@open-everywhere/core 0.1.0

package/dist/agent/operational/postgres.js

@@ -0,0 +1,4052 @@
+// The Postgres half of the OperationalStore seam, over the same small PgClient port the memory store uses; sqlite.ts is the twin and the schema is ported from it verbatim. Every query filters by org_id.
+// The append-only tables (audit_entry, usage_events, domain_skill_revisions, routine_prompt_revisions) carry FORCE ROW LEVEL SECURITY, which denies UPDATE and DELETE to the table owner too — AS DML ONLY. The owner can still DROP POLICY, and on the default single-role deploy the app IS the owner, so the two-role split is what closes that escape (docs/extending/database.md). A mutable table keys its policy on the `app.current_org` GUC and PERMITS when that is unset, because a non-owner runtime role must serve before per-request GUC wiring exists; the load-bearing isolation is the org_id filter on every query either way.
+// audit_entry carries that same GUC predicate (OPE-1812), so it is append-only AND org-keyed; the other three append-only tables stay GUC-free (`USING (true)`). The load-bearing isolation for the audit log is the REQUIRED org at the store boundary — readAudit refuses a read that names none (store.ts auditReadOrg) — because nothing in the shipped runtime sets the GUC.
+// A value import, not a type-only one: the assertions and the retention ceilings are ONE definition shared with the sqlite twin, so a bound cannot drift between two hand-copied SQL statements.
+import { asSurfaceMode, auditSurfaceMode, auditReadOrg, likePrefixPattern, assertIngressDeliveryRetainUntil, assertSpendLimitAmount, assertDomainModelPick, assertHaltAddress, haltAddressColumns, haltAddressFromColumns, framePromoterId, promoterListField, proactiveAddressRow, routinePromptRevisionWrites, spendLedgerConjuncts, CAPTURE_MAX_RETENTION_MS, EVENT_DEDUPE_MAX_RETENTION_MS, PROMOTER_LIST_MAX } from "./store.js";
+import { grantBorrowColumnsProblem, grantFrozenArgsDigest, grantJsonColumn, grantJsonFromColumn, grantRefundTurnOrdinal } from "./credential-grant-rows.js";
+import { CONNECTOR_OP_KIND_PREFIX, ROUTINE_PERMISSION_PREFIX } from "../approvals/session-grant.js";
+import { SESSION_TAIL_MAX_ENTRIES } from "../channels/session-tail.js";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { createHash } from "node:crypto";
+import { AUDIT_CHAIN_EPOCH_ACTION, auditEpochDetail, auditEpochSealFor, auditRowSha, withOrgAuditLock } from "../audit/chain.js";
+import { deploymentOrg } from "../identity/deployment-identity.js";
+import { assembleAnalyticsSql } from "../analytics/compile.js";
+export { setOrgContext } from "../memory/postgres.js";
+// The GUC-keyed org predicate for MUTABLE tables' RLS: enforce when app.current_org is
+// set, permit when unset/empty (see the header — a non-owner runtime role must be able
+// to serve before per-request GUC wiring exists; the load-bearing isolation is the
+// org_id filter on every query either way). NULLIF folds an empty-string GUC (a RESET
+// artefact) into "unset".
+const ORG_GUC = `(org_id = current_setting('app.current_org', true)
+     OR NULLIF(current_setting('app.current_org', true), '') IS NULL)`;
+/**
+ * Does a deparsed policy expression carry the ORG_GUC predicate? {@link EXPECTED_POLICIES} tests the
+ * audit policies with this instead of an exact string, so an audit policy that drifts off the GUC
+ * predicate is a verifyAppendOnlyAudit violation rather than a silent widening.
+ *
+ * 🔴 A SHAPE TEST, NOT THE DEPARSED TEXT, AND THE REASON IS FAIL-CLOSED BOOT. `pg_get_expr` returns
+ * the server's own rendering, which on PGlite 18.3 is
+ * `((org_id = current_setting('app.current_org'::text, true)) OR (NULLIF(current_setting(
+ * 'app.current_org'::text, true), ''::text) IS NULL))` — measured, not guessed. Pinning that string
+ * would make a one-byte deparse difference on another server version (production runs Neon, a
+ * different major) throw "posture STILL failing after apply" on EVERY boot. The parts this tests —
+ * the column, the GUC read, and the NULLIF arm that makes it permit-when-unset — are names, not
+ * formatting, so they survive a reformat. `true` carries none of them, which is the case that must
+ * stay a violation: it is the widening this predicate replaced.
+ */
+function isOrgGucExpr(expr) {
+    return (expr !== null &&
+        /\borg_id\b/.test(expr) &&
+        /current_setting\(\s*'app\.current_org'(::text)?\s*,\s*true\s*\)/i.test(expr) &&
+        /\bNULLIF\s*\(/i.test(expr));
+}
+const SCHEMA_STATEMENTS = [
+    // The drop guard exists because CREATE TABLE IF NOT EXISTS would silently keep an old-shape spend_ledger and every insert would then fail. The probe is usd_micros_measured, the column no pre-OPE-369 table can have, and the statement runs only in owner mode - initOperationalSchema skips all DDL as a non-owner.
+    `DO $$ BEGIN
+     IF to_regclass('public.spend_ledger') IS NOT NULL AND NOT EXISTS (
+       SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public' AND table_name = 'spend_ledger' AND column_name = 'usd_micros_measured'
+     ) THEN
+       EXECUTE 'DROP TABLE spend_ledger';
+     END IF;
+   END $$`,
+    `CREATE TABLE IF NOT EXISTS spend_ledger (
+     org_id             text   NOT NULL,
+     surface_key        text   NOT NULL,
+     principal_id       text   NOT NULL DEFAULT '',  -- '' = unattributed (PK columns can't be NULL)
+     routine_id         text   NOT NULL DEFAULT '',  -- '' = not a routine turn
+     model              text   NOT NULL DEFAULT '',  -- '' = no model (sandbox runtime); '(unknown)' = an unattributed model call
+     period             text   NOT NULL,
+     -- OPE-1862 (mirrored in the ALTER list below): WHICH KIND OF CONVERSATION this row's spend
+     -- happened in — 'dm' | 'mpim' | 'channel', or '' when nothing stamped it. The anti-doxxing
+     -- mask reads THIS and never the shape of a surface id, so Discord and Teams DMs mask exactly
+     -- as Slack's do. OUTSIDE the primary key: a surface's mode never changes, so keying on it
+     -- would split a month for nothing.
+     surface_mode       text   NOT NULL DEFAULT '',
+     input_tokens       bigint NOT NULL DEFAULT 0,
+     output_tokens      bigint NOT NULL DEFAULT 0,
+     cache_read_tokens  bigint NOT NULL DEFAULT 0,
+     cache_write_tokens bigint NOT NULL DEFAULT 0,
+     -- OPE-1611 (mirrored in the ALTER list below): reasoning tokens, ATTRIBUTION only. No rate
+     -- table names a reasoning rate, so this never reaches usd_micros and no cap sees it.
+     reasoning_tokens   bigint NOT NULL DEFAULT 0,
+     usd_micros         bigint NOT NULL DEFAULT 0,   -- millionths of a dollar, DERIVED at write from the rate table (what caps sum)
+     -- OPE-369: the GATEWAY's own billed figure for these same calls, when it published one.
+     -- 0 on a cost_source='derived' row. Never read by a cap — see store.ts's CostSource section.
+     usd_micros_measured bigint NOT NULL DEFAULT 0,
+     cost_source        text   NOT NULL DEFAULT 'derived', -- 'measured' | 'derived'; in the PK so a row is homogeneous
+     calls              bigint NOT NULL DEFAULT 0,
+     PRIMARY KEY (org_id, surface_key, principal_id, routine_id, model, period, cost_source)
+   )`,
+    // period is the SIXTH primary-key column and a btree bounds a scan only up to the first unconstrained column, so the primary key bounds a period-ranged read on org_id alone; measured, the planner takes a Seq Scan that touches every org's rows instead. Like every statement in this list this is also the migration: it builds in place on an owner-mode boot, and a two-role deployment gets it when the owner role runs the schema step.
+    `CREATE INDEX IF NOT EXISTS spend_ledger_org_period ON spend_ledger (org_id, period)`,
+    `CREATE TABLE IF NOT EXISTS routine (
+     org_id      text NOT NULL,
+     id          text NOT NULL,
+     surface_key text NOT NULL,
+     data        text NOT NULL,
+     PRIMARY KEY (org_id, id)
+   )`,
+    // routine_prompt_revisions is the append-only prompt history behind the mutable routine row above, with the same DB-enforced posture as audit_entry. See the RoutinePromptRevisionRow doc comment in store.ts for why a prompt history is an audit artefact, why the log begins at the first edit, and for the retention position.
+    `CREATE TABLE IF NOT EXISTS routine_prompt_revisions (
+     seq         bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+     org_id      text NOT NULL,
+     surface_key text NOT NULL,
+     routine_id  text NOT NULL,
+     prompt      text NOT NULL,
+     generation  integer,
+     authored_by text,
+     armed_by    text,
+     approval_id text,
+     recorded_at text NOT NULL
+   )`,
+    `CREATE INDEX IF NOT EXISTS routine_prompt_revisions_org_surface_routine ON routine_prompt_revisions (org_id, surface_key, routine_id, seq)`,
+    `CREATE TABLE IF NOT EXISTS audit_entry (
+     seq          bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+     ts           text NOT NULL,
+     org_id       text NOT NULL,
+     platform     text NOT NULL,
+     workspace    text NOT NULL,
+     surface      text,
+     surface_mode text,                       -- OPE-1866: the conversation the surface names; NULL = unclassified, which MASKS
+     principal_id text,
+     action       text NOT NULL,
+     detail       text,
+     prev_sha     text                        -- sha256 of the org's previous row (OPE-52 hash chain); NULL = genesis
+   )`,
+    `CREATE INDEX IF NOT EXISTS audit_org_ts ON audit_entry (org_id, ts)`,
+    `CREATE TABLE IF NOT EXISTS spend_limit (
+     org_id         text   NOT NULL,
+     scope_key      text   NOT NULL,
+     level          text   NOT NULL,          -- "surface" | "workspace" | "domain" | "user" (free-text, no CHECK — see store.ts CapLevel)
+     monthly_tokens bigint NOT NULL,          -- -1 = no token component (matches the SQLite encoding)
+     monthly_usd    double precision,         -- NULL = no USD component
+     expires_at     bigint,                  -- epoch ms; NULL = no auto-expiry
+     reason         text,
+     set_by         text,
+     PRIMARY KEY (org_id, scope_key, level)
+   )`,
+    // THE BREAK-GLASS HALT (OPE-1602). Same columns and same encodings as the SQLite adapter — the
+    // filler/marker rule is documented once, at store.ts `haltAddressColumns`.
+    `CREATE TABLE IF NOT EXISTS halt (
+     org_id     text    NOT NULL,
+     level      text    NOT NULL,            -- "" on an org-wide row: FILLER, never an address
+     scope_key  text    NOT NULL,            -- "" on an org-wide row, same reason
+     org_wide   boolean NOT NULL,            -- true = the org-wide MARKER; the column every match branches on first
+     active     boolean NOT NULL,            -- true = halted; a cleared row stays for the trail
+     set_by     text,
+     set_at     text    NOT NULL,            -- ISO-8601
+     set_ref    text,                        -- host wake owning a chat-set halt; NULL for operator/legacy rows
+     cleared_by text,
+     cleared_at text,                        -- ISO-8601; NULL until a resume clears it
+     PRIMARY KEY (org_id, level, scope_key, org_wide)
+   )`,
+    `CREATE TABLE IF NOT EXISTS connector_override (
+     org_id    text    NOT NULL,
+     scope_key text    NOT NULL,
+     connector text    NOT NULL,
+     granted   boolean NOT NULL,
+     reason    text,                         -- no expires_at: auto-expiry would re-open access
+     set_by    text,
+     PRIMARY KEY (org_id, scope_key, connector)
+   )`,
+    `CREATE TABLE IF NOT EXISTS thread_engagement (
+     org_id        text    NOT NULL,
+     surface_key   text    NOT NULL,
+     thread_ts     text    NOT NULL,
+     engaged_at    text    NOT NULL,
+     last_turn_at  text    NOT NULL,
+     participating boolean NOT NULL DEFAULT false, -- true = invited participant; false = warm watcher
+     silent_streak integer NOT NULL DEFAULT 0,     -- consecutive silent woken turns since last engage/participation
+     stopped       boolean NOT NULL DEFAULT false, -- true = an explicit stop landed (task #100 window path); suppress non-mention wakes until re-invited
+     engaged_by    text,                           -- SEPARATOR-FRAMED list of the ids of events that PROMOTED this row, most recent last, bounded; a re-promotion from ANY id the list holds never clears stopped (store.ts PROMOTER_SEP)
+     PRIMARY KEY (org_id, surface_key, thread_ts)
+   )`,
+    // channel_session: the live channel-supervisor session pointer per (org, surface_key) —
+    // Slack Claude-Tag-parity T1.1. ONE row per surface (rotation replaces it wholesale, see
+    // the ChannelSessionRow doc comment in store.ts) — read-write like thread_engagement,
+    // NOT append-only.
+    `CREATE TABLE IF NOT EXISTS channel_session (
+     org_id             text    NOT NULL,
+     surface_key        text    NOT NULL,
+     token              text    NOT NULL,
+     generation         integer NOT NULL,
+     created_at         text    NOT NULL,
+     last_wake_at       text    NOT NULL,
+     turn_count         integer NOT NULL DEFAULT 0,
+     input_tokens_total bigint,               -- measured cumulative input+cacheRead for this generation (§2 #551); NULL = unknown ⇒ rotate
+     first_wake_at      text,                 -- ISO-8601 of the first delivered wake (H7c); NULL = none yet ⇒ still fresh
+     last_input_tokens  bigint,               -- OPE-794: measured input+cacheRead of the LATEST request (SET, not summed); NULL = none yet ⇒ rung skipped
+     rotate_marked_at   text,                 -- OPE-820: ISO-8601 an operator marked this generation for retirement; NULL = unmarked. Set ONLY by the ops sweep; cleared by every rotation
+     served_code_fingerprint   text,          -- OPE-1821: the runtime CODE hash this seat was last served with; NULL = never stamped. Written ONLY by stampChannelSessionRuntime, and deliberately NOT reset by a rotation
+     served_domain_fingerprint text,          -- OPE-1821: the DOMAIN declaration hash this seat was last served with. Same writer, same NULL meaning — the pair moves together
+     PRIMARY KEY (org_id, surface_key)
+   )`,
+    // session_tail (OPE-794): the standing-seat TAIL ring — one row per recorded conversational
+    // event on ONE generation (a delivered wake message, or a post the seat made). The rotate leg
+    // reads the OUTGOING generation's rows and renders them into the fresh generation's first wake.
+    // Keyed by the generation's live TOKEN, so a straggler write from a retired generation files
+    // under the retired token and is never read again. Read-write and self-pruning like
+    // event_dedupe; bounded on write, and dropped once its tail has been carried forward.
+    `CREATE TABLE IF NOT EXISTS session_tail (
+     org_id      text    NOT NULL,
+     surface_key text    NOT NULL,
+     token       text    NOT NULL,
+     seq         bigint  NOT NULL,
+     at          text    NOT NULL,
+     entry_json  text    NOT NULL,
+     PRIMARY KEY (org_id, surface_key, token, seq)
+   )`,
+    `CREATE TABLE IF NOT EXISTS event_dedupe (
+     org_id  text NOT NULL,
+     key     text NOT NULL,
+     seen_at text NOT NULL,
+     PRIMARY KEY (org_id, key)
+   )`,
+    // Durable provider inbox. The verified signer id is part of the immutable delivery identity;
+    // payload_json is versioned by its provider but never contains a raw signature or secret.
+    // Pending rows have retain_until NULL and survive arbitrary outages. Completion erases the
+    // payload and starts the bounded tombstone clock in the same fenced UPDATE.
+    `CREATE TABLE IF NOT EXISTS ingress_delivery (
+     org_id        text NOT NULL,
+     source        text NOT NULL,
+     authority_id  text NOT NULL,
+     delivery_id   text NOT NULL,
+     payload_json  text,
+     received_at   text NOT NULL,
+     available_at  text NOT NULL,
+     claim_id      text,
+     claimed_at    text,
+     completed_at  text,
+     retain_until  text,
+     PRIMARY KEY (org_id, source, authority_id, delivery_id)
+   )`,
+    `CREATE INDEX IF NOT EXISTS ingress_delivery_due ON ingress_delivery (org_id, source, completed_at, available_at, claimed_at)`,
+    // webhook_capture: the BOUNDED CAPTURE WINDOW (OPE-211 + OPE-184 Half 2). The only table in this
+    // schema holding bytes an outside party authored — `document` is the jq FILTER DOCUMENT, not the
+    // raw body (webhooks/capture-window.ts explains why that distinction is the safety property and
+    // not a convenience). Read-write and self-pruning like event_dedupe; never UPDATEd, which is why
+    // its grant is a narrow SELECT/INSERT/DELETE of its own rather than a place in the blanket list.
+    `CREATE TABLE IF NOT EXISTS webhook_capture (
+     org_id      text   NOT NULL,
+     source      text   NOT NULL,
+     seq         integer NOT NULL,
+     captured_at text   NOT NULL,
+     document    text   NOT NULL,
+     PRIMARY KEY (org_id, source, seq)
+   )`,
+    // unified_wake_target: the single-window wakeId → replyTarget map (channels/unified-window.ts).
+    // Read-write like event_dedupe (a routing map with TTL prune, not an append-only record).
+    `CREATE TABLE IF NOT EXISTS unified_wake_target (
+     org_id           text NOT NULL,
+     wake_id          text NOT NULL,
+     target_json      text NOT NULL,
+     created_at       text NOT NULL,
+     window_token     text,
+     answered_at      text,
+     answered_turn_id text,
+     inbound          boolean,
+     audited_at       text,
+     PRIMARY KEY (org_id, wake_id)
+   )`,
+    // thread_ownership: the async-spawn (org, channelKey, threadKey) → taskToken index the ingress
+    // router consults (channels/thread-ownership.ts, §S2). Read-write like unified_wake_target (a
+    // TTL-pruned routing map) but WITH a real clear — complete_thread + generation/idle GC delete rows.
+    `CREATE TABLE IF NOT EXISTS thread_ownership (
+     org_id      text NOT NULL,
+     channel_key text NOT NULL,
+     thread_key  text NOT NULL,
+     task_token  text NOT NULL,
+     created_at  text NOT NULL,
+     PRIMARY KEY (org_id, channel_key, thread_key)
+   )`,
+    // thread_seat_state: one THREAD SEAT's durable record (OPE-1696) — the seat token, the parent seat
+    // it reports to, open/completed, and its closing report. Read by `read_thread_seat`, never by the
+    // ingress router: ROUTING stays on thread_ownership, which is cleared at hand-back while this row
+    // survives so a coordinator can still read what came back.
+    `CREATE TABLE IF NOT EXISTS thread_seat_state (
+     org_id      text NOT NULL,
+     channel_key text NOT NULL,
+     thread_key  text NOT NULL,
+     seat_token  text NOT NULL,
+     parent_key  text NOT NULL,
+     state       text NOT NULL,
+     origin_json text NOT NULL,
+     report      text,
+     opened_at   text NOT NULL,
+     updated_at  text NOT NULL,
+     PRIMARY KEY (org_id, channel_key, thread_key)
+   )`,
+    // turn_anchor: the (org, windowKey) → {sessionId, turnId} index an INGRESS route consults to
+    // cancel an in-flight turn pre-dispatch (OPE-418; hooks/turn-anchor.ts writes it, the ingress
+    // stop path reads it). Read-write with a real clear, like thread_ownership; SHORT TTL.
+    `CREATE TABLE IF NOT EXISTS turn_anchor (
+     org_id      text NOT NULL,
+     window_key  text NOT NULL,
+     anchor_key  text,
+     channel_key text,
+     session_id  text NOT NULL,
+     turn_id     text NOT NULL,
+     surface_key text NOT NULL,
+     created_at  text NOT NULL,
+     PRIMARY KEY (org_id, window_key)
+   )`,
+    // task_result: an org-scoped, TTL-pruned, OPAQUE key-value scratch table. The name is historical —
+    // see the store interface's own note: it was minted for the deleted roll-own delegation regime and
+    // is now shared by the native-subagent taint markers, the question bridge and the task-wake join,
+    // each under its own key prefix. Read-write like unified_wake_target, no explicit clear.
+    `CREATE TABLE IF NOT EXISTS task_result (
+     org_id       text NOT NULL,
+     task_id      text NOT NULL,
+     result_json  text NOT NULL,
+     created_at   text NOT NULL,
+     PRIMARY KEY (org_id, task_id)
+   )`,
+    // slack_attachment: the DURABLE, cross-process file-id → url_private index the delegated-worker
+    // upload-read path turns on (channels/slack-attachments.ts; describe_image + read_file_upload).
+    // Read-write like unified_wake_target (a TTL-pruned routing map), no explicit clear. Written only
+    // from the trusted Slack event parse; the bytes are never stored, only the short-lived url + meta.
+    `CREATE TABLE IF NOT EXISTS slack_attachment (
+     org_id      text NOT NULL,
+     file_id     text NOT NULL,
+     url_private text NOT NULL,
+     mime_type   text,
+     name        text,
+     team_id     text,
+     created_at  text NOT NULL,
+     PRIMARY KEY (org_id, file_id)
+   )`,
+    // stored_credential (task #113): the ciphertext store behind the `db` credential broker
+    // (agent/credentials/db-broker.ts). `ciphertext` is an AES-256-GCM envelope, opaque here — this
+    // table NEVER holds plaintext. Read-write (a re-store under the same ref replaces the envelope),
+    // org-isolated by RLS. The bytes are the secret; connector/domain are labels only. Mirrors the
+    // slack_attachment shape (org-scoped mutable routing/lookup table).
+    `CREATE TABLE IF NOT EXISTS stored_credential (
+     org_id     text NOT NULL,
+     ref        text NOT NULL,
+     ciphertext text NOT NULL,
+     connector  text,
+     domain     text,
+     created_by text NOT NULL,
+     created_at text NOT NULL,
+     PRIMARY KEY (org_id, ref)
+   )`,
+    // credential_intake (task #113): the durable, single-use, TTL'd binding a "Set API key" button
+    // carries (agent/credentials/intake.ts). Read-write; the ONE unused→used transition is CAS-guarded
+    // at the query layer (consumeCredentialIntake's `WHERE used_at IS NULL`), like pending_actions.
+    // NEVER carries the secret value — only the ref/connector/domain labels + the requester who may
+    // complete it.
+    `CREATE TABLE IF NOT EXISTS credential_intake (
+     org_id       text NOT NULL,
+     id           text NOT NULL,
+     ref          text NOT NULL,
+     connector    text NOT NULL,
+     domain       text,
+     requested_by text NOT NULL,
+     channel_id   text NOT NULL,
+     thread_ts    text,
+     created_at   text NOT NULL,
+     expires_at   text NOT NULL,
+     used_at      text,
+     PRIMARY KEY (org_id, id)
+   )`,
+    // webhook_capture_window (OPE-211, re-homed by OPE-224): the ONLY mutable state a declared webhook
+    // has — when its capture window closes, and who opened it. Keyed by (org_id, hook_id) because a
+    // hook id is unique WITHIN an org's config, unlike the deleted chat-created class's ids which were
+    // globally-unique URL segments. Nothing here is secret, nothing here is authority: the hook's
+    // identity, posture and read grant are all re-read from the config registry at arm and delivery
+    // time, so this row can never become a second place a hook is defined.
+    `CREATE TABLE IF NOT EXISTS webhook_capture_window (
+     org_id        text NOT NULL,
+     hook_id       text NOT NULL,
+     capture_until text NOT NULL,
+     armed_by      text NOT NULL,
+     armed_at      text NOT NULL,
+     PRIMARY KEY (org_id, hook_id)
+   )`,
+    // github_installation (scm/installations.ts): owner → installation id, learned from the App's own
+    // signature-verified `installation` webhook so a new org installing the App self-registers instead
+    // of needing an OE_GITHUB_INSTALLATIONS env edit + redeploy. NOT a secret (an installation id is a
+    // public routing number; the App private key stays in env). Read-write with a real clear (an
+    // uninstall/suspend delivery revokes); NOT TTL-pruned — an installation is durable until GitHub says
+    // otherwise. The env map composes OVER these rows, so env stays authoritative.
+    `CREATE TABLE IF NOT EXISTS github_installation (
+     org_id               text NOT NULL,
+     owner                text NOT NULL,
+     installation_id      text NOT NULL,
+     account_type         text,
+     repository_selection text,
+     updated_at           text NOT NULL,
+     PRIMARY KEY (org_id, owner)
+   )`,
+    // pr_session_approval (OPE-53): the "Approve for session" grant on a pr.open card. Read-write,
+    // keyed by the bare session/window token (its generation makes the memo die with the session).
+    // Written in the webhook process (the click), read in the eve workflow process (the next
+    // pr.open propose). Scoped to kind="pr.open" by the callers; NEVER carries PR content.
+    `CREATE TABLE IF NOT EXISTS pr_session_approval (
+     org_id     text NOT NULL,
+     session_id text NOT NULL,
+     kind       text NOT NULL,
+     granted_by text NOT NULL,
+     created_at text NOT NULL,
+     expires_at text NOT NULL,
+     PRIMARY KEY (org_id, session_id, kind)
+   )`,
+    // pending_actions: the in-Slack admin-approvals durable state (agent/approvals/*).
+    // Read-write like spend_limit/connector_override (NOT append-only like audit_entry) —
+    // but its one pending→decided transition is CAS-guarded at the query layer
+    // (decidePendingAction's `WHERE status = 'pending'`), not by RLS.
+    `CREATE TABLE IF NOT EXISTS pending_actions (
+     org_id       text NOT NULL,
+     id           text NOT NULL,
+     kind         text NOT NULL,
+     args_json    text NOT NULL,
+     scope_key    text NOT NULL,
+     domain       text,
+     requested_by text NOT NULL,
+     channel_id   text NOT NULL,
+     thread_ts    text,
+     message_ts   text,
+     posted_to    text,
+     status       text NOT NULL,
+     created_at   text NOT NULL,
+     expires_at   text NOT NULL,
+     decided_by   text,
+     decided_at   text,
+     PRIMARY KEY (org_id, id)
+   )`,
+    `CREATE INDEX IF NOT EXISTS pending_actions_org_status ON pending_actions (org_id, status)`,
+    `CREATE TABLE IF NOT EXISTS domain_skill (
+     org_id     text NOT NULL,
+     domain     text NOT NULL,
+     name       text NOT NULL,
+     content    text NOT NULL,
+     updated_by text,
+     updated_at text NOT NULL,
+     PRIMARY KEY (org_id, domain, name)
+   )`,
+    // domain_skill_revisions (OPE-237): the APPEND-ONLY content history behind the mutable
+    // domain_skill row above. Same DB-enforced posture as audit_entry/usage_events — see the
+    // DomainSkillRevisionRow doc comment in store.ts for why a domain skill's history is an
+    // audit artefact rather than ordinary versioning, and for the retention position (never
+    // pruned; bounded by human approval clicks, not by traffic).
+    `CREATE TABLE IF NOT EXISTS domain_skill_revisions (
+     seq         bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+     org_id      text NOT NULL,
+     domain      text NOT NULL,
+     name        text NOT NULL,
+     content     text NOT NULL,
+     authored_by text,
+     armed_by    text,
+     approval_id text,
+     recorded_at text NOT NULL
+   )`,
+    `CREATE INDEX IF NOT EXISTS domain_skill_revisions_org_domain_name ON domain_skill_revisions (org_id, domain, name, seq)`,
+    // domain_model: a domain's runtime model/reasoning pick (the DB-overlay half of the
+    // model-policy envelope, model/policy.ts) — read-write like domain_skill (a domain
+    // OWNS its pick, no expiresAt/auto-revert), NOT append-only.
+    `CREATE TABLE IF NOT EXISTS domain_model (
+     org_id     text NOT NULL,
+     domain     text NOT NULL,
+     model_id   text,
+     reasoning  text,
+     set_by     text,
+     updated_at text NOT NULL,
+     PRIMARY KEY (org_id, domain)
+   )`,
+    // usage_events: append-only per-model-call ledger (session/user cost + analytics).
+    // Deliberately NO "IF NOT EXISTS" migration for pruning here — see the RLS note
+    // below: this table gets SELECT+INSERT-only policies, same as audit_entry, so
+    // pruneUsageEvents is a documented no-op under Postgres (sqlite prunes for real).
+    `CREATE TABLE IF NOT EXISTS usage_events (
+     seq                bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+     org_id             text   NOT NULL,
+     surface_key        text   NOT NULL,
+     session_id         text   NOT NULL,
+     principal_id       text,
+     ts                 text   NOT NULL,
+     kind               text,
+     routine_id         text,
+     input_tokens       bigint NOT NULL DEFAULT 0,
+     output_tokens      bigint NOT NULL DEFAULT 0,
+     cache_read_tokens  bigint NOT NULL DEFAULT 0,
+     cache_write_tokens bigint NOT NULL DEFAULT 0,
+     model              text,
+     detail             text,
+     -- OPE-1611 (mirrored in the ALTER list below): the two attribution dimensions the cache/
+     -- reasoning question needs. Both NULLABLE on purpose — NULL is "the source reported nothing",
+     -- which is a different fact from a reported zero, and that difference is the whole ticket.
+     -- OPE-1862 (mirrored in the ALTER list below): the conversation this event happened in —
+     -- 'dm' | 'mpim' | 'channel'; NULL = unstamped. The kind column above cannot answer this: a routine,
+     -- supervisor or subagent turn wins that tag before the DM test runs, so a routine fired in a
+     -- DM reads kind 'routine'. Reports mask an unstamped row rather than guess.
+     surface_mode       text,
+     cache_tokens_reported boolean,          -- true = the call reported a cache split; false = it did not; NULL = never asked
+     reasoning_tokens   bigint,              -- NULL = unreported; a number (0 included) = reported
+     -- OPE-369 (mirrored in the ALTER list below, which is what an existing DB takes)
+     usd_micros_measured bigint,             -- the gateway's billed figure for THIS call; NULL = nothing measured it
+     cost_source        text,                -- 'measured' | 'derived'; NULL on pre-migration/non-model rows
+     delegation_depth   integer,             -- 0 = root turn, 1 = direct child, 2 = two-or-more hops (a BAND — see store.ts)
+     root_session_id    text                 -- top of this call's delegation chain (its own session id on a root turn)
+   )`,
+    `CREATE INDEX IF NOT EXISTS usage_events_org_session ON usage_events (org_id, session_id)`,
+    `CREATE INDEX IF NOT EXISTS usage_events_org_surface_ts ON usage_events (org_id, surface_key, ts)`,
+    // The three identity link tables are read-write like domain_skill, with the history in audit_entry that identity/link-store.ts appends on every mutation; nothing else writes here. handle is DISPLAY ONLY and carries no index and no uniqueness: a name/handle/email join is the attacker-controllable merge the fail-closed-on-merge doctrine forbids, so sets join on id and accounts join on (platform, native_id).
+    `CREATE TABLE IF NOT EXISTS identity_link_sets (
+     org_id     text NOT NULL,
+     id         text NOT NULL,
+     handle     text NOT NULL,          -- DISPLAY ONLY: admin lists + audit rows, never a lookup key
+     status     text NOT NULL,          -- "active" | "suspended" | "revoked" ("revoked" is terminal)
+     created_at text NOT NULL,
+     updated_at text NOT NULL,
+     PRIMARY KEY (org_id, id)
+   )`,
+    // The primary key IS the 'an account is exactly one person' invariant - the write API checks it too, but this is the half a racing second writer cannot lose. tenant is in the key because a tenant-scoped platform (slack) issues a person id PER WORKSPACE, so the older 3-column key made two workspaces' members one row; it is '' for every vendor-global platform, and identity/link-tenant.ts owns the value space.
+    `CREATE TABLE IF NOT EXISTS identity_linked_ids (
+     org_id         text NOT NULL,
+     platform       text NOT NULL,
+     tenant         text NOT NULL DEFAULT '',  -- '' = vendor-global platform, or not yet backfilled
+     native_id      text NOT NULL,
+     link_set_id    text NOT NULL,
+     status         text NOT NULL,      -- "suggested" | "confirmed" | "revoked" ("revoked" is terminal)
+     established_by text NOT NULL,      -- "challenge:<id>" | "config-import" | "directory-sync:<provider>"
+     evidence       text,               -- the structured evidence record as JSON; opaque here
+     created_at     text NOT NULL,
+     updated_at     text NOT NULL,
+     PRIMARY KEY (org_id, platform, tenant, native_id)
+   )`,
+    `CREATE INDEX IF NOT EXISTS identity_linked_ids_org_set ON identity_linked_ids (org_id, link_set_id)`,
+    // identity_link_challenges: the proof-of-control nonce ledger. `nonce_hash` is a sha-256 — the
+    // RAW code is never stored, so a database copy yields no usable codes. Single-use is the
+    // pending-only claim CAS (claimLinkChallenge), not a boolean anyone has to remember to flip.
