@open-everywhere/core 0.1.0

package/dist/agent/operational/sqlite.js

@@ -0,0 +1,3170 @@
+// The SQLite adapter behind the operational store seam: local and small self-host installs, on Node's built-in node:sqlite, sharing one DB file with the memory provider.
+// Audit is append-only BY CONTRACT here — this module has no delete path — while Postgres enforces append-only at the DB layer.
+import { mkdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+// A VALUE import, deliberately: the assertions and the retention ceiling are ONE definition shared
+// by both backends, so a bound cannot drift between two hand-copied SQL statements.
+// (Webhook hooks are not stored here at all: OPE-224 left ONE config-declared class, so a hook's
+// identity is whatever a merged PR says and uniqueness is a boot check, not an index.)
+import { asSurfaceMode, auditSurfaceMode, auditReadOrg, likePrefixPattern, assertIngressDeliveryRetainUntil, assertSpendLimitAmount, assertDomainModelPick, assertHaltAddress, haltAddressColumns, haltAddressFromColumns, framePromoterId, promoterListField, proactiveAddressRow, routinePromptRevisionWrites, spendLedgerConjuncts, CAPTURE_MAX_RETENTION_MS, EVENT_DEDUPE_MAX_RETENTION_MS, PROMOTER_LIST_MAX } from "./store.js";
+import { grantBorrowColumnsProblem, grantFrozenArgsDigest, grantJsonColumn, grantJsonFromColumn, grantRefundTurnOrdinal } from "./credential-grant-rows.js";
+// Both prefixes are imported, never respelled, so the legacy-connector sweep's key prefix and kind prefix keep one spelling in the file that defines them.
+import { CONNECTOR_OP_KIND_PREFIX, ROUTINE_PERMISSION_PREFIX } from "../approvals/session-grant.js";
+import { SESSION_TAIL_MAX_ENTRIES } from "../channels/session-tail.js";
+import { AUDIT_CHAIN_EPOCH_ACTION, auditEpochDetail, auditEpochSealFor, auditRowSha, withOrgAuditLock } from "../audit/chain.js";
+import { assembleAnalyticsSql } from "../analytics/compile.js";
+// Shares memory's DB-file convention so both land in one file; override with
+// OE_SQLITE_PATH (memory + operational then share it — table names don't clash).
+/** The resolved file, and WHETHER `OE_SQLITE_PATH` named it. The flag is what {@link getDb} needs:
+ *  the fallback branch is derived from `OE_MEMORY_DIR`, else the process's cwd, and neither may
+ *  displace a handle the env already pinned — so the guard pins against an `OE_MEMORY_DIR` change
+ *  mid-process too, not only against a blocked `OE_SQLITE_PATH` read. */
+function dbPath() {
+    if (process.env.OE_SQLITE_PATH)
+        return { path: process.env.OE_SQLITE_PATH, fromEnv: true };
+    const root = process.env.OE_MEMORY_DIR ?? join(process.cwd(), ".open-everywhere-memory");
+    return { path: join(root, "open-everywhere.sqlite3"), fromEnv: false };
+}
+let db = null;
+let openedPath = null;
+function getDb() {
+    const resolved = dbPath();
+    // 🔴 AN ABSENT `OE_SQLITE_PATH` NEVER MOVES AN OPEN HANDLE (OPE-1933). This function re-reads the
+    // env on EVERY call, so any scope that hides `process.env` turns the env read into `undefined` —
+    // and the fallback above then computes a DIFFERENT file from `process.cwd()`. The old code closed
+    // the open DB and reopened at that file, silently, mid-process: every row written afterwards
+    // landed in a store nothing would ever read again. just-bash's DefenseInDepthBox is one such
+    // scope (its ALS wraps `process.env` in a blocking Proxy), and a store call made inside it is all
+    // it takes. An absent env read is NOT an instruction to switch files, so it keeps the handle.
+    // A PRESENT value naming a different file still switches — that is an explicit instruction, not
+    // a guess — and a test that genuinely wants a different path uses `_resetOperationalDbForTest`.
+    if (db && !resolved.fromEnv)
+        return db;
+    const path = resolved.path;
+    if (db && openedPath !== path) {
+        db.close();
+        db = null;
+    }
+    if (db)
+        return db;
+    if (path !== ":memory:")
+        mkdirSync(dirname(path), { recursive: true });
+    const handle = new DatabaseSync(path);
+    // busy_timeout: WAL allows one writer; a second process (the integration tier reads/tampers the
+    // store through its own handle) would otherwise get an immediate SQLITE_BUSY instead of a retry.
+    handle.exec("PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON; PRAGMA busy_timeout = 5000;");
+    // An old-shape spend_ledger is DROPPED and recreated, never migrated: cost_source sits in the primary key and SQLite cannot ALTER a key.
+    // The accepted cost is at most the current month's cap accounting; usd_micros_measured is the shape probe, because no old table can have it.
+    const spendCols = handle.prepare("SELECT name FROM pragma_table_info('spend_ledger')").all();
+    if (spendCols.length > 0 && !spendCols.some((c) => c.name === "usd_micros_measured"))
+        handle.exec("DROP TABLE spend_ledger");
+    // An existing identity_linked_ids crosses to the tenant-in-key shape by rename-create-copy-drop, and ITS ROWS ARE KEPT, unlike the spend_ledger case above.
+    // The index must be dropped FIRST: SQLite index names are schema-global, so a renamed table keeps the name the CREATE INDEX below needs.
+    const linkedIdCols = handle.prepare("SELECT name FROM pragma_table_info('identity_linked_ids')").all();
+    const needsLinkedIdTenantRebuild = linkedIdCols.length > 0 && !linkedIdCols.some((c) => c.name === "tenant");
+    if (needsLinkedIdTenantRebuild) {
+        handle.exec("DROP INDEX IF EXISTS identity_linked_ids_org_set; ALTER TABLE identity_linked_ids RENAME TO identity_linked_ids__pre_tenant;");
+    }
+    handle.exec(`
+    CREATE TABLE IF NOT EXISTS spend_ledger (
+      org_id             TEXT NOT NULL,
+      surface_key        TEXT NOT NULL,
+      principal_id       TEXT NOT NULL DEFAULT '',  -- '' = unattributed (PK columns can't be NULL)
+      routine_id         TEXT NOT NULL DEFAULT '',  -- '' = not a routine turn
+      model              TEXT NOT NULL DEFAULT '',  -- '' = no model (unstamped call; sandbox runtime)
+      period             TEXT NOT NULL,             -- "YYYY-MM"
+      -- OPE-1862 (mirrored in the ALTER list below): WHICH KIND OF CONVERSATION this row's spend
+      -- happened in — 'dm' | 'mpim' | 'channel', or '' when nothing stamped it. The anti-doxxing
+      -- mask reads THIS and never the shape of a surface id, so Discord and Teams DMs mask exactly
+      -- as Slack's do. Deliberately OUTSIDE the primary key: a surface's mode never changes, so
+      -- keying on it would split a month for nothing — and would force the table drop an additive
+      -- column avoids.
+      surface_mode       TEXT NOT NULL DEFAULT '',
+      input_tokens       INTEGER NOT NULL DEFAULT 0,
+      output_tokens      INTEGER NOT NULL DEFAULT 0,
+      cache_read_tokens  INTEGER NOT NULL DEFAULT 0,
+      cache_write_tokens INTEGER NOT NULL DEFAULT 0,
+      -- OPE-1611 (mirrored in the ALTER list below): reasoning tokens, ATTRIBUTION only. No rate
+      -- table names a reasoning rate, so this never reaches usd_micros and no cap sees it.
+      reasoning_tokens   INTEGER NOT NULL DEFAULT 0,
+      usd_micros         INTEGER NOT NULL DEFAULT 0, -- millionths of a dollar, DERIVED at write from the rate table (what caps sum)
+      -- OPE-369: the GATEWAY's own billed figure for these same calls, when it published one.
+      -- 0 on a cost_source='derived' row. Never read by a cap — see store.ts's CostSource section.
+      usd_micros_measured INTEGER NOT NULL DEFAULT 0,
+      cost_source        TEXT NOT NULL DEFAULT 'derived', -- 'measured' | 'derived'; in the PK so a row is homogeneous
+      calls              INTEGER NOT NULL DEFAULT 0,
+      PRIMARY KEY (org_id, surface_key, principal_id, routine_id, model, period, cost_source)
+    );
+    -- OPE-1677: the PERIOD index the primary key cannot be. The bounded spend reads are shaped
+    -- "WHERE org_id = ? AND period ..." (spendLedgerConjuncts in store.ts). period is the SIXTH
+    -- primary-key column, and a btree bounds its scan only up to the first column the query
+    -- leaves unconstrained -- so the automatic primary-key index bounds on org_id, and everything
+    -- after it is a per-row test over every row the org ever wrote. This index puts period
+    -- second, which makes the range a plan-level narrowing rather than a transfer saving. It
+    -- matters most on the "/oe budget raise" domain scan, which answers a Discord interaction
+    -- inside 3 seconds. This statement is also the MIGRATION: the CREATE block runs on every
+    -- database open, so an existing file builds the index in place, with no drop-and-recreate.
+    CREATE INDEX IF NOT EXISTS spend_ledger_org_period ON spend_ledger (org_id, period);
+    CREATE TABLE IF NOT EXISTS routine (
+      org_id      TEXT NOT NULL,
+      id          TEXT NOT NULL,
+      surface_key TEXT NOT NULL,
+      data        TEXT NOT NULL,              -- JSON of the full Routine
+      PRIMARY KEY (org_id, id)
+    );
+    -- APPEND-ONLY prompt history for the mutable routine row (OPE-242). Written by
+    -- updateRoutine on a patch that REPLACES the prompt, never updated, never deleted, never
+    -- pruned — see RoutinePromptRevisionRow in store.ts for why a routine's prompt history is an
+    -- audit artefact (an edit revokes standing authority), why the log begins at the first EDIT
+    -- rather than at creation, and for the retention position. Append-only here is BY CONTRACT
+    -- only: sqlite has no RLS, so unlike Postgres (SELECT+INSERT policies under FORCE) nothing at
+    -- the engine stops a rewrite. Same caveat audit_entry carries on this deprecated backend,
+    -- stated rather than implied.
+    CREATE TABLE IF NOT EXISTS routine_prompt_revisions (
+      seq         INTEGER PRIMARY KEY AUTOINCREMENT,
+      org_id      TEXT NOT NULL,
+      surface_key TEXT NOT NULL,
+      routine_id  TEXT NOT NULL,
+      prompt      TEXT NOT NULL,          -- the exact text the routine ran under
+      generation  INTEGER,                -- the promptGeneration it ran under (joins routinePermissionKey)
+      authored_by TEXT,                   -- createdBy on the genesis row, the edit's requestedBy after
+      armed_by    TEXT,                   -- the approver whose click armed it (never on genesis)
+      approval_id TEXT,                   -- pending_actions.id of the card that armed it
+      recorded_at TEXT NOT NULL           -- ISO-8601 (the routine's createdAt on the genesis row)
+    );
+    CREATE INDEX IF NOT EXISTS routine_prompt_revisions_org_surface_routine ON routine_prompt_revisions (org_id, surface_key, routine_id, seq);
+    CREATE TABLE IF NOT EXISTS audit_entry (
+      seq          INTEGER PRIMARY KEY AUTOINCREMENT,
+      ts           TEXT NOT NULL,
+      org_id       TEXT NOT NULL,
+      platform     TEXT NOT NULL,
+      workspace    TEXT NOT NULL,
+      surface      TEXT,
+      surface_mode TEXT,                      -- OPE-1866: the conversation the surface names; NULL = unclassified, which MASKS
+      principal_id TEXT,
+      action       TEXT NOT NULL,
+      detail       TEXT,                      -- JSON
+      prev_sha     TEXT                       -- sha256 of the org's previous row (OPE-52 hash chain); NULL = genesis
+    );
+    CREATE INDEX IF NOT EXISTS audit_org_ts ON audit_entry (org_id, ts);
+    CREATE TABLE IF NOT EXISTS spend_limit (
+      org_id        TEXT NOT NULL,
+      scope_key     TEXT NOT NULL,
+      level         TEXT NOT NULL,            -- "surface" | "workspace" | "domain" | "user" (free-text, no CHECK — see store.ts CapLevel)
+      monthly_tokens INTEGER NOT NULL,        -- -1 = no token component (legacy NOT NULL; see setSpendLimit)
+      monthly_usd   REAL,                     -- NULL = no USD component
+      expires_at    INTEGER,                  -- epoch ms; NULL = no auto-expiry
+      reason        TEXT,
+      set_by        TEXT,
+      PRIMARY KEY (org_id, scope_key, level)
+    );
+    CREATE TABLE IF NOT EXISTS halt (
+      org_id     TEXT    NOT NULL,
+      level      TEXT    NOT NULL,            -- "" on an org-wide row: FILLER, never an address (store.ts haltAddressColumns)
+      scope_key  TEXT    NOT NULL,            -- "" on an org-wide row, same reason
+      org_wide   INTEGER NOT NULL,            -- 1 = the org-wide MARKER; the column every match branches on first
+      active     INTEGER NOT NULL,            -- 1 = halted; a cleared row stays for the trail
+      set_by     TEXT,
+      set_at     TEXT    NOT NULL,            -- ISO-8601
+      set_ref    TEXT,                        -- host wake owning a chat-set halt; NULL for operator/legacy rows
+      cleared_by TEXT,
+      cleared_at TEXT,                        -- ISO-8601; NULL until a resume clears it
+      PRIMARY KEY (org_id, level, scope_key, org_wide)
+    );
+    CREATE TABLE IF NOT EXISTS connector_override (
+      org_id    TEXT NOT NULL,
+      scope_key TEXT NOT NULL,
+      connector TEXT NOT NULL,
+      granted   INTEGER NOT NULL,             -- 1 = grant, 0 = revoke
+      reason    TEXT,                         -- no expires_at: auto-expiry would re-open access
+      set_by    TEXT,
+      PRIMARY KEY (org_id, scope_key, connector)
+    );
+    CREATE TABLE IF NOT EXISTS thread_engagement (
+      org_id        TEXT    NOT NULL,
+      surface_key   TEXT    NOT NULL,          -- platform/workspace/surface (the channel)
+      thread_ts     TEXT    NOT NULL,
+      engaged_at    TEXT    NOT NULL,          -- ISO-8601, set once
+      last_turn_at  TEXT    NOT NULL,          -- ISO-8601, refreshed each engaged turn
+      participating INTEGER NOT NULL DEFAULT 0, -- 1 = invited participant (replied/@mentioned); 0 = warm watcher
+      silent_streak INTEGER NOT NULL DEFAULT 0, -- consecutive silent woken turns since last engage/participation
+      stopped       INTEGER NOT NULL DEFAULT 0, -- 1 = an explicit stop landed (task #100 window path); suppress non-mention wakes until re-invited
+      engaged_by    TEXT,                       -- SEPARATOR-FRAMED list of the ids of events that PROMOTED this row, most recent last, bounded; a re-promotion from ANY id the list holds never clears stopped (store.ts PROMOTER_SEP)
+      PRIMARY KEY (org_id, surface_key, thread_ts)
+    );
+    CREATE TABLE IF NOT EXISTS channel_session (
+      org_id             TEXT    NOT NULL,
+      surface_key        TEXT    NOT NULL,          -- the channel (platform/workspace/surface)
+      token              TEXT    NOT NULL,          -- caller-minted continuation token for the CURRENT generation
+      generation         INTEGER NOT NULL,          -- 1 on first mint, +1 on every rotation
+      created_at         TEXT    NOT NULL,          -- ISO-8601, reset on rotation
+      last_wake_at       TEXT    NOT NULL,          -- ISO-8601, bumped by touchChannelSession, reset on rotation
+      turn_count         INTEGER NOT NULL DEFAULT 0, -- bumped by touchChannelSession, reset to 0 on rotation (BACKSTOP trigger)
+      input_tokens_total INTEGER,                    -- measured cumulative input+cacheRead this generation (§2 #551); NULL = unknown ⇒ rotate
+      first_wake_at      TEXT,                        -- ISO-8601 of the first delivered wake (H7c); NULL = none yet ⇒ still fresh
+      last_input_tokens  INTEGER,                     -- OPE-794: measured input+cacheRead of the LATEST request (SET, not summed); NULL = none yet ⇒ rung skipped
+      rotate_marked_at   TEXT,                        -- OPE-820: ISO-8601 an operator marked this generation for retirement; NULL = unmarked. Set ONLY by the ops sweep; cleared by every rotation
+      served_code_fingerprint   TEXT,                  -- OPE-1821: the runtime CODE hash this seat was last served with; NULL = never stamped. Written ONLY by stampChannelSessionRuntime, and deliberately NOT reset by a rotation
+      served_domain_fingerprint TEXT,                  -- OPE-1821: the DOMAIN declaration hash this seat was last served with. Same writer, same NULL meaning — the pair moves together
+      PRIMARY KEY (org_id, surface_key)
+    );
+    -- session_tail (OPE-794): the standing-seat TAIL ring. One row per recorded conversational
+    -- event on ONE generation — the wake messages the deployment delivered and the posts the seat
+    -- made. The rotate leg reads the OUTGOING generation's rows and renders them into the fresh
+    -- generation's first wake. Keyed by the generation's live TOKEN, so a straggler write from a
+    -- retired generation files under the retired token and is simply never read again.
+    -- Bounded on write (channels/session-tail.ts SESSION_TAIL_MAX_ENTRIES) and dropped once carried.
+    CREATE TABLE IF NOT EXISTS session_tail (
+      org_id      TEXT    NOT NULL,
+      surface_key TEXT    NOT NULL,        -- the channel_session registry key this generation lives under
+      token       TEXT    NOT NULL,        -- the generation's continuation token (the read + prune key)
+      seq         INTEGER NOT NULL,        -- insertion ordinal within the token; ties broken by the at column at render
+      at          TEXT    NOT NULL,        -- ISO-8601 of the event (the ORDERING key the render sorts on)
+      entry_json  TEXT    NOT NULL,        -- serialized SessionTailEntry (opaque to the store)
+      PRIMARY KEY (org_id, surface_key, token, seq)
+    );
+    CREATE TABLE IF NOT EXISTS event_dedupe (
+      org_id  TEXT NOT NULL,
+      key     TEXT NOT NULL,                  -- Slack event_id (or channel:ts fallback)
+      seen_at TEXT NOT NULL,                  -- ISO-8601 (lexicographic = chronological)
+      PRIMARY KEY (org_id, key)
+    );
+    -- Durable provider inbox. The verified signer id is part of the immutable delivery identity;
+    -- payload_json contains a versioned provider envelope but never the raw signature or secret.
+    -- Pending rows have retain_until NULL and survive arbitrarily long outages. Completion erases
+    -- payload_json and starts the bounded tombstone clock in the SAME fenced UPDATE.
+    CREATE TABLE IF NOT EXISTS ingress_delivery (
+      org_id       TEXT NOT NULL,
+      source       TEXT NOT NULL,
+      authority_id TEXT NOT NULL,
+      delivery_id  TEXT NOT NULL,
+      payload_json TEXT,
+      received_at  TEXT NOT NULL,
+      available_at TEXT NOT NULL,
+      claim_id     TEXT,
+      claimed_at   TEXT,
+      completed_at TEXT,
+      retain_until TEXT,
+      PRIMARY KEY (org_id, source, authority_id, delivery_id)
+    );
+    CREATE INDEX IF NOT EXISTS ingress_delivery_due ON ingress_delivery (org_id, source, completed_at, available_at, claimed_at);
+    -- webhook_capture: the BOUNDED CAPTURE WINDOW (OPE-211 + OPE-184 Half 2). The only table here
+    -- that holds bytes an outside party authored — see webhooks/capture-window.ts for what the
+    -- document column is (the jq filter document, NOT the raw body) and why that is the safety
+    -- property rather than a redaction step. Mutable + self-pruning, like event_dedupe: rows are
+    -- swept on write and a whole window is cleared on re-arm. Never UPDATEd.
+    -- (No backticks in this block: it is inside a template literal and one would close it.)
+    CREATE TABLE IF NOT EXISTS webhook_capture (
+      org_id      TEXT    NOT NULL,
+      source      TEXT    NOT NULL,         -- the hook HANDLE a routine subscribes to (= the declared id)
+      seq         INTEGER NOT NULL,         -- 1-based ordinal within the current window; the number a human says
+      captured_at TEXT    NOT NULL,         -- ISO-8601 receive time (OUR clock; prune key)
+      document    TEXT    NOT NULL,         -- serialized EventFilterDocument (opaque to the store)
+      PRIMARY KEY (org_id, source, seq)
+    );
+    CREATE TABLE IF NOT EXISTS unified_wake_target (
+      org_id           TEXT NOT NULL,
+      wake_id          TEXT NOT NULL,         -- host-minted per-wake id (rides the wake envelope)
+      target_json      TEXT NOT NULL,         -- serialized UnifiedWakeOrigin (opaque to the store)
+      created_at       TEXT NOT NULL,         -- ISO-8601 (lexicographic = chronological; TTL prune key)
+      window_token     TEXT,                  -- OPE-161: the BARE window token dispatched to; NULL = legacy row (never answerable via the pending arm)
+      answered_at      TEXT,                  -- OPE-161: ISO-8601 when a reply answered this wake; NULL = still pending
+      answered_turn_id TEXT,                  -- OPE-161: the turn that answered it (the same-turn re-accept key)
+      inbound          INTEGER,               -- OPE-767: 1 = this wake carries a real message from the room; NULL/0 = a wake the deployment minted for itself
+      audited_at       TEXT,                  -- OPE-836: ISO-8601 when the turn-end wake-accounting audit considered this wake; NULL = not yet audited. Read ONLY by listUnauditedUnifiedWakes.
+      PRIMARY KEY (org_id, wake_id)
+    );
+    CREATE TABLE IF NOT EXISTS thread_ownership (
+      org_id      TEXT NOT NULL,
+      channel_key TEXT NOT NULL,              -- the container (unifiedThreadRef.channelKey)
+      thread_key  TEXT NOT NULL,              -- the thread within it (unifiedThreadRef.threadKey)
+      task_token  TEXT NOT NULL,              -- the owning task window token (embeds its generation)
+      created_at  TEXT NOT NULL,              -- ISO-8601 (lexicographic = chronological; TTL prune key)
+      PRIMARY KEY (org_id, channel_key, thread_key)
+    );
+    CREATE TABLE IF NOT EXISTS thread_seat_state (
+      org_id       TEXT NOT NULL,
+      channel_key  TEXT NOT NULL,              -- the container (unifiedThreadRef.channelKey)
+      thread_key   TEXT NOT NULL,              -- the thread within it (unifiedThreadRef.threadKey)
+      seat_token   TEXT NOT NULL,              -- the thread seat's own window token
+      parent_key   TEXT NOT NULL,              -- the PARENT seat's channel_session registry key
+      state        TEXT NOT NULL,              -- 'open' | 'completed'
+      origin_json  TEXT NOT NULL,              -- the thread's own wake origin (UnifiedWakeOrigin JSON)
+      report       TEXT,                       -- the seat's closing report, in its own words
+      opened_at    TEXT NOT NULL,              -- ISO-8601 of the spawn
+      updated_at   TEXT NOT NULL,              -- ISO-8601 (lexicographic = chronological; TTL prune key)
+      PRIMARY KEY (org_id, channel_key, thread_key)
+    );
+    CREATE TABLE IF NOT EXISTS turn_anchor (
+      org_id      TEXT NOT NULL,
+      window_key  TEXT NOT NULL,              -- the continuation token / window this turn belongs to
+      anchor_key  TEXT,                       -- "<platform>:<channelId>:<messageId>" where the surface knows it
+      channel_key TEXT,                       -- "<platform>:<channelId>" — the slash-command arm (NOT unique)
+      session_id  TEXT NOT NULL,              -- → attachSession(session_id)
+      turn_id     TEXT NOT NULL,              -- → cancel({turnId})
+      surface_key TEXT NOT NULL,
+      created_at  TEXT NOT NULL,              -- ISO-8601 (lexicographic = chronological; TTL prune key)
+      PRIMARY KEY (org_id, window_key)
+    );
+    -- An org-scoped, TTL-pruned, OPAQUE key-value scratch table. The NAME is historical (see the
+    -- store interface's note): minted for the deleted roll-own delegation regime, now shared by the
+    -- native-subagent taint markers, the question bridge and the task-wake join, each under its own
+    -- key prefix.
+    CREATE TABLE IF NOT EXISTS task_result (
+      org_id       TEXT NOT NULL,
+      task_id      TEXT NOT NULL,             -- the consumer's own namespaced key
+      result_json  TEXT NOT NULL,             -- opaque to the store; each consumer owns its shape
+      created_at   TEXT NOT NULL,             -- ISO-8601 (lexicographic = chronological; TTL prune key)
+      PRIMARY KEY (org_id, task_id)
+    );
+    CREATE TABLE IF NOT EXISTS slack_attachment (
+      org_id      TEXT NOT NULL,
+      file_id     TEXT NOT NULL,              -- Slack file id (the model-named ref; trusted-provenance key)
+      url_private TEXT NOT NULL,              -- event-supplied url_private (opaque; never a model string)
+      mime_type   TEXT,                       -- IANA media type from the event, when known
+      name        TEXT,                       -- original filename, when known (extension fallback for the read path)
+      team_id     TEXT,                       -- Slack team id, when known
+      created_at  TEXT NOT NULL,              -- ISO-8601 (lexicographic = chronological; TTL prune key)
+      PRIMARY KEY (org_id, file_id)
+    );
+    -- stored_credential (task #113): ciphertext store behind the "db" credential broker. NEVER
+    -- plaintext — ciphertext is an AES-256-GCM envelope, opaque here. Mutable (re-store replaces).
