@prismshadow/penguin-server 0.2.15 → 0.2.17

package/dist/{chunk-NVWAYYRX.js → chunk-HPOHMZCH.js}

@@ -2,301 +2,372 @@
 import { mkdirSync } from "fs";
 import path from "path";
 
-// src/db/migrations.ts
-var MIGRATIONS = [
-  {
-    version: 1,
-    name: "messaging-bindings",
-    // Purely additive: one new table plus three indexes, no column of any existing table
-    // touched. A platform that rolls back to a predecessor without messaging simply never
-    // queries them.
-    swapSafe: true,
-    up(db) {
-      db.exec(`
-        CREATE TABLE IF NOT EXISTS messaging_bindings (
-          session_id       TEXT NOT NULL,
-          channel          TEXT NOT NULL,
-          account_id       TEXT NOT NULL,
-          config_json      TEXT NOT NULL,
-          enabled          INTEGER NOT NULL DEFAULT 0,
-          line_per_message INTEGER NOT NULL DEFAULT 0,
-          last_chat_id     TEXT,
-          last_chat_is_direct INTEGER NOT NULL DEFAULT 1,
-          last_inbound_message_id TEXT,
-          created_at       TEXT NOT NULL,
-          updated_at       TEXT NOT NULL,
-          PRIMARY KEY (session_id, channel)
-        );
-        CREATE INDEX IF NOT EXISTS idx_messaging_by_account ON messaging_bindings(channel, account_id);
-        CREATE INDEX IF NOT EXISTS idx_auth_sessions_expires ON auth_sessions(expires_at);
-        CREATE INDEX IF NOT EXISTS idx_auth_sessions_user ON auth_sessions(user_id);
-      `);
-    },
-    // LOSES every messaging binding: the channel credentials, the enabled flag and the
-    // last-chat memory all live in the table this drops. The auth_sessions indexes are
-    // derived and cost nothing to lose.
-    down(db) {
-      db.exec(`
-        DROP INDEX IF EXISTS idx_auth_sessions_user;
-        DROP INDEX IF EXISTS idx_auth_sessions_expires;
-        DROP INDEX IF EXISTS idx_messaging_by_account;
-        DROP TABLE IF EXISTS messaging_bindings;
-      `);
+// src/db/migrations/runner.ts
+var LEDGER_DDL = `
+  CREATE TABLE IF NOT EXISTS schema_migrations (
+    name       TEXT PRIMARY KEY,
+    applied_at TEXT NOT NULL
+  );
+`;
+function hasLedger(db) {
+  return db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'schema_migrations'").get() !== void 0;
+}
+function appliedMigrations(db) {
+  if (!hasLedger(db)) return [];
+  const rows = db.prepare("SELECT name FROM schema_migrations ORDER BY rowid").all();
+  return rows.map((r) => r.name);
+}
+function migrate(db, migrations, { swapPath = false } = {}) {
+  const adopted = !hasLedger(db);
+  const done = new Set(appliedMigrations(db));
+  const pending = migrations.filter((m) => !done.has(m.name));
+  if (adopted) db.exec(LEDGER_DDL);
+  const record = db.prepare("INSERT INTO schema_migrations (name, applied_at) VALUES (?, ?)");
+  const applied = [];
+  const deferred = [];
+  for (const m of pending) {
+    if (swapPath && !m.swapSafe) {
+      deferred.push(m.name);
+      continue;
     }
-  },
-  {
-    version: 2,
-    name: "messaging-delivery-flags",
-    // Two columns with defaults on an existing table: a rollback to a predecessor that
-    // does not know them leaves them at their defaults and reads nothing.
-    swapSafe: true,
-    up(db) {
-      ensureColumn(db, "messaging_bindings", "final_reply_only", "INTEGER NOT NULL DEFAULT 0");
-      ensureColumn(db, "messaging_bindings", "render_markdown", "INTEGER NOT NULL DEFAULT 1");
-    },
-    // LOSES both delivery preferences on every binding; the bindings themselves survive.
-    // Dropped in reverse order for symmetry with `up`. Neither column is indexed, which is
-    // what lets SQLite drop them at all.
-    down(db) {
-      db.exec("ALTER TABLE messaging_bindings DROP COLUMN render_markdown");
-      db.exec("ALTER TABLE messaging_bindings DROP COLUMN final_reply_only");
+    db.exec("BEGIN");
+    try {
+      m.up(db);
+      record.run(m.name, (/* @__PURE__ */ new Date()).toISOString());
+      db.exec("COMMIT");
+    } catch (err) {
+      db.exec("ROLLBACK");
+      throw new Error(`migration ${m.name} failed: ${String(err)}`, { cause: err });
     }
+    applied.push(m.name);
+  }
+  return { adopted, applied, deferred };
+}
+
+// src/db/migrations/steps/2026-08-31-messaging-bindings.ts
+var messagingBindings = {
+  name: "2026-08-31-messaging-bindings",
+  // Purely additive: one new table plus three indexes, no column of any existing table
+  // touched. A platform that rolls back to a predecessor without messaging simply never
+  // queries them.
+  swapSafe: true,
+  up(db) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS messaging_bindings (
+        session_id       TEXT NOT NULL,
+        channel          TEXT NOT NULL,
+        account_id       TEXT NOT NULL,
+        config_json      TEXT NOT NULL,
+        enabled          INTEGER NOT NULL DEFAULT 0,
+        line_per_message INTEGER NOT NULL DEFAULT 0,
+        last_chat_id     TEXT,
+        last_chat_is_direct INTEGER NOT NULL DEFAULT 1,
+        last_inbound_message_id TEXT,
+        created_at       TEXT NOT NULL,
+        updated_at       TEXT NOT NULL,
+        PRIMARY KEY (session_id, channel)
+      );
+      CREATE INDEX IF NOT EXISTS idx_messaging_by_account ON messaging_bindings(channel, account_id);
+      CREATE INDEX IF NOT EXISTS idx_auth_sessions_expires ON auth_sessions(expires_at);
+      CREATE INDEX IF NOT EXISTS idx_auth_sessions_user ON auth_sessions(user_id);
+    `);
   },
-  {
-    version: 3,
-    name: "drop-goal-state",
-    // Narrowing: drops a table. A pushed platform rolled back to 0.2.9 mid-process would
-    // prepare its goal statements against a table that is gone (its declarative track only
-    // runs at the runtime's own open, never at a platform boot), so this is the first
-    // restart-only migration: refused on the swap path, applied by the runtime's open.
-    swapSafe: false,
-    up(db) {
-      db.exec(`
-        DROP INDEX IF EXISTS idx_goal_session;
-        DROP TABLE IF EXISTS goal_state;
-      `);
-    },
-    // Recreates the table exactly as 0.2.9 declared it — EMPTY. LOSES every goal run ever
-    // recorded (objective, status, budget, used, rounds per run): the rows only ever fed the
-    // banner of a finished goal, and a build with this migration reads the goal file instead.
-    down(db) {
-      db.exec(`
-        CREATE TABLE IF NOT EXISTS goal_state (
-          id          INTEGER PRIMARY KEY AUTOINCREMENT,
-          session_id  TEXT NOT NULL,
-          project_id  TEXT NOT NULL,
-          agent_id    TEXT NOT NULL,
-          objective   TEXT NOT NULL,
-          status      TEXT NOT NULL,
-          budget      INTEGER NOT NULL,
-          used        INTEGER NOT NULL DEFAULT 0,
-          rounds      INTEGER NOT NULL DEFAULT 0,
-          created_at  TEXT NOT NULL,
-          updated_at  TEXT NOT NULL
-        );
-        CREATE INDEX IF NOT EXISTS idx_goal_session ON goal_state(session_id);
-      `);
-    }
+  // LOSES every messaging binding: the channel credentials, the enabled flag and the
+  // last-chat memory all live in the table this drops. The auth_sessions indexes are
+  // derived and cost nothing to lose.