+    `CREATE TABLE IF NOT EXISTS identity_link_challenges (
+     org_id                 text NOT NULL,
+     id                     text NOT NULL,
+     nonce_hash             text NOT NULL,   -- sha-256 hex of the uppercased code; NEVER the code
+     initiating_platform    text NOT NULL,
+     initiating_tenant      text NOT NULL DEFAULT '',  -- OPE-309 phase 2; '' off a tenant-scoped platform
+     initiating_native_id   text NOT NULL,
+     initiating_surface_key text NOT NULL,   -- the DM the ratification must come back to
+     claimed_platform       text,            -- stamped from the WAKE's own captured author
+     claimed_tenant         text,            -- …in the same CAS, so a claimed row names a whole account
+     claimed_native_id      text,
+     claimed_at             text,
+     transport              text NOT NULL DEFAULT 'code',  -- OPE-617; code | directory
+     target_platform        text,            -- the directory transport's NAMED target …
+     target_tenant          text,            -- …matched inside the consent CAS, so a consent
+     target_native_id       text,            -- …from any other account matches no row
+     back_nonce_hash        text,            -- sha-256 of code-2; its PRESENCE forces the code-back
+     status                 text NOT NULL,   -- pending | claimed | ratified | denied | expired
+     created_at             text NOT NULL,
+     expires_at             text NOT NULL,
+     decided_at             text,
+     PRIMARY KEY (org_id, id)
+   )`,
+    `CREATE INDEX IF NOT EXISTS identity_link_challenges_org_nonce ON identity_link_challenges (org_id, nonce_hash)`,
+    // credential_grant_ask (OPE-1060): one person's REQUEST for another person's credential, pending
+    // the owner's answer in their own DM. `purpose` is MODEL-AUTHORED and stored as data — every reader
+    // renders it escaped and quoted. Single-answer is the pending-only approve CAS, not a flag.
+    `CREATE TABLE IF NOT EXISTS credential_grant_ask (
+     org_id                 text NOT NULL,
+     id                     text NOT NULL,
+     requester_principal_id text NOT NULL,
+     owner_principal_id     text NOT NULL,
+     owner_slug             text NOT NULL,   -- the eventual tool name's owner segment, PINNED here
+     owner_platform         text NOT NULL,   -- where the owner's card is delivered
+     owner_native_id        text NOT NULL,   -- the bare platform id the DM arm addresses
+     connector              text NOT NULL,
+     verb                   text NOT NULL,   -- the vendor tool SLUGIFIED, as a name segment; a label, never the wire name
+     resource               text NOT NULL,   -- the host-composed DISPLAY LABEL, holding model-authored text and the frozen VALUES
+     mcp_tool               text,            -- OPE-1136: the vendor MCP tool, in the vendor's exact bytes
+     frozen_args            text,            -- OPE-1136: canonical JSON; '{}' is "nothing frozen", NULL is "no borrow"
+     tool_name              text,            -- OPE-1136: the full mounted name, PINNED here with the ordinal
+     scope_key              text NOT NULL,   -- the CHAT this would serve (the session id)
+     domain_scope_key       text,            -- OPE-1950: the room's domain-shaped seat key; a STANDING grant binds here instead
+     purpose                text NOT NULL,   -- model-authored; untrusted content
+     requester_target       text,            -- JSON ReplyTarget: where the owner's answer is reported back
+     card_surface_id        text,            -- where the owner's card landed -- the lapse sweep rewrites it
+     card_message_id        text,
+     requested_mode         text NOT NULL,   -- once | session | standing
+     status                 text NOT NULL,   -- pending | approved | declined | expired
+     created_at             text NOT NULL,
+     expires_at             text NOT NULL,   -- the ASK's own short TTL, NOT the grant's
+     decided_at             text,
+     grant_id               text,            -- stamped by the approve CAS
+     PRIMARY KEY (org_id, id)
+   )`,
+    `CREATE INDEX IF NOT EXISTS credential_grant_ask_org_scope ON credential_grant_ask (org_id, scope_key)`,
+    // credential_grant (OPE-1060): the owner-approved grant a chat spends. `tier` is decided ONCE at
+    // mint — from the verb definition on the registry path, from `classifyConnectorOpTier` on the
+    // OPE-1136 borrow path — and is never re-derived from the mounted tool name (a `grant__…` name
+    // carries a person's handle where a classifier looks for a verb).
+    // Rows are NEVER deleted: the mount projects every row for a scope and the broker refuses on state,
+    // so a removed row would make a tool vanish mid-plan instead of refusing.
+    // 🔴 NO UNIQUE INDEX ON (org_id, scope_key, tool_name), deliberately — the same call the sqlite
+    // schema states: the ordinal holds uniqueness inside a chat, the mount-side dedupe closes the
+    // compose race, and a write-refusing constraint waits for a writer it can be proven against.
+    `CREATE TABLE IF NOT EXISTS credential_grant (
+     org_id                 text NOT NULL,
+     id                     text NOT NULL,
+     ask_id                 text NOT NULL,
+     requester_principal_id text NOT NULL,
+     owner_principal_id     text NOT NULL,
+     owner_slug             text NOT NULL,   -- the mounted name's owner segment, PINNED at mint
+     connector              text NOT NULL,
+     verb                   text NOT NULL,
+     resource               text NOT NULL,
+     mcp_tool               text,            -- OPE-1136: the vendor MCP tool, in the vendor's exact bytes
+     frozen_args            text,            -- OPE-1136: canonical JSON; '{}' is "nothing frozen", NULL is "no borrow"
+     tool_name              text,            -- OPE-1136: the full mounted name, copied from the ask
+     input_schema           text,            -- OPE-1136: the post-bake schema snapshot, taken at approve
+     scope_key              text NOT NULL,
+     mode                   text NOT NULL,   -- once | session | standing
+     tier                   text NOT NULL,   -- read | write | destructive, pinned at mint
+     status                 text NOT NULL,   -- active | used | revoked | expired
+     purpose                text NOT NULL,   -- model-authored; untrusted content
+     created_at             text NOT NULL,
+     expires_at             text NOT NULL,
+     used_at                text,
+     revoked_at             text,
+     refund_turn            text,            -- OPE-1264: the turn key the refund count below belongs to
+     refund_turn_seq        bigint,          -- OPE-1281: that key's eve turn ordinal; only a LATER one rolls the count
+     refund_count           integer NOT NULL DEFAULT 0, -- OPE-1264: refunds already claimed on that turn
+     PRIMARY KEY (org_id, id)
+   )`,
+    `CREATE INDEX IF NOT EXISTS credential_grant_org_scope ON credential_grant (org_id, scope_key)`,
+    // notice_claim: LIFETIME at-most-once claims (store.ts claimNotice) — four key families, from the
+    // external-room `silent` announcement pair to the GitHub reaction-feedback dedupe. NO TTL and NO
+    // DELETE, deliberately: the row records "this already happened", and dropping it would turn a
+    // once-ever announcement into a periodic one and a recorded reaction into a repeated one. Every
+    // family is bounded by the thing it records, never by the number of ships. Two are traffic-derived
+    // and grow as a constant factor of the append-only audit log the deployment already keeps —
+    // store.ts's own section states what bounds each. The fifth family, OPE-1751's runtime-rotation
+    // claim, was the one entry keyed by the (eve build, deployment) pair, so it grew by a row per ship
+    // per standing seat and needed the only sweep this table ever had; OPE-1821 retired both.
+    `CREATE TABLE IF NOT EXISTS notice_claim (
+     org_id     text NOT NULL,
+     key        text NOT NULL,
+     claimed_at text NOT NULL,
+     PRIMARY KEY (org_id, key)
+   )`,
+    // proactive_address (OPE-887): where this deployment may reach somebody with no live turn. UPSERTED,
+    // never appended — one row per (platform, kind, ref_key), re-stamped by every inbound activity, so a
+    // moved serviceUrl region corrects itself instead of pinning a dead address. `address` is a
+    // provider-shaped JSON bag core never reads inside. No TTL and no prune: an address is corrected by
+    // the next activity, and expiring one would trade a stale address for no address at all. See
+    // store.ts's PROACTIVE ADDRESSES section for the whole posture.
+    `CREATE TABLE IF NOT EXISTS proactive_address (
+     org_id     text NOT NULL,
+     platform   text NOT NULL,
+     kind       text NOT NULL,
+     ref_key    text NOT NULL,
+     tenant     text NOT NULL,
+     address    text NOT NULL,
+     updated_at text NOT NULL,
+     PRIMARY KEY (org_id, platform, kind, ref_key)
+   )`,
+    // model_call_capture (OPE-846): the soak lane's byte-exact model-call recorder. MUTABLE and
+    // deliberately so — the retention verb is an explicit delete-by-session, so this table takes plain
+    // org-isolation RLS rather than the append-only SELECT+INSERT pair `usage_events` carries. A DELETE
+    // that cannot delete would make the store permanent, which is the one thing store.ts's MODEL-CALL
+    // CAPTURE posture forbids. Written only while `soak.capture` is armed; a deployment that never arms
+    // it never grows a row. `body_gzip_b64` holds the composed prompt verbatim — transcript-grade at
+    // rest, served only over a service token, never logged.
+    `CREATE TABLE IF NOT EXISTS model_call_capture (
+     seq            bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+     org_id         text    NOT NULL,
+     surface_key    text    NOT NULL,
+     session_id     text    NOT NULL,
+     turn_id        text    NOT NULL,
+     step_index     integer NOT NULL,
+     ts             text    NOT NULL,
+     model          text    NOT NULL,
+     provider       text    NOT NULL,
+     schema_version integer NOT NULL,
+     sha256         text    NOT NULL,
+     body_bytes     bigint  NOT NULL,
+     body_gzip_b64  text    NOT NULL,
+     truncated      boolean NOT NULL DEFAULT false
+   )`,
+    `CREATE INDEX IF NOT EXISTS model_call_capture_org_session ON model_call_capture (org_id, session_id, seq)`,
+    // memory_proposal (OPE-957): the dream cycle's proposal review queue, moved off the audit log
+    // (store.ts's MEMORY PROPOSALS section carries the whole posture). MUTABLE, like
+    // model_call_capture — a store holding member text needs a real erasure path.
+    `CREATE TABLE IF NOT EXISTS memory_proposal (
+     id           bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+     org_id       text NOT NULL,
+     kind         text NOT NULL,
+     scope        text NOT NULL,
+     summary      text NOT NULL,
+     before_text  text,
+     after_text   text,
+     detail_json  text,
+     principal_id text NOT NULL,
+     created_at   text NOT NULL
+   )`,
+    `CREATE INDEX IF NOT EXISTS memory_proposal_org ON memory_proposal (org_id, id)`,
+    // dm_audience (OPE-1064 tier P2): who this deployment may START a direct message with, and whether
+    // they have stopped it. Two nullable timestamps and no content — store.ts's DM AUDIENCE section
+    // carries the whole posture, including why the key is the grant's own ARN-like address.
+    `CREATE TABLE IF NOT EXISTS dm_audience (
+     org_id      text NOT NULL,
+     address     text NOT NULL,
+     first_dm_at text,
+     stopped_at  text,
+     PRIMARY KEY (org_id, address)
+   )`,
+    // instance_meta: deployment-level KV (today just the anonymous telemetry instance
+    // id — observability/telemetry.ts). DELIBERATELY NOT org-partitioned — no org_id
+    // column, no RLS policy — because this holds facts about the DEPLOYMENT itself,
+    // never tenant data. One deployment can serve many orgs; the instance id must stay
+    // ONE value across all of them. This is the one intentional exception to every
+    // other table's org_id + RLS contract in this file.
+    `CREATE TABLE IF NOT EXISTS instance_meta (
+     key   text PRIMARY KEY,
+     value text NOT NULL
+   )`,
+    // These ALTER statements migrate an older DB in place: CREATE TABLE IF NOT EXISTS leaves an existing table's columns alone. The OPE-1611 attribution columns are additive and never backfilled - spend_ledger's takes NOT NULL DEFAULT 0 so its SUM stays a plain integer, and the usage_events pair stays nullable so a row can say 'unreported' instead of claiming a zero.
+    `ALTER TABLE spend_ledger ADD COLUMN IF NOT EXISTS reasoning_tokens bigint NOT NULL DEFAULT 0`,
+    `ALTER TABLE usage_events ADD COLUMN IF NOT EXISTS cache_tokens_reported boolean`,
+    `ALTER TABLE usage_events ADD COLUMN IF NOT EXISTS reasoning_tokens bigint`,
+    // OPE-1862: the conversation mode the anti-doxxing mask reads. Additive on both tables and in
+    // neither primary key, so every existing row is kept. Nothing is backfilled and nothing may be:
+    // the mode was knowable only from the turn's binding, which no stored row carries. An unstamped
+    // row reads '' / NULL and every report MASKS it — fail closed.
+    `ALTER TABLE usage_events ADD COLUMN IF NOT EXISTS surface_mode text`,
+    `ALTER TABLE spend_ledger ADD COLUMN IF NOT EXISTS surface_mode text NOT NULL DEFAULT ''`,
+    `ALTER TABLE spend_limit ADD COLUMN IF NOT EXISTS expires_at bigint`,
+    `ALTER TABLE spend_limit ADD COLUMN IF NOT EXISTS reason text`,
+    `ALTER TABLE spend_limit ADD COLUMN IF NOT EXISTS set_by text`,
+    `ALTER TABLE spend_limit ADD COLUMN IF NOT EXISTS monthly_usd double precision`, // item 16: USD caps
+    `ALTER TABLE halt ADD COLUMN IF NOT EXISTS set_ref text`,
+    `ALTER TABLE connector_override ADD COLUMN IF NOT EXISTS reason text`,
+    `ALTER TABLE connector_override ADD COLUMN IF NOT EXISTS set_by text`,
+    // Warm-on-wake engagement (participating watcher + silent-streak shedding): additive
+    // columns on a table that predates them — mirrors the SQLite migration. The NOT NULL
+    // DEFAULT backfills existing rows, so a pre-migration engaged thread reads as a
+    // non-participating (warm) thread with a zero streak (the fail-safe reading).
+    `ALTER TABLE thread_engagement ADD COLUMN IF NOT EXISTS participating boolean NOT NULL DEFAULT false`,
+    `ALTER TABLE thread_engagement ADD COLUMN IF NOT EXISTS silent_streak integer NOT NULL DEFAULT 0`,
+    // Ownership routing (Slack Claude-Tag-parity T1.1): additive columns, same table,
+    // mirrors the SQLite migration. owner_token stays NULL until a router sets one
+    // (decoded to `undefined` on read); kind backfills every pre-migration row to
+    // "thread" via the DEFAULT (Postgres applies it to existing rows on ADD COLUMN).
+    `ALTER TABLE thread_engagement ADD COLUMN IF NOT EXISTS owner_token text`,
+    `ALTER TABLE thread_engagement ADD COLUMN IF NOT EXISTS kind text NOT NULL DEFAULT 'thread'`,
+    // Durable STOPPED marker (task #100 follow-up — window-riding supervisor stop): additive,
+    // NOT NULL DEFAULT false backfills every existing row to NOT-stopped (the safe reading — a
+    // stop only ever suppresses AFTER it has been written). Mirrors the SQLite migration.
+    `ALTER TABLE thread_engagement ADD COLUMN IF NOT EXISTS stopped boolean NOT NULL DEFAULT false`,
+    // Durable engage-idempotency (OPE-1527) — see the sqlite.ts migration note. Nullable, and a NULL
+    // reads as "no recorded promoter", which clears exactly as before.
+    `ALTER TABLE thread_engagement ADD COLUMN IF NOT EXISTS engaged_by text`,
+    // This UPDATE reframes a legacy bare engaged_by id into the one-entry list the membership test reads. The list runs with no try/catch, so the WHERE clause is what makes a second run a no-op; and it is an OPTIMISATION, never a precondition - initOperationalSchema returns early for a non-owner runtime role, so on a two-role deployment nothing here runs and markEngaged must frame the value inside its own statement.
+    `UPDATE thread_engagement SET engaged_by = chr(10) || engaged_by || chr(10) WHERE engaged_by IS NOT NULL AND engaged_by <> '' AND substr(engaged_by, 1, 1) <> chr(10)`,
+    // Cumulative-token rotation + H7c (§2, eve #551): additive, all nullable, on a table that
+    // predates them. input_tokens_total stays NULL on pre-migration rows ⇒ shouldRotate fails safe
+    // and rotates once (self-heals — the new row starts at 0). first_wake_at stays NULL.
+    `ALTER TABLE channel_session ADD COLUMN IF NOT EXISTS input_tokens_total bigint`,
+    `ALTER TABLE channel_session ADD COLUMN IF NOT EXISTS first_wake_at text`,
+    // OPE-794 context-size rung. NULL on pre-migration rows, and that is NOT a fail-safe rotate: the
+    // rung is SKIPPED on NULL (rotationTrigger), because every freshly-minted generation is NULL too
+    // and rotating on it would retire each new generation before its first turn.
+    //
+    // `handoff_note` is deliberately NOT dropped. OPE-794 deleted the rotation handoff note, so
+    // nothing reads or writes that column any more; an existing install keeps a vestigial column and
+    // a fresh one never grows it. A destructive DROP on a live table buys nothing.
+    `ALTER TABLE channel_session ADD COLUMN IF NOT EXISTS last_input_tokens bigint`,
+    // OPE-820 operator mark. NULL on every pre-migration row, which reads as "unmarked" — the rung
+    // is skipped, so the migration changes no seat's rotation behaviour on its own.
+    `ALTER TABLE channel_session ADD COLUMN IF NOT EXISTS rotate_marked_at text`,
+    // OPE-1821 runtime-rotation comparison. Additive, both nullable. NULL reads as "never stamped",
+    // which stampChannelSessionRuntime ADOPTS rather than rotating: a pre-migration seat keeps its
+    // generation on the deploy that runs this migration and rotates on the next CODE change. Rotating
+    // on absence would retire every standing seat at migration time, and again after every fresh mint.
+    `ALTER TABLE channel_session ADD COLUMN IF NOT EXISTS served_code_fingerprint text`,
+    `ALTER TABLE channel_session ADD COLUMN IF NOT EXISTS served_domain_fingerprint text`,
+    // Answerable-wake lifecycle (OPE-161): additive, all three nullable, mirrors the SQLite
+    // migration. Pre-migration rows keep NULL window_token ⇒ they never qualify for the PENDING arm
+    // of the reply fence (fail-closed), and NULL answered_at ⇒ they read as unanswered (the safe
+    // direction). RLS policy unchanged (unified_wake_target_org_isolation is row-scoped, FOR ALL, so
+    // the answered UPDATE is already permitted) and the runtime role already holds UPDATE on it.
+    `ALTER TABLE unified_wake_target ADD COLUMN IF NOT EXISTS window_token text`,
+    `ALTER TABLE unified_wake_target ADD COLUMN IF NOT EXISTS answered_at text`,
+    `ALTER TABLE unified_wake_target ADD COLUMN IF NOT EXISTS answered_turn_id text`,
+    // OPE-767: additive, nullable. A pre-migration row reads as NOT inbound, so it never appears in
+    // `listPendingUnifiedWakes` and can never make a reply look stale — a missed refusal, never a
+    // false one, which is the direction the whole freshness gate fails in.
+    `ALTER TABLE unified_wake_target ADD COLUMN IF NOT EXISTS inbound boolean`,
+    // OPE-836: additive, nullable — the turn-end wake-accounting HORIZON, mirroring the SQLite
+    // migration. A pre-migration row reads NULL ⇒ "not yet audited", so the first turn after the
+    // migration considers it once and stamps it. Only `listUnauditedUnifiedWakes` filters on this
+    // column, so it cannot change the reply-freshness gate or the answerable-reply fence. RLS unchanged
+    // (unified_wake_target_org_isolation is row-scoped, FOR ALL, so the UPDATE is already permitted)
+    // and the runtime role already holds UPDATE on the table.
+    `ALTER TABLE unified_wake_target ADD COLUMN IF NOT EXISTS audited_at text`,
+    // Frozen proposing-surface identity (task #105 — sweep-expiry decision feedback): additive,
+    // nullable, mirrors the SQLite migration. Pre-migration rows stay NULL ⇒ the TTL sweep expires
+    // them WITHOUT notice/wake feedback (the fail-safe reading).
+    `ALTER TABLE pending_actions ADD COLUMN IF NOT EXISTS posted_to text`,
+    // Cross-process single-flight claim (OPE-91): additive, both nullable, on stored_credential —
+    // mirrors the SQLite migration. The ciphertext envelope is opaque, so the CAS can't live inside it;
+    // the claim gets its OWN columns (a random, non-secret claim id + an ISO-8601 lease stamp). Never-
+    // claimed / pre-migration rows read NULL ⇒ the row is FREE (claimable), the fail-safe reading. RLS
+    // is unchanged (stored_credential_org_isolation is FOR ALL, so the claim UPDATE is already allowed).
+    `ALTER TABLE stored_credential ADD COLUMN IF NOT EXISTS claim_id text`,
+    `ALTER TABLE stored_credential ADD COLUMN IF NOT EXISTS claimed_at text`,
+    // OPE-598: `provider` → `connector` (vocabulary fix — the value was always a connector name, only
+    // the field name said otherwise; docs/glossary.md §6). Postgres has no `RENAME COLUMN IF EXISTS`
+    // (the `IF EXISTS` clause binds the TABLE, not the column), so this is guarded the same way the
+    // identity_linked_ids PK swap below is: inspect the columns, rename only when the OLD name is
+    // present and the NEW one is not — idempotent, and a no-op forever after the first run. A fresh
+    // CREATE TABLE above never has a `provider` column, so this only ever fires on a pre-existing DB.
+    `DO $$
+   BEGIN
+     IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema = 'public' AND table_name = 'stored_credential' AND column_name = 'provider')
+        AND NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema = 'public' AND table_name = 'stored_credential' AND column_name = 'connector')
+     THEN
+       ALTER TABLE stored_credential RENAME COLUMN provider TO connector;
+     END IF;
+   END
+   $$`,
+    `DO $$
+   BEGIN
+     IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema = 'public' AND table_name = 'credential_intake' AND column_name = 'provider')
+        AND NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema = 'public' AND table_name = 'credential_intake' AND column_name = 'connector')
+     THEN
+       ALTER TABLE credential_intake RENAME COLUMN provider TO connector;
+     END IF;
+   END
+   $$`,
+    // Audit hash chain (OPE-52, audit-wedge WS-6c): additive, nullable, mirrors the SQLite
+    // migration. The chain STARTS at the first row appended after this migration — pre-migration
+    // rows keep prev_sha NULL, so the boundary reads as a genesis (backfill-free; a later null-prev
+    // row after non-null rows is itself a detectable break, findChainBreak flags it). DDL runs
+    // owner-mode only (initOperationalSchema); the runtime role only INSERTs the column, which the
+    // existing SELECT+INSERT grant on audit_entry already permits — no policy/grant change needed.
+    `ALTER TABLE audit_entry ADD COLUMN IF NOT EXISTS prev_sha text`,
+    // OPE-1866: the conversation mode the anti-doxxing mask reads on the AUDIT dataset. Additive and
+    // nullable, on the same terms as the spend/usage pair, and the existing SELECT+INSERT grant on
+    // audit_entry already permits it — no policy or grant change. Nothing is backfilled: the mode was
+    // knowable only from the turn's binding, which no stored row carries, so a pre-migration row reads
+    // NULL and masks as `(unclassified)`. It sits OUTSIDE the hash prefix (agent/audit/chain.ts), so
+    // adding it breaks no existing chain link.
+    `ALTER TABLE audit_entry ADD COLUMN IF NOT EXISTS surface_mode text`,
+    // Per-routine cost attribution (OPE-145): additive, nullable, mirrors the SQLite migration.
+    // Nothing is backfilled — pre-migration `kind = 'routine'` rows honestly stay "a routine ran, we
+    // can't say which" (the marker that names it only ever lived in the fired session's auth). Same
+    // grant story as prev_sha above: DDL is owner-mode, the runtime role only INSERTs the column,
+    // which the existing SELECT+INSERT grant on usage_events already permits.
+    `ALTER TABLE usage_events ADD COLUMN IF NOT EXISTS routine_id text`,
+    // Measured cost + delegation lineage (OPE-369): additive, nullable, not backfilled — each
+    // records something only knowable AT CALL TIME (the gateway's billed figure, which cost path it
+    // took, the lineage eve seeded into that run), so a pre-migration row honestly reads NULL. Same
+    // grant story as prev_sha/routine_id above: DDL is owner-mode, and the runtime role only INSERTs
+    // these columns, which the existing SELECT+INSERT grant on usage_events already permits.
+    `ALTER TABLE usage_events ADD COLUMN IF NOT EXISTS usd_micros_measured bigint`,
+    `ALTER TABLE usage_events ADD COLUMN IF NOT EXISTS cost_source text`,
+    `ALTER TABLE usage_events ADD COLUMN IF NOT EXISTS delegation_depth integer`,
+    `ALTER TABLE usage_events ADD COLUMN IF NOT EXISTS root_session_id text`,
+    // NOT NULL DEFAULT '' backfills every existing row to the sentinel, which is correct-and-final for a vendor-global platform and 'nobody has named this yet' for a tenant-scoped one. identity/link-tenant-backfill.ts fills the latter at boot from the deployment's sole admitted tenant, or says loudly that it cannot.
+    `ALTER TABLE identity_linked_ids ADD COLUMN IF NOT EXISTS tenant text NOT NULL DEFAULT ''`,
+    `ALTER TABLE identity_link_challenges ADD COLUMN IF NOT EXISTS initiating_tenant text NOT NULL DEFAULT ''`,
+    `ALTER TABLE identity_link_challenges ADD COLUMN IF NOT EXISTS claimed_tenant text`,
+    // transport defaults to 'code', which is exactly what every pre-migration row IS - the bearer-code flow was the only one - so no backfill can be wrong.
+    `ALTER TABLE identity_link_challenges ADD COLUMN IF NOT EXISTS transport text NOT NULL DEFAULT 'code'`,
+    `ALTER TABLE identity_link_challenges ADD COLUMN IF NOT EXISTS target_platform text`,
+    `ALTER TABLE identity_link_challenges ADD COLUMN IF NOT EXISTS target_tenant text`,
+    `ALTER TABLE identity_link_challenges ADD COLUMN IF NOT EXISTS target_native_id text`,
+    `ALTER TABLE identity_link_challenges ADD COLUMN IF NOT EXISTS back_nonce_hash text`,
+    // OPE-1060 S3: where the owner's answer is reported back — a JSON ReplyTarget, pinned when the ask
+    // is raised. Additive and nullable; a pre-migration ask reads NULL, so its resolution notice is
+    // skipped rather than posted somewhere guessed.
+    `ALTER TABLE credential_grant_ask ADD COLUMN IF NOT EXISTS requester_target text`,
+    // OPE-1112: where the owner's DM card landed, so the TTL sweep can rewrite it to `expired`.
+    // Additive and nullable; a pre-migration ask reads NULL, so the sweep skips the rewrite rather
+    // than editing a guessed message.
+    `ALTER TABLE credential_grant_ask ADD COLUMN IF NOT EXISTS card_surface_id text`,
+    `ALTER TABLE credential_grant_ask ADD COLUMN IF NOT EXISTS card_message_id text`,
+    // OPE-1136: the borrow columns. A grant lends ONE vendor MCP tool with its arguments optionally
+    // frozen, so both rows carry the vendor tool name, the frozen arguments and the full mounted name;
+    // the grant row also carries the schema snapshot taken at approve. Additive and nullable. A
+    // pre-migration row reads NULL on all four, which is the honest reading: it was written by the
+    // verb-registry path OPE-1334 deleted, which named no vendor tool at all. Such a row is READ but
+    // never spendable — it refuses `no_lent_tool` at the broker and mounts nothing. NULL is NOT `{}` —
+    // see credential-grant-rows.ts for why the two must never collapse.
+    `ALTER TABLE credential_grant_ask ADD COLUMN IF NOT EXISTS mcp_tool text`,
+    `ALTER TABLE credential_grant_ask ADD COLUMN IF NOT EXISTS frozen_args text`,
+    `ALTER TABLE credential_grant_ask ADD COLUMN IF NOT EXISTS tool_name text`,
+    // OPE-1950: the room's DOMAIN-shaped seat key, recorded beside the session one so the mint binds a
+    // STANDING grant to the domain and every other mode to the session. Additive and nullable; a
+    // pre-migration ask reads NULL, and since OPE-2160 such an ask is offered no 30-day arm at all.
+    `ALTER TABLE credential_grant_ask ADD COLUMN IF NOT EXISTS domain_scope_key text`,
+    `ALTER TABLE credential_grant ADD COLUMN IF NOT EXISTS mcp_tool text`,
+    `ALTER TABLE credential_grant ADD COLUMN IF NOT EXISTS frozen_args text`,
+    `ALTER TABLE credential_grant ADD COLUMN IF NOT EXISTS tool_name text`,
+    `ALTER TABLE credential_grant ADD COLUMN IF NOT EXISTS input_schema text`,
+    `ALTER TABLE credential_grant ADD COLUMN IF NOT EXISTS refund_turn text`,
+    `ALTER TABLE credential_grant ADD COLUMN IF NOT EXISTS refund_count integer NOT NULL DEFAULT 0`,
+    `ALTER TABLE credential_grant ADD COLUMN IF NOT EXISTS refund_turn_seq bigint`,
+    // The primary-key swap has no IF NOT EXISTS form, so it inspects the existing key first: a blind DROP+ADD would rebuild the index on every cold start, and a bare ADD PRIMARY KEY errors when one is already there. It is a WIDENING, so it cannot fail on data, and it is safe to run BEFORE the tenant backfill because every row still carries tenant = '' at this point.
+    `DO $$
+   BEGIN
+     IF EXISTS (SELECT 1 FROM pg_class WHERE relname = 'identity_linked_ids' AND relkind = 'r')
+        AND NOT EXISTS (
+          SELECT 1
+            FROM pg_index i
+            JOIN pg_class c ON c.oid = i.indrelid
+            JOIN pg_attribute a ON a.attrelid = c.oid AND a.attnum = ANY(i.indkey)
+           WHERE c.relname = 'identity_linked_ids' AND i.indisprimary AND a.attname = 'tenant'
+        )
+     THEN
+       ALTER TABLE identity_linked_ids DROP CONSTRAINT IF EXISTS identity_linked_ids_pkey;
+       ALTER TABLE identity_linked_ids ADD CONSTRAINT identity_linked_ids_pkey PRIMARY KEY (org_id, platform, tenant, native_id);
+     END IF;
+   END
+   $$`,
+    // RLS. Spend + routine + overrides: FOR ALL (mutable). Audit + usage_events +
+    // domain_skill_revisions + routine_prompt_revisions: SELECT + INSERT only (append-only) AND
+    // FORCE — see the header
+    // comment for why FORCE is the load-bearing statement (it binds the table owner, which is
+    // what the app connects as).
+    `ALTER TABLE spend_ledger ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE routine ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE audit_entry ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE spend_limit ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE halt ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE connector_override ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE thread_engagement ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE channel_session ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE event_dedupe ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE ingress_delivery ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE session_tail ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE webhook_capture ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE unified_wake_target ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE thread_ownership ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE thread_seat_state ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE turn_anchor ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE task_result ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE slack_attachment ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE stored_credential ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE credential_intake ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE webhook_capture_window ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE github_installation ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE domain_skill ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE domain_skill_revisions ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE routine_prompt_revisions ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE domain_model ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE usage_events ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE pending_actions ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE pr_session_approval ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE identity_link_sets ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE identity_linked_ids ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE identity_link_challenges ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE notice_claim ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE model_call_capture ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE proactive_address ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE memory_proposal ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE credential_grant_ask ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE credential_grant ENABLE ROW LEVEL SECURITY`,
+    `ALTER TABLE dm_audience ENABLE ROW LEVEL SECURITY`,
+    // FORCE the append-only tables so RLS binds the OWNER too (the default deploy connects
+    // as the table owner; plain ENABLE lets the owner bypass all policies). This is what makes
+    // "UPDATE/DELETE denied" real on the shipped single-role deploy, not just under a separate
+    // non-owner runtime role. Idempotent: re-running FORCE on an already-forced table is a no-op.
+    `ALTER TABLE audit_entry FORCE ROW LEVEL SECURITY`,
+    `ALTER TABLE usage_events FORCE ROW LEVEL SECURITY`,
+    `ALTER TABLE domain_skill_revisions FORCE ROW LEVEL SECURITY`,
+    `ALTER TABLE routine_prompt_revisions FORCE ROW LEVEL SECURITY`,
+];
+/**
+ * The RLS policy span — DROP-then-CREATE for every policy, and NOTHING else. It is a list of its
+ * own because {@link applyPolicyStatements} must run it as ONE transaction, which the statements
+ * above must never join.
