@runfusion/fusion 0.76.0-beta.1 → 0.76.0-beta.3

package/dist/plugins/fusion-plugin-paperclip-runtime/bundled.js

@@ -6113,9 +6113,14 @@ var config = projectSchema.table("config", {
   // now keyed per-project on `project_id` (the effective PK). `id` is retained
   // for column-shape parity (always 1) but is no longer the PK and no longer
   // CHECK-constrained. Single-project / SQLite-parity callers leave project_id
-  // at its '' default (one row), preserving the pre-isolation behavior.
+  // through the database ownership trigger, preserving the pre-isolation behavior.
+  /*
+  FNXC:MultiProjectIsolation 2026-08-12-15:43:
+  Migration 0006 owns config's project_id default and leaves its catalog PK as (project_id).
+  Drizzle emits DEFAULT while the database GUC/trigger selects the effective ownership partition.
+  */
   id: integer("id").default(1),
-  projectId: text("project_id").notNull().default("").primaryKey(),
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`).primaryKey(),
   nextId: integer("next_id").default(1),
   nextWorkflowStepId: integer("next_workflow_step_id").default(1),
   // FNXC:SqliteFinalRemoval 2026-06-28:
@@ -6509,9 +6514,13 @@ var taskCommitAssociations = projectSchema.table("task_commit_associations", {
 var automations = projectSchema.table("automations", {
   /*
    * FNXC:AutomationIsolation 2026-07-13-22:37:
-   * Automations are partitioned by the AsyncDataLayer's project ID because embedded PostgreSQL consolidates the per-project SQLite files into one table. The composite key deliberately permits the same automation ID in two projects without allowing either project's CRUD or cron-claim path to address the other row. The empty default preserves an explicit partition for legacy and project-agnostic callers until startup stamps migrated rows.
+   * Automations are partitioned by the AsyncDataLayer's project ID because embedded PostgreSQL consolidates the per-project SQLite files into one table. The composite key deliberately permits the same automation ID in two projects without allowing either project's CRUD or cron-claim path to address the other row.
+   *
+   * FNXC:MultiProjectIsolation 2026-08-12-15:43:
+   * Migration 0006 owns the default through the database GUC/trigger; Drizzle emits DEFAULT
+   * without replacing the physical legacy fallback or the fail-closed bound writer contract.
    */
-  projectId: text("project_id").notNull().default(""),
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
   id: text("id").notNull(),
   name: text("name").notNull(),
   description: text("description"),
@@ -6810,7 +6819,8 @@ var taskDocuments = projectSchema.table("task_documents", {
   index("idxTaskDocumentsTaskId").on(t.taskId)
 ]);
 var artifacts = projectSchema.table("artifacts", {
-  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
+  id: text("id").notNull(),
   type: text("type").notNull(),
   title: text("title").notNull(),
   description: text("description"),
@@ -6825,7 +6835,8 @@ var artifacts = projectSchema.table("artifacts", {
   createdAt: text("created_at").notNull(),
   updatedAt: text("updated_at").notNull()
 }, (t) => [
-  foreignKey({ columns: [t.taskId], foreignColumns: [tasks.id] }).onDelete("cascade"),
+  primaryKey({ columns: [t.projectId, t.id] }),
+  foreignKey({ name: "artifacts_task_id_fkey", columns: [t.projectId, t.taskId], foreignColumns: [tasks.projectId, tasks.id] }).onDelete("cascade"),
   index("idxArtifactsTaskId").on(t.taskId),
   index("idxArtifactsAuthorId").on(t.authorId),
   index("idxArtifactsType").on(t.type),
@@ -7015,7 +7026,8 @@ var evalRunEvents = projectSchema.table("eval_run_events", {
   index("idxEvalRunEventsRunIdSeq").on(t.runId, t.seq)
 ]);
 var secrets = projectSchema.table("secrets", {
-  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
+  id: text("id").notNull(),
   key: text("key").notNull(),
   valueCiphertext: bytea("value_ciphertext").notNull(),
   nonce: bytea("nonce").notNull(),
@@ -7028,7 +7040,8 @@ var secrets = projectSchema.table("secrets", {
   lastReadAt: text("last_read_at"),
   lastReadBy: text("last_read_by")
 }, (t) => [