+  down(db) {
+    db.exec(`
+      DROP INDEX IF EXISTS idx_auth_sessions_user;
+      DROP INDEX IF EXISTS idx_auth_sessions_expires;
+      DROP INDEX IF EXISTS idx_messaging_by_account;
+      DROP TABLE IF EXISTS messaging_bindings;
+    `);
+  }
+};
+
+// src/db/migrations/steps/2026-08-31-messaging-delivery-flags.ts
+var messagingDeliveryFlags = {
+  name: "2026-08-31-messaging-delivery-flags",
+  // Two columns with defaults on an existing table: a rollback to a predecessor that
+  // does not know them leaves them at their defaults and reads nothing.
+  swapSafe: true,
+  up(db) {
+    ensureColumn(db, "messaging_bindings", "final_reply_only", "INTEGER NOT NULL DEFAULT 0");
+    ensureColumn(db, "messaging_bindings", "render_markdown", "INTEGER NOT NULL DEFAULT 1");
   },
-  {
-    version: 4,
-    name: "machines",
-    // Three new tables, nothing existing touched: a platform rolled back to one without
-    // machines never queries them. Swap-safe on its own; a database still behind
-    // drop-goal-state is refused whole by that one first, which is the rule.
-    swapSafe: true,
-    up(db) {
-      db.exec(`
-        CREATE TABLE IF NOT EXISTS machine (
-          singleton  INTEGER PRIMARY KEY CHECK (singleton = 1),
-          machine_id TEXT NOT NULL
-        );
-        CREATE TABLE IF NOT EXISTS machines (
-          address      TEXT PRIMARY KEY,
-          machine_id   TEXT,
-          version      TEXT,
-          installed_at TEXT,
-          session_pid  INTEGER,
-          remote_port  INTEGER,
-          platform     TEXT
-        );
-        CREATE TABLE IF NOT EXISTS machine_project (
-          project_id TEXT PRIMARY KEY REFERENCES projects(project_id) ON DELETE CASCADE,
-          addresses  TEXT NOT NULL
-        );
-      `);
-    },
-    // LOSES this server's own machine id (every stored reference to it on other machines
-    // then points at nothing), what was installed where, the sessions held, and which
-    // machines each Project used.
-    down(db) {
-      db.exec(`
-        DROP TABLE IF EXISTS machine_project;
-        DROP TABLE IF EXISTS machines;
-        DROP TABLE IF EXISTS machine;
-      `);
-    }
+  // LOSES both delivery preferences on every binding; the bindings themselves survive.
+  // Dropped in reverse order for symmetry with `up`. Neither column is indexed, which is
+  // what lets SQLite drop them at all.
+  down(db) {
+    db.exec("ALTER TABLE messaging_bindings DROP COLUMN render_markdown");
+    db.exec("ALTER TABLE messaging_bindings DROP COLUMN final_reply_only");
+  }
+};
+
+// src/db/migrations/steps/2026-09-02-drop-goal-state.ts
+var dropGoalState = {
+  name: "2026-09-02-drop-goal-state",
+  // CONTRACT: drops a table no build since 0.2.10 reads. A pushed platform rolled back to
+  // 0.2.9 mid-process would prepare its goal statements against a table that is gone, so it
+  // is left pending on the swap path and applied by the runtime's own open; until then the
+  // table just sits there unused.
+  swapSafe: false,
+  up(db) {
+    db.exec(`
+      DROP INDEX IF EXISTS idx_goal_session;
+      DROP TABLE IF EXISTS goal_state;
+    `);
   },
-  {
-    version: 5,
-    name: "user-profile",
-    // Two nullable columns on `users`, no default and nothing existing rewritten: a platform
-    // rolled back to a predecessor that does not know them never selects or writes them, and
-    // every existing account simply reads NULL — no profile yet.
-    swapSafe: true,
-    up(db) {
-      ensureColumn(db, "users", "display_name", "TEXT");
-      ensureColumn(db, "users", "avatar", "TEXT");
-    },
-    // LOSES every stored nickname and avatar: both live entirely in the two columns this
-    // drops, and nothing else on disk holds a copy. Dropped in reverse order for symmetry
-    // with `up`; neither column is indexed, which is what lets SQLite drop them at all.
-    down(db) {
-      const cols = db.prepare("PRAGMA table_info(users)").all();
-      const has = (name) => cols.some((c) => c.name === name);
-      if (has("avatar")) db.exec("ALTER TABLE users DROP COLUMN avatar");
-      if (has("display_name")) db.exec("ALTER TABLE users DROP COLUMN display_name");
-    }
+  // Recreates the table exactly as 0.2.9 declared it — EMPTY. LOSES every goal run ever
+  // recorded (objective, status, budget, used, rounds per run): the rows only ever fed the
+  // banner of a finished goal, and a build with this migration reads the goal file instead.
+  down(db) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS goal_state (
+        id          INTEGER PRIMARY KEY AUTOINCREMENT,
+        session_id  TEXT NOT NULL,
+        project_id  TEXT NOT NULL,
+        agent_id    TEXT NOT NULL,
+        objective   TEXT NOT NULL,
+        status      TEXT NOT NULL,
+        budget      INTEGER NOT NULL,
+        used        INTEGER NOT NULL DEFAULT 0,
+        rounds      INTEGER NOT NULL DEFAULT 0,
+        created_at  TEXT NOT NULL,
+        updated_at  TEXT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_goal_session ON goal_state(session_id);
+    `);
+  }
+};
+
+// src/db/migrations/steps/2026-09-04-machines.ts
+var machines = {
+  name: "2026-09-04-machines",
+  // Three new tables, nothing existing touched: a platform rolled back to one without
+  // machines never queries them. Swap-safe on its own; a database still behind
+  // 2026-09-02-drop-goal-state is refused whole by that one first, which is the rule.
+  swapSafe: true,
+  up(db) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS machine (
+        singleton  INTEGER PRIMARY KEY CHECK (singleton = 1),
+        machine_id TEXT NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS machines (
+        address      TEXT PRIMARY KEY,
+        machine_id   TEXT,
+        version      TEXT,
+        installed_at TEXT,
+        session_pid  INTEGER,
+        remote_port  INTEGER,
+        platform     TEXT
+      );
+      CREATE TABLE IF NOT EXISTS machine_project (
+        project_id TEXT PRIMARY KEY REFERENCES projects(project_id) ON DELETE CASCADE,
+        addresses  TEXT NOT NULL
+      );
+    `);
   },
-  {
-    version: 6,
-    name: "company-mode-org-caches",
-    // Additive: seven new tables for company mode (organizations of Agents), no change to any
-    // existing table. Every row is either rebuildable from the organization's files (desks.toml,
-    // the tickets' Sessions headers, the calendar files, usage records) or a user's own read
-    // cursor; a predecessor build never touches them.