+    CREATE TABLE IF NOT EXISTS stored_credential (
+      org_id     TEXT NOT NULL,
+      ref        TEXT NOT NULL,               -- unique lookup key, e.g. "db:notion-<domain>-key"
+      ciphertext TEXT NOT NULL,               -- AES-256-GCM envelope (iv‖tag‖ct, base64); NEVER logged
+      connector  TEXT,                        -- label only (audit/admin views), never the value
+      domain     TEXT,                        -- label only
+      created_by TEXT NOT NULL,               -- storing principal (the intake requester)
+      created_at TEXT NOT NULL,               -- ISO-8601
+      PRIMARY KEY (org_id, ref)
+    );
+    -- credential_intake (task #113): the single-use, TTL'd binding a "Set API key" button carries.
+    -- Mutable; the ONE unused→used transition is CAS-guarded (WHERE used_at IS NULL). NEVER holds
+    -- the secret value — only where it goes (ref), who may store it (requested_by), and labels.
+    CREATE TABLE IF NOT EXISTS credential_intake (
+      org_id       TEXT NOT NULL,
+      id           TEXT NOT NULL,             -- opaque intake id (embedded in the button action_id)
+      ref          TEXT NOT NULL,             -- the stored_credential ref the value is written under
+      connector    TEXT NOT NULL,             -- label shown in the modal
+      domain       TEXT,                      -- label shown in the modal
+      requested_by TEXT NOT NULL,             -- the ONLY principal permitted to open + submit
+      channel_id   TEXT NOT NULL,             -- where the button lives (wrong-clicker notice + confirm)
+      thread_ts    TEXT,
+      created_at   TEXT NOT NULL,             -- ISO-8601
+      expires_at   TEXT NOT NULL,             -- ISO-8601 TTL bound (~15 min)
+      used_at      TEXT,                      -- ISO-8601 when consumed; NULL = still open (single-use)
+      PRIMARY KEY (org_id, id)
+    );
+    -- webhook_capture_window (OPE-211, re-homed by OPE-224): the ONLY mutable state a DECLARED
+    -- webhook has -- when its capture window closes and who opened it. Keyed by (org_id, hook_id):
+    -- a hook id is unique within an org's config, unlike the deleted chat-created class's ids which
+    -- were globally-unique URL segments and therefore keyed on the bare id. Nothing here is secret
+    -- and nothing here is authority -- the hook's identity, posture and read grant are re-read from
+    -- the config registry at arm and at delivery time. See the postgres twin.
+    CREATE TABLE IF NOT EXISTS webhook_capture_window (
+      org_id        TEXT NOT NULL,
+      hook_id       TEXT NOT NULL,             -- the DECLARED hook's id (= webhook_capture.source)
+      capture_until TEXT NOT NULL,             -- ISO-8601, already clamped by the arming path
+      armed_by      TEXT NOT NULL,
+      armed_at      TEXT NOT NULL,
+      PRIMARY KEY (org_id, hook_id)
+    );
+    -- github_installation (scm/installations.ts): owner → installation id, learned from the App's own
+    -- signature-verified "installation" webhook so a new org installing the App self-registers instead
+    -- of needing an OE_GITHUB_INSTALLATIONS env edit + redeploy. NOT a secret (an installation id is a
+    -- public routing number; the App private key stays in env). The env map is composed OVER these
+    -- rows — env stays authoritative, this only augments.
+    CREATE TABLE IF NOT EXISTS github_installation (
+      org_id               TEXT NOT NULL,
+      owner                TEXT NOT NULL,     -- installation.account.login (the SCM map's key)
+      installation_id      TEXT NOT NULL,     -- installation.id, stringified
+      account_type         TEXT,              -- "Organization" | "User" (diagnostics)
+      repository_selection TEXT,              -- "all" | "selected" (refreshed by installation_repositories)
+      updated_at           TEXT NOT NULL,     -- ISO-8601 of the delivery that last wrote this row
+      PRIMARY KEY (org_id, owner)
+    );
+    -- pr_session_approval (OPE-53): the "Approve for session" grant on a pr.open card. Keyed by the
+    -- bare session/window token (embeds the generation ⇒ the memo dies with the session). Scoped to
+    -- kind="pr.open" by the callers. NEVER holds PR content — only who granted the skip + when.
+    CREATE TABLE IF NOT EXISTS pr_session_approval (
+      org_id     TEXT NOT NULL,
+      session_id TEXT NOT NULL,               -- the bare session/window token of the granting turn
+      kind       TEXT NOT NULL,               -- always "pr.open" (the only session-skippable kind)
+      granted_by TEXT NOT NULL,               -- the member who clicked "Approve for session"
+      created_at TEXT NOT NULL,               -- ISO-8601
+      expires_at TEXT NOT NULL,               -- ISO-8601 GC bound (prune-on-write); death is via session_id
+      PRIMARY KEY (org_id, session_id, kind)
+    );
+    CREATE TABLE IF NOT EXISTS pending_actions (
+      org_id       TEXT NOT NULL,
+      id           TEXT NOT NULL,
+      kind         TEXT NOT NULL,             -- e.g. "spend.set" (agent/approvals/actions.ts registry key)
+      args_json    TEXT NOT NULL,             -- FROZEN mutation args, JSON
+      scope_key    TEXT NOT NULL,             -- the scope the mutation targets
+      domain       TEXT,                      -- memory domain resolved at propose time (NULL if none)
+      requested_by TEXT NOT NULL,             -- proposing session's verified principal id
+      channel_id   TEXT NOT NULL,             -- where the card is posted
+      thread_ts    TEXT,
+      message_ts   TEXT,                      -- the card's ts, set after post
+      posted_to    TEXT,                      -- proposing surfaceKey frozen at mint (task #105); NULL = no sweep feedback
+      status       TEXT NOT NULL,             -- pending|approved|rejected|expired
+      created_at   TEXT NOT NULL,
+      expires_at   TEXT NOT NULL,
+      decided_by   TEXT,
+      decided_at   TEXT,
+      PRIMARY KEY (org_id, id)
+    );
+    CREATE INDEX IF NOT EXISTS pending_actions_org_status ON pending_actions (org_id, status);
+    CREATE TABLE IF NOT EXISTS domain_skill (
+      org_id     TEXT NOT NULL,
+      domain     TEXT NOT NULL,
+      name       TEXT NOT NULL,               -- bare (no repo-style namespace)
+      content    TEXT NOT NULL,               -- model-facing markdown, verbatim
+      updated_by TEXT,                        -- authoring principalId, when known
+      updated_at TEXT NOT NULL,               -- ISO-8601
+      PRIMARY KEY (org_id, domain, name)
+    );
+    -- APPEND-ONLY content history for domain_skill (OPE-237). Written by putDomainSkill on
+    -- every write, never updated, never deleted, never pruned — see DomainSkillRevisionRow in
+    -- store.ts for why a domain skill's history is an audit artefact, and for the retention
+    -- position. Append-only here is BY CONTRACT only: sqlite has no RLS, so unlike Postgres
+    -- (SELECT+INSERT policies under FORCE) nothing at the engine stops a rewrite. That is the
+    -- same caveat audit_entry carries on this deprecated backend, stated rather than implied.
+    CREATE TABLE IF NOT EXISTS domain_skill_revisions (
+      seq         INTEGER PRIMARY KEY AUTOINCREMENT,
+      org_id      TEXT NOT NULL,
+      domain      TEXT NOT NULL,
+      name        TEXT NOT NULL,
+      content     TEXT NOT NULL,          -- the exact body written to domain_skill
+      authored_by TEXT,                   -- authoring principalId, when known
+      armed_by    TEXT,                   -- the approver whose click armed it, when known
+      approval_id TEXT,                   -- pending_actions.id of the card that armed it
+      recorded_at TEXT NOT NULL           -- ISO-8601 (= the live row's updated_at)
+    );
+    CREATE INDEX IF NOT EXISTS domain_skill_revisions_org_domain_name ON domain_skill_revisions (org_id, domain, name, seq);
+    CREATE TABLE IF NOT EXISTS domain_model (
+      org_id     TEXT NOT NULL,
+      domain     TEXT NOT NULL,
+      model_id   TEXT,                     -- NULL = no modelId component (reasoning-only pick)
+      reasoning  TEXT,                     -- NULL = no reasoning component (modelId-only pick)
+      set_by     TEXT,
+      updated_at TEXT NOT NULL,            -- ISO-8601
+      PRIMARY KEY (org_id, domain)
+    );
+    CREATE TABLE IF NOT EXISTS usage_events (
+      seq                INTEGER PRIMARY KEY AUTOINCREMENT,
+      org_id             TEXT NOT NULL,
+      surface_key        TEXT NOT NULL,
+      session_id         TEXT NOT NULL,
+      principal_id       TEXT,
+      ts                 TEXT NOT NULL,        -- ISO-8601
+      kind               TEXT,                 -- "dm" | "channel" | "routine" | "sandbox" | ...
+      routine_id         TEXT,                 -- OPE-145: set iff kind = "routine"
+      input_tokens       INTEGER NOT NULL DEFAULT 0,
+      output_tokens      INTEGER NOT NULL DEFAULT 0,
+      cache_read_tokens  INTEGER NOT NULL DEFAULT 0,
+      cache_write_tokens INTEGER NOT NULL DEFAULT 0,
+      model              TEXT,
+      detail             TEXT,                 -- JSON
+      -- OPE-1611 (mirrored in the ALTER list below): the cache/reasoning ATTRIBUTION pair. Both
+      -- NULLABLE on purpose — NULL is "the source reported nothing", a different fact from a
+      -- reported zero, and keeping the two apart is the whole point of the dimension.
+      -- OPE-1862 (mirrored in the ALTER list below): the conversation this event happened in —
+      -- 'dm' | 'mpim' | 'channel'; NULL = unstamped. The kind column above cannot answer this: a routine,
+      -- supervisor or subagent turn wins that tag before the DM test runs, so a routine fired in a
+      -- DM is stamped kind 'routine'. Reports mask an unstamped row rather than guess.
+      surface_mode       TEXT,
+      cache_tokens_reported INTEGER,           -- 1 = the call reported a cache split; 0 = it did not; NULL = never asked
+      reasoning_tokens   INTEGER,              -- NULL = unreported; a number (0 included) = reported
+      -- OPE-369 (mirrored in the ALTER list below, which is what an existing DB takes)
+      usd_micros_measured INTEGER,             -- the gateway's billed figure for THIS call; NULL = nothing measured it
+      cost_source        TEXT,                 -- 'measured' | 'derived'; NULL on pre-migration/non-model rows
+      delegation_depth   INTEGER,              -- 0 = root turn, 1 = direct child, 2 = two-or-more hops (a BAND — see store.ts)
+      root_session_id    TEXT                  -- top of this call's delegation chain (its own session id on a root turn)
+    );
+    CREATE INDEX IF NOT EXISTS usage_events_org_session ON usage_events (org_id, session_id);
+    CREATE INDEX IF NOT EXISTS usage_events_org_surface_ts ON usage_events (org_id, surface_key, ts);
+    -- identity link-sets (P1): the three tables behind DB-backed cross-surface identity. See the
+    -- LinkSetRow section in store.ts for what they are, and the postgres twin for the RLS half.
+    -- Read-write (a person severs an account, an admin suspends a set); the immutable HISTORY is
+    -- audit_entry, which identity/link-store.ts appends on every mutation. The handle column is
+    -- DISPLAY ONLY -- no index, no uniqueness, no lookup -- because a name/handle join is exactly the
+    -- attacker-controllable merge the fail-closed-on-merge doctrine forbids.
+    CREATE TABLE IF NOT EXISTS identity_link_sets (
+      org_id     TEXT NOT NULL,
+      id         TEXT NOT NULL,               -- opaque, host-minted; the ONLY join key for a set
+      handle     TEXT NOT NULL,               -- DISPLAY ONLY: admin lists + audit rows
+      status     TEXT NOT NULL,               -- active | suspended | revoked ("revoked" is terminal)
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      PRIMARY KEY (org_id, id)
+    );
+    -- PRIMARY KEY (org_id, platform, tenant, native_id) IS the "an account is exactly one person"
+    -- invariant -- assertPrincipalsValid's rule, moved from config load to write time. tenant joined
+    -- the key in OPE-309 phase 2: on a tenant-scoped platform a person id is issued PER WORKSPACE, so
+    -- the 3-column key made two workspaces' members one row -- i.e. one person. See the postgres twin
+    -- and identity/link-tenant.ts. SQLite cannot ALTER a PRIMARY KEY, so an existing table crosses over
+    -- by the rename-and-copy rebuild either side of this exec (needsLinkedIdTenantRebuild).
+    CREATE TABLE IF NOT EXISTS identity_linked_ids (
+      org_id         TEXT NOT NULL,
+      platform       TEXT NOT NULL,
+      tenant         TEXT NOT NULL DEFAULT '', -- OPE-309: '' = vendor-global platform, or not yet backfilled
+      native_id      TEXT NOT NULL,
+      link_set_id    TEXT NOT NULL,
+      status         TEXT NOT NULL,           -- suggested | confirmed | revoked ("revoked" terminal)
+      established_by TEXT NOT NULL,           -- "challenge:<id>" | "config-import" | "directory-sync:<p>"
+      evidence       TEXT,                    -- structured evidence record as JSON; opaque here
+      created_at     TEXT NOT NULL,
+      updated_at     TEXT NOT NULL,
+      PRIMARY KEY (org_id, platform, tenant, native_id)
+    );
+    CREATE INDEX IF NOT EXISTS identity_linked_ids_org_set ON identity_linked_ids (org_id, link_set_id);
+    -- The proof-of-control nonce ledger. nonce_hash is a sha-256 -- the RAW code is NEVER stored,
+    -- so a copy of this file yields no usable codes. Single-use is the pending-only claim CAS.
+    CREATE TABLE IF NOT EXISTS identity_link_challenges (
+      org_id                 TEXT NOT NULL,
+      id                     TEXT NOT NULL,
+      nonce_hash             TEXT NOT NULL,   -- sha-256 hex of the uppercased code; NEVER the code
+      initiating_platform    TEXT NOT NULL,
+      initiating_tenant      TEXT NOT NULL DEFAULT '', -- OPE-309; '' off a tenant-scoped platform
+      initiating_native_id   TEXT NOT NULL,
+      initiating_surface_key TEXT NOT NULL,   -- the DM the ratification must come back to
+      claimed_platform       TEXT,            -- stamped from the WAKE's own captured author
+      claimed_tenant         TEXT,            -- ...in the same CAS, so a claimed row names a whole account
+      claimed_native_id      TEXT,
+      claimed_at             TEXT,
+      transport              TEXT NOT NULL DEFAULT 'code', -- OPE-617; code | directory
+      target_platform        TEXT,            -- the directory transport's NAMED target ...
+      target_tenant          TEXT,            -- ...matched inside the consent CAS, so a consent
+      target_native_id       TEXT,            -- ...from any other account matches no row
+      back_nonce_hash        TEXT,            -- sha-256 of code-2; its PRESENCE forces the code-back
+      status                 TEXT NOT NULL,   -- pending | claimed | ratified | denied | expired
+      created_at             TEXT NOT NULL,
+      expires_at             TEXT NOT NULL,
+      decided_at             TEXT,
+      PRIMARY KEY (org_id, id)
+    );
+    CREATE INDEX IF NOT EXISTS identity_link_challenges_org_nonce ON identity_link_challenges (org_id, nonce_hash);
+    -- credential_grant_ask (OPE-1060): one person's REQUEST for another person's credential, pending
+    -- the owner's answer in their own DM. The purpose is MODEL-AUTHORED and is stored as data -- every
+    -- reader renders it escaped and quoted. Single-answer is the pending-only approve CAS.
+    CREATE TABLE IF NOT EXISTS credential_grant_ask (
+      org_id                 TEXT NOT NULL,
+      id                     TEXT NOT NULL,
+      requester_principal_id TEXT NOT NULL,
+      owner_principal_id     TEXT NOT NULL,
+      owner_slug             TEXT NOT NULL,   -- the eventual tool name's owner segment, PINNED here
+      owner_platform         TEXT NOT NULL,   -- where the owner's card is delivered
+      owner_native_id        TEXT NOT NULL,   -- the bare platform id the DM arm addresses
+      connector              TEXT NOT NULL,
+      verb                   TEXT NOT NULL,   -- the vendor tool SLUGIFIED, as a name segment; a label, never the wire name
+      resource               TEXT NOT NULL,   -- the host-composed DISPLAY LABEL, holding model-authored text and the frozen VALUES
+      mcp_tool               TEXT,            -- OPE-1136: the vendor MCP tool, in the vendor's exact bytes
+      frozen_args            TEXT,            -- OPE-1136: canonical JSON; '{}' is "nothing frozen", NULL is "no borrow"
+      tool_name              TEXT,            -- OPE-1136: the full mounted name, PINNED here with the ordinal
+      scope_key              TEXT NOT NULL,   -- the CHAT this would serve (the session id)
+      domain_scope_key       TEXT,            -- OPE-1950: the room's domain-shaped seat key; a STANDING grant binds here instead
+      purpose                TEXT NOT NULL,   -- model-authored; untrusted content
+      requester_target       TEXT,            -- JSON ReplyTarget: where the owner's answer is reported back
+      card_surface_id        TEXT,            -- where the owner's card landed -- the lapse sweep rewrites it
+      card_message_id        TEXT,
+      requested_mode         TEXT NOT NULL,   -- once | session | standing
+      status                 TEXT NOT NULL,   -- pending | approved | declined | expired
+      created_at             TEXT NOT NULL,
+      expires_at             TEXT NOT NULL,   -- the ASK's own short TTL, NOT the grant's
+      decided_at             TEXT,
+      grant_id               TEXT,            -- stamped by the approve CAS
+      PRIMARY KEY (org_id, id)
+    );
+    CREATE INDEX IF NOT EXISTS credential_grant_ask_org_scope ON credential_grant_ask (org_id, scope_key);
+    -- credential_grant (OPE-1060): the owner-approved grant a chat spends. The tier is decided ONCE at
+    -- mint -- from the verb definition on the registry path, from classifyConnectorOpTier on the
+    -- OPE-1136 borrow path -- and is never re-derived from the mounted tool name (a grant__… name
+    -- carries a person's handle where a classifier looks for a verb).
+    -- Rows are NEVER deleted: the mount projects every row for a scope and the broker refuses on
+    -- state, so a removed row would make a tool vanish mid-plan instead of refusing.
+    -- 🔴 NO UNIQUE INDEX ON (org_id, scope_key, tool_name), and the reason is stated once here
+    -- (OPE-1136). Uniqueness inside one chat is held by the ORDINAL: nextGrantBorrowToolName reads
+    -- every row in the scope, dead ones included, and picks the lowest free ordinal. The only hole
+    -- that leaves is two asks composing at the same instant, and the mount-side dedupe closes that
+    -- one. A unique index would ALSO refuse a write, and it would start doing so before any writer
+    -- of tool_name exists to be tested against it -- so the constraint waits for the transport
+    -- slice, where a real writer can be proven against it.
+    CREATE TABLE IF NOT EXISTS credential_grant (
+      org_id                 TEXT NOT NULL,
+      id                     TEXT NOT NULL,
+      ask_id                 TEXT NOT NULL,
+      requester_principal_id TEXT NOT NULL,
+      owner_principal_id     TEXT NOT NULL,
+      owner_slug             TEXT NOT NULL,   -- the mounted name's owner segment, PINNED at mint
+      connector              TEXT NOT NULL,
+      verb                   TEXT NOT NULL,
+      resource               TEXT NOT NULL,
+      mcp_tool               TEXT,            -- OPE-1136: the vendor MCP tool, in the vendor's exact bytes
+      frozen_args            TEXT,            -- OPE-1136: canonical JSON; '{}' is "nothing frozen", NULL is "no borrow"
+      tool_name              TEXT,            -- OPE-1136: the full mounted name, copied from the ask
+      input_schema           TEXT,            -- OPE-1136: the post-bake schema snapshot, taken at approve
+      scope_key              TEXT NOT NULL,
+      mode                   TEXT NOT NULL,   -- once | session | standing
+      tier                   TEXT NOT NULL,   -- read | write | destructive, pinned at mint
+      status                 TEXT NOT NULL,   -- active | used | revoked | expired
+      purpose                TEXT NOT NULL,   -- model-authored; untrusted content
+      created_at             TEXT NOT NULL,
+      expires_at             TEXT NOT NULL,
+      used_at                TEXT,
+      revoked_at             TEXT,
+      refund_turn            TEXT,            -- OPE-1264: the turn key the refund count below belongs to
+      refund_turn_seq        INTEGER,         -- OPE-1281: that key's eve turn ordinal; only a LATER one rolls the count
+      refund_count           INTEGER NOT NULL DEFAULT 0, -- OPE-1264: refunds already claimed on that turn
+      PRIMARY KEY (org_id, id)
+    );
+    CREATE INDEX IF NOT EXISTS credential_grant_org_scope ON credential_grant (org_id, scope_key);
+    -- notice_claim: LIFETIME at-most-once claims (store.ts claimNotice), four key families. NO TTL
+    -- and NO DELETE at all, on purpose: the one thing it records is "this already happened", and
+    -- dropping that would make an announcement periodic and a recorded reaction repeatable. Every
+    -- family is bounded by the thing it records (one room, one grant, one reaction), never by the
+    -- number of ships. Two families are traffic-derived; store.ts's own section states what bounds
+    -- each. The fifth family, OPE-1751's runtime-rotation claim, was the one entry that grew per
+    -- ship per standing seat, and OPE-1821 retired it with the sweep it needed.
+    CREATE TABLE IF NOT EXISTS notice_claim (
+      org_id     TEXT NOT NULL,
+      key        TEXT NOT NULL,
+      claimed_at TEXT NOT NULL,                -- ISO-8601
+      PRIMARY KEY (org_id, key)
+    );
+    -- proactive_address (OPE-887): where this deployment may reach somebody with no live turn.
+    -- UPSERTED, never appended — one row per (platform, kind, ref_key), re-stamped by every inbound
+    -- activity, so a moved serviceUrl region corrects itself. The address column is a provider-shaped
+    -- JSON bag core never reads inside. No TTL: see store.ts's PROACTIVE ADDRESSES section.
+    CREATE TABLE IF NOT EXISTS proactive_address (
+      org_id     TEXT NOT NULL,
+      platform   TEXT NOT NULL,
+      kind       TEXT NOT NULL,                -- the provider's own record species
+      ref_key    TEXT NOT NULL,                -- the provider's own key inside (platform, kind)
+      tenant     TEXT NOT NULL,                -- "" when the platform has no tenant
+      address    TEXT NOT NULL,                -- provider-shaped JSON
+      updated_at TEXT NOT NULL,                -- ISO-8601
+      PRIMARY KEY (org_id, platform, kind, ref_key)
+    );
+    -- model_call_capture (OPE-846): the soak lane's byte-exact model-call recorder. MUTABLE and
+    -- deliberately so — retention here is an explicit delete-by-session, not a TTL (store.ts's
+    -- MODEL-CALL CAPTURE section carries the whole posture). Written only while soak.capture is
+    -- armed; a deployment that never arms it never grows a row. body_gzip_b64 is gzip(body)
+    -- base64'd, TRANSCRIPT-GRADE: it holds the composed prompt verbatim. Never logged.
+    CREATE TABLE IF NOT EXISTS model_call_capture (
+      seq            INTEGER PRIMARY KEY AUTOINCREMENT,
+      org_id         TEXT NOT NULL,
+      surface_key    TEXT NOT NULL,             -- spend grain (domainKeyOf), joins to usage_events
+      session_id     TEXT NOT NULL,             -- eve's durable session id (wrun_…)
+      turn_id        TEXT NOT NULL,             -- eve turn id; '' when none was resolvable
+      step_index     INTEGER NOT NULL,          -- 0-based, within the turn
+      ts             TEXT NOT NULL,             -- ISO-8601
+      model          TEXT NOT NULL,             -- the id the router resolved for THIS call
+      provider       TEXT NOT NULL,
+      schema_version INTEGER NOT NULL,          -- serialised-shape version (replay validates on read)
+      sha256         TEXT NOT NULL,             -- sha256 of the UNCOMPRESSED body
+      body_bytes     INTEGER NOT NULL,          -- uncompressed length
+      body_gzip_b64  TEXT NOT NULL,             -- '' when truncated
+      truncated      INTEGER NOT NULL DEFAULT 0
+    );
+    CREATE INDEX IF NOT EXISTS model_call_capture_org_session ON model_call_capture (org_id, session_id, seq);
+    -- memory_proposal (OPE-957): the dream cycle's proposal review queue, moved off the audit log
+    -- (store.ts's MEMORY PROPOSALS section carries the whole posture). MUTABLE, like
+    -- model_call_capture — a store holding member text needs a real erasure path.
+    CREATE TABLE IF NOT EXISTS memory_proposal (
+      id           INTEGER PRIMARY KEY AUTOINCREMENT,
+      org_id       TEXT NOT NULL,
+      kind         TEXT NOT NULL,
+      scope        TEXT NOT NULL,
+      summary      TEXT NOT NULL,
+      before_text  TEXT,
+      after_text   TEXT,
+      detail_json  TEXT,
+      principal_id TEXT NOT NULL,
+      created_at   TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS memory_proposal_org ON memory_proposal (org_id, id);
+    -- dm_audience (OPE-1064 tier P2): who this deployment may START a direct message with, and
+    -- whether they have stopped it. Two nullable timestamps and no content — store.ts's DM AUDIENCE
+    -- section carries the whole posture, including why the key is the grant's own ARN-like address.
+    CREATE TABLE IF NOT EXISTS dm_audience (
+      org_id      TEXT NOT NULL,
+      address     TEXT NOT NULL,          -- the person address, e.g. slack:person/U0123ABC
+      first_dm_at TEXT,                   -- ISO-8601 of the FIRST proactive DM; NULL = never delivered
+      stopped_at  TEXT,                   -- ISO-8601 the recipient stopped it; NULL = not stopped
+      PRIMARY KEY (org_id, address)
+    );
+    CREATE TABLE IF NOT EXISTS instance_meta (
+      key   TEXT PRIMARY KEY,
+      value TEXT NOT NULL
+    );
+  `);
+    // OPE-309 phase 2, second half of the linked-ids rebuild: copy every row across with the sentinel
+    // tenant, then drop the old table. `''` is CORRECT-and-final for a vendor-global platform and means
+    // "nobody has named this yet" on a tenant-scoped one — identity/link-tenant-backfill.ts fills the
+    // latter at boot, or says loudly that it cannot. Column list written out in full rather than
+    // `SELECT *` so a future column added to one side can never silently shift the copy.
