@sleep2agi/commhub-server 0.9.0-preview.0 → 0.9.0-preview.100

package/src/db.ts

@@ -1,6 +1,6 @@
-import { createAdapter, type DbAdapter } from "./db-adapter";
+import { createAdapter, type DbAdapter } from "./db-adapter"; import { withStatementHook } from "./status-read-cache"; // #431 写 sessions 的语句让 /api/status 缓存失效
 
-export const db: DbAdapter = createAdapter();
+export const db: DbAdapter = withStatementHook(createAdapter());
 
 // Schema
 db.exec(`
@@ -53,6 +53,38 @@ db.exec(`
   CREATE INDEX IF NOT EXISTS idx_inbox_pending
     ON inbox(session_name, acked) WHERE acked = 0;
 
+  -- #1459 ① — agent→用户的 desktop message 持久化收件箱。
+  -- inbox 是 session_name(alias) 寻址的;desktop message 目标是 user_id,不能复用
+  -- inbox(否则 /api/messages+inbox_count+SSE gate 一票 alias 域查询会隐性开始返回
+  -- 用户消息)。单独一张 user_id 寻址表,镜像 inbox 的 acked/count 语义。
+  -- message_id 即主键(dm_<uuid>,与 inbox「消息 id 即主键」同形)→ 写入用
+  -- INSERT OR IGNORE,send_desktop_message 重试天然幂等,不会插出重复消息行。
+  -- 索引留到 P3:读取查询形状定了再按真实 WHERE 加(SDK马 review:没查询就加索引是猜;
+  -- 部分索引 acked=0 若「近期」读含已 ack 行则用不上)。P1 只落表。
+  CREATE TABLE IF NOT EXISTS user_inbox (
+    message_id    TEXT PRIMARY KEY,
+    network_id    TEXT NOT NULL,
+    user_id       TEXT NOT NULL,
+    from_session  TEXT,
+    kind          TEXT NOT NULL DEFAULT 'info',
+    title         TEXT,
+    content       TEXT NOT NULL,
+    severity      TEXT NOT NULL DEFAULT 'info',
+    meta_json     TEXT,
+    acked         INTEGER NOT NULL DEFAULT 0,
+    created_at    TEXT NOT NULL DEFAULT (datetime('now')),
+    acked_at      TEXT
+  );
+
+  -- #1459 ① P3 —— 现在有真实查询了才建索引（P1 刻意没建：没有查询就加索引是猜）。
+  -- 覆盖回读分支的两条：
+  --   列表  SELECT ... WHERE user_id = ? [AND acked = 0] ORDER BY created_at DESC
+  --   未读数 SELECT COUNT(*) WHERE user_id = ? AND acked = 0
+  -- 不是部分索引（不写 WHERE acked = 0）：列表在 unacked=0 时要读**含已 ack 的**
+  -- 近期消息，部分索引那时用不上。
+  CREATE INDEX IF NOT EXISTS idx_user_inbox_user_acked
+    ON user_inbox(user_id, acked, created_at);
+
   CREATE TABLE IF NOT EXISTS completions (
     id               TEXT PRIMARY KEY,
     session_name     TEXT NOT NULL,
@@ -89,6 +121,21 @@ for (const col of [
   { name: "process_cpu_pct", def: "REAL" },
   { name: "process_uptime_seconds", def: "REAL" },
   { name: "process_in_flight_count", def: "INTEGER" },
+  { name: "external_schedules", def: "TEXT" },
+  { name: "peer_reply_inbox_capable", def: "INTEGER NOT NULL DEFAULT 0" },
+  // app#225 follow-up — a session (incl. claude-code sessions with no `nodes` row)
+  // that answers the rules-file doorbell. Sticky: set by a bound node token, never
+  // cleared by reports that omit it (agent-node status-only reports do).
+  { name: "rules_file_capable", def: "INTEGER NOT NULL DEFAULT 0" },
+  // Node skills view — the same session answers skills_list / skill_read on the
+  // rules-file doorbell (node-skills.ts). Sticky, bound-token only, like above.
+  { name: "skills_capable", def: "INTEGER NOT NULL DEFAULT 0" },
+  // Project folder view — the same session answers files_list / file_read on the
+  // rules-file doorbell (node-files.ts). Sticky, bound-token only, like above.
+  { name: "files_capable", def: "INTEGER NOT NULL DEFAULT 0" },
+  // Node run-log view — the same session answers logs_tail on the rules-file
+  // doorbell (node-logs.ts). Sticky, bound-token only, like above.
+  { name: "logs_capable", def: "INTEGER NOT NULL DEFAULT 0" },
 ]) {
   try { db.exec(`ALTER TABLE sessions ADD COLUMN ${col.name} ${col.def}`); } catch {}
 }
@@ -117,12 +164,43 @@ db.exec(`
     created_at              TEXT NOT NULL DEFAULT (datetime('now'))
   );
 
-  CREATE INDEX IF NOT EXISTS idx_agent_telemetry_host_time
-    ON agent_telemetry(network_id, hostname, ip, created_at);
   CREATE INDEX IF NOT EXISTS idx_agent_telemetry_alias_time
     ON agent_telemetry(network_id, alias, created_at);
 `);
 
+// Round-2/4 review ② — server-health index split.
+//
+// The /api/server-health/:host query (index.ts) filters
+//   WHERE (hostname = ?1 OR ip = ?2) AND created_at >= ?3
+// The old combined index (network_id, hostname, ip, created_at) only
+// covers an equality on hostname AND ip (not OR), so SQLite couldn't
+// use it for the disjunction and fell back to a full scan of
+// agent_telemetry on every server-health page load. At a 30s heartbeat
+// × N agents, the table grows fast and the scan dominates.