-    swapSafe: true,
-    up(db) {
-      db.exec(`
-        CREATE TABLE IF NOT EXISTS org_sessions (      -- DERIVED CACHE (company mode): desk sessions, rebuilt from each organization's desks.toml (current + previous); trigger_hop is chat-chain accounting and reads 0 after a rebuild
-          session_id  TEXT PRIMARY KEY,
-          project_id  TEXT NOT NULL,
-          org_id      TEXT NOT NULL,
-          agent_id    TEXT NOT NULL,
-          current     INTEGER NOT NULL DEFAULT 1,
-          trigger_hop INTEGER NOT NULL DEFAULT 0
-        );
-        CREATE INDEX IF NOT EXISTS idx_org_sessions_org ON org_sessions(project_id, org_id);
-        CREATE TABLE IF NOT EXISTS org_ticket_sessions ( -- DERIVED CACHE (company mode): ticket <-> contributing session, rebuilt from each ticket's Sessions header
-          project_id  TEXT NOT NULL,
-          org_id      TEXT NOT NULL,
-          ticket_id   TEXT NOT NULL,
-          session_id  TEXT NOT NULL,
-          agent_id    TEXT NOT NULL,
-          trigger_hop INTEGER NOT NULL DEFAULT 0,
-          PRIMARY KEY (project_id, org_id, ticket_id, session_id)
-        );
-        CREATE INDEX IF NOT EXISTS idx_org_ticket_sessions_session ON org_ticket_sessions(session_id);
-        CREATE TABLE IF NOT EXISTS org_calendar_state ( -- calendar run state (company mode; the files are declarative intent), same rules as schedule_state
-          project_id     TEXT NOT NULL,
-          org_id         TEXT NOT NULL,
-          agent_id       TEXT NOT NULL,
-          name           TEXT NOT NULL,
-          start_at_ms    INTEGER NOT NULL,
-          def_hash       TEXT NOT NULL,
-          last_slot_ms   INTEGER,
-          last_fired_at  TEXT,
-          fired_once     INTEGER NOT NULL DEFAULT 0,
-          missed         INTEGER NOT NULL DEFAULT 0,
-          invalid_reason TEXT,
-          last_outcome   TEXT,
-          PRIMARY KEY (project_id, org_id, agent_id, name)
-        );
-        CREATE TABLE IF NOT EXISTS org_ticket_state (   -- DERIVED CACHE (company mode): the last (status, owner, blocked) seen per ticket, so a change is notified once; rebuilt silently from the ticket files
-          project_id  TEXT NOT NULL,
-          org_id      TEXT NOT NULL,
-          ticket_id   TEXT NOT NULL,
-          status      TEXT NOT NULL,
-          owner       TEXT NOT NULL DEFAULT '',
-          blocked     TEXT NOT NULL DEFAULT '',
-          blocked_by  TEXT NOT NULL DEFAULT '',
-          PRIMARY KEY (project_id, org_id, ticket_id)
-        );
-        CREATE TABLE IF NOT EXISTS org_chat_state (     -- DERIVED CACHE (company mode): tail-scan byte cursor per chat day file
-          project_id   TEXT NOT NULL,
-          org_id       TEXT NOT NULL,
-          date         TEXT NOT NULL,
-          offset_bytes INTEGER NOT NULL DEFAULT 0,
-          PRIMARY KEY (project_id, org_id, date)
-        );
-        CREATE TABLE IF NOT EXISTS org_chat_reads (     -- user data (company mode): each user's read cursor in an organization's chat
-          project_id   TEXT NOT NULL,
-          org_id       TEXT NOT NULL,
-          user_id      TEXT NOT NULL,
-          last_read_id TEXT NOT NULL,
-          PRIMARY KEY (project_id, org_id, user_id)
-        );
-        CREATE TABLE IF NOT EXISTS org_budget_state (   -- DERIVED CACHE (company mode): warn / pause marks per employee and period, recomputed from usage and the chart's budgets
-          project_id TEXT NOT NULL,
-          org_id     TEXT NOT NULL,
-          agent_id   TEXT NOT NULL,
-          period     TEXT NOT NULL,
-          warned_at  TEXT,
-          paused_at  TEXT,
-          PRIMARY KEY (project_id, org_id, agent_id, period)
-        );
-      `);
-    },
-    // Drops the seven tables. LOSES: chat read cursors (each user's "read up to here" marks) and
-    // the run marks that stop a calendar slot, a ticket change or a budget alert from firing
-    // twice — a build with this migration re-registers everything from the files, without
-    // backfilling missed slots, and users see every chat message as unread once.
-    down(db) {
-      db.exec(`
-        DROP INDEX IF EXISTS idx_org_ticket_sessions_session;
-        DROP INDEX IF EXISTS idx_org_sessions_org;
-        DROP TABLE IF EXISTS org_budget_state;
-        DROP TABLE IF EXISTS org_chat_reads;
-        DROP TABLE IF EXISTS org_chat_state;
-        DROP TABLE IF EXISTS org_ticket_state;
-        DROP TABLE IF EXISTS org_calendar_state;
-        DROP TABLE IF EXISTS org_ticket_sessions;
-        DROP TABLE IF EXISTS org_sessions;
-      `);
-    }
+  // LOSES this server's own machine id (every stored reference to it on other machines
+  // then points at nothing), what was installed where, the sessions held, and which
+  // machines each Project used.
+  down(db) {
+    db.exec(`
+      DROP TABLE IF EXISTS machine_project;
+      DROP TABLE IF EXISTS machines;
+      DROP TABLE IF EXISTS machine;
+    `);
+  }
+};
+
+// src/db/migrations/steps/2026-09-14-user-profile.ts
+var userProfile = {
+  name: "2026-09-14-user-profile",
+  // Two nullable columns on `users`, no default and nothing existing rewritten: a platform
+  // rolled back to a predecessor that does not know them never selects or writes them, and
+  // every existing account simply reads NULL — no profile yet.
+  swapSafe: true,
+  up(db) {
+    ensureColumn(db, "users", "display_name", "TEXT");
+    ensureColumn(db, "users", "avatar", "TEXT");
   },
-  {
-    version: 7,
-    name: "company-mode-channels",
-    // The organization's single group chat became channels: a message lives in
-    // `channels/<channel_id>/<date>.jsonl`, so the tail-scan cursor and each user's read
-    // cursor are per channel. `org_chat_state` / `org_chat_reads` are dropped for
-    // `org_channel_state` / `org_channel_reads`: the tables are renamed and the channel
-    // belongs in the primary key, neither of which SQLite does in place. Nothing is carried
-    // over: company mode is unreleased, and every row was either rebuildable from the files
-    // (the scan cursor) or one pass of "everything looks unread" (the read cursor). A
-    // predecessor build reads neither table's shape, only its own writes, so this is
-    // swap-safe.
-    swapSafe: true,
-    up(db) {
-      db.exec(`
-        DROP TABLE IF EXISTS org_chat_state;
-        DROP TABLE IF EXISTS org_chat_reads;
-        CREATE TABLE IF NOT EXISTS org_channel_state ( -- DERIVED CACHE (company mode): tail-scan byte cursor per channel and day file
-          project_id   TEXT NOT NULL,
-          org_id       TEXT NOT NULL,
-          channel_id   TEXT NOT NULL,
-          date         TEXT NOT NULL,
-          offset_bytes INTEGER NOT NULL DEFAULT 0,
-          PRIMARY KEY (project_id, org_id, channel_id, date)
-        );
-        CREATE TABLE IF NOT EXISTS org_channel_reads ( -- user data (company mode): each user's read cursor in one channel
-          project_id   TEXT NOT NULL,
-          org_id       TEXT NOT NULL,
-          channel_id   TEXT NOT NULL,
-          user_id      TEXT NOT NULL,
-          last_read_id TEXT NOT NULL,
-          PRIMARY KEY (project_id, org_id, channel_id, user_id)
-        );
-      `);
-    },
-    // Recreates the two tables under their old names, exactly as migration 6 declared them —
-    // EMPTY. LOSES every scan cursor (re-derived by the next pass, which republishes the
-    // messages it re-reads) and every read cursor (users see the recent days as unread once).
-    down(db) {
+  // LOSES every stored nickname and avatar: both live entirely in the two columns this
+  // drops, and nothing else on disk holds a copy. Dropped in reverse order for symmetry
+  // with `up`; neither column is indexed, which is what lets SQLite drop them at all.
+  down(db) {
+    const cols = db.prepare("PRAGMA table_info(users)").all();
+    const has = (name) => cols.some((c) => c.name === name);
+    if (has("avatar")) db.exec("ALTER TABLE users DROP COLUMN avatar");
+    if (has("display_name")) db.exec("ALTER TABLE users DROP COLUMN display_name");
+  }
+};
+
+// src/db/migrations/steps/2026-09-16-company-mode-channels.ts
+var companyModeChannels = {
+  name: "2026-09-16-company-mode-channels",
+  // The organization's single group chat became channels: a message lives in
+  // `channels/<channel_id>/<date>.jsonl`, so the tail-scan cursor and each user's read
+  // cursor are per channel. `org_chat_state` / `org_chat_reads` are dropped for
+  // `org_channel_state` / `org_channel_reads`: the tables are renamed and the channel
+  // belongs in the primary key, neither of which SQLite does in place. Nothing is carried
+  // over: company mode is unreleased, and every row was either rebuildable from the files
+  // (the scan cursor) or one pass of "everything looks unread" (the read cursor). A
+  // predecessor build reads neither table's shape, only its own writes, so this is
+  // swap-safe.