-  unique("secrets_key_unique").on(t.key),
+  primaryKey({ columns: [t.projectId, t.id] }),
+  unique("secrets_key_unique").on(t.projectId, t.key),
   check("secrets_access_policy_check", sql`${t.accessPolicy} IN ('auto', 'prompt', 'deny')`),
   check("secrets_env_exportable_check", sql`${t.envExportable} IN (0, 1)`)
 ]);
@@ -7070,10 +7083,11 @@ var missions = projectSchema.table("missions", {
   updatedAt: text("updated_at").notNull()
 }, (t) => [primaryKey({ columns: [t.projectId, t.id] })]);
 var branchGroups = projectSchema.table("branch_groups", {
-  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
+  id: text("id").notNull(),
   sourceType: text("source_type").notNull(),
   sourceId: text("source_id").notNull(),
-  branchName: text("branch_name").notNull().unique(),
+  branchName: text("branch_name").notNull(),
   worktreePath: text("worktree_path"),
   autoMerge: integer("auto_merge").notNull().default(0),
   prState: text("pr_state").notNull().default("none"),
@@ -7089,6 +7103,8 @@ var branchGroups = projectSchema.table("branch_groups", {
   updatedAt: bigint("updated_at", { mode: "number" }).notNull(),
   closedAt: bigint("closed_at", { mode: "number" })
 }, (t) => [
+  primaryKey({ columns: [t.projectId, t.id] }),
+  unique("branch_groups_branch_name_key").on(t.projectId, t.branchName),
   check("branch_groups_source_type_check", sql`${t.sourceType} IN ('mission','planning','new-task')`),
   check("branch_groups_pr_state_check", sql`${t.prState} IN ('none','open','merged','closed')`),
   check("branch_groups_status_check", sql`${t.status} IN ('open','finalized','abandoned')`),
@@ -7490,12 +7506,14 @@ var usageEvents = projectSchema.table("usage_events", {
   index("idxUsageEventsKindTs").on(t.kind, t.ts)
 ]);
 var pluginActivations = projectSchema.table("plugin_activations", {
-  id: integer("id").generatedAlwaysAsIdentity().primaryKey(),
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
+  id: integer("id").generatedAlwaysAsIdentity().notNull(),
   pluginId: text("plugin_id").notNull(),
   source: text("source").notNull(),
   pluginVersion: text("plugin_version"),
   activatedAt: text("activated_at").notNull()
 }, (t) => [
+  primaryKey({ columns: [t.projectId, t.id] }),
   index("idxPluginActivationsActivatedAt").on(t.activatedAt),
   index("idxPluginActivationsPluginId").on(t.pluginId)
 ]);
@@ -7520,8 +7538,13 @@ var knowledgePages = projectSchema.table("knowledge_pages", {
   index("idxKnowledgePagesUpdatedAt").on(t.updatedAt)
 ]);
 var deployments = projectSchema.table("deployments", {
-  id: integer("id").generatedAlwaysAsIdentity().primaryKey(),
-  projectId: text("project_id").notNull().default(""),
+  id: integer("id").generatedAlwaysAsIdentity().notNull(),
+  /*
+  FNXC:MultiProjectIsolation 2026-08-12-15:43:
+  Migration 0006 rebuilt deployments_pkey as (project_id, id). Drizzle emits DEFAULT while the
+  database GUC/trigger keeps ownership stamping and the physical legacy fallback authoritative.
+  */
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
   deploymentId: text("deployment_id").notNull(),
   service: text("service"),
   environment: text("environment"),
@@ -7532,6 +7555,7 @@ var deployments = projectSchema.table("deployments", {
   meta: jsonb("meta"),
   createdAt: text("created_at").notNull()
 }, (t) => [
+  primaryKey({ columns: [t.projectId, t.id], name: "deployments_pkey" }),
   uniqueIndex("idxDeploymentsProjectDeploymentId").on(t.projectId, t.deploymentId),
   index("idxDeploymentsProjectDeployedAt").on(t.projectId, t.deployedAt),
   index("idxDeploymentsDeployedAt").on(t.deployedAt),
@@ -7539,7 +7563,12 @@ var deployments = projectSchema.table("deployments", {
 ]);
 var githubCheckStates = projectSchema.table("github_check_states", {
   id: integer("id").generatedAlwaysAsIdentity().notNull(),
-  projectId: text("project_id").notNull().default(""),
+  /*
+  FNXC:MultiProjectIsolation 2026-08-12-15:43:
+  Migration 0048 post-dated 0006, so FN-9004 reconciles its physical default to the ownership
+  expression. Drizzle emits DEFAULT while the database GUC/trigger remains the stamping authority.
