@humwick/server 0.0.0-stage → 0.130.0

package/src/db/schema.ts

@@ -0,0 +1,1472 @@
+import { DURABLE_PAYLOAD_SCHEMA } from "./durable-payloads"; import { PLAN_IMPORT_SCHEMA_SQL } from "./plan-import-schema";
+import { PROJECT_ROOTS_SCHEMA } from "./project-root-schema";
+import { seedBuiltInTokenProfiles } from "../token-db";
+import { LONG_RUNNING_WORK_SCHEMA } from "./long-running-work";
+import { ARTIFACT_RETENTION_SCHEMA } from "./artifact-retention";
+import { CLAUDE_API_BUDGET_SCHEMA, migrateApiBudgets } from "./api-budget-schema";
+import { Database } from "bun:sqlite";
+import { AGENT_EXIT_REPORT_SCHEMA } from "./agent-exit-report";
+import { BROWSER_SESSIONS_SCHEMA_SQL } from "./browser-sessions";
+import { CONTEXT_RESET_SCHEMA } from "./context-reset-carry";
+import { AGENT_IDENTITY_ARCHIVE_SCHEMA } from "./agent-identity-archive";
+import { COORDINATOR_DIGEST_SCHEMA_SQL } from "./coordinator-digest";
+import { PLAN_DISPATCH_SCHEMA_SQL } from "./plan-dispatch-schema";
+import { IDLE_DIGEST_SCHEMA_SQL } from "./idle-digest";
+import { TASK_TOKEN_TOTALS_SCHEMA } from "./token-usage";
+import { SHIPPING_STATS_SCHEMA } from "./shipping-stats-schema";
+import { OPERATOR_ACTIONS_SCHEMA } from "./operator-actions-schema";
+import { SELF_EFFORT_PERMISSIONS_SCHEMA } from "./self-effort-permissions";
+import { AGENT_EFFORT_STATE_SCHEMA } from "./agent-effort-state";
+import { applyConnectionPragmas, CONNECTION_BUSY_TIMEOUT_MS, getDb, refreshPlannerStats, setDb } from "./connection.ts";
+import { STARTUP_LOCK_WAIT_MS, waitForStartupWriteLock } from "./startup-write-lock";
+import { __resetDeferredLineageReports } from "./messages.ts";
+import { __resetLifecycleSignals } from "../lifecycle-signal-registry";
+import { resetLifecycleSeqSeed } from "./lifecycle-seq.ts";
+import { resetFannedSeq } from "../sse-outbox-cursor";
+import { dropLegacyContinuationArchiveIndex } from "./continuation-archive-search.ts";
+import { applyMigrations } from "./migrations.ts";
+import { PROMPT_TEMPLATES_SCHEMA_SQL, seedPromptTemplatesIfNeeded } from "./prompt-templates-schema";
+import { ensureLandingPhaseOneSchema } from "./landing-schema.ts";
+import { beginStartupPhase, timeStartupPhase } from "../startup-timing";
+import { resetMainConnectionWrites } from "./main-connection-writes";
+
+// Schema bootstrap. initDb opens the handle, applies connection pragmas, creates
+// the full table/index catalog (the inline DDL below — kept in one place so the
+// schema reads top-to-bottom), then hands off to applyMigrations() for the
+// incremental ALTER/backfill history. The DDL block is declarative and large by
+// nature; that is why this file carries a file-size-ratchet baseline.
+export function initDb(path: string = "agent-relay.db"): Database {
+  const conn = timeStartupPhase("db.open", () => new Database(path, { create: true }));
+  timeStartupPhase("db.write-lock", () => waitForStartupWriteLock(conn));
+  timeStartupPhase("db.pragmas", () => applyConnectionPragmas(conn)); setDb(conn, path);
+  // #3707 — the bootstrap below may meet a held lock again; wait it out instead of crash-looping.
+  conn.run(`PRAGMA busy_timeout = ${STARTUP_LOCK_WAIT_MS}`);
+  // A fresh DB must drop in-memory report-up state keyed by old message ids / agent lineage (#1037/#1032b).
+  __resetDeferredLineageReports();
+  __resetLifecycleSignals();
+  // #2111 — drop the lifecycle-ordinal seed so it is re-read from THIS database; a seed carried over
+  // from a smaller one would sit below its stamps and fence every lifecycle write out (lifecycle-seq.ts).
+  resetLifecycleSeqSeed();
+
+  const finishCatalog = beginStartupPhase("db.catalog");
+  getDb().run(DURABLE_PAYLOAD_SCHEMA); getDb().run(`
+    CREATE TABLE IF NOT EXISTS agents (
+      id TEXT PRIMARY KEY,
+      name TEXT NOT NULL,
+      kind TEXT NOT NULL DEFAULT 'provider',
+      tags TEXT NOT NULL DEFAULT '[]',
+      system_tags TEXT NOT NULL DEFAULT '[]',
+      machine TEXT,
+      rig TEXT,
+      capabilities TEXT NOT NULL DEFAULT '[]',
+      status TEXT NOT NULL DEFAULT 'idle',
+      instance_id TEXT,
+      epoch INTEGER NOT NULL DEFAULT 0,
+      provider_capabilities TEXT,
+      context_state TEXT,
+      quota_state TEXT,
+      profile_projection TEXT,
+      meta TEXT NOT NULL DEFAULT '{}', lifecycle TEXT NOT NULL DEFAULT 'persistent',
+      -- #2111 ordering fence: submission ordinal of the newest write to each of these columns, so a
+      -- deferred write can never undo a later one. PER COLUMN, not per row, so an ordinary concurrent
+      -- setStatus + markReady do not suppress each other. See src/db/lifecycle-seq.ts.
+      status_seq INTEGER NOT NULL DEFAULT 0,
+      ready_seq INTEGER NOT NULL DEFAULT 0,
+      spawned_by TEXT,
+      team_id TEXT,
+      keep_state TEXT, -- #3428 server-owned keep flag (JSON AgentKeep); registration upserts never touch it
+      last_seen INTEGER NOT NULL,
+      created_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_agents_spawn_request ON agents(json_extract(meta, '$.spawnRequestId'));
+    CREATE TABLE IF NOT EXISTS notification_subscriptions (
+      id TEXT PRIMARY KEY,
+      agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+      type TEXT NOT NULL,
+      mode TEXT NOT NULL CHECK (mode IN ('opt_in', 'opt_out', 'mute')),
+      scope_match TEXT,
+      created_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_notification_subscriptions_agent ON notification_subscriptions(agent_id, type);
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_notification_subscriptions_unique
+      ON notification_subscriptions(agent_id, type, mode, coalesce(scope_match, ''));
+    CREATE TABLE IF NOT EXISTS messages (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      from_agent TEXT NOT NULL,
+      to_target TEXT NOT NULL,
+      kind TEXT NOT NULL DEFAULT 'chat', message_type TEXT, source_message_id INTEGER,
+      channel TEXT,
+      subject TEXT,
+      body TEXT NOT NULL,
+      thread_id INTEGER,
+      reply_to INTEGER REFERENCES messages(id),
+      reply_expected INTEGER NOT NULL DEFAULT 1,
+      urgent_requested INTEGER NOT NULL DEFAULT 0,
+      urgent_throttled INTEGER NOT NULL DEFAULT 0,
+      claimable INTEGER NOT NULL DEFAULT 0,
+      claimed_by TEXT,
+      claimed_at INTEGER,
+      claim_expires_at INTEGER,
+      idempotency_key TEXT,
+      delivery_status TEXT NOT NULL DEFAULT 'pending',
+      delivery_attempts INTEGER NOT NULL DEFAULT 0,
+      delivery_last_error TEXT,
+      delivery_next_retry_at INTEGER,
+      delivery_poison_reason TEXT,
+      delivery_updated_at INTEGER,
+      queued_at INTEGER,
+      max_age_seconds INTEGER,
+      resolved_to_agent TEXT,
+      payload TEXT NOT NULL DEFAULT '{}',
+      meta TEXT NOT NULL DEFAULT '{}',
+      read_by TEXT NOT NULL DEFAULT '[]',
+      created_at INTEGER NOT NULL,
+      occurred_at INTEGER,
+      seq INTEGER
+    );
+
+    -- (#846) composite covers ORDER BY id DESC for the to_target branch of
+    -- listAgentChatHistory without a filesort.  The composite is a leftmost-prefix
+    -- superset of the old idx_msg_to single-column index, so all WHERE to_target=?
+    -- queries (delivery, polling, etc.) are served identically.
+    -- idx_msg_resolved_to_id is created in applyMigrations() AFTER the
+    -- resolved_to_agent ALTER — never inline here (same hazard as #483/#559).
+    -- idx_msg_reply_to is also migration-owned because reply_to was added by ALTER.