+ *
+ * 🔴 WHY IT IS SEPARATE. Postgres has no `CREATE POLICY IF NOT EXISTS`, so re-applying a policy
+ * means dropping it first. In autocommit each DROP commits on its own, and every table between the
+ * first DROP and its own CREATE carries RLS with NO policy. Postgres then denies SELECT and INSERT
+ * to every role, the owner included, because the four append-only tables also carry FORCE. A pass
+ * that ABORTS inside the span — a killed process, a connection error, a concurrent pass's
+ * `duplicate_object` — leaves the store deny-all until the next owner-mode init. Audit appends fail
+ * for that whole time, and agent/audit/audit.ts retries once and then DROPS the row. That is how
+ * `audit_entry` lost both policies on the live store on 2026-09-20 (OPE-1994). One transaction
+ * fixes it: a DROP and a CREATE inside one transaction are atomic, no other session ever sees the
+ * table policy-less, and an abort rolls the drops back.
+ *
+ * 🔴 WHY ONLY THIS SPAN. One transaction over the WHOLE array would hold ACCESS EXCLUSIVE on every
+ * table for the length of the apply (about 28 s measured on the live store, OPE-1993) and block the
+ * live app. Every statement above is `IF NOT EXISTS` or an idempotent `ALTER`, so autocommit is
+ * safe there.
+ *
+ * 🔴 THE INVARIANT: every `CREATE POLICY` here has its `DROP POLICY IF EXISTS` in THIS list. That
+ * is what makes the span self-contained, so a second pass that waits for the lock recreates from a
+ * clean slate instead of raising `duplicate_object` on a policy the first pass just created.
+ * `scripts/schema-policy-atomicity-test.ts` pins it.
+ */
+const POLICY_STATEMENTS = [
+    `DROP POLICY IF EXISTS spend_org_isolation ON spend_ledger`,
+    `DROP POLICY IF EXISTS routine_org_isolation ON routine`,
+    `DROP POLICY IF EXISTS audit_select ON audit_entry`,
+    `DROP POLICY IF EXISTS audit_insert ON audit_entry`,
+    `DROP POLICY IF EXISTS spend_limit_org_isolation ON spend_limit`,
+    `DROP POLICY IF EXISTS halt_org_isolation ON halt`,
+    `DROP POLICY IF EXISTS connector_override_org_isolation ON connector_override`,
+    `DROP POLICY IF EXISTS thread_engagement_org_isolation ON thread_engagement`,
+    `DROP POLICY IF EXISTS channel_session_org_isolation ON channel_session`,
+    `DROP POLICY IF EXISTS event_dedupe_org_isolation ON event_dedupe`,
+    `DROP POLICY IF EXISTS ingress_delivery_org_isolation ON ingress_delivery`,
+    `DROP POLICY IF EXISTS session_tail_org_isolation ON session_tail`,
+    `DROP POLICY IF EXISTS webhook_capture_org_isolation ON webhook_capture`,
+    `DROP POLICY IF EXISTS unified_wake_target_org_isolation ON unified_wake_target`,
+    `DROP POLICY IF EXISTS thread_ownership_org_isolation ON thread_ownership`,
+    `DROP POLICY IF EXISTS thread_seat_state_org_isolation ON thread_seat_state`,
+    `DROP POLICY IF EXISTS turn_anchor_org_isolation ON turn_anchor`,
+    `DROP POLICY IF EXISTS task_result_org_isolation ON task_result`,
+    `DROP POLICY IF EXISTS slack_attachment_org_isolation ON slack_attachment`,
+    `DROP POLICY IF EXISTS stored_credential_org_isolation ON stored_credential`,
+    `DROP POLICY IF EXISTS credential_intake_org_isolation ON credential_intake`,
+    `DROP POLICY IF EXISTS webhook_capture_window_org_isolation ON webhook_capture_window`,
+    `DROP POLICY IF EXISTS github_installation_org_isolation ON github_installation`,
+    `DROP POLICY IF EXISTS domain_skill_org_isolation ON domain_skill`,
+    `DROP POLICY IF EXISTS domain_skill_revisions_select ON domain_skill_revisions`,
+    `DROP POLICY IF EXISTS domain_skill_revisions_insert ON domain_skill_revisions`,
+    `DROP POLICY IF EXISTS routine_prompt_revisions_select ON routine_prompt_revisions`,
+    `DROP POLICY IF EXISTS routine_prompt_revisions_insert ON routine_prompt_revisions`,
+    `DROP POLICY IF EXISTS domain_model_org_isolation ON domain_model`,
+    `DROP POLICY IF EXISTS usage_events_select ON usage_events`,
+    `DROP POLICY IF EXISTS usage_events_insert ON usage_events`,
+    `DROP POLICY IF EXISTS pending_actions_org_isolation ON pending_actions`,
+    `DROP POLICY IF EXISTS pr_session_approval_org_isolation ON pr_session_approval`,
+    `DROP POLICY IF EXISTS identity_link_sets_org_isolation ON identity_link_sets`,
+    `DROP POLICY IF EXISTS identity_linked_ids_org_isolation ON identity_linked_ids`,
+    `DROP POLICY IF EXISTS identity_link_challenges_org_isolation ON identity_link_challenges`,
+    `DROP POLICY IF EXISTS notice_claim_org_isolation ON notice_claim`,
+    `DROP POLICY IF EXISTS model_call_capture_org_isolation ON model_call_capture`,
+    `DROP POLICY IF EXISTS proactive_address_org_isolation ON proactive_address`,
+    `DROP POLICY IF EXISTS memory_proposal_org_isolation ON memory_proposal`,
+    `DROP POLICY IF EXISTS credential_grant_ask_org_isolation ON credential_grant_ask`,
+    `DROP POLICY IF EXISTS credential_grant_org_isolation ON credential_grant`,
+    `DROP POLICY IF EXISTS dm_audience_org_isolation ON dm_audience`,
+    `CREATE POLICY spend_org_isolation ON spend_ledger
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY routine_org_isolation ON routine
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    // audit_entry: append-only AND org-keyed (OPE-1812). Append-only is the SHAPE of this pair —
+    // SELECT and INSERT policies only, no UPDATE/DELETE policy, so those two verbs are denied under
+    // FORCE for every non-superuser role, the owner included. That part is unchanged and does not
+    // depend on the GUC.
+    //
+    // The org predicate is the same ORG_GUC the mutable tables carry, for the same reason and with
+    // the same bound: it ENFORCES where a deployment sets app.current_org and PERMITS where the GUC
+    // is unset. These policies read `USING (true)`, which said the database would hand any session
+    // every tenant's audit rows; the permit-when-unset predicate says it plainly instead, and it
+    // narrows for free on any deployment that wires the GUC. 🔴 NOTHING IN THE SHIPPED RUNTIME SETS
+    // THAT GUC (setOrgContext has no non-test caller), so this is a latent second layer and NOT the
+    // control today: the control is the REQUIRED org at the store boundary — readAudit refuses a
+    // read without one (store.ts auditReadOrg) and appendAudit writes the row's own org. Do not cite
+    // this policy as the log's tenancy on a deployment that sets no GUC.
+    //
+    // 🔴 A DEPLOYMENT THAT SETS THE GUC NARROWS THE CROSS-ORG READS TOO: listAuditOrgs() and the
+    // chain verifier (scripts/verify-audit-chain.ts) walk every org, and under a set GUC they see
+    // one. Set it per request, never once per process, or run those on a session that leaves it unset.
+    //
+    // 🔴 THE UPGRADE WRITES ONE audit.integrity ROW, AND IT IS THE MIGRATION, NOT TAMPERING. An
+    // existing store carries the old `USING (true)` pair, which no longer matches EXPECTED_POLICIES.
+    // The first OWNER-mode boot therefore counts it as a violation, healUnexpectedArtifacts DROPs
+    // both policies as unexpected, the re-apply recreates them, and the boot logs the repair and
+    // records ONE audit.integrity row naming audit_entry.audit_select and audit_entry.audit_insert.
+    // That row is this repository's evidence-of-tampering signal, so an incident responder reading
+    // the chain must be able to tell this one apart: it is the upgrade to OPE-1812, it names exactly
+    // those two policies, and it sits at the first boot on the new code.
+    // 🔴 ON A TWO-ROLE DEPLOYMENT, RUN THE OWNER BOOT FIRST. The runtime role cannot heal: it records
+    // the same row and THROWS (see initOperationalSchema's `owner === false` branch), so an app tier
+    // that reaches the new code before the owner boot refuses to start.
+    `CREATE POLICY audit_select ON audit_entry FOR SELECT USING ${ORG_GUC}`,
+    `CREATE POLICY audit_insert ON audit_entry FOR INSERT WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY spend_limit_org_isolation ON spend_limit
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY halt_org_isolation ON halt
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY connector_override_org_isolation ON connector_override
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY thread_engagement_org_isolation ON thread_engagement
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY channel_session_org_isolation ON channel_session
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY event_dedupe_org_isolation ON event_dedupe
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY ingress_delivery_org_isolation ON ingress_delivery
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY session_tail_org_isolation ON session_tail
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    // webhook_capture holds third-party payload projections and takes the same enforce-when-set / permit-when-unset arm as every other mutable table. Under the single-role deploy the GUC is unwired and this policy permits, so the load-bearing isolation is the org_id filter on all four of its statements - stated here because on THIS table over-reading what RLS buys would be the expensive kind of wrong.
+    `CREATE POLICY webhook_capture_org_isolation ON webhook_capture
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY unified_wake_target_org_isolation ON unified_wake_target
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY thread_ownership_org_isolation ON thread_ownership
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    // thread_seat_state is read-write like thread_ownership (a TTL-pruned per-thread row with an
+    // explicit rewrite at hand-back) — same ENFORCE-WHEN-SET / PERMIT-WHEN-UNSET GUC arm. It holds a
+    // thread seat's own REPORT TEXT, so the policy is the fence between one tenant's report and
+    // another tenant's reader.
+    `CREATE POLICY thread_seat_state_org_isolation ON thread_seat_state
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    // turn_anchor is read-write like thread_ownership (a short-TTL routing map with a real clear) —
+    // same ENFORCE-WHEN-SET / PERMIT-WHEN-UNSET GUC arm as the other mutable tables. 🔴 THE POLICY IS
+    // THE ONLY THING BETWEEN A CANCEL AND ANOTHER TENANT'S TURN: the ingress stop path resolves an
+    // anchor by a channel/message key an outside party controls the shape of, so a missing policy
+    // here would fail SILENTLY as a cross-org cancel, not as an error.
+    `CREATE POLICY turn_anchor_org_isolation ON turn_anchor
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY task_result_org_isolation ON task_result
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY slack_attachment_org_isolation ON slack_attachment
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY stored_credential_org_isolation ON stored_credential
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY credential_intake_org_isolation ON credential_intake
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    // Every lookup of a capture window already knows its org, because a window is only ever reached through a hook this deployment's config declares rather than through a bare URL segment. So unlike a URL-addressed table this one needs no cross-org caveat.
+    `CREATE POLICY webhook_capture_window_org_isolation ON webhook_capture_window
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY github_installation_org_isolation ON github_installation
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY domain_skill_org_isolation ON domain_skill
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    // domain_skill_revisions is append-only on the same GUC-free terms as audit_entry: SELECT and INSERT policies only under FORCE, so UPDATE and DELETE are denied to every non-superuser role, the owner included. No retention path is given up here, because nothing was ever going to prune it.
+    `CREATE POLICY domain_skill_revisions_select ON domain_skill_revisions FOR SELECT USING (true)`,
+    `CREATE POLICY domain_skill_revisions_insert ON domain_skill_revisions FOR INSERT WITH CHECK (true)`,
+    // routine_prompt_revisions is append-only on the same GUC-free terms. The denial does more work here than on any other table: the runtime role holds full CRUD on routine itself, so whoever holds the app's credential can already rewrite what fires unattended - what they must not be able to rewrite is the record of the text a human armed.
+    `CREATE POLICY routine_prompt_revisions_select ON routine_prompt_revisions FOR SELECT USING (true)`,
+    `CREATE POLICY routine_prompt_revisions_insert ON routine_prompt_revisions FOR INSERT WITH CHECK (true)`,
+    `CREATE POLICY domain_model_org_isolation ON domain_model
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    // usage_events is append-only at the DB layer: SELECT and INSERT policies only under FORCE, so UPDATE and DELETE are denied to every non-superuser role including the owner. That is the cost of the trade - pruneUsageEvents is a documented no-op under Postgres, and real retention needs a maintenance path outside the app role.
+    `CREATE POLICY usage_events_select ON usage_events FOR SELECT USING (true)`,
+    `CREATE POLICY usage_events_insert ON usage_events FOR INSERT WITH CHECK (true)`,
+    // pending_actions is read-write (mutable, FOR ALL) like spend_limit/connector_override —
+    // the CAS guarantee lives in the query (WHERE status='pending'), not in RLS.
+    `CREATE POLICY pending_actions_org_isolation ON pending_actions
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY pr_session_approval_org_isolation ON pr_session_approval
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    // The three identity link tables are read-write like domain_skill — same ENFORCE-WHEN-SET /
+    // PERMIT-WHEN-UNSET GUC arm as every other mutable table. NOT append-only: a link-set is state
+    // a person severs and an admin suspends, so it needs real UPDATE/DELETE. What must not be
+    // rewritable is the RECORD of who linked what and on whose evidence, and that lives in
+    // `audit_entry` (DB-enforced append-only), which identity/link-store.ts writes on every
+    // mutation — the same split domain_skill ⇄ domain_skill_revisions makes.
+    `CREATE POLICY identity_link_sets_org_isolation ON identity_link_sets
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY identity_linked_ids_org_isolation ON identity_linked_ids
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY identity_link_challenges_org_isolation ON identity_link_challenges
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY notice_claim_org_isolation ON notice_claim
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY model_call_capture_org_isolation ON model_call_capture
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY proactive_address_org_isolation ON proactive_address
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY memory_proposal_org_isolation ON memory_proposal
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY credential_grant_ask_org_isolation ON credential_grant_ask
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY credential_grant_org_isolation ON credential_grant
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+    `CREATE POLICY dm_audience_org_isolation ON dm_audience
+     USING ${ORG_GUC}
+     WITH CHECK ${ORG_GUC}`,
+];
+/** The DB-enforced append-only tables (see the header). */
+const APPEND_ONLY_TABLES = ["audit_entry", "usage_events", "domain_skill_revisions", "routine_prompt_revisions"];
+/** One `dm_audience` row → {@link DmAudienceRow}. A NULL timestamp is dropped rather than carried as
+ *  `null`, so a caller reads absence as absence and never has to test two spellings of "not set". */
+function dmAudienceRowFrom(r) {
+    return {
+        address: r.address,
+        ...(r.first_dm_at === null ? {} : { firstDmAt: r.first_dm_at }),
+        ...(r.stopped_at === null ? {} : { stoppedAt: r.stopped_at }),
+    };
+}
+const EXPECTED_POLICIES = {
+    audit_entry: [
+        { name: "audit_select", permissive: true, cmd: "r", qual: isOrgGucExpr, withCheck: null },
+        { name: "audit_insert", permissive: true, cmd: "a", qual: null, withCheck: isOrgGucExpr },
+    ],
+    usage_events: [
+        { name: "usage_events_select", permissive: true, cmd: "r", qual: "true", withCheck: null },
+        { name: "usage_events_insert", permissive: true, cmd: "a", qual: null, withCheck: "true" },
+    ],
+    domain_skill_revisions: [
+        { name: "domain_skill_revisions_select", permissive: true, cmd: "r", qual: "true", withCheck: null },
+        { name: "domain_skill_revisions_insert", permissive: true, cmd: "a", qual: null, withCheck: "true" },
+    ],
+    routine_prompt_revisions: [
+        { name: "routine_prompt_revisions_select", permissive: true, cmd: "r", qual: "true", withCheck: null },
+        { name: "routine_prompt_revisions_insert", permissive: true, cmd: "a", qual: null, withCheck: "true" },
+    ],
+};
+function expressionMatches(found, expected) {
+    return typeof expected === "function" ? expected(found) : found === expected;
+}
+function policyMatchesExpected(p, e) {
+    return p.name === e.name && p.permissive === e.permissive && p.cmd === e.cmd && expressionMatches(p.qual, e.qual) && expressionMatches(p.withcheck, e.withCheck);
+}
+async function policiesOn(client, table) {
+    const { rows } = await client.query(`SELECT p.polname AS name, p.polpermissive AS permissive, p.polcmd AS cmd,
+            pg_get_expr(p.polqual, p.polrelid) AS qual,
+            pg_get_expr(p.polwithcheck, p.polrelid) AS withcheck
+     FROM pg_policy p WHERE p.polrelid = to_regclass($1)`, [table]);
+    return rows.map((r) => ({
+        name: r.name,
+        permissive: r.permissive,
+        cmd: r.cmd,
+        qual: r.qual,
+        withcheck: r.withcheck,
+    }));
+}
+function triggerEvents(tgtype) {
+    const ev = [];
+    if (tgtype & 4)
+        ev.push("INSERT");
+    if (tgtype & 8)
+        ev.push("DELETE");
+    if (tgtype & 16)
+        ev.push("UPDATE");
+    if (tgtype & 32)
+        ev.push("TRUNCATE");
+    return ev;
+}
+/** Every NON-internal trigger on `table` (constraint/FK triggers are internal → excluded). */
+async function nonInternalTriggers(client, table) {
+    const { rows } = await client.query(`SELECT t.tgname AS name, t.tgtype AS tgtype
+     FROM pg_trigger t WHERE t.tgrelid = to_regclass($1) AND NOT t.tgisinternal`, [table]);
+    return rows.map((r) => ({ name: r.name, tgtype: Number(r.tgtype) }));
+}
+/** Every UPDATE/DELETE/TRUNCATE grant on table held by a role OTHER than the owner - an owner GRANT slip that would let the runtime role, or PUBLIC, mutate the append-only log despite RLS. aclexplode over pg_class.relacl means no runtime-role name is needed, so a bad grant to ANY grantee is caught, and token comes back REVOKE-ready (a quoted role name, or the literal PUBLIC). */
+async function badMutationGrants(client, table) {
+    const { rows } = await client.query(`SELECT DISTINCT
+        CASE WHEN g.grantee = 0 THEN 'PUBLIC' ELSE quote_ident(r.rolname) END AS token,
+        CASE WHEN g.grantee = 0 THEN 'PUBLIC' ELSE r.rolname END          AS label,
+        g.privilege_type AS privilege
+     FROM (
+       SELECT ae.grantee AS grantee, ae.privilege_type AS privilege_type, c.relowner AS relowner
+       FROM pg_class c CROSS JOIN LATERAL aclexplode(c.relacl) ae
+       WHERE c.oid = to_regclass($1)
+     ) g
+     LEFT JOIN pg_roles r ON r.oid = g.grantee
+     WHERE g.privilege_type IN ('UPDATE', 'DELETE', 'TRUNCATE') AND g.grantee <> g.relowner`, [table]);
+    return rows;
+}
+/**
+ * Does the CURRENT role own (or inherit ownership of, via role membership — the same
+ * test Postgres itself applies to DDL) the audit table? `null` when the table doesn't
+ * exist yet (fresh database). Drives initOperationalSchema's owner-vs-runtime split.
+ */
+async function ownsAuditTable(client) {
+    const { rows } = await client.query(`SELECT pg_has_role(current_user, c.relowner, 'USAGE') AS is_owner
+     FROM pg_class c WHERE c.oid = to_regclass('audit_entry')`);
+    const r = rows[0];
+    return r ? r.is_owner === true : null;
+}
+/**
+ * The tail of every violation sentence {@link auditIntegrityCause} reads. The producers below build
+ * their messages from these constants, and the classifier matches on them, so a reworded violation
+ * cannot silently stop naming a cause. The sentences stay human-readable: they are what a responder
+ * sees in the `audit.integrity` row and on the console.
+ */
+const VIOLATION_SUFFIX = {
+    noInsertPolicy: ": no INSERT policy — appends would be denied under FORCE",
+    noSelectPolicy: ": no SELECT policy — reads would be denied under FORCE",
+    foreignPolicy: " — not in the append-only allowlist",
+    mutatingPolicy: " — append-only defeated",
+    hostileTrigger: " — could suppress or alter audit writes",
+    badGrant: " — a non-owner could mutate the append-only log",
+};
+/** The violations that name an artifact SOMEBODY ADDED. Each one is a thing the store never creates
+ *  for itself, so its presence is the tampering signature. */
+const TAMPER_SUFFIXES = [VIOLATION_SUFFIX.foreignPolicy, VIOLATION_SUFFIX.mutatingPolicy, VIOLATION_SUFFIX.hostileTrigger, VIOLATION_SUFFIX.badGrant];
+/** Verify the append-only posture of every APPEND_ONLY_TABLES entry as it ACTUALLY stands in the catalog: RLS enabled and FORCED, the full policy set matching the EXPECTED_POLICIES allowlist, no non-internal INSERT/UPDATE/DELETE trigger, and no non-owner UPDATE/DELETE/TRUNCATE grant. Returns human-readable violations, empty when sound; it is read-only and safe under any role, so the non-owner runtime boot can call it. */
+export async function verifyAppendOnlyAudit(client) {
+    const violations = [];
+    for (const table of APPEND_ONLY_TABLES) {
+        const { rows } = await client.query(`SELECT c.relrowsecurity AS rls, c.relforcerowsecurity AS force
+       FROM pg_class c WHERE c.oid = to_regclass($1)`, [table]);
+        const t = rows[0];
+        if (!t) {
+            violations.push(`${table}: table missing`);
+            continue;
+        }
+        if (t.rls !== true)
+            violations.push(`${table}: ROW LEVEL SECURITY is disabled`);
+        if (t.force !== true)
+            violations.push(`${table}: FORCE ROW LEVEL SECURITY is off (owner would bypass policies)`);
+        const pols = await policiesOn(client, table);
+        const expected = EXPECTED_POLICIES[table] ?? [];
+        // polcmd: r=SELECT a=INSERT w=UPDATE d=DELETE *=ALL
+        for (const p of pols) {
+            if (p.cmd === "w" || p.cmd === "d" || p.cmd === "*") {
+                violations.push(`${table}: policy "${p.name}" permits ${p.cmd === "w" ? "UPDATE" : p.cmd === "d" ? "DELETE" : "ALL"}${VIOLATION_SUFFIX.mutatingPolicy}`);
+            }
+            if (!expected.some((e) => policyMatchesExpected(p, e))) {
+                violations.push(`${table}: unexpected ${p.permissive ? "permissive" : "RESTRICTIVE"} policy "${p.name}" (cmd ${p.cmd})${VIOLATION_SUFFIX.foreignPolicy}`);
+            }
+        }
+        if (!pols.some((p) => p.cmd === "a"))
+            violations.push(`${table}${VIOLATION_SUFFIX.noInsertPolicy}`);
+        if (!pols.some((p) => p.cmd === "r"))
+            violations.push(`${table}${VIOLATION_SUFFIX.noSelectPolicy}`);
+        for (const tr of await nonInternalTriggers(client, table)) {
+            const ev = triggerEvents(tr.tgtype);
+            if (ev.some((e) => e === "INSERT" || e === "UPDATE" || e === "DELETE")) {
+                violations.push(`${table}: hostile trigger "${tr.name}" (${ev.join("/")})${VIOLATION_SUFFIX.hostileTrigger}`);
+            }
+        }
+        for (const g of await badMutationGrants(client, table)) {
+            violations.push(`${table}: role "${g.label}" holds a ${g.privilege} grant${VIOLATION_SUFFIX.badGrant}`);
+        }
+    }
+    return violations;
+}
+/** Owner-only surgical repair of the suppression vectors SCHEMA_STATEMENTS cannot fix by re-CREATE alone: a foreign or RESTRICTIVE policy, a hostile trigger, a stray grant. Strictly scoped to APPEND_ONLY_TABLES and to artifacts outside the known-good set; a no-op on a sound posture. A hostile trigger and a stray grant are repaired HERE, in autocommit: neither leaves a table policy-less, and both must precede the `audit.integrity` INSERT, which a trigger could otherwise swallow. A foreign policy is only collected — see {@link HealPlan.policyDrops}. */
+async function healUnexpectedArtifacts(client) {
+    const droppedPolicies = [];
+    const droppedTriggers = [];
+    const revokedGrants = [];
+    const policyDrops = [];
+    for (const table of APPEND_ONLY_TABLES) {
+        // A missing table has no policies/triggers/grants to enumerate (the queries return
+        // empty) and is repaired by the schema re-apply — nothing to heal here.
+        const expected = EXPECTED_POLICIES[table] ?? [];
+        for (const p of await policiesOn(client, table)) {
+            if (!expected.some((e) => policyMatchesExpected(p, e))) {
+                policyDrops.push(`DROP POLICY IF EXISTS ${quoteIdent(p.name)} ON ${table}`);
+                droppedPolicies.push(`${table}.${p.name}`);
+            }
+        }
+        for (const tr of await nonInternalTriggers(client, table)) {
+            await client.query(`DROP TRIGGER IF EXISTS ${quoteIdent(tr.name)} ON ${table}`);
+            droppedTriggers.push(`${table}.${tr.name}`);
+        }
+        for (const g of await badMutationGrants(client, table)) {
+            // g.token is a REVOKE-ready identifier (quoted role name or the literal PUBLIC),
+            // derived by quote_ident in the query — never raw user input.
+            await client.query(`REVOKE UPDATE, DELETE, TRUNCATE ON ${table} FROM ${g.token}`);
+            revokedGrants.push(`${table}:${g.label}:${g.privilege}`);
+        }
+    }
+    return { heal: { droppedPolicies, droppedTriggers, revokedGrants }, policyDrops };
+}
+function quoteIdent(name) {
+    return `"${name.replace(/"/g, '""')}"`;
+}
+/** Did the heal pass remove anything? The audit row and the console line both need that fact, and
+ *  an EMPTY heal is half of the aborted-init signature, so the two readers share one definition. */
+function healedAnything(heal) {
+    return heal !== undefined && (heal.droppedPolicies.length > 0 || heal.droppedTriggers.length > 0 || heal.revokedGrants.length > 0);
+}
+/**
+ * Name the CAUSE of a posture violation, so the heal reports what happened instead of hiding it
+ * (OPE-1994). Each answer names a CATALOG STATE. It does not name a history, because the catalog
+ * carries none — read each one as "what is true", then look for who did it:
+ *
+ * - **aborted-init** — a table stands with RLS forced and NO policy, and the heal found nothing to
+ *   remove. An init that aborted inside the policy span leaves exactly this state. 🔴 So does an
+ *   owner-credential `DROP POLICY`, which is the attack FORCE cannot stop, so this answer does NOT
+ *   rule a tamper out — check who held owner DDL in the window. Either way every audit append was
+ *   denied until this boot, and agent/audit/audit.ts dropped each row it could not append. That
+ *   loss is NOT recoverable — this row is the only record of it.
+ * - **tampering** — an artifact outside the current allowlist is present: a policy, a trigger or a
+ *   mutation grant this schema never creates. An older release's own shape reads the same way (the
+ *   pre-OPE-1812 `USING (true)` audit policies, for one), so check the release history before
+ *   treating it as an intrusion.
+ *
+ * Tampering WINS when both hold. An aborted span can only ever remove, so an added artifact is the
+ * stronger evidence and the one a responder must see first. Anything else — RLS off, FORCE off, a
+ * missing table — is `unknown`: real, and outside both signatures.
+ */
+export function auditIntegrityCause(violations, healedArtifacts) {
+    if (healedArtifacts || violations.some((v) => TAMPER_SUFFIXES.some((suffix) => v.endsWith(suffix))))
+        return "tampering";
+    if (violations.some((v) => v.endsWith(VIOLATION_SUFFIX.noInsertPolicy) || v.endsWith(VIOLATION_SUFFIX.noSelectPolicy)))
+        return "aborted-init";
+    return "unknown";
+}
+/** One sentence per cause, for the console line a responder reads before anything else. */
+const CAUSE_NOTE = {
+    "aborted-init": "a table stood with row-level security forced and NO policy, and the heal removed nothing — an init aborted inside the policy span leaves this, and so does an owner-credential DROP POLICY; every audit append since was denied and its row dropped",
+    tampering: "an artifact outside the current allowlist was present — a policy, trigger or grant this schema never creates, or one an older release created; check the release history before treating it as an intrusion",
+    unknown: "neither the aborted-init nor the tampering signature explains this state — read the violations",
+};
+/** Record a detected posture violation IN the audit log itself - a direct INSERT, because this runs at boot before the store singleton exists, and best-effort: if the log cannot take the row, the caller's throw is the signal. The org MUST come from deploymentOrg() and never from a second normaliser, or the row lands in a partition readAudit never queries and links onto the wrong chain. */
+async function recordAuditIntegrity(client, violations, healed, heal) {
+    const healedArtifacts = healedAnything(heal);
+    // `cause` is what separates an aborted init from tampering for whoever reads this row months
+    // later; the violations alone read the same either way.
+    const detail = { violations, healed, cause: auditIntegrityCause(violations, healedArtifacts) };
+    if (healedArtifacts) {
+        detail.healed_artifacts = heal;
+    }
+    const org = deploymentOrg();
+    const ts = new Date().toISOString();
+    try {
+        // Chain-link this row like a normal append: a bare NULL prev_sha here would look like a genesis planted mid-chain and read as a false break. It takes the SAME serialised append as every other row, so a boot that repairs the append-only posture cannot fork the chain it is recording.
+        const insert = async (conn, prevSha) => {
+            await conn.query(`INSERT INTO audit_entry (ts, org_id, platform, workspace, action, detail, prev_sha)
+         VALUES ($1, $2, 'db', 'postgres', 'audit.integrity', $3, $4)`, [ts, org, JSON.stringify(detail), prevSha]);
+        };
+        try {
+            await withAuditChainLock(client, org, async (conn) => insert(conn, await nextAuditPrevSha(conn, org)));
+        }
+        catch (chainErr) {
+            // RECORDING THE VIOLATION BEATS A PERFECT LINK. If the chained append cannot run at all
+            // (the posture repair may have left the table half-usable, which is the whole reason this
+            // row exists), write the row UNCHAINED rather than lose it — and say so, because a null
+            // prev_sha mid-chain is exactly what the verifier reports as a break.
+            console.error(`[open-everywhere:operational] the audit.integrity row could not be chain-linked (${String(chainErr)}); ` +
+                "writing it UNCHAINED — the chain verifier will report a break at this row.");
+            await insert(client, null);
+        }
+    }
+    catch (err) {
+        console.error(`[open-everywhere:operational] could not record audit.integrity row: ${String(err)}`);
+    }
+}
+// The chain link is a read-tail-then-insert, so two writers that read the same tail stamp the same prev_sha and FORK the chain - measured at 6,966 broken links across 53,218 rows on the live store. The critical section is therefore a transaction on a pinned connection behind pg_advisory_xact_lock, whose xact form releases at COMMIT so no lock survives the connection's return to the pool; with no withConnection seam the append falls back to a plain read-then-insert, correct only for a single-process engine.
+/** Advisory-lock class for the audit chain — the first 4 bytes of sha256("open-everywhere:
+ *  audit-chain"), read as a signed int32. A class of its own keeps the org keys below from
+ *  colliding with any other advisory-lock user in the same database. */
+const AUDIT_CHAIN_LOCK_CLASS = createHash("sha256").update("open-everywhere:audit-chain").digest().readInt32BE(0);
+/** The per-org advisory-lock key: the first 4 bytes of sha256(org) as a signed int32. Derived
+ *  in Node rather than with Postgres's `hashtext` so the value does not depend on an internal
+ *  server function, and so a test can name the exact key the append must take. */
+export function auditChainLockKey(org) {
+    return createHash("sha256").update(org).digest().readInt32BE(0);
+}
+/** Advisory-lock class for the schema's policy span — the first 4 bytes of
+ *  sha256("open-everywhere:schema-policy"), read as a signed int32. A class of its own keeps the
+ *  span apart from the audit-chain keys above, so a boot that re-applies the policies never waits
+ *  on an append and never makes one wait. A TRACKED literal, never an env var. */
+const SCHEMA_POLICY_LOCK_CLASS = createHash("sha256").update("open-everywhere:schema-policy").digest().readInt32BE(0);
+/** The one key in that class. The span is a single critical section per database — it re-applies
+ *  EVERY org's policies at once — so unlike the audit chain it needs no per-org key. */
+const SCHEMA_POLICY_LOCK_KEY = createHash("sha256").update("open-everywhere:operational-policy-span").digest().readInt32BE(0);
+/** How long the policy span waits for a lock. It bounds two waits: the advisory lock another init
+ *  pass holds, and the ACCESS EXCLUSIVE lock each DROP/CREATE POLICY takes on its table. A timeout
+ *  ABORTS the transaction, which rolls the span back and leaves every policy in place, so the cost
+ *  of the bound is a failed boot and never a deny-all store. The value is generous because the span
+ *  is a boot path, not a hot path: it must outlast another pass's span (about 5 s, derived from the
+ *  28 s apply, never measured on its own) rather than give up beside it. A TRACKED literal, never
+ *  an env var. */
+const SCHEMA_POLICY_LOCK_TIMEOUT_MS = 60_000;
+/** How long an append waits for the per-org advisory lock. pg_advisory_xact_lock waits FOREVER by default and appendAudit is awaited on the hot path, so without a bound one wedged holder stalls every other instance's appends for that org; on timeout agent/audit/audit.ts retries once and then drops the row with its counter and warn. It is a TRACKED literal, never an env var. */
+const AUDIT_CHAIN_LOCK_TIMEOUT_MS = 10_000;
+/** One org's audit rows OLDEST-first with their seq + prev_sha — the hash-chain walk's input.
