
+CREATE INDEX IF NOT EXISTS memory_claim_evidence_evidence_idx
+  ON public.memory_claim_evidence (evidence_item_id);
+
+CREATE INDEX IF NOT EXISTS memory_claim_evidence_claim_status_idx
+  ON public.memory_claim_evidence (claim_id, status);
+
+CREATE TABLE IF NOT EXISTS public.memory_retraction_attempts (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  scope text NOT NULL,
+  derivation_id uuid REFERENCES public.memory_derivations(id) ON DELETE SET NULL,
+  source_config_id uuid NOT NULL
+    REFERENCES public.memory_source_configs(id) ON DELETE CASCADE,
+  provider text NOT NULL DEFAULT 'hindsight',
+  provider_document_id text NOT NULL,
+  target_bank_id text NOT NULL,
+  status text NOT NULL DEFAULT 'queued',
+  attempt_count integer NOT NULL DEFAULT 0,
+  max_attempts integer NOT NULL DEFAULT 5,
+  next_retry_at timestamptz,
+  locked_at timestamptz,
+  locked_by text,
+  error_class text,
+  error_message text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  completed_at timestamptz,
+  CONSTRAINT memory_retraction_attempts_scope_check
+    CHECK (scope IN ('derivation', 'source')),
+  CONSTRAINT memory_retraction_attempts_status_check
+    CHECK (status IN ('queued', 'running', 'supports_updated', 'provider_deleted', 'reconsolidated', 'retracted', 'failed', 'dead_lettered')),
+  CONSTRAINT memory_retraction_attempts_attempt_count_nonnegative
+    CHECK (attempt_count >= 0),
+  CONSTRAINT memory_retraction_attempts_max_attempts_positive
+    CHECK (max_attempts > 0)
+);
+
+-- Partial unique — a completed retraction can be re-queued later.
+CREATE UNIQUE INDEX IF NOT EXISTS memory_retraction_attempts_document_uidx
+  ON public.memory_retraction_attempts (tenant_id, provider, provider_document_id)
+  WHERE status NOT IN ('retracted', 'dead_lettered');
+
+CREATE INDEX IF NOT EXISTS memory_retraction_attempts_due_idx
+  ON public.memory_retraction_attempts (status, next_retry_at, created_at);
+
+ALTER TABLE public.memory_evidence_items
+  ADD COLUMN IF NOT EXISTS snapshot_expires_at timestamptz;

package/dist/drizzle/0235_workflow_token_execution_claim.sql

@@ -0,0 +1,34 @@
+-- THINK-193 U1 (Codex F1/F7/F9): durable pre-execution claim for workflow
+-- task tokens. Adds the 'executing' status (pending -> executing -> consumed),
+-- lease columns (locked_at/locked_by, stale claims are re-claimable), and a
+-- persisted completion result for safe redrive after a SendTaskSuccess
+-- transient failure.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0235_workflow_token_execution_claim.sql
+-- creates-constraint: public.workflow_task_tokens.workflow_task_tokens_status_check_v2
+-- creates-column: public.workflow_task_tokens.locked_at
+-- creates-column: public.workflow_task_tokens.locked_by
+-- creates-column: public.workflow_task_tokens.result
+--
+-- The constraint is RENAMED (_v2), not redefined in place: the drift
+-- reporter probes constraints by NAME only, so redefining under the old
+-- name would report APPLIED on environments still carrying the narrow
+-- three-status list. The _v2 name makes an unapplied widening visible as
+-- MISSING. (Same precedent as 0233's purpose-check widening.)