+    CREATE INDEX IF NOT EXISTS idx_msg_to_id ON messages(to_target, id);
+    CREATE INDEX IF NOT EXISTS idx_msg_from_id ON messages(from_agent, id);
+    CREATE INDEX IF NOT EXISTS idx_msg_created ON messages(created_at);
+    CREATE INDEX IF NOT EXISTS idx_msg_channel ON messages(channel);
+    CREATE TABLE IF NOT EXISTS urgent_message_budgets (
+      sender_agent TEXT NOT NULL,
+      recipient_target TEXT NOT NULL,
+      tokens REAL NOT NULL,
+      updated_at INTEGER NOT NULL,
+      PRIMARY KEY (sender_agent, recipient_target)
+    );
+    CREATE TABLE IF NOT EXISTS scheduled_timers (
+      id TEXT PRIMARY KEY,
+      target TEXT NOT NULL,
+      created_by TEXT NOT NULL,
+      created_by_kind TEXT NOT NULL,
+      created_by_scopes TEXT NOT NULL DEFAULT '[]',
+      created_by_constraints TEXT,
+      delivery_from TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      next_run_at INTEGER NOT NULL,
+      schedule_kind TEXT NOT NULL,
+      schedule_def TEXT NOT NULL,
+      message_kind TEXT,
+      channel TEXT,
+      subject TEXT,
+      body TEXT NOT NULL,
+      claimable INTEGER NOT NULL DEFAULT 0,
+      payload TEXT NOT NULL DEFAULT '{}',
+      meta TEXT NOT NULL DEFAULT '{}',
+      enabled INTEGER NOT NULL DEFAULT 1,
+      run_count INTEGER NOT NULL DEFAULT 0,
+      max_runs INTEGER,
+      expires_at INTEGER,
+      last_run_at INTEGER,
+      last_error TEXT,
+      consecutive_failures INTEGER NOT NULL DEFAULT 0,
+      idempotency_key TEXT,
+      correlation_id TEXT NOT NULL,
+      last_message_id INTEGER REFERENCES messages(id) ON DELETE SET NULL,
+      claimed_by TEXT,
+      claim_expires_at INTEGER,
+      command TEXT, message_authority_frozen INTEGER NOT NULL DEFAULT 0 CHECK (message_authority_frozen IN (0, 1) AND (command IS NULL OR message_authority_frozen = 0))
+    );
+    CREATE INDEX IF NOT EXISTS idx_scheduled_timers_due ON scheduled_timers(enabled, next_run_at, claim_expires_at);
+    CREATE INDEX IF NOT EXISTS idx_scheduled_timers_creator ON scheduled_timers(created_by, enabled, next_run_at);
+    CREATE INDEX IF NOT EXISTS idx_scheduled_timers_correlation ON scheduled_timers(correlation_id);
+    CREATE TABLE IF NOT EXISTS teams (
+      id TEXT PRIMARY KEY,
+      parent_team_id TEXT,
+      coordinator_id TEXT,
+      root_coordinator_id TEXT,
+      title TEXT,
+      brief TEXT,
+      definition_of_done TEXT,
+      status TEXT NOT NULL DEFAULT 'active',
+      outcome_status TEXT,
+      outcome_summary TEXT,
+      composition TEXT,
+      cost_tokens INTEGER,
+      cost_usd REAL,
+      wall_clock_ms INTEGER,
+      lands_clean INTEGER,
+      zero_members_since INTEGER,
+      idle_since INTEGER,
+      idle_pinged INTEGER,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      dissolved_at INTEGER,
+      former_coordinator_ids TEXT,
+      project_id TEXT -- #3107 set only on the project's coordinator seat team (db/team-project.ts)
+    );
+    CREATE INDEX IF NOT EXISTS idx_teams_coordinator ON teams(coordinator_id);
+    CREATE INDEX IF NOT EXISTS idx_teams_status ON teams(status);
+    CREATE TABLE IF NOT EXISTS spawn_delegation_requests (
+      team_id TEXT NOT NULL, request_id TEXT NOT NULL, input TEXT NOT NULL, result TEXT NOT NULL,
+      actor TEXT NOT NULL, created_at INTEGER NOT NULL, PRIMARY KEY (team_id, request_id)
+    );
+    CREATE TABLE IF NOT EXISTS blackboard_entries (
+      id TEXT PRIMARY KEY,
+      team_id TEXT NOT NULL,
+      kind TEXT NOT NULL,
+      title TEXT NOT NULL,
+      body TEXT,
+      status TEXT NOT NULL DEFAULT 'active',
+      supersedes TEXT,
+      tags TEXT,
+      author_id TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_blackboard_team ON blackboard_entries(team_id);
+    CREATE INDEX IF NOT EXISTS idx_blackboard_team_kind ON blackboard_entries(team_id, kind);
+    -- Projects (#403/#405) — the durable knowledge scope. projects/project_roots/project_entries
+    -- re-scope the teams/blackboard_entries pair above (team_id → project_id); project_entries
+    -- adds source/origin_ref so a promoted or ingested entry tracks where it came from.
+    -- #559 — scope generalizes the anchor from repo-root to {project|profile|user}.
+    -- A profile/user store is a projects row with scope!='project' and anchor_key = the
+    -- profile name / operator id. Existing rows default scope='project' (zero regression).
+    CREATE TABLE IF NOT EXISTS projects (
+      id TEXT PRIMARY KEY,
+      slug TEXT NOT NULL UNIQUE,
+      title TEXT,
+      description TEXT,
+      tenant_id TEXT,
+      issue_repo TEXT,
+      scope TEXT NOT NULL DEFAULT 'project',
+      anchor_key TEXT,
+      status TEXT NOT NULL DEFAULT 'active',
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    );
+    -- idx_projects_scope_anchor is created in applyMigrations() AFTER the scope/anchor_key ALTER —
+    -- never inline here (#483/#559: an inline index over a not-yet-migrated column crashes initDb
+    -- on an existing DB whose projects table predates the scope columns).
+    ${PROJECT_ROOTS_SCHEMA};
+    CREATE TABLE IF NOT EXISTS project_entries (
+      id TEXT PRIMARY KEY,
+      project_id TEXT NOT NULL,
+      kind TEXT NOT NULL,
+      title TEXT NOT NULL,
+      body TEXT,
+      status TEXT NOT NULL DEFAULT 'active',
+      supersedes TEXT,
+      tags TEXT,
+      author_id TEXT NOT NULL,
+      source TEXT NOT NULL DEFAULT 'manual',
+      origin_ref TEXT,
+      -- #1565 P2 — the unified-memory axes. Defaults are BEHAVIOR-PRESERVING: 'all' is what
+      -- every pre-#1565 row effectively was (nothing filtered by audience), and 'indexed' /
+      -- 'normal' / a null TTL keep the entry exactly as injectable as it is today. Written
+      -- inline here AND as ALTERs in applyMigrations() for populated DBs.
+      audience TEXT NOT NULL DEFAULT 'all',
+      inject TEXT NOT NULL DEFAULT 'indexed',
+      expires_at INTEGER,
+      sensitivity TEXT NOT NULL DEFAULT 'normal',
+      -- #3408 — JSON array of area names; NULL = legacy/untagged (distinct from '[]').
+      areas TEXT,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_project_entries_project ON project_entries(project_id);
+    CREATE INDEX IF NOT EXISTS idx_project_entries_project_kind ON project_entries(project_id, kind);
+    -- T4060 (#2289): the active-only display ORDER BY (updated_at, created_at, id, all DESC)
+    -- served from the index, so the sort never visits a cell's ~95% retracted rows.
+    CREATE INDEX IF NOT EXISTS idx_project_entries_active_order ON project_entries(project_id, status, updated_at DESC, created_at DESC, id DESC);
+    -- #2591 — the structured project journal: fixed-field, OVERWRITE-BY-FIELD current-state rows
+    -- (project_journal) plus an append-only diff-log (project_journal_history). Scoped to
+    -- (project_id, profile) — Phase 1: the coordinator profile. Distinct from the kernel event
+    -- journal (relay_kernel_getJournal) and workflow-journal: this is the "current field values"
+    -- store that injects as its own prompt block beside project memory.
+    -- DDL duplicated byte-identically in applyMigrations() (src/db/migrations.ts) for populated
+    -- DBs — migrations.test asserts fresh-vs-migrated schema-catalog parity.
+    CREATE TABLE IF NOT EXISTS project_journal (
+      id TEXT PRIMARY KEY,
+      project_id TEXT NOT NULL,
+      profile TEXT NOT NULL,
+      field TEXT NOT NULL,
+      value TEXT NOT NULL,
+      updated_at INTEGER NOT NULL,
+      updated_by TEXT NOT NULL,
+      UNIQUE(project_id, profile, field)
+    );
+    CREATE INDEX IF NOT EXISTS idx_project_journal_scope ON project_journal(project_id, profile);
+    CREATE TABLE IF NOT EXISTS project_journal_history (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      project_id TEXT NOT NULL,
+      profile TEXT NOT NULL,
+      field TEXT NOT NULL,
+      old_value TEXT,
+      new_value TEXT,
+      action TEXT NOT NULL,
+      changed_at INTEGER NOT NULL,
+      changed_by TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_project_journal_history_scope ON project_journal_history(project_id, profile, field);
+    -- Project composition graph (#406). kind is 'contains' (umbrella→sub-project, INHERITS)
+    -- or 'depends_on' (reference-only, never inherits). Cycles are rejected on insert in
+    -- src/db/projects.ts (addEdge). Both-direction indexes: from_project for descend/deps,
+    -- to_project for the ancestors() walk.