+  */
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
   repo: text("repo").notNull(),
   headSha: text("head_sha").notNull(),
   checkName: text("check_name").notNull(),
@@ -7559,9 +7588,14 @@ var githubCheckStates = projectSchema.table("github_check_states", {
   index("idxGithubCheckStatesProjectReceived").on(t.projectId, t.receivedAt)
 ]);
 var incidents = projectSchema.table("incidents", {
-  id: integer("id").generatedAlwaysAsIdentity().primaryKey(),
-  projectId: text("project_id").notNull().default(""),
-  incidentId: text("incident_id").notNull().unique(),
+  id: integer("id").generatedAlwaysAsIdentity().notNull(),
+  /*
+  FNXC:MultiProjectIsolation 2026-08-12-15:43:
+  Migration 0006 rebuilt incident keys with project_id first. Drizzle emits DEFAULT while the
+  database GUC/trigger retains ownership stamping and its physical legacy fallback.
+  */
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
+  incidentId: text("incident_id").notNull(),
   groupingKey: text("grouping_key").notNull(),
   title: text("title").notNull(),
   severity: text("severity"),
@@ -7575,6 +7609,8 @@ var incidents = projectSchema.table("incidents", {
   createdAt: text("created_at").notNull(),
   updatedAt: text("updated_at").notNull()
 }, (t) => [
+  primaryKey({ columns: [t.projectId, t.id], name: "incidents_pkey" }),
+  unique("incidents_incident_id_key").on(t.projectId, t.incidentId),
   index("idxIncidentsProjectOpenedAt").on(t.projectId, t.openedAt),
   index("idxIncidentsProjectStatus").on(t.projectId, t.status),
   index("idxIncidentsGroupingKey").on(t.groupingKey),
@@ -7629,12 +7665,14 @@ var messages = projectSchema.table("messages", {
   content: text("content").notNull(),
   type: text("type").notNull(),
   read: integer("read").default(0),
+  archived: integer("archived").default(0),
   metadata: jsonb("metadata"),
   createdAt: text("created_at").notNull(),
   updatedAt: text("updated_at").notNull()
 }, (t) => [
   primaryKey({ columns: [t.projectId, t.id] }),
   index("idxMessagesTo").on(t.toId, t.toType, t.read),
+  index("idxMessagesToArchived").on(t.toId, t.toType, t.archived),
   index("idxMessagesFrom").on(t.fromId, t.fromType),
   index("idxMessagesCreatedAt").on(t.createdAt)
 ]);
@@ -7735,7 +7773,8 @@ var cliSessions = projectSchema.table("cli_sessions", {
   index("idx_cli_sessions_project_state").on(t.projectId, t.agentState)
 ]);
 var chatMessages = projectSchema.table("chat_messages", {
-  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
+  id: text("id").notNull(),
   sessionId: text("session_id").notNull(),
   role: text("role").notNull(),
   content: text("content").notNull(),
@@ -7744,6 +7783,7 @@ var chatMessages = projectSchema.table("chat_messages", {
   createdAt: text("created_at").notNull(),
   attachments: jsonb("attachments")
 }, (t) => [
+  primaryKey({ columns: [t.projectId, t.id] }),
   index("idxChatMessagesSessionId").on(t.sessionId),
   index("idxChatMessagesCreatedAt").on(t.createdAt)
 ]);
@@ -7769,7 +7809,8 @@ var chatTokenUsage = projectSchema.table("chat_token_usage", {
   index("idxChatTokenUsageCreatedAt").on(t.createdAt)
 ]);
 var runAuditEvents = projectSchema.table("run_audit_events", {
-  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
+  id: text("id").notNull(),
   timestamp: text("timestamp").notNull(),
   taskId: text("task_id"),
   agentId: text("agent_id").notNull(),
