{
  "schema": "huanxi.upgrade-package.v1",
  "upgrade_kind": "schema",
  "source_release": "0.8.13.31",
  "target_release": "0.8.13.32",
  "source_schema": "0.8.2-runtime-tables.83",
  "target_schema": "0.8.2-runtime-tables.84",
  "forward_sql": "forward.sql",
  "rollback_sql": "rollback.sql",
  "forward_sha256": "a1c60816ed86e880237c245688c5a48f140197f6456f8aafec973621680d9e08",
  "rollback_sha256": "c49e9ecf776fd7a806a480183f44dbc54fa662d2a8388a1f2ba57f9d0e522f5d",
  "rollback_mode": "logical",
  "requires_admin_superuser": true,
  "service_stop_required": true,
  "database_backup_required": true,
  "preserve_tables": [
    "employees",
    "projects",
    "assignments",
    "runtime_conversation_messages",
    "user_decisions",
    "runtime_artifacts",
    "assignment_results",
    "qa_results",
    "deliveries",
    "channel_delivery_outbox",
    "channel_bindings",
    "input_commands"
  ],
  "append_only_tables": [],
  "notes": "Installs the RLS-compatible index path for the dashboard projection's message-to-input_command LATERAL join. Root cause: input_commands is FORCE RLS and huanxi_runtime has no BYPASSRLS, so the planner refuses index quals containing non-leakproof functions (jsonb_exists) — the previously trialed GIN index on (content_ref::jsonb) measured zero usage under the app role and the projection stayed at 14-16s (~350 Teams<->OS timeouts/day). This hop creates huanxi.content_ref_uri(TEXT), a genuinely LEAKPROOF IMMUTABLE STRICT PARALLEL SAFE extractor of the single-element content_ref URI array (never raises; malformed or non-array input returns NULL; reads no tables), an expression btree index input_commands_content_ref_uri_idx on (content_ref_uri(content_ref)), and grants EXECUTE to the service roles. The runtime SQL (0.8.13.32) adds the equality qual and keeps the original ? predicate as a recheck, so result semantics are unchanged; only the plan changes (Bitmap Index Scan instead of a per-message Seq Scan, locally verified 17x under a faithful FORCE RLS + non-superuser app-role reproduction). Purely additive DDL: no data read or rewritten. Forward requires a superuser session (LEAKPROOF attribute; huanxi_admin is SUPERUSER since 0.8.9.5) and guards with a clean leakproof_requires_superuser diagnosis. Rollback is subtractive (drop index + function, restore marker .83); the previous runtime must be restored together with it because the 0.8.13.32 SQL references the function. Production deployment of this DDL goes through the supervised deployment path, not this hop alone."
}