+
+ALTER TABLE public.workflow_task_tokens
+  ADD COLUMN IF NOT EXISTS locked_at timestamptz;
+ALTER TABLE public.workflow_task_tokens
+  ADD COLUMN IF NOT EXISTS locked_by text;
+ALTER TABLE public.workflow_task_tokens
+  ADD COLUMN IF NOT EXISTS result jsonb;
+
+ALTER TABLE public.workflow_task_tokens
+  DROP CONSTRAINT IF EXISTS workflow_task_tokens_status_check;
+ALTER TABLE public.workflow_task_tokens
+  DROP CONSTRAINT IF EXISTS workflow_task_tokens_status_check_v2;
+ALTER TABLE public.workflow_task_tokens
+  ADD CONSTRAINT workflow_task_tokens_status_check_v2 CHECK (
+    status IN ('pending', 'executing', 'consumed', 'expired')
+  );

package/dist/drizzle/0236_memory_retraction_fencing.sql

@@ -0,0 +1,50 @@
+-- THINK-193 U2 (Codex P1/P2 merge blockers): retraction saga worker fencing
+-- and durable source-erase aggregate markers.
+-- Contents:
+--   * memory_retraction_attempts.lock_generation — fencing token; every CAS
+--     claim increments it and all saga transitions (recordProgress /
+--     finalizeInternalState / markRetracted / markFailed) CAS on
+--     (locked_by, lock_generation) so a worker reclaimed past a stale lease
+--     can never clobber the newer claimant's progress.
+--   * memory_retraction_attempts.reconsolidation_note — non-null when the
+--     reconsolidation step was skipped (delete-capable adapter without a
+--     consolidator): durable skipped-with-reason, distinct from success.
+--   * scope CHECK v2 — adds 'erase': one durable aggregate marker row per
+--     source erase (synthetic erase:<sourceConfigId> document id under the
+--     existing partial unique document index). Markers are excluded from the
+--     per-document saga; the scheduled memory-retraction-drainer keys its
+--     self-finalizing cleanup sweep (S3 snapshot prefix -> evidence purge ->
+--     checkpoints LAST) on them, covering sources with zero derivations.
+--     NEW constraint name: the drift reporter probes by name only.
+--
+-- No status CHECK changes: the status value set is unchanged; only the
+-- saga's transition ORDER moved (provider delete now precedes the internal
+-- finalize transaction).
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0236_memory_retraction_fencing.sql
+-- creates-column: public.memory_retraction_attempts.lock_generation
+-- creates-column: public.memory_retraction_attempts.reconsolidation_note
+-- creates-constraint: public.memory_retraction_attempts.memory_retraction_attempts_scope_check_v2
+
+ALTER TABLE public.memory_retraction_attempts
+  ADD COLUMN IF NOT EXISTS lock_generation integer NOT NULL DEFAULT 0;
+
+ALTER TABLE public.memory_retraction_attempts
+  ADD COLUMN IF NOT EXISTS reconsolidation_note text;
+
+ALTER TABLE public.memory_retraction_attempts
+  DROP CONSTRAINT IF EXISTS memory_retraction_attempts_scope_check;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'memory_retraction_attempts_scope_check_v2'
+      AND conrelid = 'public.memory_retraction_attempts'::regclass
+  ) THEN
+    ALTER TABLE public.memory_retraction_attempts
+      ADD CONSTRAINT memory_retraction_attempts_scope_check_v2
+      CHECK (scope IN ('derivation', 'source', 'erase'));
+  END IF;
+END $$;

package/dist/drizzle/0237_memory_claims_active_value_uidx.sql

@@ -0,0 +1,172 @@
+-- THINK-193 U2 (Codex concurrency finding): structural backstop against
+-- duplicate ACTIVE same-value claims. upsertClaimsForEvidence serializes
+-- writers with a per-subject transaction-scoped advisory lock; this partial
+-- unique index guarantees the invariant even if a future caller bypasses
+-- the lock. Superseded/retracted rows keep full temporal history (a value
+-- may recur later as a NEW active edition — only one can be active).