@@ -7779,6 +7820,7 @@ var runAuditEvents = projectSchema.table("run_audit_events", {
   target: text("target").notNull(),
   metadata: jsonb("metadata")
 }, (t) => [
+  primaryKey({ columns: [t.projectId, t.id] }),
   index("idxRunAuditEventsRunIdTimestamp").on(t.runId, t.timestamp),
   index("idxRunAuditEventsTaskIdTimestamp").on(t.taskId, t.timestamp),
   index("idxRunAuditEventsTimestamp").on(t.timestamp)
@@ -7879,13 +7921,14 @@ var missionLineageStops = projectSchema.table("mission_lineage_stops", {
   index("idxMissionLineageStopsMissionId").on(t.projectId, t.missionId)
 ]);
 var verificationCache = projectSchema.table("verification_cache", {
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
   treeSha: text("tree_sha").notNull(),
   testCommand: text("test_command").notNull().default(""),
   buildCommand: text("build_command").notNull().default(""),
   recordedAt: text("recorded_at").notNull(),
   taskId: text("task_id")
 }, (t) => [
-  primaryKey({ columns: [t.treeSha, t.testCommand, t.buildCommand] }),
+  primaryKey({ columns: [t.projectId, t.treeSha, t.testCommand, t.buildCommand] }),
   index("idxVerificationCacheRecordedAt").on(t.recordedAt)
 ]);
 var importTranslationCache = projectSchema.table("import_translation_cache", {
@@ -7918,7 +7961,8 @@ var importTranslationCache = projectSchema.table("import_translation_cache", {
   index("idxImportTranslationCacheRecordedAt").on(t.recordedAt)
 ]);
 var approvalRequests = projectSchema.table("approval_requests", {
-  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
+  id: text("id").notNull(),
   status: text("status").notNull(),
   requesterActorId: text("requester_actor_id").notNull(),
   requesterActorType: text("requester_actor_type").notNull(),
@@ -7937,13 +7981,14 @@ var approvalRequests = projectSchema.table("approval_requests", {
   createdAt: text("created_at").notNull(),
   updatedAt: text("updated_at").notNull()
 }, (t) => [
+  primaryKey({ columns: [t.projectId, t.id] }),
   index("idxApprovalRequestsStatusCreatedAt").on(t.status, t.createdAt),
   index("idxApprovalRequestsRequesterCreatedAt").on(t.requesterActorId, t.createdAt),
   index("idxApprovalRequestsTaskCreatedAt").on(t.taskId, t.createdAt)
 ]);
 var approvalRequestAuditEvents = projectSchema.table("approval_request_audit_events", {
-  projectId: text("project_id").notNull().default(""),
-  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
+  id: text("id").notNull(),
   requestId: text("request_id").notNull(),
   eventType: text("event_type").notNull(),
   actorId: text("actor_id").notNull(),
@@ -7952,6 +7997,7 @@ var approvalRequestAuditEvents = projectSchema.table("approval_request_audit_eve
   note: text("note"),
   createdAt: text("created_at").notNull()
 }, (t) => [
+  primaryKey({ columns: [t.projectId, t.id] }),
   index("idxApprovalRequestAuditRequestCreatedAt").on(t.requestId, t.createdAt, t.id),
   index("idxApprovalRequestAuditProjectCreatedAt").on(t.projectId, t.createdAt)
 ]);
@@ -9078,6 +9124,8 @@ var DEFAULT_GLOBAL_SETTINGS = {
 var DEFAULT_PROJECT_SETTINGS = {
   // FNXC:TaskRecommendations 2026-08-08-05:02: completion follows-ups stay bounded by default; 0 disables writing them.
   maxRecommendationsPerTask: 3,
+  // FNXC:TaskRecommendations 2026-08-13-03:56: surface completed-task proposals by default; operators can suppress the notice without suppressing capture.