+    CREATE TABLE IF NOT EXISTS project_edges (
+      from_project TEXT NOT NULL,
+      to_project TEXT NOT NULL,
+      kind TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      UNIQUE(from_project, to_project, kind)
+    );
+    CREATE INDEX IF NOT EXISTS idx_project_edges_from ON project_edges(from_project, kind);
+    CREATE INDEX IF NOT EXISTS idx_project_edges_to ON project_edges(to_project, kind);
+    CREATE TABLE IF NOT EXISTS plans (
+      id TEXT PRIMARY KEY, thread_id INTEGER NOT NULL, team_id TEXT, channel TEXT, version INTEGER NOT NULL DEFAULT 1,
+      archived INTEGER NOT NULL DEFAULT 0, title TEXT, objective TEXT, nodes TEXT NOT NULL DEFAULT '[]', edges TEXT NOT NULL DEFAULT '[]',
+      created_by TEXT NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL, acceptance TEXT, conformance TEXT, completion TEXT
+    );
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_plans_thread_channel ON plans(thread_id, coalesce(channel, ''));
+    CREATE INDEX IF NOT EXISTS idx_plans_updated ON plans(updated_at);
+    CREATE TABLE IF NOT EXISTS plan_versions (
+      id INTEGER PRIMARY KEY AUTOINCREMENT, plan_id TEXT NOT NULL,
+      version INTEGER NOT NULL, title TEXT, objective TEXT, nodes TEXT NOT NULL, edges TEXT NOT NULL,
+      changed_by TEXT, changed_at INTEGER NOT NULL, acceptance TEXT, conformance TEXT
+    );
+    CREATE INDEX IF NOT EXISTS idx_plan_versions_plan ON plan_versions(plan_id, version DESC);
+
+    CREATE TABLE IF NOT EXISTS message_reactions (
+      message_id INTEGER NOT NULL REFERENCES messages(id) ON DELETE CASCADE,
+      actor_id TEXT NOT NULL,
+      emoji TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      PRIMARY KEY (message_id, actor_id, emoji)
+    );
+    CREATE INDEX IF NOT EXISTS idx_message_reactions_message ON message_reactions(message_id);
+
+    CREATE TABLE IF NOT EXISTS context_snapshots (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+      utilization REAL NOT NULL,
+      lifecycle_state TEXT NOT NULL,
+      tokens_used INTEGER,
+      tokens_max INTEGER,
+      source TEXT NOT NULL,
+      confidence TEXT NOT NULL,
+      context_state TEXT NOT NULL,
+      captured_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_context_snapshots_agent_time ON context_snapshots(agent_id, captured_at DESC);
+
+    -- #2485 — the durable, provider-agnostic token-usage ledger the capture seams write to and the
+    -- Analytics box reads. NOT context_snapshots (debounced + ~1-day pruned): this is a ledger.
+    -- Deliberately NO agents FK — rows are historical fact and must survive a reaped agent, or a
+    -- reaped agent's spend silently vanishes from every aggregate.
+    CREATE TABLE IF NOT EXISTS session_token_usage (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      agent_id TEXT NOT NULL,
+      session_id TEXT NOT NULL,
+      turn_id TEXT,
+      provider TEXT NOT NULL,
+      model TEXT NOT NULL,
+      input_tokens INTEGER NOT NULL DEFAULT 0,
+      output_tokens INTEGER NOT NULL DEFAULT 0,
+      cache_read_tokens INTEGER NOT NULL DEFAULT 0,
+      cache_write_tokens INTEGER NOT NULL DEFAULT 0,
+      reasoning_output_tokens INTEGER,
+      created_at INTEGER NOT NULL,
+      dedupe_key TEXT NOT NULL,
+      -- #3011 -- the Task this report was first attributed to; replacements reuse it, so a later
+      -- reassignment never moves a correction's delta onto another Task. NULL = never attributed.
+      task_id INTEGER,
+      subagent_id TEXT,
+      -- #3351 -- 'unknown' = usage was observed but its counts were unavailable; NULL = counts known.
+      usage_status TEXT
+    );
+    CREATE INDEX IF NOT EXISTS idx_session_token_usage_created ON session_token_usage(created_at);
+    CREATE INDEX IF NOT EXISTS idx_session_token_usage_provider_time ON session_token_usage(provider, created_at);
+    -- The idempotency mechanism itself: a repeated POST/SSE double-report of the same natural key
+    -- upserts, never double-counts.
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_session_token_usage_dedupe ON session_token_usage(dedupe_key);
+    CREATE INDEX IF NOT EXISTS idx_session_token_usage_agent ON session_token_usage(agent_id);
+
+    CREATE TABLE IF NOT EXISTS quota_snapshots (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      provider TEXT NOT NULL,
+      account_key TEXT NOT NULL,
+      agent_id TEXT REFERENCES agents(id) ON DELETE SET NULL,
+      windows TEXT NOT NULL,
+      source TEXT NOT NULL,
+      quota_state TEXT NOT NULL,
+      captured_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_quota_snapshots_agent_time ON quota_snapshots(agent_id, captured_at DESC);
+
+    CREATE TABLE IF NOT EXISTS provider_quotas (
+      provider TEXT NOT NULL,
+      account_key TEXT NOT NULL,
+      quota_state TEXT,
+      codex_reset_credits TEXT,
+      source_agent_ids TEXT NOT NULL DEFAULT '[]',
+      quota_advisory_state TEXT NOT NULL DEFAULT '{}',
+      quota_band_state TEXT NOT NULL DEFAULT '{}',
+      last_updated_at INTEGER,
+      last_attempt_at INTEGER NOT NULL,
+      last_error TEXT,
+      updated_at INTEGER NOT NULL,
+      created_at INTEGER NOT NULL,
+      PRIMARY KEY (provider, account_key)
+    );
+
+    CREATE TABLE IF NOT EXISTS provider_quota_leases (
+      provider TEXT NOT NULL,
+      account_key TEXT NOT NULL,
+      orchestrator_id TEXT NOT NULL,
+      lease_token TEXT NOT NULL,
+      expires_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      created_at INTEGER NOT NULL,
+      PRIMARY KEY (provider, account_key)
+    );
+    CREATE INDEX IF NOT EXISTS idx_provider_quota_leases_expires ON provider_quota_leases(expires_at);
+
+    CREATE TABLE IF NOT EXISTS agent_continuations (
+      agent_id TEXT PRIMARY KEY REFERENCES agents(id) ON DELETE CASCADE,
+      objective TEXT NOT NULL, objective_epoch INTEGER NOT NULL,
+      generation INTEGER NOT NULL DEFAULT 0,
+      ledger TEXT NOT NULL DEFAULT '[]',
+      working_state TEXT NOT NULL DEFAULT '',
+      archive_refs TEXT NOT NULL DEFAULT '[]',
+      budget TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS continuation_archives (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+      generation INTEGER NOT NULL,
+      segment TEXT NOT NULL,
+      created_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_continuation_archives_agent_generation
+      ON continuation_archives(agent_id, generation, created_at DESC);
+
+    -- #832 — Task-bound memory is the task-local slice of the #815 scoped-knowledge
+    -- chain. It mirrors the self-resume continuation envelope shape now; when #815
+    -- lands, this table becomes the task/session scope adapter instead of a parallel
+    -- memory system.
+    CREATE TABLE IF NOT EXISTS task_memories (
+      task_id INTEGER PRIMARY KEY REFERENCES tasks(id) ON DELETE CASCADE,
+      objective TEXT NOT NULL,
+      generation INTEGER NOT NULL DEFAULT 0,
+      ledger TEXT NOT NULL DEFAULT '[]',
+      decisions TEXT NOT NULL DEFAULT '[]',
+      working_state TEXT NOT NULL DEFAULT '',
+      archive_refs TEXT NOT NULL DEFAULT '[]',
+      budget TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS artifact_blobs (
+      digest TEXT PRIMARY KEY,
+      storage_uri TEXT NOT NULL,
+      media_type TEXT NOT NULL,
+      size INTEGER NOT NULL,
+      created_at INTEGER NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS artifacts (
+      id TEXT PRIMARY KEY,
+      blob_digest TEXT NOT NULL REFERENCES artifact_blobs(digest),
+      media_type TEXT NOT NULL,
+      kind TEXT NOT NULL DEFAULT 'other',
+      filename TEXT,
+      size INTEGER NOT NULL,
+      visibility TEXT NOT NULL DEFAULT 'project',
+      sensitivity TEXT NOT NULL DEFAULT 'normal',
+      created_by TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      expires_at INTEGER,
+      pinned INTEGER NOT NULL DEFAULT 0,
+      metadata TEXT NOT NULL DEFAULT '{}'
+    );
+    CREATE INDEX IF NOT EXISTS idx_artifacts_blob ON artifacts(blob_digest);
+    CREATE INDEX IF NOT EXISTS idx_artifacts_created ON artifacts(created_at);
+    CREATE INDEX IF NOT EXISTS idx_artifacts_expires ON artifacts(expires_at);
+    CREATE INDEX IF NOT EXISTS idx_artifacts_created_by ON artifacts(created_by);
+
+    ${ARTIFACT_RETENTION_SCHEMA}
+
+    CREATE TABLE IF NOT EXISTS artifact_links (
+      id TEXT PRIMARY KEY,
+      artifact_id TEXT NOT NULL REFERENCES artifacts(id) ON DELETE CASCADE,
+      entity_type TEXT NOT NULL,
+      entity_id TEXT NOT NULL,
+      role TEXT,
+      title TEXT,
+      created_by TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      UNIQUE (artifact_id, entity_type, entity_id, role)
+    );
+    CREATE INDEX IF NOT EXISTS idx_artifact_links_entity ON artifact_links(entity_type, entity_id);
+    CREATE INDEX IF NOT EXISTS idx_artifact_links_artifact ON artifact_links(artifact_id);
+
+    CREATE TABLE IF NOT EXISTS message_delivery_attempts (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      message_id INTEGER NOT NULL REFERENCES messages(id) ON DELETE CASCADE,
+      agent_id TEXT,
+      action TEXT NOT NULL DEFAULT 'attempt',
+      status TEXT NOT NULL,
+      error TEXT,
+      next_retry_at INTEGER,
+      poison_reason TEXT,
+      created_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_mda_message ON message_delivery_attempts(message_id, created_at DESC); CREATE INDEX IF NOT EXISTS idx_mda_agent_created ON message_delivery_attempts(agent_id, created_at DESC);
+    CREATE TABLE IF NOT EXISTS channel_delivery_releases (
+      message_id INTEGER PRIMARY KEY REFERENCES messages(id) ON DELETE CASCADE
+    );
+
+    CREATE TABLE IF NOT EXISTS config (
+      namespace TEXT NOT NULL,
+      key TEXT NOT NULL,
+      value TEXT NOT NULL,
+      version INTEGER NOT NULL DEFAULT 1,
+      updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_by TEXT,
+      PRIMARY KEY (namespace, key)
+    );
+
+    CREATE TABLE IF NOT EXISTS config_history (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      namespace TEXT NOT NULL,
+      key TEXT NOT NULL,
+      value TEXT NOT NULL,
+      version INTEGER NOT NULL,
+      changed_at TEXT NOT NULL DEFAULT (datetime('now')),
+      changed_by TEXT
+    );
+    CREATE INDEX IF NOT EXISTS idx_config_history_key ON config_history(namespace, key, version);
+
+    ${PROMPT_TEMPLATES_SCHEMA_SQL}
+
+    -- Per-user settings (#391, epic #388). The user dimension the global \`config\` table lacks:
+    -- the same \`(namespace, key)\` descriptor address resolves to a per-user value, keyed by the
+    -- resolved \`users.id\` (#393). \`config\` semantics are untouched — \`tier:"user"\` descriptors
+    -- route here; everything else stays in \`config\`. ON DELETE CASCADE so removing a user drops
+    -- their prefs with them.