+//
+// Split into two narrow indexes so SQLite's OR optimizer can run an
+// index UNION on (hostname-path ∪ ip-path), each path covered by an
+// index that also lets the created_at range be range-scanned.
+//
+// **Honest trade-off** (corrected after reviewer flag): secondary
+// index count goes from 2 (host_time + alias_time) to 3 (hostname_time
+// + ip_time + alias_time). Every agent_telemetry insert now maintains
+// ONE MORE B-tree, so per-insert write-amp is +50%. The trade-off is
+// deliberate: write-amp is bounded by the heartbeat cadence (30s ×
+// N agents) and is small in absolute terms, while the read-path win
+// is going from O(n) full-scan-per-dashboard-poll to O(log n) two-
+// branch index union. For the public-facing hub's expected load
+// shape (many readers, few writers), that's a clear net gain.
+try { db.exec("DROP INDEX IF EXISTS idx_agent_telemetry_host_time"); } catch {}
+try {
+  db.exec(`CREATE INDEX IF NOT EXISTS idx_agent_telemetry_hostname_time
+           ON agent_telemetry(network_id, hostname, created_at)`);
+} catch {}
+try {
+  db.exec(`CREATE INDEX IF NOT EXISTS idx_agent_telemetry_ip_time
+           ON agent_telemetry(network_id, ip, created_at)`);
+} catch {}
+
 // inbox: add in_reply_to, requires_response, expires_at, scope, node identity
 for (const col of [
   { name: "in_reply_to", def: "TEXT" },
@@ -131,6 +209,11 @@ for (const col of [
   { name: "scope", def: "TEXT DEFAULT 'single'" },
   { name: "meta_json", def: "TEXT" },
   { name: "node_id", def: "TEXT" },
+  // #520 — explicit logical task identity.  Initial deliveries historically
+  // used inbox.id == tasks.task_id, while retry/reassign generate a fresh
+  // inbox row id.  Keep transport-row identity and logical-task identity
+  // separate so runtime evidence/replies survive those redeliveries.
+  { name: "task_id", def: "TEXT" },
 ]) {
   try { db.exec(`ALTER TABLE inbox ADD COLUMN ${col.name} ${col.def}`); } catch {}
 }
@@ -160,6 +243,10 @@ db.exec(`
     created_at        TEXT NOT NULL DEFAULT (datetime('now')),
     delivered_at      TEXT,
     started_at        TEXT,
+    runtime_submitted_at TEXT,
+    consumed_at       TEXT,
+    thread_id         TEXT,
+    turn_id           TEXT,
     completed_at      TEXT,
     expires_at        TEXT
   );
@@ -206,6 +293,8 @@ db.exec(`
     task_id       TEXT NOT NULL,
     from_status   TEXT,
     to_status     TEXT NOT NULL,
+    event_type    TEXT,
+    event_key     TEXT,
     actor         TEXT NOT NULL DEFAULT 'system',
     detail        TEXT,
     created_at    TEXT NOT NULL DEFAULT (datetime('now'))
@@ -246,6 +335,265 @@ try {
   if (!/duplicate column|already exists/i.test(e?.message || "")) throw e;
 }
 
+// RFC-024 (2026-06-28): node config-apply foundation.
+//
+// `nodes` table gains two columns:
+//   - `config_revision`: monotonically-incrementing per-node revision
+//     that gates write conflicts (dashboard sends base_revision, hub
+//     rejects 409 if it doesn't match current). Promoted by hub when
+//     the node ACKs `applied` from a successful apply.
+//   - `config_snapshot`: masked JSON of the node's current effective
+//     config, posted by the node via report_status. Dashboard reads
+//     this for the GET snapshot path (never touches per-node files).
+//
+// Both ALTERs wrapped in try/catch for the same reason as
+// must_change_password above (no IF NOT EXISTS on SQLite < 3.35).
+try {
+  db.exec(`ALTER TABLE nodes ADD COLUMN config_revision INTEGER DEFAULT 0`);
+} catch (e: any) {
+  if (!/duplicate column|already exists/i.test(e?.message || "")) throw e;
+}
+try {
+  db.exec(`ALTER TABLE nodes ADD COLUMN config_snapshot TEXT`);
+} catch (e: any) {
+  if (!/duplicate column|already exists/i.test(e?.message || "")) throw e;
+}
+
+// RFC-036 / B4 — immutable per-node owner. New nodes receive this value in
+// the same transaction that mints their node token. Heartbeats may verify the
+// binding but must never first-claim or replace it. Legacy NULL rows remain
+// read-only for external-schedule writes.
+try {
+  db.exec(`ALTER TABLE nodes ADD COLUMN owner_user_id TEXT`);
+} catch (e: any) {
+  if (!/duplicate column|already exists/i.test(e?.message || "")) throw e;
+}
+
+// RFC-026 §9 / #338 PR2 — daemon self-declare fields promoted from
+// config_snapshot to first-class indexable columns. The hub
+// `list_host_supervisors` MCP tool reads these directly without parsing
+// the snapshot JSON on every list call.
+//
+// Both fields are JSON arrays of strings:
+//   runtimes_supported    e.g. ["claude-agent-sdk","codex-sdk","grok-build-acp"]
+//   allowed_secret_keys   e.g. ["ANTHROPIC_API_KEY","OPENAI_API_KEY"]
+//
+// Stored as TEXT (JSON-encoded) — SQLite has no native array type and
+// the wrapper code is small. Both nullable for pre-PR2 daemons; the
+// list endpoint falls back to [] when null.
