safety layer: hard daily budget, user quotas, spend report, forgetme + privacy

specs/SPEC-009-persistence.md

@@ -28,9 +28,16 @@ accident).
 ### PER-04 — Database hygiene (coverage: test)
 
 The database runs in WAL journal mode, carries `PRAGMA user_version`
-= schema version (currently 1) for future migrations/rollback
+= the store's current schema version for the migration/rollback
 policy, and the file is chmod 0600 (it stores conversation data).
 
+### PER-06 — Schema migrations run forward automatically (coverage: test)
+
+Opening a database with an older `user_version` applies the missing
+migration steps in order (v1 → v2 adds the usage table) and preserves
+existing rows. Deploy rollback policy: never roll binaries back past
+a schema bump without restoring the pre-deploy backup.
+
 ### PER-05 — Writes run off the event loop (coverage: test)
 
 History and memory persistence happen in a worker thread