+    CREATE TABLE IF NOT EXISTS user_settings (
+      user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      namespace TEXT NOT NULL,
+      key TEXT NOT NULL,
+      value TEXT NOT NULL,
+      version INTEGER NOT NULL DEFAULT 1,
+      updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_by TEXT,
+      PRIMARY KEY (user_id, namespace, key)
+    );
+
+    CREATE TABLE IF NOT EXISTS managed_agent_state (
+      policy_name TEXT PRIMARY KEY,
+      status TEXT NOT NULL,
+      agent_id TEXT,
+      last_agent_id TEXT, -- #1623 retained provenance: last relay-written agent_id, kept when agent_id nulls on stop
+      orchestrator_id TEXT NOT NULL,
+      provider TEXT NOT NULL,
+      tmux_session TEXT,
+      spawn_request_id TEXT,
+      workspace_id TEXT,
+      workspace_path TEXT,
+      workspace_branch TEXT,
+      last_spawn_at INTEGER,
+      last_stop_at INTEGER,
+      healthy_since INTEGER,
+      restart_count INTEGER NOT NULL DEFAULT 0,
+      consecutive_failures INTEGER NOT NULL DEFAULT 0,
+      backoff_until INTEGER,
+      last_error TEXT,
+      updated_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_managed_agent_state_status ON managed_agent_state(status);
+    CREATE INDEX IF NOT EXISTS idx_managed_agent_state_agent ON managed_agent_state(agent_id);
+    CREATE INDEX IF NOT EXISTS idx_managed_agent_state_spawn_request ON managed_agent_state(policy_name, spawn_request_id);
+
+    CREATE TABLE IF NOT EXISTS workspaces (
+      id TEXT PRIMARY KEY,
+      repo_root TEXT NOT NULL,
+      source_cwd TEXT NOT NULL,
+      worktree_path TEXT NOT NULL,
+      branch TEXT,
+      base_ref TEXT,
+      base_sha TEXT,
+      mode TEXT NOT NULL,
+      requested_mode TEXT,
+      status TEXT NOT NULL DEFAULT 'active',
+      land_state TEXT NOT NULL DEFAULT 'no-changes',
+      land_state_at INTEGER,
+      orchestrator_id TEXT,
+      owner_agent_id TEXT,
+      owner_policy_name TEXT,
+      owner_automation_run_id TEXT,
+      steward_agent_id TEXT,
+      metadata TEXT NOT NULL DEFAULT '{}',
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      ready_at INTEGER,
+      cleaned_at INTEGER,
+      landed_at INTEGER,
+      landed_sha TEXT
+    );
+    CREATE INDEX IF NOT EXISTS idx_workspaces_repo_status ON workspaces(repo_root, status);
+    -- idx_workspaces_orchestrator created in applyMigrations() AFTER orchestrator_id ALTER (#949)
+    CREATE INDEX IF NOT EXISTS idx_workspaces_owner_agent ON workspaces(owner_agent_id);
+    CREATE INDEX IF NOT EXISTS idx_workspaces_policy ON workspaces(owner_policy_name);
+
+    -- Durable notification fingerprints for disk-only workspace orphans. The
+    -- reaper removes a row when the orphan disappears, so an unchanged orphan
+    -- is alerted once across Relay restarts while a genuinely new occurrence at
+    -- the same path can alert again.
+    CREATE TABLE IF NOT EXISTS workspace_orphan_alerts (
+      orphan_key TEXT PRIMARY KEY,
+      fingerprint TEXT NOT NULL,
+      alerted_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    );
+
+    -- Durable "has a human already been paged for this exact condition" marker
+    -- for the disk-orphan human-ntfy escalation path (#1525). Deliberately
+    -- independent of workspace_orphan_alerts: that table is pruned whenever a
+    -- key drops out of the live scan for ANY reason, including a transient
+    -- single-repo probe failure — which would otherwise let an already-paged,
+    -- genuinely-stranded orphan re-page once on recovery. Keyed on the full
+    -- escalation idempotency key (condition fingerprint baked in), so a real
+    -- change re-alerts while an unchanged condition never re-sends.
+    CREATE TABLE IF NOT EXISTS workspace_human_escalation_alerts (
+      alert_key TEXT PRIMARY KEY,
+      alerted_at INTEGER NOT NULL
+    );
+
+    -- Persistent per-repo steward record. Keyed to the repo, not a live agent, so
+    -- it survives a full all-agents-offline gap: steward_agent_id goes NULL
+    -- (dormant) while last_steward_agent_id preserves continuity, and the row is
+    -- re-filled when an agent rejoins the repo. This is the durable backing store
+    -- the steward column on workspace rows mirrors for display/maintenance.
+    CREATE TABLE IF NOT EXISTS repo_stewards (
+      repo_root TEXT PRIMARY KEY,
+      steward_agent_id TEXT,
+      last_steward_agent_id TEXT,
+      elected_at INTEGER,
+      updated_at INTEGER NOT NULL
+    );
+
+    -- Per-repo merge serialization lease. Exactly one base merge may be in flight
+    -- per repo; a second merge request is rejected until the holder settles or the
+    -- lease expires. Atomicity comes from the repo_root PRIMARY KEY + expiry guard.
+    CREATE TABLE IF NOT EXISTS workspace_merge_leases (
+      repo_root TEXT PRIMARY KEY,
+      workspace_id TEXT NOT NULL,
+      command_id TEXT,
+      holder TEXT,
+      acquired_at INTEGER NOT NULL,
+      expires_at INTEGER NOT NULL
+    );
+
+    -- Permanent land attribution ledger. Intentionally no foreign keys: agent/workspace
+    -- rows are pruned, while these receipts must remain queryable for the Task lifetime.
+    CREATE TABLE IF NOT EXISTS landing_receipts (
+      id TEXT PRIMARY KEY,
+      project_id TEXT,
+      repo TEXT NOT NULL,
+      ref TEXT NOT NULL,
+      branch TEXT,
+      base_sha TEXT,
+      tip_sha TEXT,
+      commit_shas TEXT NOT NULL CHECK (json_valid(commit_shas) AND json_type(commit_shas) = 'array'),
+      workspace_id TEXT NOT NULL,
+      task_id INTEGER,
+      worker_agent_id TEXT,
+      coordinator_agent_id TEXT,
+      team_id TEXT,
+      orchestrator_id TEXT,
+      host TEXT,
+      landed_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_landing_receipts_repo_tip ON landing_receipts(repo, tip_sha);
+    CREATE INDEX IF NOT EXISTS idx_landing_receipts_repo_landed ON landing_receipts(repo, landed_at);
+    CREATE INDEX IF NOT EXISTS idx_landing_receipts_task ON landing_receipts(task_id) WHERE task_id IS NOT NULL;
+
+    -- #1744 / Phase -1 F1 — "this exact git TREE passed the full land gate", the record that lets
+    -- cd-watcher deploy without waiting for main's redundant ci.yml re-run. Keyed on the TREE (not
+    -- the commit, which the no-ff land re-synthesizes) and on the owner/repo REMOTE slug (not a
+    -- local path, which the landing worktree and the detection clone do not share). See
+    -- db/land-gate-attestations.ts for why both choices are load-bearing and fail-closed.
+    CREATE TABLE IF NOT EXISTS land_gate_attestations (
+      repo TEXT NOT NULL,
+      tree_sha TEXT NOT NULL,
+      commit_sha TEXT NOT NULL,
+      base_ref TEXT NOT NULL,
+      level TEXT NOT NULL CHECK (level IN ('full')),
+      gates_digest TEXT NOT NULL,
+      gate_names TEXT NOT NULL CHECK (json_valid(gate_names) AND json_type(gate_names) = 'array'),
+      gates_ran INTEGER NOT NULL,
+      workspace_id TEXT,
+      attested_at INTEGER NOT NULL,
+      suite_coverage TEXT CHECK (suite_coverage IN ('full', 'partial')),
+      PRIMARY KEY (repo, tree_sha)
+    );
+    CREATE INDEX IF NOT EXISTS idx_land_gate_attestations_attested ON land_gate_attestations(attested_at);
+
+    -- #1355 U3 — per-watch last-observed CI status, so a red/green transition can
+    -- be detected against the PRIOR poll rather than inferred from a single sample.