+  recommendationMailboxNoticeEnabled: true,
   globalPause: false,
   globalPauseReason: void 0,
   defaultWorkflowId: void 0,

package/dist/plugins/fusion-plugin-paperclip-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fusion-plugin-examples/paperclip-runtime",
-  "version": "0.2.85-beta.1",
+  "version": "0.2.85-beta.3",
   "type": "module",
   "exports": {
     ".": {

package/dist/plugins/fusion-plugin-quality/bundled.js

@@ -6116,9 +6116,14 @@ var config = projectSchema.table("config", {
   // now keyed per-project on `project_id` (the effective PK). `id` is retained
   // for column-shape parity (always 1) but is no longer the PK and no longer
   // CHECK-constrained. Single-project / SQLite-parity callers leave project_id
-  // at its '' default (one row), preserving the pre-isolation behavior.
+  // through the database ownership trigger, preserving the pre-isolation behavior.
+  /*
+  FNXC:MultiProjectIsolation 2026-08-12-15:43:
+  Migration 0006 owns config's project_id default and leaves its catalog PK as (project_id).
+  Drizzle emits DEFAULT while the database GUC/trigger selects the effective ownership partition.
+  */
   id: integer("id").default(1),
-  projectId: text("project_id").notNull().default("").primaryKey(),
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`).primaryKey(),
   nextId: integer("next_id").default(1),
   nextWorkflowStepId: integer("next_workflow_step_id").default(1),
   // FNXC:SqliteFinalRemoval 2026-06-28:
@@ -6512,9 +6517,13 @@ var taskCommitAssociations = projectSchema.table("task_commit_associations", {
 var automations = projectSchema.table("automations", {
   /*
    * FNXC:AutomationIsolation 2026-07-13-22:37:
-   * Automations are partitioned by the AsyncDataLayer's project ID because embedded PostgreSQL consolidates the per-project SQLite files into one table. The composite key deliberately permits the same automation ID in two projects without allowing either project's CRUD or cron-claim path to address the other row. The empty default preserves an explicit partition for legacy and project-agnostic callers until startup stamps migrated rows.
+   * Automations are partitioned by the AsyncDataLayer's project ID because embedded PostgreSQL consolidates the per-project SQLite files into one table. The composite key deliberately permits the same automation ID in two projects without allowing either project's CRUD or cron-claim path to address the other row.
+   *
+   * FNXC:MultiProjectIsolation 2026-08-12-15:43:
+   * Migration 0006 owns the default through the database GUC/trigger; Drizzle emits DEFAULT
+   * without replacing the physical legacy fallback or the fail-closed bound writer contract.
    */
-  projectId: text("project_id").notNull().default(""),
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
   id: text("id").notNull(),
   name: text("name").notNull(),
   description: text("description"),
@@ -6813,7 +6822,8 @@ var taskDocuments = projectSchema.table("task_documents", {
   index("idxTaskDocumentsTaskId").on(t.taskId)
 ]);
 var artifacts = projectSchema.table("artifacts", {
-  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
+  id: text("id").notNull(),
   type: text("type").notNull(),
   title: text("title").notNull(),
   description: text("description"),
@@ -6828,7 +6838,8 @@ var artifacts = projectSchema.table("artifacts", {
   createdAt: text("created_at").notNull(),
   updatedAt: text("updated_at").notNull()
 }, (t) => [
-  foreignKey({ columns: [t.taskId], foreignColumns: [tasks.id] }).onDelete("cascade"),
+  primaryKey({ columns: [t.projectId, t.id] }),
+  foreignKey({ name: "artifacts_task_id_fkey", columns: [t.projectId, t.taskId], foreignColumns: [tasks.projectId, tasks.id] }).onDelete("cascade"),
   index("idxArtifactsTaskId").on(t.taskId),
   index("idxArtifactsAuthorId").on(t.authorId),
   index("idxArtifactsType").on(t.type),
@@ -7018,7 +7029,8 @@ var evalRunEvents = projectSchema.table("eval_run_events", {
   index("idxEvalRunEventsRunIdSeq").on(t.runId, t.seq)
 ]);
 var secrets = projectSchema.table("secrets", {
-  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
+  id: text("id").notNull(),
   key: text("key").notNull(),
   valueCiphertext: bytea("value_ciphertext").notNull(),
   nonce: bytea("nonce").notNull(),