+ *  Takes the client explicitly so the epoch seal can read the chain on the SAME pinned
+ *  connection its INSERT runs on (OPE-1636), not through the pool. tailLimit>0 → the last N by
+ *  seq, then reversed to oldest-first (an inner DESC+LIMIT subquery, the outer re-orders ASC). */
+async function readAuditChainRows(client, org, tail) {
+    const cols = "seq, ts, org_id, platform, workspace, surface, surface_mode, principal_id, action, detail, prev_sha";
+    const sql = tail && tail > 0
+        ? `SELECT ${cols} FROM (
+           SELECT ${cols} FROM audit_entry WHERE org_id = $1 ORDER BY seq DESC LIMIT $2
+         ) sub ORDER BY seq ASC`
+        : `SELECT ${cols} FROM audit_entry WHERE org_id = $1 ORDER BY seq ASC`;
+    const { rows } = await client.query(sql, tail && tail > 0 ? [org, tail] : [org]);
+    return rows.map((r) => ({
+        seq: Number(r.seq),
+        ts: r.ts,
+        org: r.org_id,
+        platform: r.platform,
+        workspace: r.workspace,
+        ...(r.surface ? { surface: r.surface } : {}),
+        ...auditSurfaceMode(r.surface_mode),
+        ...(r.principal_id ? { principalId: r.principal_id } : {}),
+        action: r.action,
+        ...(r.detail ? { detail: JSON.parse(r.detail) } : {}),
+        prevSha: r.prev_sha,
+    }));
+}
+/** The orgs whose audit-chain critical section the CURRENT async context already holds, each
+ *  mapped to the connection that section runs on. Both locks below are NON-REENTRANT on their
+ *  own, so a re-entry would wait on itself forever; this is what tells one apart from a genuine
+ *  second writer. */
+const heldAuditChainLocks = new AsyncLocalStorage();
+/** Run body inside the per-org audit-chain critical section: body gets the connection to read the tail from and to insert on - the same connection, inside one transaction, whenever the client can pin one. The in-process lock wraps the transaction because an embedded engine has ONE connection and would otherwise nest a BEGIN, and the whole thing MUST stay reentrant: a deferred schema init can write an audit.integrity row from inside an append's own section, and without the re-entry check the lock waits on itself for the life of the process. */
+async function withAuditChainLock(client, org, body) {
+    const held = heldAuditChainLocks.getStore();
+    const outer = held?.get(org);
+    if (outer !== undefined)
+        return await body(outer);
+    return withOrgAuditLock(org, async () => {
+        const next = new Map(held ?? []);
+        if (!client.withConnection) {
+            next.set(org, client);
+            return await heldAuditChainLocks.run(next, () => body(client));
+        }
+        return await client.withConnection(async (conn) => {
+            next.set(org, conn);
+            await conn.query("BEGIN");
+            try {
+                // SET LOCAL, so the bound dies with the transaction and never leaks onto a pooled
+                // connection — the same reason the advisory lock is the xact form. The value is a module
+                // constant interpolated as a literal because a utility statement takes no bind parameter.
+                await conn.query(`SET LOCAL lock_timeout = ${AUDIT_CHAIN_LOCK_TIMEOUT_MS}`);
+                await conn.query("SELECT pg_advisory_xact_lock($1::int, $2::int)", [AUDIT_CHAIN_LOCK_CLASS, auditChainLockKey(org)]);
+                const result = await heldAuditChainLocks.run(next, () => body(conn));
+                await conn.query("COMMIT");
+                return result;
+            }
+            catch (err) {
+                // ROLLBACK is what releases the advisory lock on a failed append. Its own failure is
+                // swallowed — the original error is the one the caller must see — and `withConnection`
+                // is told about the failure so the driver can DESTROY the connection instead of
+                // returning a still-in-transaction one, holding this org's lock, to the pool.
+                await conn.query("ROLLBACK").catch(() => undefined);
+                throw err;
+            }
+        });
+    });
+}
+/** Boot note (OPE-1636): a Postgres client with no `withConnection` cannot open the transaction
+ *  the chain append needs, so its appends serialise only inside this process. Warn ONCE per
+ *  process. The embedded PGlite floor is the expected, correct case — it holds a single-writer
+ *  file lock, so one process is all there is — and the message says so rather than crying wolf. */
+let auditChainSerialisationWarned = false;
+function warnIfAuditChainCannotSerialise(client) {
+    if (client.withConnection || auditChainSerialisationWarned)
+        return;
+    auditChainSerialisationWarned = true;
+    console.warn("[open-everywhere:operational] this Postgres client offers no withConnection seam, so audit-chain appends are serialised " +
+        "IN-PROCESS ONLY. That is correct for the embedded PGlite floor (one writer by construction). On a POOLED hosted client it " +
+        "means concurrent instances can fork the chain — give the client a withConnection implementation " +
+        "(packages/adapters/agent/postgres/neon.ts is the reference).");
+}
+export function _resetAuditChainSerialisationWarnForTest() {
+    auditChainSerialisationWarned = false;
+}
+/** Compute the OPE-52 hash-chain prev_sha for the NEXT audit row of `org`: sha256 of the org's
+ *  current last row (by seq), or null when the org has no rows yet (genesis). Shared by the
+ *  store's appendAudit and recordAuditIntegrity. */
+async function nextAuditPrevSha(client, org) {
+    const { rows } = await client.query(`SELECT ts, org_id, platform, workspace, surface, surface_mode, principal_id, action, detail, prev_sha
+     FROM audit_entry WHERE org_id = $1 ORDER BY seq DESC LIMIT 1`, [org]);
+    const last = rows[0];
+    if (!last)
+        return null;
+    return auditRowSha({
+        org: last.org_id,
+        ts: last.ts,
+        platform: last.platform,
+        workspace: last.workspace,
+        ...(last.surface ? { surface: last.surface } : {}),
+        // Through the same reading the report gets (auditSurfaceMode): a stored value outside the
+        // enum hashes as ABSENT, or the link would break on a row nobody touched.
+        ...auditSurfaceMode(last.surface_mode),
+        ...(last.principal_id ? { principalId: last.principal_id } : {}),
+        action: last.action,
+        ...(last.detail ? { detail: JSON.parse(last.detail) } : {}),
+    }, last.prev_sha);
+}
+/** A client with no `withConnection` seam cannot open the policy span's transaction, so the
+ *  deny-all window {@link POLICY_STATEMENTS} describes stays open on it. Warn ONCE per process.
+ *  The embedded PGlite floor is the expected, correct case — one connection, one writer, and a
+ *  killed process takes the whole store with it — and the message says so. */
+let policySpanAtomicityWarned = false;
+function warnIfPolicySpanCannotBeAtomic(client) {
+    if (client.withConnection || policySpanAtomicityWarned)
+        return;
+    policySpanAtomicityWarned = true;
+    console.warn("[open-everywhere:operational] this Postgres client offers no withConnection seam, so the RLS policy span re-applies in " +
+        "AUTOCOMMIT. That is correct for the embedded PGlite floor. On a POOLED hosted client it means a pass that aborts inside " +
+        "the span leaves the append-only tables with NO policy — deny-all — until the next owner-mode init. A one-connection " +
+        "engine can run BEGIN and COMMIT; what this seam buys is the proof that every statement lands on ONE connection. Give the client a " +
+        "withConnection implementation (packages/adapters/agent/postgres/neon.ts is the reference).");
+}
+/** Let a test drive the once-per-process warning above more than once. Without it the only signal a
+ *  pooled hosted deployment gets that its policy span is NOT atomic is one line nothing asserts. */
+export function _resetPolicySpanAtomicityWarnForTest() {
+    policySpanAtomicityWarned = false;
+}
+/**
+ * Apply {@link POLICY_STATEMENTS} as ONE atomic, serialised unit: a transaction on a pinned
+ * connection, behind `pg_advisory_xact_lock`. The lock makes two concurrent inits take the span in
+ * turn, so neither can create a policy the other just dropped (`duplicate_object`, SQLSTATE 42710);
+ * the transaction makes an abort inside the span roll the drops back instead of leaving the store
+ * deny-all. The xact form releases the lock at COMMIT or ROLLBACK, so no lock survives the
+ * connection's return to the pool.
+ *
+ * `healDrops` are the heal pass's `DROP POLICY` statements for the policies outside the allowlist
+ * ({@link HealPlan.policyDrops}). They run at the HEAD of the same transaction, so a foreign policy
+ * is removed and the known-good set recreated as one atomic step.
+ *
+ * The fallback, when the client cannot pin a connection, is the plain autocommit loop — the
+ * behaviour before OPE-1994, which is all this code can do without a pinning seam.
+ */
+async function applyPolicyStatements(client, healDrops = []) {
+    warnIfPolicySpanCannotBeAtomic(client);
+    const statements = [...healDrops, ...POLICY_STATEMENTS];
+    if (!client.withConnection) {
+        for (const stmt of statements)
+            await client.query(stmt);
+        return;
+    }
+    await client.withConnection(async (conn) => {
+        await conn.query("BEGIN");
+        try {
+            // SET LOCAL, so the bound dies with the transaction and never leaks onto a pooled
+            // connection — the same reason the advisory lock is the xact form. The value is a module
+            // constant interpolated as a literal because a utility statement takes no bind parameter.
+            await conn.query(`SET LOCAL lock_timeout = ${SCHEMA_POLICY_LOCK_TIMEOUT_MS}`);
+            await conn.query("SELECT pg_advisory_xact_lock($1::int, $2::int)", [SCHEMA_POLICY_LOCK_CLASS, SCHEMA_POLICY_LOCK_KEY]);
+            for (const stmt of statements)
+                await conn.query(stmt);
+            await conn.query("COMMIT");
+        }
+        catch (err) {
+            // ROLLBACK is what puts the dropped policies back and releases the advisory lock. Its own
+            // failure is swallowed — the original error is the one the caller must see — and the throw
+            // reaches `withConnection` so the driver can DESTROY a still-in-transaction connection
+            // instead of returning it to the pool.
+            await conn.query("ROLLBACK").catch(() => undefined);
+            throw err;
+        }
+    });
+}
+/** Create the tables and RLS policies. Idempotent and safe on every boot, and ROLE-AWARE: as the owner (or on a fresh database) it applies the DDL and records any pre-existing posture violation as an audit.integrity row, while a non-owner runtime role runs no DDL, verifies the append-only posture instead, and refuses to boot when it does not hold - nobody with the runtime credential could have broken it and nothing running can repair it. */
+export async function initOperationalSchema(client) {
+    warnIfAuditChainCannotSerialise(client);
+    const owner = await ownsAuditTable(client);
+    if (owner === false) {
+        const violations = await verifyAppendOnlyAudit(client);
+        if (violations.length > 0) {
+            await recordAuditIntegrity(client, violations, false);
+            const cause = auditIntegrityCause(violations, false);
+            throw new Error(`operational schema: append-only audit posture FAILED verification under the non-owner runtime role — cause: ${cause} ` +
+                `(${CAUSE_NOTE[cause]}) — ${violations.join("; ")}. ` +
+                "Re-run the schema init as the owner/migration role to repair it, then reboot (docs/extending/database.md, two-role split).");
+        }
+        return; // runtime role, posture sound — no DDL to run
+    }
+    const preViolations = owner === true ? await verifyAppendOnlyAudit(client) : [];
+    // Heal the suppression vectors SCHEMA_STATEMENTS can't fix by re-CREATE alone (a
+    // foreign/RESTRICTIVE policy, a hostile trigger, a stray UPDATE/DELETE/TRUNCATE grant)
+    // BEFORE recording — an insert-swallowing trigger would otherwise eat the integrity INSERT.
+    // The trigger drops and grant revokes commit here; the POLICY drops are only planned, and run
+    // inside the span's transaction below, so the heal never leaves a table policy-less either.
+    // Only meaningful on an existing table (owner === true); a fresh DB has nothing to heal.
+    const plan = owner === true ? await healUnexpectedArtifacts(client) : { heal: { droppedPolicies: [], droppedTriggers: [], revokedGrants: [] }, policyDrops: [] };
+    const heal = plan.heal;
+    try {
+        for (const stmt of SCHEMA_STATEMENTS)
+            await client.query(stmt);
+        // The policy span runs apart from the loop above, and ATOMICALLY — see POLICY_STATEMENTS. The
+        // heal's own policy drops ride INSIDE it, or they would open the same deny-all window here.
+        await applyPolicyStatements(client, plan.policyDrops);
+    }
+    catch (err) {
+        if (owner === null) {
+            throw new Error(`operational schema: could not create the schema (fresh database, and this role may lack CREATE) — ${String(err)}. ` +
+                "Run the first boot / migration as the owner role, then point the app at the runtime role (docs/extending/database.md).");
+        }
+        throw err;
+    }
+    if (preViolations.length > 0) {
+        const cause = auditIntegrityCause(preViolations, healedAnything(heal));
+        console.error(`[open-everywhere:operational] append-only audit posture was broken and has been re-applied — cause: ${cause} ` +
+            `(${CAUSE_NOTE[cause]}): ${preViolations.join("; ")}`);
+        await recordAuditIntegrity(client, preViolations, true, heal);
+    }
+    const post = await verifyAppendOnlyAudit(client);
+    if (post.length > 0) {
+        throw new Error(`operational schema: append-only audit posture STILL failing after apply — ${post.join("; ")}`);
+    }
+}
+/**
+ * The provisioning statements for the NON-OWNER runtime role — the exact grants the
+ * two-role split needs (docs/extending/database.md walks through running them; the
+ * operational test executes this same list against a real engine so docs and reality
+ * can't drift). Run them AS THE OWNER, after both schema inits, each time a migration
+ * adds a table (no ALTER DEFAULT PRIVILEGES on purpose: a future append-only table must
+ * not silently inherit UPDATE/DELETE).
+ *
+ * The role itself is created separately (`CREATE ROLE <name> LOGIN PASSWORD '…'` — via
+ * SQL, NOT the Neon console, so it picks up no elevated platform role memberships) —
+ * see the docs. `role` is interpolated, not parameterised (DDL can't take parameters):
+ * callers pass a literal role name from config, never untrusted input.
+ */
+export function runtimeRoleGrantsSql(role) {
+    if (!/^[a-z_][a-z0-9_]*$/.test(role)) {
+        throw new Error(`runtimeRoleGrantsSql: "${role}" is not a plain lowercase identifier`);
+    }
+    return [
+        `GRANT USAGE ON SCHEMA public TO ${role}`,
+        // No DDL, ever: not owner + no CREATE = Postgres refuses DROP POLICY / ALTER TABLE outright.
+        `REVOKE CREATE ON SCHEMA public FROM ${role}`,
+        // Append-only tables: SELECT + INSERT and nothing else — belt (privileges) and
+        // braces (the FORCE RLS policies) both deny UPDATE/DELETE.
+        `GRANT SELECT, INSERT ON audit_entry, usage_events, domain_skill_revisions, routine_prompt_revisions TO ${role}`,
+        `REVOKE UPDATE, DELETE, TRUNCATE, REFERENCES, TRIGGER ON audit_entry, usage_events, domain_skill_revisions, routine_prompt_revisions FROM ${role}`,
+        // Identity columns draw from sequences; INSERT needs USAGE on them.
+        `GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO ${role}`,
+        ...mutableTableGrantsSql(role),
+        // webhook_capture sits OUTSIDE MUTABLE_TABLE_VERBS deliberately: it is the one table holding an outside party's bytes, and its code uses exactly SELECT (list a window), INSERT (capture one delivery) and DELETE (the sweeps and the re-arm clear). It never UPDATEs - a captured row is evidence of what arrived, and a window is replaced wholesale rather than edited - which is a property of what evidence IS, not of what its current callers happen to issue.
+        `GRANT SELECT, INSERT, DELETE ON webhook_capture TO ${role}`,
+        // Belt to the braces: the grant above already withholds UPDATE, and this makes the intent
+        // survive someone later folding webhook_capture into MUTABLE_TABLE_VERBS by reflex.
+        `REVOKE UPDATE, TRUNCATE, REFERENCES, TRIGGER ON webhook_capture FROM ${role}`,
+        // The memory tables come from memory/postgres.ts's schema, so on a deployment with a Postgres operational store and a non-Postgres memory provider they do not exist and this statement fails. It is kept out of MUTABLE_TABLE_VERBS to confine that failure to the memory grant instead of taking the operational grants down with it.
+        `GRANT SELECT, INSERT, UPDATE, DELETE ON memory_file, memory_tier TO ${role}`,
+        `REVOKE TRUNCATE, REFERENCES, TRIGGER ON memory_file, memory_tier FROM ${role}`,
+    ];
+}
+/** The four table-level DML verbs, in the canonical order every emitted statement uses. */
+const DML_VERBS = ["SELECT", "INSERT", "UPDATE", "DELETE"];
+/** The mutable operational tables, each keyed to THE VERBS THE CODE ACTUALLY ISSUES against it; add an entry with the verbs your statements use and nothing else. An INSERT ... ON CONFLICT DO UPDATE needs UPDATE as well as INSERT while DO NOTHING does not, and TRUNCATE stays revoked everywhere even where DELETE is granted because RLS does not filter TRUNCATE - one would wipe EVERY org's rows. The explicit REVOKEs are also what strip the over-wide verbs from a role upgraded from the old blanket grant. */
+const MUTABLE_TABLE_VERBS = {
+    // Upsert-only cost ledger (UPSERT_SPEND: ON CONFLICT DO UPDATE) plus reads. NO DELETE: nothing
+    // prunes it — the per-period rows ARE the spend history a limit is checked against, so deleting
+    // one silently lowers a surface's spend. Grant DELETE only alongside a real retention path.
+    spend_ledger: ["SELECT", "INSERT", "UPDATE"],
+    // Full CRUD: addRoutine / updateRoutine / removeRoutine are all real user-facing operations.
+    routine: ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    // Upsert (ON CONFLICT DO UPDATE) + a real clear when a limit is removed.
+    spend_limit: ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    // NO DELETE, and the omission is the property: a halt row is never removed. A resume UPDATEs
+    // `active` to false and stamps who cleared it, so who halted and who resumed both stay readable.
+    // (scripts/operational-test.ts asserts every table's grant EQUALS the verbs its code issues, so
+    // this cannot drift into a privilege nothing uses.)
+    halt: ["SELECT", "INSERT", "UPDATE"],
+    connector_override: ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    // Upsert on engage, UPDATE on the stop/turn bumps, DELETE on disengage.
+    thread_engagement: ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    // Atomic generation bump (ON CONFLICT DO UPDATE) + UPDATE. NO DELETE: a session is retired by
+    // bumping its generation, never by removing the row — the row is what makes the retirement
+    // durable across a restart. A delete path here would resurrect the retired session's identity.
+    channel_session: ["SELECT", "INSERT", "UPDATE"],
+    // The one table whose INSERT is `ON CONFLICT DO NOTHING` (the atomic first-sighting check), so it
+    // needs NO UPDATE — a dedupe row is written once and never edited; changing `seen_at` after the
+    // fact would defeat the check. DELETE is the org-scoped TTL prune-on-write. Revoking UPDATE here
+    // would only be wrong if the DO NOTHING became a DO UPDATE, which would itself be a bug.
+    event_dedupe: ["SELECT", "INSERT", "DELETE"],
+    // Verified delivery inbox: insert-if-absent freezes identity/payload; claim/release/completion are
+    // fenced UPDATEs; DELETE prunes completed tombstones and gives back only a definitively refused,
+    // still-claimed delivery. Pending rows are never clock-pruned.
+    ingress_delivery: ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    // The tail ring: INSERT per recorded event, DELETE for the bound-on-write prune and the carried-forward clear, and ONE narrow UPDATE - editSessionTailPost rewrites a single post row's text, called only from edit_reply's platform-CONFIRMED success path, never a refusal or an ambiguous outcome. The room's own copy of the message changed, so the ring must change with it or it is the one lying about what the room shows.
+    session_tail: ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    // INSERT on request, UPDATE on approve/deny (the CAS lives in `WHERE status = 'pending'`). NO
+    // DELETE: a decided action is RETAINED — the row is the approval record the audit story leans on,
+    // and expiry flips a status rather than removing evidence.
+    pending_actions: ["SELECT", "INSERT", "UPDATE"],
+    // Upsert + a real delete (deleteDomainSkill on the store port).
+    domain_skill: ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    domain_model: ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    // Single-row-per-key instance settings, upserted (ON CONFLICT DO UPDATE). NO DELETE: a key is
+    // overwritten, never removed; there is no "unset" operation on this seam.
+    instance_meta: ["SELECT", "INSERT", "UPDATE"],
+    // The lifetime at-most-once claim: INSERT ... ON CONFLICT DO NOTHING is the whole write path, so it needs no UPDATE. NO DELETE: dropping a claim lets the thing it records happen a second time, and every key space on this table is bounded by the thing it records (one room, one grant, one reaction) rather than by the number of ships.
+    notice_claim: ["SELECT", "INSERT"],
+    // The soak lane's model-call capture (OPE-846). INSERT per captured model call, SELECT for the
+    // harvest read, DELETE because retention here IS a delete-by-session — the harvest takes the
+    // prefixes and then drops them. NO UPDATE: a capture is a record of one call as it was sent, and
+    // a rewritable one would be worthless as a replay source (the sha256 would stop meaning anything).
+    model_call_capture: ["SELECT", "INSERT", "DELETE"],
+    // The proactive-address map (OPE-887). UPSERT is the whole write path (INSERT ... ON CONFLICT DO
+    // UPDATE), so it needs UPDATE alongside INSERT. NO DELETE: an address is corrected by the next
+    // inbound activity, never removed — and a store that could drop one would silently turn a working
+    // proactive delivery into an impossible one.
+    proactive_address: ["SELECT", "INSERT", "UPDATE"],
+    // The dream cycle's proposal review queue (OPE-957). INSERT per recorded proposal, SELECT for
+    // the review list. NO UPDATE/DELETE: nothing calls one today — a real erasure path is future
+    // work the schema does not block, but the runtime role gets no verb without a caller for it.
+    memory_proposal: ["SELECT", "INSERT"],
+    // Upsert on delivery/stop, UPDATE to lift a stop. NO DELETE: a stop is the recipient's boundary,
+    // and a row that can be deleted is a boundary an operator can erase. Lifting one is an UPDATE the
+    // recipient asks for, which keeps the row (and therefore the carded-first-delivery fact) intact.
+    dm_audience: ["SELECT", "INSERT", "UPDATE"],
+    // TTL-pruned routing maps the runtime role must DML or the async-spawn / delegation / upload-read
+    // paths break dead-closed under two-role RLS. All three upsert (ON CONFLICT DO UPDATE ⇒ UPDATE)
+    // and all three delete for real (explicit clears + the opportunistic prune-on-write).
+    thread_ownership: ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    // The thread-seat record (OPE-1696). UPSERT is the whole write path (INSERT ... ON CONFLICT DO
+    // UPDATE), so it needs UPDATE beside INSERT, and DELETE because the writer prunes its own
+    // expired rows on write, exactly as thread_ownership does.
+    thread_seat_state: ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    turn_anchor: ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    task_result: ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    slack_attachment: ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    // The credential broker's ciphertext store: upsert, the OPE-91 claim/release CAS, and a real DELETE. This is the one entry where 'retire by status, keep the row' is the WRONG default - there is no status column and never was, the row IS the secret, so a retained-but-retired credential is a live decryptable token; the evidence of the act survives in the append-only audit ledger, which no runtime DELETE can reach.
+    stored_credential: ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    // The intake single-use CAS: INSERT on offer, UPDATE to stamp `used_at`. NO DELETE — burning an
+    // intake marks it used; removing the row would make a single-use token replayable.
+    credential_intake: ["SELECT", "INSERT", "UPDATE"],
+    // The capture-window arm state: the webhook process reads it on every delivery to decide whether the window is open, and the arming path UPSERTs, so UPDATE is needed alongside INSERT to re-arm in place rather than accumulate a second window over one hook. NO DELETE - a window closes because its deadline elapses, and a delete path would be a second way to close one.
+    webhook_capture_window: ["SELECT", "INSERT", "UPDATE"],
+    // Single-window wakeId→origin routing map: upsert on register, UPDATE to mark answered, DELETE as
+    // the org-scoped TTL prune.
+    unified_wake_target: ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    // The GitHub App's discovered owner→installation map (OPE-226). Upsert on an `installation`
+    // delivery (ON CONFLICT DO UPDATE ⇒ INSERT + UPDATE), DELETE on an uninstall/suspend — the store
+    // port calls it "read-write with a real clear", so unlike the retained-evidence tables above the
+    // delete is the point: an uninstalled App must stop being routable, and a status flag would leave
+    // a stale installation id readable.
+    github_installation: ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    // The approval memos (OPE-53 session grants, OPE-152 routine declared permissions). Upsert on
+    // write (ON CONFLICT DO UPDATE), and DELETE twice over: the prune-on-write that drops this org's
+    // expired memos, and `revokeSessionApprovals` withdrawing a routine's declared permissions. DELETE
+    // rather than a status flip because a memo is live authority, not evidence — the audit row is what
+    // is retained, and a withdrawn row that lingered would keep answering the "is this approved" read.
+    pr_session_approval: ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    // Sets are retired by status and never deleted: the set id is the join key every audit row about that person cites. Linked ids take DELETE for the person's OWN sever, because a severed account must become joinable again while an ADMIN revocation tombstones instead; challenges take no DELETE, because the spent nonce row is what keeps a used code from being claimable again.
+    identity_link_sets: ["SELECT", "INSERT", "UPDATE"],
+    identity_linked_ids: ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    identity_link_challenges: ["SELECT", "INSERT", "UPDATE"],
+    // Credential grants (OPE-1060): INSERT on ask/mint, UPDATE for the approve/decide/burn/revoke/
+    // expire CAS chain. NO DELETE on either — a spent grant row is what makes once-mode single-use,
+    // and the mount projects EVERY row for a scope so it can refuse on state rather than vanish.
+    credential_grant_ask: ["SELECT", "INSERT", "UPDATE"],
+    credential_grant: ["SELECT", "INSERT", "UPDATE"],
+};
+/**
+ * Emit the mutable-table grants: one GRANT + one matching REVOKE per DISTINCT verb set, tables
+ * grouped in map order. Grouping is a formatting choice — the statement a table lands in follows
+ * only from its verbs, so appending an entry above never rewrites another table's grant.
+ */
+function mutableTableGrantsSql(role) {
+    const groups = new Map();
+    for (const [table, verbs] of Object.entries(MUTABLE_TABLE_VERBS)) {
+        // These names are interpolated into DDL (which can't take parameters). They are compile-time
+        // literals today; validate anyway so that stays true if the map is ever built from config.
+        if (!/^[a-z_][a-z0-9_]*$/.test(table)) {
+            throw new Error(`runtimeRoleGrantsSql: "${table}" is not a plain lowercase identifier`);
+        }
+        if (!verbs.includes("SELECT")) {
+            throw new Error(`runtimeRoleGrantsSql: ${table} must grant SELECT (every read, and every WHERE/RETURNING, needs it)`);
+        }
+        const canonical = DML_VERBS.filter((v) => verbs.includes(v));
+        const key = canonical.join(", ");
+        const group = groups.get(key);
+        if (group)
+            group.tables.push(table);
+        else
+            groups.set(key, { verbs: canonical, tables: [table] });
+    }
+    const out = [];
+    for (const [key, { verbs, tables }] of groups) {
+        const list = tables.join(", ");
+        out.push(`GRANT ${key} ON ${list} TO ${role}`);
+        // The complement, plus the three verbs no runtime path ever needs. TRUNCATE is the load-bearing
+        // one (RLS does not filter it — see MUTABLE_TABLE_VERBS); the rest are belt-and-braces.
+        const revoked = [...DML_VERBS.filter((v) => !verbs.includes(v)), "TRUNCATE", "REFERENCES", "TRIGGER"];
+        out.push(`REVOKE ${revoked.join(", ")} ON ${list} FROM ${role}`);
+    }
+    return out;
+}
+const UPSERT_SPEND = `INSERT INTO spend_ledger
+     (org_id, surface_key, principal_id, routine_id, model, period, cost_source, surface_mode,
+      input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, reasoning_tokens, usd_micros, usd_micros_measured, calls)
+   VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, 1)
+   ON CONFLICT (org_id, surface_key, principal_id, routine_id, model, period, cost_source) DO UPDATE SET
+     -- OPE-1862: a stamped mode HEALS a row an older build (or a writer with no binding) left
+     -- unstamped, and an unstamped write never erases a mode the row already holds.
+     surface_mode        = COALESCE(NULLIF(excluded.surface_mode, ''), spend_ledger.surface_mode),
+     input_tokens        = spend_ledger.input_tokens        + excluded.input_tokens,
+     output_tokens       = spend_ledger.output_tokens       + excluded.output_tokens,
+     cache_read_tokens   = spend_ledger.cache_read_tokens   + excluded.cache_read_tokens,
+     cache_write_tokens  = spend_ledger.cache_write_tokens  + excluded.cache_write_tokens,
+     reasoning_tokens    = spend_ledger.reasoning_tokens    + excluded.reasoning_tokens,
+     usd_micros          = spend_ledger.usd_micros          + excluded.usd_micros,
+     usd_micros_measured = spend_ledger.usd_micros_measured + excluded.usd_micros_measured,
+     calls               = spend_ledger.calls + 1`;
+/** Render the shared `?`-placeholder conjuncts (store.ts spendLedgerConjuncts) to $n,
+ *  starting after `offset` already-used params. */
+function renderSpendConjuncts(conjuncts, offset) {
+    let n = offset;
+    return conjuncts.map((c) => c.replace("?", () => `$${++n}`));
+}
+function pendingActionFromPgRow(org, r) {
+    return {
+        id: r.id,
+        org,
+        kind: r.kind,
+        argsJson: r.args_json,
+        scopeKey: r.scope_key,
+        domain: r.domain,
+        requestedBy: r.requested_by,
+        channelId: r.channel_id,
+        threadTs: r.thread_ts,
+        messageTs: r.message_ts,
+        postedTo: r.posted_to,
+        status: r.status,
+        createdAt: r.created_at,
+        expiresAt: r.expires_at,
+        decidedBy: r.decided_by,
+        decidedAt: r.decided_at,
+    };
+}
+const TURN_ANCHOR_SELECT = "SELECT window_key, anchor_key, channel_key, session_id, turn_id, surface_key, created_at FROM turn_anchor";
+/** Project a raw turn_anchor row (or an absent one) into {@link TurnAnchorRow} — the exact shape
+ *  sqlite.ts's readTurnAnchorRow produces, so the two backends are indistinguishable to callers. */
+function turnAnchorFromPgRow(raw) {
+    const r = raw;
+    if (!r)
+        return null;
+    return {
+        windowKey: r.window_key,
+        ...(r.anchor_key !== null ? { anchorKey: r.anchor_key } : {}),
+        ...(r.channel_key !== null ? { channelKey: r.channel_key } : {}),
+        sessionId: r.session_id,
+        turnId: r.turn_id,
+        surfaceKey: r.surface_key,
+        createdAt: r.created_at,
+    };
+}
+function linkSetFromPgRow(org, r) {
+    return { org, id: r.id, handle: r.handle, status: r.status, createdAt: r.created_at, updatedAt: r.updated_at };
+}
+function linkedIdFromPgRow(org, r) {
+    return {
+        org,
+        linkSetId: r.link_set_id,
+        platform: r.platform,
+        tenant: r.tenant,
+        nativeId: r.native_id,
+        status: r.status,
+        establishedBy: r.established_by,
+        ...(r.evidence === null ? {} : { evidenceJson: r.evidence }),
+        createdAt: r.created_at,
+        updatedAt: r.updated_at,
+    };
+}
+/** The column list every challenge read uses — ONE spelling, so a filtered list and a by-id get
+ *  can never disagree about which columns come back. */
+const LINK_CHALLENGE_SELECT = `SELECT org_id, id, nonce_hash, initiating_platform, initiating_tenant, initiating_native_id, initiating_surface_key,
+          claimed_platform, claimed_tenant, claimed_native_id, claimed_at,
+          transport, target_platform, target_tenant, target_native_id, back_nonce_hash,
+          status, created_at, expires_at, decided_at
+   FROM identity_link_challenges`;
+/** The same column list the CAS statements RETURN — one spelling, so a claim/consent's returned row
+ *  can never carry fewer columns than a subsequent read of the same row. */
+const LINK_CHALLENGE_RETURNING = `org_id, id, nonce_hash, initiating_platform, initiating_tenant, initiating_native_id, initiating_surface_key,
+   claimed_platform, claimed_tenant, claimed_native_id, claimed_at,
+   transport, target_platform, target_tenant, target_native_id, back_nonce_hash,
+   status, created_at, expires_at, decided_at`;
+function linkChallengeFromPgRow(org, r) {
+    return {
+        org,
+        id: r.id,
+        nonceHash: r.nonce_hash,
+        initiatingPlatform: r.initiating_platform,
+        initiatingTenant: r.initiating_tenant,
+        initiatingNativeId: r.initiating_native_id,
+        initiatingSurfaceKey: r.initiating_surface_key,
+        ...(r.claimed_platform === null ? {} : { claimedPlatform: r.claimed_platform }),
+        ...(r.claimed_tenant === null ? {} : { claimedTenant: r.claimed_tenant }),
+        ...(r.claimed_native_id === null ? {} : { claimedNativeId: r.claimed_native_id }),
+        ...(r.claimed_at === null ? {} : { claimedAt: r.claimed_at }),
+        // A pre-OPE-617 row is a CODE-transport row — what every row was before the column existed, so
+        // the fallback states a fact rather than guessing one.