+    CREATE TABLE IF NOT EXISTS ci_watch_state (
+      watch_key TEXT PRIMARY KEY,
+      provider TEXT NOT NULL,
+      repository TEXT NOT NULL,
+      branch TEXT NOT NULL,
+      workflow TEXT NOT NULL,
+      status TEXT NOT NULL CHECK (status IN ('green', 'failing', 'cancelled', 'pending', 'missing')),
+      head_sha TEXT NOT NULL,
+      observed_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      -- #1609 -- "never observed" visibility. first_seen_at is set once on insert and never
+      -- touched again; has_matched latches true the first time a poll finds a matching run and
+      -- stays true forever after (a watch key is workflow/branch/jobs-specific, so a rename to fix
+      -- a broken watch naturally mints a fresh key/row); never_matched_notified_at is the
+      -- fire-once guard for the one-time never-matched signal.
+      first_seen_at INTEGER NOT NULL DEFAULT 0,
+      has_matched INTEGER NOT NULL DEFAULT 0,
+      never_matched_notified_at INTEGER,
+      -- #3004 -- fire-once guard for "selected jobs not found in a finished run" (a watch config problem).
+      config_mismatch_notified_at INTEGER,
+      -- #3004 -- set on every row of a repository while its checkout/CI config is missing; any
+      -- later observation clears it, so the notice fires once per outage.
+      root_missing_notified_at INTEGER
+    );
+    CREATE INDEX IF NOT EXISTS idx_ci_watch_state_repo ON ci_watch_state(repository, branch, workflow);
+
+    -- #3370 — immutable main-CI gate history: one row per finished run attempt, apart from the per-commit readiness cache (ci_sha_observations).
+    CREATE TABLE IF NOT EXISTS ci_gate_runs (
+      watch_key TEXT NOT NULL, run_id TEXT NOT NULL, attempt INTEGER NOT NULL, head_sha TEXT NOT NULL,
+      status TEXT NOT NULL CHECK (status IN ('green', 'failing', 'cancelled')), run_url TEXT, failing_json TEXT, created_at INTEGER, started_at INTEGER, settled_at INTEGER NOT NULL,
+      PRIMARY KEY (watch_key, run_id, attempt)
+    );
+    CREATE INDEX IF NOT EXISTS idx_ci_gate_runs_settled ON ci_gate_runs(settled_at);
+
+    -- #1355 U3 — durable CI incident lifecycle. No foreign keys: watch state and
+    -- coordinator/agent rows may churn or get pruned while an incident's history
+    -- must remain queryable. The two partial unique indexes below ARE the lease:
+    -- SQLite rejects a second non-resolved row for the same watch (or the same
+    -- watch+fingerprint pair), so "one active incident per watch/fingerprint" is
+    -- enforced by the engine itself, not by application-level locking.
+    CREATE TABLE IF NOT EXISTS ci_incidents (
+      id TEXT PRIMARY KEY,
+      watch_key TEXT NOT NULL,
+      provider TEXT NOT NULL,
+      repository TEXT NOT NULL,
+      branch TEXT NOT NULL,
+      workflow TEXT NOT NULL,
+      fingerprint TEXT NOT NULL,
+      state TEXT NOT NULL CHECK (state IN ('detected', 'attributed', 'notified', 'steward_attempting', 'escalated', 'resolved')),
+      attempt INTEGER NOT NULL DEFAULT 0 CHECK (attempt >= 0),
+      opened_at INTEGER NOT NULL,
+      opened_head_sha TEXT NOT NULL,
+      opened_conclusion TEXT,
+      coordinator_agent_id TEXT,
+      escalated_at INTEGER,
+      escalation_reason TEXT,
+      resolved_at INTEGER,
+      resolved_head_sha TEXT,
+      resolution TEXT,
+      lease_owner TEXT,
+      lease_token TEXT,
+      lease_acquired_at INTEGER,
+      lease_expires_at INTEGER,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      CHECK ((state = 'resolved') = (resolved_at IS NOT NULL)),
+      CHECK (
+        (lease_owner IS NULL AND lease_token IS NULL AND lease_acquired_at IS NULL AND lease_expires_at IS NULL)
+        OR
+        (lease_owner IS NOT NULL AND lease_token IS NOT NULL AND lease_acquired_at IS NOT NULL AND lease_expires_at > lease_acquired_at)
+      )
+    );
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_ci_incidents_active_watch ON ci_incidents(watch_key) WHERE state != 'resolved';
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_ci_incidents_active_fingerprint ON ci_incidents(watch_key, fingerprint) WHERE state != 'resolved';
+    CREATE INDEX IF NOT EXISTS idx_ci_incidents_repo ON ci_incidents(repository, branch, workflow, state);
+    CREATE INDEX IF NOT EXISTS idx_ci_incidents_lease ON ci_incidents(state, lease_expires_at) WHERE lease_owner IS NOT NULL;
+
+    CREATE TABLE IF NOT EXISTS tasks (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      source TEXT NOT NULL,
+      title TEXT NOT NULL,
+      body TEXT NOT NULL,
+      severity TEXT NOT NULL,
+      status TEXT NOT NULL,
+      target TEXT NOT NULL,
+      channel TEXT,
+      dedupe_key TEXT,
+      external_url TEXT,
+      occurrence_count INTEGER NOT NULL DEFAULT 1,
+      claimed_by TEXT,
+      claimed_at INTEGER,
+      claim_expires_at INTEGER,
+      message_id INTEGER REFERENCES messages(id) ON DELETE SET NULL,
+      result TEXT,
+      metadata TEXT NOT NULL DEFAULT '{}',
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      last_seen_at INTEGER NOT NULL,
+      -- #834 durable-Task facet. kind='claim' (default) is the historical claimable
+      -- work-item lane; kind='deliverable' is the durable coordination Task. The claim-
+      -- lease machinery is fenced to kind='claim' (see claimTaskWhere in task-core.ts).
+      kind TEXT NOT NULL DEFAULT 'claim',
+      intent TEXT,
+      complexity TEXT,
+      context TEXT,
+      latest_steer TEXT,
+      deliverable_stage TEXT NOT NULL DEFAULT 'none',
+      blocked_by TEXT,
+      branch TEXT,
+      commits TEXT,
+      done_when TEXT,
+      team_id TEXT,
+      project_id TEXT,
+      repo TEXT,
+      created_by TEXT,
+      owner_agent_id TEXT,
+      owner_agent_label TEXT,
+      dispatch TEXT,
+      reaped_at INTEGER,
+      -- #1535 WS2 — tags[] (JSON array of strings) + priority (backlog-triage axis,
+      -- distinct from severity). Both optional; absent on claim-kind rows.
+      tags TEXT,
+      priority TEXT,
+      -- #1535 WS1 — parent/epic tree edge: a task has at most one parent. Cycle-guarded
+      -- in application code (src/db/task-entity.ts setTaskParent), the same way as the
+      -- depends-on DAG below (#834 finding 7) — SQLite CHECK can't express acyclicity.
+      parent_task_id INTEGER REFERENCES tasks(id) ON DELETE SET NULL,
+      -- #1535 WS3 — backlog lifecycle axis (backlog|promoted), distinct from the execution
+      -- status FSM. NULL = not backlog-managed. Promote-to-dispatch flips it backlog->promoted
+      -- (src/services/backlog.ts). The prioritized backlog query is a project-scoped view over
+      -- backlog_state='backlog' rows (src/db/backlog.ts). Its index is created in applyMigrations()
+      -- AFTER the ALTER (see idx_tasks_priority note below), never inline here.
+      backlog_state TEXT,
+      -- #2518 — coordinator review-hold: while 1, a 'complete' delivery is accepted and
+      -- gate-validated but does NOT arm a land (no ingress); the coordinator's clear (CAS on
+      -- the held delivery's host-probed HEAD) promotes that exact delivery. Distinct from the
+      -- permanent workspace landBlocked. Default 0 keeps every pre-#2518 Task unheld.
+      validation_items TEXT, terminal_stage TEXT, completed_at INTEGER,
+      review_hold INTEGER NOT NULL DEFAULT 0 CHECK (review_hold IN (0, 1)),
+      -- #2862 durable owner: a coordinator role (coordinator:TEAM) or a human id, never an agent id.
+      owner TEXT
+    );
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_tasks_source_dedupe ON tasks(source, dedupe_key) WHERE dedupe_key IS NOT NULL AND status NOT IN ('done', 'failed', 'canceled');
+    CREATE INDEX IF NOT EXISTS idx_tasks_status ON tasks(status);
+    CREATE INDEX IF NOT EXISTS idx_tasks_target ON tasks(target);
+    CREATE INDEX IF NOT EXISTS idx_tasks_updated ON tasks(updated_at);
+    CREATE INDEX IF NOT EXISTS idx_tasks_message_status
+      ON tasks(message_id, status)
+      WHERE message_id IS NOT NULL;
+    -- idx_tasks_kind / idx_tasks_branch / idx_tasks_team / idx_tasks_priority / idx_tasks_parent
+    -- reference columns added after the base table shipped and are created in applyMigrations()
+    -- AFTER the ALTERs — never inline here: an existing pre-#834 tasks table makes CREATE TABLE
+    -- IF NOT EXISTS a no-op, so an inline index over a column it doesn't yet have crashes initDb
+    -- (same hazard as idx_projects_scope_anchor above).
+
+    -- #834 task→task dependency DAG (the edges the plan DAG collapses into; #835).
+    -- Cycle-rejected transactionally on insert (src/db/task-entity.ts).