@@ -7031,7 +7043,8 @@ var secrets = projectSchema.table("secrets", {
   lastReadAt: text("last_read_at"),
   lastReadBy: text("last_read_by")
 }, (t) => [
-  unique("secrets_key_unique").on(t.key),
+  primaryKey({ columns: [t.projectId, t.id] }),
+  unique("secrets_key_unique").on(t.projectId, t.key),
   check("secrets_access_policy_check", sql`${t.accessPolicy} IN ('auto', 'prompt', 'deny')`),
   check("secrets_env_exportable_check", sql`${t.envExportable} IN (0, 1)`)
 ]);
@@ -7073,10 +7086,11 @@ var missions = projectSchema.table("missions", {
   updatedAt: text("updated_at").notNull()
 }, (t) => [primaryKey({ columns: [t.projectId, t.id] })]);
 var branchGroups = projectSchema.table("branch_groups", {
-  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
+  id: text("id").notNull(),
   sourceType: text("source_type").notNull(),
   sourceId: text("source_id").notNull(),
-  branchName: text("branch_name").notNull().unique(),
+  branchName: text("branch_name").notNull(),
   worktreePath: text("worktree_path"),
   autoMerge: integer("auto_merge").notNull().default(0),
   prState: text("pr_state").notNull().default("none"),
@@ -7092,6 +7106,8 @@ var branchGroups = projectSchema.table("branch_groups", {
   updatedAt: bigint("updated_at", { mode: "number" }).notNull(),
   closedAt: bigint("closed_at", { mode: "number" })
 }, (t) => [
+  primaryKey({ columns: [t.projectId, t.id] }),
+  unique("branch_groups_branch_name_key").on(t.projectId, t.branchName),
   check("branch_groups_source_type_check", sql`${t.sourceType} IN ('mission','planning','new-task')`),
   check("branch_groups_pr_state_check", sql`${t.prState} IN ('none','open','merged','closed')`),
   check("branch_groups_status_check", sql`${t.status} IN ('open','finalized','abandoned')`),
@@ -7493,12 +7509,14 @@ var usageEvents = projectSchema.table("usage_events", {
   index("idxUsageEventsKindTs").on(t.kind, t.ts)
 ]);
 var pluginActivations = projectSchema.table("plugin_activations", {
-  id: integer("id").generatedAlwaysAsIdentity().primaryKey(),
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
+  id: integer("id").generatedAlwaysAsIdentity().notNull(),
   pluginId: text("plugin_id").notNull(),
   source: text("source").notNull(),
   pluginVersion: text("plugin_version"),
   activatedAt: text("activated_at").notNull()
 }, (t) => [
+  primaryKey({ columns: [t.projectId, t.id] }),
   index("idxPluginActivationsActivatedAt").on(t.activatedAt),
   index("idxPluginActivationsPluginId").on(t.pluginId)
 ]);
@@ -7523,8 +7541,13 @@ var knowledgePages = projectSchema.table("knowledge_pages", {
   index("idxKnowledgePagesUpdatedAt").on(t.updatedAt)
 ]);
 var deployments = projectSchema.table("deployments", {
-  id: integer("id").generatedAlwaysAsIdentity().primaryKey(),
-  projectId: text("project_id").notNull().default(""),
+  id: integer("id").generatedAlwaysAsIdentity().notNull(),
+  /*
+  FNXC:MultiProjectIsolation 2026-08-12-15:43:
+  Migration 0006 rebuilt deployments_pkey as (project_id, id). Drizzle emits DEFAULT while the
+  database GUC/trigger keeps ownership stamping and the physical legacy fallback authoritative.
+  */
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
   deploymentId: text("deployment_id").notNull(),
   service: text("service"),
   environment: text("environment"),
@@ -7535,6 +7558,7 @@ var deployments = projectSchema.table("deployments", {
   meta: jsonb("meta"),
   createdAt: text("created_at").notNull()
 }, (t) => [
+  primaryKey({ columns: [t.projectId, t.id], name: "deployments_pkey" }),
   uniqueIndex("idxDeploymentsProjectDeploymentId").on(t.projectId, t.deploymentId),
   index("idxDeploymentsProjectDeployedAt").on(t.projectId, t.deployedAt),
   index("idxDeploymentsDeployedAt").on(t.deployedAt),
@@ -7542,7 +7566,12 @@ var deployments = projectSchema.table("deployments", {
 ]);
 var githubCheckStates = projectSchema.table("github_check_states", {
   id: integer("id").generatedAlwaysAsIdentity().notNull(),
-  projectId: text("project_id").notNull().default(""),
+  /*
+  FNXC:MultiProjectIsolation 2026-08-12-15:43:
+  Migration 0048 post-dated 0006, so FN-9004 reconciles its physical default to the ownership
+  expression. Drizzle emits DEFAULT while the database GUC/trigger remains the stamping authority.