+    if (needsLinkedIdTenantRebuild) {
+        handle.exec(`
+      INSERT INTO identity_linked_ids (org_id, platform, tenant, native_id, link_set_id, status, established_by, evidence, created_at, updated_at)
+        SELECT org_id, platform, '', native_id, link_set_id, status, established_by, evidence, created_at, updated_at
+          FROM identity_linked_ids__pre_tenant;
+      DROP TABLE identity_linked_ids__pre_tenant;
+    `);
+    }
+    // Migrate older DBs in place: CREATE TABLE IF NOT EXISTS won't add columns to a table
+    // that already exists, so add the override-metadata columns if missing. ALTER ... ADD
+    // COLUMN throws "duplicate column name" once migrated — swallow that (idempotent).
+    for (const ddl of [
+        "ALTER TABLE spend_limit ADD COLUMN expires_at INTEGER",
+        "ALTER TABLE spend_limit ADD COLUMN reason TEXT",
+        "ALTER TABLE spend_limit ADD COLUMN set_by TEXT",
+        "ALTER TABLE spend_limit ADD COLUMN monthly_usd REAL", // item 16: USD caps
+        "ALTER TABLE halt ADD COLUMN set_ref TEXT",
+        "ALTER TABLE connector_override ADD COLUMN reason TEXT",
+        "ALTER TABLE connector_override ADD COLUMN set_by TEXT",
+        // Warm-on-wake engagement (participating watcher + silent-streak shedding): additive
+        // columns on a table that predates them. NOT NULL DEFAULT is honoured for existing
+        // rows too (SQLite backfills the default), so a pre-migration engaged thread reads as
+        // a NON-participating (warm) thread with a zero streak — the fail-safe reading.
+        "ALTER TABLE thread_engagement ADD COLUMN participating INTEGER NOT NULL DEFAULT 0",
+        "ALTER TABLE thread_engagement ADD COLUMN silent_streak INTEGER NOT NULL DEFAULT 0",
+        // Additive columns on a pre-existing table: owner_token stays NULL until a router sets one, and SQLite backfills the DEFAULT, so every pre-migration row reads kind = thread.
+        "ALTER TABLE thread_engagement ADD COLUMN owner_token TEXT",
+        "ALTER TABLE thread_engagement ADD COLUMN kind TEXT NOT NULL DEFAULT 'thread'",
+        // Durable STOPPED marker (task #100 follow-up — window-riding supervisor stop): additive
+        // on the same pre-existing table, same fail-safe pattern. NOT NULL DEFAULT 0 backfills every
+        // existing row to NOT-stopped, so a pre-migration engaged thread keeps waking (the safe
+        // reading — a stop only ever suppresses AFTER it has been written).
+        "ALTER TABLE thread_engagement ADD COLUMN stopped INTEGER NOT NULL DEFAULT 0",
+        // Durable engage-idempotency (OPE-1527): the ids of the events that PROMOTED this row.
+        // Nullable, and a NULL reads as "no recorded promoter", which never blocks a clear — a
+        // pre-migration stopped row keeps the pre-OPE-1527 behaviour and the guard only ever engages
+        // once a promoter id has been recorded.
+        "ALTER TABLE thread_engagement ADD COLUMN engaged_by TEXT",
+        // OPE-1562 REFRAME: the column went from ONE bare id to a FRAMED list. A row written by
+        // OPE-1527 holds a bare id, so frame it in place. Idempotent and self-guarding: a framed value
+        // already starts with the separator, and no platform event id does, so a second run matches
+        // nothing. Safe on an existing row — it rewrites the encoding, never the id, so the guard the
+        // row already carried survives the migration unchanged.
+        // 🔴 AN OPTIMISATION, NOT A PRECONDITION — `markEngaged` normalises a bare value inside its own
+        // statement, because the Postgres twin of this list does not run on every deployment.
+        "UPDATE thread_engagement SET engaged_by = char(10) || engaged_by || char(10) WHERE engaged_by IS NOT NULL AND engaged_by <> '' AND substr(engaged_by, 1, 1) <> char(10)",
+        // Cumulative-token rotation + H7c (§2, eve #551): additive, all nullable.
+        // input_tokens_total stays NULL on pre-migration rows ⇒ shouldRotate fails safe and rotates
+        // once (self-heals — the new row starts at 0). first_wake_at stays NULL.
+        "ALTER TABLE channel_session ADD COLUMN input_tokens_total INTEGER",
+        "ALTER TABLE channel_session ADD COLUMN first_wake_at TEXT",
+        // A NULL last_input_tokens SKIPS the context-size rung rather than rotating: every freshly-minted generation is NULL too, and rotating on it would retire each generation before its first turn.
+        // handoff_note is deliberately not dropped — nothing reads it, a fresh install never grows it, and a destructive DROP on a live table buys nothing.
+        "ALTER TABLE channel_session ADD COLUMN last_input_tokens INTEGER",
+        // OPE-820 operator mark. NULL on every pre-migration row, which reads as "unmarked" — the
+        // rung is skipped, so the migration changes no seat's rotation behaviour on its own.
+        "ALTER TABLE channel_session ADD COLUMN rotate_marked_at TEXT",
+        // OPE-1821 runtime-rotation comparison. Additive, both nullable. NULL reads as "never stamped",
+        // which stampChannelSessionRuntime ADOPTS rather than rotating: a pre-migration seat keeps its
+        // generation on the deploy that runs this migration and rotates on the next CODE change. The
+        // fail-safe direction here is NOT to rotate — rotating on absence would retire every standing
+        // seat's generation at migration time and again on every seat's first wake after a fresh mint.
+        "ALTER TABLE channel_session ADD COLUMN served_code_fingerprint TEXT",
+        "ALTER TABLE channel_session ADD COLUMN served_domain_fingerprint TEXT",
+        // Answerable-wake lifecycle (OPE-161): additive, all three nullable. Pre-migration rows (6h-TTL ephemera) keep NULL window_token ⇒ they
+        // never qualify for the PENDING arm of the reply fence (fail-closed — an un-window-stamped row
+        // can't prove it belongs to the answering session), and NULL answered_at ⇒ they read as
+        // unanswered, which is the safe direction (worst case a duplicate reply, never a lost answer).
+        "ALTER TABLE unified_wake_target ADD COLUMN window_token TEXT",
+        "ALTER TABLE unified_wake_target ADD COLUMN answered_at TEXT",
+        "ALTER TABLE unified_wake_target ADD COLUMN answered_turn_id TEXT",
+        // OPE-767: additive, nullable. A pre-migration row reads as NOT inbound, so it never appears in
+        // `listPendingUnifiedWakes` and can never make a reply look stale — a missed refusal, never a
+        // false one, which is the direction the whole freshness gate fails in.
+        "ALTER TABLE unified_wake_target ADD COLUMN inbound INTEGER",
+        // OPE-836: additive, nullable — the turn-end wake-accounting HORIZON. A pre-migration row reads
+        // NULL ⇒ "not yet audited", so the first turn after the migration considers it once and stamps
+        // it. Only `listUnauditedUnifiedWakes` filters on this column, so adding it cannot change the
+        // reply-freshness gate or the answerable-reply fence — both read `listPendingUnifiedWakes`.
+        "ALTER TABLE unified_wake_target ADD COLUMN audited_at TEXT",
+        // Frozen proposing-surface identity (task #105 — sweep-expiry decision feedback): additive,
+        // nullable. Pre-migration rows stay NULL ⇒ the TTL sweep expires them WITHOUT notice/wake
+        // feedback (the fail-safe reading — feedback only ever fires on a mint that froze its target).
+        "ALTER TABLE pending_actions ADD COLUMN posted_to TEXT",
+        // Cross-process single-flight claim (OPE-91): additive, both nullable, on the stored_credential
+        // table. A row's ciphertext is an OPAQUE AES envelope, so the CAS can't live inside it — the
+        // claim gets its OWN columns (a random, non-secret claim id + an ISO-8601 lease stamp). Pre-
+        // migration / never-claimed rows read NULL ⇒ the row is FREE (claimable), the fail-safe reading.
+        "ALTER TABLE stored_credential ADD COLUMN claim_id TEXT",
+        "ALTER TABLE stored_credential ADD COLUMN claimed_at TEXT",
+        // SQLite's RENAME COLUMN has no guard clause, so it rides the same try/catch swallow as the ADD COLUMNs above: it throws "no such column" once already renamed.
+        // A fresh CREATE TABLE never has a provider column, so this only fires on a pre-existing DB.
+        "ALTER TABLE stored_credential RENAME COLUMN provider TO connector",
+        "ALTER TABLE credential_intake RENAME COLUMN provider TO connector",
+        // Audit hash chain (OPE-52, audit-wedge WS-6c): additive, nullable. The chain STARTS at
+        // the first row appended after this migration — pre-migration rows keep prev_sha NULL, so
+        // the boundary reads as a genesis (the fail-safe, backfill-free reading: a later null-prev
+        // row sitting AFTER non-null rows is itself a detectable break, findChainBreak flags it).
+        "ALTER TABLE audit_entry ADD COLUMN prev_sha TEXT",
+        // OPE-1866: the conversation mode the anti-doxxing mask reads on the AUDIT dataset, the last
+        // table that could not classify its own surfaces. Additive and nullable, exactly as the
+        // spend/usage pair above, and NOTHING IS BACKFILLED for the same reason: the mode was knowable
+        // only from the turn's binding, which no stored row carries. A pre-migration row therefore
+        // reads NULL and `query_analytics` masks it as `(unclassified)` — fail closed, because the
+        // alternative is publishing a surface id the reader cannot classify. It is OUTSIDE the hash
+        // prefix too (agent/audit/chain.ts), so adding the column breaks no existing chain link.
+        "ALTER TABLE audit_entry ADD COLUMN surface_mode TEXT",
+        // Per-routine cost attribution (OPE-145): additive, nullable. Pre-migration `kind = "routine"`
+        // rows keep routine_id NULL — they are honestly "a routine ran, we can't say which", which is
+        // exactly what they were. Nothing is backfilled: the marker that would name the routine only
+        // ever existed in the fired session's auth, never on the stored row.
+        "ALTER TABLE usage_events ADD COLUMN routine_id TEXT",
+        // Each of these records something knowable only AT THE MOMENT OF THE CALL, so a pre-migration row honestly reads NULL and nothing is backfilled.
+        // None of them touches the primary key, so these are ordinary ADD COLUMNs and the rows are kept.
+        "ALTER TABLE usage_events ADD COLUMN usd_micros_measured INTEGER",
+        "ALTER TABLE usage_events ADD COLUMN cost_source TEXT",
+        "ALTER TABLE usage_events ADD COLUMN delegation_depth INTEGER",
+        "ALTER TABLE usage_events ADD COLUMN root_session_id TEXT",
+        // Cache/reasoning ATTRIBUTION (OPE-1611): additive, and the two usage_events columns are
+        // NULLABLE for the same reason the four above are — each records what the call's own source
+        // reported at the moment of the call, so a pre-migration row honestly reads NULL rather than
+        // being handed a zero it never earned. spend_ledger takes a NOT NULL DEFAULT instead: it is a
+        // monthly SUM, and a SUM has no way to say "unreported" anyway.
+        "ALTER TABLE usage_events ADD COLUMN cache_tokens_reported INTEGER",
+        "ALTER TABLE usage_events ADD COLUMN reasoning_tokens INTEGER",
+        "ALTER TABLE spend_ledger ADD COLUMN reasoning_tokens INTEGER NOT NULL DEFAULT 0",
+        // OPE-1862: the conversation mode the anti-doxxing mask reads. Additive on both tables and
+        // NOT in either primary key, so existing rows are kept. Nothing is backfilled and nothing may
+        // be: the mode was knowable only from the turn's binding, which no stored row carries. An
+        // unstamped row therefore reads '' / NULL, and every report MASKS it — fail closed, because
+        // the alternative is publishing a surface id the reader cannot classify.
+        "ALTER TABLE usage_events ADD COLUMN surface_mode TEXT",
+        "ALTER TABLE spend_ledger ADD COLUMN surface_mode TEXT NOT NULL DEFAULT ''",
+        // OPE-309 phase 2: both ends of a link challenge record their tenant. Additive and ordinary —
+        // unlike identity_linked_ids these are not PK columns, so no rebuild is needed. Pre-migration
+        // rows take `''` / NULL; challenges carry a short TTL (link-challenge.ts), so in practice every
+        // one of them has expired before this line ever runs, and an expired challenge writes nothing.
+        "ALTER TABLE identity_link_challenges ADD COLUMN initiating_tenant TEXT NOT NULL DEFAULT ''",
+        "ALTER TABLE identity_link_challenges ADD COLUMN claimed_tenant TEXT",
+        // OPE-617: the transport a challenge belongs to, the directory transport's named target, and the
+        // code-back digest. Additive and nullable, and `transport` defaults to 'code' — which is exactly
+        // what every pre-migration row IS, so no backfill can be wrong. The same TTL argument as above
+        // applies: a challenge that outlived this migration has expired anyway.
+        "ALTER TABLE identity_link_challenges ADD COLUMN transport TEXT NOT NULL DEFAULT 'code'",
+        "ALTER TABLE identity_link_challenges ADD COLUMN target_platform TEXT",
+        "ALTER TABLE identity_link_challenges ADD COLUMN target_tenant TEXT",
+        "ALTER TABLE identity_link_challenges ADD COLUMN target_native_id TEXT",
+        "ALTER TABLE identity_link_challenges ADD COLUMN back_nonce_hash TEXT",
+        // OPE-1060 S3: where the owner's answer is reported back — a JSON ReplyTarget, pinned when the
+        // ask is raised. Additive and nullable. A pre-migration ask reads NULL, which is the honest
+        // reading: nothing recorded the requesting room, so the resolution notice is skipped rather
+        // than posted somewhere guessed. Asks carry a 30-minute TTL, so in practice every pre-migration
+        // row has already expired before this line runs.
+        "ALTER TABLE credential_grant_ask ADD COLUMN requester_target TEXT",
+        // OPE-1112: where the owner's DM card landed, so the TTL sweep can rewrite it to `expired`.
+        // Additive and nullable. A pre-migration ask reads NULL, which is the honest reading: nothing
+        // recorded the card's address, so the sweep skips the rewrite rather than editing a guessed
+        // message. Asks carry a 30-minute TTL, so every pre-migration row has already lapsed.
+        "ALTER TABLE credential_grant_ask ADD COLUMN card_surface_id TEXT",
+        "ALTER TABLE credential_grant_ask ADD COLUMN card_message_id TEXT",
+        // A pre-migration row reads NULL on all four borrow columns: it names no vendor tool, so it is read but never spendable — the broker refuses no_lent_tool and it mounts nothing.
+        // NULL is NOT an empty object; see credential-grant-rows.ts for why the two must never collapse.
+        "ALTER TABLE credential_grant_ask ADD COLUMN mcp_tool TEXT",
+        "ALTER TABLE credential_grant_ask ADD COLUMN frozen_args TEXT",
+        "ALTER TABLE credential_grant_ask ADD COLUMN tool_name TEXT",
+        "ALTER TABLE credential_grant ADD COLUMN mcp_tool TEXT",
+        "ALTER TABLE credential_grant ADD COLUMN frozen_args TEXT",
+        "ALTER TABLE credential_grant ADD COLUMN tool_name TEXT",
+        "ALTER TABLE credential_grant ADD COLUMN input_schema TEXT",
+        "ALTER TABLE credential_grant ADD COLUMN refund_turn TEXT",
+        "ALTER TABLE credential_grant ADD COLUMN refund_count INTEGER NOT NULL DEFAULT 0",
+        "ALTER TABLE credential_grant ADD COLUMN refund_turn_seq INTEGER",
+        // OPE-1950: the room's DOMAIN-shaped seat key, recorded beside the session one so the mint can
+        // bind a STANDING grant to the domain and every other mode to the session. Additive and
+        // nullable. A pre-migration ask reads NULL, which is the honest reading — nothing recorded the
+        // room's domain. Since OPE-2160 such an ask is offered no 30-day arm at all; before that, a
+        // standing grant minted from one kept the exact-session rule. Asks carry a 30-minute TTL, so every pre-migration row has
+        // already lapsed by the time this line runs.
+        "ALTER TABLE credential_grant_ask ADD COLUMN domain_scope_key TEXT",
+    ]) {
+        try {
+            handle.exec(ddl);
+        }
+        catch {
+            /* column already present — already migrated */
+        }
+    }
+    db = handle;
+    openedPath = path;
+    return handle;
+}
+/** The runtime file path the operational sqlite store opens — the SAME resolution the
+ *  migrator uses to find the source DB (OE_SQLITE_PATH, else OE_MEMORY_DIR/open-everywhere.sqlite3).
+ *  Exported so migrate-operational.ts reads the exact file the runtime writes, not a guess. */
+export function sqliteOperationalDbPath() {
+    return dbPath().path;
+}
+/** Test seam: the file the cached handle is actually OPEN at, or `null` when nothing is open.
+ *  {@link sqliteOperationalDbPath} answers what the env RESOLVES to right now, which is a different
+ *  question and the one OPE-1933's silent switch turned on — a test that cannot tell them apart
+ *  cannot prove the handle stayed put. */
+export function _openedOperationalDbPathForTest() {
+    return openedPath;
+}
+/** WHERE THE ROWS ACTUALLY ARE — the store's `root`, and the provenance field `auditRoot()` puts on
+ *  every audit view. It must name the OPEN handle's file, not the env's current resolution: since
+ *  OPE-1933 `getDb()` deliberately keeps its handle when the env read returns `undefined`, so inside
+ *  the very scope that guard exists for, the env resolves to a cwd-derived path while the rows come
+ *  from the pinned one. Reporting the env's answer there would state a location the rows are not in.
+ *  Falls back to the resolution only when nothing is open yet, which is what a caller asking before
+ *  the first read wants. */
+function operationalRoot() {
+    return openedPath ?? dbPath().path;
+}
+/** Every operational table this store actually creates (read from sqlite_master on the live
+ *  handle) — the runtime-truth counterpart to OPERATIONAL_TABLES that migrate-operational-test.ts
+ *  asserts against, so a new CREATE TABLE here can't drift from the migrator's canonical list.
+ *  Excludes sqlite internal tables AND the memory tables (memory_file/memory_tier) — those share
+ *  the file but belong to the memory provider, not the operational store, so a :memory: DB opened
+ *  through this store alone (memory provider untouched) never creates them. */
+export function sqliteOperationalTableNames() {
+    const rows = getDb()
+        .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' AND name NOT IN ('memory_file', 'memory_tier') ORDER BY name")
+        .all();
+    return rows.map((r) => r.name);
+}
+/** Test seam: drop the cached handle so the next call reopens (e.g. new path). */
+export function _resetOperationalDbForTest() {
+    if (db)
+        db.close();
+    db = null;
+    openedPath = null;
+}
+function modelCallCaptureFromRow(org, r) {
+    return {
+        seq: Number(r.seq),
+        org,
+        surfaceKey: r.surface_key,
+        sessionId: r.session_id,
+        turnId: r.turn_id,
+        stepIndex: Number(r.step_index),
+        ts: r.ts,
+        model: r.model,
+        provider: r.provider,
+        schemaVersion: Number(r.schema_version),
+        sha256: r.sha256,
+        bodyBytes: Number(r.body_bytes),
+        bodyGzipB64: r.body_gzip_b64,
+        truncated: Number(r.truncated) === 1,
+    };
+}
+function spendRowFrom(r) {
+    return {
+        org: r.org_id,
+        surfaceKey: r.surface_key,
+        principalId: r.principal_id,
+        routineId: r.routine_id,
+        model: r.model,
+        period: r.period,
+        costSource: r.cost_source === "measured" ? "measured" : "derived",
+        // `?? ""` covers the window between the ADD COLUMN and a write: a row read through an older
+        // prepared statement, or any NULL an operator's own migration left, reads as UNSTAMPED.
+        surfaceMode: r.surface_mode ?? "",
+        inputTokens: r.input_tokens,
+        outputTokens: r.output_tokens,
+        cacheReadTokens: r.cache_read_tokens,
+        cacheWriteTokens: r.cache_write_tokens,
+        reasoningTokens: r.reasoning_tokens,
+        usdMicros: r.usd_micros,
+        usdMicrosMeasured: r.usd_micros_measured,
+        calls: r.calls,
+    };
+}
+function usageEventFromRow(org, r) {
+    return {
+        org,
+        surfaceKey: r.surface_key,
+        sessionId: r.session_id,
+        ...(r.principal_id ? { principalId: r.principal_id } : {}),
+        ts: r.ts,
+        ...(r.kind ? { kind: r.kind } : {}),
+        ...(r.routine_id ? { routineId: r.routine_id } : {}),
+        inputTokens: r.input_tokens,
+        outputTokens: r.output_tokens,
+        cacheReadTokens: r.cache_read_tokens,
+        cacheWriteTokens: r.cache_write_tokens,
+        ...(r.model ? { model: r.model } : {}),
+        // OPE-369. `usd_micros_measured` is read back on `!= null` rather than on truthiness: a
+        // genuinely-measured $0.000000 call (a cached/free response the gateway still bills as zero)
+        // is EVIDENCE that the gateway answered, and dropping it would silently demote the row to
+        // "nothing measured it". `delegation_depth` reads the same way — 0 IS the root turn.
+        ...(r.usd_micros_measured != null ? { usdMicrosMeasured: Number(r.usd_micros_measured) } : {}),
+        ...(r.cost_source ? { costSource: r.cost_source === "measured" ? "measured" : "derived" } : {}),
+        ...(r.delegation_depth != null ? { delegationDepth: Number(r.delegation_depth) } : {}),
+        ...(r.root_session_id ? { rootSessionId: r.root_session_id } : {}),
+        // OPE-1611, read back on `!= null` for the SAME reason: `0` here means "the source reported a
+        // zero", which is real evidence, while NULL means it reported nothing at all. The flag stores
+        // 1/0 (node:sqlite has no boolean) and comes back as a real boolean.
+        ...(r.cache_tokens_reported != null ? { cacheTokensReported: r.cache_tokens_reported === 1 } : {}),
+        ...(r.reasoning_tokens != null ? { reasoningTokens: Number(r.reasoning_tokens) } : {}),
+        // OPE-1862: only the three declared spellings become a mode. Every other value — '', NULL, a
+        // spelling a foreign writer invented — stays ABSENT, which the report mask treats as
+        // unclassified and hides.
+        ...(() => {
+            const mode = asSurfaceMode(r.surface_mode);
+            return mode ? { surfaceMode: mode } : {};
+        })(),
+        ...(r.detail ? { detail: JSON.parse(r.detail) } : {}),
+    };
+}
+function pendingActionFromRow(org, r) {
+    return {
+        id: r.id,
+        org,
+        kind: r.kind,
+        argsJson: r.args_json,
+        scopeKey: r.scope_key,
+        domain: r.domain,
+        requestedBy: r.requested_by,
+        channelId: r.channel_id,
+        threadTs: r.thread_ts,
+        messageTs: r.message_ts,
+        postedTo: r.posted_to,
+        status: r.status,
+        createdAt: r.created_at,
+        expiresAt: r.expires_at,
+        decidedBy: r.decided_by,
+        decidedAt: r.decided_at,
+    };
+}
+/** `?, ?, …` for an `IN (…)` over a CLOSED status vocabulary — never caller text (sqlite has no
+ *  array-parameter form, so a status CAS list has to be spread into placeholders). */
+function placeholders(n) {
+    return new Array(n).fill("?").join(", ");
+}
+const TURN_ANCHOR_SELECT = "SELECT window_key, anchor_key, channel_key, session_id, turn_id, surface_key, created_at FROM turn_anchor";
+/** Project a raw turn_anchor row (or an absent one) into {@link TurnAnchorRow}. NULL optional
+ *  columns are OMITTED rather than carried as null, matching getUnifiedWakeRecord's shape. */
+function readTurnAnchorRow(raw) {
+    const r = raw;
+    if (!r)
+        return null;
+    return {
+        windowKey: r.window_key,
+        ...(r.anchor_key !== null ? { anchorKey: r.anchor_key } : {}),
+        ...(r.channel_key !== null ? { channelKey: r.channel_key } : {}),
+        sessionId: r.session_id,
+        turnId: r.turn_id,
+        surfaceKey: r.surface_key,
+        createdAt: r.created_at,
+    };
+}
+function linkSetFromSqliteRow(org, r) {
+    return { org, id: r.id, handle: r.handle, status: r.status, createdAt: r.created_at, updatedAt: r.updated_at };
+}
+const LINKED_ID_SQLITE_SELECT = "SELECT platform, tenant, native_id, link_set_id, status, established_by, evidence, created_at, updated_at FROM identity_linked_ids";
+function linkedIdFromSqliteRow(org, r) {
+    return {
+        org,
+        linkSetId: r.link_set_id,
+        platform: r.platform,
+        tenant: r.tenant,
+        nativeId: r.native_id,
+        status: r.status,
+        establishedBy: r.established_by,
+        ...(r.evidence === null ? {} : { evidenceJson: r.evidence }),
+        createdAt: r.created_at,
+        updatedAt: r.updated_at,
+    };
+}
+const LINK_CHALLENGE_SQLITE_SELECT = `SELECT id, nonce_hash, initiating_platform, initiating_tenant, initiating_native_id, initiating_surface_key,
+          claimed_platform, claimed_tenant, claimed_native_id, claimed_at,
+          transport, target_platform, target_tenant, target_native_id, back_nonce_hash,
+          status, created_at, expires_at, decided_at
+   FROM identity_link_challenges`;
+function linkChallengeFromSqliteRow(org, r) {
+    return {
+        org,
+        id: r.id,
+        nonceHash: r.nonce_hash,
+        initiatingPlatform: r.initiating_platform,
+        initiatingTenant: r.initiating_tenant,
+        initiatingNativeId: r.initiating_native_id,
+        initiatingSurfaceKey: r.initiating_surface_key,
+        ...(r.claimed_platform === null ? {} : { claimedPlatform: r.claimed_platform }),
+        ...(r.claimed_tenant === null ? {} : { claimedTenant: r.claimed_tenant }),
+        ...(r.claimed_native_id === null ? {} : { claimedNativeId: r.claimed_native_id }),
+        ...(r.claimed_at === null ? {} : { claimedAt: r.claimed_at }),
+        // A pre-OPE-617 row (or one read through a driver that returns no such column) is a CODE-transport
+        // row — that is what every row was before the column existed, so the fallback states a fact
+        // rather than guessing one.