+  //
+  // By the expand / contract rule (migration.ts) the two DROPs are a contract, and this is the
+  // one expand that removes anything on the swap path. It stays an expand because it is frozen
+  // and cannot be deferred: the same step creates the channel tables a pushed platform needs.
+  // A new change of this kind is split into an expand and a later contract instead.
+  swapSafe: true,
+  up(db) {
+    db.exec(`
+      DROP TABLE IF EXISTS org_chat_state;
+      DROP TABLE IF EXISTS org_chat_reads;
+      CREATE TABLE IF NOT EXISTS org_channel_state ( -- DERIVED CACHE (company mode): tail-scan byte cursor per channel and day file
+        project_id   TEXT NOT NULL,
+        org_id       TEXT NOT NULL,
+        channel_id   TEXT NOT NULL,
+        date         TEXT NOT NULL,
+        offset_bytes INTEGER NOT NULL DEFAULT 0,
+        PRIMARY KEY (project_id, org_id, channel_id, date)
+      );
+      CREATE TABLE IF NOT EXISTS org_channel_reads ( -- user data (company mode): each user's read cursor in one channel
+        project_id   TEXT NOT NULL,
+        org_id       TEXT NOT NULL,
+        channel_id   TEXT NOT NULL,
+        user_id      TEXT NOT NULL,
+        last_read_id TEXT NOT NULL,
+        PRIMARY KEY (project_id, org_id, channel_id, user_id)
+      );
+    `);
+  },
+  // Recreates the two tables under their old names, exactly as 2026-09-16-company-mode-org-caches declared them —
+  // EMPTY. LOSES every scan cursor (re-derived by the next pass, which republishes the
+  // messages it re-reads) and every read cursor (users see the recent days as unread once).
+  down(db) {
+    db.exec(`
+      DROP TABLE IF EXISTS org_channel_state;
+      DROP TABLE IF EXISTS org_channel_reads;
+      CREATE TABLE IF NOT EXISTS org_chat_state (     -- DERIVED CACHE (company mode): tail-scan byte cursor per chat day file
+        project_id   TEXT NOT NULL,
+        org_id       TEXT NOT NULL,
+        date         TEXT NOT NULL,
+        offset_bytes INTEGER NOT NULL DEFAULT 0,
+        PRIMARY KEY (project_id, org_id, date)
+      );
+      CREATE TABLE IF NOT EXISTS org_chat_reads ( -- user data (company mode): each user's read cursor in an organization's chat
+        project_id   TEXT NOT NULL,
+        org_id       TEXT NOT NULL,
+        user_id      TEXT NOT NULL,
+        last_read_id TEXT NOT NULL,
+        PRIMARY KEY (project_id, org_id, user_id)
+      );
+    `);
+  }
+};
+
+// src/db/migrations/steps/2026-09-16-company-mode-desk-notices.ts
+var companyModeDeskNotices = {
+  name: "2026-09-16-company-mode-desk-notices",
+  // Additive: one new table and its index. A ticket change no longer starts a work run at
+  // the owner's desk; it is queued here and delivered inside the body of that employee's
+  // next calendar sweep. A predecessor build never reads the table, so a rollback survives
+  // it — with whatever rows are in it left undelivered.
+  swapSafe: true,
+  up(db) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS org_desk_notices (   -- DERIVED CACHE (company mode): ticket changes waiting for an employee's next calendar sweep; dropping it loses only the digests not delivered yet
+        seq        INTEGER PRIMARY KEY AUTOINCREMENT,
+        project_id TEXT NOT NULL,
+        org_id     TEXT NOT NULL,
+        agent_id   TEXT NOT NULL,
+        ticket_id  TEXT NOT NULL,
+        change     TEXT NOT NULL,
+        at         TEXT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_org_desk_notices_agent ON org_desk_notices(project_id, org_id, agent_id);
+    `);
+  },
+  // LOSES every queued notice: the ticket changes an employee has not been told about yet.
+  // The change itself is in the ticket file and its history either way; what
+  // goes is the "Since your last sweep" line that would have named it.
+  down(db) {
+    db.exec(`
+      DROP INDEX IF EXISTS idx_org_desk_notices_agent;
+      DROP TABLE IF EXISTS org_desk_notices;
+    `);
+  }
+};
+
+// src/db/migrations/steps/2026-09-16-company-mode-org-caches.ts
+var companyModeOrgCaches = {
+  name: "2026-09-16-company-mode-org-caches",
+  // Additive: seven new tables for company mode (organizations of Agents), no change to any
+  // existing table. Every row is either rebuildable from the organization's files (desks.toml,
+  // the tickets' Sessions headers, the calendar files, usage records) or a user's own read
+  // cursor; a predecessor build never touches them.
+  swapSafe: true,
+  up(db) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS org_sessions (      -- DERIVED CACHE (company mode): desk sessions, rebuilt from each organization's desks.toml (current + previous); trigger_hop is chat-chain accounting and reads 0 after a rebuild
+        session_id  TEXT PRIMARY KEY,
+        project_id  TEXT NOT NULL,
+        org_id      TEXT NOT NULL,
+        agent_id    TEXT NOT NULL,
+        current     INTEGER NOT NULL DEFAULT 1,
+        trigger_hop INTEGER NOT NULL DEFAULT 0
+      );
+      CREATE INDEX IF NOT EXISTS idx_org_sessions_org ON org_sessions(project_id, org_id);
+      CREATE TABLE IF NOT EXISTS org_ticket_sessions ( -- DERIVED CACHE (company mode): ticket <-> contributing session, rebuilt from each ticket's Sessions header
+        project_id  TEXT NOT NULL,
+        org_id      TEXT NOT NULL,
+        ticket_id   TEXT NOT NULL,
+        session_id  TEXT NOT NULL,
+        agent_id    TEXT NOT NULL,
+        trigger_hop INTEGER NOT NULL DEFAULT 0,
+        PRIMARY KEY (project_id, org_id, ticket_id, session_id)
+      );
+      CREATE INDEX IF NOT EXISTS idx_org_ticket_sessions_session ON org_ticket_sessions(session_id);
+      CREATE TABLE IF NOT EXISTS org_calendar_state ( -- calendar run state (company mode; the files are declarative intent), same rules as schedule_state
+        project_id     TEXT NOT NULL,
+        org_id         TEXT NOT NULL,
+        agent_id       TEXT NOT NULL,
+        name           TEXT NOT NULL,
+        start_at_ms    INTEGER NOT NULL,
+        def_hash       TEXT NOT NULL,
+        last_slot_ms   INTEGER,
+        last_fired_at  TEXT,
+        fired_once     INTEGER NOT NULL DEFAULT 0,
+        missed         INTEGER NOT NULL DEFAULT 0,
+        invalid_reason TEXT,
+        last_outcome   TEXT,
+        PRIMARY KEY (project_id, org_id, agent_id, name)
+      );
+      CREATE TABLE IF NOT EXISTS org_ticket_state (   -- DERIVED CACHE (company mode): the last (status, owner, blocked) seen per ticket, so a change is notified once; rebuilt silently from the ticket files
+        project_id  TEXT NOT NULL,
+        org_id      TEXT NOT NULL,
+        ticket_id   TEXT NOT NULL,
+        status      TEXT NOT NULL,
+        owner       TEXT NOT NULL DEFAULT '',
+        blocked     TEXT NOT NULL DEFAULT '',
+        blocked_by  TEXT NOT NULL DEFAULT '',
+        PRIMARY KEY (project_id, org_id, ticket_id)
+      );
+      CREATE TABLE IF NOT EXISTS org_budget_state (   -- DERIVED CACHE (company mode): warn / pause marks per employee and period, recomputed from usage and the chart's budgets
+        project_id TEXT NOT NULL,
+        org_id     TEXT NOT NULL,
+        agent_id   TEXT NOT NULL,
+        period     TEXT NOT NULL,
+        warned_at  TEXT,
+        paused_at  TEXT,
+        PRIMARY KEY (project_id, org_id, agent_id, period)
+      );
+    `);
+    const superseded = db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'org_channel_state'").get() !== void 0;
+    if (!superseded) {
       db.exec(`
-        DROP TABLE IF EXISTS org_channel_state;
-        DROP TABLE IF EXISTS org_channel_reads;
         CREATE TABLE IF NOT EXISTS org_chat_state (     -- DERIVED CACHE (company mode): tail-scan byte cursor per chat day file
           project_id   TEXT NOT NULL,
           org_id       TEXT NOT NULL,
@@ -304,7 +375,7 @@ var MIGRATIONS = [
           offset_bytes INTEGER NOT NULL DEFAULT 0,
           PRIMARY KEY (project_id, org_id, date)
         );
-        CREATE TABLE IF NOT EXISTS org_chat_reads ( -- user data (company mode): each user's read cursor in an organization's chat
+        CREATE TABLE IF NOT EXISTS org_chat_reads (     -- user data (company mode): each user's read cursor in an organization's chat
           project_id   TEXT NOT NULL,
           org_id       TEXT NOT NULL,
           user_id      TEXT NOT NULL,
@@ -314,168 +385,203 @@ var MIGRATIONS = [
       `);
     }
   },
-  {
-    version: 8,
-    name: "company-mode-desk-notices",
-    // Additive: one new table and its index. A ticket change no longer starts a work run at
-    // the owner's desk; it is queued here and delivered inside the body of that employee's
-    // next calendar sweep. A predecessor build never reads the table, so a rollback survives
-    // it — with whatever rows are in it left undelivered.