+        transport: r.transport ?? "code",
+        ...(r.target_platform === null || r.target_platform === undefined ? {} : { targetPlatform: r.target_platform }),
+        ...(r.target_tenant === null || r.target_tenant === undefined ? {} : { targetTenant: r.target_tenant }),
+        ...(r.target_native_id === null || r.target_native_id === undefined ? {} : { targetNativeId: r.target_native_id }),
+        ...(r.back_nonce_hash === null || r.back_nonce_hash === undefined ? {} : { backNonceHash: r.back_nonce_hash }),
+        status: r.status,
+        createdAt: r.created_at,
+        expiresAt: r.expires_at,
+        ...(r.decided_at === null ? {} : { decidedAt: r.decided_at }),
+    };
+}
+// One spelling of each column list, shared by the reads and by every CAS statement's RETURNING, so a returned row can never carry fewer columns than a later read of the same row.
+/** Refuse a half-written borrow at the INSERT, where the caller can still be fixed — see
+ *  {@link grantBorrowColumnsProblem} for what "half" means and why it is silent otherwise. */
+function refuseHalfBorrow(table, row) {
+    const problem = grantBorrowColumnsProblem(row);
+    if (problem !== undefined)
+        throw new Error(`${table}: ${problem}`);
+}
+const GRANT_ASK_COLUMNS = `id, requester_principal_id, owner_principal_id, owner_slug, owner_platform, owner_native_id, connector, verb, resource,
+   mcp_tool, frozen_args, tool_name,
+   scope_key, domain_scope_key, purpose, requester_target, card_surface_id, card_message_id, requested_mode, status, created_at, expires_at, decided_at, grant_id`;
+const GRANT_ASK_SELECT = `SELECT ${GRANT_ASK_COLUMNS} FROM credential_grant_ask`;
+function grantAskFromPgRow(r) {
+    const frozenArgs = grantJsonFromColumn(r.frozen_args, "credential_grant_ask.frozen_args");
+    return {
+        id: r.id,
+        requesterPrincipalId: r.requester_principal_id,
+        ownerPrincipalId: r.owner_principal_id,
+        ownerSlug: r.owner_slug,
+        ownerPlatform: r.owner_platform,
+        ownerNativeId: r.owner_native_id,
+        connector: r.connector,
+        verb: r.verb,
+        resource: r.resource,
+        // `undefined` as well as `null`, for the reason the card columns below carry: these are
+        // migration-added columns, so a mid-rollout read can answer from a row the ALTER has not reached.
+        ...(r.mcp_tool === null || r.mcp_tool === undefined ? {} : { mcpTool: r.mcp_tool }),
+        ...(frozenArgs === undefined ? {} : { frozenArgs }),
+        ...(r.tool_name === null || r.tool_name === undefined ? {} : { toolName: r.tool_name }),
+        scopeKey: r.scope_key,
+        ...(r.domain_scope_key === null || r.domain_scope_key === undefined ? {} : { domainScopeKey: r.domain_scope_key }),
+        purpose: r.purpose,
+        ...(r.requester_target === null ? {} : { requesterTarget: r.requester_target }),
+        ...(r.card_surface_id === null || r.card_surface_id === undefined ? {} : { cardSurfaceId: r.card_surface_id }),
+        ...(r.card_message_id === null || r.card_message_id === undefined ? {} : { cardMessageId: r.card_message_id }),
+        requestedMode: r.requested_mode,
+        status: r.status,
+        createdAt: r.created_at,
+        expiresAt: r.expires_at,
+        ...(r.decided_at === null ? {} : { decidedAt: r.decided_at }),
+        ...(r.grant_id === null ? {} : { grantId: r.grant_id }),
+    };
+}
+const GRANT_COLUMNS = `id, ask_id, requester_principal_id, owner_principal_id, owner_slug, connector, verb, resource,
+   mcp_tool, frozen_args, tool_name, input_schema,
+   scope_key, mode, tier, status, purpose, created_at, expires_at, used_at, revoked_at`;
+const GRANT_SELECT = `SELECT ${GRANT_COLUMNS} FROM credential_grant`;
+function grantFromPgRow(r) {
+    const frozenArgs = grantJsonFromColumn(r.frozen_args, "credential_grant.frozen_args");
+    const inputSchema = grantJsonFromColumn(r.input_schema, "credential_grant.input_schema");
+    return {
+        id: r.id,
+        askId: r.ask_id,
+        requesterPrincipalId: r.requester_principal_id,
+        ownerPrincipalId: r.owner_principal_id,
+        ownerSlug: r.owner_slug,
+        connector: r.connector,
+        verb: r.verb,
+        resource: r.resource,
+        // `undefined` as well as `null`: migration-added columns, so a mid-rollout read can answer from
+        // a row the ALTER has not reached yet.
+        ...(r.mcp_tool === null || r.mcp_tool === undefined ? {} : { mcpTool: r.mcp_tool }),
+        ...(frozenArgs === undefined ? {} : { frozenArgs }),
+        ...(r.tool_name === null || r.tool_name === undefined ? {} : { toolName: r.tool_name }),
+        ...(inputSchema === undefined ? {} : { inputSchema }),
+        scopeKey: r.scope_key,
+        mode: r.mode,
+        tier: r.tier,
+        status: r.status,
+        purpose: r.purpose,
+        createdAt: r.created_at,
+        expiresAt: r.expires_at,
+        ...(r.used_at === null ? {} : { usedAt: r.used_at }),
+        ...(r.revoked_at === null ? {} : { revokedAt: r.revoked_at }),
+    };
+}
+function spendRowFromPg(r) {
+    return {
+        org: r.org_id,
+        surfaceKey: r.surface_key,
+        principalId: r.principal_id,
+        routineId: r.routine_id,
+        model: r.model,
+        period: r.period,
+        costSource: r.cost_source === "measured" ? "measured" : "derived",
+        // `?? ""` covers any NULL an operator's own migration left: an unreadable mode is UNSTAMPED,
+        // which every report masks.
+        surfaceMode: r.surface_mode ?? "",
+        inputTokens: Number(r.input_tokens),
+        outputTokens: Number(r.output_tokens),
+        cacheReadTokens: Number(r.cache_read_tokens),
+        cacheWriteTokens: Number(r.cache_write_tokens),
+        reasoningTokens: Number(r.reasoning_tokens ?? 0),
+        usdMicros: Number(r.usd_micros),
+        usdMicrosMeasured: Number(r.usd_micros_measured),
+        calls: Number(r.calls),
+    };
+}
+export function makeOperationalPostgresStore(client) {
+    return {
+        id: "postgres",
+        root: () => "postgres",
+        async recordSpend(org, write) {
+            await client.query(UPSERT_SPEND, [
+                org,
+                write.surfaceKey,
+                write.principalId ?? "",
+                write.routineId ?? "",
+                write.model ?? "",
+                write.period,
+                write.costSource ?? "derived",
+                write.surfaceMode ?? "",
+                write.inputTokens ?? 0,
+                write.outputTokens ?? 0,
+                write.cacheReadTokens ?? 0,
+                write.cacheWriteTokens ?? 0,
+                write.reasoningTokens ?? 0,
+                write.usdMicros ?? 0,
+                write.usdMicrosMeasured ?? 0,
+            ]);
+        },
+        async spendTotals(org, filter = {}) {
+            const { conjuncts, params } = spendLedgerConjuncts(filter);
+            const { rows } = await client.query(`SELECT COALESCE(SUM(input_tokens), 0) AS input_tokens,
+                COALESCE(SUM(output_tokens), 0) AS output_tokens,
+                COALESCE(SUM(cache_read_tokens), 0) AS cache_read_tokens,
+                COALESCE(SUM(cache_write_tokens), 0) AS cache_write_tokens,
+                COALESCE(SUM(reasoning_tokens), 0) AS reasoning_tokens,
+                COALESCE(SUM(usd_micros), 0) AS usd_micros,
+                COALESCE(SUM(usd_micros_measured), 0) AS usd_micros_measured,
+                COALESCE(SUM(calls), 0) AS calls
+         FROM spend_ledger WHERE ${["org_id = $1", ...renderSpendConjuncts(conjuncts, 1)].join(" AND ")}`, [org, ...params]);
+            const r = rows[0];
+            return {
+                inputTokens: Number(r.input_tokens),
+                outputTokens: Number(r.output_tokens),
+                cacheReadTokens: Number(r.cache_read_tokens),
+                cacheWriteTokens: Number(r.cache_write_tokens),
+                reasoningTokens: Number(r.reasoning_tokens),
+                usdMicros: Number(r.usd_micros),
+                usdMicrosMeasured: Number(r.usd_micros_measured),
+                calls: Number(r.calls),
+            };
+        },
+        async listSpendLedger(org, filter = {}) {
+            // Filtered in the QUERY, exactly as the sqlite adapter filters it (OPE-1653) — one
+            // `spendLedgerConjuncts` assembly, rendered to $n here. `org` takes $1 when it is named, so
+            // the conjunct offset is the count of params already placed, never a constant.
+            const { conjuncts, params } = spendLedgerConjuncts(filter);
+            const orgParams = org !== undefined ? [org] : [];
+            const where = [...(org !== undefined ? ["org_id = $1"] : []), ...renderSpendConjuncts(conjuncts, orgParams.length)];
+            const { rows } = await client.query(`SELECT * FROM spend_ledger${where.length ? ` WHERE ${where.join(" AND ")}` : ""}`, [...orgParams, ...params]);
+            return rows.map(spendRowFromPg);
+        },
+        async listRoutines(org, surfaceKey) {
+            const { rows } = await client.query("SELECT data FROM routine WHERE org_id = $1 AND surface_key = $2", [org, surfaceKey]);
+            return rows.map((r) => JSON.parse(r.data));
+        },
+        async getRoutine(org, surfaceKey, id) {
+            const { rows } = await client.query("SELECT data FROM routine WHERE org_id = $1 AND id = $2 AND surface_key = $3", [org, id, surfaceKey]);
+            const row = rows[0];
+            return row ? JSON.parse(row.data) : null;
+        },
+        async addRoutine(routine) {
+            await client.query("INSERT INTO routine (org_id, id, surface_key, data) VALUES ($1, $2, $3, $4)", [
+                routine.org,
+                routine.id,
+                routine.surfaceKey,
+                JSON.stringify(routine),
+            ]);
+            return routine;
+        },
+        async updateRoutine(org, surfaceKey, id, patch, provenance) {
+            const { rows } = await client.query("SELECT data FROM routine WHERE org_id = $1 AND id = $2 AND surface_key = $3", [org, id, surfaceKey]);
+            const row = rows[0];
+            if (!row)
+                return null;
+            const existing = JSON.parse(row.data);
+            const updated = { ...existing, ...patch, id: existing.id, org: existing.org, surfaceKey: existing.surfaceKey };
+            // Record the revision BEFORE the destructive UPDATE, and only when the patch actually replaces the prompt. The PgClient port is query-only with no transaction seam, so the two writes can tear: recording first makes the reachable tear an EXTRA revision for a prompt that failed to land, instead of a live prompt whose predecessor was destroyed unrecorded.
+            if (patch.prompt !== undefined && patch.prompt !== existing.prompt) {
+                const prior = await client.query("SELECT 1 FROM routine_prompt_revisions WHERE org_id = $1 AND surface_key = $2 AND routine_id = $3 LIMIT 1", [org, surfaceKey, id]);
+                const writes = routinePromptRevisionWrites({
+                    existing,
+                    updated,
+                    ...(provenance ? { provenance } : {}),
+                    hasPriorRevisions: prior.rows.length > 0,
+                    nowIso: new Date().toISOString(),
+                });
+                for (const w of writes) {
+                    await client.query(`INSERT INTO routine_prompt_revisions (org_id, surface_key, routine_id, prompt, generation, authored_by, armed_by, approval_id, recorded_at)
+             VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`, [org, surfaceKey, id, w.prompt, w.generation, w.authoredBy ?? null, w.armedBy ?? null, w.approvalId ?? null, w.recordedAt]);
+                }
+            }
+            await client.query("UPDATE routine SET data = $1 WHERE org_id = $2 AND id = $3", [JSON.stringify(updated), org, id]);
+            return updated;
+        },
+        async listRoutinePromptRevisions(org, surfaceKey, routineId) {
+            const { rows } = await client.query(`SELECT seq, routine_id, prompt, generation, authored_by, armed_by, approval_id, recorded_at
+         FROM routine_prompt_revisions
+         WHERE org_id = $1 AND surface_key = $2 AND ($3::text IS NULL OR routine_id = $3)
+         ORDER BY seq`, [org, surfaceKey, routineId ?? null]);
+            return rows.map((r) => ({
+                seq: Number(r.seq), // bigint arrives as a string on some drivers
+                org,
+                surfaceKey,
+                routineId: r.routine_id,
+                prompt: r.prompt,
+                ...(r.generation === null ? {} : { generation: Number(r.generation) }),
+                ...(r.authored_by ? { authoredBy: r.authored_by } : {}),
+                ...(r.armed_by ? { armedBy: r.armed_by } : {}),
+                ...(r.approval_id ? { approvalId: r.approval_id } : {}),
+                recordedAt: r.recorded_at,
+            }));
+        },
+        async removeRoutine(org, surfaceKey, id) {
+            const { rows } = await client.query("DELETE FROM routine WHERE org_id = $1 AND id = $2 AND surface_key = $3 RETURNING id", [org, id, surfaceKey]);
+            return rows.length > 0;
+        },
+        async listAllRoutines() {
+            const { rows } = await client.query("SELECT data FROM routine");
+            return rows.map((r) => JSON.parse(r.data));
+        },
+        async appendAudit(entry) {
+            // Hash-chain link: stamp prev_sha with the sha256 of the org's current LAST row. The read and the insert are two round trips, so both run inside one transaction behind the per-org advisory lock (withAuditChainLock) - two writers that read the same tail would otherwise fork the chain.
+            await withAuditChainLock(client, entry.org, async (conn) => {
+                const prevSha = await nextAuditPrevSha(conn, entry.org);
+                await conn.query(`INSERT INTO audit_entry (ts, org_id, platform, workspace, surface, surface_mode, principal_id, action, detail, prev_sha)
+           VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)`, [
+                    entry.ts,
+                    entry.org,
+                    entry.platform,
+                    entry.workspace,
+                    entry.surface ?? null,
+                    entry.surfaceMode ?? null,
+                    entry.principalId ?? null,
+                    entry.action,
+                    entry.detail ? JSON.stringify(entry.detail) : null,
+                    prevSha,
+                ]);
+            });
+        },
+        async readAudit(filter) {
+            // Refuse before the builder runs (OPE-1812): every other predicate is optional, so an absent
+            // org would simply leave `WHERE` empty and read every org's rows.
+            const org = auditReadOrg(filter);
+            const where = [];
+            const params = [];
+            const eq = (col, val) => {
+                if (val !== undefined) {
+                    params.push(val);
+                    where.push(`${col} = $${params.length}`);
+                }
+            };
+            eq("org_id", org);
+            eq("platform", filter.platform);
+            eq("workspace", filter.workspace);
+            eq("surface", filter.surface);
+            eq("action", filter.action);
+            eq("principal_id", filter.principalId);
+            if (filter.since !== undefined) {
+                params.push(filter.since);
+                where.push(`ts >= $${params.length}`);
+            }
+            if (filter.until !== undefined) {
+                params.push(filter.until);
+                where.push(`ts <= $${params.length}`);
+            }
+            const clause = where.length ? `WHERE ${where.join(" AND ")}` : "";
+            let limitClause = "";
+            if (filter.limit && filter.limit > 0) {
+                params.push(filter.limit);
+                limitClause = `LIMIT $${params.length}`;
+            }
+            const { rows } = await client.query(
+            // `seq` rides along (OPE-1933): it is already the ORDER BY tiebreak, and it is the only
+            // monotonic locator a reader can anchor on when the box's wall clock steps backward.
+            // `surface_mode` is the anti-doxxing mask's input (OPE-1866).
+            `SELECT seq, ts, org_id, platform, workspace, surface, surface_mode, principal_id, action, detail
+         FROM audit_entry ${clause} ORDER BY ts DESC, seq DESC ${limitClause}`, params);
+            return rows.map((r) => ({
+                seq: Number(r.seq),
+                ts: r.ts,
+                org: r.org_id,
+                platform: r.platform,
+                workspace: r.workspace,
+                ...(r.surface ? { surface: r.surface } : {}),
+                ...auditSurfaceMode(r.surface_mode),
+                ...(r.principal_id ? { principalId: r.principal_id } : {}),
+                action: r.action,
+                ...(r.detail ? { detail: JSON.parse(r.detail) } : {}),
+            }));
+        },
+        async listAuditOrgs() {
+            const { rows } = await client.query("SELECT DISTINCT org_id FROM audit_entry ORDER BY org_id");
+            return rows.map((r) => r.org_id);
+        },
+        async readAuditChain(org, opts) {
+            return readAuditChainRows(client, org, opts?.tailLimit);
+        },
+        async sealAuditChainEpoch(org, sealedBy) {
+            // The read and the INSERT MUST be one critical section: a row appended between them would land after the era the seal claims to cover, and the seal would be born wrong. The cost is this org's appends - the section holds the org's ENTIRE chain read, seconds on a 53k-row log over a hosted endpoint, and every concurrent append waits up to AUDIT_CHAIN_LOCK_TIMEOUT_MS and then drops best-effort, so do not seal a busy org unaware.
+            return withAuditChainLock(client, org, async (conn) => {
+                const rows = await readAuditChainRows(conn, org);
+                const seal = auditEpochSealFor(rows);
+                if (seal === null)
+                    return null;
+                const { rows: written } = await conn.query(`INSERT INTO audit_entry (ts, org_id, platform, workspace, principal_id, action, detail, prev_sha)
+           VALUES ($1, $2, 'db', 'postgres', $3, $4, $5, NULL) RETURNING seq`, [new Date().toISOString(), org, sealedBy, AUDIT_CHAIN_EPOCH_ACTION, JSON.stringify(auditEpochDetail(seal))]);
+                return { seal, markerSeq: Number(written[0].seq) };
+            });
+        },
+        async setSpendLimit(org, scopeKey, level, limit, meta, condition) {
+            assertSpendLimitAmount(limit);
+            // Same encodings as the SQLite adapter (kept identical so one documented rule
+            // covers both backings): monthly_tokens = -1 means "no token component" (the
+            // column predates USD caps and is NOT NULL in every existing DB); monthly_usd
+            // NULL means "no USD component". spendLimits() decodes both to `undefined`.
+            const params = [org, scopeKey, level, limit.monthlyTokens ?? -1, limit.monthlyUsd ?? null, meta?.expiresAt ?? null, meta?.reason ?? null, meta?.setBy ?? null];
+            const { rows } = condition?.ifAbsent
+                ? await client.query(`INSERT INTO spend_limit (org_id, scope_key, level, monthly_tokens, monthly_usd, expires_at, reason, set_by) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+             ON CONFLICT (org_id, scope_key, level) DO NOTHING
+             RETURNING scope_key`, params)
+                : await client.query(`INSERT INTO spend_limit (org_id, scope_key, level, monthly_tokens, monthly_usd, expires_at, reason, set_by) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+             ON CONFLICT (org_id, scope_key, level) DO UPDATE SET
+               monthly_tokens = excluded.monthly_tokens,
+               monthly_usd    = excluded.monthly_usd,
+               expires_at     = excluded.expires_at,
+               reason         = excluded.reason,
+               set_by         = excluded.set_by
+             RETURNING scope_key`, params);
+            return rows.length > 0;
+        },
+        async clearSpendLimit(org, scopeKey, level, expected) {
+            const expectedSql = expected
+                ? " AND monthly_tokens IS NOT DISTINCT FROM $4 AND monthly_usd IS NOT DISTINCT FROM $5 AND expires_at IS NOT DISTINCT FROM $6 AND reason IS NOT DISTINCT FROM $7 AND set_by IS NOT DISTINCT FROM $8"
+                : "";
+            const params = expected
+                ? [org, scopeKey, level, expected.monthlyTokens ?? -1, expected.monthlyUsd ?? null, expected.expiresAt ?? null, expected.reason ?? null, expected.setBy ?? null]
+                : [org, scopeKey, level];
+            const { rows } = await client.query(`DELETE FROM spend_limit WHERE org_id = $1 AND scope_key = $2 AND level = $3${expectedSql} RETURNING scope_key`, params);
+            return rows.length > 0;
+        },
+        async spendLimits(org) {
+            const { rows } = await client.query("SELECT scope_key, level, monthly_tokens, monthly_usd, expires_at, reason, set_by FROM spend_limit WHERE org_id = $1", [org]);
+            return rows.map((r) => ({
+                org,
+                scopeKey: r.scope_key,
+                level: r.level,
+                // Decode the storage encodings (see setSpendLimit): -1 tokens / NULL usd =
+                // component absent.
+                ...(Number(r.monthly_tokens) >= 0 ? { monthlyTokens: Number(r.monthly_tokens) } : {}),
+                ...(r.monthly_usd != null ? { monthlyUsd: Number(r.monthly_usd) } : {}),
+                ...(r.expires_at != null ? { expiresAt: Number(r.expires_at) } : {}),
+                ...(r.reason ? { reason: r.reason } : {}),
+                ...(r.set_by ? { setBy: r.set_by } : {}),
+            }));
+        },
+        async setHalt(org, address, meta) {
+            assertHaltAddress(address);
+            const a = haltAddressColumns(address);
+            // Same upsert semantics as the SQLite adapter: restamp who/when, drop the previous resume
+            // stamps so a cleared_at never sits beside an active row.
+            await client.query(`INSERT INTO halt (org_id, level, scope_key, org_wide, active, set_by, set_at, set_ref, cleared_by, cleared_at) VALUES ($1, $2, $3, $4, true, $5, $6, $7, NULL, NULL)
+         ON CONFLICT (org_id, level, scope_key, org_wide) DO UPDATE SET
+           active     = true,
+           set_by     = excluded.set_by,
+           set_at     = excluded.set_at,
+           set_ref    = excluded.set_ref,
+           cleared_by = NULL,
+           cleared_at = NULL`, [org, a.level, a.scopeKey, a.orgWide, meta?.setBy ?? null, meta?.setAt ?? new Date().toISOString(), meta?.setRef ?? null]);
+        },
+        async clearHalt(org, address, meta, expected) {
+            assertHaltAddress(address);
+            const a = haltAddressColumns(address);
+            const expectedSql = expected ? " AND set_at = $7 AND set_by IS NOT DISTINCT FROM $8 AND set_ref IS NOT DISTINCT FROM $9" : "";
+            const params = [meta?.clearedBy ?? null, new Date().toISOString(), org, a.level, a.scopeKey, a.orgWide, ...(expected ? [expected.setAt, expected.setBy ?? null, expected.setRef ?? null] : [])];
+            const { rows } = await client.query(`UPDATE halt SET active = false, cleared_by = $1, cleared_at = $2 WHERE org_id = $3 AND level = $4 AND scope_key = $5 AND org_wide = $6 AND active = true${expectedSql} RETURNING org_id`, params);
+            return rows.length > 0;
+        },
+        async activeHalts(org) {
+            const { rows } = await client.query("SELECT level, scope_key, org_wide, set_by, set_at, set_ref, cleared_by, cleared_at FROM halt WHERE org_id = $1 AND active = true", [org]);
+            return rows.map((r) => ({
+                org,
+                address: haltAddressFromColumns(r.level, r.scope_key, r.org_wide === true),
+                active: true,
+                setAt: r.set_at,
+                ...(r.set_by ? { setBy: r.set_by } : {}),
+                ...(r.set_ref ? { setRef: r.set_ref } : {}),
+                ...(r.cleared_by ? { clearedBy: r.cleared_by } : {}),
+                ...(r.cleared_at ? { clearedAt: r.cleared_at } : {}),
+            }));
+        },
+        async setConnectorOverride(org, scopeKey, connector, granted, meta) {
+            await client.query(`INSERT INTO connector_override (org_id, scope_key, connector, granted, reason, set_by) VALUES ($1, $2, $3, $4, $5, $6)
+         ON CONFLICT (org_id, scope_key, connector) DO UPDATE SET
+           granted = excluded.granted,
+           reason  = excluded.reason,
+           set_by  = excluded.set_by`, [org, scopeKey, connector, granted, meta?.reason ?? null, meta?.setBy ?? null]);
+        },
+        async clearConnectorOverride(org, scopeKey, connector) {
+            const { rows } = await client.query("DELETE FROM connector_override WHERE org_id = $1 AND scope_key = $2 AND connector = $3 RETURNING connector", [org, scopeKey, connector]);
+            return rows.length > 0;
+        },
+        async connectorOverrides(org, scopeKey) {
+            // Hot gate path — only the fields the connector gate needs. reason/setBy are read by allConnectorOverrides.
+            const { rows } = await client.query("SELECT connector, granted FROM connector_override WHERE org_id = $1 AND scope_key = $2", [org, scopeKey]);
+            return rows.map((r) => ({ connector: r.connector, granted: r.granted }));
+        },
+        async allConnectorOverrides(org) {
+            const { rows } = await client.query("SELECT scope_key, connector, granted, reason, set_by FROM connector_override WHERE org_id = $1", [org]);
+            return rows.map((r) => ({ scopeKey: r.scope_key, connector: r.connector, granted: r.granted, ...(r.reason ? { reason: r.reason } : {}), ...(r.set_by ? { setBy: r.set_by } : {}) }));
+        },
+        async setDomainModel(org, domain, pick, setBy) {
+            assertDomainModelPick(pick);
+            await client.query(`INSERT INTO domain_model (org_id, domain, model_id, reasoning, set_by, updated_at) VALUES ($1, $2, $3, $4, $5, $6)
+         ON CONFLICT (org_id, domain) DO UPDATE SET
+           model_id   = excluded.model_id,
+           reasoning  = excluded.reasoning,
+           set_by     = excluded.set_by,
+           updated_at = excluded.updated_at`, [org, domain, pick.modelId ?? null, pick.reasoning ?? null, setBy ?? null, new Date().toISOString()]);
+        },
+        async clearDomainModel(org, domain) {
+            const { rows } = await client.query("DELETE FROM domain_model WHERE org_id = $1 AND domain = $2 RETURNING domain", [org, domain]);
+            return rows.length > 0;
+        },
+        async getDomainModel(org, domain) {
+            const { rows } = await client.query("SELECT model_id, reasoning, set_by, updated_at FROM domain_model WHERE org_id = $1 AND domain = $2", [org, domain]);
+            const r = rows[0];
+            if (!r)
+                return null;
+            return {
+                org,
+                domain,
+                ...(r.model_id ? { modelId: r.model_id } : {}),
+                ...(r.reasoning ? { reasoning: r.reasoning } : {}),
+                ...(r.set_by ? { setBy: r.set_by } : {}),
+                updatedAt: r.updated_at,
+            };
+        },
+        async domainModels(org) {
+            const { rows } = await client.query("SELECT domain, model_id, reasoning, set_by, updated_at FROM domain_model WHERE org_id = $1 ORDER BY domain", [org]);
+            return rows.map((r) => ({
+                org,
+                domain: r.domain,
+                ...(r.model_id ? { modelId: r.model_id } : {}),
+                ...(r.reasoning ? { reasoning: r.reasoning } : {}),
+                ...(r.set_by ? { setBy: r.set_by } : {}),
+                updatedAt: r.updated_at,
+            }));
+        },
+        async markEngaged(org, surfaceKey, threadTs, at, opts) {
+            // kind is set ONLY at first touch and is deliberately absent from the ON CONFLICT SET clause; participating is an OR so a refresh never downgrades a promotion, and only a promotion clears silent_streak. engaged_by carries the durable engage-idempotency rule - a promotion from ANY id the row's framed list already holds never clears stopped - and this statement frames a legacy bare id itself, because initOperationalSchema runs no migration for a non-owner runtime role.
+            const framed = opts?.participating && opts?.engagedBy ? framePromoterId(opts.engagedBy) : null;
+            await client.query(`INSERT INTO thread_engagement (org_id, surface_key, thread_ts, engaged_at, last_turn_at, participating, silent_streak, owner_token, kind, stopped, engaged_by)
+         VALUES ($1, $2, $3, $4, $5, $6, 0, $7, $8, false, $9)
+         ON CONFLICT (org_id, surface_key, thread_ts) DO UPDATE SET
+           last_turn_at  = excluded.last_turn_at,
+           participating = thread_engagement.participating OR excluded.participating,
+           silent_streak = CASE WHEN excluded.participating THEN 0 ELSE thread_engagement.silent_streak END,
+           owner_token   = COALESCE(excluded.owner_token, thread_engagement.owner_token),
+           stopped       = CASE
+                             WHEN excluded.participating
+                              AND (excluded.engaged_by IS NULL
+                                   OR strpos(CASE WHEN thread_engagement.engaged_by IS NULL OR thread_engagement.engaged_by = '' THEN chr(10)
+                                                  WHEN substr(thread_engagement.engaged_by, 1, 1) = chr(10) THEN thread_engagement.engaged_by
+                                                  ELSE chr(10) || thread_engagement.engaged_by || chr(10) END,
+                                             excluded.engaged_by) = 0)
+                             THEN false ELSE thread_engagement.stopped END,
+           engaged_by    = CASE
+                             WHEN excluded.participating AND excluded.engaged_by IS NOT NULL
+                             THEN replace(CASE WHEN thread_engagement.engaged_by IS NULL OR thread_engagement.engaged_by = '' THEN chr(10)
+                                               WHEN substr(thread_engagement.engaged_by, 1, 1) = chr(10) THEN thread_engagement.engaged_by
+                                               ELSE chr(10) || thread_engagement.engaged_by || chr(10) END,
+                                          excluded.engaged_by, chr(10)) || substr(excluded.engaged_by, 2)
+                             ELSE thread_engagement.engaged_by END`, [
+                org,
+                surfaceKey,
+                threadTs,
+                at,
+                at,
+                opts?.participating ?? false,
+                opts?.ownerToken ?? null,
+                opts?.kind ?? "thread",
+                framed,
+            ]);
+            if (framed === null)
+                return;
+            // THE BOUND — the SQLite twin's second statement, same reasoning: the clear decision and the
+            // append ride the one atomic statement above, and the trim is bookkeeping that drops at most
+            // one entry per promotion, which is all a one-entry append can ever need. A crash between the
+            // two leaves the list one entry OVER the bound, where it stays — see the SQLite twin.
+            await client.query(`UPDATE thread_engagement
+            SET engaged_by = substr(engaged_by, strpos(substr(engaged_by, 2), chr(10)) + 1)
+          WHERE org_id = $1 AND surface_key = $2 AND thread_ts = $3
+            AND engaged_by IS NOT NULL
+            AND length(engaged_by) - length(replace(engaged_by, chr(10), '')) - 1 > $4`, [org, surfaceKey, threadTs, PROMOTER_LIST_MAX]);
+        },
+        async markStopped(org, surfaceKey, threadTs) {
+            // Set the durable stopped marker on an EXISTING row (task #100 follow-up); no INSERT —
+            // a stop only applies to a thread that already carries a row. Missing row → 0 rows
+            // returned → false. Idempotent. Kept semantically identical to the SQLite adapter.
+            const { rows } = await client.query("UPDATE thread_engagement SET stopped = true WHERE org_id = $1 AND surface_key = $2 AND thread_ts = $3 RETURNING thread_ts", [org, surfaceKey, threadTs]);
+            return rows.length > 0;
+        },
+        async bumpSilentStreak(org, surfaceKey, threadTs) {
+            // RETURNING hands back the post-increment value; a missing row updates nothing →
+            // no rows returned → 0 (no-op, nothing to shed).