+        transport: r.transport ?? "code",
+        ...(r.target_platform === null || r.target_platform === undefined ? {} : { targetPlatform: r.target_platform }),
+        ...(r.target_tenant === null || r.target_tenant === undefined ? {} : { targetTenant: r.target_tenant }),
+        ...(r.target_native_id === null || r.target_native_id === undefined ? {} : { targetNativeId: r.target_native_id }),
+        ...(r.back_nonce_hash === null || r.back_nonce_hash === undefined ? {} : { backNonceHash: r.back_nonce_hash }),
+        status: r.status,
+        createdAt: r.created_at,
+        expiresAt: r.expires_at,
+        ...(r.decided_at === null ? {} : { decidedAt: r.decided_at }),
+    };
+}
+/** Refuse a half-written borrow at the INSERT, where the caller can still be fixed — see
+ *  {@link grantBorrowColumnsProblem} for what "half" means and why it is silent otherwise. */
+function refuseHalfBorrow(table, row) {
+    const problem = grantBorrowColumnsProblem(row);
+    if (problem !== undefined)
+        throw new Error(`${table}: ${problem}`);
+}
+const GRANT_ASK_SQLITE_SELECT = `SELECT id, requester_principal_id, owner_principal_id, owner_slug, owner_platform, owner_native_id, connector, verb, resource,
+          mcp_tool, frozen_args, tool_name,
+          scope_key, domain_scope_key, purpose, requester_target, card_surface_id, card_message_id, requested_mode, status, created_at, expires_at, decided_at, grant_id
+   FROM credential_grant_ask`;
+function grantAskFromSqliteRow(r) {
+    const frozenArgs = grantJsonFromColumn(r.frozen_args, "credential_grant_ask.frozen_args");
+    return {
+        id: r.id,
+        requesterPrincipalId: r.requester_principal_id,
+        ownerPrincipalId: r.owner_principal_id,
+        ownerSlug: r.owner_slug,
+        ownerPlatform: r.owner_platform,
+        ownerNativeId: r.owner_native_id,
+        connector: r.connector,
+        verb: r.verb,
+        resource: r.resource,
+        ...(r.mcp_tool === null || r.mcp_tool === undefined ? {} : { mcpTool: r.mcp_tool }),
+        ...(frozenArgs === undefined ? {} : { frozenArgs }),
+        ...(r.tool_name === null || r.tool_name === undefined ? {} : { toolName: r.tool_name }),
+        scopeKey: r.scope_key,
+        ...(r.domain_scope_key === null || r.domain_scope_key === undefined ? {} : { domainScopeKey: r.domain_scope_key }),
+        purpose: r.purpose,
+        ...(r.requester_target === null ? {} : { requesterTarget: r.requester_target }),
+        ...(r.card_surface_id === null ? {} : { cardSurfaceId: r.card_surface_id }),
+        ...(r.card_message_id === null ? {} : { cardMessageId: r.card_message_id }),
+        requestedMode: r.requested_mode,
+        status: r.status,
+        createdAt: r.created_at,
+        expiresAt: r.expires_at,
+        ...(r.decided_at === null ? {} : { decidedAt: r.decided_at }),
+        ...(r.grant_id === null ? {} : { grantId: r.grant_id }),
+    };
+}
+const GRANT_SQLITE_SELECT = `SELECT id, ask_id, requester_principal_id, owner_principal_id, owner_slug, connector, verb, resource,
+          mcp_tool, frozen_args, tool_name, input_schema,
+          scope_key, mode, tier, status, purpose, created_at, expires_at, used_at, revoked_at
+   FROM credential_grant`;
+function grantFromSqliteRow(r) {
+    const frozenArgs = grantJsonFromColumn(r.frozen_args, "credential_grant.frozen_args");
+    const inputSchema = grantJsonFromColumn(r.input_schema, "credential_grant.input_schema");
+    return {
+        id: r.id,
+        askId: r.ask_id,
+        requesterPrincipalId: r.requester_principal_id,
+        ownerPrincipalId: r.owner_principal_id,
+        ownerSlug: r.owner_slug,
+        connector: r.connector,
+        verb: r.verb,
+        resource: r.resource,
+        ...(r.mcp_tool === null || r.mcp_tool === undefined ? {} : { mcpTool: r.mcp_tool }),
+        ...(frozenArgs === undefined ? {} : { frozenArgs }),
+        ...(r.tool_name === null || r.tool_name === undefined ? {} : { toolName: r.tool_name }),
+        ...(inputSchema === undefined ? {} : { inputSchema }),
+        scopeKey: r.scope_key,
+        mode: r.mode,
+        tier: r.tier,
+        status: r.status,
+        purpose: r.purpose,
+        createdAt: r.created_at,
+        expiresAt: r.expires_at,
+        ...(r.used_at === null ? {} : { usedAt: r.used_at }),
+        ...(r.revoked_at === null ? {} : { revokedAt: r.revoked_at }),
+    };
+}
+/** One `dm_audience` row → {@link DmAudienceRow}. A NULL timestamp is dropped rather than carried as
+ *  `null`, so a caller reads absence as absence and never has to test two spellings of "not set". */
+function dmAudienceRowFrom(r) {
+    return {
+        address: r.address,
+        ...(r.first_dm_at === null ? {} : { firstDmAt: r.first_dm_at }),
+        ...(r.stopped_at === null ? {} : { stoppedAt: r.stopped_at }),
+    };
+}
+export const sqliteOperationalStore = {
+    id: "sqlite",
+    root: operationalRoot,
+    async recordSpend(org, write) {
+        getDb()
+            .prepare(`INSERT INTO spend_ledger
+           (org_id, surface_key, principal_id, routine_id, model, period, cost_source, surface_mode,
+            input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, reasoning_tokens, usd_micros, usd_micros_measured, calls)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1)
+         ON CONFLICT(org_id, surface_key, principal_id, routine_id, model, period, cost_source) DO UPDATE SET
+           -- OPE-1862: a stamped mode HEALS a row an older build (or a writer with no binding)
+           -- left unstamped, and an unstamped write never erases a mode the row already holds.
+           -- A surface cannot change mode, so the two spellings can only ever be '' and the truth.
+           surface_mode        = COALESCE(NULLIF(excluded.surface_mode, ''), spend_ledger.surface_mode),
+           input_tokens        = input_tokens        + excluded.input_tokens,
+           output_tokens       = output_tokens       + excluded.output_tokens,
+           cache_read_tokens   = cache_read_tokens   + excluded.cache_read_tokens,
+           cache_write_tokens  = cache_write_tokens  + excluded.cache_write_tokens,
+           reasoning_tokens    = reasoning_tokens    + excluded.reasoning_tokens,
+           usd_micros          = usd_micros          + excluded.usd_micros,
+           usd_micros_measured = usd_micros_measured + excluded.usd_micros_measured,
+           calls               = calls + 1`)
+            .run(org, write.surfaceKey, write.principalId ?? "", write.routineId ?? "", write.model ?? "", write.period, write.costSource ?? "derived", write.surfaceMode ?? "", write.inputTokens ?? 0, write.outputTokens ?? 0, write.cacheReadTokens ?? 0, write.cacheWriteTokens ?? 0, write.reasoningTokens ?? 0, write.usdMicros ?? 0, write.usdMicrosMeasured ?? 0);
+    },
+    async spendTotals(org, filter = {}) {
+        const { conjuncts, params } = spendLedgerConjuncts(filter);
+        const row = getDb()
+            .prepare(`SELECT COALESCE(SUM(input_tokens), 0) AS input_tokens,
+                COALESCE(SUM(output_tokens), 0) AS output_tokens,
+                COALESCE(SUM(cache_read_tokens), 0) AS cache_read_tokens,
+                COALESCE(SUM(cache_write_tokens), 0) AS cache_write_tokens,
+                COALESCE(SUM(reasoning_tokens), 0) AS reasoning_tokens,
+                COALESCE(SUM(usd_micros), 0) AS usd_micros,
+                COALESCE(SUM(usd_micros_measured), 0) AS usd_micros_measured,
+                COALESCE(SUM(calls), 0) AS calls
+         FROM spend_ledger WHERE ${["org_id = ?", ...conjuncts].join(" AND ")}`)
+            .get(org, ...params);
+        return {
+            inputTokens: row.input_tokens,
+            outputTokens: row.output_tokens,
+            cacheReadTokens: row.cache_read_tokens,
+            cacheWriteTokens: row.cache_write_tokens,
+            reasoningTokens: row.reasoning_tokens,
+            usdMicros: row.usd_micros,
+            usdMicrosMeasured: row.usd_micros_measured,
+            calls: row.calls,
+        };
+    },
+    async listSpendLedger(org, filter = {}) {
+        // The filter goes into the QUERY, never into a `.filter()` over the result (OPE-1653): a
+        // caller that renders one period must not pay to load every period the deployment ever
+        // wrote. Same `spendLedgerConjuncts` assembly the SUM read uses, so the two reads — and the
+        // two backends — agree on what each conjunct means.
+        const { conjuncts, params } = spendLedgerConjuncts(filter);
+        const where = [...(org !== undefined ? ["org_id = ?"] : []), ...conjuncts];
+        const rows = getDb()
+            .prepare(`SELECT * FROM spend_ledger${where.length ? ` WHERE ${where.join(" AND ")}` : ""}`)
+            .all(...(org !== undefined ? [org] : []), ...params);
+        return rows.map(spendRowFrom);
+    },
+    async listRoutines(org, surfaceKey) {
+        const rows = getDb()
+            .prepare("SELECT data FROM routine WHERE org_id = ? AND surface_key = ?")
+            .all(org, surfaceKey);
+        return rows.map((r) => JSON.parse(r.data));
+    },
+    async getRoutine(org, surfaceKey, id) {
+        const row = getDb()
+            .prepare("SELECT data FROM routine WHERE org_id = ? AND id = ? AND surface_key = ?")
+            .get(org, id, surfaceKey);
+        return row ? JSON.parse(row.data) : null;
+    },
+    async addRoutine(routine) {
+        getDb()
+            .prepare("INSERT INTO routine (org_id, id, surface_key, data) VALUES (?, ?, ?, ?)")
+            .run(routine.org, routine.id, routine.surfaceKey, JSON.stringify(routine));
+        return routine;
+    },
+    async updateRoutine(org, surfaceKey, id, patch, provenance) {
+        const handle = getDb();
+        const row = handle.prepare("SELECT data FROM routine WHERE org_id = ? AND id = ? AND surface_key = ?").get(org, id, surfaceKey);
+        if (!row)
+            return null;
+        const existing = JSON.parse(row.data);
+        const updated = { ...existing, ...patch, id: existing.id, org: existing.org, surfaceKey: existing.surfaceKey };
+        // REVISIONS BEFORE the destructive UPDATE (OPE-242) — same reasoning as the Postgres adapter,
+        // and the same shared decision (routinePromptRevisionWrites) so the two backends cannot drift
+        // on WHAT gets recorded. Only a patch that REPLACES the prompt records anything.
+        if (patch.prompt !== undefined && patch.prompt !== existing.prompt) {
+            const prior = handle
+                .prepare("SELECT 1 FROM routine_prompt_revisions WHERE org_id = ? AND surface_key = ? AND routine_id = ? LIMIT 1")
+                .get(org, surfaceKey, id);
+            const writes = routinePromptRevisionWrites({
+                existing,
+                updated,
+                ...(provenance ? { provenance } : {}),
+                hasPriorRevisions: prior !== undefined,
+                nowIso: new Date().toISOString(),
+            });
+            const insert = handle.prepare(`INSERT INTO routine_prompt_revisions (org_id, surface_key, routine_id, prompt, generation, authored_by, armed_by, approval_id, recorded_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`);
+            for (const w of writes) {
+                insert.run(org, surfaceKey, id, w.prompt, w.generation, w.authoredBy ?? null, w.armedBy ?? null, w.approvalId ?? null, w.recordedAt);
+            }
+        }
+        handle.prepare("UPDATE routine SET data = ? WHERE org_id = ? AND id = ?").run(JSON.stringify(updated), org, id);
+        return updated;
+    },
+    async listRoutinePromptRevisions(org, surfaceKey, routineId) {
+        const rows = getDb()
+            .prepare(`SELECT seq, routine_id, prompt, generation, authored_by, armed_by, approval_id, recorded_at
+         FROM routine_prompt_revisions
+         WHERE org_id = ? AND surface_key = ? AND (? IS NULL OR routine_id = ?)
+         ORDER BY seq`)
+            .all(org, surfaceKey, routineId ?? null, routineId ?? null);
+        return rows.map((r) => ({
+            seq: Number(r.seq),
+            org,
+            surfaceKey,
+            routineId: r.routine_id,
+            prompt: r.prompt,
+            ...(r.generation === null ? {} : { generation: Number(r.generation) }),
+            ...(r.authored_by ? { authoredBy: r.authored_by } : {}),
+            ...(r.armed_by ? { armedBy: r.armed_by } : {}),
+            ...(r.approval_id ? { approvalId: r.approval_id } : {}),
+            recordedAt: r.recorded_at,
+        }));
+    },
+    async removeRoutine(org, surfaceKey, id) {
+        const info = getDb().prepare("DELETE FROM routine WHERE org_id = ? AND id = ? AND surface_key = ?").run(org, id, surfaceKey);
+        return info.changes > 0;
+    },
+    async listAllRoutines() {
+        const rows = getDb().prepare("SELECT data FROM routine").all();
+        return rows.map((r) => JSON.parse(r.data));
+    },
+    async appendAudit(entry) {
+        // Hash-chain link (OPE-52): stamp prev_sha = sha256 of the org's current LAST row. The
+        // read-last-then-insert is a race window for one org, so the whole body runs under the
+        // per-org in-process lock (OPE-1636 moved that lock here from audit.ts, so a caller that
+        // reaches the store directly is covered too). sqlite is one process by construction — a
+        // local/self-host file — so this lock is the WHOLE serialisation the engine needs; there
+        // is no cross-process layer to add. See chain.ts's concurrency stance.
+        return withOrgAuditLock(entry.org, async () => {
+            const handle = getDb();
+            const last = handle
+                .prepare(`SELECT ts, org_id, platform, workspace, surface, surface_mode, principal_id, action, detail, prev_sha
+         FROM audit_entry WHERE org_id = ? ORDER BY seq DESC LIMIT 1`)
+                .get(entry.org);
+            // Read the predecessor's mode back through asSurfaceMode, so a stored value outside the enum
+            // hashes as ABSENT here exactly as it reads as unclassified everywhere else. The predecessor's
+            // sha must be recomputed from the same reading the row itself gets, or the link breaks on a
+            // row nobody touched.
+            const lastMode = auditSurfaceMode(last?.surface_mode);
+            const prevSha = last
+                ? auditRowSha({
+                    org: last.org_id,
+                    ts: last.ts,
+                    platform: last.platform,
+                    workspace: last.workspace,
+                    ...(last.surface ? { surface: last.surface } : {}),
+                    ...lastMode,
+                    ...(last.principal_id ? { principalId: last.principal_id } : {}),
+                    action: last.action,
+                    ...(last.detail ? { detail: JSON.parse(last.detail) } : {}),
+                }, last.prev_sha)
+                : null;
+            handle
+                .prepare(`INSERT INTO audit_entry (ts, org_id, platform, workspace, surface, surface_mode, principal_id, action, detail, prev_sha)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                .run(entry.ts, entry.org, entry.platform, entry.workspace, entry.surface ?? null, entry.surfaceMode ?? null, entry.principalId ?? null, entry.action, entry.detail ? JSON.stringify(entry.detail) : null, prevSha);
+        });
+    },
+    async readAudit(filter) {
+        // Refuse before the builder runs (OPE-1812) — the Postgres twin does the same, through the same
+        // helper, so the two query builders cannot drift on the one predicate that partitions the log.
+        const org = auditReadOrg(filter);
+        const where = [];
+        const params = [];
+        const eq = (col, val) => {
+            if (val !== undefined) {
+                where.push(`${col} = ?`);
+                params.push(val);
+            }
+        };
+        eq("org_id", org);
+        eq("platform", filter.platform);
+        eq("workspace", filter.workspace);
+        eq("surface", filter.surface);
+        eq("action", filter.action);
+        eq("principal_id", filter.principalId);
+        if (filter.since !== undefined) {
+            where.push("ts >= ?");
+            params.push(filter.since);
+        }
+        if (filter.until !== undefined) {
+            where.push("ts <= ?");
+            params.push(filter.until);
+        }
+        const clause = where.length ? `WHERE ${where.join(" AND ")}` : "";
+        const limit = filter.limit && filter.limit > 0 ? filter.limit : -1; // SQLite: -1 = no limit
+        const rows = getDb()
+            .prepare(
+        // `seq` rides along (OPE-1933): it is already the ORDER BY tiebreak, and it is the only
+        // monotonic locator a reader can anchor on when the box's wall clock steps backward.
+        // `surface_mode` is the anti-doxxing mask's input (OPE-1866).
+        `SELECT seq, ts, org_id, platform, workspace, surface, surface_mode, principal_id, action, detail
+         FROM audit_entry ${clause} ORDER BY ts DESC, seq DESC LIMIT ?`)
+            .all(...params, limit);
+        return rows.map((r) => ({
+            seq: Number(r.seq),
+            ts: r.ts,
+            org: r.org_id,
+            platform: r.platform,
+            workspace: r.workspace,
+            ...(r.surface ? { surface: r.surface } : {}),
+            ...auditSurfaceMode(r.surface_mode),
+            ...(r.principal_id ? { principalId: r.principal_id } : {}),
+            action: r.action,
+            ...(r.detail ? { detail: JSON.parse(r.detail) } : {}),
+        }));
+    },
+    async listAuditOrgs() {
+        const rows = getDb().prepare("SELECT DISTINCT org_id FROM audit_entry ORDER BY org_id").all();
+        return rows.map((r) => r.org_id);
+    },
+    async readAuditChain(org, opts) {
+        // Rows come back OLDEST-first, which is the order the hash-chain walk needs; a tailLimit takes the last N by seq and re-orders them ascending.
+        const tail = opts?.tailLimit;
+        const sql = tail && tail > 0
+            ? `SELECT * FROM (
+             SELECT seq, ts, org_id, platform, workspace, surface, surface_mode, principal_id, action, detail, prev_sha
+             FROM audit_entry WHERE org_id = ? ORDER BY seq DESC LIMIT ?
+           ) ORDER BY seq ASC`
+            : `SELECT seq, ts, org_id, platform, workspace, surface, surface_mode, principal_id, action, detail, prev_sha
+           FROM audit_entry WHERE org_id = ? ORDER BY seq ASC`;
+        const rows = getDb()
+            .prepare(sql)
+            .all(...(tail && tail > 0 ? [org, tail] : [org]));
+        return rows.map((r) => ({
+            seq: Number(r.seq),
+            ts: r.ts,
+            org: r.org_id,
+            platform: r.platform,
+            workspace: r.workspace,
+            ...(r.surface ? { surface: r.surface } : {}),
+            ...auditSurfaceMode(r.surface_mode),
+            ...(r.principal_id ? { principalId: r.principal_id } : {}),
+            action: r.action,
+            ...(r.detail ? { detail: JSON.parse(r.detail) } : {}),
+            prevSha: r.prev_sha,
+        }));
+    },
+    async sealAuditChainEpoch(org, sealedBy) {
+        // The read and the insert run under the SAME per-org lock as an append (OPE-1636): a row
+        // that landed between them would sit after the era the seal claims to cover. The org's whole
+        // chain is read inside that lock, so this org's appends queue behind it for the duration.
+        return withOrgAuditLock(org, async () => {
+            const rows = await sqliteOperationalStore.readAuditChain(org);
+            const seal = auditEpochSealFor(rows);
+            if (seal === null)
+                return null;
+            // The marker's seq comes from the INSERT itself (`lastInsertRowid` — `seq` is the table's
+            // INTEGER PRIMARY KEY AUTOINCREMENT, i.e. the rowid). Reading the chain back for it would
+            // sit outside this lock and could name a row another writer appended first.
+            const written = getDb()
+                .prepare(`INSERT INTO audit_entry (ts, org_id, platform, workspace, principal_id, action, detail, prev_sha)
+           VALUES (?, ?, 'db', 'sqlite', ?, ?, ?, NULL)`)
+                .run(new Date().toISOString(), org, sealedBy, AUDIT_CHAIN_EPOCH_ACTION, JSON.stringify(auditEpochDetail(seal)));
+            return { seal, markerSeq: Number(written.lastInsertRowid) };
+        });
+    },
+    async setSpendLimit(org, scopeKey, level, limit, meta, condition) {
+        assertSpendLimitAmount(limit);
+        // ENCODING: monthly_tokens = -1 means "no token component". The column is NOT NULL
+        // in every pre-existing DB and SQLite's ALTER TABLE can't relax that, so a sentinel
+        // is the only additive migration; -1 is unambiguous because assertSpendLimitAmount
+        // rejects any non-positive real limit. monthly_usd (a new, nullable column) uses a
+        // plain NULL. spendLimits() below decodes both back to `undefined`.
+        const conflict = condition?.ifAbsent
+            ? "DO NOTHING"
+            : `DO UPDATE SET
+           monthly_tokens = excluded.monthly_tokens,
+           monthly_usd    = excluded.monthly_usd,
+           expires_at     = excluded.expires_at,
+           reason         = excluded.reason,
+           set_by         = excluded.set_by`;
+        return (getDb()
+            .prepare(`INSERT INTO spend_limit (org_id, scope_key, level, monthly_tokens, monthly_usd, expires_at, reason, set_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+           ON CONFLICT(org_id, scope_key, level) ${conflict}`)
+            .run(org, scopeKey, level, limit.monthlyTokens ?? -1, limit.monthlyUsd ?? null, meta?.expiresAt ?? null, meta?.reason ?? null, meta?.setBy ?? null).changes > 0);
+    },
+    async clearSpendLimit(org, scopeKey, level, expected) {
+        const sql = expected
+            ? "DELETE FROM spend_limit WHERE org_id = ? AND scope_key = ? AND level = ? AND monthly_tokens IS ? AND monthly_usd IS ? AND expires_at IS ? AND reason IS ? AND set_by IS ?"
+            : "DELETE FROM spend_limit WHERE org_id = ? AND scope_key = ? AND level = ?";
+        const params = expected
+            ? [org, scopeKey, level, expected.monthlyTokens ?? -1, expected.monthlyUsd ?? null, expected.expiresAt ?? null, expected.reason ?? null, expected.setBy ?? null]
+            : [org, scopeKey, level];
+        return getDb().prepare(sql).run(...params).changes > 0;
+    },
+    async spendLimits(org) {
+        const rows = getDb()
+            .prepare("SELECT scope_key, level, monthly_tokens, monthly_usd, expires_at, reason, set_by FROM spend_limit WHERE org_id = ?")
+            .all(org);
+        return rows.map((r) => ({
+            org,
+            scopeKey: r.scope_key,
+            level: r.level,
+            // Decode the storage encodings (see setSpendLimit): -1 tokens = no token
+            // component; NULL usd = no USD component.
+            ...(r.monthly_tokens >= 0 ? { monthlyTokens: r.monthly_tokens } : {}),
+            ...(r.monthly_usd != null ? { monthlyUsd: r.monthly_usd } : {}),
+            ...(r.expires_at != null ? { expiresAt: r.expires_at } : {}),
+            ...(r.reason ? { reason: r.reason } : {}),
+            ...(r.set_by ? { setBy: r.set_by } : {}),
+        }));
+    },
+    async setHalt(org, address, meta) {
+        assertHaltAddress(address);
+        const a = haltAddressColumns(address);
+        // Re-halting an already-halted address restamps who/when and DROPS the previous resume stamps:
+        // a cleared_at left beside an active row would read as "resumed" to anyone scanning the table.
+        getDb()
+            .prepare(`INSERT INTO halt (org_id, level, scope_key, org_wide, active, set_by, set_at, set_ref, cleared_by, cleared_at) VALUES (?, ?, ?, ?, 1, ?, ?, ?, NULL, NULL)
+         ON CONFLICT(org_id, level, scope_key, org_wide) DO UPDATE SET
+           active     = 1,
+           set_by     = excluded.set_by,
+           set_at     = excluded.set_at,
+           set_ref    = excluded.set_ref,
+           cleared_by = NULL,
+           cleared_at = NULL`)
+            .run(org, a.level, a.scopeKey, a.orgWide ? 1 : 0, meta?.setBy ?? null, meta?.setAt ?? new Date().toISOString(), meta?.setRef ?? null);
+    },
+    async clearHalt(org, address, meta, expected) {
+        assertHaltAddress(address);
+        const a = haltAddressColumns(address);
+        // `AND active = 1` is what makes the boolean answer honest: a second resume on an already-clear
+        // address returns false rather than restamping a clear that already happened.