+try {
+  db.exec(`ALTER TABLE nodes ADD COLUMN runtimes_supported TEXT`);
+} catch (e: any) {
+  if (!/duplicate column|already exists/i.test(e?.message || "")) throw e;
+}
+try {
+  db.exec(`ALTER TABLE nodes ADD COLUMN allowed_secret_keys TEXT`);
+} catch (e: any) {
+  if (!/duplicate column|already exists/i.test(e?.message || "")) throw e;
+}
+
+// RFC-027 §2.3 — state machine for stop/delete (D5). 'active' default
+// matches pre-RFC behavior for every existing row. Transitions:
+//   active → stopping → stopped → (back to active via restart_node)
+//   active → deleting → (row gone)
+//   stopped → deleting → (row gone)
+// Used as the inbox-enqueue gate per §2.3 race-free invariant:
+// pushEvent / INSERT INTO inbox must refuse a non-active target so the
+// SIGTERM-in-flight window never gets a new task.
+try {
+  db.exec(`ALTER TABLE nodes ADD COLUMN lifecycle_state TEXT DEFAULT 'active'`);
+} catch (e: any) {
+  if (!/duplicate column|already exists/i.test(e?.message || "")) throw e;
+}
+
+// #462 — user-set custom avatar (nullable http/https image URL). Pure
+// display attribute: deliberately NOT part of the RFC-024 config-apply
+// pipeline (nothing for agent-node to consume, no revision/ack). Written
+// only via PUT /api/nodes/:ref/avatar which validates the URL shape.
+try {
+  db.exec(`ALTER TABLE nodes ADD COLUMN avatar_url TEXT`);
+} catch (e: any) {
+  if (!/duplicate column|already exists/i.test(e?.message || "")) throw e;
+}
+
+// Node DISPLAY attributes (Vincent 目标第 3 条 — dashboard/app 多维度编辑).
+// Same posture as avatar_url above: hub-side presentation only, NOT part of
+// the RFC-024 config-apply pipeline (agent-node consumes none of them, so a
+// doorbell/ack round-trip would be meaningless and could wedge the config
+// revision). Written only via PUT /api/nodes/:ref/attrs.
+//
+//   display_name   — human label shown in the UI. Distinct from `alias`,
+//                    which is the ROUTING key (messages address the alias)
+//                    and from `node_name`, which is an addressing key
+//                    (`WHERE node_id OR node_name OR alias`). Renaming
+//                    either of those must go through the rename 2PC
+//                    (/api/node-rename/*), never through an attrs write.
+//   team, tags     — organisation metadata; tags stored as JSON array text.
+//   attrs_revision — optimistic-lock counter for these display fields ONLY.
+//                    Deliberately separate from config_revision so that
+//                    editing a tag never bumps the node's *config* revision
+//                    (which would perturb the config ack protocol).
+//
+// All nullable / defaulted so the ~100 rows already in flight keep reading.
+for (const ddl of [
+  `ALTER TABLE nodes ADD COLUMN display_name TEXT`,
+  `ALTER TABLE nodes ADD COLUMN team TEXT`,
+  `ALTER TABLE nodes ADD COLUMN tags TEXT`,
+  `ALTER TABLE nodes ADD COLUMN attrs_revision INTEGER NOT NULL DEFAULT 0`,
+]) {
+  try {
+    db.exec(ddl);
+  } catch (e: any) {
+    if (!/duplicate column|already exists/i.test(e?.message || "")) throw e;
+  }
+}
+
+// RFC-027 §2 — stop/delete request envelope. Mirrors
+// node_create_requests structure so the daemon-side pull/ack pattern
+// is symmetric with create_node. action='stop'|'delete' picks which
+// branch (delete adds backup_path + revokes ntok on ack).
+db.exec(`
+  CREATE TABLE IF NOT EXISTS node_stop_requests (
+    request_id TEXT PRIMARY KEY,
+    network_id TEXT NOT NULL,
+    daemon_node_id TEXT NOT NULL,
+    child_node_id TEXT NOT NULL,
+    child_alias TEXT NOT NULL,
+    child_token_id TEXT,
+    action TEXT NOT NULL CHECK (action IN ('stop', 'delete')),
+    delete_config INTEGER NOT NULL DEFAULT 1,
+    grace_seconds INTEGER NOT NULL DEFAULT 10,
+    force INTEGER NOT NULL DEFAULT 0,
+    in_flight_at_dispatch INTEGER NOT NULL DEFAULT 0,
+    created_by_token TEXT NOT NULL,
+    status TEXT NOT NULL DEFAULT 'pending',
+    error TEXT,
+    backup_path TEXT,
+    exit_signal TEXT,
+    created_at INTEGER NOT NULL,
+    delivered_at INTEGER,
+    acked_at INTEGER
+  )
+`);
+db.exec(`CREATE INDEX IF NOT EXISTS idx_stop_req_daemon ON node_stop_requests(daemon_node_id, status)`);
+db.exec(`CREATE INDEX IF NOT EXISTS idx_stop_req_child ON node_stop_requests(child_node_id)`);
+// #1448 finding-5 — 存 delete 目标 child 的 token_id,让 ack 精确按 token_id 撤 ntok
+// (而非按 name='node:<alias>' 广撤 → 同 alias 在 delete 窗口内重建会误杀新 token)。
+// 幂等迁移:已有库补列,旧行 child_token_id 为 NULL、ack 时 fallback 回按 name 撤。
+try { db.exec(`ALTER TABLE node_stop_requests ADD COLUMN child_token_id TEXT`); } catch { /* 已存在 */ }
+
+// Daemon-mediated start request. Kept separate from node_stop_requests:
+// the deployed stop table has a CHECK(action IN ('stop','delete')) and
+// rebuilding that table in-place would be a risky migration for an additive
+// lifecycle operation.