-    swapSafe: true,
-    up(db) {
-      db.exec(`
-        CREATE TABLE IF NOT EXISTS org_desk_notices (   -- DERIVED CACHE (company mode): ticket changes waiting for an employee's next calendar sweep; dropping it loses only the digests not delivered yet
-          seq        INTEGER PRIMARY KEY AUTOINCREMENT,
-          project_id TEXT NOT NULL,
-          org_id     TEXT NOT NULL,
-          agent_id   TEXT NOT NULL,
-          ticket_id  TEXT NOT NULL,
-          change     TEXT NOT NULL,
-          at         TEXT NOT NULL
-        );
-        CREATE INDEX IF NOT EXISTS idx_org_desk_notices_agent ON org_desk_notices(project_id, org_id, agent_id);
-      `);
-    },
-    // LOSES every queued notice: the ticket changes an employee has not been told about yet.
-    // The change itself is in the ticket file and its history either way; what
-    // goes is the "Since your last sweep" line that would have named it.
-    down(db) {
-      db.exec(`
-        DROP INDEX IF EXISTS idx_org_desk_notices_agent;
-        DROP TABLE IF EXISTS org_desk_notices;
-      `);
-    }
+  // Drops the seven tables. LOSES: chat read cursors (each user's "read up to here" marks) and
+  // the run marks that stop a calendar slot, a ticket change or a budget alert from firing
+  // twice — a build with this migration re-registers everything from the files, without
+  // backfilling missed slots, and users see every chat message as unread once.
+  down(db) {
+    db.exec(`
+      DROP INDEX IF EXISTS idx_org_ticket_sessions_session;
+      DROP INDEX IF EXISTS idx_org_sessions_org;
+      DROP TABLE IF EXISTS org_budget_state;
+      DROP TABLE IF EXISTS org_chat_reads;
+      DROP TABLE IF EXISTS org_chat_state;
+      DROP TABLE IF EXISTS org_ticket_state;
+      DROP TABLE IF EXISTS org_calendar_state;
+      DROP TABLE IF EXISTS org_ticket_sessions;
+      DROP TABLE IF EXISTS org_sessions;
+    `);
+  }
+};
+
+// src/db/migrations/steps/2026-09-17-model-promotions.ts
+var modelPromotions = {
+  name: "2026-09-17-model-promotions",
+  // Additive: one new table, nothing existing touched. A predecessor build never reads it
+  // and prices every row at the number in its Project file, so a rollback survives it.
+  swapSafe: true,
+  up(db) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS model_promotions ( -- NOT a cache rebuildable from files: the only record of a Project row's running promotion (.project_config.toml keeps the list price), written by preset seeding at Project creation, "sync presets" and Penguin Go authorization / sync, and read by cost; lost rows price usage at list until the next sync writes them back
+        project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+        provider   TEXT NOT NULL,
+        model_id   TEXT NOT NULL,
+        discount   REAL NOT NULL CHECK (discount > 0 AND discount < 1),
+        updated_at TEXT NOT NULL,
+        PRIMARY KEY (project_id, provider, model_id)
+      );
+    `);
   },
-  {
-    version: 9,
-    name: "model-promotions",
-    // Additive: one new table, nothing existing touched. A predecessor build never reads it
-    // and prices every row at the number in its Project file, so a rollback survives it.
-    swapSafe: true,
-    up(db) {
-      db.exec(`
-        CREATE TABLE IF NOT EXISTS model_promotions ( -- NOT a cache rebuildable from files: the only record of a Project row's running promotion (.project_config.toml keeps the list price), written by preset seeding at Project creation, "sync presets" and Penguin Go authorization / sync, and read by cost; lost rows price usage at list until the next sync writes them back
-          project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
-          provider   TEXT NOT NULL,
-          model_id   TEXT NOT NULL,
-          discount   REAL NOT NULL CHECK (discount > 0 AND discount < 1),
-          updated_at TEXT NOT NULL,
-          PRIMARY KEY (project_id, provider, model_id)
-        );
-      `);
-    },
-    // LOSES every stored promotion: no file holds a copy of the fractions, so usage is priced
-    // at the Project files' list prices until the next "sync presets" or Penguin Go sync
-    // writes them back.
-    down(db) {
-      db.exec("DROP TABLE IF EXISTS model_promotions");
-    }
+  // LOSES every stored promotion: no file holds a copy of the fractions, so usage is priced
+  // at the Project files' list prices until the next "sync presets" or Penguin Go sync
+  // writes them back.
+  down(db) {
+    db.exec("DROP TABLE IF EXISTS model_promotions");
+  }
+};
+
+// src/db/migrations/steps/2026-09-21-model-provider-auth-tokens.ts
+var modelProviderAuthTokens = {
+  name: "2026-09-21-model-provider-auth-tokens",
+  // Additive: one new table, nothing existing touched. A predecessor build never reads it;
+  // the access token already written into .project_config.toml keeps working until it
+  // expires, so rollback only loses silent refresh state.
+  // KEEP until every supported upgrade starts from a database that already has this table.
+  // The release that raises the minimum database baseline past it owns removing this
+  // migration and its fixture; the table itself remains while provider token refresh uses it.
+  swapSafe: true,
+  up(db) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS model_provider_auth_tokens ( -- Server-side OAuth refresh metadata for provider groups. The current request token remains in .project_config.toml as api_key; this table holds only the refresh material that must never be returned to the frontend or written into Project files.
+        project_id              TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+        provider                TEXT NOT NULL,
+        refresh_token           TEXT NOT NULL,
+        access_token_expires_at TEXT,
+        updated_at              TEXT NOT NULL,
+        PRIMARY KEY (project_id, provider)
+      );
+    `);
   },
-  {
-    version: 10,
-    name: "model-provider-auth-tokens",
-    // Additive: one new table, nothing existing touched. A predecessor build never reads it;
-    // the access token already written into .project_config.toml keeps working until it
-    // expires, so rollback only loses silent refresh state.