+        const expectedSql = expected ? " AND set_at = ? AND set_by IS ? AND set_ref IS ?" : "";
+        const expectedParams = expected ? [expected.setAt, expected.setBy ?? null, expected.setRef ?? null] : [];
+        return (getDb()
+            .prepare(`UPDATE halt SET active = 0, cleared_by = ?, cleared_at = ? WHERE org_id = ? AND level = ? AND scope_key = ? AND org_wide = ? AND active = 1${expectedSql}`)
+            .run(meta?.clearedBy ?? null, new Date().toISOString(), org, a.level, a.scopeKey, a.orgWide ? 1 : 0, ...expectedParams).changes > 0);
+    },
+    async activeHalts(org) {
+        const rows = getDb()
+            .prepare("SELECT level, scope_key, org_wide, set_by, set_at, set_ref, cleared_by, cleared_at FROM halt WHERE org_id = ? AND active = 1")
+            .all(org);
+        return rows.map((r) => ({
+            org,
+            address: haltAddressFromColumns(r.level, r.scope_key, r.org_wide === 1),
+            active: true,
+            setAt: r.set_at,
+            ...(r.set_by ? { setBy: r.set_by } : {}),
+            ...(r.set_ref ? { setRef: r.set_ref } : {}),
+            ...(r.cleared_by ? { clearedBy: r.cleared_by } : {}),
+            ...(r.cleared_at ? { clearedAt: r.cleared_at } : {}),
+        }));
+    },
+    async setConnectorOverride(org, scopeKey, connector, granted, meta) {
+        getDb()
+            .prepare(`INSERT INTO connector_override (org_id, scope_key, connector, granted, reason, set_by) VALUES (?, ?, ?, ?, ?, ?)
+         ON CONFLICT(org_id, scope_key, connector) DO UPDATE SET
+           granted = excluded.granted,
+           reason  = excluded.reason,
+           set_by  = excluded.set_by`)
+            .run(org, scopeKey, connector, granted ? 1 : 0, meta?.reason ?? null, meta?.setBy ?? null);
+    },
+    async clearConnectorOverride(org, scopeKey, connector) {
+        return getDb().prepare("DELETE FROM connector_override WHERE org_id = ? AND scope_key = ? AND connector = ?").run(org, scopeKey, connector).changes > 0;
+    },
+    async connectorOverrides(org, scopeKey) {
+        // Hot gate path — only the fields the connector gate needs (stays robust even if a
+        // drift-view column is missing). reason/setBy are read by allConnectorOverrides.
+        const rows = getDb()
+            .prepare("SELECT connector, granted FROM connector_override WHERE org_id = ? AND scope_key = ?")
+            .all(org, scopeKey);
+        return rows.map((r) => ({ connector: r.connector, granted: r.granted === 1 }));
+    },
+    async allConnectorOverrides(org) {
+        const rows = getDb()
+            .prepare("SELECT scope_key, connector, granted, reason, set_by FROM connector_override WHERE org_id = ?")
+            .all(org);
+        return rows.map((r) => ({ scopeKey: r.scope_key, connector: r.connector, granted: r.granted === 1, ...(r.reason ? { reason: r.reason } : {}), ...(r.set_by ? { setBy: r.set_by } : {}) }));
+    },
+    async setDomainModel(org, domain, pick, setBy) {
+        assertDomainModelPick(pick);
+        getDb()
+            .prepare(`INSERT INTO domain_model (org_id, domain, model_id, reasoning, set_by, updated_at) VALUES (?, ?, ?, ?, ?, ?)
+         ON CONFLICT(org_id, domain) DO UPDATE SET
+           model_id   = excluded.model_id,
+           reasoning  = excluded.reasoning,
+           set_by     = excluded.set_by,
+           updated_at = excluded.updated_at`)
+            .run(org, domain, pick.modelId ?? null, pick.reasoning ?? null, setBy ?? null, new Date().toISOString());
+    },
+    async clearDomainModel(org, domain) {
+        return getDb().prepare("DELETE FROM domain_model WHERE org_id = ? AND domain = ?").run(org, domain).changes > 0;
+    },
+    async getDomainModel(org, domain) {
+        const row = getDb()
+            .prepare("SELECT model_id, reasoning, set_by, updated_at FROM domain_model WHERE org_id = ? AND domain = ?")
+            .get(org, domain);
+        if (!row)
+            return null;
+        return {
+            org,
+            domain,
+            ...(row.model_id ? { modelId: row.model_id } : {}),
+            ...(row.reasoning ? { reasoning: row.reasoning } : {}),
+            ...(row.set_by ? { setBy: row.set_by } : {}),
+            updatedAt: row.updated_at,
+        };
+    },
+    async domainModels(org) {
+        const rows = getDb()
+            .prepare("SELECT domain, model_id, reasoning, set_by, updated_at FROM domain_model WHERE org_id = ? ORDER BY domain")
+            .all(org);
+        return rows.map((r) => ({
+            org,
+            domain: r.domain,
+            ...(r.model_id ? { modelId: r.model_id } : {}),
+            ...(r.reasoning ? { reasoning: r.reasoning } : {}),
+            ...(r.set_by ? { setBy: r.set_by } : {}),
+            updatedAt: r.updated_at,
+        }));
+    },
+    async markEngaged(org, surfaceKey, threadTs, at, opts) {
+        // A promotion from any id the row already records NEVER clears stopped: a platform that redelivers one event replays the invitation, and that must not lift a stand-down nobody asked to lift. The statement normalises a legacy bare id ITSELF and must — the boot migration does not run for a non-owner runtime role, and an un-normalised value fails OPEN.
+        // The trim rides a SECOND statement on purpose: the stopped decision and the promoter append have to be ONE atomic statement, and the Postgres twin has no transaction seam. A crash between the two leaves the promoter list one entry over PROMOTER_LIST_MAX, where it stays — bounded, but never self-healed.
+        const participating = opts?.participating ? 1 : 0;
+        const ownerToken = opts?.ownerToken ?? null;
+        const kind = opts?.kind ?? "thread";
+        // FRAMED (`\nID\n`) on both sides of every comparison — see store.ts. `instr` of the framed id
+        // against the framed list is therefore an EXACT membership test, and `replace(list, framed,
+        // SEP) || <framed minus its leading SEP>` removes any existing entry and re-appends it last.
+        const framed = participating === 1 && opts?.engagedBy ? framePromoterId(opts.engagedBy) : null;
+        getDb()
+            .prepare(`INSERT INTO thread_engagement (org_id, surface_key, thread_ts, engaged_at, last_turn_at, participating, silent_streak, owner_token, kind, stopped, engaged_by)
+         VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, 0, ?)
+         ON CONFLICT(org_id, surface_key, thread_ts) DO UPDATE SET
+           last_turn_at  = excluded.last_turn_at,
+           participating = MAX(participating, excluded.participating),
+           silent_streak = CASE WHEN excluded.participating = 1 THEN 0 ELSE silent_streak END,
+           owner_token   = COALESCE(excluded.owner_token, owner_token),
+           stopped       = CASE
+                             WHEN excluded.participating = 1
+                              AND (excluded.engaged_by IS NULL
+                                   OR instr(CASE WHEN engaged_by IS NULL OR engaged_by = '' THEN char(10)
+                                                 WHEN substr(engaged_by, 1, 1) = char(10) THEN engaged_by
+                                                 ELSE char(10) || engaged_by || char(10) END,
+                                            excluded.engaged_by) = 0)
+                             THEN 0 ELSE stopped END,
+           engaged_by    = CASE
+                             WHEN excluded.participating = 1 AND excluded.engaged_by IS NOT NULL
+                             THEN replace(CASE WHEN engaged_by IS NULL OR engaged_by = '' THEN char(10)
+                                               WHEN substr(engaged_by, 1, 1) = char(10) THEN engaged_by
+                                               ELSE char(10) || engaged_by || char(10) END,
+                                          excluded.engaged_by, char(10)) || substr(excluded.engaged_by, 2)
+                             ELSE engaged_by END`)
+            .run(org, surfaceKey, threadTs, at, at, participating, ownerToken, kind, framed);
+        if (framed === null)
+            return;
+        // THE BOUND. One promotion appends at most one entry, so dropping at most one entry per
+        // promotion holds the list at PROMOTER_LIST_MAX. Entry count is (separators - 1); the drop is
+        // "cut everything up to and including the SECOND separator", which is the oldest entry. Safe on
+        // a legacy value because the statement above has just framed it.
+        getDb()
+            .prepare(`UPDATE thread_engagement
+            SET engaged_by = substr(engaged_by, instr(substr(engaged_by, 2), char(10)) + 1)
+          WHERE org_id = ? AND surface_key = ? AND thread_ts = ?
+            AND engaged_by IS NOT NULL
+            AND length(engaged_by) - length(replace(engaged_by, char(10), '')) - 1 > ?`)
+            .run(org, surfaceKey, threadTs, PROMOTER_LIST_MAX);
+    },
+    async markStopped(org, surfaceKey, threadTs) {
+        // Set the durable stopped marker on an EXISTING row (task #100 follow-up). No INSERT — a
+        // stop only ever applies to a thread that already carries an engagement row (the caller
+        // gates on that). Missing row → 0 changes → false. Idempotent (re-stop is a no-op write).
+        return getDb().prepare("UPDATE thread_engagement SET stopped = 1 WHERE org_id = ? AND surface_key = ? AND thread_ts = ?").run(org, surfaceKey, threadTs).changes > 0;
+    },
+    async bumpSilentStreak(org, surfaceKey, threadTs) {
+        // RETURNING (SQLite ≥3.35) hands back the post-increment value in one statement; a
+        // missing row matches nothing → get() is undefined → 0 (no-op, nothing to shed).
+        const row = getDb()
+            .prepare(`UPDATE thread_engagement SET silent_streak = silent_streak + 1
+         WHERE org_id = ? AND surface_key = ? AND thread_ts = ? RETURNING silent_streak`)
+            .get(org, surfaceKey, threadTs);
+        return row ? row.silent_streak : 0;
+    },
+    async getEngagement(org, surfaceKey, threadTs) {
+        const row = getDb()
+            .prepare("SELECT engaged_at, last_turn_at, participating, silent_streak, owner_token, kind, stopped, engaged_by FROM thread_engagement WHERE org_id = ? AND surface_key = ? AND thread_ts = ?")
+            .get(org, surfaceKey, threadTs);
+        return row
+            ? {
+                org,
+                surfaceKey,
+                threadTs,
+                engagedAt: row.engaged_at,
+                lastTurnAt: row.last_turn_at,
+                participating: row.participating === 1,
+                silentStreak: row.silent_streak,
+                ...(row.owner_token ? { ownerToken: row.owner_token } : {}),
+                kind: row.kind ?? "thread",
+                stopped: row.stopped === 1,
+                ...promoterListField(row.engaged_by),
+            }
+            : null;
+    },
+    async disengage(org, surfaceKey, threadTs) {
+        return getDb().prepare("DELETE FROM thread_engagement WHERE org_id = ? AND surface_key = ? AND thread_ts = ?").run(org, surfaceKey, threadTs).changes > 0;
+    },
+    async listEngagements(org) {
+        const rows = getDb()
+            .prepare("SELECT surface_key, thread_ts, engaged_at, last_turn_at, participating, silent_streak, owner_token, kind, stopped, engaged_by FROM thread_engagement WHERE org_id = ?")
+            .all(org);
+        return rows.map((r) => ({
+            org,
+            surfaceKey: r.surface_key,
+            threadTs: r.thread_ts,
+            engagedAt: r.engaged_at,
+            lastTurnAt: r.last_turn_at,
+            participating: r.participating === 1,
+            silentStreak: r.silent_streak,
+            ...(r.owner_token ? { ownerToken: r.owner_token } : {}),
+            kind: r.kind ?? "thread",
+            stopped: r.stopped === 1,
+            ...promoterListField(r.engaged_by),
+        }));
+    },
+    async getChannelSession(org, surfaceKey) {
+        const row = getDb()
+            .prepare("SELECT token, generation, created_at, last_wake_at, turn_count, input_tokens_total, first_wake_at, last_input_tokens, rotate_marked_at, served_code_fingerprint, served_domain_fingerprint FROM channel_session WHERE org_id = ? AND surface_key = ?")
+            .get(org, surfaceKey);
+        return row
+            ? {
+                org, surfaceKey, token: row.token, generation: row.generation, createdAt: row.created_at,
+                lastWakeAt: row.last_wake_at, turnCount: row.turn_count,
+                inputTokensTotal: row.input_tokens_total == null ? null : Number(row.input_tokens_total),
+                firstWakeAt: row.first_wake_at ?? null,
+                lastInputTokens: row.last_input_tokens == null ? null : Number(row.last_input_tokens),
+                rotateMarkedAt: row.rotate_marked_at ?? null,
+                servedCodeFingerprint: row.served_code_fingerprint ?? null,
+                servedDomainFingerprint: row.served_domain_fingerprint ?? null,
+            }
+            : null;
+    },
+    async stampChannelSessionRuntime(org, surfaceKey, codeFingerprint, domainFingerprint) {
+        // The read reports what the row HELD; the conditional UPDATE decides who ACTS on it, and only
+        // the UPDATE's own `changes` is trusted for that. `IS NOT` is SQLite's null-safe comparison, so
+        // a row that carries no pair at all matches the predicate.
+        //
+        // 🔴 WHY THIS NEEDS NO TRANSACTION. The two statements are synchronous and sit between no
+        // `await`, so nothing else in this process runs between them; across processes SQLite evaluates
+        // the UPDATE's WHERE under the write lock, so exactly one of two racing wakes gets changes = 1.
+        // A loser whose SELECT saw the stale pair still reads changes = 0 and answers "current" — the
+        // seat's generation retires ONCE. The Postgres twin gets the same guarantee from one statement.
+        const handle = getDb();
+        const prev = handle
+            .prepare("SELECT served_code_fingerprint, served_domain_fingerprint FROM channel_session WHERE org_id = ? AND surface_key = ?")
+            .get(org, surfaceKey);
+        if (prev === undefined)
+            return { outcome: "absent", previousCodeFingerprint: null, previousDomainFingerprint: null };
+        const previousCodeFingerprint = prev.served_code_fingerprint ?? null;
+        const previousDomainFingerprint = prev.served_domain_fingerprint ?? null;
+        const info = handle
+            .prepare(`UPDATE channel_session SET served_code_fingerprint = ?, served_domain_fingerprint = ?
+          WHERE org_id = ? AND surface_key = ?
+            AND (served_code_fingerprint IS NOT ? OR served_domain_fingerprint IS NOT ?)`)
+            .run(codeFingerprint, domainFingerprint, org, surfaceKey, codeFingerprint, domainFingerprint);
+        if (Number(info.changes ?? 0) === 0)
+            return { outcome: "current", previousCodeFingerprint, previousDomainFingerprint };
+        // NULL is ADOPTED, never rotated: the row was minted by this same bundle moments ago (the
+        // mint arm writes no pair) or predates the columns, and neither proves the code changed.
+        const outcome = previousCodeFingerprint === null ? "adopted" : "rotate";
+        return { outcome, previousCodeFingerprint, previousDomainFingerprint };
+    },
+    async rotateChannelSession(org, surfaceKey, newToken, at) {
+        const handle = getDb();
+        // In a SQLite UPSERT's DO UPDATE SET an unqualified column reads the PRE-update row and excluded.x reads the proposed values, so generation = generation + 1 bumps atomically in one statement.
+        // Every rotation sets rotate_marked_at = NULL, which SPENDS the operator mark; a mark that survived its own rotation would retire the seat on every wake.
+        const row = handle
+            .prepare(`INSERT INTO channel_session (org_id, surface_key, token, generation, created_at, last_wake_at, turn_count, input_tokens_total, first_wake_at, last_input_tokens, rotate_marked_at)
+         VALUES (?, ?, ?, 1, ?, ?, 0, 0, NULL, NULL, NULL)
+         ON CONFLICT(org_id, surface_key) DO UPDATE SET
+           token              = excluded.token,
+           generation         = generation + 1,
+           created_at         = excluded.created_at,
+           last_wake_at       = excluded.last_wake_at,
+           turn_count         = 0,
+           input_tokens_total = 0,
+           first_wake_at      = NULL,
+           last_input_tokens  = NULL,
+           rotate_marked_at   = NULL
+         RETURNING generation, served_code_fingerprint, served_domain_fingerprint`)
+            .get(org, surfaceKey, newToken, at, at);
+        const generation = row.generation;
+        // The fingerprint pair is NOT in the INSERT column list and NOT in the DO UPDATE SET, so a fresh
+        // mint starts NULL (adopted by the next wake) and a rotation KEEPS the pair the pre-dispatch
+        // stamp just wrote. Resetting it here would rotate the seat again on its very next wake.
+        return {
+            org, surfaceKey, token: newToken, generation, createdAt: at, lastWakeAt: at, turnCount: 0, inputTokensTotal: 0, firstWakeAt: null, lastInputTokens: null, rotateMarkedAt: null,
+            servedCodeFingerprint: row.served_code_fingerprint ?? null,
+            servedDomainFingerprint: row.served_domain_fingerprint ?? null,
+        };
+    },
+    async markChannelSessionRotation(org, surfaceKey, at) {
+        // UPDATE, never an upsert: a registry key with no row has no generation to retire, and minting
+        // one here would seat a channel nobody woke. COALESCE keeps the FIRST mark's stamp, so a
+        // re-run of the sweep is idempotent and the stamp stays readable as "marked since when".
+        const res = getDb()
+            .prepare("UPDATE channel_session SET rotate_marked_at = COALESCE(rotate_marked_at, ?) WHERE org_id = ? AND surface_key = ?")
+            .run(at, org, surfaceKey);
+        return Number(res.changes ?? 0) > 0;
+    },
+    async touchChannelSession(org, surfaceKey, at) {
+        // first_wake_at set ONCE (COALESCE) — runs only after a successful wake (H7c "delivered").
+        getDb()
+            .prepare("UPDATE channel_session SET last_wake_at = ?, turn_count = turn_count + 1, first_wake_at = COALESCE(first_wake_at, ?) WHERE org_id = ? AND surface_key = ?")
+            .run(at, at, org, surfaceKey);
+    },
+    async bumpChannelSessionUsage(org, surfaceKey, token, delta) {
+        // Token-guarded: only the LIVE generation's row updates, so a straggler step from a
+        // retired generation is a no-op (no phantom counting across a rotation). NULL⇒0 first.
+        // ONE write, TWO rungs (OPE-794): the running SUM is the cumulative backstop's input, the SET
+        // value is the context-size trigger's. They share this statement so they can never disagree
+        // about which step they saw, and the token guard covers both.
+        const res = getDb()
+            .prepare("UPDATE channel_session SET input_tokens_total = COALESCE(input_tokens_total, 0) + ?, last_input_tokens = ? WHERE org_id = ? AND surface_key = ? AND token = ?")
+            .run(delta, delta, org, surfaceKey, token);
+        return Number(res.changes ?? 0);
+    },
+    async listChannelSessions(org, keyPrefix) {
+        const rows = (keyPrefix === undefined
+            ? getDb()
+                .prepare("SELECT surface_key, token, generation, created_at, last_wake_at, turn_count, input_tokens_total, first_wake_at, last_input_tokens, rotate_marked_at, served_code_fingerprint, served_domain_fingerprint FROM channel_session WHERE org_id = ?")
+                .all(org)
+            : getDb()
+                // LIKE with a literal, colon/`::`-only prefix (`oe-domain::`) — no user-controlled
+                // wildcard chars ever reach this call, so a plain concatenation is safe.
+                .prepare("SELECT surface_key, token, generation, created_at, last_wake_at, turn_count, input_tokens_total, first_wake_at, last_input_tokens, rotate_marked_at, served_code_fingerprint, served_domain_fingerprint FROM channel_session WHERE org_id = ? AND surface_key LIKE ?")
+                .all(org, `${keyPrefix}%`));
+        return rows.map((r) => ({
+            org, surfaceKey: r.surface_key, token: r.token, generation: r.generation, createdAt: r.created_at,
+            lastWakeAt: r.last_wake_at, turnCount: r.turn_count,
+            inputTokensTotal: r.input_tokens_total == null ? null : Number(r.input_tokens_total),
+            firstWakeAt: r.first_wake_at ?? null,
+            lastInputTokens: r.last_input_tokens == null ? null : Number(r.last_input_tokens),
+            rotateMarkedAt: r.rotate_marked_at ?? null,
+            servedCodeFingerprint: r.served_code_fingerprint ?? null,
+            servedDomainFingerprint: r.served_domain_fingerprint ?? null,
+        }));
+    },
+    // The tail ring is bounded ON WRITE, in the same statement batch as the insert. A ring pruned by a sweep has a window where a hot generation is unbounded, and this table takes a write on every wake and every post.
+    async appendSessionTail(org, surfaceKey, token, entry) {
+        const handle = getDb();
+        const next = handle
+            .prepare("SELECT COALESCE(MAX(seq), 0) + 1 AS seq FROM session_tail WHERE org_id = ? AND surface_key = ? AND token = ?")
+            .get(org, surfaceKey, token);
+        handle
+            .prepare("INSERT INTO session_tail (org_id, surface_key, token, seq, at, entry_json) VALUES (?, ?, ?, ?, ?, ?)")
+            .run(org, surfaceKey, token, next.seq, entry.at, JSON.stringify(entry));
+        handle
+            .prepare(`DELETE FROM session_tail
+          WHERE org_id = ? AND surface_key = ? AND token = ?
+            AND seq <= ?`)
+            .run(org, surfaceKey, token, next.seq - SESSION_TAIL_MAX_ENTRIES);
+    },
+    async readSessionTail(org, surfaceKey, token) {
+        const rows = getDb()
+            .prepare("SELECT entry_json FROM session_tail WHERE org_id = ? AND surface_key = ? AND token = ? ORDER BY seq ASC")
+            .all(org, surfaceKey, token);
+        // A row whose JSON no longer parses is DROPPED, not thrown on: this feeds a wake, and one bad
+        // row must never cost the whole tail. There is no schema version to negotiate — the entry is
+        // written and read by the same deployment within one generation's lifetime.
+        const out = [];
+        for (const r of rows) {
+            try {
+                out.push(JSON.parse(r.entry_json));
+            }
+            catch {
+                /* unreadable entry — skip it, keep the rest of the tail */
+            }
+        }
+        return out;
+    },
+    async clearSessionTail(org, surfaceKey, token) {
+        getDb().prepare("DELETE FROM session_tail WHERE org_id = ? AND surface_key = ? AND token = ?").run(org, surfaceKey, token);
+    },
+    // The ring's only mutation: rewrite ONE post row's text after edit_reply's platform-confirmed success.
+    // The match runs in JS on the parsed rows because entry_json is opaque to this store, and the post-kind test guards a wake row carrying the same platform message id.
+    async editSessionTailPost(org, surfaceKey, token, messageId, text) {
+        const rows = getDb()
+            .prepare("SELECT seq, entry_json FROM session_tail WHERE org_id = ? AND surface_key = ? AND token = ? ORDER BY seq DESC")
+            .all(org, surfaceKey, token);
+        for (const r of rows) {
+            let entry;
+            try {
+                entry = JSON.parse(r.entry_json);
+            }
+            catch {
+                continue; // an unreadable row can't be the match — readSessionTail drops it too
+            }
+            if (entry.kind !== "post" || entry.id !== messageId)
+                continue;
+            const updated = { ...entry, text };
+            getDb()
+                .prepare("UPDATE session_tail SET entry_json = ? WHERE org_id = ? AND surface_key = ? AND token = ? AND seq = ?")
+                .run(JSON.stringify(updated), org, surfaceKey, token, r.seq);
+            return true;
+        }
+        return false;
+    },
+    async listDomainSkills(org, domain) {
+        const rows = getDb()
+            .prepare("SELECT name, content, updated_by, updated_at FROM domain_skill WHERE org_id = ? AND domain = ? ORDER BY name")
+            .all(org, domain);
+        return rows.map((r) => ({
+            org,
+            domain,
+            name: r.name,
+            content: r.content,
+            ...(r.updated_by ? { updatedBy: r.updated_by } : {}),
+            updatedAt: r.updated_at,
+        }));
+    },
+    async putDomainSkill(org, domain, name, content, updatedBy, updatedAt, provenance) {
+        // REVISION FIRST, then the destructive upsert — same reasoning as the Postgres adapter:
+        // if the two tear, over-record (an extra revision for a body that failed to arm) rather
+        // than under-record (a live body with no record of what an approver agreed to).
+        getDb()
+            .prepare(`INSERT INTO domain_skill_revisions (org_id, domain, name, content, authored_by, armed_by, approval_id, recorded_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(org, domain, name, content, updatedBy ?? null, provenance?.armedBy ?? null, provenance?.approvalId ?? null, updatedAt);
+        getDb()
+            .prepare(`INSERT INTO domain_skill (org_id, domain, name, content, updated_by, updated_at) VALUES (?, ?, ?, ?, ?, ?)
+         ON CONFLICT(org_id, domain, name) DO UPDATE SET
+           content    = excluded.content,
+           updated_by = excluded.updated_by,
+           updated_at = excluded.updated_at`)
+            .run(org, domain, name, content, updatedBy ?? null, updatedAt);
+    },
+    async deleteDomainSkill(org, domain, name) {
+        return getDb().prepare("DELETE FROM domain_skill WHERE org_id = ? AND domain = ? AND name = ?").run(org, domain, name).changes > 0;
+    },
+    async listDomainSkillRevisions(org, domain, name) {
+        const rows = getDb()
+            .prepare(`SELECT seq, name, content, authored_by, armed_by, approval_id, recorded_at
+         FROM domain_skill_revisions
+         WHERE org_id = ? AND domain = ? AND (? IS NULL OR name = ?)
+         ORDER BY seq`)
+            .all(org, domain, name ?? null, name ?? null);
+        return rows.map((r) => ({
+            seq: Number(r.seq),
+            org,
+            domain,
+            name: r.name,
+            content: r.content,
+            ...(r.authored_by ? { authoredBy: r.authored_by } : {}),
+            ...(r.armed_by ? { armedBy: r.armed_by } : {}),
+            ...(r.approval_id ? { approvalId: r.approval_id } : {}),
+            recordedAt: r.recorded_at,
+        }));
+    },
+    async appendUsageEvent(entry) {
+        getDb()
+            .prepare(`INSERT INTO usage_events
+           (org_id, surface_key, session_id, principal_id, ts, kind, routine_id,
+            input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, model, detail,
+            usd_micros_measured, cost_source, delegation_depth, root_session_id,
+            cache_tokens_reported, reasoning_tokens, surface_mode)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(entry.org, entry.surfaceKey, entry.sessionId, entry.principalId ?? null, entry.ts, entry.kind ?? null, entry.routineId ?? null, entry.inputTokens, entry.outputTokens, entry.cacheReadTokens, entry.cacheWriteTokens, entry.model ?? null, entry.detail ? JSON.stringify(entry.detail) : null, 
+        // `?? null` on all four, never `?? 0`/`?? ''`: a NULL says "this writer had nothing to
+        // report", which is a different fact from a measured zero or a root turn's depth 0.