+  */
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
   repo: text("repo").notNull(),
   headSha: text("head_sha").notNull(),
   checkName: text("check_name").notNull(),
@@ -7562,9 +7591,14 @@ var githubCheckStates = projectSchema.table("github_check_states", {
   index("idxGithubCheckStatesProjectReceived").on(t.projectId, t.receivedAt)
 ]);
 var incidents = projectSchema.table("incidents", {
-  id: integer("id").generatedAlwaysAsIdentity().primaryKey(),
-  projectId: text("project_id").notNull().default(""),
-  incidentId: text("incident_id").notNull().unique(),
+  id: integer("id").generatedAlwaysAsIdentity().notNull(),
+  /*
+  FNXC:MultiProjectIsolation 2026-08-12-15:43:
+  Migration 0006 rebuilt incident keys with project_id first. Drizzle emits DEFAULT while the
+  database GUC/trigger retains ownership stamping and its physical legacy fallback.
+  */
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
+  incidentId: text("incident_id").notNull(),
   groupingKey: text("grouping_key").notNull(),
   title: text("title").notNull(),
   severity: text("severity"),
@@ -7578,6 +7612,8 @@ var incidents = projectSchema.table("incidents", {
   createdAt: text("created_at").notNull(),
   updatedAt: text("updated_at").notNull()
 }, (t) => [
+  primaryKey({ columns: [t.projectId, t.id], name: "incidents_pkey" }),
+  unique("incidents_incident_id_key").on(t.projectId, t.incidentId),
   index("idxIncidentsProjectOpenedAt").on(t.projectId, t.openedAt),
   index("idxIncidentsProjectStatus").on(t.projectId, t.status),
   index("idxIncidentsGroupingKey").on(t.groupingKey),
@@ -7632,12 +7668,14 @@ var messages = projectSchema.table("messages", {
   content: text("content").notNull(),
   type: text("type").notNull(),
   read: integer("read").default(0),
+  archived: integer("archived").default(0),
   metadata: jsonb("metadata"),
   createdAt: text("created_at").notNull(),
   updatedAt: text("updated_at").notNull()
 }, (t) => [
   primaryKey({ columns: [t.projectId, t.id] }),
   index("idxMessagesTo").on(t.toId, t.toType, t.read),
+  index("idxMessagesToArchived").on(t.toId, t.toType, t.archived),
   index("idxMessagesFrom").on(t.fromId, t.fromType),
   index("idxMessagesCreatedAt").on(t.createdAt)
 ]);
@@ -7738,7 +7776,8 @@ var cliSessions = projectSchema.table("cli_sessions", {
   index("idx_cli_sessions_project_state").on(t.projectId, t.agentState)
 ]);
 var chatMessages = projectSchema.table("chat_messages", {
-  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
+  id: text("id").notNull(),
   sessionId: text("session_id").notNull(),
   role: text("role").notNull(),
   content: text("content").notNull(),
@@ -7747,6 +7786,7 @@ var chatMessages = projectSchema.table("chat_messages", {
   createdAt: text("created_at").notNull(),
   attachments: jsonb("attachments")
 }, (t) => [
+  primaryKey({ columns: [t.projectId, t.id] }),
   index("idxChatMessagesSessionId").on(t.sessionId),
   index("idxChatMessagesCreatedAt").on(t.createdAt)
 ]);
@@ -7772,7 +7812,8 @@ var chatTokenUsage = projectSchema.table("chat_token_usage", {
   index("idxChatTokenUsageCreatedAt").on(t.createdAt)
 ]);
 var runAuditEvents = projectSchema.table("run_audit_events", {
-  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
+  id: text("id").notNull(),
   timestamp: text("timestamp").notNull(),
   taskId: text("task_id"),
   agentId: text("agent_id").notNull(),
@@ -7782,6 +7823,7 @@ var runAuditEvents = projectSchema.table("run_audit_events", {
   target: text("target").notNull(),
   metadata: jsonb("metadata")
 }, (t) => [