+db.exec(`
+  CREATE TABLE IF NOT EXISTS node_start_requests (
+    request_id TEXT PRIMARY KEY,
+    network_id TEXT NOT NULL,
+    daemon_node_id TEXT NOT NULL,
+    child_node_id TEXT NOT NULL,
+    child_alias TEXT NOT NULL,
+    created_by_token TEXT NOT NULL,
+    status TEXT NOT NULL DEFAULT 'pending',
+    error TEXT,
+    child_pid INTEGER,
+    created_at INTEGER NOT NULL,
+    delivered_at INTEGER,
+    acked_at INTEGER
+  )
+`);
+db.exec(`CREATE INDEX IF NOT EXISTS idx_start_req_daemon ON node_start_requests(daemon_node_id, status)`);
+db.exec(`CREATE INDEX IF NOT EXISTS idx_start_req_child ON node_start_requests(child_node_id)`);
+try {
+  db.exec(`CREATE UNIQUE INDEX IF NOT EXISTS uniq_start_req_child_inflight
+             ON node_start_requests(child_node_id)
+          WHERE status IN ('pending', 'delivered')`);
+} catch (e: any) {
+  if (!/unique constraint/i.test(e?.message || "")) throw e;
+}
+
+// `node_config_updates` — pending + history. One row per dashboard write.
+// At most one row per node may be in a non-terminal state at a time
+// (single-flight enforced at the tool layer; this table just stores).
+//
+// network_id is denormalized from nodes(network_id) at insert time so
+// queries don't need to JOIN through nodes every time + so a node
+// deletion doesn't orphan the history (audit retention).
+db.exec(`
+  CREATE TABLE IF NOT EXISTS node_config_updates (
+    update_id        TEXT PRIMARY KEY,
+    node_id          TEXT NOT NULL,
+    network_id       TEXT NOT NULL,
+    patch_json       TEXT NOT NULL,
+    apply_mode       TEXT NOT NULL,
+    base_revision    INTEGER NOT NULL,
+    status           TEXT NOT NULL,
+    error            TEXT,
+    created_at       INTEGER NOT NULL,
+    created_by_token TEXT NOT NULL,
+    acked_at         INTEGER,
+    new_revision     INTEGER
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_ncu_node_status ON node_config_updates(node_id, status);
+  CREATE INDEX IF NOT EXISTS idx_ncu_network ON node_config_updates(network_id);
+`);
+
+// F-C (CHANGE_REQ): partial unique index on non-terminal rows. The
+// single-flight check in tools.ts is an app-level check-then-INSERT —
+// safe under single-process Bun, but two hub workers could race and
+// double-insert. This index makes that race impossible at the DB
+// layer regardless of process count. Wrapped in try/catch because
+// SQLite < 3.8.0 doesn't support partial indexes (rare on modern
+// systems; if missing, app-level check is the fallback).
+try {
+  db.exec(`CREATE UNIQUE INDEX IF NOT EXISTS uniq_ncu_node_inflight ON node_config_updates(node_id) WHERE status IN ('pending', 'restarting')`);
+} catch (e: any) {
+  // Older SQLite — fall back to app-level single-flight only.
+  console.warn(`[commhub] partial unique index uniq_ncu_node_inflight skipped: ${e?.message || e}`);
+}
+
+// ── app#225: 节点规则文件（AGENTS.md / CLAUDE.md）远程读写请求 ──
+//
+// 形状照抄 node_config_updates（上面）：客户端落一行 + 门铃，节点拉走做完回报，
+// 客户端轮询结果。network_id 同样在插入时从 nodes 反规范化。
+//
+// 🔴 这张表**故意没有路径列**：文件名由节点按自己的 RUNTIME 决定
+// （claude → CLAUDE.md，其余 → AGENTS.md），目录固定是节点进程的 cwd。
+// hub 侧只存 op + 内容，客户端连文件名都指定不了（#225 验收第 5 条）。
+// file_name 是节点**回报**的实际文件名，只用于显示。
+db.exec(`
+  CREATE TABLE IF NOT EXISTS node_rules_requests (
+    request_id       TEXT PRIMARY KEY,
+    node_id          TEXT NOT NULL,
+    network_id       TEXT NOT NULL,
+    op               TEXT NOT NULL,
+    content          TEXT,
+    status           TEXT NOT NULL,
+    file_name        TEXT,
+    file_exists      INTEGER,
+    result_content   TEXT,
+    error            TEXT,
+    created_at       INTEGER NOT NULL,
+    created_by_token TEXT NOT NULL,
+    pulled_at        INTEGER,
+    acked_at         INTEGER
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_nrr_node_status ON node_rules_requests(node_id, status);
+  CREATE INDEX IF NOT EXISTS idx_nrr_network ON node_rules_requests(network_id);
+`);
+// Content retention (node-request-retention.ts): file bytes in content /
+// result_content are purged after the first terminal read (+grace) or a TTL;
+// these two columns record when, so the row itself survives as audit metadata.
+for (const col of ["first_read_at INTEGER", "content_purged_at INTEGER"]) {
+  try { db.exec(`ALTER TABLE node_rules_requests ADD COLUMN ${col}`); } catch {}
+}
+db.exec(`
+  CREATE INDEX IF NOT EXISTS idx_nrr_created ON node_rules_requests(created_at);
+  CREATE INDEX IF NOT EXISTS idx_nrr_first_read ON node_rules_requests(first_read_at);
+`);
+
 // ── V3: networks table ──
 db.exec(`
   CREATE TABLE IF NOT EXISTS networks (
@@ -280,6 +628,287 @@ db.exec(`
   CREATE INDEX IF NOT EXISTS idx_tokens_user ON api_tokens(user_id);
 `);
 
+// RFC-026 v4 §4.4.8 C4 — api_tokens metadata so sweeper can revoke
+// orphan child-ntoks without ever touching plaintext tokens. ALTER in
+// try/catch (idempotent for already-migrated DBs).