+        entry.usdMicrosMeasured ?? null, entry.costSource ?? null, entry.delegationDepth ?? null, entry.rootSessionId ?? null, 
+        // OPE-1611, same `?? null` discipline: NULL is "nothing was reported". node:sqlite has no
+        // boolean, so the flag stores 1/0 and reads back through the same `!= null` test.
+        entry.cacheTokensReported === undefined ? null : entry.cacheTokensReported ? 1 : 0, entry.reasoningTokens ?? null, 
+        // OPE-1862, same discipline: NULL says "no binding stamped this row", and a report masks
+        // such a row. It is never inferred from the surface id.
+        entry.surfaceMode ?? null);
+    },
+    async usageForSession(org, sessionId) {
+        const rows = getDb()
+            .prepare(`SELECT surface_key, session_id, principal_id, ts, kind, routine_id,
+                input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, model, detail,
+                usd_micros_measured, cost_source, delegation_depth, root_session_id,
+                cache_tokens_reported, reasoning_tokens, surface_mode
+         FROM usage_events WHERE org_id = ? AND session_id = ? ORDER BY seq ASC`)
+            .all(org, sessionId);
+        return rows.map((r) => usageEventFromRow(org, r));
+    },
+    async usageSummary(org, filter = {}) {
+        const where = ["org_id = ?"];
+        const params = [org];
+        if (filter.surfaceKeyPrefix !== undefined) {
+            where.push("surface_key LIKE ?");
+            params.push(`${filter.surfaceKeyPrefix}%`);
+        }
+        if (filter.sinceTs !== undefined) {
+            where.push("ts >= ?");
+            params.push(filter.sinceTs);
+        }
+        if (filter.untilTs !== undefined) {
+            where.push("ts <= ?");
+            params.push(filter.untilTs);
+        }
+        // OPE-402: exclude rows whose session had ANY recorded usage event before the bound — the
+        // session-scoped half of the leak sinceTs alone cannot close (see UsageSummaryFilter's doc).
+        // Rides the existing (org_id, session_id) index (usage_events_org_session).
+        if (filter.sessionStartedAfter !== undefined) {
+            where.push("session_id IN (SELECT session_id FROM usage_events WHERE org_id = ? GROUP BY session_id HAVING MIN(ts) >= ?)");
+            params.push(org, filter.sessionStartedAfter);
+        }
+        const rows = getDb()
+            .prepare(`SELECT surface_key, principal_id, kind, routine_id, model, surface_mode,
+                SUM(input_tokens) AS input_tokens, SUM(output_tokens) AS output_tokens,
+                SUM(cache_read_tokens) AS cache_read_tokens, SUM(cache_write_tokens) AS cache_write_tokens,
+                -- OPE-1611: the attribution dimension AND its coverage. COALESCE keeps the sum an
+                -- integer when every row is NULL; the two counts say how many calls actually
+                -- reported, so a reader never mistakes an all-NULL group's 0 for "no caching".
+                -- (sqlite has no FILTER clause here, so the flag count is a SUM over 1/0.)
+                COALESCE(SUM(reasoning_tokens), 0) AS reasoning_tokens,
+                COALESCE(SUM(CASE WHEN cache_tokens_reported = 1 THEN 1 ELSE 0 END), 0) AS cache_reported_calls,
+                COUNT(reasoning_tokens) AS reasoning_reported_calls,
+                COUNT(*) AS events, COUNT(DISTINCT session_id) AS sessions
+         FROM usage_events WHERE ${where.join(" AND ")}
+         -- OPE-1862: surface_mode joins the GRAIN rather than riding along as MAX(). A group must
+         -- be homogeneous in every column it reports, and one surface can hold both unstamped
+         -- legacy rows and stamped new ones; those two masks differently, so they must not blend.
+         GROUP BY surface_key, principal_id, kind, routine_id, model, surface_mode`)
+            .all(...params);
+        return rows.map((r) => ({
+            surfaceKey: r.surface_key,
+            ...(r.principal_id ? { principalId: r.principal_id } : {}),
+            ...(r.kind ? { kind: r.kind } : {}),
+            ...(r.routine_id ? { routineId: r.routine_id } : {}),
+            ...(r.model ? { model: r.model } : {}),
+            ...(() => {
+                const mode = asSurfaceMode(r.surface_mode);
+                return mode ? { surfaceMode: mode } : {};
+            })(),
+            inputTokens: r.input_tokens,
+            outputTokens: r.output_tokens,
+            cacheReadTokens: r.cache_read_tokens,
+            cacheWriteTokens: r.cache_write_tokens,
+            reasoningTokens: r.reasoning_tokens,
+            cacheReportedCalls: r.cache_reported_calls,
+            reasoningReportedCalls: r.reasoning_reported_calls,
+            events: r.events,
+            sessions: r.sessions,
+        }));
+    },
+    async pruneUsageEvents(org, olderThanTs) {
+        // node:sqlite types `changes` as `number | bigint`; this DB never runs with
+        // BigInt result mode, but the type needs a plain Number() to satisfy the
+        // Promise<number> contract.
+        return Number(getDb().prepare("DELETE FROM usage_events WHERE org_id = ? AND ts < ?").run(org, olderThanTs).changes);
+    },
+    async appendModelCallCapture(write) {
+        getDb()
+            .prepare(`INSERT INTO model_call_capture
+           (org_id, surface_key, session_id, turn_id, step_index, ts, model, provider,
+            schema_version, sha256, body_bytes, body_gzip_b64, truncated)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(write.org, write.surfaceKey, write.sessionId, write.turnId, write.stepIndex, write.ts, write.model, write.provider, write.schemaVersion, write.sha256, write.bodyBytes, write.bodyGzipB64, write.truncated ? 1 : 0);
+    },
+    async modelCallCapturesForSession(org, sessionId, opts = {}) {
+        const includeBody = opts.includeBody !== false;
+        // The body column is selected only when asked for. A metadata read of a 200-row soak session
+        // otherwise drags tens of MB of prompt bytes through the process for a count.
+        const bodyCol = includeBody ? "body_gzip_b64" : "'' AS body_gzip_b64";
+        const where = ["org_id = ?", "session_id = ?"];
+        const params = [org, sessionId];
+        if (opts.turnId !== undefined) {
+            where.push("turn_id = ?");
+            params.push(opts.turnId);
+        }
+        const limit = opts.limit !== undefined ? ` LIMIT ${Math.max(0, Math.floor(opts.limit))}` : "";
+        const rows = getDb()
+            .prepare(`SELECT seq, surface_key, session_id, turn_id, step_index, ts, model, provider,
+                schema_version, sha256, body_bytes, ${bodyCol}, truncated
+         FROM model_call_capture WHERE ${where.join(" AND ")} ORDER BY seq ASC${limit}`)
+            .all(...params);
+        return rows.map((r) => modelCallCaptureFromRow(org, r));
+    },
+    async modelCallCaptureSessions(org) {
+        const rows = getDb()
+            .prepare(`SELECT session_id, MIN(ts) AS first_ts, MAX(ts) AS last_ts, COUNT(*) AS row_count, SUM(body_bytes) AS total_bytes
+         FROM model_call_capture WHERE org_id = ?
+         GROUP BY session_id
+         ORDER BY MAX(ts) DESC`)
+            .all(org);
+        return rows.map((r) => ({
+            sessionId: r.session_id,
+            firstTs: r.first_ts,
+            lastTs: r.last_ts,
+            rowCount: Number(r.row_count),
+            totalBytes: Number(r.total_bytes ?? 0),
+        }));
+    },
+    async deleteModelCallCapturesForSession(org, sessionId) {
+        return Number(getDb().prepare("DELETE FROM model_call_capture WHERE org_id = ? AND session_id = ?").run(org, sessionId).changes);
+    },
+    async addMemoryProposal(write) {
+        const result = getDb()
+            .prepare(`INSERT INTO memory_proposal (org_id, kind, scope, summary, before_text, after_text, detail_json, principal_id, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(write.org, write.kind, write.scope, write.summary, write.before ?? null, write.after ?? null, write.detail ? JSON.stringify(write.detail) : null, write.principalId, write.createdAt);
+        return { ...write, id: Number(result.lastInsertRowid) };
+    },
+    async listMemoryProposals(org) {
+        const rows = getDb()
+            .prepare(`SELECT id, kind, scope, summary, before_text, after_text, detail_json, principal_id, created_at
+         FROM memory_proposal WHERE org_id = ? ORDER BY id DESC`)
+            .all(org);
+        return rows.map((r) => ({
+            id: r.id,
+            org,
+            kind: r.kind,
+            scope: r.scope,
+            summary: r.summary,
+            ...(r.before_text !== null ? { before: r.before_text } : {}),
+            ...(r.after_text !== null ? { after: r.after_text } : {}),
+            ...(r.detail_json ? { detail: JSON.parse(r.detail_json) } : {}),
+            principalId: r.principal_id,
+            createdAt: r.created_at,
+        }));
+    },
+    async getDmAudience(org, address) {
+        const row = getDb()
+            .prepare("SELECT address, first_dm_at, stopped_at FROM dm_audience WHERE org_id = ? AND address = ?")
+            .get(org, address);
+        return row ? dmAudienceRowFrom(row) : null;
+    },
+    async markDmAudienceDelivered(org, address, at) {
+        // COALESCE keeps the ORIGINAL first_dm_at — see store.ts's method doc. `stopped_at` is not in the
+        // update list at all, so a delivery can never clear a stop even if a caller raced one.
+        getDb()
+            .prepare(`INSERT INTO dm_audience (org_id, address, first_dm_at, stopped_at) VALUES (?, ?, ?, NULL)
+         ON CONFLICT (org_id, address) DO UPDATE SET first_dm_at = COALESCE(dm_audience.first_dm_at, excluded.first_dm_at)`)
+            .run(org, address, at);
+    },
+    async setDmAudienceStopped(org, address, at) {
+        // COALESCE for the same reason as above, in the other direction: a second stop keeps the FIRST
+        // stopped_at, so the trail records when the boundary was first drawn rather than last repeated.
+        getDb()
+            .prepare(`INSERT INTO dm_audience (org_id, address, first_dm_at, stopped_at) VALUES (?, ?, NULL, ?)
+         ON CONFLICT (org_id, address) DO UPDATE SET stopped_at = COALESCE(dm_audience.stopped_at, excluded.stopped_at)`)
+            .run(org, address, at);
+    },
+    async clearDmAudienceStopped(org, address) {
+        // The `stopped_at IS NOT NULL` conjunct is what makes the return value honest: `changes` counts
+        // rows the UPDATE actually altered, so a row that was never stopped answers false rather than
+        // reporting a resume that resumed nothing.
+        return (getDb()
+            .prepare("UPDATE dm_audience SET stopped_at = NULL WHERE org_id = ? AND address = ? AND stopped_at IS NOT NULL")
+            .run(org, address).changes > 0);
+    },
+    async listDmAudience(org) {
+        const rows = getDb()
+            .prepare("SELECT address, first_dm_at, stopped_at FROM dm_audience WHERE org_id = ? ORDER BY address")
+            .all(org);
+        return rows.map(dmAudienceRowFrom);
+    },
+    async runAnalyticsQuery(compiled) {
+        // OPE-66: assemble the SELECT-only statement with `?` placeholders (the SQLite style) and run it.
+        // Every non-param token is registry-derived; only `params` bind. node:sqlite returns bigints as
+        // JS numbers here (no BigInt result mode), so the plain objects need no coercion at this layer.
+        const { sql, params } = assembleAnalyticsSql(compiled, "qmark");
+        return getDb().prepare(sql).all(...params);
+    },
+    async enqueueIngressDelivery(org, write) {
+        const handle = getDb();
+        // Completed rows contain no payload and exist only to suppress a vendor replay. Prune them on
+        // the next enqueue for this org/source; pending rows carry NULL and are never clock-expired.
+        handle
+            .prepare("DELETE FROM ingress_delivery WHERE org_id = ? AND source = ? AND completed_at IS NOT NULL AND retain_until IS NOT NULL AND retain_until <= ?")
+            .run(org, write.source, write.receivedAt);
+        const info = handle
+            .prepare(`INSERT OR IGNORE INTO ingress_delivery
+           (org_id, source, authority_id, delivery_id, payload_json, received_at, available_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`)
+            .run(org, write.source, write.authorityId, write.deliveryId, write.payloadJson, write.receivedAt, write.receivedAt);
+        return info.changes > 0;
+    },
+    async listDueIngressDeliveries(org, source, nowIso, staleBeforeIso, limit) {
+        const rows = getDb()
+            .prepare(`SELECT authority_id, delivery_id, received_at, available_at
+           FROM ingress_delivery
+          WHERE org_id = ? AND source = ? AND completed_at IS NULL AND payload_json IS NOT NULL
+            AND available_at <= ?
+            AND (claim_id IS NULL OR (claimed_at IS NOT NULL AND claimed_at <= ?))
+          ORDER BY received_at ASC, authority_id ASC, delivery_id ASC
+          LIMIT ?`)
+            .all(org, source, nowIso, staleBeforeIso, Math.max(0, Math.trunc(limit)));
+        return rows.map((row) => ({
+            source,
+            authorityId: row.authority_id,
+            deliveryId: row.delivery_id,
+            receivedAt: row.received_at,
+            availableAt: row.available_at,
+        }));
+    },
+    async claimIngressDelivery(org, key, claimId, claimedAtIso, staleBeforeIso) {
+        const row = getDb()
+            .prepare(`UPDATE ingress_delivery SET claim_id = ?, claimed_at = ?
+          WHERE org_id = ? AND source = ? AND authority_id = ? AND delivery_id = ?
+            AND completed_at IS NULL AND payload_json IS NOT NULL AND available_at <= ?
+            AND (claim_id IS NULL OR (claimed_at IS NOT NULL AND claimed_at <= ?))
+        RETURNING payload_json, received_at, available_at`)
+            .get(claimId, claimedAtIso, org, key.source, key.authorityId, key.deliveryId, claimedAtIso, staleBeforeIso);
+        return row
+            ? {
+                ...key,
+                payloadJson: row.payload_json,
+                receivedAt: row.received_at,
+                availableAt: row.available_at,
+                claimId,
+                claimedAt: claimedAtIso,
+            }
+            : null;
+    },
+    async releaseIngressDelivery(org, key, claimId, availableAtIso) {
+        const info = getDb()
+            .prepare(`UPDATE ingress_delivery SET claim_id = NULL, claimed_at = NULL, available_at = ?
+          WHERE org_id = ? AND source = ? AND authority_id = ? AND delivery_id = ?
+            AND completed_at IS NULL AND claim_id = ?`)
+            .run(availableAtIso, org, key.source, key.authorityId, key.deliveryId, claimId);
+        return info.changes > 0;
+    },
+    async completeIngressDelivery(org, key, claimId, completedAtIso, retainUntilIso) {
+        assertIngressDeliveryRetainUntil(completedAtIso, retainUntilIso);
+        const info = getDb()
+            .prepare(`UPDATE ingress_delivery
+            SET payload_json = NULL, claim_id = NULL, claimed_at = NULL,
+                completed_at = ?, retain_until = ?
+          WHERE org_id = ? AND source = ? AND authority_id = ? AND delivery_id = ?
+            AND completed_at IS NULL AND claim_id = ?`)
+            .run(completedAtIso, retainUntilIso, org, key.source, key.authorityId, key.deliveryId, claimId);
+        return info.changes > 0;
+    },
+    async discardIngressDelivery(org, key, claimId) {
+        const info = getDb()
+            .prepare(`DELETE FROM ingress_delivery
+          WHERE org_id = ? AND source = ? AND authority_id = ? AND delivery_id = ?
+            AND completed_at IS NULL AND claim_id = ?`)
+            .run(org, key.source, key.authorityId, key.deliveryId, claimId);
+        return info.changes > 0;
+    },
+    async markEventSeen(org, key, at, ttlMs) {
+        const handle = getDb();
+        // Opportunistic prune keeps the table bounded without a scheduled job; ISO timestamps compare
+        // lexicographically so string < works. TWO clauses, both ORG-SCOPED (see store.ts):
+        //   • the caller's `ttlMs`, applied to THIS KEY ONLY — the table is shared by callers whose
+        //     windows differ by an order of magnitude (60 s postOnce vs 10 min Slack retry dedupe), so
+        //     a bare TTL sweep let the shortest-TTL caller expire everyone else's keys;
+        //   • a fixed 24 h housekeeping ceiling for everything else this org wrote.
+        const atMs = Date.parse(at);
+        const ttlCutoff = new Date(atMs - ttlMs).toISOString();
+        const maxCutoff = new Date(atMs - EVENT_DEDUPE_MAX_RETENTION_MS).toISOString();
+        handle
+            .prepare("DELETE FROM event_dedupe WHERE org_id = ? AND (seen_at < ? OR (key = ? AND seen_at < ?))")
+            .run(org, maxCutoff, key, ttlCutoff);
+        // INSERT OR IGNORE is the atomic first-sighting check: exactly one of two
+        // racing inserts lands (changes=1); the loser sees changes=0 → duplicate.
+        const info = handle.prepare("INSERT OR IGNORE INTO event_dedupe (org_id, key, seen_at) VALUES (?, ?, ?)").run(org, key, at);
+        return info.changes > 0;
+    },
+    async claimNotice(org, key, at) {
+        // INSERT OR IGNORE is the atomic claim, exactly as markEventSeen's is: one of two racing callers
+        // lands the row (changes=1) and announces; the loser sees changes=0 and stays quiet.
+        // NO DELETE PATH — a claim is a lifetime record, and dropping one lets the thing it records
+        // happen a second time. Every key space on this table is bounded by the thing it records.
+        const info = getDb().prepare("INSERT OR IGNORE INTO notice_claim (org_id, key, claimed_at) VALUES (?, ?, ?)").run(org, key, at);
+        return info.changes > 0;
+    },
+    async noticeClaimed(org, key) {
+        const row = getDb().prepare("SELECT 1 FROM notice_claim WHERE org_id = ? AND key = ? LIMIT 1").get(org, key);
+        return row !== undefined;
+    },
+    async recordProactiveAddress(org, row) {
+        getDb()
+            .prepare(`INSERT INTO proactive_address (org_id, platform, kind, ref_key, tenant, address, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT(org_id, platform, kind, ref_key) DO UPDATE SET
+           tenant = excluded.tenant, address = excluded.address, updated_at = excluded.updated_at`)
+            .run(org, row.platform, row.kind, row.refKey, row.tenant, JSON.stringify(row.address ?? {}), row.updatedAt);
+    },
+    async proactiveAddress(org, platform, kind, refKey) {
+        const row = getDb()
+            .prepare("SELECT tenant, address, updated_at FROM proactive_address WHERE org_id = ? AND platform = ? AND kind = ? AND ref_key = ?")
+            .get(org, platform, kind, refKey);
+        return row ? proactiveAddressRow(platform, kind, refKey, row.tenant, row.address, row.updated_at) : undefined;
+    },
+    async proactiveAddresses(org, platform, kind, limit) {
+        const rows = getDb()
+            .prepare(`SELECT ref_key, tenant, address, updated_at FROM proactive_address
+         WHERE org_id = ? AND platform = ? AND kind = ? ORDER BY updated_at DESC LIMIT ?`)
+            .all(org, platform, kind, Math.max(0, Math.trunc(limit)));
+        return rows.map((r) => proactiveAddressRow(platform, kind, r.ref_key, r.tenant, r.address, r.updated_at));
+    },
+    async hasEventSeen(org, key, at, ttlMs) {
+        // READ-ONLY twin of markEventSeen: same cutoff arithmetic, no write, no prune. A caller uses
+        // this to check "is this already marked" before deciding whether marking is even safe.
+        const cutoff = new Date(Date.parse(at) - ttlMs).toISOString();
+        const row = getDb()
+            .prepare("SELECT 1 FROM event_dedupe WHERE org_id = ? AND key = ? AND seen_at >= ? LIMIT 1")
+            .get(org, key, cutoff);
+        return row !== undefined;
+    },
+    async forgetEventSeen(org, key) {
+        // ONE row, org-scoped and keyed — never a sweep. See the interface note for when a claim is
+        // given back (OPE-821: a DEFINITIVE post failure, so an identical retry can really post).
+        getDb().prepare("DELETE FROM event_dedupe WHERE org_id = ? AND key = ?").run(org, key);
+    },
+    async captureDelivery(org, source, documentJson, at, captureUntil, maxRows) {
+        const handle = getDb();
+        const atMs = Date.parse(at);
+        // A NON-PARSEABLE `at` FAILS CLOSED. Every other TTL-pruned table in this file derives a cutoff
+        // from `Date.parse(at)` and would compute `Invalid Date` on a bad stamp; here that would mean a
+        // sweep that deletes nothing while the insert still lands, i.e. the one table whose bound must
+        // hold silently losing it. Refusing to capture costs a sample.
+        if (!Number.isFinite(atMs))
+            return false;
+        // BOUND 1 — the absolute age sweep, ORG-SCOPED, and FIRST so it runs even on a write the window
+        // is about to refuse. This is the bound that holds when the other two are wrong.
+        const maxCutoff = new Date(atMs - CAPTURE_MAX_RETENTION_MS).toISOString();
+        handle.prepare("DELETE FROM webhook_capture WHERE org_id = ? AND captured_at < ?").run(org, maxCutoff);
+        // BOUND 2 — the window closed on TIME. Compared as instants, not as strings: `captureUntil` is
+        // minted by the arming path and a lexicographic comparison would quietly do the wrong thing on
+        // any stamp that is not Z-normalised.
+        const untilMs = Date.parse(captureUntil);
+        if (!Number.isFinite(untilMs) || atMs >= untilMs)
+            return false;
+        // BOUND 3 — the window closed on VOLUME. The row count IS the counter, so there is no separate
+        // tally that can drift from the rows it claims to count.
+        const row = handle
+            .prepare("SELECT COUNT(*) AS n, COALESCE(MAX(seq), 0) AS maxSeq FROM webhook_capture WHERE org_id = ? AND source = ?")
+            .get(org, source);
+        if (row.n >= maxRows)
+            return false;
+        handle
+            .prepare("INSERT INTO webhook_capture (org_id, source, seq, captured_at, document) VALUES (?, ?, ?, ?, ?)")
+            .run(org, source, row.maxSeq + 1, at, documentJson);
+        return true;
+    },
+    async listCapturedDeliveries(org, source, limit) {
+        const rows = getDb()
+            .prepare("SELECT seq, captured_at, document FROM webhook_capture WHERE org_id = ? AND source = ? ORDER BY seq ASC LIMIT ?")
+            .all(org, source, limit);
+        return rows.map((r) => ({ seq: r.seq, capturedAt: r.captured_at, documentJson: r.document }));
+    },
+    async clearCapturedDeliveries(org, source) {
+        getDb().prepare("DELETE FROM webhook_capture WHERE org_id = ? AND source = ?").run(org, source);
+    },
+    async putUnifiedWakeTarget(org, wakeId, targetJson, at, ttlMs, windowToken, inbound) {
+        const handle = getDb();
+        // Opportunistic TTL prune, same posture as markEventSeen (bounded table, no scheduled job).
+        // ORG-SCOPED (matches the postgres backend): one org's write never touches another org's rows.
+        const cutoff = new Date(Date.parse(at) - ttlMs).toISOString();
+        handle.prepare("DELETE FROM unified_wake_target WHERE created_at < ? AND org_id = ?").run(cutoff, org);
+        handle
+            .prepare(
+        // 🔴 The conflict clause updates target_json/created_at/window_token and NEVER the answered
+        // columns — a redrive/webhook-retry re-register must not clear (or resurrect) a mark.
+        // 🔴 `inbound` is STICKY-TRUE (MAX over the two sides), unlike every other updated column:
+        // the redrive re-registers an EXISTING wake id as an INTERNAL dispatch, and a plain
+        // overwrite would clear the flag on a row a human's message created.
+        `INSERT INTO unified_wake_target (org_id, wake_id, target_json, created_at, window_token, inbound) VALUES (?, ?, ?, ?, ?, ?)
+         ON CONFLICT (org_id, wake_id) DO UPDATE SET target_json = excluded.target_json, created_at = excluded.created_at, window_token = excluded.window_token,
+           inbound = MAX(COALESCE(excluded.inbound, 0), COALESCE(unified_wake_target.inbound, 0))`)
+            .run(org, wakeId, targetJson, at, windowToken ?? null, inbound === true ? 1 : 0);
+    },
+    async getUnifiedWakeTarget(org, wakeId) {
+        const row = getDb().prepare("SELECT target_json FROM unified_wake_target WHERE org_id = ? AND wake_id = ?").get(org, wakeId);
+        return row?.target_json ?? null;
+    },
+    async getUnifiedWakeRecord(org, wakeId) {
+        const row = getDb()
+            .prepare("SELECT target_json, created_at, window_token, answered_at, answered_turn_id, audited_at, inbound FROM unified_wake_target WHERE org_id = ? AND wake_id = ?")
+            .get(org, wakeId);
+        if (!row)
+            return null;
+        return {
+            targetJson: row.target_json,
+            createdAt: row.created_at,
+            ...(row.window_token !== null ? { windowToken: row.window_token } : {}),
+            ...(row.answered_at !== null ? { answeredAt: row.answered_at } : {}),
+            ...(row.answered_turn_id !== null ? { answeredTurnId: row.answered_turn_id } : {}),
+            ...(row.audited_at !== null ? { auditedAt: row.audited_at } : {}),
+            // A NULL column is a legacy row, and it stays ABSENT rather than becoming `false` — the two say
+            // different things, and every reader treats absent as attended (OPE-2051).
+            ...(row.inbound !== null ? { inbound: row.inbound === 1 } : {}),
+        };
+    },
+    async listPendingUnifiedWakes(org, windowToken, afterIso, limit) {
+        // ORDER BY created_at ASC: the gate reports the OLDEST unseen messages first, which is the order
+        // a reader would meet them in. `answered_at IS NULL` is the whole "pending" definition — the same
+        // column the answerable-reply fence reads, so the two can never disagree about what pending means.