+            const { rows } = await client.query(`UPDATE thread_engagement SET silent_streak = silent_streak + 1
+         WHERE org_id = $1 AND surface_key = $2 AND thread_ts = $3 RETURNING silent_streak`, [org, surfaceKey, threadTs]);
+            const r = rows[0];
+            return r ? Number(r.silent_streak) : 0;
+        },
+        async getEngagement(org, surfaceKey, threadTs) {
+            const { rows } = await client.query("SELECT engaged_at, last_turn_at, participating, silent_streak, owner_token, kind, stopped, engaged_by FROM thread_engagement WHERE org_id = $1 AND surface_key = $2 AND thread_ts = $3", [org, surfaceKey, threadTs]);
+            const r = rows[0];
+            return r
+                ? {
+                    org,
+                    surfaceKey,
+                    threadTs,
+                    engagedAt: r.engaged_at,
+                    lastTurnAt: r.last_turn_at,
+                    participating: r.participating,
+                    silentStreak: Number(r.silent_streak),
+                    ...(r.owner_token ? { ownerToken: r.owner_token } : {}),
+                    kind: r.kind ?? "thread",
+                    stopped: r.stopped,
+                    ...promoterListField(r.engaged_by),
+                }
+                : null;
+        },
+        async disengage(org, surfaceKey, threadTs) {
+            const { rows } = await client.query("DELETE FROM thread_engagement WHERE org_id = $1 AND surface_key = $2 AND thread_ts = $3 RETURNING thread_ts", [org, surfaceKey, threadTs]);
+            return rows.length > 0;
+        },
+        async listEngagements(org) {
+            const { rows } = await client.query("SELECT surface_key, thread_ts, engaged_at, last_turn_at, participating, silent_streak, owner_token, kind, stopped, engaged_by FROM thread_engagement WHERE org_id = $1", [org]);
+            return rows.map((r) => ({
+                org,
+                surfaceKey: r.surface_key,
+                threadTs: r.thread_ts,
+                engagedAt: r.engaged_at,
+                lastTurnAt: r.last_turn_at,
+                participating: r.participating,
+                silentStreak: Number(r.silent_streak),
+                ...(r.owner_token ? { ownerToken: r.owner_token } : {}),
+                kind: r.kind ?? "thread",
+                stopped: r.stopped,
+                ...promoterListField(r.engaged_by),
+            }));
+        },
+        async getChannelSession(org, surfaceKey) {
+            const { rows } = await client.query("SELECT token, generation, created_at, last_wake_at, turn_count, input_tokens_total, first_wake_at, last_input_tokens, rotate_marked_at, served_code_fingerprint, served_domain_fingerprint FROM channel_session WHERE org_id = $1 AND surface_key = $2", [org, surfaceKey]);
+            const r = rows[0];
+            return r
+                ? {
+                    org, surfaceKey, token: r.token, generation: Number(r.generation), createdAt: r.created_at,
+                    lastWakeAt: r.last_wake_at, turnCount: Number(r.turn_count),
+                    inputTokensTotal: r.input_tokens_total == null ? null : Number(r.input_tokens_total),
+                    firstWakeAt: r.first_wake_at ?? null,
+                    lastInputTokens: r.last_input_tokens == null ? null : Number(r.last_input_tokens),
+                    rotateMarkedAt: r.rotate_marked_at ?? null,
+                    servedCodeFingerprint: r.served_code_fingerprint ?? null,
+                    servedDomainFingerprint: r.served_domain_fingerprint ?? null,
+                }
+                : null;
+        },
+        async rotateChannelSession(org, surfaceKey, newToken, at) {
+            // One INSERT ... ON CONFLICT DO UPDATE computes the next generation FROM THE ROW BEING UPDATED, inside the same statement and row lock (an unqualified column reference in a DO UPDATE SET reads the PRE-update row; excluded.x reads the proposed values), so two concurrent rotations cannot both mint the same value. A fresh generation starts at input_tokens_total = 0 rather than NULL so the NULL-means-rotate fail-safe fires only on pre-migration rows, and rotate_marked_at = NULL SPENDS the operator mark - a mark that survived its own rotation would retire the seat on every wake for ever.
+            const { rows } = await client.query(`INSERT INTO channel_session (org_id, surface_key, token, generation, created_at, last_wake_at, turn_count, input_tokens_total, first_wake_at, last_input_tokens, rotate_marked_at)
+         VALUES ($1, $2, $3, 1, $4, $5, 0, 0, NULL, NULL, NULL)
+         ON CONFLICT (org_id, surface_key) DO UPDATE SET
+           token              = excluded.token,
+           generation         = channel_session.generation + 1,
+           created_at         = excluded.created_at,
+           last_wake_at       = excluded.last_wake_at,
+           turn_count         = 0,
+           input_tokens_total = 0,
+           first_wake_at      = NULL,
+           last_input_tokens  = NULL,
+           rotate_marked_at   = NULL
+         RETURNING generation, served_code_fingerprint, served_domain_fingerprint`, [org, surfaceKey, newToken, at, at]);
+            // The fingerprint pair is in NEITHER the INSERT column list NOR the DO UPDATE SET, so a fresh
+            // mint starts NULL (adopted by the next wake) and a rotation KEEPS the pair the pre-dispatch
+            // stamp just wrote. Resetting it here would rotate the seat again on its very next wake.
+            const r = rows[0];
+            const generation = Number(r.generation);
+            return {
+                org, surfaceKey, token: newToken, generation, createdAt: at, lastWakeAt: at, turnCount: 0, inputTokensTotal: 0, firstWakeAt: null, lastInputTokens: null, rotateMarkedAt: null,
+                servedCodeFingerprint: r.served_code_fingerprint ?? null,
+                servedDomainFingerprint: r.served_domain_fingerprint ?? null,
+            };
+        },
+        async stampChannelSessionRuntime(org, surfaceKey, codeFingerprint, domainFingerprint) {
+            // ONE statement, so the read and the conditional write cannot interleave with another wake.
+            // Every CTE here shares one snapshot and a data-modifying CTE's effects are invisible to the
+            // others, so `prev` always reports the PRE-update pair. Under a concurrent wake the second
+            // statement blocks on the UPDATE's row lock, re-checks its own WHERE against the updated row
+            // and matches nothing — it answers "current" and the seat's generation retires exactly once.
+            const { rows } = await client.query(`WITH prev AS (
+           SELECT served_code_fingerprint AS c, served_domain_fingerprint AS d
+             FROM channel_session WHERE org_id = $1 AND surface_key = $2
+         ), upd AS (
+           UPDATE channel_session SET served_code_fingerprint = $3, served_domain_fingerprint = $4
+            WHERE org_id = $1 AND surface_key = $2
+              AND (served_code_fingerprint IS DISTINCT FROM $3 OR served_domain_fingerprint IS DISTINCT FROM $4)
+           RETURNING 1
+         )
+         SELECT (SELECT c FROM prev) AS prev_code,
+                (SELECT d FROM prev) AS prev_domain,
+                EXISTS (SELECT 1 FROM prev) AS present,
+                EXISTS (SELECT 1 FROM upd) AS changed`, [org, surfaceKey, codeFingerprint, domainFingerprint]);
+            const r = rows[0];
+            if (!r || !r.present)
+                return { outcome: "absent", previousCodeFingerprint: null, previousDomainFingerprint: null };
+            const previousCodeFingerprint = r.prev_code ?? null;
+            const previousDomainFingerprint = r.prev_domain ?? null;
+            if (!r.changed)
+                return { outcome: "current", previousCodeFingerprint, previousDomainFingerprint };
+            // NULL is ADOPTED, never rotated: the row was minted by this same bundle moments ago (the
+            // mint arm writes no pair) or predates the columns, and neither proves the code changed.
+            return { outcome: previousCodeFingerprint === null ? "adopted" : "rotate", previousCodeFingerprint, previousDomainFingerprint };
+        },
+        async markChannelSessionRotation(org, surfaceKey, at) {
+            // UPDATE, never an upsert: a registry key with no row has no generation to retire, and
+            // minting one here would seat a channel nobody woke. COALESCE keeps the FIRST mark's stamp,
+            // so a re-run of the sweep is idempotent and the stamp stays readable as "marked since when".
+            const { rows } = await client.query("UPDATE channel_session SET rotate_marked_at = COALESCE(rotate_marked_at, $3) WHERE org_id = $1 AND surface_key = $2 RETURNING surface_key", [org, surfaceKey, at]);
+            return rows.length > 0;
+        },
+        async touchChannelSession(org, surfaceKey, at) {
+            // first_wake_at is set ONCE (COALESCE) — this runs only after a successful wake, so it
+            // stamps "first wake delivered" (H7c). A later touch leaves it at its first value.
+            await client.query("UPDATE channel_session SET last_wake_at = $1, turn_count = turn_count + 1, first_wake_at = COALESCE(first_wake_at, $1) WHERE org_id = $2 AND surface_key = $3", [at, org, surfaceKey]);
+        },
+        async bumpChannelSessionUsage(org, surfaceKey, token, delta) {
+            // Token-guarded: the UPDATE only lands on the LIVE generation's row, so a straggler
+            // step from a retired generation (a rotation-boundary race) is a no-op — no phantom
+            // counting across a rotation. NULL counter ⇒ COALESCE'd to 0 first (backfill posture).
+            // ONE write, TWO rungs (OPE-794): the running SUM feeds the cumulative backstop, the SET
+            // value feeds the context-size trigger. They share this statement so they can never disagree
+            // about which step they saw, and the token guard covers both.
+            const { rows } = await client.query("UPDATE channel_session SET input_tokens_total = COALESCE(input_tokens_total, 0) + $4, last_input_tokens = $4 WHERE org_id = $1 AND surface_key = $2 AND token = $3 RETURNING surface_key", [org, surfaceKey, token, delta]);
+            return rows.length;
+        },
+        async listChannelSessions(org, keyPrefix) {
+            const { rows } = keyPrefix === undefined
+                ? await client.query("SELECT surface_key, token, generation, created_at, last_wake_at, turn_count, input_tokens_total, first_wake_at, last_input_tokens, rotate_marked_at, served_code_fingerprint, served_domain_fingerprint FROM channel_session WHERE org_id = $1", [org])
+                : await client.query(
+                // LIKE with a literal, colon/`::`-only prefix (`oe-domain::`) — no user-controlled
+                // wildcard chars ever reach this call, so a plain concatenation is safe.
+                "SELECT surface_key, token, generation, created_at, last_wake_at, turn_count, input_tokens_total, first_wake_at, last_input_tokens, rotate_marked_at, served_code_fingerprint, served_domain_fingerprint FROM channel_session WHERE org_id = $1 AND surface_key LIKE $2", [org, `${keyPrefix}%`]);
+            return rows.map((r) => ({
+                org, surfaceKey: r.surface_key, token: r.token, generation: Number(r.generation), createdAt: r.created_at,
+                lastWakeAt: r.last_wake_at, turnCount: Number(r.turn_count),
+                inputTokensTotal: r.input_tokens_total == null ? null : Number(r.input_tokens_total),
+                firstWakeAt: r.first_wake_at ?? null,
+                lastInputTokens: r.last_input_tokens == null ? null : Number(r.last_input_tokens),
+                rotateMarkedAt: r.rotate_marked_at ?? null,
+                servedCodeFingerprint: r.served_code_fingerprint ?? null,
+                servedDomainFingerprint: r.served_domain_fingerprint ?? null,
+            }));
+        },
+        async appendSessionTail(org, surfaceKey, token, entry) {
+            // Bounded ON WRITE, in the same round-trip pair as the insert. A ring pruned by a sweep
+            // instead has a window where a hot generation is unbounded, and this table takes a write on
+            // every wake and every post.
+            const { rows } = await client.query(`INSERT INTO session_tail (org_id, surface_key, token, seq, at, entry_json)
+         SELECT $1, $2, $3, COALESCE(MAX(seq), 0) + 1, $4, $5 FROM session_tail WHERE org_id = $1 AND surface_key = $2 AND token = $3
+         RETURNING seq`, [org, surfaceKey, token, entry.at, JSON.stringify(entry)]);
+            const seq = Number(rows[0].seq);
+            await client.query("DELETE FROM session_tail WHERE org_id = $1 AND surface_key = $2 AND token = $3 AND seq <= $4", [
+                org,
+                surfaceKey,
+                token,
+                seq - SESSION_TAIL_MAX_ENTRIES,
+            ]);
+        },
+        async readSessionTail(org, surfaceKey, token) {
+            const { rows } = await client.query("SELECT entry_json FROM session_tail WHERE org_id = $1 AND surface_key = $2 AND token = $3 ORDER BY seq ASC", [org, surfaceKey, token]);
+            // A row whose JSON no longer parses is DROPPED, not thrown on: this feeds a wake, and one bad
+            // row must never cost the whole tail.
+            const out = [];
+            for (const r of rows) {
+                try {
+                    out.push(JSON.parse(r.entry_json));
+                }
+                catch {
+                }
+            }
+            return out;
+        },
+        async clearSessionTail(org, surfaceKey, token) {
+            await client.query("DELETE FROM session_tail WHERE org_id = $1 AND surface_key = $2 AND token = $3", [org, surfaceKey, token]);
+        },
+        // The ring's only mutation: rewrite ONE post row's text, matched by its platform message id, after edit_reply's platform-CONFIRMED success - never on a refusal or an ambiguous outcome. entry_json is opaque to this store, so the match happens in JS on the parsed rows rather than in a JSON-in-SQL query, and the kind check skips a wake row that happens to carry the same platform id.
+        async editSessionTailPost(org, surfaceKey, token, messageId, text) {
+            const { rows } = await client.query("SELECT seq, entry_json FROM session_tail WHERE org_id = $1 AND surface_key = $2 AND token = $3 ORDER BY seq DESC", [org, surfaceKey, token]);
+            for (const r of rows) {
+                let entry;
+                try {
+                    entry = JSON.parse(r.entry_json);
+                }
+                catch {
+                    continue; // an unreadable row can't be the match — readSessionTail drops it too
+                }
+                if (entry.kind !== "post" || entry.id !== messageId)
+                    continue;
+                const updated = { ...entry, text };
+                await client.query("UPDATE session_tail SET entry_json = $1 WHERE org_id = $2 AND surface_key = $3 AND token = $4 AND seq = $5", [
+                    JSON.stringify(updated),
+                    org,
+                    surfaceKey,
+                    token,
+                    r.seq,
+                ]);
+                return true;
+            }
+            return false;
+        },
+        async listDomainSkills(org, domain) {
+            const { rows } = await client.query("SELECT name, content, updated_by, updated_at FROM domain_skill WHERE org_id = $1 AND domain = $2 ORDER BY name", [org, domain]);
+            return rows.map((r) => ({
+                org,
+                domain,
+                name: r.name,
+                content: r.content,
+                ...(r.updated_by ? { updatedBy: r.updated_by } : {}),
+                updatedAt: r.updated_at,
+            }));
+        },
+        async putDomainSkill(org, domain, name, content, updatedBy, updatedAt, provenance) {
+            // Record the REVISION FIRST, then the destructive upsert. The PgClient port is query-only - the Neon HTTP driver has no transaction across calls - so the two writes can tear, and the reachable tear must be an extra revision for a body that failed to arm rather than an armed body with no record of what was approved. Over-record rather than under-record.
+            await client.query(`INSERT INTO domain_skill_revisions (org_id, domain, name, content, authored_by, armed_by, approval_id, recorded_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`, [org, domain, name, content, updatedBy ?? null, provenance?.armedBy ?? null, provenance?.approvalId ?? null, updatedAt]);
+            await client.query(`INSERT INTO domain_skill (org_id, domain, name, content, updated_by, updated_at) VALUES ($1, $2, $3, $4, $5, $6)
+         ON CONFLICT (org_id, domain, name) DO UPDATE SET
+           content    = excluded.content,
+           updated_by = excluded.updated_by,
+           updated_at = excluded.updated_at`, [org, domain, name, content, updatedBy ?? null, updatedAt]);
+        },
+        async deleteDomainSkill(org, domain, name) {
+            const { rows } = await client.query("DELETE FROM domain_skill WHERE org_id = $1 AND domain = $2 AND name = $3 RETURNING name", [org, domain, name]);
+            return rows.length > 0;
+        },
+        async listDomainSkillRevisions(org, domain, name) {
+            const { rows } = await client.query(`SELECT seq, name, content, authored_by, armed_by, approval_id, recorded_at
+         FROM domain_skill_revisions
+         WHERE org_id = $1 AND domain = $2 AND ($3::text IS NULL OR name = $3)
+         ORDER BY seq`, [org, domain, name ?? null]);
+            return rows.map((r) => ({
+                seq: Number(r.seq), // bigint arrives as a string on some drivers
+                org,
+                domain,
+                name: r.name,
+                content: r.content,
+                ...(r.authored_by ? { authoredBy: r.authored_by } : {}),
+                ...(r.armed_by ? { armedBy: r.armed_by } : {}),
+                ...(r.approval_id ? { approvalId: r.approval_id } : {}),
+                recordedAt: r.recorded_at,
+            }));
+        },
+        async appendUsageEvent(entry) {
+            await client.query(`INSERT INTO usage_events
+           (org_id, surface_key, session_id, principal_id, ts, kind, routine_id,
+            input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, model, detail,
+            usd_micros_measured, cost_source, delegation_depth, root_session_id,
+            cache_tokens_reported, reasoning_tokens, surface_mode)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20)`, [
+                entry.org,
+                entry.surfaceKey,
+                entry.sessionId,
+                entry.principalId ?? null,
+                entry.ts,
+                entry.kind ?? null,
+                entry.routineId ?? null,
+                entry.inputTokens,
+                entry.outputTokens,
+                entry.cacheReadTokens,
+                entry.cacheWriteTokens,
+                entry.model ?? null,
+                entry.detail ? JSON.stringify(entry.detail) : null,
+                // `?? null` on all four, never `?? 0`/`?? ''` — a NULL says "this writer had nothing to
+                // report", which is a different fact from a measured zero or a root turn's depth 0.
+                entry.usdMicrosMeasured ?? null,
+                entry.costSource ?? null,
+                entry.delegationDepth ?? null,
+                entry.rootSessionId ?? null,
+                entry.cacheTokensReported ?? null,
+                entry.reasoningTokens ?? null,
+                // OPE-1862, same discipline: NULL says "no binding stamped this row", and a report masks
+                // such a row. It is never inferred from the surface id.
+                entry.surfaceMode ?? null,
+            ]);
+        },
+        async usageForSession(org, sessionId) {
+            const { rows } = await client.query(`SELECT surface_key, session_id, principal_id, ts, kind, routine_id,
+                input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, model, detail,
+                usd_micros_measured, cost_source, delegation_depth, root_session_id,
+                cache_tokens_reported, reasoning_tokens, surface_mode
+         FROM usage_events WHERE org_id = $1 AND session_id = $2 ORDER BY seq ASC`, [org, sessionId]);
+            return rows.map((r) => ({
+                org,
+                surfaceKey: r.surface_key,
+                sessionId: r.session_id,
+                ...(r.principal_id ? { principalId: r.principal_id } : {}),
+                ts: r.ts,
+                ...(r.kind ? { kind: r.kind } : {}),
+                ...(r.routine_id ? { routineId: r.routine_id } : {}),
+                inputTokens: Number(r.input_tokens),
+                outputTokens: Number(r.output_tokens),
+                cacheReadTokens: Number(r.cache_read_tokens),
+                cacheWriteTokens: Number(r.cache_write_tokens),
+                ...(r.model ? { model: r.model } : {}),
+                // OPE-369, read back on `!= null` (not truthiness): a measured $0 and a root turn's
+                // depth 0 are both real evidence and must not degrade to "absent". Mirrors sqlite.ts.
+                ...(r.usd_micros_measured != null ? { usdMicrosMeasured: Number(r.usd_micros_measured) } : {}),
+                ...(r.cost_source ? { costSource: r.cost_source === "measured" ? "measured" : "derived" } : {}),
+                ...(r.delegation_depth != null ? { delegationDepth: Number(r.delegation_depth) } : {}),
+                ...(r.root_session_id ? { rootSessionId: r.root_session_id } : {}),
+                ...(r.cache_tokens_reported != null ? { cacheTokensReported: r.cache_tokens_reported } : {}),
+                ...(r.reasoning_tokens != null ? { reasoningTokens: Number(r.reasoning_tokens) } : {}),
+                // OPE-1862: only the three declared spellings become a mode; every other value stays
+                // ABSENT, which the report mask treats as unclassified and hides. Mirrors sqlite.ts.
+                ...(() => {
+                    const mode = asSurfaceMode(r.surface_mode);
+                    return mode ? { surfaceMode: mode } : {};
+                })(),
+                ...(r.detail ? { detail: JSON.parse(r.detail) } : {}),
+            }));
+        },
+        async usageSummary(org, filter = {}) {
+            const where = ["org_id = $1"];
+            const params = [org];
+            if (filter.surfaceKeyPrefix !== undefined) {
+                params.push(`${filter.surfaceKeyPrefix}%`);
+                where.push(`surface_key LIKE $${params.length}`);
+            }
+            if (filter.sinceTs !== undefined) {
+                params.push(filter.sinceTs);
+                where.push(`ts >= $${params.length}`);
+            }
+            if (filter.untilTs !== undefined) {
+                params.push(filter.untilTs);
+                where.push(`ts <= $${params.length}`);
+            }
+            // OPE-402: exclude rows whose session had ANY recorded usage event before the bound — the
+            // session-scoped half of the leak sinceTs alone cannot close (see UsageSummaryFilter's doc).
+            // Reuses org_id = $1 from the outer WHERE inside the subquery (same query, same param list),
+            // and rides the existing (org_id, session_id) index (usage_events_org_session).
+            if (filter.sessionStartedAfter !== undefined) {
+                params.push(filter.sessionStartedAfter);
+                where.push(`session_id IN (SELECT session_id FROM usage_events WHERE org_id = $1 GROUP BY session_id HAVING MIN(ts) >= $${params.length})`);
+            }
+            const { rows } = await client.query(`SELECT surface_key, principal_id, kind, routine_id, model, surface_mode,
+                SUM(input_tokens) AS input_tokens, SUM(output_tokens) AS output_tokens,
+                SUM(cache_read_tokens) AS cache_read_tokens, SUM(cache_write_tokens) AS cache_write_tokens,
+                -- OPE-1611: the attribution dimension AND its coverage. COALESCE keeps the sum an
+                -- integer when every row is NULL; the two counts say how many calls actually
+                -- reported, so a reader never mistakes an all-NULL group's 0 for "no caching".
+                COALESCE(SUM(reasoning_tokens), 0) AS reasoning_tokens,
+                COUNT(*) FILTER (WHERE cache_tokens_reported) AS cache_reported_calls,
+                COUNT(reasoning_tokens) AS reasoning_reported_calls,
+                COUNT(*) AS events, COUNT(DISTINCT session_id) AS sessions
+         FROM usage_events WHERE ${where.join(" AND ")}
+         -- OPE-1862: surface_mode joins the GRAIN rather than riding along as MAX(). A group must
+         -- be homogeneous in every column it reports, and one surface can hold both unstamped
+         -- legacy rows and stamped new ones; those two masks differently, so they must not blend.
+         GROUP BY surface_key, principal_id, kind, routine_id, model, surface_mode`, params);
+            return rows.map((r) => ({
+                surfaceKey: r.surface_key,
+                ...(r.principal_id ? { principalId: r.principal_id } : {}),
+                ...(r.kind ? { kind: r.kind } : {}),
+                ...(r.routine_id ? { routineId: r.routine_id } : {}),
+                ...(r.model ? { model: r.model } : {}),
+                ...(() => {
+                    const mode = asSurfaceMode(r.surface_mode);
+                    return mode ? { surfaceMode: mode } : {};
+                })(),
+                inputTokens: Number(r.input_tokens),
+                outputTokens: Number(r.output_tokens),
+                cacheReadTokens: Number(r.cache_read_tokens),
+                cacheWriteTokens: Number(r.cache_write_tokens),
+                reasoningTokens: Number(r.reasoning_tokens),
+                cacheReportedCalls: Number(r.cache_reported_calls),
+                reasoningReportedCalls: Number(r.reasoning_reported_calls),
+                events: Number(r.events),
+                sessions: Number(r.sessions),
+            }));
+        },
+        async pruneUsageEvents() {
+            // NO-OP under Postgres by design: usage_events is append-only at the DB layer
+            // (SELECT+INSERT-only RLS under FORCE — see the schema comment above), so no role
+            // short of a superuser (owner included) can DELETE from it. Real retention here needs
+            // a maintenance path outside this seam (a migration-role-owned SECURITY DEFINER prune);
+            // sqlite.ts prunes for real (local/dev is single-tenant-trusted, no such gate).
+            return 0;
+        },
+        async appendModelCallCapture(write) {
+            await client.query(`INSERT INTO model_call_capture
+           (org_id, surface_key, session_id, turn_id, step_index, ts, model, provider,
+            schema_version, sha256, body_bytes, body_gzip_b64, truncated)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)`, [
+                write.org,
+                write.surfaceKey,
+                write.sessionId,
+                write.turnId,
+                write.stepIndex,
+                write.ts,
+                write.model,
+                write.provider,
+                write.schemaVersion,
+                write.sha256,
+                write.bodyBytes,
+                write.bodyGzipB64,
+                write.truncated,
+            ]);
+        },
+        async modelCallCapturesForSession(org, sessionId, opts = {}) {
+            const includeBody = opts.includeBody !== false;
+            // The body column is selected only when asked for — a metadata read must not drag tens of MB
+            // of prompt bytes across the wire for a count.
+            const bodyCol = includeBody ? "body_gzip_b64" : "'' AS body_gzip_b64";
+            const where = ["org_id = $1", "session_id = $2"];
+            const params = [org, sessionId];
+            if (opts.turnId !== undefined) {
+                params.push(opts.turnId);
+                where.push(`turn_id = $${params.length}`);
+            }
+            let limit = "";
+            if (opts.limit !== undefined) {
+                params.push(Math.max(0, Math.floor(opts.limit)));
+                limit = ` LIMIT $${params.length}`;
+            }
+            const { rows } = await client.query(`SELECT seq, surface_key, session_id, turn_id, step_index, ts, model, provider,
+                schema_version, sha256, body_bytes, ${bodyCol}, truncated
+         FROM model_call_capture WHERE ${where.join(" AND ")} ORDER BY seq ASC${limit}`, params);
+            return rows.map((r) => ({
+                seq: Number(r.seq),
+                org,
+                surfaceKey: r.surface_key,
+                sessionId: r.session_id,
+                turnId: r.turn_id,
+                stepIndex: Number(r.step_index),
+                ts: r.ts,
+                model: r.model,
+                provider: r.provider,
+                schemaVersion: Number(r.schema_version),
+                sha256: r.sha256,
+                bodyBytes: Number(r.body_bytes),
+                bodyGzipB64: r.body_gzip_b64,
+                truncated: r.truncated === true,
+            }));
+        },
+        async modelCallCaptureSessions(org) {
+            const { rows } = await client.query(`SELECT session_id, MIN(ts) AS first_ts, MAX(ts) AS last_ts, COUNT(*) AS row_count, SUM(body_bytes) AS total_bytes
+         FROM model_call_capture WHERE org_id = $1
+         GROUP BY session_id
+         ORDER BY MAX(ts) DESC`, [org]);
+            return rows.map((r) => ({
+                sessionId: r.session_id,
+                firstTs: r.first_ts,
+                lastTs: r.last_ts,
+                rowCount: Number(r.row_count),
+                totalBytes: Number(r.total_bytes ?? 0),
+            }));
+        },
+        async deleteModelCallCapturesForSession(org, sessionId) {
+            // A REAL delete here, unlike pruneUsageEvents above: this table is not append-only, precisely
+            // so that the harvest-then-drop retention story holds on the deployed Postgres too.
+            // `RETURNING seq` and count the rows — the one-method PgClient port exposes no rowCount, the
+            // same reason every other delete in this file returns its keys.
+            const { rows } = await client.query(`DELETE FROM model_call_capture WHERE org_id = $1 AND session_id = $2 RETURNING seq`, [org, sessionId]);
+            return rows.length;
+        },
+        async addMemoryProposal(write) {
+            const { rows } = await client.query(`INSERT INTO memory_proposal (org_id, kind, scope, summary, before_text, after_text, detail_json, principal_id, created_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+         RETURNING id`, [
+                write.org,
+                write.kind,
+                write.scope,
+                write.summary,
+                write.before ?? null,
+                write.after ?? null,
+                write.detail ? JSON.stringify(write.detail) : null,
+                write.principalId,
+                write.createdAt,
+            ]);
+            return { ...write, id: Number(rows[0].id) };
+        },
+        async listMemoryProposals(org) {
+            const { rows } = await client.query(`SELECT id, kind, scope, summary, before_text, after_text, detail_json, principal_id, created_at
+         FROM memory_proposal WHERE org_id = $1 ORDER BY id DESC`, [org]);
+            return rows.map((r) => ({
+                id: Number(r.id),
+                org,
+                kind: r.kind,
+                scope: r.scope,
+                summary: r.summary,
+                ...(r.before_text !== null ? { before: r.before_text } : {}),
+                ...(r.after_text !== null ? { after: r.after_text } : {}),
+                ...(r.detail_json ? { detail: JSON.parse(r.detail_json) } : {}),
+                principalId: r.principal_id,
+                createdAt: r.created_at,
+            }));
+        },
+        async getDmAudience(org, address) {
+            const { rows } = await client.query("SELECT address, first_dm_at, stopped_at FROM dm_audience WHERE org_id = $1 AND address = $2", [org, address]);
+            const row = rows[0];
+            return row ? dmAudienceRowFrom(row) : null;
+        },
+        async markDmAudienceDelivered(org, address, at) {
+            // COALESCE keeps the ORIGINAL first_dm_at — see store.ts's method doc. `stopped_at` is not in
+            // the update list at all, so a delivery can never clear a stop even if a caller raced one.
+            await client.query(`INSERT INTO dm_audience (org_id, address, first_dm_at, stopped_at) VALUES ($1, $2, $3, NULL)
+         ON CONFLICT (org_id, address) DO UPDATE SET first_dm_at = COALESCE(dm_audience.first_dm_at, excluded.first_dm_at)`, [org, address, at]);
+        },
+        async setDmAudienceStopped(org, address, at) {
+            // COALESCE for the same reason as above, in the other direction: a second stop keeps the FIRST
+            // stopped_at, so the trail records when the boundary was first drawn rather than last repeated.
+            await client.query(`INSERT INTO dm_audience (org_id, address, first_dm_at, stopped_at) VALUES ($1, $2, NULL, $3)
+         ON CONFLICT (org_id, address) DO UPDATE SET stopped_at = COALESCE(dm_audience.stopped_at, excluded.stopped_at)`, [org, address, at]);
+        },
+        async clearDmAudienceStopped(org, address) {
+            // The `stopped_at IS NOT NULL` conjunct is what makes the return value honest: RETURNING yields
+            // a row only when the UPDATE actually altered one, so a row that was never stopped answers
+            // false rather than reporting a resume that resumed nothing.
+            const { rows } = await client.query("UPDATE dm_audience SET stopped_at = NULL WHERE org_id = $1 AND address = $2 AND stopped_at IS NOT NULL RETURNING address", [org, address]);
+            return rows.length > 0;
+        },
+        async listDmAudience(org) {
+            const { rows } = await client.query("SELECT address, first_dm_at, stopped_at FROM dm_audience WHERE org_id = $1 ORDER BY address", [org]);
+            return rows.map(dmAudienceRowFrom);
+        },
+        async runAnalyticsQuery(compiled) {
+            // OPE-66: assemble the SELECT-only statement with `$n` placeholders (the Postgres style) and
+            // run it read-only. Every non-param token is registry-derived; only `params` bind. Numeric
+            // SUM/COUNT come back as bigint STRINGS — analytics/execute.ts coerces. Org RLS backstops the
+            // org_id scope conjunct (defence in depth, same as every other read here).
+            const { sql, params } = assembleAnalyticsSql(compiled, "dollar");
+            const { rows } = await client.query(sql, params);
+            return rows;
+        },
+        async enqueueIngressDelivery(org, write) {
+            // Only payload-free completed tombstones are clock-pruned. Pending work has NULL retention
+            // and survives an arbitrarily long provider/store outage.