+    CREATE TABLE IF NOT EXISTS task_dependencies (
+      task_id INTEGER NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+      depends_on_task_id INTEGER NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+      created_at INTEGER NOT NULL,
+      required_stage TEXT CHECK (required_stage IN ('landed-on-main','deployed')),
+      PRIMARY KEY (task_id, depends_on_task_id)
+    );
+    CREATE INDEX IF NOT EXISTS idx_task_dependencies_depended ON task_dependencies(depends_on_task_id);
+
+    -- #1535 WS1 — soft "related" association: symmetric and non-blocking (unlike the
+    -- depends-on DAG above, it carries no ordering/gating semantics). A single canonical
+    -- row (task_a_id < task_b_id, enforced by the CHECK) represents the undirected edge,
+    -- so both directions read it back identically and add/remove from either side is the
+    -- same write (src/db/task-entity.ts). This is a wholly NEW table, so — unlike the
+    -- tasks columns above — it needs no ALTER-based migration: CREATE TABLE IF NOT EXISTS
+    -- is safe verbatim on every pre-existing DB (there is no earlier shape to collide with).
+    CREATE TABLE IF NOT EXISTS task_relations (
+      task_a_id INTEGER NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+      task_b_id INTEGER NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+      created_at INTEGER NOT NULL,
+      PRIMARY KEY (task_a_id, task_b_id),
+      CHECK (task_a_id < task_b_id)
+    );
+    CREATE INDEX IF NOT EXISTS idx_task_relations_b ON task_relations(task_b_id);
+
+    -- #833 comment-through idempotency outbox: reserve→post→finalize so a Task comment
+    -- written THROUGH to GitHub is concurrency- and crash-safe (UNIQUE claim before the
+    -- adapter append; receipt only after it succeeds). Logic in src/db/task-comment-through.ts.
+    CREATE TABLE IF NOT EXISTS task_comment_throughs (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      task_id INTEGER NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+      kind TEXT NOT NULL,
+      idempotency_key TEXT NOT NULL,
+      status TEXT NOT NULL,
+      event_id INTEGER,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      UNIQUE (task_id, kind, idempotency_key)
+    );
+
+    CREATE TABLE IF NOT EXISTS automations (
+      id TEXT PRIMARY KEY,
+      kind TEXT NOT NULL,
+      name TEXT NOT NULL,
+      description TEXT,
+      enabled INTEGER NOT NULL DEFAULT 1,
+      schedule TEXT NOT NULL,
+      timezone TEXT NOT NULL,
+      next_run_at INTEGER,
+      catch_up_policy TEXT NOT NULL,
+      concurrency_policy TEXT NOT NULL,
+      orchestrator_id TEXT NOT NULL,
+      target_policy TEXT NOT NULL,
+      task_template TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_automations_enabled_next_run ON automations(enabled, next_run_at);
+
+    CREATE TABLE IF NOT EXISTS automation_runs (
+      id TEXT PRIMARY KEY,
+      automation_id TEXT NOT NULL,
+      status TEXT NOT NULL,
+      scheduled_for INTEGER NOT NULL,
+      started_at INTEGER,
+      finished_at INTEGER,
+      orchestrator_id TEXT NOT NULL,
+      target_agent_id TEXT,
+      spawned_agent_id TEXT,
+      task_id INTEGER,
+      message_id INTEGER,
+      control_message_id INTEGER,
+      error TEXT,
+      result TEXT,
+      meta TEXT NOT NULL DEFAULT '{}',
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      shutdown_requested_at INTEGER
+    );
+    CREATE INDEX IF NOT EXISTS idx_automation_runs_automation ON automation_runs(automation_id, created_at);
+    CREATE INDEX IF NOT EXISTS idx_automation_runs_status ON automation_runs(status);
+    CREATE INDEX IF NOT EXISTS idx_automation_runs_task ON automation_runs(task_id);
+
+    CREATE TABLE IF NOT EXISTS task_events (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      task_id INTEGER NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+      source TEXT NOT NULL,
+      type TEXT NOT NULL,
+      severity TEXT NOT NULL,
+      title TEXT NOT NULL,
+      body TEXT NOT NULL,
+      metadata TEXT NOT NULL DEFAULT '{}',
+      created_at INTEGER NOT NULL
+    );
+
+    -- #834 — supports the deterministic latest-per-gate projection (type LIKE 'gate:%')
+    -- and append-history reads. The audit ledger stays append-only; this is just the index.
+    CREATE INDEX IF NOT EXISTS idx_task_events_task_type ON task_events(task_id, type, id DESC);
+    -- #2805 — steward re-key coordinator-notice outbox: only undelivered notices are indexed.
+    CREATE INDEX IF NOT EXISTS idx_task_events_rekey_notice_pending ON task_events(id)
+      WHERE type = 'workspace.steward-rekey' AND json_extract(metadata, '$.noticePending') = 1;
+
+    -- #1275 — deploy-level truth. Per-orchestrator activity remains an audit trail;
+    -- this row is the all-or-nothing result used to stamp landed Tasks.
+    CREATE TABLE IF NOT EXISTS deploy_events (
+      id TEXT PRIMARY KEY,
+      commit_sha TEXT NOT NULL,
+      version TEXT,
+      hosts TEXT NOT NULL,
+      status TEXT NOT NULL CHECK (status IN ('pending', 'succeeded', 'failed', 'rolled-back')),
+      initiated_by TEXT NOT NULL,
+      started_at INTEGER NOT NULL, lease_renewed_at INTEGER,
+      finished_at INTEGER,
+      -- #1327 — the fleet's prior successful SHA at the time this deploy was opened, so
+      -- "what changed" (git log previous_sha..commit_sha) survives past latestSuccessfulDeploy()
+      -- moving on to this row once it completes. Null for the first-ever deploy.
+      previous_sha TEXT,
+      -- #1799 — CD computes task/commit attribution off-thread and persists this immutable
+      -- range-keyed cache. HTTP readers must never invoke git or re-evaluate Tasks.
+      changes_summary TEXT,
+      -- #2105 — opaque serialized identity of the DRIVER PROCESS holding this pending row's
+      -- fleet lease (src/deploy-executor.ts). Executor liveness, not the 2h lease TTL, is what
+      -- lets a stranded row be reclaimed in minutes. Null until the driver records it.
+      executor TEXT
+    );
+    CREATE INDEX IF NOT EXISTS idx_deploy_events_commit ON deploy_events(commit_sha, started_at DESC);
+    -- A pending event is the fleet-wide deploy lease. This partial uniqueness
+    -- makes check-and-acquire atomic across watcher/release processes.
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_deploy_events_single_pending ON deploy_events(status) WHERE status = 'pending';
+
+    CREATE TABLE IF NOT EXISTS task_callback_deliveries (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      task_id INTEGER NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+      url TEXT NOT NULL,
+      event_type TEXT NOT NULL,
+      payload TEXT NOT NULL,
+      status TEXT NOT NULL,
+      attempts INTEGER NOT NULL DEFAULT 0,
+      last_error TEXT,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS pairs (
+      id TEXT PRIMARY KEY,
+      requester_id TEXT NOT NULL,
+      target_id TEXT NOT NULL,
+      status TEXT NOT NULL,
+      objective TEXT,
+      meta TEXT NOT NULL DEFAULT '{}',
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      expires_at INTEGER NOT NULL,
+      accepted_at INTEGER,
+      ended_at INTEGER,
+      ended_by TEXT,
+      last_message_at INTEGER
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_pairs_requester ON pairs(requester_id);
+    CREATE INDEX IF NOT EXISTS idx_pairs_target ON pairs(target_id);
+    CREATE INDEX IF NOT EXISTS idx_pairs_status ON pairs(status);
+
+    CREATE TABLE IF NOT EXISTS inbox_thread_state (
+      operator_id TEXT NOT NULL,
+      peer_id TEXT NOT NULL,
+      read_cursor_message_id INTEGER,
+      archived_at_message_id INTEGER,
+      updated_at INTEGER NOT NULL,
+      PRIMARY KEY (operator_id, peer_id)
+    );
+    CREATE INDEX IF NOT EXISTS idx_inbox_thread_operator ON inbox_thread_state(operator_id);
+
+    CREATE TABLE IF NOT EXISTS inbox_drafts (
+      operator_id TEXT NOT NULL,
+      peer_id TEXT NOT NULL,
+      body TEXT NOT NULL,
+      subject TEXT,
+      channel TEXT,
+      updated_at INTEGER NOT NULL,
+      PRIMARY KEY (operator_id, peer_id)
+    );
+    CREATE INDEX IF NOT EXISTS idx_inbox_drafts_operator ON inbox_drafts(operator_id);
+
+    CREATE TABLE IF NOT EXISTS chat_history_imports (
+      id TEXT PRIMARY KEY,
+      target_agent_id TEXT,
+      target_spawn_request_id TEXT,
+      source_peer_id TEXT NOT NULL,
+      source_agent_id TEXT,
+      source_thread_id TEXT,
+      source_agent_label TEXT,
+      imported_by TEXT NOT NULL,
+      imported_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_chat_history_imports_target_agent ON chat_history_imports(target_agent_id, imported_at);
+    CREATE INDEX IF NOT EXISTS idx_chat_history_imports_target_spawn ON chat_history_imports(target_spawn_request_id, imported_at);
+
+    CREATE TABLE IF NOT EXISTS chat_history_import_entries (
+      import_id TEXT NOT NULL REFERENCES chat_history_imports(id) ON DELETE CASCADE,
+      position INTEGER NOT NULL,
+      original_message_id INTEGER NOT NULL,
+      original_from TEXT NOT NULL,
+      original_to TEXT NOT NULL,
+      original_created_at INTEGER NOT NULL,
+      message_snapshot TEXT NOT NULL,
+      PRIMARY KEY (import_id, position)
+    );
+    CREATE INDEX IF NOT EXISTS idx_chat_history_import_entries_import ON chat_history_import_entries(import_id, position);
+
+    CREATE TABLE IF NOT EXISTS activity_events (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      operator_id TEXT,
+      client_id TEXT UNIQUE,
+      kind TEXT NOT NULL,
+      title TEXT NOT NULL,
+      body TEXT,
+      meta_text TEXT,
+      icon TEXT,
+      view TEXT,
+      peer_id TEXT,
+      message_id INTEGER,
+      pair_id TEXT,
+      task_id INTEGER,
+      agent_id TEXT, issue_ref_id TEXT, issue_action TEXT,
+      metadata TEXT NOT NULL DEFAULT '{}',
+      created_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_activity_operator ON activity_events(operator_id, created_at);
+    CREATE INDEX IF NOT EXISTS idx_activity_created ON activity_events(created_at);
+    CREATE INDEX IF NOT EXISTS idx_activity_agent ON activity_events(agent_id, created_at); CREATE INDEX IF NOT EXISTS idx_activity_policy_created ON activity_events(json_extract(metadata, '$.policyName'), created_at DESC, id DESC);
+    CREATE INDEX IF NOT EXISTS idx_activity_registered_spawn_request
+      ON activity_events(json_extract(metadata, '$.spawnRequestId'))
+      WHERE kind = 'state' AND title = 'Agent registered';
+    -- issue_ref_id/issue_action indexes are created in applyMigrations() AFTER the ALTER — never inline here (#483: inline index over a not-yet-migrated column crashes initDb on existing DBs).