+--
+-- Codex round-5/6 P1: a bare CREATE UNIQUE INDEX cannot upgrade a database
+-- that already contains the duplicates the index forbids, and repair +
+-- index creation must be ATOMIC against concurrent writers. The whole file
+-- is ONE explicit transaction that write-locks memory_claims and
+-- memory_claim_evidence before scanning:
+--   1. ABORT loudly if any active duplicate group has the same value_hash
+--      but DIFFERENT full JSON values (sha256 collision — human decision).
+--   2. Per duplicate group, keep the EARLIEST row (created_at, id). Edge
+--      merge is PAIR-SAFE: first materialize the DISTINCT
+--      (keeper, evidence) pairs implied by all loser ACTIVE edges, then
+--      ensure exactly ONE ACTIVE keeper edge per pair (reactivating a
+--      pre-existing retracted keeper edge, inserting otherwise — never
+--      violating the (claim_id, evidence_item_id) pair unique), then
+--      retract all loser edges. Finally close the losers as 'superseded'
+--      with the duplicate-edition interval policy: zero-length at their own
+--      effective_from when the keeper is earlier-or-equal (NULL keeper
+--      counts as earliest), else closed at the keeper's effective_from; a
+--      NULL result falls back to now() so every ended interval is closed.
+--   3. Assert zero remaining active duplicates (RAISE rolls the whole
+--      transaction back).
+-- Re-running is idempotent: with no duplicates the repair is a no-op and
+-- the index CREATE is IF NOT EXISTS.
+--
+-- Hand-rolled (partial index + repair; drizzle-kit cannot express it).
+-- Apply with:
+--   psql "$DATABASE_URL" -f drizzle/0237_memory_claims_active_value_uidx.sql
+-- creates: public.memory_claims_active_value_uidx
+
+BEGIN;
+
+LOCK TABLE public.memory_claims IN SHARE ROW EXCLUSIVE MODE;
+LOCK TABLE public.memory_claim_evidence IN SHARE ROW EXCLUSIVE MODE;
+
+DO $$
+DECLARE
+  collision_groups integer;
+  remaining_duplicates integer;
+BEGIN
+  -- 1. Same hash, different value: refuse to merge automatically.
+  SELECT count(*) INTO collision_groups FROM (
+    SELECT 1
+    FROM memory_claims
+    WHERE status = 'active'
+    GROUP BY tenant_id, target_scope, target_id, subject_key,
+             ontology_predicate, value_hash
+    HAVING count(*) > 1 AND count(DISTINCT value::text) > 1
+  ) t;
+  IF collision_groups > 0 THEN
+    RAISE EXCEPTION
+      'memory_claims: % active duplicate group(s) share value_hash with DIFFERING values (hash collision) — resolve manually before applying 0237',
+      collision_groups;
+  END IF;
+
+  -- 2. Deterministic repair of identical-value active duplicates.
+  CREATE TEMP TABLE _mc_active_dupe_losers ON COMMIT DROP AS
+  SELECT id,
+         keeper_id,
+         keeper_effective_from,
+         effective_from AS own_effective_from
+  FROM (
+    SELECT id,
+           effective_from,
+           first_value(id) OVER w AS keeper_id,
+           first_value(effective_from) OVER w AS keeper_effective_from,
+           row_number() OVER w AS rn
+    FROM memory_claims
+    WHERE status = 'active'
+    WINDOW w AS (
+      PARTITION BY tenant_id, target_scope, target_id, subject_key,
+                   ontology_predicate, value_hash
+      ORDER BY created_at, id
+    )
+  ) ranked
+  WHERE rn > 1;
+
+  -- 2a. Materialize the DISTINCT (keeper, evidence) pairs implied by loser
+  --     ACTIVE edges — several losers sharing one evidence item collapse to
+  --     one target pair, so the merge can never violate the
+  --     (claim_id, evidence_item_id) pair unique.