-    // KEEP until every supported upgrade starts from schema 10 or newer. The release that
-    // raises the minimum database baseline past 9 owns removing this migration block and its
-    // version-9 fixture; the table itself remains while provider token refresh uses it.
-    swapSafe: true,
-    up(db) {
-      db.exec(`
-        CREATE TABLE IF NOT EXISTS model_provider_auth_tokens ( -- Server-side OAuth refresh metadata for provider groups. The current request token remains in .project_config.toml as api_key; this table holds only the refresh material that must never be returned to the frontend or written into Project files.
-          project_id              TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
-          provider                TEXT NOT NULL,
-          refresh_token           TEXT NOT NULL,
-          access_token_expires_at TEXT,
-          updated_at              TEXT NOT NULL,
-          PRIMARY KEY (project_id, provider)
-        );
-      `);
-    },
-    // LOSES every stored refresh token and access-token expiry. Existing access tokens in
-    // Project files remain until they expire; users re-authorize to restore silent refresh.
-    down(db) {
-      db.exec("DROP TABLE IF EXISTS model_provider_auth_tokens");
-    }
+  // LOSES every stored refresh token and access-token expiry. Existing access tokens in
+  // Project files remain until they expire; users re-authorize to restore silent refresh.
+  down(db) {
+    db.exec("DROP TABLE IF EXISTS model_provider_auth_tokens");
+  }
+};
+
+// src/db/migrations/steps/2026-09-22-sessions-sandbox.ts
+var sessionsSandbox = {
+  name: "2026-09-22-sessions-sandbox",
+  // The Session's own sandbox policy (JSON), snapshotted from the server's settings when
+  // the Session is created, so a later settings change leaves running Sessions alone.
+  // NULL = a row from before this column: it takes the settings in force at its next
+  // command and keeps them from then on. Swap-safe: a pushed platform boots against the
+  // runtime's already-open database, so the column has to arrive by a migration.
+  swapSafe: true,
+  up(db) {
+    ensureColumn(db, "sessions", "sandbox", "TEXT");
   },
-  {
-    version: 11,
-    name: "sessions-sandbox",
-    // The Session's own sandbox policy (JSON), snapshotted from the server's settings when
-    // the Session is created, so a later settings change leaves running Sessions alone.
-    // NULL = a row from before this column: it takes the settings in force at its next
-    // command and keeps them from then on. Swap-safe: a pushed platform boots against the
-    // runtime's already-open database, so the column has to arrive by a migration.
-    swapSafe: true,
-    up(db) {
-      ensureColumn(db, "sessions", "sandbox", "TEXT");
-    },
-    // Not a DROP: schema.ts declares the column, and dropping it would put every Session
-    // back under whatever the settings say.
-    down() {
-    }
+  // Not a DROP: schema.ts declares the column, and dropping it would put every Session
+  // back under whatever the settings say.
+  down() {
+  }
+};
+
+// src/db/migrations/steps/2026-09-23-machines-columns.ts
+var machinesColumns = {
+  name: "2026-09-23-machines-columns",
+  // A machines table can predate `machines` — a data root that ran the machines line
+  // before it was released kept forwards, not sessions — and that migration's IF NOT
+  // EXISTS adopted it whatever its columns were, so the first connect failed on the row's
+  // insert. Adds what is missing, nullable; a platform rolled back to `machines` declared these
+  // columns itself, so there is nothing for it to mind.
+  swapSafe: true,
+  up(db) {
+    ensureColumn(db, "machines", "session_pid", "INTEGER");
+    ensureColumn(db, "machines", "platform", "TEXT");
   },
-  {
-    version: 12,
-    name: "machines-columns",
-    // A machines table can predate migration 4 — a data root that ran the machines line
-    // before it was released kept forwards, not sessions — and that migration's IF NOT
-    // EXISTS adopted it whatever its columns were, so the first connect failed on the row's
-    // insert. Adds what is missing, nullable; a platform rolled back to 4 declared these
-    // columns itself, so there is nothing for it to mind.
-    swapSafe: true,
-    up(db) {
-      ensureColumn(db, "machines", "session_pid", "INTEGER");
-      ensureColumn(db, "machines", "platform", "TEXT");
-    },
-    // Nothing to undo: what this added, 4 already declares, and a column it found in place
-    // was never this migration's to take away.
-    down() {
-    }
+  // Nothing to undo: what this added, `machines` already declares, and a column it found in place
+  // was never this migration's to take away.
+  down() {
+  }
+};
+
+// src/db/migrations/steps/2026-09-23-model-tables-adoption.ts
+var modelTablesAdoption = {
+  name: "2026-09-23-model-tables-adoption",
+  // A data root that ran the chain before it was restacked onto main (2026-09-23) is
+  // stamped 16 under THAT line's numbering, where 9 and 10 were 2026-09-22-sessions-sandbox and
+  // 2026-09-23-machines-columns. This line numbers main's 2026-09-17-model-promotions and
+  // 2026-09-21-model-provider-auth-tokens 9 and 10 and everything after them two higher, so such a
+  // root reads both as already applied, reaches 18 without `model_promotions` or
+  // `model_provider_auth_tokens`, and answers 500 wherever cost or provider auth reads
+  // them (the models page, an organization's overview). Seen on the release instance at
+  // the first push of the restacked line.
+  //
+  // Re-runs 9's and 10's own `up` — the frozen DDL, both `IF NOT EXISTS`, so a root that
+  // took them in their proper place finds its work done. The ledger ended the numbering
+  // hazard: adopting a numbered root runs 2026-09-17-model-promotions and 2026-09-21-model-provider-auth-tokens
+  // themselves. Remove together with the ledger's adoption of numbered roots (index.ts).
+  swapSafe: true,
+  up(db) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS model_promotions (
+        project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+        provider   TEXT NOT NULL,
+        model_id   TEXT NOT NULL,
+        discount   REAL NOT NULL CHECK (discount > 0 AND discount < 1),
+        updated_at TEXT NOT NULL,
+        PRIMARY KEY (project_id, provider, model_id)
+      );
+      CREATE TABLE IF NOT EXISTS model_provider_auth_tokens (
+        project_id              TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+        provider                TEXT NOT NULL,
+        refresh_token           TEXT NOT NULL,
+        access_token_expires_at TEXT,
+        updated_at              TEXT NOT NULL,
+        PRIMARY KEY (project_id, provider)
+      );
+    `);
   },
-  {
-    version: 13,
-    name: "browser-extensions",
-    // Additive: one new table and its index. The Chrome backend's pairings — one row per
-    // PenguinHarness Browser extension a user paired, its token stored hashed. A predecessor
-    // build never reads the table, so a rollback survives it; the paired extensions then simply
-    // fail to connect until a build that knows them is back.
-    swapSafe: true,
-    up(db) {
-      db.exec(`
-        CREATE TABLE IF NOT EXISTS browser_extensions ( -- one row per Chrome paired to a user (builtin-browser/extension-pairing.ts): the PenguinHarness Browser extension's long-lived credential, stored only hashed; NOT rebuildable \u2014 a lost row means pairing that Chrome again
-          extension_id TEXT PRIMARY KEY,
-          user_id      TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
-          token_hash   TEXT NOT NULL UNIQUE,
-          name         TEXT NOT NULL,
-          version      TEXT NOT NULL,
-          created_at   TEXT NOT NULL,
-          last_seen_at TEXT,
-          revoked_at   TEXT
-        );
-        CREATE INDEX IF NOT EXISTS idx_browser_extensions_user ON browser_extensions(user_id);
-      `);
-    },
-    // LOSES every pairing: each user's Chrome has to be paired again (a new code from the
-    // Browser panel) before agents can drive it.
-    down(db) {
-      db.exec(`
-        DROP INDEX IF EXISTS idx_browser_extensions_user;
-        DROP TABLE IF EXISTS browser_extensions;
-      `);
-    }
+  // Nothing to undo: the tables are 2026-09-17-model-promotions' and 2026-09-21-model-provider-auth-tokens', and
+  // their own downs drop them.