+        const rows = getDb()
+            .prepare(`SELECT wake_id, target_json, created_at FROM unified_wake_target
+         WHERE org_id = ? AND window_token = ? AND answered_at IS NULL AND inbound = 1 AND created_at > ?
+         ORDER BY created_at ASC LIMIT ?`)
+            .all(org, windowToken, afterIso, limit);
+        return rows.map((r) => ({ wakeId: r.wake_id, targetJson: r.target_json, createdAt: r.created_at }));
+    },
+    async listUnauditedUnifiedWakes(org, windowToken, limit) {
+        // Same pending definition as the listing above, plus the OPE-836 horizon (`audited_at IS NULL`)
+        // and NO time bound below — a row an earlier turn considered is already excluded by the column.
+        // The filter is in SQL so `limit` bounds the rows still to consider, never a backlog of audited
+        // ones. This query is the accounting audit's alone; the freshness gate's own SQL is untouched.
+        const rows = getDb()
+            .prepare(`SELECT wake_id, target_json, created_at FROM unified_wake_target
+         WHERE org_id = ? AND window_token = ? AND answered_at IS NULL AND inbound = 1 AND audited_at IS NULL
+         ORDER BY created_at ASC LIMIT ?`)
+            .all(org, windowToken, limit);
+        return rows.map((r) => ({ wakeId: r.wake_id, targetJson: r.target_json, createdAt: r.created_at }));
+    },
+    async markUnifiedWakesAudited(org, wakeIds, at) {
+        // UPDATE-only and FIRST-STAMP-WINS (`audited_at IS NULL`), so a re-run cannot move the horizon
+        // stamp and a missing row inserts nothing. One statement per id keeps the parameter count fixed
+        // (node:sqlite has no array binding); the caller's own cap bounds the list.
+        if (wakeIds.length === 0)
+            return;
+        const stmt = getDb().prepare("UPDATE unified_wake_target SET audited_at = ? WHERE org_id = ? AND wake_id = ? AND audited_at IS NULL");
+        for (const wakeId of wakeIds)
+            stmt.run(at, org, wakeId);
+    },
+    async markUnifiedWakeAnswered(org, wakeId, at, turnId) {
+        // UPDATE-only (never an upsert): an answered mark on a row with no origin is meaningless, and
+        // inserting one would create a phantom the resolver would then have to reject.
+        getDb()
+            .prepare("UPDATE unified_wake_target SET answered_at = ?, answered_turn_id = ? WHERE org_id = ? AND wake_id = ?")
+            .run(at, turnId ?? null, org, wakeId);
+    },
+    async putThreadOwner(org, channelKey, threadKey, taskToken, at, ttlMs) {
+        const handle = getDb();
+        // Opportunistic ORG-SCOPED TTL prune (bounded table, no scheduled job), same posture as
+        // putUnifiedWakeTarget — a backstop over the explicit clears (complete_thread / generation GC).
+        const cutoff = new Date(Date.parse(at) - ttlMs).toISOString();
+        handle.prepare("DELETE FROM thread_ownership WHERE created_at < ? AND org_id = ?").run(cutoff, org);
+        handle
+            .prepare(`INSERT INTO thread_ownership (org_id, channel_key, thread_key, task_token, created_at) VALUES (?, ?, ?, ?, ?)
+         ON CONFLICT (org_id, channel_key, thread_key) DO UPDATE SET task_token = excluded.task_token, created_at = excluded.created_at`)
+            .run(org, channelKey, threadKey, taskToken, at);
+    },
+    async getThreadOwner(org, channelKey, threadKey) {
+        const row = getDb().prepare("SELECT task_token FROM thread_ownership WHERE org_id = ? AND channel_key = ? AND thread_key = ?").get(org, channelKey, threadKey);
+        return row?.task_token ?? null;
+    },
+    async clearThreadOwner(org, channelKey, threadKey) {
+        return getDb().prepare("DELETE FROM thread_ownership WHERE org_id = ? AND channel_key = ? AND thread_key = ?").run(org, channelKey, threadKey).changes > 0;
+    },
+    async putThreadSeatState(org, row, at, ttlMs) {
+        const handle = getDb();
+        // Opportunistic ORG-SCOPED TTL prune, the same posture as putThreadOwner beside it.
+        const cutoff = new Date(Date.parse(at) - ttlMs).toISOString();
+        handle.prepare("DELETE FROM thread_seat_state WHERE updated_at < ? AND org_id = ?").run(cutoff, org);
+        handle
+            .prepare(`INSERT INTO thread_seat_state (org_id, channel_key, thread_key, seat_token, parent_key, state, origin_json, report, opened_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (org_id, channel_key, thread_key) DO UPDATE SET
+           seat_token = excluded.seat_token,
+           parent_key = excluded.parent_key,
+           state = excluded.state,
+           origin_json = excluded.origin_json,
+           report = excluded.report,
+           opened_at = excluded.opened_at,
+           updated_at = excluded.updated_at`)
+            .run(org, row.channelKey, row.threadKey, row.seatToken, row.parentRegistryKey, row.state, row.originJson, row.report ?? null, row.openedAt, at);
+    },
+    async getThreadSeatState(org, channelKey, threadKey) {
+        const row = getDb()
+            .prepare("SELECT seat_token, parent_key, state, origin_json, report, opened_at, updated_at FROM thread_seat_state WHERE org_id = ? AND channel_key = ? AND thread_key = ?")
+            .get(org, channelKey, threadKey);
+        if (!row)
+            return null;
+        return {
+            channelKey,
+            threadKey,
+            seatToken: row.seat_token,
+            parentRegistryKey: row.parent_key,
+            // Anything but the two written values reads as `completed`: an unreadable state must never
+            // report a seat as LIVE, which is the direction that would send a steer into a dead session.
+            state: row.state === "open" ? "open" : "completed",
+            originJson: row.origin_json,
+            ...(row.report !== null ? { report: row.report } : {}),
+            openedAt: row.opened_at,
+            updatedAt: row.updated_at,
+        };
+    },
+    async putTurnAnchor(org, anchor, at, ttlMs) {
+        const handle = getDb();
+        // Opportunistic ORG-SCOPED TTL prune (bounded table, no scheduled job) — a BACKSTOP over the
+        // explicit clear the turn-end hook does, exactly like putThreadOwner's.
+        const cutoff = new Date(Date.parse(at) - ttlMs).toISOString();
+        handle.prepare("DELETE FROM turn_anchor WHERE created_at < ? AND org_id = ?").run(cutoff, org);
+        handle
+            .prepare(`INSERT INTO turn_anchor (org_id, window_key, anchor_key, channel_key, session_id, turn_id, surface_key, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (org_id, window_key) DO UPDATE SET
+           anchor_key = excluded.anchor_key, channel_key = excluded.channel_key,
+           session_id = excluded.session_id, turn_id = excluded.turn_id,
+           surface_key = excluded.surface_key, created_at = excluded.created_at`)
+            .run(org, anchor.windowKey, anchor.anchorKey ?? null, anchor.channelKey ?? null, anchor.sessionId, anchor.turnId, anchor.surfaceKey, at);
+    },
+    async getTurnAnchorByWindow(org, windowKey) {
+        return readTurnAnchorRow(getDb().prepare(`${TURN_ANCHOR_SELECT} WHERE org_id = ? AND window_key = ?`).get(org, windowKey));
+    },
+    async getTurnAnchorByAnchor(org, anchorKey) {
+        return readTurnAnchorRow(getDb().prepare(`${TURN_ANCHOR_SELECT} WHERE org_id = ? AND anchor_key = ?`).get(org, anchorKey));
+    },
+    async getLatestTurnAnchorForChannel(org, channelKey) {
+        return readTurnAnchorRow(getDb().prepare(`${TURN_ANCHOR_SELECT} WHERE org_id = ? AND channel_key = ? ORDER BY created_at DESC, window_key DESC LIMIT 1`).get(org, channelKey));
+    },
+    async clearTurnAnchor(org, windowKey) {
+        return getDb().prepare("DELETE FROM turn_anchor WHERE org_id = ? AND window_key = ?").run(org, windowKey).changes > 0;
+    },
+    async putTaskResult(org, taskId, resultJson, at, ttlMs) {
+        const handle = getDb();
+        // Opportunistic ORG-SCOPED TTL prune (bounded table, no scheduled job), same posture as
+        // putUnifiedWakeTarget — one org's write never touches another org's rows.
+        const cutoff = new Date(Date.parse(at) - ttlMs).toISOString();
+        handle.prepare("DELETE FROM task_result WHERE created_at < ? AND org_id = ?").run(cutoff, org);
+        handle
+            .prepare(`INSERT INTO task_result (org_id, task_id, result_json, created_at) VALUES (?, ?, ?, ?)
+         ON CONFLICT (org_id, task_id) DO UPDATE SET result_json = excluded.result_json, created_at = excluded.created_at`)
+            .run(org, taskId, resultJson, at);
+    },
+    async putTaskResultIfAbsent(org, taskId, resultJson, at, ttlMs) {
+        const handle = getDb();
+        const cutoff = new Date(Date.parse(at) - ttlMs).toISOString();
+        handle.prepare("DELETE FROM task_result WHERE created_at < ? AND org_id = ?").run(cutoff, org);
+        const info = handle
+            .prepare(`INSERT INTO task_result (org_id, task_id, result_json, created_at) VALUES (?, ?, ?, ?) ON CONFLICT (org_id, task_id) DO NOTHING`)
+            .run(org, taskId, resultJson, at);
+        return info.changes > 0;
+    },
+    async getTaskResult(org, taskId) {
+        const row = getDb().prepare("SELECT result_json FROM task_result WHERE org_id = ? AND task_id = ?").get(org, taskId);
+        return typeof row?.result_json === "string" ? row.result_json : null;
+    },
+    async deleteTaskResult(org, taskId) {
+        return getDb().prepare("DELETE FROM task_result WHERE org_id = ? AND task_id = ?").run(org, taskId).changes > 0;
+    },
+    async putSlackAttachment(org, fileId, rec, at, ttlMs) {
+        const handle = getDb();
+        // Opportunistic ORG-SCOPED TTL prune (bounded table, no scheduled job), same posture as
+        // putUnifiedWakeTarget — one org's write never touches another org's rows.
+        const cutoff = new Date(Date.parse(at) - ttlMs).toISOString();
+        handle.prepare("DELETE FROM slack_attachment WHERE created_at < ? AND org_id = ?").run(cutoff, org);
+        handle
+            .prepare(`INSERT INTO slack_attachment (org_id, file_id, url_private, mime_type, name, team_id, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (org_id, file_id) DO UPDATE SET
+           url_private = excluded.url_private, mime_type = excluded.mime_type,
+           name = excluded.name, team_id = excluded.team_id, created_at = excluded.created_at`)
+            .run(org, fileId, rec.urlPrivate, rec.mimeType ?? null, rec.name ?? null, rec.teamId ?? null, at);
+    },
+    async getSlackAttachment(org, fileId) {
+        const row = getDb()
+            .prepare("SELECT url_private, mime_type, name, team_id FROM slack_attachment WHERE org_id = ? AND file_id = ?")
+            .get(org, fileId);
+        if (!row)
+            return null;
+        const rec = {
+            urlPrivate: row.url_private,
+            ...(row.mime_type ? { mimeType: row.mime_type } : {}),
+            ...(row.name ? { name: row.name } : {}),
+            ...(row.team_id ? { teamId: row.team_id } : {}),
+        };
+        return rec;
+    },
+    async putStoredCredential(org, rec) {
+        // Upsert the ciphertext envelope. `rec.ciphertext` is opaque here — never inspected, never logged.
+        getDb()
+            .prepare(`INSERT INTO stored_credential (org_id, ref, ciphertext, connector, domain, created_by, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (org_id, ref) DO UPDATE SET
+           ciphertext = excluded.ciphertext, connector = excluded.connector,
+           domain = excluded.domain, created_by = excluded.created_by, created_at = excluded.created_at`)
+            .run(org, rec.ref, rec.ciphertext, rec.connector ?? null, rec.domain ?? null, rec.createdBy, rec.createdAt);
+    },
+    async getStoredCredential(org, ref) {
+        const row = getDb()
+            .prepare("SELECT ref, ciphertext, connector, domain, created_by, created_at FROM stored_credential WHERE org_id = ? AND ref = ?")
+            .get(org, ref);
+        if (!row)
+            return null;
+        return {
+            ref: row.ref,
+            ciphertext: row.ciphertext,
+            ...(row.connector ? { connector: row.connector } : {}),
+            ...(row.domain ? { domain: row.domain } : {}),
+            createdBy: row.created_by,
+            createdAt: row.created_at,
+        };
+    },
+    async deleteStoredCredential(org, ref) {
+        // A REAL delete of the ciphertext row (OPE-287) — the self-host twin of the postgres path. See
+        // the store port for why this table retires by destruction rather than by status.
+        return getDb().prepare("DELETE FROM stored_credential WHERE org_id = ? AND ref = ?").run(org, ref).changes > 0;
+    },
+    async listStoredCredentialRefs(org, refPrefix) {
+        // REFS ONLY (OPE-349) — the ciphertext column is deliberately not in the projection; see the
+        // store port for why an enumerating caller must never be handed envelopes. `refPrefix` narrows
+        // IN THE PREDICATE (OPE-1025) — the self-host twin of the postgres path, same escaping.
+        if (refPrefix) {
+            const rows = getDb().prepare("SELECT ref FROM stored_credential WHERE org_id = ? AND ref LIKE ? ESCAPE '\\' ORDER BY ref").all(org, likePrefixPattern(refPrefix));
+            return rows.map((r) => r.ref);
+        }
+        const rows = getDb().prepare("SELECT ref FROM stored_credential WHERE org_id = ? ORDER BY ref").all(org);
+        return rows.map((r) => r.ref);
+    },
+    async putGitHubInstallation(org, rec) {
+        getDb()
+            .prepare(`INSERT INTO github_installation (org_id, owner, installation_id, account_type, repository_selection, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?)
+         ON CONFLICT (org_id, owner) DO UPDATE SET installation_id = excluded.installation_id,
+           account_type = excluded.account_type, repository_selection = excluded.repository_selection,
+           updated_at = excluded.updated_at`)
+            .run(org, rec.owner, rec.installationId, rec.accountType ?? null, rec.repositorySelection ?? null, rec.updatedAt);
+    },
+    async deleteGitHubInstallation(org, owner) {
+        return getDb().prepare("DELETE FROM github_installation WHERE org_id = ? AND owner = ?").run(org, owner).changes > 0;
+    },
+    async listGitHubInstallations(org) {
+        const rows = getDb()
+            .prepare("SELECT owner, installation_id, account_type, repository_selection, updated_at FROM github_installation WHERE org_id = ? ORDER BY owner ASC")
+            .all(org);
+        return rows.map((r) => ({
+            owner: r.owner,
+            installationId: r.installation_id,
+            ...(r.account_type ? { accountType: r.account_type } : {}),
+            ...(r.repository_selection ? { repositorySelection: r.repository_selection } : {}),
+            updatedAt: r.updated_at,
+        }));
+    },
+    async claimStoredCredential(org, ref, claimId, claimedAtIso, staleBeforeIso) {
+        // Atomic compare-and-set on the claim columns: win iff the row is free (claim_id NULL) OR the
+        // existing claim's lease is stale (claimed_at <= staleBefore). ISO-8601 compares lexicographically,
+        // so `<=` is a correct time comparison. A single UPDATE ⇒ of two racing claimants exactly one
+        // flips `changes` (the other loses). A missing row updates nothing ⇒ changes=0 ⇒ lost.
+        const info = getDb()
+            .prepare(`UPDATE stored_credential SET claim_id = ?, claimed_at = ?
+         WHERE org_id = ? AND ref = ? AND (claim_id IS NULL OR claimed_at <= ?)`)
+            .run(claimId, claimedAtIso, org, ref, staleBeforeIso);
+        return info.changes > 0;
+    },
+    async releaseStoredCredential(org, ref, claimId) {
+        // Guarded release: clear the claim only if THIS caller still holds it (claim_id matches). A caller
+        // whose lease was stolen mismatches and no-ops — it never clears the new owner's claim.
+        const info = getDb()
+            .prepare("UPDATE stored_credential SET claim_id = NULL, claimed_at = NULL WHERE org_id = ? AND ref = ? AND claim_id = ?")
+            .run(org, ref, claimId);
+        return info.changes > 0;
+    },
+    async addCredentialIntake(row) {
+        getDb()
+            .prepare(`INSERT INTO credential_intake (org_id, id, ref, connector, domain, requested_by, channel_id, thread_ts, created_at, expires_at, used_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(row.org, row.id, row.ref, row.connector, row.domain ?? null, row.requestedBy, row.channelId, row.threadTs ?? null, row.createdAt, row.expiresAt, row.usedAt ?? null);
+    },
+    async getCredentialIntake(org, id) {
+        const row = getDb()
+            .prepare("SELECT id, ref, connector, domain, requested_by, channel_id, thread_ts, created_at, expires_at, used_at FROM credential_intake WHERE org_id = ? AND id = ?")
+            .get(org, id);
+        if (!row)
+            return null;
+        return {
+            org,
+            id: row.id,
+            ref: row.ref,
+            connector: row.connector,
+            ...(row.domain ? { domain: row.domain } : {}),
+            requestedBy: row.requested_by,
+            channelId: row.channel_id,
+            ...(row.thread_ts ? { threadTs: row.thread_ts } : {}),
+            createdAt: row.created_at,
+            expiresAt: row.expires_at,
+            ...(row.used_at ? { usedAt: row.used_at } : {}),
+        };
+    },
+    async armWebhookCaptureWindow(org, hookId, captureUntil, armedBy, at) {
+        // UPSERT on the whole key — re-arming replaces, never accumulates (see the store port).
+        getDb()
+            .prepare(`INSERT INTO webhook_capture_window (org_id, hook_id, capture_until, armed_by, armed_at) VALUES (?, ?, ?, ?, ?)
+           ON CONFLICT (org_id, hook_id) DO UPDATE SET capture_until = excluded.capture_until, armed_by = excluded.armed_by, armed_at = excluded.armed_at`)
+            .run(org, hookId, captureUntil, armedBy, at);
+    },
+    async getWebhookCaptureWindow(org, hookId) {
+        const row = getDb()
+            .prepare("SELECT hook_id, capture_until, armed_by, armed_at FROM webhook_capture_window WHERE org_id = ? AND hook_id = ?")
+            .get(org, hookId);
+        // Returned EXPIRED-AND-ALL: closing is the caller's comparison (`captureWindowOpen`).
+        return row ? { hookId: row.hook_id, captureUntil: row.capture_until, armedBy: row.armed_by, armedAt: row.armed_at } : null;
+    },
+    async consumeCredentialIntake(org, id, usedAt) {
+        // Single-use CAS: a single UPDATE gated on used_at IS NULL means of two racing submits
+        // exactly one flips `changes` (the other loses and is refused).
+        const info = getDb()
+            .prepare("UPDATE credential_intake SET used_at = ? WHERE org_id = ? AND id = ? AND used_at IS NULL")
+            .run(usedAt, org, id);
+        return info.changes > 0;
+    },
+    async addPendingAction(row) {
+        getDb()
+            .prepare(`INSERT INTO pending_actions
+           (org_id, id, kind, args_json, scope_key, domain, requested_by, channel_id, thread_ts, message_ts, posted_to, status, created_at, expires_at, decided_by, decided_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(row.org, row.id, row.kind, row.argsJson, row.scopeKey, row.domain, row.requestedBy, row.channelId, row.threadTs, row.messageTs, row.postedTo, row.status, row.createdAt, row.expiresAt, row.decidedBy, row.decidedAt);
+    },
+    async addPendingActionIfAbsent(row) {
+        // The conflict arm the derived-id wedge needs — see the store interface's note (OPE-1348).
+        const info = getDb()
+            .prepare(`INSERT INTO pending_actions
+           (org_id, id, kind, args_json, scope_key, domain, requested_by, channel_id, thread_ts, message_ts, posted_to, status, created_at, expires_at, decided_by, decided_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (org_id, id) DO NOTHING`)
+            .run(row.org, row.id, row.kind, row.argsJson, row.scopeKey, row.domain, row.requestedBy, row.channelId, row.threadTs, row.messageTs, row.postedTo, row.status, row.createdAt, row.expiresAt, row.decidedBy, row.decidedAt);
+        return info.changes > 0;
+    },
+    async getPendingAction(org, id) {
+        const row = getDb()
+            .prepare(`SELECT id, kind, args_json, scope_key, domain, requested_by, channel_id, thread_ts, message_ts, posted_to, status, created_at, expires_at, decided_by, decided_at
+         FROM pending_actions WHERE org_id = ? AND id = ?`)
+            .get(org, id);
+        return row ? pendingActionFromRow(org, row) : null;
+    },
+    async listPendingActions(org) {
+        const rows = getDb()
+            .prepare(`SELECT id, kind, args_json, scope_key, domain, requested_by, channel_id, thread_ts, message_ts, posted_to, status, created_at, expires_at, decided_by, decided_at
+         FROM pending_actions WHERE org_id = ? AND status = 'pending' ORDER BY created_at ASC`)
+            .all(org);
+        return rows.map((r) => pendingActionFromRow(org, r));
+    },
+    async listExpiredPendingActions(org, nowIso) {
+        const rows = getDb()
+            .prepare(`SELECT id, kind, args_json, scope_key, domain, requested_by, channel_id, thread_ts, message_ts, posted_to, status, created_at, expires_at, decided_by, decided_at
+         FROM pending_actions WHERE org_id = ? AND status = 'pending' AND expires_at <= ? ORDER BY created_at ASC`)
+            .all(org, nowIso);
+        return rows.map((r) => pendingActionFromRow(org, r));
+    },
+    async listRejectedActionsSince(org, sinceIso) {
+        const rows = getDb()
+            .prepare(`SELECT id, kind, args_json, scope_key, domain, requested_by, channel_id, thread_ts, message_ts, posted_to, status, created_at, expires_at, decided_by, decided_at
+         FROM pending_actions WHERE org_id = ? AND status = 'rejected' AND decided_at >= ? ORDER BY decided_at DESC`)
+            .all(org, sinceIso);
+        return rows.map((r) => pendingActionFromRow(org, r));
+    },
+    async setPendingActionMessage(org, id, messageTs) {
+        getDb().prepare("UPDATE pending_actions SET message_ts = ? WHERE org_id = ? AND id = ?").run(messageTs, org, id);
+    },
+    async decidePendingAction(org, id, status, decidedBy, decidedAt) {
+        // The CAS: a single UPDATE gated on status='pending' means of two racing decides
+        // (two clicks, or a click racing a lazy-expiry sweep) exactly one flips `changes`.
+        const info = getDb()
+            .prepare("UPDATE pending_actions SET status = ?, decided_by = ?, decided_at = ? WHERE org_id = ? AND id = ? AND status = 'pending'")
+            .run(status, decidedBy, decidedAt, org, id);
+        return info.changes > 0;
+    },
+    async setSessionApproval(row) {
+        const db = getDb();
+        // Prune-on-write: drop this org's expired memos so the table can't grow unboundedly (there is no
+        // sweep — the session_id generation is the real death mechanism, this is just GC).
+        db.prepare("DELETE FROM pr_session_approval WHERE org_id = ? AND expires_at <= ?").run(row.org, row.createdAt);
+        db.prepare(`INSERT INTO pr_session_approval (org_id, session_id, kind, granted_by, created_at, expires_at)
+       VALUES (?, ?, ?, ?, ?, ?)
+       ON CONFLICT(org_id, session_id, kind) DO UPDATE SET granted_by = excluded.granted_by, created_at = excluded.created_at, expires_at = excluded.expires_at`).run(row.org, row.sessionId, row.kind, row.grantedBy, row.createdAt, row.expiresAt);
+    },
+    async getSessionApproval(org, sessionId, kind, nowIso) {
+        const row = getDb()
+            .prepare("SELECT session_id, kind, granted_by, created_at, expires_at FROM pr_session_approval WHERE org_id = ? AND session_id = ? AND kind = ? AND expires_at > ?")
+            .get(org, sessionId, kind, nowIso);
+        if (!row)
+            return null;
+        return { org, sessionId: row.session_id, kind: row.kind, grantedBy: row.granted_by, createdAt: row.created_at, expiresAt: row.expires_at };
+    },
+    async listSessionApprovals(org, sessionId, nowIso) {
+        const rows = getDb()
+            .prepare("SELECT session_id, kind, granted_by, created_at, expires_at FROM pr_session_approval WHERE org_id = ? AND session_id = ? AND expires_at > ? ORDER BY kind ASC")
+            .all(org, sessionId, nowIso);
+        return rows.map((r) => ({ org, sessionId: r.session_id, kind: r.kind, grantedBy: r.granted_by, createdAt: r.created_at, expiresAt: r.expires_at }));
+    },
+    async revokeSessionApprovals(org, sessionId) {
+        // `changes` is `number | bigint` on this driver (a BigInt only past 2^53 rows) — normalise.
+        return Number(getDb().prepare("DELETE FROM pr_session_approval WHERE org_id = ? AND session_id = ?").run(org, sessionId).changes);
+    },
+    async sweepLegacyConnectorOpRows(org) {
+        // Both prefixes, and no expiry clause — see the port's own comment for why each is required.
+        // The two prefixes are code constants, never caller text, and carry no LIKE metacharacter.
+        return Number(getDb()
+            .prepare("DELETE FROM pr_session_approval WHERE org_id = ? AND session_id LIKE ? AND kind LIKE ?")
+            .run(org, `${ROUTINE_PERMISSION_PREFIX}%`, `${CONNECTOR_OP_KIND_PREFIX}%`).changes);
+    },
+    // The Postgres twin is the reference; these are the same statements in sqlite's placeholder dialect.
+    // status = ANY($n) has no sqlite equivalent, so each CAS spreads its closed status list into an IN list with one placeholder per member.