+
+    CREATE TABLE IF NOT EXISTS channels (
+      id TEXT PRIMARY KEY,
+      provider TEXT NOT NULL,
+      account_id TEXT NOT NULL,
+      display_name TEXT NOT NULL,
+      agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+      transport TEXT NOT NULL,
+      direction TEXT NOT NULL DEFAULT 'bidirectional',
+      topic_channels TEXT NOT NULL DEFAULT '[]',
+      capabilities TEXT NOT NULL DEFAULT '[]',
+      meta TEXT NOT NULL DEFAULT '{}',
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_channels_agent ON channels(agent_id);
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_channels_provider_account ON channels(provider, account_id);
+
+    CREATE TABLE IF NOT EXISTS channel_bindings (
+      id TEXT PRIMARY KEY,
+      channel_id TEXT NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
+      conversation_key TEXT NOT NULL DEFAULT '',
+      conversation_id TEXT,
+      target_type TEXT NOT NULL,
+      target_id TEXT NOT NULL,
+      mode TEXT NOT NULL DEFAULT 'exclusive',
+      priority INTEGER NOT NULL DEFAULT 0,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_channel_bindings_channel ON channel_bindings(channel_id, priority);
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_channel_bindings_target ON channel_bindings(channel_id, conversation_key, target_type, target_id);
+
+    CREATE TABLE IF NOT EXISTS orchestrators (
+      id TEXT PRIMARY KEY,
+      hostname TEXT NOT NULL,
+      status TEXT NOT NULL DEFAULT 'online',
+      agent_id TEXT NOT NULL,
+      providers TEXT NOT NULL DEFAULT '[]',
+      base_dir TEXT NOT NULL,
+      env_keys TEXT NOT NULL DEFAULT '[]',
+      meta TEXT NOT NULL DEFAULT '{}',
+      managed_agents TEXT NOT NULL DEFAULT '[]',
+      queued_spawns TEXT NOT NULL DEFAULT '[]',
+      host_id TEXT REFERENCES hosts(id),
+      -- ADR 0002 §4.3.1 (U3) — the PER-GENERATION half of the latest utilization sample. The
+      -- machine-wide half goes to hosts.utilization; these eight fields describe a process
+      -- generation, and a single overwritten Host column cannot express "∃ a generation that
+      -- admits" or max(sampleCount) across a rolling upgrade. One row per generation can.
+      utilization TEXT,
+      last_seen INTEGER NOT NULL,
+      created_at INTEGER NOT NULL
+    );
+    -- idx_orchestrators_host is created in applyMigrations() AFTER the host_id ALTER (#963) — never
+    -- inline here: this whole DDL block runs on EVERY boot (CREATE TABLE IF NOT EXISTS is a no-op
+    -- on an existing table), so an existing pre-H2 DB would still be missing host_id at this point
+    -- and an inline index over it would crash initDb (#483's exact hazard).
+
+    -- ADR 0002 (#1925) H2 — the Host registry. anchor_name is the IMMUTABLE partition key
+    -- (§3.2.3), set once at creation and never rewritten by a label change or alias removal; only
+    -- label is the mutable operator-facing name. SQLite allows the orchestrators.host_id
+    -- REFERENCES clause above to forward-reference this table (FK targets aren't resolved until
+    -- DML, not DDL), so declaration order here is documentation, not a dependency.
+    CREATE TABLE IF NOT EXISTS hosts (
+      id            TEXT PRIMARY KEY,
+      label         TEXT NOT NULL,
+      anchor_name   TEXT NOT NULL,
+      enabled       INTEGER NOT NULL DEFAULT 1,
+      hardware      TEXT NOT NULL DEFAULT '{}',
+      -- The latest real report is held separately from the accepted fingerprint. A conflict keeps
+      -- the hardware fingerprint first-seen until an operator accepts this current report (#1977).
+      reported_hardware TEXT,
+      tags          TEXT NOT NULL DEFAULT '[]',
+      system_tags   TEXT NOT NULL DEFAULT '[]',
+      policy        TEXT NOT NULL DEFAULT '{}',
+      utilization   TEXT,
+      first_seen_at INTEGER NOT NULL,
+      last_seen_at  INTEGER NOT NULL,
+      created_at    INTEGER NOT NULL
+    );
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_hosts_label ON hosts(label);
+
+    -- §3.2 alias set — the identity primitive. alias is normalizeHostToken(raw); resolved via
+    -- src/host/identity.ts's process-local memo, never a per-call query on the hot path.
+    CREATE TABLE IF NOT EXISTS host_aliases (
+      alias    TEXT PRIMARY KEY,
+      host_id  TEXT NOT NULL REFERENCES hosts(id) ON DELETE CASCADE,
+      source   TEXT NOT NULL,
+      added_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_host_aliases_host ON host_aliases(host_id);
+
+    -- §3.8 — the backfill alias audit, H4's gate. One row per agents.machine spelling that never
+    -- resolved against host_aliases; the operator binds it (host alias add) or marks it dead.
+    -- H4 (the fuzzy-matching strangler) may not land while any row here is still 'unresolved'.
+    CREATE TABLE IF NOT EXISTS host_alias_audit (
+      spelling    TEXT PRIMARY KEY,
+      status      TEXT NOT NULL DEFAULT 'unresolved',
+      detected_at INTEGER NOT NULL,
+      resolved_at INTEGER
+    );
+
+    CREATE TABLE IF NOT EXISTS bus_outbox (
+      seq INTEGER PRIMARY KEY AUTOINCREMENT,
+      event_type TEXT NOT NULL,
+      source TEXT NOT NULL,
+      subject TEXT,
+      data TEXT NOT NULL,
+      timestamp INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_outbox_type ON bus_outbox(event_type);
+    CREATE INDEX IF NOT EXISTS idx_outbox_timestamp ON bus_outbox(timestamp);
+
+    CREATE TABLE IF NOT EXISTS commands (
+      id TEXT PRIMARY KEY,
+      type TEXT NOT NULL,
+      source TEXT NOT NULL,
+      target TEXT NOT NULL,
+      params TEXT NOT NULL DEFAULT '{}',
+      status TEXT NOT NULL DEFAULT 'pending',
+      result TEXT,
+      error TEXT,
+      correlation_id TEXT, claim_owner_token TEXT, agent_profile_hash TEXT,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      expires_at INTEGER
+    );
+    CREATE INDEX IF NOT EXISTS idx_commands_target ON commands(target); CREATE INDEX IF NOT EXISTS idx_commands_target_updated ON commands(target, updated_at DESC, created_at DESC);
+    CREATE INDEX IF NOT EXISTS idx_commands_status ON commands(status);
+    CREATE INDEX IF NOT EXISTS idx_commands_created ON commands(created_at);
+    CREATE INDEX IF NOT EXISTS idx_commands_correlation ON commands(correlation_id);
+    CREATE INDEX IF NOT EXISTS idx_commands_spawn_watchdog ON commands(type, status, updated_at);
+    -- T4060 (#2289): the scheduler-restart reconcile's awaiting-wake scan predicates on
+    -- target + error over failed scheduler.commands; the partial index keeps every
+    -- 30s orchestrator heartbeat off a full per-target row visit (was 67-233ms on-loop).