+  down() {
+  }
+};
+
+// src/db/migrations/steps/2026-10-04-browser-extensions.ts
+var browserExtensions = {
+  name: "2026-10-04-browser-extensions",
+  // Additive: one new table and its index. The Chrome backend's pairings — one row per
+  // PenguinHarness Browser extension a user paired, its token stored hashed. A predecessor
+  // build never reads the table, so a rollback survives it; the paired extensions then simply
+  // fail to connect until a build that knows them is back.
+  swapSafe: true,
+  up(db) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS browser_extensions ( -- one row per Chrome paired to a user (builtin-browser/extension-pairing.ts): the PenguinHarness Browser extension's long-lived credential, stored only hashed; NOT rebuildable \u2014 a lost row means pairing that Chrome again
+        extension_id TEXT PRIMARY KEY,
+        user_id      TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
+        token_hash   TEXT NOT NULL UNIQUE,
+        name         TEXT NOT NULL,
+        version      TEXT NOT NULL,
+        created_at   TEXT NOT NULL,
+        last_seen_at TEXT,
+        revoked_at   TEXT
+      );
+      CREATE INDEX IF NOT EXISTS idx_browser_extensions_user ON browser_extensions(user_id);
+    `);
   },
-  {
-    version: 14,
-    name: "agent-api",
-    // Additive: two new tables and an index. The Agent API's per-Agent settings (the switch,
-    // keyless access, the approval mode API Sessions are created with) and its keys, stored
-    // hashed. A predecessor build never reads them and serves no /api/amsp route, so a
-    // rollback survives it: callers get 404 until a build that knows the tables is back.
-    swapSafe: true,
-    up(db) {
-      db.exec(`
+  // LOSES every pairing: each user's Chrome has to be paired again (a new code from the
+  // Browser panel) before agents can drive it.
+  down(db) {
+    db.exec(`
+      DROP INDEX IF EXISTS idx_browser_extensions_user;
+      DROP TABLE IF EXISTS browser_extensions;
+    `);
+  }
+};
+
+// src/db/migrations/steps/2026-10-10-agent-api.ts
+var agentApi = {
+  name: "2026-10-10-agent-api",
+  // Additive: two new tables and an index. The Agent API's per-Agent settings (the switch,
+  // keyless access, the approval mode API Sessions are created with) and its keys, stored
+  // hashed. A predecessor build never reads them and serves no /api/amsp route, so a
+  // rollback survives it: callers get 404 until a build that knows the tables is back.
+  swapSafe: true,
+  up(db) {
+    db.exec(`
         CREATE TABLE IF NOT EXISTS agent_api (          -- per-Agent public API settings (amsp/routes.ts); NOT rebuildable from files
           project_id    TEXT NOT NULL,
           agent_id      TEXT NOT NULL,
@@ -498,98 +604,141 @@ var MIGRATIONS = [
         );
         CREATE INDEX IF NOT EXISTS idx_agent_api_keys_agent ON agent_api_keys(project_id, agent_id);
       `);
-    },
-    // LOSES every Agent's API settings and every key: each exposed Agent reads as disabled
-    // again (404 to its callers), and every caller needs a newly created key once it is back
-    // on — no file holds a copy of either.
-    down(db) {
-      db.exec(`
+  },
+  // LOSES every Agent's API settings and every key: each exposed Agent reads as disabled
+  // again (404 to its callers), and every caller needs a newly created key once it is back
+  // on — no file holds a copy of either.
+  down(db) {
+    db.exec(`
         DROP INDEX IF EXISTS idx_agent_api_keys_agent;
         DROP TABLE IF EXISTS agent_api_keys;
         DROP TABLE IF EXISTS agent_api;
       `);
-    }
+  }
+};
+
+// src/db/migrations/steps/2026-10-12-messaging-conversations.ts
+var messagingConversations = {
+  name: "2026-10-12-messaging-conversations",
+  // Additive: one new table. The WeChat connector's per-(bot, user) delivery state — the
+  // context token every send must echo, how many sends it has funded, and replies held for
+  // the user's next message. A predecessor build never reads it and keeps its tokens in
+  // memory as it always did, so a rollback survives it.
+  swapSafe: true,
+  up(db) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS messaging_conversations ( -- per-(bot, chat) delivery state a connector must keep across reconnects and restarts (WeChat: the context token, its send count, held replies); deleted once no messaging_bindings row references (channel, account_id) \u2014 see MessagingBindingsRepo
+        channel    TEXT NOT NULL,
+        account_id TEXT NOT NULL,
+        chat_id    TEXT NOT NULL,
+        state_json TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        PRIMARY KEY (channel, account_id, chat_id)
+      );
+    `);
   },
-  {
-    version: 15,
-    name: "messaging-conversations",
-    // Additive: one new table. The WeChat connector's per-(bot, user) delivery state — the
-    // context token every send must echo, how many sends it has funded, and replies held for
-    // the user's next message. A predecessor build never reads it and keeps its tokens in
-    // memory as it always did, so a rollback survives it.
-    swapSafe: true,
-    up(db) {
-      db.exec(`
-        CREATE TABLE IF NOT EXISTS messaging_conversations ( -- per-(bot, chat) delivery state a connector must keep across reconnects and restarts (WeChat: the context token, its send count, held replies); deleted once no messaging_bindings row references (channel, account_id) \u2014 see MessagingBindingsRepo
-          channel    TEXT NOT NULL,
-          account_id TEXT NOT NULL,
-          chat_id    TEXT NOT NULL,
-          state_json TEXT NOT NULL,
-          updated_at TEXT NOT NULL,
-          PRIMARY KEY (channel, account_id, chat_id)
-        );
-      `);
-    },
-    // LOSES every stored context token and every held reply: replies sent before each user's
-    // next message are refused again, and what was held never arrives.
-    down(db) {
-      db.exec("DROP TABLE IF EXISTS messaging_conversations");
-    }
+  // LOSES every stored context token and every held reply: replies sent before each user's
+  // next message are refused again, and what was held never arrives.
+  down(db) {
+    db.exec("DROP TABLE IF EXISTS messaging_conversations");
+  }
+};
+
+// src/db/migrations/steps/2026-10-12-sessions-kept-at.ts
+var sessionsKeptAt = {
+  name: "2026-10-12-sessions-kept-at",
+  // The "keep in sidebar" mark: written when the user unarchives a Session, cleared when they
+  // archive it. The listing rule files a background Session (api / schedule / cli) away unless
+  // it carries the mark, so existing rows are listed by the rule as they stand and nothing is
+  // rewritten. Swap-safe: a pushed platform boots against the runtime's already-open database,
+  // so the column has to arrive by a migration.
+  swapSafe: true,
+  up(db) {
+    ensureColumn(db, "sessions", "kept_at", "TEXT");
   },
-  {
-    version: 16,
-    name: "sessions-kept-at",
-    // The "keep in sidebar" mark: written when the user unarchives a Session, cleared when they
-    // archive it. The listing rule files a background Session (api / schedule / cli) away unless
-    // it carries the mark, so existing rows are listed by the rule as they stand and nothing is
-    // rewritten. Swap-safe: a pushed platform boots against the runtime's already-open database,
-    // so the column has to arrive by a migration.
-    swapSafe: true,
-    up(db) {
-      ensureColumn(db, "sessions", "kept_at", "TEXT");
-    },
-    // Not a DROP: schema.ts declares the column, and dropping it would file every kept
-    // background Session away again.
-    down() {
-    }
+  // Not a DROP: schema.ts declares the column, and dropping it would file every kept
+  // background Session away again.