+  primaryKey({ columns: [t.projectId, t.id] }),
   index("idxRunAuditEventsRunIdTimestamp").on(t.runId, t.timestamp),
   index("idxRunAuditEventsTaskIdTimestamp").on(t.taskId, t.timestamp),
   index("idxRunAuditEventsTimestamp").on(t.timestamp)
@@ -7882,13 +7924,14 @@ var missionLineageStops = projectSchema.table("mission_lineage_stops", {
   index("idxMissionLineageStopsMissionId").on(t.projectId, t.missionId)
 ]);
 var verificationCache = projectSchema.table("verification_cache", {
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
   treeSha: text("tree_sha").notNull(),
   testCommand: text("test_command").notNull().default(""),
   buildCommand: text("build_command").notNull().default(""),
   recordedAt: text("recorded_at").notNull(),
   taskId: text("task_id")
 }, (t) => [
-  primaryKey({ columns: [t.treeSha, t.testCommand, t.buildCommand] }),
+  primaryKey({ columns: [t.projectId, t.treeSha, t.testCommand, t.buildCommand] }),
   index("idxVerificationCacheRecordedAt").on(t.recordedAt)
 ]);
 var importTranslationCache = projectSchema.table("import_translation_cache", {
@@ -7921,7 +7964,8 @@ var importTranslationCache = projectSchema.table("import_translation_cache", {
   index("idxImportTranslationCacheRecordedAt").on(t.recordedAt)
 ]);
 var approvalRequests = projectSchema.table("approval_requests", {
-  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
+  id: text("id").notNull(),
   status: text("status").notNull(),
   requesterActorId: text("requester_actor_id").notNull(),
   requesterActorType: text("requester_actor_type").notNull(),
@@ -7940,13 +7984,14 @@ var approvalRequests = projectSchema.table("approval_requests", {
   createdAt: text("created_at").notNull(),
   updatedAt: text("updated_at").notNull()
 }, (t) => [
+  primaryKey({ columns: [t.projectId, t.id] }),
   index("idxApprovalRequestsStatusCreatedAt").on(t.status, t.createdAt),
   index("idxApprovalRequestsRequesterCreatedAt").on(t.requesterActorId, t.createdAt),
   index("idxApprovalRequestsTaskCreatedAt").on(t.taskId, t.createdAt)
 ]);
 var approvalRequestAuditEvents = projectSchema.table("approval_request_audit_events", {
-  projectId: text("project_id").notNull().default(""),
-  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
+  id: text("id").notNull(),
   requestId: text("request_id").notNull(),
   eventType: text("event_type").notNull(),
   actorId: text("actor_id").notNull(),
@@ -7955,6 +8000,7 @@ var approvalRequestAuditEvents = projectSchema.table("approval_request_audit_eve
   note: text("note"),
   createdAt: text("created_at").notNull()
 }, (t) => [
+  primaryKey({ columns: [t.projectId, t.id] }),
   index("idxApprovalRequestAuditRequestCreatedAt").on(t.requestId, t.createdAt, t.id),
   index("idxApprovalRequestAuditProjectCreatedAt").on(t.projectId, t.createdAt)
 ]);
@@ -9081,6 +9127,8 @@ var DEFAULT_GLOBAL_SETTINGS = {
 var DEFAULT_PROJECT_SETTINGS = {
   // FNXC:TaskRecommendations 2026-08-08-05:02: completion follows-ups stay bounded by default; 0 disables writing them.
   maxRecommendationsPerTask: 3,
+  // FNXC:TaskRecommendations 2026-08-13-03:56: surface completed-task proposals by default; operators can suppress the notice without suppressing capture.
+  recommendationMailboxNoticeEnabled: true,
   globalPause: false,
   globalPauseReason: void 0,
   defaultWorkflowId: void 0,

package/dist/plugins/fusion-plugin-quality/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fusion-plugin-examples/quality",
-  "version": "0.1.10-beta.1",
+  "version": "0.1.10-beta.3",
   "type": "module",
   "exports": {
     ".": {