+    CREATE INDEX IF NOT EXISTS idx_commands_scheduler_recovery ON commands(target, error) WHERE type = 'scheduler.command' AND status = 'failed';
+    ${CLAUDE_API_BUDGET_SCHEMA}
+    ${AGENT_EXIT_REPORT_SCHEMA};
+    ${BROWSER_SESSIONS_SCHEMA_SQL};
+    ${CONTEXT_RESET_SCHEMA};
+    ${COORDINATOR_DIGEST_SCHEMA_SQL};
+    ${PLAN_DISPATCH_SCHEMA_SQL};
+    ${PLAN_IMPORT_SCHEMA_SQL};
+    ${IDLE_DIGEST_SCHEMA_SQL};
+    ${TASK_TOKEN_TOTALS_SCHEMA};
+    ${LONG_RUNNING_WORK_SCHEMA};
+    ${SHIPPING_STATS_SCHEMA};
+    ${OPERATOR_ACTIONS_SCHEMA};
+    ${SELF_EFFORT_PERMISSIONS_SCHEMA};
+    ${AGENT_EFFORT_STATE_SCHEMA};
+
+    CREATE TABLE IF NOT EXISTS recipe_instances (
+      id TEXT PRIMARY KEY,
+      recipe_name TEXT NOT NULL,
+      recipe_source TEXT NOT NULL,
+      cwd TEXT NOT NULL,
+      orchestrator_id TEXT NOT NULL,
+      status TEXT NOT NULL,
+      started_by TEXT NOT NULL,
+      error TEXT,
+      started_at INTEGER NOT NULL,
+      stopped_at INTEGER
+    );
+    CREATE TABLE IF NOT EXISTS recipe_agent_instances (
+      instance_id TEXT NOT NULL REFERENCES recipe_instances(id) ON DELETE CASCADE,
+      role TEXT NOT NULL,
+      agent_id TEXT NOT NULL,
+      provider TEXT NOT NULL,
+      status TEXT NOT NULL,
+      idx INTEGER,
+      PRIMARY KEY (instance_id, role, agent_id)
+    );
+    CREATE INDEX IF NOT EXISTS idx_recipe_instances_status ON recipe_instances(status);
+
+    CREATE TABLE IF NOT EXISTS tokens (
+      jti TEXT PRIMARY KEY,
+      sub TEXT NOT NULL,
+      role TEXT NOT NULL,
+      scope TEXT NOT NULL,
+      profile_id TEXT,
+      issued_at INTEGER NOT NULL,
+      expires_at INTEGER,
+      revoked_at INTEGER,
+      revoked_reason TEXT,
+      created_by TEXT
+    );
+
+    CREATE TABLE IF NOT EXISTS token_profiles (
+      id TEXT PRIMARY KEY,
+      name TEXT NOT NULL,
+      description TEXT,
+      role TEXT NOT NULL,
+      scope TEXT NOT NULL,
+      constraints TEXT,
+      ttl_seconds INTEGER,
+      built_in INTEGER NOT NULL DEFAULT 0,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      created_by TEXT
+    );
+
+    CREATE TABLE IF NOT EXISTS maintenance_jobs (
+      id TEXT PRIMARY KEY,
+      title TEXT NOT NULL,
+      description TEXT,
+      interval_ms INTEGER NOT NULL,
+      timeout_ms INTEGER NOT NULL,
+      enabled INTEGER NOT NULL DEFAULT 1,
+      -- #1645 — cached from the job DEFINITION's required critical flag on every reconcile.
+      -- Declared in code (src/maintenance/jobs.ts) and merely mirrored here so the health check in
+      -- src/db/stats.ts can evaluate criticality in SQL without the db layer importing the
+      -- maintenance layer (which imports db - that way lies a cycle).
+      critical INTEGER NOT NULL DEFAULT 0,
+      run_on_start INTEGER NOT NULL DEFAULT 0,
+      last_run_at INTEGER,
+      next_run_at INTEGER,
+      last_duration_ms INTEGER,
+      -- #1725 P1 -- measured synchronous block time (loop occupancy), distinct from wall-clock last_duration_ms; the number the breaker attributes a freeze on. NULL until the first run.
+      last_block_ms INTEGER,
+      last_status TEXT NOT NULL DEFAULT 'idle',
+      last_error TEXT,
+      last_result TEXT,
+      consecutive_failures INTEGER NOT NULL DEFAULT 0,
+      lease_owner TEXT,
+      lease_until INTEGER,
+      -- #2317 — fenced identity and progress heartbeat for a live maintenance run. A stale lease
+      -- alone is never evidence that the work stopped.
+      run_token TEXT,
+      last_progress_at INTEGER,
+      updated_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_maintenance_jobs_next_run ON maintenance_jobs(enabled, next_run_at);
+
+    CREATE TABLE IF NOT EXISTS provider_model_overrides (
+      provider TEXT NOT NULL,
+      alias TEXT NOT NULL,
+      entry TEXT NOT NULL DEFAULT '{}',
+      deleted INTEGER NOT NULL DEFAULT 0, disabled INTEGER NOT NULL DEFAULT 0,
+      updated_at INTEGER NOT NULL,
+      updated_by TEXT,
+      PRIMARY KEY (provider, alias)
+    );
+    CREATE INDEX IF NOT EXISTS idx_provider_model_overrides_provider ON provider_model_overrides(provider);
+
+    CREATE TABLE IF NOT EXISTS provider_model_defaults (
+      provider TEXT PRIMARY KEY,
+      alias TEXT NOT NULL,
+      updated_at INTEGER NOT NULL,
+      updated_by TEXT
+    );
+
+    CREATE TABLE IF NOT EXISTS integration_registry (
+      name TEXT PRIMARY KEY,
+      display_name TEXT,
+      description TEXT,
+      enabled INTEGER NOT NULL DEFAULT 1,
+      scopes TEXT NOT NULL DEFAULT '[]',
+      targets TEXT NOT NULL DEFAULT '[]',
+      channels TEXT NOT NULL DEFAULT '[]',
+      type TEXT,
+      icon TEXT,
+      accent_color TEXT,
+      tags TEXT NOT NULL DEFAULT '[]',
+      homepage_url TEXT,
+      repository_url TEXT,
+      docs_url TEXT,
+      manifest TEXT NOT NULL DEFAULT '{}',
+      source TEXT NOT NULL DEFAULT 'api',
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      last_event_at INTEGER,
+      last_task_at INTEGER,
+      last_auth_success_at INTEGER,
+      last_auth_failure_at INTEGER
+    );
+
+    CREATE TABLE IF NOT EXISTS insights_observations (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      session_id TEXT NOT NULL,
+      agent_id TEXT,
+      project TEXT NOT NULL DEFAULT 'unknown',
+      signal TEXT NOT NULL,
+      value TEXT NOT NULL DEFAULT '{}',
+      outcome TEXT,
+      source TEXT NOT NULL DEFAULT 'server',
+      created_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_insights_obs_project_signal ON insights_observations(project, signal, created_at DESC);
+    CREATE INDEX IF NOT EXISTS idx_insights_obs_signal ON insights_observations(signal, created_at DESC);
+    CREATE INDEX IF NOT EXISTS idx_insights_obs_session ON insights_observations(session_id);
+
+    -- Relay-owned provisioning registry (#554/#555/#556/#694): capabilities are
+    -- profile-facing slugs; provisioning_assets are materializable variants.
+    CREATE TABLE IF NOT EXISTS provisioning_capabilities (
+      id TEXT PRIMARY KEY,
+      slug TEXT NOT NULL,
+      kind TEXT NOT NULL,
+      title TEXT,
+      description TEXT,
+      status TEXT NOT NULL DEFAULT 'active',
+      tenant_id TEXT,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      UNIQUE(kind, slug)
+    );
+    CREATE INDEX IF NOT EXISTS idx_provisioning_capabilities_kind ON provisioning_capabilities(kind, status);
+
+    CREATE TABLE IF NOT EXISTS provisioning_assets (
+      id TEXT PRIMARY KEY,
+      kind TEXT NOT NULL,
+      name TEXT NOT NULL,
+      provider TEXT NOT NULL DEFAULT 'any',
+      definition TEXT NOT NULL,
+      enabled INTEGER NOT NULL DEFAULT 1,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      UNIQUE(kind, name, provider)
+    );
+
+    -- #1963 N8 (G3) — relay-side per-(profile, repo, capability) trust-review approvals. repo_key
+    -- is the registered Project id when the spawn cwd resolves to one, else the resolved cwd itself
+    -- (an unregistered repo still gets a stable, cwd-scoped approval rather than being unbindable).
+    -- approved_value is a sha256:<hex> fingerprint or a commit:<sha>, matching review_mode.
+    CREATE TABLE IF NOT EXISTS project_trust_approvals (
+      id TEXT PRIMARY KEY,
+      profile_name TEXT NOT NULL,
+      repo_key TEXT NOT NULL,
+      capability TEXT NOT NULL,
+      review_mode TEXT NOT NULL,
+      approved_value TEXT NOT NULL,
+      approved_by TEXT NOT NULL,
+      approved_at INTEGER NOT NULL,
+      UNIQUE(profile_name, repo_key, capability)
+    );
+  `);
+
+  getDb().run(AGENT_IDENTITY_ARCHIVE_SCHEMA);
+  finishCatalog();
+  migrateApiBudgets();
+  timeStartupPhase("db.archive-search", dropLegacyContinuationArchiveIndex);
+  ensureLandingPhaseOneSchema();
+  // Vault catalog, environments and metadata upgrades share applyMigrations (#3561, #3562).
+  timeStartupPhase("db.migrations", applyMigrations);
+  timeStartupPhase("db.prompt-seed", seedPromptTemplatesIfNeeded);
+  timeStartupPhase("db.token-profile-seed", seedBuiltInTokenProfiles);
+
+  timeStartupPhase("db.planner-statistics", () => refreshPlannerStats(getDb()));
+
+  // S3 L2 (#1891): seed the SSE live-fanout head to this generation's committed outbox head (see
+  // sse-outbox-cursor.ts — historical rows are safe as the replay ceiling; a :memory: reset drops a
+  // stale-high head). Read inline (no bus-outbox import → no schema-bootstrap cycle).
+  resetFannedSeq((getDb().query("SELECT coalesce(max(seq), 0) AS h FROM bus_outbox").get() as { h: number }).h);
+
+  resetMainConnectionWrites();
+  conn.run(`PRAGMA busy_timeout = ${CONNECTION_BUSY_TIMEOUT_MS}`);
+  return conn;
+}