+//   request_id  — links a child token to the create_node request that
+//                 minted it; sweeper joins on this
+//   revoked_at  — explicit revoke; resolveToken treats non-NULL as
+//                 invalid even before expiry
+for (const ddl of [
+  "ALTER TABLE api_tokens ADD COLUMN request_id TEXT",
+  "ALTER TABLE api_tokens ADD COLUMN revoked_at TEXT",
+  "ALTER TABLE api_tokens ADD COLUMN role TEXT",
+  "ALTER TABLE api_tokens ADD COLUMN bound_node_id TEXT",
+  // 登录会话的设备标识(GET /api/auth/sessions 显示用):客户端自报的 client_label + 登录请求的 User-Agent。
+  "ALTER TABLE api_tokens ADD COLUMN client_label TEXT",
+  "ALTER TABLE api_tokens ADD COLUMN user_agent TEXT",
+]) {
+  try { db.exec(ddl); }
+  catch (e: any) {
+    if (!/duplicate column|already exists/i.test(e?.message || "")) throw e;
+  }
+}
+try { db.exec(`CREATE INDEX IF NOT EXISTS idx_tokens_request ON api_tokens(request_id)`); }
+catch (e: any) { /* index may already exist */ void e; }
+try { db.exec(`CREATE INDEX IF NOT EXISTS idx_tokens_bound_node ON api_tokens(bound_node_id)`); }
+catch (e: any) { void e; }
+
+// RFC-026 v4 §2.5 + §4.4 — node_create_requests. Metadata only;
+// env_blob NEVER lives in this table (F1 mint-stream-evict — secret
+// blob is in-memory Map keyed by request_id, drained on daemon get,
+// TTL 60s GC).
+//
+// env_keys is a JSON array of secret KEY NAMES only (for audit). The
+// actual values flow through pendingEnvBlobs Map and never touch
+// disk.
+db.exec(`
+  CREATE TABLE IF NOT EXISTS node_create_requests (
+    request_id        TEXT PRIMARY KEY,
+    daemon_node_id    TEXT NOT NULL,
+    child_name        TEXT NOT NULL,
+    network_id        TEXT NOT NULL,
+    runtime           TEXT NOT NULL,
+    model             TEXT,
+    flags_json        TEXT NOT NULL,
+    env_keys          TEXT NOT NULL,
+    status            TEXT NOT NULL,
+    error             TEXT,
+    child_token_id    TEXT,
+    created_at        INTEGER NOT NULL,
+    created_by_token  TEXT NOT NULL,
+    delivered_at      INTEGER,
+    acked_at          INTEGER,
+    child_node_id     TEXT
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_ncr_daemon_status ON node_create_requests(daemon_node_id, status);
+  CREATE INDEX IF NOT EXISTS idx_ncr_network ON node_create_requests(network_id);
+  CREATE INDEX IF NOT EXISTS idx_ncr_child_name ON node_create_requests(child_name);
+`);
+function migrateNodeCreateRequestsModelNullable() {
+  if (db.dialect === "postgres") {
+    try { db.exec("ALTER TABLE node_create_requests ALTER COLUMN model DROP NOT NULL"); } catch {}
+    return;
+  }
+
+  let needsRebuild = false;
+  try {
+    const createSql = db.get<{ sql: string }>("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'node_create_requests'");
+    needsRebuild = !!createSql?.sql && /\bmodel\s+TEXT\s+NOT\s+NULL\b/i.test(createSql.sql);
+  } catch {}
+  if (!needsRebuild) return;
+
+  db.transaction(() => {
+    db.exec("DROP TABLE IF EXISTS node_create_requests_migrated");
+    db.exec(`
+      CREATE TABLE node_create_requests_migrated (
+        request_id        TEXT PRIMARY KEY,
+        daemon_node_id    TEXT NOT NULL,
+        child_name        TEXT NOT NULL,
+        network_id        TEXT NOT NULL,
+        runtime           TEXT NOT NULL,
+        model             TEXT,
+        flags_json        TEXT NOT NULL,
+        env_keys          TEXT NOT NULL,
+        status            TEXT NOT NULL,
+        error             TEXT,
+        child_token_id    TEXT,
+        created_at        INTEGER NOT NULL,
+        created_by_token  TEXT NOT NULL,
+        delivered_at      INTEGER,
+        acked_at          INTEGER,
+        child_node_id     TEXT
+      )
+    `);
+    db.exec(`
+      INSERT INTO node_create_requests_migrated (
+        request_id, daemon_node_id, child_name, network_id, runtime, model,
+        flags_json, env_keys, status, error, child_token_id, created_at,
+        created_by_token, delivered_at, acked_at, child_node_id
+      )
+      SELECT
+        request_id, daemon_node_id, child_name, network_id, runtime, model,
+        flags_json, env_keys, status, error, child_token_id, created_at,
+        created_by_token, delivered_at, acked_at, child_node_id
+      FROM node_create_requests
+    `);
+    db.exec("DROP TABLE node_create_requests");
+    db.exec("ALTER TABLE node_create_requests_migrated RENAME TO node_create_requests");
+  });
+}
+migrateNodeCreateRequestsModelNullable();
+
+// app「新建节点」工作目录 —— 请求带的 node_spec.workdir(可空;空 = 落 daemon cwd 的老行为)。