+  down() {
   }
-];
-var LATEST_VERSION = MIGRATIONS.reduce((n, m) => Math.max(n, m.version), 0);
-function schemaVersion(db) {
-  const row = db.prepare("PRAGMA user_version").get();
-  return row?.user_version ?? 0;
-}
-var RestartRequiredError = class extends Error {
-  constructor(migration) {
-    super(
-      `migration ${migration.version} (${migration.name}) is restart-only and cannot be applied while a pushed platform boots: it is not safe to leave behind if this boot is rolled back. Restart the runtime on a build that carries it, then push again.`
-    );
-    this.migration = migration;
-    this.name = "RestartRequiredError";
+};
+
+// src/db/migrations/steps/2026-10-14-agent-api-concurrency.ts
+var agentApiConcurrency = {
+  name: "2026-10-14-agent-api-concurrency",
+  // How many of an Agent API Agent's runs may be live at once.
+  // Retain while a supported data root can predate this column; the maintainer raising
+  // that baseline removes this upgrade once every supported data root has it.
+  swapSafe: true,
+  up(db) {
+    ensureColumn(db, "agent_api", "max_concurrent_runs", "INTEGER NOT NULL DEFAULT 4");
+  },
+  // Keep the configured limit on rollback; older builds ignore this column.
+  down() {
   }
-  migration;
 };
-function migrate(db, { swapPath = false } = {}) {
-  const from = schemaVersion(db);
-  const pending = [...MIGRATIONS].sort((a, b) => a.version - b.version).filter((m) => m.version > from);
-  if (swapPath) {
-    const blocked = pending.find((m) => !m.swapSafe);
-    if (blocked) throw new RestartRequiredError(blocked);
+
+// src/db/migrations/steps/2026-10-14-agent-api-session-settings.ts
+var agentApiSessionSettings = {
+  name: "2026-10-14-agent-api-session-settings",
+  // The per-Agent API defaults a new Session starts with: which provider, model, thinking
+  // level and workspace it opens in. Nullable additions preserve existing keys, exposure,
+  // approvals and new-Session defaults.
+  // Retain while a supported data root can predate these columns; the maintainer raising
+  // that baseline removes this upgrade after all supported data roots have them.
+  swapSafe: true,
+  up(db) {
+    ensureColumn(db, "agent_api", "provider", "TEXT");
+    ensureColumn(db, "agent_api", "model_id", "TEXT");
+    ensureColumn(db, "agent_api", "thinking_level", "TEXT");
+    ensureColumn(db, "agent_api", "workspace", "TEXT");
+  },
+  // Keep the saved defaults on rollback; older builds ignore the additional columns.
+  down() {
   }
-  const applied = [];
-  for (const m of pending) {
-    db.exec("BEGIN");
-    try {
-      m.up(db);
-      db.exec(`PRAGMA user_version = ${m.version}`);
-      db.exec("COMMIT");
-    } catch (err) {
-      db.exec("ROLLBACK");
-      throw new Error(`migration ${m.version} (${m.name}) failed: ${String(err)}`, { cause: err });
-    }
-    applied.push(m.name);
+};
+
+// src/db/migrations/steps/2026-10-16-machines-adopted-at.ts
+var machinesAdoptedAt = {
+  name: "2026-10-16-machines-adopted-at",
+  // When this server adopted a machine (first recorded it): the Sessions that machine held
+  // before then read as CLI tasks through this server (session-sources.ts sourceSeenBy). A
+  // machine recorded before this column has none and never gets one, so the rule does not apply
+  // to it (user decision, 2026-10-15) — nothing on either side is rewritten. Swap-safe: a pushed platform boots against the runtime's
+  // already-open database, so the column has to arrive by a migration.
+  swapSafe: true,
+  up(db) {
+    ensureColumn(db, "machines", "adopted_at", "TEXT");
+  },
+  // Keep the adoption times on rollback; older builds ignore the column.
+  down() {
   }
-  return { from, to: schemaVersion(db), applied };
+};
+
+// src/db/migrations/index.ts
+var MIGRATIONS = [
+  messagingBindings,
+  messagingDeliveryFlags,
+  dropGoalState,
+  machines,
+  userProfile,
+  companyModeOrgCaches,
+  companyModeChannels,
+  companyModeDeskNotices,
+  modelPromotions,
+  modelProviderAuthTokens,
+  sessionsSandbox,
+  machinesColumns,
+  browserExtensions,
+  agentApi,
+  messagingConversations,
+  sessionsKeptAt,
+  agentApiSessionSettings,
+  agentApiConcurrency,
+  machinesAdoptedAt,
+  modelTablesAdoption
+];
+function migrate2(db, options = {}) {
+  return migrate(db, MIGRATIONS, options);
 }
 
 // src/db/schema.ts
@@ -629,7 +778,7 @@ CREATE TABLE IF NOT EXISTS auth_sessions (
   user_id    TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
   created_at TEXT NOT NULL,
   expires_at TEXT NOT NULL,                  -- 30-day sliding renewal, topped up in place when <29 days remain
-  via        TEXT                            -- 'password'|'desktop'|'setup'|'cli'; NULL = legacy (password)
+  via        TEXT                            -- 'password'|'desktop'|'setup'|'cli'|'remote'; NULL = legacy (password)
 );
 -- deleteExpired runs on every login and mint, deleteByUser on every admin reset; without
 -- these both scan the whole table.
@@ -766,7 +915,12 @@ CREATE TABLE IF NOT EXISTS agent_api (          -- per-Agent public API settings
   agent_id      TEXT NOT NULL,
   enabled       INTEGER NOT NULL DEFAULT 0,     -- the API tab's switch; off = every /api/amsp request for it is 404 agent_not_found
   open          INTEGER NOT NULL DEFAULT 0,     -- keyless access: a request without Authorization is accepted; off = 401 unauthorized
-  approval_mode TEXT NOT NULL DEFAULT 'allow-all', -- the approval mode an API Session is CREATED with (allow-all|deny-all|read-only|always-ask); copied onto sessions.approval_mode, never read per decision
+  approval_mode TEXT NOT NULL DEFAULT 'allow-all', -- copied onto each new API Session
+  provider      TEXT,                         -- NULL pair follows the Project default model
+  model_id      TEXT,
+  thinking_level TEXT,                        -- NULL follows Agent/Project configuration
+  workspace     TEXT,                         -- NULL creates a temporary Workspace
+  max_concurrent_runs INTEGER NOT NULL DEFAULT 4,
   updated_at    TEXT NOT NULL,
   PRIMARY KEY (project_id, agent_id)
 );
@@ -797,7 +951,8 @@ CREATE TABLE IF NOT EXISTS machines (          -- one row per machine this serve
   installed_at TEXT,
   session_pid  INTEGER,                        -- the ssh session this server holds to it; what a successor App closes after a hot swap
   remote_port  INTEGER,                        -- its server's port over there, as of the last connect
-  platform     TEXT                            -- linux | darwin | win32, as the install found it: the shell dialect the status probe speaks to it in
+  platform     TEXT,                           -- linux | darwin | win32, as the install found it: the shell dialect the status probe speaks to it in
+  adopted_at   TEXT                            -- when this server first recorded this machine (reset when the address answers with another machine's id): Sessions it held before then read as CLI tasks through this server. NULL = recorded before the column existed; never filled in later, and the rule does not apply
 );
 CREATE TABLE IF NOT EXISTS machine_project (   -- which machines a Project uses; no row = none yet. Follows the Project out, like project_members
   project_id TEXT PRIMARY KEY REFERENCES projects(project_id) ON DELETE CASCADE,
@@ -945,7 +1100,7 @@ function openDatabase(dbPath) {
   db.exec("DROP INDEX IF EXISTS idx_usage_session");
   db.exec("DROP INDEX IF EXISTS idx_messaging_account");
   upgradeLastActiveAt(db);
-  migrate(db);
+  migrate2(db);
   return db;
 }
 function upgradeLastActiveAt(db) {
@@ -973,9 +1128,9 @@ function ensureColumn(db, table, column, ddl) {
 }
 
 export {
-  migrate,
+  migrate2 as migrate,
   openExistingDatabase,
   openDatabaseReadOnly,
   openDatabase
 };
-//# sourceMappingURL=chunk-NVWAYYRX.js.map
+//# sourceMappingURL=chunk-HPOHMZCH.js.map