+    async putLinkSet(org, row) {
+        getDb()
+            .prepare(`INSERT INTO identity_link_sets (org_id, id, handle, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)
+         ON CONFLICT(org_id, id) DO UPDATE SET handle = excluded.handle, status = excluded.status, updated_at = excluded.updated_at`)
+            .run(org, row.id, row.handle, row.status, row.createdAt, row.updatedAt);
+    },
+    async getLinkSet(org, id) {
+        const row = getDb().prepare("SELECT id, handle, status, created_at, updated_at FROM identity_link_sets WHERE org_id = ? AND id = ?").get(org, id);
+        return row ? linkSetFromSqliteRow(org, row) : null;
+    },
+    async listLinkSets(org) {
+        const rows = getDb().prepare("SELECT id, handle, status, created_at, updated_at FROM identity_link_sets WHERE org_id = ? ORDER BY id ASC").all(org);
+        return rows.map((r) => linkSetFromSqliteRow(org, r));
+    },
+    async updateLinkSetStatus(org, id, from, to, at) {
+        const changes = getDb()
+            .prepare(`UPDATE identity_link_sets SET status = ?, updated_at = ? WHERE org_id = ? AND id = ? AND status IN (${placeholders(from.length)})`)
+            .run(to, at, org, id, ...from).changes;
+        return Number(changes) > 0;
+    },
+    async insertLinkedId(org, row) {
+        // DO NOTHING, never DO UPDATE — the conflict IS the answer (the account already belongs to a
+        // person). See the postgres twin.
+        const changes = getDb()
+            .prepare(`INSERT INTO identity_linked_ids (org_id, platform, tenant, native_id, link_set_id, status, established_by, evidence, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT(org_id, platform, tenant, native_id) DO NOTHING`)
+            .run(org, row.platform, row.tenant, row.nativeId, row.linkSetId, row.status, row.establishedBy, row.evidenceJson ?? null, row.createdAt, row.updatedAt).changes;
+        return Number(changes) > 0;
+    },
+    async getLinkedId(org, platform, tenant, nativeId) {
+        const row = getDb()
+            .prepare(`${LINKED_ID_SQLITE_SELECT} WHERE org_id = ? AND platform = ? AND tenant = ? AND native_id = ?`)
+            .get(org, platform, tenant, nativeId);
+        return row ? linkedIdFromSqliteRow(org, row) : null;
+    },
+    async listLinkedIds(org, linkSetId) {
+        const sql = `${LINKED_ID_SQLITE_SELECT} WHERE org_id = ?${linkSetId === undefined ? "" : " AND link_set_id = ?"} ORDER BY platform ASC, tenant ASC, native_id ASC`;
+        const rows = (linkSetId === undefined ? getDb().prepare(sql).all(org) : getDb().prepare(sql).all(org, linkSetId));
+        return rows.map((r) => linkedIdFromSqliteRow(org, r));
+    },
+    async updateLinkedIdStatus(org, platform, tenant, nativeId, from, to, establishedBy, evidenceJson, at) {
+        const changes = getDb()
+            .prepare(`UPDATE identity_linked_ids SET status = ?, established_by = ?, evidence = ?, updated_at = ?
+         WHERE org_id = ? AND platform = ? AND tenant = ? AND native_id = ? AND status IN (${placeholders(from.length)})`)
+            .run(to, establishedBy, evidenceJson ?? null, at, org, platform, tenant, nativeId, ...from).changes;
+        return Number(changes) > 0;
+    },
+    async deleteLinkedId(org, platform, tenant, nativeId) {
+        return Number(getDb().prepare("DELETE FROM identity_linked_ids WHERE org_id = ? AND platform = ? AND tenant = ? AND native_id = ?").run(org, platform, tenant, nativeId).changes) > 0;
+    },
+    async revokeLinkedIdsForSet(org, linkSetId, at) {
+        return Number(getDb().prepare("UPDATE identity_linked_ids SET status = 'revoked', updated_at = ? WHERE org_id = ? AND link_set_id = ? AND status <> 'revoked'").run(at, org, linkSetId).changes);
+    },
+    async unbackfilledLinkedIdPlatforms() {
+        // Deployment-wide, no org filter — the tenant a row should carry is a fact about the deployment's
+        // channel config, not about an org. See the seam's doc on OperationalStore.
+        const rows = getDb().prepare("SELECT DISTINCT platform FROM identity_linked_ids WHERE tenant = '' ORDER BY platform ASC").all();
+        return rows.map((r) => r.platform);
+    },
+    async backfillLinkedIdTenant(platform, tenant, at) {
+        // `tenant = ''` in the predicate is what makes this fill-a-blank-only: a row that already names a
+        // workspace is a delivery's own statement and is never rewritten here.
+        return Number(getDb().prepare("UPDATE identity_linked_ids SET tenant = ?, updated_at = ? WHERE platform = ? AND tenant = ''").run(tenant, at, platform).changes);
+    },
+    async addLinkChallenge(org, row) {
+        getDb()
+            .prepare(`INSERT INTO identity_link_challenges
+           (org_id, id, nonce_hash, initiating_platform, initiating_tenant, initiating_native_id, initiating_surface_key,
+            claimed_platform, claimed_tenant, claimed_native_id, claimed_at,
+            transport, target_platform, target_tenant, target_native_id, back_nonce_hash,
+            status, created_at, expires_at, decided_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(org, row.id, row.nonceHash, row.initiatingPlatform, row.initiatingTenant, row.initiatingNativeId, row.initiatingSurfaceKey, row.claimedPlatform ?? null, row.claimedTenant ?? null, row.claimedNativeId ?? null, row.claimedAt ?? null, row.transport, row.targetPlatform ?? null, row.targetTenant ?? null, row.targetNativeId ?? null, row.backNonceHash ?? null, row.status, row.createdAt, row.expiresAt, row.decidedAt ?? null);
+    },
+    async getLinkChallenge(org, id) {
+        const row = getDb().prepare(`${LINK_CHALLENGE_SQLITE_SELECT} WHERE org_id = ? AND id = ?`).get(org, id);
+        return row ? linkChallengeFromSqliteRow(org, row) : null;
+    },
+    async listLinkChallenges(org, filter) {
+        const conjuncts = ["org_id = ?"];
+        const params = [org];
+        if (filter?.initiatingPlatform !== undefined) {
+            conjuncts.push("initiating_platform = ?");
+            params.push(filter.initiatingPlatform);
+        }
+        if (filter?.initiatingTenant !== undefined) {
+            conjuncts.push("initiating_tenant = ?");
+            params.push(filter.initiatingTenant);
+        }
+        if (filter?.initiatingNativeId !== undefined) {
+            conjuncts.push("initiating_native_id = ?");
+            params.push(filter.initiatingNativeId);
+        }
+        if (filter?.targetPlatform !== undefined) {
+            conjuncts.push("target_platform = ?");
+            params.push(filter.targetPlatform);
+        }
+        if (filter?.targetTenant !== undefined) {
+            conjuncts.push("target_tenant = ?");
+            params.push(filter.targetTenant);
+        }
+        if (filter?.targetNativeId !== undefined) {
+            conjuncts.push("target_native_id = ?");
+            params.push(filter.targetNativeId);
+        }
+        if (filter?.claimedPlatform !== undefined) {
+            conjuncts.push("claimed_platform = ?");
+            params.push(filter.claimedPlatform);
+        }
+        if (filter?.claimedTenant !== undefined) {
+            conjuncts.push("claimed_tenant = ?");
+            params.push(filter.claimedTenant);
+        }
+        if (filter?.claimedNativeId !== undefined) {
+            conjuncts.push("claimed_native_id = ?");
+            params.push(filter.claimedNativeId);
+        }
+        if (filter?.status !== undefined) {
+            conjuncts.push("status = ?");
+            params.push(filter.status);
+        }
+        const rows = getDb()
+            .prepare(`${LINK_CHALLENGE_SQLITE_SELECT} WHERE ${conjuncts.join(" AND ")} ORDER BY created_at DESC`)
+            .all(...params);
+        return rows.map((r) => linkChallengeFromSqliteRow(org, r));
+    },
+    async claimLinkChallenge(org, nonceHash, platform, tenant, nativeId, at, backNonceHash) {
+        // This driver's run has no RETURNING, so the claimed row is read back by id; the UPDATE alone decides the winner, so the read cannot hand a second caller the same claim.
+        // The initiator exclusion is TENANT-QUALIFIED: platform plus native_id alone would treat an id-twin in another workspace as a self-claim and refuse a legitimate one.
+        const db = getDb();
+        const changes = db
+            .prepare(`UPDATE identity_link_challenges SET claimed_platform = ?, claimed_tenant = ?, claimed_native_id = ?, claimed_at = ?, back_nonce_hash = ?, status = 'claimed'
+         WHERE org_id = ? AND nonce_hash = ? AND status = 'pending' AND expires_at > ?
+           AND NOT (initiating_platform = ? AND initiating_tenant = ? AND initiating_native_id = ?)`)
+            .run(platform, tenant, nativeId, at, backNonceHash ?? null, org, nonceHash, at, platform, tenant, nativeId).changes;
+        if (Number(changes) === 0)
+            return null;
+        const row = db.prepare(`${LINK_CHALLENGE_SQLITE_SELECT} WHERE org_id = ? AND nonce_hash = ? AND claimed_at = ?`).get(org, nonceHash, at);
+        return row ? linkChallengeFromSqliteRow(org, row) : null;
+    },
+    async consentLinkChallenge(org, id, consenter, at, backNonceHash) {
+        // The TARGET MATCH is a conjunct, not a caller-side check (see store.ts's contract): a consent
+        // from any account but the one this challenge named matches no row and returns null. Single-use
+        // rides the same `status = 'pending'` predicate the claim CAS uses, and the TTL rides
+        // `expires_at > at` — all three in one statement, so none can be lost to a race.
+        const db = getDb();
+        const changes = db
+            .prepare(`UPDATE identity_link_challenges SET claimed_platform = ?, claimed_tenant = ?, claimed_native_id = ?, claimed_at = ?, back_nonce_hash = ?, status = 'claimed'
+         WHERE org_id = ? AND id = ? AND status = 'pending' AND expires_at > ?
+           AND target_platform = ? AND target_tenant = ? AND target_native_id = ?`)
+            .run(consenter.platform, consenter.tenant, consenter.nativeId, at, backNonceHash ?? null, org, id, at, consenter.platform, consenter.tenant, consenter.nativeId).changes;
+        if (Number(changes) === 0)
+            return null;
+        const row = db.prepare(`${LINK_CHALLENGE_SQLITE_SELECT} WHERE org_id = ? AND id = ?`).get(org, id);
+        return row ? linkChallengeFromSqliteRow(org, row) : null;
+    },
+    async decideLinkChallenge(org, id, from, to, at) {
+        // TTL CONJUNCT ON RATIFY (audit finding F7) — the postgres twin's contract on the floor backend:
+        // the terminal `ratified` transition (the one that writes a link) also requires `expires_at > at`
+        // so a claimed-but-expired challenge cannot be ratified without a prior sweep. Deny carries no
+        // TTL conjunct (it writes nothing). TTL lives INSIDE the statement, not in a caller's clock read.
+        const ttlConjunct = to === "ratified" ? " AND expires_at > ?" : "";
+        const args = to === "ratified" ? [to, at, org, id, ...from, at] : [to, at, org, id, ...from];
+        const changes = getDb()
+            .prepare(`UPDATE identity_link_challenges SET status = ?, decided_at = ? WHERE org_id = ? AND id = ? AND status IN (${placeholders(from.length)})${ttlConjunct}`)
+            .run(...args).changes;
+        return Number(changes) > 0;
+    },
+    async expireLinkChallenges(org, nowIso) {
+        return Number(getDb()
+            .prepare("UPDATE identity_link_challenges SET status = 'expired', decided_at = ? WHERE org_id = ? AND status IN ('pending', 'claimed') AND expires_at <= ?")
+            .run(nowIso, org, nowIso).changes);
+    },
+    async addCredentialGrantAsk(org, row) {
+        refuseHalfBorrow("credential_grant_ask", row);
+        getDb()
+            .prepare(`INSERT INTO credential_grant_ask
+           (org_id, id, requester_principal_id, owner_principal_id, owner_slug, owner_platform, owner_native_id, connector, verb, resource,
+            mcp_tool, frozen_args, tool_name,
+            scope_key, domain_scope_key, purpose, requester_target, card_surface_id, card_message_id, requested_mode, status, created_at, expires_at, decided_at, grant_id)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(org, row.id, row.requesterPrincipalId, row.ownerPrincipalId, row.ownerSlug, row.ownerPlatform, row.ownerNativeId, row.connector, row.verb, row.resource, row.mcpTool ?? null, grantJsonColumn(row.frozenArgs), row.toolName ?? null, row.scopeKey, row.domainScopeKey ?? null, row.purpose, row.requesterTarget ?? null, row.cardSurfaceId ?? null, row.cardMessageId ?? null, row.requestedMode, row.status, row.createdAt, row.expiresAt, row.decidedAt ?? null, row.grantId ?? null);
+    },
+    async setCredentialGrantAskCard(org, id, surfaceId, messageId) {
+        getDb().prepare("UPDATE credential_grant_ask SET card_surface_id = ?, card_message_id = ? WHERE org_id = ? AND id = ?").run(surfaceId, messageId, org, id);
+    },
+    async getCredentialGrantAsk(org, id) {
+        const row = getDb().prepare(`${GRANT_ASK_SQLITE_SELECT} WHERE org_id = ? AND id = ?`).get(org, id);
+        return row ? grantAskFromSqliteRow(row) : null;
+    },
+    async liveCredentialGrantAsk(org, requesterPrincipalId, ownerPrincipalId, verb, resource, nowIso) {
+        // EXPIRY IN THE PREDICATE, never a status check alone: the sweep is a tidy-up, so an unswept
+        // `pending` row past its TTL must read as gone here or a lapsed ask would block a fresh one.
+        const row = getDb()
+            .prepare(`${GRANT_ASK_SQLITE_SELECT}
+         WHERE org_id = ? AND requester_principal_id = ? AND owner_principal_id = ? AND verb = ? AND resource = ?
+           AND status = 'pending' AND expires_at > ?
+         ORDER BY created_at DESC LIMIT 1`)
+            .get(org, requesterPrincipalId, ownerPrincipalId, verb, resource, nowIso);
+        return row ? grantAskFromSqliteRow(row) : null;
+    },
+    async approveCredentialGrantAsk(org, id, mode, grantId, at) {
+        // Single-answer + TTL in ONE statement (the claimLinkChallenge discipline). `status = 'pending'`
+        // admits exactly one approval, and `expires_at > at` makes a late click on a scrolled-back card
+        // lose the CAS rather than be caught by a UI state.
+        const db = getDb();
+        const changes = db
+            .prepare(`UPDATE credential_grant_ask SET status = 'approved', requested_mode = ?, grant_id = ?, decided_at = ?
+         WHERE org_id = ? AND id = ? AND status = 'pending' AND expires_at > ?`)
+            .run(mode, grantId, at, org, id, at).changes;
+        if (Number(changes) === 0)
+            return null;
+        const row = db.prepare(`${GRANT_ASK_SQLITE_SELECT} WHERE org_id = ? AND id = ?`).get(org, id);
+        return row ? grantAskFromSqliteRow(row) : null;
+    },
+    async decideCredentialGrantAsk(org, id, from, to, at) {
+        const changes = getDb()
+            .prepare(`UPDATE credential_grant_ask SET status = ?, decided_at = ? WHERE org_id = ? AND id = ? AND status IN (${placeholders(from.length)})`)
+            .run(to, at, org, id, ...from).changes;
+        return Number(changes) > 0;
+    },
+    async listExpiredCredentialGrantAsks(org, nowIso) {
+        const rows = getDb()
+            .prepare(`${GRANT_ASK_SQLITE_SELECT} WHERE org_id = ? AND status = 'pending' AND expires_at <= ? ORDER BY created_at ASC`)
+            .all(org, nowIso);
+        return rows.map(grantAskFromSqliteRow);
+    },
+    async pendingCredentialGrantAsksForScope(org, scopeKey, nowIso) {
+        // EXPIRY IN THE PREDICATE, for `liveCredentialGrantAsk`'s reason: the sweep is a tidy-up, so an
+        // unswept `pending` row past its TTL must read as gone or a lapsed ask would hold its name for
+        // ever. The read rides the `(org_id, scope_key)` index the table already carries.
+        const rows = getDb()
+            .prepare(`${GRANT_ASK_SQLITE_SELECT} WHERE org_id = ? AND scope_key = ? AND status = 'pending' AND expires_at > ? ORDER BY created_at ASC`)
+            .all(org, scopeKey, nowIso);
+        return rows.map(grantAskFromSqliteRow);
+    },
+    async addCredentialGrant(org, row) {
+        refuseHalfBorrow("credential_grant", row);
+        getDb()
+            .prepare(`INSERT INTO credential_grant
+           (org_id, id, ask_id, requester_principal_id, owner_principal_id, owner_slug, connector, verb, resource,
+            mcp_tool, frozen_args, tool_name, input_schema,
+            scope_key, mode, tier, status, purpose, created_at, expires_at, used_at, revoked_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(org, row.id, row.askId, row.requesterPrincipalId, row.ownerPrincipalId, row.ownerSlug, row.connector, row.verb, row.resource, row.mcpTool ?? null, grantJsonColumn(row.frozenArgs), row.toolName ?? null, grantJsonColumn(row.inputSchema), row.scopeKey, row.mode, row.tier, row.status, row.purpose, row.createdAt, row.expiresAt, row.usedAt ?? null, row.revokedAt ?? null);
+    },
+    async getCredentialGrant(org, id) {
+        const row = getDb().prepare(`${GRANT_SQLITE_SELECT} WHERE org_id = ? AND id = ?`).get(org, id);
+        return row ? grantFromSqliteRow(row) : null;
+    },
+    async credentialGrantsForScope(org, scopeKey) {
+        // NO status filter, deliberately — the mount projects EXISTENCE and the broker refuses on STATE.
+        // See the store.ts contract for why a status filter here breaks the cold-heal path.
+        const rows = getDb()
+            .prepare(`${GRANT_SQLITE_SELECT} WHERE org_id = ? AND scope_key = ? ORDER BY created_at DESC`)
+            .all(org, scopeKey);
+        return rows.map(grantFromSqliteRow);
+    },
+    async liveStandingCredentialGrantsForScope(org, scopeKey, nowIso) {
+        // STATUS, EXPIRY, REVOCATION AND MODE ALL IN THE PREDICATE — a domain-keyed row is read by
+        // sessions that never saw it, so a dead one must not mount there. See the store.ts contract.
+        const rows = getDb()
+            .prepare(`${GRANT_SQLITE_SELECT} WHERE org_id = ? AND scope_key = ? AND mode = 'standing' AND status = 'active'
+           AND expires_at > ? AND revoked_at IS NULL ORDER BY created_at DESC`)
+            .all(org, scopeKey, nowIso);
+        return rows.map(grantFromSqliteRow);
+    },
+    async liveCredentialGrantsForOwner(org, ownerPrincipalId, nowIso) {
+        // STATUS AND EXPIRY BOTH IN THE PREDICATE — the owner may only be offered rows they can still
+        // end. See the store.ts contract for why this filters where `credentialGrantsForScope` must not.
+        const rows = getDb()
+            .prepare(`${GRANT_SQLITE_SELECT} WHERE org_id = ? AND owner_principal_id = ? AND status = 'active' AND expires_at > ? ORDER BY created_at ASC`)
+            .all(org, ownerPrincipalId, nowIso);
+        return rows.map(grantFromSqliteRow);
+    },
+    async liveBorrowCredentialGrant(org, ownerPrincipalId, connector, mcpTool, frozenArgsDigest, scopeKey, nowIso) {
+        // THE DIGEST IS COMPARED IN TYPESCRIPT, not in SQL, because it is not a column. The predicate
+        // narrows to the rows that could match — one owner, one connector, one vendor tool, one chat,
+        // still live — and there are at most a handful of those, so the scan is cheap. A digest column
+        // would be a second copy of `frozen_args` that a partial write could put out of step with it.
+        const rows = getDb()
+            .prepare(`${GRANT_SQLITE_SELECT} WHERE org_id = ? AND owner_principal_id = ? AND connector = ? AND mcp_tool = ? AND scope_key = ?
+           AND status = 'active' AND expires_at > ? ORDER BY created_at DESC`)
+            .all(org, ownerPrincipalId, connector, mcpTool, scopeKey, nowIso);
+        for (const r of rows) {
+            const row = grantFromSqliteRow(r);
+            if (row.frozenArgs !== undefined && grantFrozenArgsDigest(row.frozenArgs) === frozenArgsDigest)
+                return row;
+        }
+        return null;
+    },
+    async burnCredentialGrant(org, id, at) {
+        // THE WHOLE OF ONCE-MODE. Both conjuncts are in the statement: `status = 'active'` makes the burn
+        // single-use, `expires_at > at` makes an expired row unspendable without waiting for a sweep.
+        const db = getDb();
+        const changes = db
+            .prepare(`UPDATE credential_grant SET status = 'used', used_at = ? WHERE org_id = ? AND id = ? AND status = 'active' AND expires_at > ?`)
+            .run(at, org, id, at).changes;
+        if (Number(changes) === 0)
+            return null;
+        const row = db.prepare(`${GRANT_SQLITE_SELECT} WHERE org_id = ? AND id = ?`).get(org, id);
+        return row ? grantFromSqliteRow(row) : null;
+    },
+    async refundCredentialGrant(org, id, burnedAt) {
+        // `used_at = ?` IS THE CONTROL, not a tidy extra conjunct: it binds the refund to the caller's
+        // OWN burn, so a call that lost the burn race cannot un-spend the winner's. `revoked_at IS NULL`
+        // is what makes an owner's revoke beat a refund racing it — see `revokeCredentialGrant`.
+        const changes = getDb()
+            .prepare(`UPDATE credential_grant SET status = 'active', used_at = NULL
+         WHERE org_id = ? AND id = ? AND status = 'used' AND used_at = ? AND revoked_at IS NULL`)
+            .run(org, id, burnedAt).changes;
+        return Number(changes) > 0;
+    },
+    async claimCredentialGrantRefund(org, id, turnKey, cap) {
+        // ONE STATEMENT, so two calls racing in one step cannot both read the same remaining count. The
+        // right-hand `refund_turn_seq` is the row's PRE-UPDATE value in both engines, so every CASE and
+        // the WHERE read the same stored ordinal.
+        //
+        // 🔴 ONLY A STRICTLY LATER TURN ROLLS (OPE-1281). The predicate is the ORDINAL comparison, not
+        // the key inequality this statement used to carry: an inequality rolls in both directions, so
+        // two turn ids alternating on one row each read the other as new and each collected a fresh
+        // allowance. A NULL ordinal — no turn id, or a key eve's shape no longer mints — never rolls;
+        // it counts against the stored turn and leaves the turn in place, which is the fail-closed
+        // direction.
+        //
+        // 🔴 A ROW THAT HAS COUNTED A TURN AND CARRIES NO ORDINAL NEVER ROLLS EITHER, and that is the
+        // upgrade window rather than a corner. A row written before this column existed holds a turn
+        // key, a count up to `cap`, and a NULL ordinal; reading that NULL as "never counted" would let
+        // ANY turn roll it — the same turn included — which is the hole this ticket closes. So the
+        // first disjunct asks for BOTH columns empty, which is a row that has genuinely counted
+        // nothing. A migrated row keeps the allowance it had for the rest of its life, bounded by the
+        // grant's TTL.
+        const key = turnKey ?? null;
+        const seq = grantRefundTurnOrdinal(turnKey) ?? null;
+        // The roll predicate, spelled once and bound twice per use. Binds below follow the statement's
+        // own order: (seq, seq, key) (seq, seq, seq) (seq, seq) org id (seq, seq) cap.
+        const rolls = "(? IS NOT NULL AND ((refund_turn IS NULL AND refund_turn_seq IS NULL) OR ? > refund_turn_seq))";
+        const changes = getDb()
+            .prepare(`UPDATE credential_grant
+            SET refund_turn = CASE WHEN ${rolls} THEN ? ELSE refund_turn END,
+                refund_turn_seq = CASE WHEN ${rolls} THEN ? ELSE refund_turn_seq END,
+                refund_count = CASE WHEN ${rolls} THEN 1 ELSE COALESCE(refund_count, 0) + 1 END
+          WHERE org_id = ? AND id = ?
+            AND (${rolls} OR COALESCE(refund_count, 0) < ?)`)
+            .run(seq, seq, key, seq, seq, seq, seq, seq, org, id, seq, seq, cap).changes;
+        return Number(changes) > 0;
+    },
+    async revokeCredentialGrant(org, id, at) {
+        const db = getDb();
+        const changes = db
+            .prepare("UPDATE credential_grant SET status = 'revoked', revoked_at = ? WHERE org_id = ? AND id = ? AND status = 'active'")
+            .run(at, org, id).changes;
+        if (Number(changes) > 0)
+            return true;
+        // THE ROW WAS NOT LIVE. If it is `used`, the owner may be racing a once call that is still in
+        // flight: stamp the intent so a refund cannot re-open it (OPE-1198). The STATUS is left alone —
+        // a spent grant is already terminal, and rewriting it would lose which arm ended it. The answer
+        // stays `false`: this call revoked no live grant.
+        db.prepare("UPDATE credential_grant SET revoked_at = ? WHERE org_id = ? AND id = ? AND status = 'used' AND revoked_at IS NULL").run(at, org, id);
+        return false;
+    },
+    async expireCredentialGrants(org, nowIso) {
+        return Number(getDb()
+            .prepare("UPDATE credential_grant SET status = 'expired' WHERE org_id = ? AND status = 'active' AND expires_at <= ?")
+            .run(org, nowIso).changes);
+    },
+    async getMeta(key) {
+        const row = getDb().prepare("SELECT value FROM instance_meta WHERE key = ?").get(key);
+        return row ? row.value : null;
+    },
+    async setMeta(key, value) {
+        getDb()
+            .prepare(`INSERT INTO instance_meta (key, value) VALUES (?, ?)
+         ON CONFLICT(key) DO UPDATE SET value = excluded.value`)
+            .run(key, value);
+    },
+};
+//# sourceMappingURL=sqlite.js.map