+            await client.query(`DELETE FROM ingress_delivery
+          WHERE org_id = $1 AND source = $2 AND completed_at IS NOT NULL
+            AND retain_until IS NOT NULL AND retain_until <= $3`, [org, write.source, write.receivedAt]);
+            const { rows } = await client.query(`INSERT INTO ingress_delivery
+           (org_id, source, authority_id, delivery_id, payload_json, received_at, available_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $6)
+         ON CONFLICT (org_id, source, authority_id, delivery_id) DO NOTHING
+         RETURNING delivery_id`, [org, write.source, write.authorityId, write.deliveryId, write.payloadJson, write.receivedAt]);
+            return rows.length > 0;
+        },
+        async listDueIngressDeliveries(org, source, nowIso, staleBeforeIso, limit) {
+            const { rows } = await client.query(`SELECT authority_id, delivery_id, received_at, available_at
+           FROM ingress_delivery
+          WHERE org_id = $1 AND source = $2 AND completed_at IS NULL AND payload_json IS NOT NULL
+            AND available_at <= $3
+            AND (claim_id IS NULL OR (claimed_at IS NOT NULL AND claimed_at <= $4))
+          ORDER BY received_at ASC, authority_id ASC, delivery_id ASC
+          LIMIT $5`, [org, source, nowIso, staleBeforeIso, Math.max(0, Math.trunc(limit))]);
+            return rows.map((row) => ({
+                source,
+                authorityId: row.authority_id,
+                deliveryId: row.delivery_id,
+                receivedAt: row.received_at,
+                availableAt: row.available_at,
+            }));
+        },
+        async claimIngressDelivery(org, key, claimId, claimedAtIso, staleBeforeIso) {
+            const { rows } = await client.query(`UPDATE ingress_delivery SET claim_id = $1, claimed_at = $2
+          WHERE org_id = $3 AND source = $4 AND authority_id = $5 AND delivery_id = $6
+            AND completed_at IS NULL AND payload_json IS NOT NULL AND available_at <= $2
+            AND (claim_id IS NULL OR (claimed_at IS NOT NULL AND claimed_at <= $7))
+        RETURNING payload_json, received_at, available_at`, [claimId, claimedAtIso, org, key.source, key.authorityId, key.deliveryId, staleBeforeIso]);
+            const row = rows[0];
+            return row
+                ? {
+                    ...key,
+                    payloadJson: row.payload_json,
+                    receivedAt: row.received_at,
+                    availableAt: row.available_at,
+                    claimId,
+                    claimedAt: claimedAtIso,
+                }
+                : null;
+        },
+        async releaseIngressDelivery(org, key, claimId, availableAtIso) {
+            const { rows } = await client.query(`UPDATE ingress_delivery SET claim_id = NULL, claimed_at = NULL, available_at = $1
+          WHERE org_id = $2 AND source = $3 AND authority_id = $4 AND delivery_id = $5
+            AND completed_at IS NULL AND claim_id = $6
+        RETURNING delivery_id`, [availableAtIso, org, key.source, key.authorityId, key.deliveryId, claimId]);
+            return rows.length > 0;
+        },
+        async completeIngressDelivery(org, key, claimId, completedAtIso, retainUntilIso) {
+            assertIngressDeliveryRetainUntil(completedAtIso, retainUntilIso);
+            const { rows } = await client.query(`UPDATE ingress_delivery
+            SET payload_json = NULL, claim_id = NULL, claimed_at = NULL,
+                completed_at = $1, retain_until = $2
+          WHERE org_id = $3 AND source = $4 AND authority_id = $5 AND delivery_id = $6
+            AND completed_at IS NULL AND claim_id = $7
+        RETURNING delivery_id`, [completedAtIso, retainUntilIso, org, key.source, key.authorityId, key.deliveryId, claimId]);
+            return rows.length > 0;
+        },
+        async discardIngressDelivery(org, key, claimId) {
+            const { rows } = await client.query(`DELETE FROM ingress_delivery
+          WHERE org_id = $1 AND source = $2 AND authority_id = $3 AND delivery_id = $4
+            AND completed_at IS NULL AND claim_id = $5
+        RETURNING delivery_id`, [org, key.source, key.authorityId, key.deliveryId, claimId]);
+            return rows.length > 0;
+        },
+        async markEventSeen(org, key, at, ttlMs) {
+            // Opportunistic prune keeps the table bounded; ISO timestamps compare lexicographically.
+            // TWO clauses, both ORG-SCOPED (see store.ts): the caller's `ttlMs` applied to THIS KEY ONLY
+            // — the table is shared by callers whose windows differ by an order of magnitude, so a bare
+            // TTL sweep let the shortest-TTL caller expire everyone else's keys AND crossed the tenant
+            // boundary — plus a fixed 24 h housekeeping ceiling for the rest of this org's rows.
+            const atMs = Date.parse(at);
+            const ttlCutoff = new Date(atMs - ttlMs).toISOString();
+            const maxCutoff = new Date(atMs - EVENT_DEDUPE_MAX_RETENTION_MS).toISOString();
+            await client.query("DELETE FROM event_dedupe WHERE org_id = $1 AND (seen_at < $2 OR (key = $3 AND seen_at < $4))", [
+                org,
+                maxCutoff,
+                key,
+                ttlCutoff,
+            ]);
+            // ON CONFLICT DO NOTHING + RETURNING is the atomic first-sighting check: exactly
+            // one of two racing inserts returns a row; the loser returns none → duplicate.
+            const { rows } = await client.query("INSERT INTO event_dedupe (org_id, key, seen_at) VALUES ($1, $2, $3) ON CONFLICT (org_id, key) DO NOTHING RETURNING key", [org, key, at]);
+            return rows.length > 0;
+        },
+        async hasEventSeen(org, key, at, ttlMs) {
+            // READ-ONLY twin of markEventSeen: same cutoff arithmetic, no write, no prune.
+            const cutoff = new Date(Date.parse(at) - ttlMs).toISOString();
+            const { rows } = await client.query("SELECT 1 FROM event_dedupe WHERE org_id = $1 AND key = $2 AND seen_at >= $3 LIMIT 1", [
+                org,
+                key,
+                cutoff,
+            ]);
+            return rows.length > 0;
+        },
+        async forgetEventSeen(org, key) {
+            // ONE row, org-scoped and keyed — never a sweep. See the interface note for when a claim is
+            // given back (OPE-821: a DEFINITIVE post failure, so an identical retry can really post).
+            await client.query("DELETE FROM event_dedupe WHERE org_id = $1 AND key = $2", [org, key]);
+        },
+        async claimNotice(org, key, at) {
+            // ON CONFLICT DO NOTHING + RETURNING is the atomic claim, exactly as markEventSeen's is: one of
+            // two racing callers gets a row back and announces; the loser gets none and stays quiet.
+            // NO DELETE PATH — a claim is a lifetime record, and dropping one lets the thing it records
+            // happen a second time. Every key space on this table is bounded by the thing it records.
+            const { rows } = await client.query("INSERT INTO notice_claim (org_id, key, claimed_at) VALUES ($1, $2, $3) ON CONFLICT (org_id, key) DO NOTHING RETURNING key", [org, key, at]);
+            return rows.length > 0;
+        },
+        async noticeClaimed(org, key) {
+            const { rows } = await client.query("SELECT 1 FROM notice_claim WHERE org_id = $1 AND key = $2 LIMIT 1", [org, key]);
+            return rows.length > 0;
+        },
+        async recordProactiveAddress(org, row) {
+            await client.query(`INSERT INTO proactive_address (org_id, platform, kind, ref_key, tenant, address, updated_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $7)
+         ON CONFLICT (org_id, platform, kind, ref_key) DO UPDATE SET
+           tenant = EXCLUDED.tenant, address = EXCLUDED.address, updated_at = EXCLUDED.updated_at`, [org, row.platform, row.kind, row.refKey, row.tenant, JSON.stringify(row.address ?? {}), row.updatedAt]);
+        },
+        async proactiveAddress(org, platform, kind, refKey) {
+            const { rows } = await client.query("SELECT tenant, address, updated_at FROM proactive_address WHERE org_id = $1 AND platform = $2 AND kind = $3 AND ref_key = $4", [org, platform, kind, refKey]);
+            const r = rows[0];
+            return r ? proactiveAddressRow(platform, kind, refKey, r.tenant, r.address, r.updated_at) : undefined;
+        },
+        async proactiveAddresses(org, platform, kind, limit) {
+            const { rows } = await client.query(`SELECT ref_key, tenant, address, updated_at FROM proactive_address
+         WHERE org_id = $1 AND platform = $2 AND kind = $3 ORDER BY updated_at DESC LIMIT $4`, [org, platform, kind, Math.max(0, Math.trunc(limit))]);
+            return rows.map((r) => proactiveAddressRow(platform, kind, r.ref_key, r.tenant, r.address, r.updated_at));
+        },
+        async captureDelivery(org, source, documentJson, at, captureUntil, maxRows) {
+            // The three bounds, in the same order and for the same reasons as the sqlite twin — read that
+            // one's comments; they are the canonical statement and this is the port of it.
+            const atMs = Date.parse(at);
+            if (!Number.isFinite(atMs))
+                return false;
+            const maxCutoff = new Date(atMs - CAPTURE_MAX_RETENTION_MS).toISOString();
+            await client.query("DELETE FROM webhook_capture WHERE org_id = $1 AND captured_at < $2", [org, maxCutoff]);
+            const untilMs = Date.parse(captureUntil);
+            if (!Number.isFinite(untilMs) || atMs >= untilMs)
+                return false;
+            const { rows } = await client.query("SELECT COUNT(*) AS n, COALESCE(MAX(seq), 0) AS max_seq FROM webhook_capture WHERE org_id = $1 AND source = $2", [org, source]);
+            // COUNT comes back as a bigint STRING on this driver and MAX(seq) as a number-or-string —
+            // coerce both rather than comparing a string to `maxRows`, which would compare lexicographically
+            // and let the volume bound fail open somewhere past nine rows.
+            const agg = (rows[0] ?? {});
+            const n = Number(agg.n ?? 0);
+            const maxSeq = Number(agg.max_seq ?? 0);
+            if (!Number.isFinite(n) || n >= maxRows)
+                return false;
+            await client.query("INSERT INTO webhook_capture (org_id, source, seq, captured_at, document) VALUES ($1, $2, $3, $4, $5)", [
+                org,
+                source,
+                maxSeq + 1,
+                at,
+                documentJson,
+            ]);
+            return true;
+        },
+        async listCapturedDeliveries(org, source, limit) {
+            const { rows } = await client.query("SELECT seq, captured_at, document FROM webhook_capture WHERE org_id = $1 AND source = $2 ORDER BY seq ASC LIMIT $3", [org, source, limit]);
+            return rows.map((r) => ({
+                seq: Number(r.seq),
+                capturedAt: r.captured_at,
+                documentJson: r.document,
+            }));
+        },
+        async clearCapturedDeliveries(org, source) {
+            await client.query("DELETE FROM webhook_capture WHERE org_id = $1 AND source = $2", [org, source]);
+        },
+        async putUnifiedWakeTarget(org, wakeId, targetJson, at, ttlMs, windowToken, inbound) {
+            // Opportunistic TTL prune, same posture as markEventSeen (bounded table, no scheduled job).
+            // ORG-SCOPED: one org's write must never prune another org's rows — the every-query-filters-
+            // by-org invariant (a bare `created_at < cutoff` DELETE would cross the tenant boundary).
+            const cutoff = new Date(Date.parse(at) - ttlMs).toISOString();
+            await client.query("DELETE FROM unified_wake_target WHERE created_at < $1 AND org_id = $2", [cutoff, org]);
+            await client.query(
+            // 🔴 The conflict clause updates target_json/created_at/window_token and NEVER the answered
+            // columns — a redrive/webhook-retry re-register must not clear (or resurrect) a mark.
+            // 🔴 `inbound` is STICKY-TRUE (an OR over the two sides), unlike every other updated column:
+            // the redrive re-registers an EXISTING wake id as an INTERNAL dispatch, and a plain overwrite
+            // would clear the flag on a row a human's message created.
+            `INSERT INTO unified_wake_target (org_id, wake_id, target_json, created_at, window_token, inbound) VALUES ($1, $2, $3, $4, $5, $6)
+         ON CONFLICT (org_id, wake_id) DO UPDATE SET target_json = EXCLUDED.target_json, created_at = EXCLUDED.created_at, window_token = EXCLUDED.window_token,
+           inbound = COALESCE(unified_wake_target.inbound, false) OR COALESCE(EXCLUDED.inbound, false)`, [org, wakeId, targetJson, at, windowToken ?? null, inbound === true]);
+        },
+        async getUnifiedWakeTarget(org, wakeId) {
+            const { rows } = await client.query("SELECT target_json FROM unified_wake_target WHERE org_id = $1 AND wake_id = $2", [org, wakeId]);
+            const r = rows[0];
+            return r ? r.target_json : null;
+        },
+        async getUnifiedWakeRecord(org, wakeId) {
+            const { rows } = await client.query("SELECT target_json, created_at, window_token, answered_at, answered_turn_id, audited_at, inbound FROM unified_wake_target WHERE org_id = $1 AND wake_id = $2", [org, wakeId]);
+            const r = rows[0];
+            if (!r)
+                return null;
+            return {
+                targetJson: r.target_json,
+                createdAt: r.created_at,
+                ...(r.window_token !== null ? { windowToken: r.window_token } : {}),
+                ...(r.answered_at !== null ? { answeredAt: r.answered_at } : {}),
+                ...(r.answered_turn_id !== null ? { answeredTurnId: r.answered_turn_id } : {}),
+                ...(r.audited_at !== null ? { auditedAt: r.audited_at } : {}),
+                // A NULL column is a legacy row, and it stays ABSENT rather than becoming `false` — the two
+                // say different things, and every reader treats absent as attended (OPE-2051).
+                ...(r.inbound !== null ? { inbound: r.inbound } : {}),
+            };
+        },
+        async listPendingUnifiedWakes(org, windowToken, afterIso, limit) {
+            // ORDER BY created_at ASC: the gate reports the OLDEST unseen messages first, which is the order
+            // a reader would meet them in. `answered_at IS NULL` is the whole "pending" definition — the same
+            // column the answerable-reply fence reads, so the two can never disagree about what pending means.
+            const { rows } = await client.query(`SELECT wake_id, target_json, created_at FROM unified_wake_target
+         WHERE org_id = $1 AND window_token = $2 AND answered_at IS NULL AND inbound IS TRUE AND created_at > $3
+         ORDER BY created_at ASC LIMIT $4`, [org, windowToken, afterIso, limit]);
+            return rows.map((r) => ({
+                wakeId: r.wake_id,
+                targetJson: r.target_json,
+                createdAt: r.created_at,
+            }));
+        },
+        async listUnauditedUnifiedWakes(org, windowToken, limit) {
+            // Same pending definition as the listing above, plus the OPE-836 horizon (`audited_at IS NULL`)
+            // and NO time bound below — a row an earlier turn considered is already excluded by the column.
+            // The filter is in SQL so `limit` bounds the rows still to consider, never a backlog of audited
+            // ones. This query is the accounting audit's alone; the freshness gate's own SQL is untouched.
+            const { rows } = await client.query(`SELECT wake_id, target_json, created_at FROM unified_wake_target
+         WHERE org_id = $1 AND window_token = $2 AND answered_at IS NULL AND inbound IS TRUE AND audited_at IS NULL
+         ORDER BY created_at ASC LIMIT $3`, [org, windowToken, limit]);
+            return rows.map((r) => ({
+                wakeId: r.wake_id,
+                targetJson: r.target_json,
+                createdAt: r.created_at,
+            }));
+        },
+        async markUnifiedWakesAudited(org, wakeIds, at) {
+            // UPDATE-only and FIRST-STAMP-WINS (`audited_at IS NULL`), so a re-run cannot move the horizon
+            // stamp and a missing row inserts nothing. ONE statement for the whole batch via `= ANY`.
+            if (wakeIds.length === 0)
+                return;
+            await client.query("UPDATE unified_wake_target SET audited_at = $1 WHERE org_id = $2 AND wake_id = ANY($3::text[]) AND audited_at IS NULL", [
+                at,
+                org,
+                [...wakeIds],
+            ]);
+        },
+        async markUnifiedWakeAnswered(org, wakeId, at, turnId) {
+            // UPDATE-only (never an upsert): an answered mark on a row with no origin is meaningless, and
+            // inserting one would create a phantom the resolver would then have to reject.
+            await client.query("UPDATE unified_wake_target SET answered_at = $1, answered_turn_id = $2 WHERE org_id = $3 AND wake_id = $4", [
+                at,
+                turnId ?? null,
+                org,
+                wakeId,
+            ]);
+        },
+        async putThreadOwner(org, channelKey, threadKey, taskToken, at, ttlMs) {
+            // Opportunistic TTL prune, a backstop over complete_thread and generation GC. It is org-scoped, so it never crosses the tenant boundary.
+            const cutoff = new Date(Date.parse(at) - ttlMs).toISOString();
+            await client.query("DELETE FROM thread_ownership WHERE created_at < $1 AND org_id = $2", [cutoff, org]);
+            await client.query(`INSERT INTO thread_ownership (org_id, channel_key, thread_key, task_token, created_at) VALUES ($1, $2, $3, $4, $5)
+         ON CONFLICT (org_id, channel_key, thread_key) DO UPDATE SET task_token = EXCLUDED.task_token, created_at = EXCLUDED.created_at`, [org, channelKey, threadKey, taskToken, at]);
+        },
+        async getThreadOwner(org, channelKey, threadKey) {
+            const { rows } = await client.query("SELECT task_token FROM thread_ownership WHERE org_id = $1 AND channel_key = $2 AND thread_key = $3", [org, channelKey, threadKey]);
+            const r = rows[0];
+            return r ? r.task_token : null;
+        },
+        async clearThreadOwner(org, channelKey, threadKey) {
+            const { rows } = await client.query("DELETE FROM thread_ownership WHERE org_id = $1 AND channel_key = $2 AND thread_key = $3 RETURNING task_token", [org, channelKey, threadKey]);
+            return rows.length > 0;
+        },
+        async putThreadSeatState(org, row, at, ttlMs) {
+            // Opportunistic ORG-SCOPED TTL prune, the same posture as putThreadOwner above.
+            const cutoff = new Date(Date.parse(at) - ttlMs).toISOString();
+            await client.query("DELETE FROM thread_seat_state WHERE updated_at < $1 AND org_id = $2", [cutoff, org]);
+            await client.query(`INSERT INTO thread_seat_state (org_id, channel_key, thread_key, seat_token, parent_key, state, origin_json, report, opened_at, updated_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
+         ON CONFLICT (org_id, channel_key, thread_key) DO UPDATE SET
+           seat_token = EXCLUDED.seat_token,
+           parent_key = EXCLUDED.parent_key,
+           state = EXCLUDED.state,
+           origin_json = EXCLUDED.origin_json,
+           report = EXCLUDED.report,
+           opened_at = EXCLUDED.opened_at,
+           updated_at = EXCLUDED.updated_at`, [org, row.channelKey, row.threadKey, row.seatToken, row.parentRegistryKey, row.state, row.originJson, row.report ?? null, row.openedAt, at]);
+        },
+        async getThreadSeatState(org, channelKey, threadKey) {
+            const { rows } = await client.query("SELECT seat_token, parent_key, state, origin_json, report, opened_at, updated_at FROM thread_seat_state WHERE org_id = $1 AND channel_key = $2 AND thread_key = $3", [org, channelKey, threadKey]);
+            const r = rows[0];
+            if (!r)
+                return null;
+            return {
+                channelKey,
+                threadKey,
+                seatToken: r.seat_token,
+                parentRegistryKey: r.parent_key,
+                // Anything but the two written values reads as `completed` — see the sqlite twin for why the
+                // unreadable case must never report a seat as LIVE.
+                state: r.state === "open" ? "open" : "completed",
+                originJson: r.origin_json,
+                ...(r.report !== null ? { report: r.report } : {}),
+                openedAt: r.opened_at,
+                updatedAt: r.updated_at,
+            };
+        },
+        async putTurnAnchor(org, anchor, at, ttlMs) {
+            // Opportunistic TTL prune, a backstop over the turn-end clear. It is org-scoped, so it never crosses the tenant boundary.
+            const cutoff = new Date(Date.parse(at) - ttlMs).toISOString();
+            await client.query("DELETE FROM turn_anchor WHERE created_at < $1 AND org_id = $2", [cutoff, org]);
+            await client.query(`INSERT INTO turn_anchor (org_id, window_key, anchor_key, channel_key, session_id, turn_id, surface_key, created_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+         ON CONFLICT (org_id, window_key) DO UPDATE SET
+           anchor_key = EXCLUDED.anchor_key, channel_key = EXCLUDED.channel_key,
+           session_id = EXCLUDED.session_id, turn_id = EXCLUDED.turn_id,
+           surface_key = EXCLUDED.surface_key, created_at = EXCLUDED.created_at`, [org, anchor.windowKey, anchor.anchorKey ?? null, anchor.channelKey ?? null, anchor.sessionId, anchor.turnId, anchor.surfaceKey, at]);
+        },
+        async getTurnAnchorByWindow(org, windowKey) {
+            const { rows } = await client.query(`${TURN_ANCHOR_SELECT} WHERE org_id = $1 AND window_key = $2`, [org, windowKey]);
+            return turnAnchorFromPgRow(rows[0]);
+        },
+        async getTurnAnchorByAnchor(org, anchorKey) {
+            const { rows } = await client.query(`${TURN_ANCHOR_SELECT} WHERE org_id = $1 AND anchor_key = $2`, [org, anchorKey]);
+            return turnAnchorFromPgRow(rows[0]);
+        },
+        async getLatestTurnAnchorForChannel(org, channelKey) {
+            const { rows } = await client.query(`${TURN_ANCHOR_SELECT} WHERE org_id = $1 AND channel_key = $2 ORDER BY created_at DESC, window_key DESC LIMIT 1`, [org, channelKey]);
+            return turnAnchorFromPgRow(rows[0]);
+        },
+        async clearTurnAnchor(org, windowKey) {
+            const { rows } = await client.query("DELETE FROM turn_anchor WHERE org_id = $1 AND window_key = $2 RETURNING window_key", [org, windowKey]);
+            return rows.length > 0;
+        },
+        async putTaskResult(org, taskId, resultJson, at, ttlMs) {
+            // Opportunistic TTL prune for a bounded table with no scheduled job. It is org-scoped, so one org's write never touches another org's rows.
+            const cutoff = new Date(Date.parse(at) - ttlMs).toISOString();
+            await client.query("DELETE FROM task_result WHERE created_at < $1 AND org_id = $2", [cutoff, org]);
+            await client.query(`INSERT INTO task_result (org_id, task_id, result_json, created_at) VALUES ($1, $2, $3, $4)
+         ON CONFLICT (org_id, task_id) DO UPDATE SET result_json = EXCLUDED.result_json, created_at = EXCLUDED.created_at`, [org, taskId, resultJson, at]);
+        },
+        async putTaskResultIfAbsent(org, taskId, resultJson, at, ttlMs) {
+            const cutoff = new Date(Date.parse(at) - ttlMs).toISOString();
+            await client.query("DELETE FROM task_result WHERE created_at < $1 AND org_id = $2", [cutoff, org]);
+            const { rows } = await client.query(`INSERT INTO task_result (org_id, task_id, result_json, created_at) VALUES ($1, $2, $3, $4)
+         ON CONFLICT (org_id, task_id) DO NOTHING RETURNING task_id`, [org, taskId, resultJson, at]);
+            return rows.length > 0;
+        },
+        async getTaskResult(org, taskId) {
+            const { rows } = await client.query("SELECT result_json FROM task_result WHERE org_id = $1 AND task_id = $2", [org, taskId]);
+            const r = rows[0];
+            return r ? r.result_json : null;
+        },
+        async deleteTaskResult(org, taskId) {
+            const { rows } = await client.query("DELETE FROM task_result WHERE org_id = $1 AND task_id = $2 RETURNING task_id", [org, taskId]);
+            return rows.length > 0;
+        },
+        async putSlackAttachment(org, fileId, rec, at, ttlMs) {
+            // Opportunistic TTL prune for a bounded routing map with no scheduled job. It is org-scoped, so it never crosses the tenant boundary.
+            const cutoff = new Date(Date.parse(at) - ttlMs).toISOString();
+            await client.query("DELETE FROM slack_attachment WHERE created_at < $1 AND org_id = $2", [cutoff, org]);
+            await client.query(`INSERT INTO slack_attachment (org_id, file_id, url_private, mime_type, name, team_id, created_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $7)
+         ON CONFLICT (org_id, file_id) DO UPDATE SET
+           url_private = EXCLUDED.url_private, mime_type = EXCLUDED.mime_type,
+           name = EXCLUDED.name, team_id = EXCLUDED.team_id, created_at = EXCLUDED.created_at`, [org, fileId, rec.urlPrivate, rec.mimeType ?? null, rec.name ?? null, rec.teamId ?? null, at]);
+        },
+        async getSlackAttachment(org, fileId) {
+            const { rows } = await client.query("SELECT url_private, mime_type, name, team_id FROM slack_attachment WHERE org_id = $1 AND file_id = $2", [org, fileId]);
+            const r = rows[0];
+            if (!r)
+                return null;
+            const rec = {
+                urlPrivate: r.url_private,
+                ...(r.mime_type ? { mimeType: r.mime_type } : {}),
+                ...(r.name ? { name: r.name } : {}),
+                ...(r.team_id ? { teamId: r.team_id } : {}),
+            };
+            return rec;
+        },
+        async putStoredCredential(org, rec) {
+            // Upsert the ciphertext envelope. `rec.ciphertext` is opaque here — never inspected, never logged.
+            await client.query(`INSERT INTO stored_credential (org_id, ref, ciphertext, connector, domain, created_by, created_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $7)
+         ON CONFLICT (org_id, ref) DO UPDATE SET
+           ciphertext = EXCLUDED.ciphertext, connector = EXCLUDED.connector,
+           domain = EXCLUDED.domain, created_by = EXCLUDED.created_by, created_at = EXCLUDED.created_at`, [org, rec.ref, rec.ciphertext, rec.connector ?? null, rec.domain ?? null, rec.createdBy, rec.createdAt]);
+        },
+        async getStoredCredential(org, ref) {
+            const { rows } = await client.query("SELECT ref, ciphertext, connector, domain, created_by, created_at FROM stored_credential WHERE org_id = $1 AND ref = $2", [org, ref]);
+            const r = rows[0];
+            if (!r)
+                return null;
+            return {
+                ref: r.ref,
+                ciphertext: r.ciphertext,
+                ...(r.connector ? { connector: r.connector } : {}),
+                ...(r.domain ? { domain: r.domain } : {}),
+                createdBy: r.created_by,
+                createdAt: r.created_at,
+            };
+        },
+        async deleteStoredCredential(org, ref) {
+            // A REAL delete of the ciphertext row - see the store port for why this table retires by destruction rather than by status. The stored_credential_org_isolation policy is declared with no FOR clause, so it is FOR ALL and its USING expression applies to DELETE exactly as it does to SELECT and UPDATE.
+            const { rows } = await client.query("DELETE FROM stored_credential WHERE org_id = $1 AND ref = $2 RETURNING ref", [org, ref]);
+            return rows.length > 0;
+        },
+        async listStoredCredentialRefs(org, refPrefix) {
+            // REFS ONLY: the ciphertext column is deliberately out of the projection, because an enumerating caller must never be handed envelopes. refPrefix narrows IN THE PREDICATE and never by a filter after the fact, so an in-product sweep cannot receive the names of credentials outside its own namespace; likePrefixPattern escapes the LIKE metacharacters that the ESCAPE clause declares.
+            if (refPrefix) {
+                const { rows } = await client.query("SELECT ref FROM stored_credential WHERE org_id = $1 AND ref LIKE $2 ESCAPE '\\' ORDER BY ref", [org, likePrefixPattern(refPrefix)]);
+                return rows.map((r) => r.ref);
+            }
+            const { rows } = await client.query("SELECT ref FROM stored_credential WHERE org_id = $1 ORDER BY ref", [org]);
+            return rows.map((r) => r.ref);
+        },
+        async putGitHubInstallation(org, rec) {
+            await client.query(`INSERT INTO github_installation (org_id, owner, installation_id, account_type, repository_selection, updated_at)
+         VALUES ($1, $2, $3, $4, $5, $6)
+         ON CONFLICT (org_id, owner) DO UPDATE SET installation_id = EXCLUDED.installation_id,
+           account_type = EXCLUDED.account_type, repository_selection = EXCLUDED.repository_selection,
+           updated_at = EXCLUDED.updated_at`, [org, rec.owner, rec.installationId, rec.accountType ?? null, rec.repositorySelection ?? null, rec.updatedAt]);
+        },
+        async deleteGitHubInstallation(org, owner) {
+            const { rows } = await client.query("DELETE FROM github_installation WHERE org_id = $1 AND owner = $2 RETURNING owner", [org, owner]);
+            return rows.length > 0;
+        },
+        async listGitHubInstallations(org) {
+            const { rows } = await client.query("SELECT owner, installation_id, account_type, repository_selection, updated_at FROM github_installation WHERE org_id = $1 ORDER BY owner ASC", [org]);
+            return rows.map((r) => ({
+                owner: r.owner,
+                installationId: r.installation_id,
+                ...(r.account_type ? { accountType: r.account_type } : {}),
+                ...(r.repository_selection ? { repositorySelection: r.repository_selection } : {}),
+                updatedAt: r.updated_at,
+            }));
+        },
+        async claimStoredCredential(org, ref, claimId, claimedAtIso, staleBeforeIso) {
+            // Atomic compare-and-set on the claim columns: win iff the row is free (claim_id NULL) OR the
+            // existing claim's lease is stale (claimed_at <= staleBefore; ISO-8601 compares lexicographically).
+            // A single UPDATE ... RETURNING ⇒ of two racing claimants exactly one gets a row back (the winner);
+            // a missing row updates nothing ⇒ empty ⇒ lost.
+            const { rows } = await client.query(`UPDATE stored_credential SET claim_id = $1, claimed_at = $2
+         WHERE org_id = $3 AND ref = $4 AND (claim_id IS NULL OR claimed_at <= $5) RETURNING ref`, [claimId, claimedAtIso, org, ref, staleBeforeIso]);
+            return rows.length > 0;
+        },
+        async releaseStoredCredential(org, ref, claimId) {
+            // Guarded release: clear the claim only if THIS caller still holds it. A stolen-lease caller
+            // mismatches and no-ops — it never clears the new owner's claim.
+            const { rows } = await client.query("UPDATE stored_credential SET claim_id = NULL, claimed_at = NULL WHERE org_id = $1 AND ref = $2 AND claim_id = $3 RETURNING ref", [org, ref, claimId]);
+            return rows.length > 0;
+        },
+        async addCredentialIntake(row) {
+            await client.query(`INSERT INTO credential_intake (org_id, id, ref, connector, domain, requested_by, channel_id, thread_ts, created_at, expires_at, used_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)`, [row.org, row.id, row.ref, row.connector, row.domain ?? null, row.requestedBy, row.channelId, row.threadTs ?? null, row.createdAt, row.expiresAt, row.usedAt ?? null]);
+        },
+        async getCredentialIntake(org, id) {
+            const { rows } = await client.query("SELECT id, ref, connector, domain, requested_by, channel_id, thread_ts, created_at, expires_at, used_at FROM credential_intake WHERE org_id = $1 AND id = $2", [org, id]);
+            const r = rows[0];
+            if (!r)
+                return null;
+            return {
+                org,
+                id: r.id,
+                ref: r.ref,
+                connector: r.connector,
+                ...(r.domain ? { domain: r.domain } : {}),
+                requestedBy: r.requested_by,
+                channelId: r.channel_id,
+                ...(r.thread_ts ? { threadTs: r.thread_ts } : {}),
+                createdAt: r.created_at,
+                expiresAt: r.expires_at,
+                ...(r.used_at ? { usedAt: r.used_at } : {}),
+            };
+        },
+        async consumeCredentialIntake(org, id, usedAt) {
+            // Single-use CAS: exactly one of two racing submits matches `used_at IS NULL` and stamps it.
+            const { rows } = await client.query("UPDATE credential_intake SET used_at = $1 WHERE org_id = $2 AND id = $3 AND used_at IS NULL RETURNING id", [usedAt, org, id]);
+            return rows.length > 0;
+        },
+        async armWebhookCaptureWindow(org, hookId, captureUntil, armedBy, at) {
+            // UPSERT on the whole key: re-arming replaces, because two overlapping windows would make the
+            // numbering the human reads ambiguous across a boundary they cannot see.
+            await client.query(`INSERT INTO webhook_capture_window (org_id, hook_id, capture_until, armed_by, armed_at) VALUES ($1, $2, $3, $4, $5)
+           ON CONFLICT (org_id, hook_id) DO UPDATE SET capture_until = EXCLUDED.capture_until, armed_by = EXCLUDED.armed_by, armed_at = EXCLUDED.armed_at`, [org, hookId, captureUntil, armedBy, at]);
+        },
+        async getWebhookCaptureWindow(org, hookId) {
+            const { rows } = await client.query("SELECT hook_id, capture_until, armed_by, armed_at FROM webhook_capture_window WHERE org_id = $1 AND hook_id = $2", [org, hookId]);
+            const row = rows[0];
+            // Returned EXPIRED-AND-ALL: closing is a comparison the caller makes (`captureWindowOpen`).
+            return row ? { hookId: row.hook_id, captureUntil: row.capture_until, armedBy: row.armed_by, armedAt: row.armed_at } : null;
+        },
+        async addPendingAction(row) {
+            await client.query(`INSERT INTO pending_actions
+           (org_id, id, kind, args_json, scope_key, domain, requested_by, channel_id, thread_ts, message_ts, posted_to, status, created_at, expires_at, decided_by, decided_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)`, [
+                row.org,
+                row.id,
+                row.kind,
+                row.argsJson,
+                row.scopeKey,
+                row.domain,
+                row.requestedBy,
+                row.channelId,
+                row.threadTs,
+                row.messageTs,
+                row.postedTo,
+                row.status,
+                row.createdAt,
+                row.expiresAt,
+                row.decidedBy,
+                row.decidedAt,
+            ]);
+        },
+        async addPendingActionIfAbsent(row) {
+            // The conflict arm the derived-id wedge needs — see the store interface's note (OPE-1348).