+// 🔴 必须排在上面那个重建表迁移**之后**:它按显式列清单拷贝,排在前面的话,老库(model NOT NULL)
+//    第一次启动时这一列会被重建吞掉。
+try {
+  db.exec(`ALTER TABLE node_create_requests ADD COLUMN workdir TEXT`);
+} catch (e: any) {
+  if (!/duplicate column|already exists/i.test(e?.message || "")) throw e;
+}
+
+// #1493 — 把 user_inbox.network_id 升到 **schema 级 NOT NULL**(belt-and-suspenders,
+// 叠在 send_desktop_message 的代码级三闸之上:canWrite / `!effectiveNetId` return /
+// getUserNetworkRole,tools.ts)。「不产生 network_id=NULL 孤儿」现是代码级保证 + #1492
+// 三道测试;schema 级约束让**任何**未来绕过那三闸写 NULL 的回归在 INSERT 处直接被
+// 数据库拒(而非产出 scoped-unreadable 的静默孤儿)。
+//
+// SQLite 不能 `ALTER COLUMN ADD NOT NULL` → 建新表→copy→drop→rename(与本文件既有
+// recreate-table 迁移同范式);新库的 CREATE 已直接 NOT NULL,迁移检测到就跳过(幂等)。
+function migrateUserInboxNetworkIdNotNull() {
+  if (db.dialect === "postgres") {
+    try { db.exec("ALTER TABLE user_inbox ALTER COLUMN network_id SET NOT NULL"); } catch {}
+    return;
+  }
+  let createSql: string | undefined;
+  try {
+    createSql = db.get<{ sql: string }>("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'user_inbox'")?.sql;
+  } catch { return; }
+  if (!createSql) return;                                       // 表不存在:上面的 CREATE 已建成 NOT NULL 新表
+  if (/network_id\s+TEXT\s+NOT\s+NULL/i.test(createSql)) return; // 已是 NOT NULL → 幂等跳过
+
+  // 🔴 迁移前守卫:存量若有 network_id IS NULL 行(按代码级三闸理应 0)→ **大声 warn +
+  // 跳过迁移**(列暂保持可空),hub 照常启动。fail-safe,不 throw(SDK马 review #1516):
+  //   · 这条 NOT NULL 是 belt-and-suspenders,代码级三闸(#1492 三测钉着)已挡新 NULL;
+  //     为一条冗余保险带让**整个舰队的 hub** boot 期停摆,代价与收益不成比例;
+  //   · 生产这个 COUNT 没人量过,而 #1493 第一条原则就是"没量过的数不要动手"——只要生产
+  //     有一行历史 NULL,throw 就把升级变成停机;
+  //   · fail-closed 的真正目的(不盲目清空、不 COALESCE 猜网络)用 warn+skip 一样达到。
+  // ⚠ 校正:本文件既有迁移(migrateNodeCreateRequestsModelNullable 内部 catch{}+return;
+  //   migrateSessionsNetworkAliasUnique 全函数 throw 0 次)都**不**在 boot 期打死 hub——
+  //   "顶层无 try/catch"是真前提,但"所以 throw 符合惯例"是没验的推论(SDK马 量出),撤回。
+  // 孤儿行仍有明确运维信号,三闸仍生效;等人工量过、清干净,下次启动幂等判据自动完成迁移。
+  const nullCount = db.get<{ n: number }>("SELECT COUNT(*) AS n FROM user_inbox WHERE network_id IS NULL")?.n ?? 0;
+  if (nullCount > 0) {
+    console.error(
+      `[migrate #1493] user_inbox 有 ${nullCount} 行 network_id IS NULL —— 与 send_desktop_message ` +
+      `的代码级三闸矛盾,可能存在更早的写路径漏洞;已**跳过** NOT NULL 迁移(列暂保持可空),` +
+      `hub 正常启动。请人工排查这些孤儿行来源、清理后下次启动会自动完成迁移(不要盲目清空)。`,
+    );
+    return;
+  }
+
+  db.transaction(() => {
+    db.exec("DROP TABLE IF EXISTS user_inbox_migrated");
+    db.exec(`
+      CREATE TABLE user_inbox_migrated (
+        message_id    TEXT PRIMARY KEY,
+        network_id    TEXT NOT NULL,
+        user_id       TEXT NOT NULL,
+        from_session  TEXT,
+        kind          TEXT NOT NULL DEFAULT 'info',
+        title         TEXT,
+        content       TEXT NOT NULL,
+        severity      TEXT NOT NULL DEFAULT 'info',
+        meta_json     TEXT,
+        acked         INTEGER NOT NULL DEFAULT 0,
+        created_at    TEXT NOT NULL DEFAULT (datetime('now')),
+        acked_at      TEXT
+      )
+    `);
+    db.exec(`
+      INSERT INTO user_inbox_migrated
+        (message_id, network_id, user_id, from_session, kind, title, content, severity, meta_json, acked, created_at, acked_at)
+      SELECT
+        message_id, network_id, user_id, from_session, kind, title, content, severity, meta_json, acked, created_at, acked_at
+      FROM user_inbox
+    `);
+    db.exec("DROP TABLE user_inbox");
+    db.exec("ALTER TABLE user_inbox_migrated RENAME TO user_inbox");
+  });
+}
+migrateUserInboxNetworkIdNotNull();
+// 迁移会 drop 掉旧表上的 idx_user_inbox_user_acked → 重建(IF NOT EXISTS;未迁移时 no-op)。
+db.exec(`CREATE INDEX IF NOT EXISTS idx_user_inbox_user_acked ON user_inbox(user_id, acked, created_at);`);
+// 多用户:人与人私信。sender_user_id 由 Hub 按发信人的**用户令牌**写入(不是客户端填的 from_session),
+// 会话记录按它双向取;Agent / 节点令牌发来的桌面消息这一列为 NULL。
+try { db.exec("ALTER TABLE user_inbox ADD COLUMN sender_user_id TEXT"); } catch {}
+db.exec(`CREATE INDEX IF NOT EXISTS idx_user_inbox_dm ON user_inbox(network_id, user_id, sender_user_id, created_at);`);
+
+db.exec(`
+  CREATE INDEX IF NOT EXISTS idx_ncr_daemon_status ON node_create_requests(daemon_node_id, status);
+  CREATE INDEX IF NOT EXISTS idx_ncr_network ON node_create_requests(network_id);
+  CREATE INDEX IF NOT EXISTS idx_ncr_child_name ON node_create_requests(child_name);
+`);
+try {
+  // Single-flight per (daemon, child_name) — prevents racing dashboard
+  // create on same name. Mirrors RFC-024 uniq_ncu_node_inflight.