+  CREATE TEMP TABLE _mc_keeper_pairs ON COMMIT DROP AS
+  SELECT DISTINCT ON (l.keeper_id, e.evidence_item_id)
+         l.keeper_id,
+         e.evidence_item_id,
+         e.tenant_id,
+         e.source_config_id
+  FROM memory_claim_evidence e
+  JOIN _mc_active_dupe_losers l ON l.id = e.claim_id
+  WHERE e.status = 'active';
+
+  -- 2b. Reactivate a pre-existing (possibly retracted) keeper edge for each
+  --     pair — the keeper must end with ACTIVE support wherever a loser had
+  --     it.
+  UPDATE memory_claim_evidence k
+  SET status = 'active', retracted_at = NULL
+  FROM _mc_keeper_pairs p
+  WHERE k.claim_id = p.keeper_id
+    AND k.evidence_item_id = p.evidence_item_id
+    AND k.status <> 'active';
+
+  -- 2c. Insert the keeper edges that do not exist at all.
+  INSERT INTO memory_claim_evidence
+    (tenant_id, claim_id, evidence_item_id, source_config_id, status)
+  SELECT p.tenant_id, p.keeper_id, p.evidence_item_id, p.source_config_id,
+         'active'
+  FROM _mc_keeper_pairs p
+  WHERE NOT EXISTS (
+    SELECT 1 FROM memory_claim_evidence k
+    WHERE k.claim_id = p.keeper_id
+      AND k.evidence_item_id = p.evidence_item_id
+  );
+
+  -- 2d. Retract ALL loser active edges (their support now lives on the
+  --     keeper).
+  UPDATE memory_claim_evidence e
+  SET status = 'retracted', retracted_at = now()
+  FROM _mc_active_dupe_losers l
+  WHERE e.claim_id = l.id
+    AND e.status = 'active';
+
+  -- 2e. Close and supersede the losers (duplicate-edition interval policy).
+  UPDATE memory_claims c
+  SET status = 'superseded',
+      effective_to = COALESCE(
+        c.effective_to,
+        CASE
+          WHEN l.keeper_effective_from IS NULL
+            OR (l.own_effective_from IS NOT NULL
+                AND l.keeper_effective_from <= l.own_effective_from)
+            THEN l.own_effective_from
+          ELSE l.keeper_effective_from
+        END,
+        now()
+      ),
+      updated_at = now()
+  FROM _mc_active_dupe_losers l
+  WHERE c.id = l.id;
+
+  -- 3. The invariant must hold before the index lands.
+  SELECT count(*) INTO remaining_duplicates FROM (
+    SELECT 1
+    FROM memory_claims
+    WHERE status = 'active'
+    GROUP BY tenant_id, target_scope, target_id, subject_key,
+             ontology_predicate, value_hash
+    HAVING count(*) > 1
+  ) t;
+  IF remaining_duplicates > 0 THEN
+    RAISE EXCEPTION
+      'memory_claims duplicate repair left % active duplicate group(s) — aborting index creation',
+      remaining_duplicates;
+  END IF;
+END $$;
+
+CREATE UNIQUE INDEX IF NOT EXISTS memory_claims_active_value_uidx
+  ON public.memory_claims (
+    tenant_id,
+    target_scope,
+    target_id,
+    subject_key,
+    ontology_predicate,
+    value_hash
+  )
+  WHERE status = 'active';
+
+COMMIT;

package/dist/drizzle/0238_memory_erase_generation_fence.sql

@@ -0,0 +1,97 @@
+-- THINK-193 U2 (Codex rounds 3-6): erase write-fence, per-generation child
+-- scoping, durable bounded-cleanup progress, and DB-level integrity for the
+-- retraction saga.
+-- Contents:
+--   * memory_source_configs.erase_generation — the erase write-fence. Bumped
+--     in the SAME transaction that disables the source and persists the
+--     durable 'erase' marker (beginSourceErase). Stage writers capture it
+--     with the source row; internal writes CAS on it inside their own
+--     transaction and external writes (Hindsight upsert, S3 put) check it
+--     immediately before AND after the call (with compensation on movement),
+--     so an in-flight acquire/project/retain cannot resurrect
+--     claims/snapshots/documents after an erase starts.