+            const { rows } = await client.query(`INSERT INTO pending_actions
+           (org_id, id, kind, args_json, scope_key, domain, requested_by, channel_id, thread_ts, message_ts, posted_to, status, created_at, expires_at, decided_by, decided_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)
+         ON CONFLICT (org_id, id) DO NOTHING RETURNING id`, [
+                row.org,
+                row.id,
+                row.kind,
+                row.argsJson,
+                row.scopeKey,
+                row.domain,
+                row.requestedBy,
+                row.channelId,
+                row.threadTs,
+                row.messageTs,
+                row.postedTo,
+                row.status,
+                row.createdAt,
+                row.expiresAt,
+                row.decidedBy,
+                row.decidedAt,
+            ]);
+            return rows.length > 0;
+        },
+        async getPendingAction(org, id) {
+            const { rows } = await client.query(`SELECT id, kind, args_json, scope_key, domain, requested_by, channel_id, thread_ts, message_ts, posted_to, status, created_at, expires_at, decided_by, decided_at
+         FROM pending_actions WHERE org_id = $1 AND id = $2`, [org, id]);
+            const r = rows[0];
+            return r ? pendingActionFromPgRow(org, r) : null;
+        },
+        async listPendingActions(org) {
+            const { rows } = await client.query(`SELECT id, kind, args_json, scope_key, domain, requested_by, channel_id, thread_ts, message_ts, posted_to, status, created_at, expires_at, decided_by, decided_at
+         FROM pending_actions WHERE org_id = $1 AND status = 'pending' ORDER BY created_at ASC`, [org]);
+            return rows.map((r) => pendingActionFromPgRow(org, r));
+        },
+        async listExpiredPendingActions(org, nowIso) {
+            const { rows } = await client.query(`SELECT id, kind, args_json, scope_key, domain, requested_by, channel_id, thread_ts, message_ts, posted_to, status, created_at, expires_at, decided_by, decided_at
+         FROM pending_actions WHERE org_id = $1 AND status = 'pending' AND expires_at <= $2 ORDER BY created_at ASC`, [org, nowIso]);
+            return rows.map((r) => pendingActionFromPgRow(org, r));
+        },
+        async listRejectedActionsSince(org, sinceIso) {
+            const { rows } = await client.query(`SELECT id, kind, args_json, scope_key, domain, requested_by, channel_id, thread_ts, message_ts, posted_to, status, created_at, expires_at, decided_by, decided_at
+         FROM pending_actions WHERE org_id = $1 AND status = 'rejected' AND decided_at >= $2 ORDER BY decided_at DESC`, [org, sinceIso]);
+            return rows.map((r) => pendingActionFromPgRow(org, r));
+        },
+        async setPendingActionMessage(org, id, messageTs) {
+            await client.query("UPDATE pending_actions SET message_ts = $1 WHERE org_id = $2 AND id = $3", [messageTs, org, id]);
+        },
+        async decidePendingAction(org, id, status, decidedBy, decidedAt) {
+            // The CAS: exactly one of two racing decides (two clicks, or a click racing a
+            // lazy-expiry sweep) matches `status = 'pending'` and returns a row.
+            const { rows } = await client.query(`UPDATE pending_actions SET status = $1, decided_by = $2, decided_at = $3
+         WHERE org_id = $4 AND id = $5 AND status = 'pending' RETURNING id`, [status, decidedBy, decidedAt, org, id]);
+            return rows.length > 0;
+        },
+        async setSessionApproval(row) {
+            // Prune-on-write: drop this org's expired memos (no sweep — the session_id generation is the
+            // real death mechanism, this is just GC), then upsert.
+            await client.query("DELETE FROM pr_session_approval WHERE org_id = $1 AND expires_at <= $2", [row.org, row.createdAt]);
+            await client.query(`INSERT INTO pr_session_approval (org_id, session_id, kind, granted_by, created_at, expires_at)
+         VALUES ($1, $2, $3, $4, $5, $6)
+         ON CONFLICT (org_id, session_id, kind) DO UPDATE SET granted_by = excluded.granted_by, created_at = excluded.created_at, expires_at = excluded.expires_at`, [row.org, row.sessionId, row.kind, row.grantedBy, row.createdAt, row.expiresAt]);
+        },
+        async getSessionApproval(org, sessionId, kind, nowIso) {
+            const { rows } = await client.query("SELECT session_id, kind, granted_by, created_at, expires_at FROM pr_session_approval WHERE org_id = $1 AND session_id = $2 AND kind = $3 AND expires_at > $4", [org, sessionId, kind, nowIso]);
+            const r = rows[0];
+            return r ? { org, sessionId: r.session_id, kind: r.kind, grantedBy: r.granted_by, createdAt: r.created_at, expiresAt: r.expires_at } : null;
+        },
+        async listSessionApprovals(org, sessionId, nowIso) {
+            const { rows } = await client.query("SELECT session_id, kind, granted_by, created_at, expires_at FROM pr_session_approval WHERE org_id = $1 AND session_id = $2 AND expires_at > $3 ORDER BY kind ASC", [org, sessionId, nowIso]);
+            return rows.map((r) => ({
+                org,
+                sessionId: r.session_id,
+                kind: r.kind,
+                grantedBy: r.granted_by,
+                createdAt: r.created_at,
+                expiresAt: r.expires_at,
+            }));
+        },
+        async revokeSessionApprovals(org, sessionId) {
+            const { rows } = await client.query("DELETE FROM pr_session_approval WHERE org_id = $1 AND session_id = $2 RETURNING kind", [org, sessionId]);
+            return rows.length;
+        },
+        async sweepLegacyConnectorOpRows(org) {
+            // Both prefixes, and no expiry clause — see the port's own comment for why each is required.
+            const { rows } = await client.query("DELETE FROM pr_session_approval WHERE org_id = $1 AND session_id LIKE $2 AND kind LIKE $3 RETURNING kind", [org, `${ROUTINE_PERMISSION_PREFIX}%`, `${CONNECTOR_OP_KIND_PREFIX}%`]);
+            return rows.length;
+        },
+        // Every statement here filters by org_id - the load-bearing isolation - on top of the RLS policy. Each mutating method is an upsert or a COMPARE-AND-SET over the row's current status: the from list in the WHERE is what makes revoked terminal and a nonce single-use at the engine, not only in identity/link-store.ts's checks above it.
+        async putLinkSet(org, row) {
+            await client.query(`INSERT INTO identity_link_sets (org_id, id, handle, status, created_at, updated_at) VALUES ($1, $2, $3, $4, $5, $6)
+           ON CONFLICT (org_id, id) DO UPDATE SET handle = EXCLUDED.handle, status = EXCLUDED.status, updated_at = EXCLUDED.updated_at`, [org, row.id, row.handle, row.status, row.createdAt, row.updatedAt]);
+        },
+        async getLinkSet(org, id) {
+            const { rows } = await client.query("SELECT id, handle, status, created_at, updated_at FROM identity_link_sets WHERE org_id = $1 AND id = $2", [org, id]);
+            const r = rows[0];
+            return r ? linkSetFromPgRow(org, r) : null;
+        },
+        async listLinkSets(org) {
+            const { rows } = await client.query("SELECT id, handle, status, created_at, updated_at FROM identity_link_sets WHERE org_id = $1 ORDER BY id ASC", [org]);
+            return rows.map((r) => linkSetFromPgRow(org, r));
+        },
+        async updateLinkSetStatus(org, id, from, to, at) {
+            const { rows } = await client.query(`UPDATE identity_link_sets SET status = $1, updated_at = $2
+         WHERE org_id = $3 AND id = $4 AND status = ANY($5) RETURNING id`, [to, at, org, id, [...from]]);
+            return rows.length > 0;
+        },
+        async insertLinkedId(org, row) {
+            // DO NOTHING (not DO UPDATE): the conflict IS the answer — the account already belongs to a
+            // person, and quietly re-pointing it at a second one is the merge this table exists to refuse.
+            const { rows } = await client.query(`INSERT INTO identity_linked_ids (org_id, platform, tenant, native_id, link_set_id, status, established_by, evidence, created_at, updated_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
+           ON CONFLICT (org_id, platform, tenant, native_id) DO NOTHING RETURNING native_id`, [org, row.platform, row.tenant, row.nativeId, row.linkSetId, row.status, row.establishedBy, row.evidenceJson ?? null, row.createdAt, row.updatedAt]);
+            return rows.length > 0;
+        },
+        async getLinkedId(org, platform, tenant, nativeId) {
+            const { rows } = await client.query(`SELECT platform, tenant, native_id, link_set_id, status, established_by, evidence, created_at, updated_at
+         FROM identity_linked_ids WHERE org_id = $1 AND platform = $2 AND tenant = $3 AND native_id = $4`, [org, platform, tenant, nativeId]);
+            const r = rows[0];
+            return r ? linkedIdFromPgRow(org, r) : null;
+        },
+        async listLinkedIds(org, linkSetId) {
+            const { rows } = await client.query(`SELECT platform, tenant, native_id, link_set_id, status, established_by, evidence, created_at, updated_at
+         FROM identity_linked_ids WHERE org_id = $1${linkSetId === undefined ? "" : " AND link_set_id = $2"}
+         ORDER BY platform ASC, tenant ASC, native_id ASC`, linkSetId === undefined ? [org] : [org, linkSetId]);
+            return rows.map((r) => linkedIdFromPgRow(org, r));
+        },
+        async updateLinkedIdStatus(org, platform, tenant, nativeId, from, to, establishedBy, evidenceJson, at) {
+            const { rows } = await client.query(`UPDATE identity_linked_ids SET status = $1, established_by = $2, evidence = $3, updated_at = $4
+         WHERE org_id = $5 AND platform = $6 AND tenant = $7 AND native_id = $8 AND status = ANY($9) RETURNING native_id`, [to, establishedBy, evidenceJson ?? null, at, org, platform, tenant, nativeId, [...from]]);
+            return rows.length > 0;
+        },
+        async deleteLinkedId(org, platform, tenant, nativeId) {
+            const { rows } = await client.query("DELETE FROM identity_linked_ids WHERE org_id = $1 AND platform = $2 AND tenant = $3 AND native_id = $4 RETURNING native_id", [org, platform, tenant, nativeId]);
+            return rows.length > 0;
+        },
+        async revokeLinkedIdsForSet(org, linkSetId, at) {
+            const { rows } = await client.query(`UPDATE identity_linked_ids SET status = 'revoked', updated_at = $1
+         WHERE org_id = $2 AND link_set_id = $3 AND status <> 'revoked' RETURNING native_id`, [at, org, linkSetId]);
+            return rows.length;
+        },
+        async unbackfilledLinkedIdPlatforms() {
+            // Deployment-wide by design (see the seam's doc): no org filter, because the tenant a row
+            // should carry comes from the deployment's own channel config. RLS permits this — the org
+            // policies are ENFORCE-WHEN-SET and the GUC is unset here as everywhere else in this store.
+            const { rows } = await client.query("SELECT DISTINCT platform FROM identity_linked_ids WHERE tenant = '' ORDER BY platform ASC");
+            return rows.map((r) => r.platform);
+        },
+        async backfillLinkedIdTenant(platform, tenant, at) {
+            // `tenant = ''` in the predicate is what makes this fill-a-blank-only: a row that already
+            // names a workspace is a delivery's own statement and is never rewritten here.
+            const { rows } = await client.query("UPDATE identity_linked_ids SET tenant = $1, updated_at = $2 WHERE platform = $3 AND tenant = '' RETURNING native_id", [tenant, at, platform]);
+            return rows.length;
+        },
+        async addLinkChallenge(org, row) {
+            await client.query(`INSERT INTO identity_link_challenges
+           (org_id, id, nonce_hash, initiating_platform, initiating_tenant, initiating_native_id, initiating_surface_key,
+            claimed_platform, claimed_tenant, claimed_native_id, claimed_at,
+            transport, target_platform, target_tenant, target_native_id, back_nonce_hash,
+            status, created_at, expires_at, decided_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20)`, [
+                org,
+                row.id,
+                row.nonceHash,
+                row.initiatingPlatform,
+                row.initiatingTenant,
+                row.initiatingNativeId,
+                row.initiatingSurfaceKey,
+                row.claimedPlatform ?? null,
+                row.claimedTenant ?? null,
+                row.claimedNativeId ?? null,
+                row.claimedAt ?? null,
+                row.transport,
+                row.targetPlatform ?? null,
+                row.targetTenant ?? null,
+                row.targetNativeId ?? null,
+                row.backNonceHash ?? null,
+                row.status,
+                row.createdAt,
+                row.expiresAt,
+                row.decidedAt ?? null,
+            ]);
+        },
+        async getLinkChallenge(org, id) {
+            const { rows } = await client.query(`${LINK_CHALLENGE_SELECT} WHERE org_id = $1 AND id = $2`, [org, id]);
+            const r = rows[0];
+            return r ? linkChallengeFromPgRow(org, r) : null;
+        },
+        async listLinkChallenges(org, filter) {
+            const conjuncts = ["org_id = $1"];
+            const params = [org];
+            if (filter?.initiatingPlatform !== undefined) {
+                params.push(filter.initiatingPlatform);
+                conjuncts.push(`initiating_platform = $${params.length}`);
+            }
+            if (filter?.initiatingTenant !== undefined) {
+                params.push(filter.initiatingTenant);
+                conjuncts.push(`initiating_tenant = $${params.length}`);
+            }
+            if (filter?.initiatingNativeId !== undefined) {
+                params.push(filter.initiatingNativeId);
+                conjuncts.push(`initiating_native_id = $${params.length}`);
+            }
+            if (filter?.targetPlatform !== undefined) {
+                params.push(filter.targetPlatform);
+                conjuncts.push(`target_platform = $${params.length}`);
+            }
+            if (filter?.targetTenant !== undefined) {
+                params.push(filter.targetTenant);
+                conjuncts.push(`target_tenant = $${params.length}`);
+            }
+            if (filter?.targetNativeId !== undefined) {
+                params.push(filter.targetNativeId);
+                conjuncts.push(`target_native_id = $${params.length}`);
+            }
+            if (filter?.claimedPlatform !== undefined) {
+                params.push(filter.claimedPlatform);
+                conjuncts.push(`claimed_platform = $${params.length}`);
+            }
+            if (filter?.claimedTenant !== undefined) {
+                params.push(filter.claimedTenant);
+                conjuncts.push(`claimed_tenant = $${params.length}`);
+            }
+            if (filter?.claimedNativeId !== undefined) {
+                params.push(filter.claimedNativeId);
+                conjuncts.push(`claimed_native_id = $${params.length}`);
+            }
+            if (filter?.status !== undefined) {
+                params.push(filter.status);
+                conjuncts.push(`status = $${params.length}`);
+            }
+            const { rows } = await client.query(`${LINK_CHALLENGE_SELECT} WHERE ${conjuncts.join(" AND ")} ORDER BY created_at DESC`, params);
+            return rows.map((r) => linkChallengeFromPgRow(org, r));
+        },
+        async claimLinkChallenge(org, nonceHash, platform, tenant, nativeId, at, backNonceHash) {
+            // The SINGLE-USE gate as one statement: status = 'pending' admits exactly one claimer, expires_at > at closes the TTL in the same breath, and the initiator exclusion stops the issuing DM's own echo of the code from burning it - none of the three can be lost to a race between a read and a write. That exclusion is TENANT-QUALIFIED: comparing platform and native_id alone would treat an id-twin in another workspace as the initiator and refuse a legitimate claim as a self-claim.
+            const { rows } = await client.query(`UPDATE identity_link_challenges
+           SET claimed_platform = $1, claimed_tenant = $2, claimed_native_id = $3, claimed_at = $4, back_nonce_hash = $8, status = 'claimed'
+         WHERE org_id = $5 AND nonce_hash = $6 AND status = 'pending' AND expires_at > $7
+           AND NOT (initiating_platform = $1 AND initiating_tenant = $2 AND initiating_native_id = $3)
+         RETURNING ${LINK_CHALLENGE_RETURNING}`, [platform, tenant, nativeId, at, org, nonceHash, at, backNonceHash ?? null]);
+            const r = rows[0];
+            return r ? linkChallengeFromPgRow(org, r) : null;
+        },
+        async consentLinkChallenge(org, id, consenter, at, backNonceHash) {
+            // The TARGET MATCH is a conjunct, not a caller-side check (see store.ts's contract): a consent
+            // from any account but the one this challenge named matches no row and returns null. Single-use
+            // rides `status = 'pending'` and the TTL rides `expires_at > at`, both in the same statement.
+            const { rows } = await client.query(`UPDATE identity_link_challenges
+           SET claimed_platform = $1, claimed_tenant = $2, claimed_native_id = $3, claimed_at = $4, back_nonce_hash = $7, status = 'claimed'
+         WHERE org_id = $5 AND id = $6 AND status = 'pending' AND expires_at > $4
+           AND target_platform = $1 AND target_tenant = $2 AND target_native_id = $3
+         RETURNING ${LINK_CHALLENGE_RETURNING}`, [consenter.platform, consenter.tenant, consenter.nativeId, at, org, id, backNonceHash ?? null]);
+            const r = rows[0];
+            return r ? linkChallengeFromPgRow(org, r) : null;
+        },
+        async decideLinkChallenge(org, id, from, to, at) {
+            // TTL CONJUNCT ON RATIFY (audit finding F7): the terminal `ratified` transition — the ONE that
+            // writes a link — additionally requires `expires_at > at`, so a claimed-but-expired challenge
+            // cannot be ratified even without a prior sweep. Other transitions (deny) don't carry it: a
+            // deny writes nothing, so bounding it buys no safety and would only turn an honest late deny
+            // into a silent no-op. Enforced INSIDE the statement, never by the caller comparing clocks.
+            const ttlConjunct = to === "ratified" ? " AND expires_at > $6" : "";
+            const params = to === "ratified" ? [to, at, org, id, [...from], at] : [to, at, org, id, [...from]];
+            const { rows } = await client.query(`UPDATE identity_link_challenges SET status = $1, decided_at = $2
+         WHERE org_id = $3 AND id = $4 AND status = ANY($5)${ttlConjunct} RETURNING id`, params);
+            return rows.length > 0;
+        },
+        async expireLinkChallenges(org, nowIso) {
+            const { rows } = await client.query(`UPDATE identity_link_challenges SET status = 'expired', decided_at = $1
+         WHERE org_id = $2 AND status IN ('pending', 'claimed') AND expires_at <= $1 RETURNING id`, [nowIso, org]);
+            return rows.length;
+        },
+        async addCredentialGrantAsk(org, row) {
+            refuseHalfBorrow("credential_grant_ask", row);
+            await client.query(`INSERT INTO credential_grant_ask
+           (org_id, id, requester_principal_id, owner_principal_id, owner_slug, owner_platform, owner_native_id, connector, verb, resource,
+            mcp_tool, frozen_args, tool_name,
+            scope_key, domain_scope_key, purpose, requester_target, card_surface_id, card_message_id, requested_mode, status, created_at, expires_at, decided_at, grant_id)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25)`, [
+                org,
+                row.id,
+                row.requesterPrincipalId,
+                row.ownerPrincipalId,
+                row.ownerSlug,
+                row.ownerPlatform,
+                row.ownerNativeId,
+                row.connector,
+                row.verb,
+                row.resource,
+                row.mcpTool ?? null,
+                grantJsonColumn(row.frozenArgs),
+                row.toolName ?? null,
+                row.scopeKey,
+                row.domainScopeKey ?? null,
+                row.purpose,
+                row.requesterTarget ?? null,
+                row.cardSurfaceId ?? null,
+                row.cardMessageId ?? null,
+                row.requestedMode,
+                row.status,
+                row.createdAt,
+                row.expiresAt,
+                row.decidedAt ?? null,
+                row.grantId ?? null,
+            ]);
+        },
+        async setCredentialGrantAskCard(org, id, surfaceId, messageId) {
+            await client.query("UPDATE credential_grant_ask SET card_surface_id = $1, card_message_id = $2 WHERE org_id = $3 AND id = $4", [surfaceId, messageId, org, id]);
+        },
+        async getCredentialGrantAsk(org, id) {
+            const { rows } = await client.query(`${GRANT_ASK_SELECT} WHERE org_id = $1 AND id = $2`, [org, id]);
+            const r = rows[0];
+            return r ? grantAskFromPgRow(r) : null;
+        },
+        async liveCredentialGrantAsk(org, requesterPrincipalId, ownerPrincipalId, verb, resource, nowIso) {
+            // EXPIRY IN THE PREDICATE, never a status check alone: the sweep is a tidy-up, so an unswept
+            // `pending` row past its TTL must read as gone here or a lapsed ask would block a fresh one.
+            const { rows } = await client.query(`${GRANT_ASK_SELECT}
+         WHERE org_id = $1 AND requester_principal_id = $2 AND owner_principal_id = $3 AND verb = $4 AND resource = $5
+           AND status = 'pending' AND expires_at > $6
+         ORDER BY created_at DESC LIMIT 1`, [org, requesterPrincipalId, ownerPrincipalId, verb, resource, nowIso]);
+            const r = rows[0];
+            return r ? grantAskFromPgRow(r) : null;
+        },
+        async approveCredentialGrantAsk(org, id, mode, grantId, at) {
+            // Single-answer + TTL in ONE statement. `status = 'pending'` admits exactly one approval, and
+            // `expires_at > at` makes a late click on a scrolled-back DM card lose the CAS — the row is
+            // the only thing that can refuse it, because the card never goes away on its own.
+            const { rows } = await client.query(`UPDATE credential_grant_ask SET status = 'approved', requested_mode = $1, grant_id = $2, decided_at = $3
+         WHERE org_id = $4 AND id = $5 AND status = 'pending' AND expires_at > $3
+         RETURNING ${GRANT_ASK_COLUMNS}`, [mode, grantId, at, org, id]);
+            const r = rows[0];
+            return r ? grantAskFromPgRow(r) : null;
+        },
+        async decideCredentialGrantAsk(org, id, from, to, at) {
+            const { rows } = await client.query(`UPDATE credential_grant_ask SET status = $1, decided_at = $2 WHERE org_id = $3 AND id = $4 AND status = ANY($5) RETURNING id`, [to, at, org, id, [...from]]);
+            return rows.length > 0;
+        },
+        async listExpiredCredentialGrantAsks(org, nowIso) {
+            const { rows } = await client.query(`${GRANT_ASK_SELECT} WHERE org_id = $1 AND status = 'pending' AND expires_at <= $2 ORDER BY created_at ASC`, [org, nowIso]);
+            return rows.map(grantAskFromPgRow);
+        },
+        async pendingCredentialGrantAsksForScope(org, scopeKey, nowIso) {
+            // EXPIRY IN THE PREDICATE, for `liveCredentialGrantAsk`'s reason: the sweep is a tidy-up, so an
+            // unswept `pending` row past its TTL must read as gone or a lapsed ask would hold its name for
+            // ever. The read rides the `(org_id, scope_key)` index the table already carries.
+            const { rows } = await client.query(`${GRANT_ASK_SELECT} WHERE org_id = $1 AND scope_key = $2 AND status = 'pending' AND expires_at > $3 ORDER BY created_at ASC`, [org, scopeKey, nowIso]);
+            return rows.map(grantAskFromPgRow);
+        },
+        async addCredentialGrant(org, row) {
+            refuseHalfBorrow("credential_grant", row);
+            await client.query(`INSERT INTO credential_grant
+           (org_id, id, ask_id, requester_principal_id, owner_principal_id, owner_slug, connector, verb, resource,
+            mcp_tool, frozen_args, tool_name, input_schema,
+            scope_key, mode, tier, status, purpose, created_at, expires_at, used_at, revoked_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22)`, [
+                org,
+                row.id,
+                row.askId,
+                row.requesterPrincipalId,
+                row.ownerPrincipalId,
+                row.ownerSlug,
+                row.connector,
+                row.verb,
+                row.resource,
+                row.mcpTool ?? null,
+                grantJsonColumn(row.frozenArgs),
+                row.toolName ?? null,
+                grantJsonColumn(row.inputSchema),
+                row.scopeKey,
+                row.mode,
+                row.tier,
+                row.status,
+                row.purpose,
+                row.createdAt,
+                row.expiresAt,
+                row.usedAt ?? null,
+                row.revokedAt ?? null,
+            ]);
+        },
+        async getCredentialGrant(org, id) {
+            const { rows } = await client.query(`${GRANT_SELECT} WHERE org_id = $1 AND id = $2`, [org, id]);
+            const r = rows[0];
+            return r ? grantFromPgRow(r) : null;
+        },
+        async credentialGrantsForScope(org, scopeKey) {
+            // NO status filter, deliberately — the mount projects EXISTENCE and the broker refuses on
+            // STATE. See the store.ts contract for why a status filter here breaks the cold-heal path.
+            const { rows } = await client.query(`${GRANT_SELECT} WHERE org_id = $1 AND scope_key = $2 ORDER BY created_at DESC`, [org, scopeKey]);
+            return rows.map(grantFromPgRow);
+        },
+        async liveStandingCredentialGrantsForScope(org, scopeKey, nowIso) {
+            // STATUS, EXPIRY, REVOCATION AND MODE ALL IN THE PREDICATE — a domain-keyed row is read by
+            // sessions that never saw it, so a dead one must not mount there. See the store.ts contract.
+            const { rows } = await client.query(`${GRANT_SELECT} WHERE org_id = $1 AND scope_key = $2 AND mode = 'standing' AND status = 'active'
+           AND expires_at > $3 AND revoked_at IS NULL ORDER BY created_at DESC`, [org, scopeKey, nowIso]);
+            return rows.map(grantFromPgRow);
+        },
+        async liveCredentialGrantsForOwner(org, ownerPrincipalId, nowIso) {
+            // STATUS AND EXPIRY BOTH IN THE PREDICATE — the owner may only be offered rows they can still
+            // end. See the store.ts contract for why this filters where `credentialGrantsForScope` must not.
+            const { rows } = await client.query(`${GRANT_SELECT} WHERE org_id = $1 AND owner_principal_id = $2 AND status = 'active' AND expires_at > $3 ORDER BY created_at ASC`, [org, ownerPrincipalId, nowIso]);
+            return rows.map(grantFromPgRow);
+        },
+        async liveBorrowCredentialGrant(org, ownerPrincipalId, connector, mcpTool, frozenArgsDigest, scopeKey, nowIso) {
+            // THE DIGEST IS COMPARED IN TYPESCRIPT, not in SQL, because it is not a column. The predicate
+            // narrows to the rows that could match — one owner, one connector, one vendor tool, one chat,
+            // still live — and there are at most a handful of those. A digest column would be a second
+            // copy of `frozen_args` that a partial write could put out of step with it.
+            const { rows } = await client.query(`${GRANT_SELECT} WHERE org_id = $1 AND owner_principal_id = $2 AND connector = $3 AND mcp_tool = $4 AND scope_key = $5
+           AND status = 'active' AND expires_at > $6 ORDER BY created_at DESC`, [org, ownerPrincipalId, connector, mcpTool, scopeKey, nowIso]);
+            for (const r of rows) {
+                const row = grantFromPgRow(r);
+                if (row.frozenArgs !== undefined && grantFrozenArgsDigest(row.frozenArgs) === frozenArgsDigest)
+                    return row;
+            }
+            return null;
+        },
+        async burnCredentialGrant(org, id, at) {
+            // THE WHOLE OF ONCE-MODE. Both conjuncts sit in the statement: `status = 'active'` makes the
+            // burn single-use, `expires_at > at` makes an expired row unspendable without waiting for a
+            // sweep. A retried turn, a replayed step and two parallel calls in one step all race here.
+            const { rows } = await client.query(`UPDATE credential_grant SET status = 'used', used_at = $1
+         WHERE org_id = $2 AND id = $3 AND status = 'active' AND expires_at > $1 RETURNING ${GRANT_COLUMNS}`, [at, org, id]);
+            const r = rows[0];
+            return r ? grantFromPgRow(r) : null;
+        },
+        async refundCredentialGrant(org, id, burnedAt) {
+            // `used_at = $3` IS THE CONTROL, not a tidy extra conjunct: it binds the refund to the caller's
+            // OWN burn, so a call that lost the burn race cannot un-spend the winner's. `revoked_at IS
+            // NULL` is what makes an owner's revoke beat a refund racing it — see `revokeCredentialGrant`.
+            const { rows } = await client.query(`UPDATE credential_grant SET status = 'active', used_at = NULL
+         WHERE org_id = $1 AND id = $2 AND status = 'used' AND used_at = $3 AND revoked_at IS NULL RETURNING id`, [org, id, burnedAt]);
+            return rows.length > 0;
+        },
+        async claimCredentialGrantRefund(org, id, turnKey, cap) {
+            // ONE STATEMENT, so two calls racing in one step cannot both read the same remaining count.
+            // The right-hand `refund_turn_seq` is the row's PRE-UPDATE value in both engines, so every
+            // CASE and the WHERE read the same stored ordinal. `COALESCE` covers a row written before the
+            // count column existed; the casts are what let Postgres type a parameter that one arm only
+            // compares to NULL.
+            //
+            // 🔴 ONLY A STRICTLY LATER TURN ROLLS (OPE-1281). The predicate is the ORDINAL comparison,
+            // not the `IS DISTINCT FROM` on the key this statement used to carry: a distinctness test
+            // rolls in both directions, so two turn ids alternating on one row each read the other as new
+            // and each collected a fresh allowance. A NULL ordinal — no turn id, or a key eve's shape no
+            // longer mints — never rolls; it counts against the stored turn and leaves the turn in place,
+            // which is the fail-closed direction.
+            //
+            // 🔴 A ROW THAT HAS COUNTED A TURN AND CARRIES NO ORDINAL NEVER ROLLS EITHER, and that is the
+            // upgrade window rather than a corner. A row written before this column existed holds a turn
+            // key, a count up to `cap`, and a NULL ordinal; reading that NULL as "never counted" would let
+            // ANY turn roll it — the same turn included — which is the hole this ticket closes. So the
+            // first disjunct asks for BOTH columns empty, which is a row that has genuinely counted
+            // nothing. A migrated row keeps the allowance it had for the rest of its life, bounded by the
+            // grant's TTL.
+            const rolls = "($5::bigint IS NOT NULL AND ((refund_turn IS NULL AND refund_turn_seq IS NULL) OR $5::bigint > refund_turn_seq))";
+            const { rows } = await client.query(`UPDATE credential_grant
+            SET refund_turn = CASE WHEN ${rolls} THEN $3::text ELSE refund_turn END,
+                refund_turn_seq = CASE WHEN ${rolls} THEN $5::bigint ELSE refund_turn_seq END,
+                refund_count = CASE WHEN ${rolls} THEN 1 ELSE COALESCE(refund_count, 0) + 1 END
+          WHERE org_id = $1 AND id = $2
+            AND (${rolls} OR COALESCE(refund_count, 0) < $4) RETURNING id`, [org, id, turnKey ?? null, cap, grantRefundTurnOrdinal(turnKey) ?? null]);
+            return rows.length > 0;
+        },
+        async revokeCredentialGrant(org, id, at) {
+            const { rows } = await client.query(`UPDATE credential_grant SET status = 'revoked', revoked_at = $1 WHERE org_id = $2 AND id = $3 AND status = 'active' RETURNING id`, [at, org, id]);
+            if (rows.length > 0)
+                return true;
+            // THE ROW WAS NOT LIVE. If it is `used`, the owner may be racing a once call that is still in
+            // flight: stamp the intent so a refund cannot re-open it (OPE-1198). The STATUS is left alone —
+            // a spent grant is already terminal, and rewriting it would lose which arm ended it. The answer
+            // stays `false`: this call revoked no live grant.
+            await client.query(`UPDATE credential_grant SET revoked_at = $1 WHERE org_id = $2 AND id = $3 AND status = 'used' AND revoked_at IS NULL`, [at, org, id]);
+            return false;
+        },
+        async expireCredentialGrants(org, nowIso) {
+            const { rows } = await client.query(`UPDATE credential_grant SET status = 'expired' WHERE org_id = $1 AND status = 'active' AND expires_at <= $2 RETURNING id`, [org, nowIso]);
+            return rows.length;
+        },
+        async getMeta(key) {
+            const { rows } = await client.query("SELECT value FROM instance_meta WHERE key = $1", [key]);
+            const r = rows[0];
+            return r ? r.value : null;
+        },
+        async setMeta(key, value) {
+            await client.query(`INSERT INTO instance_meta (key, value) VALUES ($1, $2)
+         ON CONFLICT (key) DO UPDATE SET value = excluded.value`, [key, value]);
+        },
+    };
+}
+//# sourceMappingURL=postgres.js.map