+  db.exec(`CREATE UNIQUE INDEX IF NOT EXISTS uniq_ncr_inflight ON node_create_requests(daemon_node_id, child_name) WHERE status IN ('pending', 'delivered')`);
+} catch (e: any) {
+  console.warn(`[commhub] partial unique index uniq_ncr_inflight skipped: ${e?.message || e}`);
+}
+
+// RFC-028 P1 v4 §2.2 — providers + provider_models + network_secrets +
+// probe_results. All 4 tables idempotent CREATE TABLE IF NOT EXISTS. F2
+// lazy gate: tables created on hub boot regardless; vault master key
+// (ANET_HUB_SECRET_VAULT_KEY env) only required when these tables get
+// their first non-empty row (lazy in vault.ts). Empty tables = hub
+// boots fine without env (critical for existing prod hub升级 不 brick).
+db.exec(`
+  CREATE TABLE IF NOT EXISTS providers (
+    provider_id     TEXT PRIMARY KEY,
+    network_id      TEXT NOT NULL,
+    name            TEXT NOT NULL,
+    vendor          TEXT NOT NULL,
+    base_url        TEXT NOT NULL,
+    secret_key_ref  TEXT NOT NULL,
+    created_at      INTEGER NOT NULL,
+    created_by      TEXT NOT NULL,
+    enabled         INTEGER NOT NULL DEFAULT 1,
+    UNIQUE(network_id, name)
+  );
+  CREATE INDEX IF NOT EXISTS idx_providers_network ON providers(network_id);
+`);
+db.exec(`
+  CREATE TABLE IF NOT EXISTS provider_models (
+    model_id        TEXT PRIMARY KEY,
+    provider_id     TEXT NOT NULL,
+    model_name      TEXT NOT NULL,
+    display_name    TEXT,
+    context_window  INTEGER,
+    supports_vision INTEGER NOT NULL DEFAULT 0,
+    enabled         INTEGER NOT NULL DEFAULT 1,
+    created_at      INTEGER NOT NULL,
+    UNIQUE(provider_id, model_name)
+  );
+  CREATE INDEX IF NOT EXISTS idx_models_provider ON provider_models(provider_id);
+`);
+// network_secrets — encrypted-at-rest vault. ciphertext + iv + tag are
+// AES-GCM output; plaintext NEVER touches this table. master key from
+// ANET_HUB_SECRET_VAULT_KEY env (lazy gate in vault.ts).
+db.exec(`
+  CREATE TABLE IF NOT EXISTS network_secrets (
+    network_id   TEXT NOT NULL,
+    key          TEXT NOT NULL,
+    ciphertext   BLOB NOT NULL,
+    iv           BLOB NOT NULL,
+    tag          BLOB NOT NULL,
+    created_at   INTEGER NOT NULL,
+    updated_at   INTEGER NOT NULL,
+    PRIMARY KEY (network_id, key)
+  );
+`);
+// probe_results — connectivity matrix history. v3 R3 lock: error_label
+// is HUB-DERIVED ONLY from (status, raw_status_code) — daemon CANNOT
+// submit arbitrary error string. status enum mirrors ProbeAckPayload.
+db.exec(`
+  CREATE TABLE IF NOT EXISTS probe_results (
+    probe_id        TEXT PRIMARY KEY,
+    provider_id     TEXT NOT NULL,
+    model_name      TEXT NOT NULL,
+    daemon_node_id  TEXT NOT NULL,
+    network_id      TEXT NOT NULL,
+    status          TEXT NOT NULL,
+    latency_ms      INTEGER,
+    error_label     TEXT,
+    probed_at       INTEGER NOT NULL,
+    probed_by_user  TEXT,
+    raw_status_code INTEGER
+  );
+  CREATE INDEX IF NOT EXISTS idx_probe_matrix ON probe_results(network_id, provider_id, model_name, daemon_node_id, probed_at DESC);
+`);
+
 // ── V3: audit_log table ──
 db.exec(`
   CREATE TABLE IF NOT EXISTS audit_log (
@@ -300,6 +929,64 @@ db.exec(`
   CREATE INDEX IF NOT EXISTS idx_audit_network ON audit_log(network_id);
 `);
 
+// SkillHub — immutable, network-scoped skill submissions. A (network, slug,
+// version) tuple is write-once: retries with the same content are idempotent,
+// while different content must use a new version. Node submissions remain
+// pending until an owner/admin explicitly publishes them.