+--   * memory_retraction_attempts.erase_generation — tags 'erase' markers and
+--     their 'source'-scoped children with the generation they belong to, so
+--     aggregate child accounting never counts dead-lettered children from a
+--     PREVIOUS (remediated) erase. Constrained to 0 for derivation-scoped
+--     rows.
+--   * memory_retraction_attempts.cleanup_phase / cleanup_cursor — durable
+--     bounded-cleanup progress on the 'erase' marker (NULL →
+--     'snapshots_deleted' → 'evidence_purged'; checkpoints last, then
+--     terminal). Closed CHECK domain, valid only on scope='erase'.
+--   * Composite accounting index for the per-generation child queries.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0238_memory_erase_generation_fence.sql
+-- creates-column: public.memory_source_configs.erase_generation
+-- creates-column: public.memory_retraction_attempts.erase_generation
+-- creates-column: public.memory_retraction_attempts.cleanup_phase
+-- creates-column: public.memory_retraction_attempts.cleanup_cursor
+-- creates-constraint: public.memory_source_configs.memory_source_configs_erase_generation_nonnegative
+-- creates-constraint: public.memory_retraction_attempts.memory_retraction_attempts_erase_generation_nonnegative
+-- creates-constraint: public.memory_retraction_attempts.memory_retraction_attempts_derivation_generation_check
+-- creates-constraint: public.memory_retraction_attempts.memory_retraction_attempts_cleanup_phase_check
+-- creates: public.memory_retraction_attempts_erase_accounting_idx
+
+ALTER TABLE public.memory_source_configs
+  ADD COLUMN IF NOT EXISTS erase_generation integer NOT NULL DEFAULT 0;
+
+ALTER TABLE public.memory_retraction_attempts
+  ADD COLUMN IF NOT EXISTS erase_generation integer NOT NULL DEFAULT 0;
+
+ALTER TABLE public.memory_retraction_attempts
+  ADD COLUMN IF NOT EXISTS cleanup_phase text;
+
+ALTER TABLE public.memory_retraction_attempts
+  ADD COLUMN IF NOT EXISTS cleanup_cursor text;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'memory_source_configs_erase_generation_nonnegative'
+      AND conrelid = 'public.memory_source_configs'::regclass
+  ) THEN
+    ALTER TABLE public.memory_source_configs
+      ADD CONSTRAINT memory_source_configs_erase_generation_nonnegative
+      CHECK (erase_generation >= 0);
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'memory_retraction_attempts_erase_generation_nonnegative'
+      AND conrelid = 'public.memory_retraction_attempts'::regclass
+  ) THEN
+    ALTER TABLE public.memory_retraction_attempts
+      ADD CONSTRAINT memory_retraction_attempts_erase_generation_nonnegative
+      CHECK (erase_generation >= 0);
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'memory_retraction_attempts_derivation_generation_check'
+      AND conrelid = 'public.memory_retraction_attempts'::regclass
+  ) THEN
+    ALTER TABLE public.memory_retraction_attempts
+      ADD CONSTRAINT memory_retraction_attempts_derivation_generation_check
+      CHECK (scope <> 'derivation' OR erase_generation = 0);
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'memory_retraction_attempts_cleanup_phase_check'
+      AND conrelid = 'public.memory_retraction_attempts'::regclass
+  ) THEN
+    ALTER TABLE public.memory_retraction_attempts
+      ADD CONSTRAINT memory_retraction_attempts_cleanup_phase_check
+      CHECK (
+        cleanup_phase IS NULL
+        OR (scope = 'erase'
+            AND cleanup_phase IN ('snapshots_deleted', 'evidence_purged'))
+      );
+  END IF;
+END $$;
+
+CREATE INDEX IF NOT EXISTS memory_retraction_attempts_erase_accounting_idx
+  ON public.memory_retraction_attempts
+    (source_config_id, erase_generation, scope, status);