+db.exec(`
+  CREATE TABLE IF NOT EXISTS skillhub_skills (
+    skill_id          TEXT PRIMARY KEY,
+    network_id        TEXT NOT NULL,
+    slug              TEXT NOT NULL,
+    name              TEXT NOT NULL,
+    description       TEXT NOT NULL DEFAULT '',
+    version           TEXT NOT NULL,
+    content           TEXT NOT NULL,
+    content_hash      TEXT NOT NULL,
+    status            TEXT NOT NULL DEFAULT 'pending' CHECK(status IN ('pending', 'published', 'rejected', 'archived')),
+    source_type       TEXT NOT NULL CHECK(source_type IN ('node', 'user')),
+    source_alias      TEXT,
+    created_by_user   TEXT,
+    reviewed_by_user  TEXT,
+    review_note       TEXT,
+    created_at        TEXT NOT NULL DEFAULT (datetime('now')),
+    updated_at        TEXT NOT NULL DEFAULT (datetime('now')),
+    reviewed_at       TEXT,
+    UNIQUE(network_id, slug, version)
+  );
+  CREATE INDEX IF NOT EXISTS idx_skillhub_network_status
+    ON skillhub_skills(network_id, status, updated_at DESC);
+  CREATE INDEX IF NOT EXISTS idx_skillhub_network_slug
+    ON skillhub_skills(network_id, slug, version);
+`);
+
+// 需求池。长期卡片，按 network 隔离。不是 tasks。
+db.exec(`
+  CREATE TABLE IF NOT EXISTS requirements (
+    requirement_id TEXT PRIMARY KEY,
+    network_id     TEXT NOT NULL,
+    title          TEXT NOT NULL,
+    column_name    TEXT NOT NULL DEFAULT 'pool' CHECK(column_name IN ('pool', 'doing', 'done')),
+    priority       TEXT NOT NULL DEFAULT 'normal' CHECK(priority IN ('high', 'normal', 'low', 'lowest')),
+    due_on         TEXT,
+    assignee       TEXT,
+    client_id      TEXT,
+    issues_json    TEXT,
+    created_by     TEXT,
+    created_at     TEXT NOT NULL DEFAULT (datetime('now')),
+    updated_at     TEXT NOT NULL DEFAULT (datetime('now'))
+  );
+  CREATE INDEX IF NOT EXISTS idx_requirements_network
+    ON requirements(network_id, created_at DESC);
+`);
+try { db.exec("ALTER TABLE requirements ADD COLUMN client_id TEXT"); } catch {}
+try { db.exec("ALTER TABLE requirements ADD COLUMN issues_json TEXT"); } catch {}
+try { db.exec("ALTER TABLE requirements ADD COLUMN tags_json TEXT NOT NULL DEFAULT '[]'"); } catch (e: any) { if (!/duplicate column|already exists/i.test(e?.message || "")) throw e; }
+db.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_requirements_client ON requirements(network_id, client_id) WHERE client_id IS NOT NULL AND client_id != ''");
+for (const column of ["owner_json TEXT", "participants_json TEXT NOT NULL DEFAULT '[]'", "agent_owner_json TEXT", "description TEXT", "checklist_json TEXT", "project_id TEXT", "external_ref TEXT", "external_url TEXT", "archived INTEGER NOT NULL DEFAULT 0", "created_by_json TEXT", "updated_by_json TEXT", "parent_id TEXT", "start_on TEXT"]) {
+  try { db.exec(`ALTER TABLE requirements ADD COLUMN ${column}`); } catch (e: any) { if (!/duplicate column|already exists/i.test(e?.message || "")) throw e; }
+}
+
 // ── V3: licenses table ──
 db.exec(`
   CREATE TABLE IF NOT EXISTS licenses (
@@ -356,6 +1043,68 @@ db.exec(`
   );
 `);
 
+// ── 多用户账号与 Agent 权限:成员可见哪些 Agent ──
+// network_members.agent_access:
+//   'all'     —— 旧语义:能看到并联系网络里所有 Agent。ALTER 的 DEFAULT 让**升级前已有的**成员行
+//                全部落在这里,生产上已有成员的可见范围不因升级而变。
+//   'granted' —— 只看到 network_member_agent_grants 里给了的 Agent。此后**新加入**的
+//                member/viewer(管理员建号、POST members、邀请码)都以它入库,即默认零权限。
+// owner/admin 角色与 Hub 管理员不看这一列(永远全部可见),判定集中在 agent-access.ts。
+try { db.exec("ALTER TABLE network_members ADD COLUMN agent_access TEXT NOT NULL DEFAULT 'all'"); } catch {}
+// node_id 优先(稳定);alias 只给没有 node_id 的旧会话用。两者恰有其一。
+db.exec(`
+  CREATE TABLE IF NOT EXISTS network_member_agent_grants (
+    network_id   TEXT NOT NULL,
+    user_id      TEXT NOT NULL,
+    node_id      TEXT,
+    alias        TEXT,
+    can_message  INTEGER NOT NULL DEFAULT 1,
+    created_by   TEXT,
+    created_at   TEXT NOT NULL DEFAULT (datetime('now')),
+    CHECK ((node_id IS NULL) <> (alias IS NULL))
+  );
+
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_agent_grants_node ON network_member_agent_grants(network_id, user_id, node_id) WHERE node_id IS NOT NULL;
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_agent_grants_alias ON network_member_agent_grants(network_id, user_id, alias) WHERE alias IS NOT NULL;
+`);
+
+// ── Agent 分组(RFC-038 §8):管理员自由定义的组,授权可以给到组,组成员动态生效 ──
+// 组授权单独一张表(不给 network_member_agent_grants 加列):那张表的 CHECK 改不了,
+// 而且旧 app 的 PUT 是整体替换 —— 同表的话,旧 app 一保存就把组授权清掉。
+db.exec(`
+  CREATE TABLE IF NOT EXISTS agent_groups (
+    group_id     TEXT PRIMARY KEY,
+    network_id   TEXT NOT NULL,
+    name         TEXT NOT NULL,
+    description  TEXT,
+    created_by   TEXT,
+    created_at   TEXT NOT NULL DEFAULT (datetime('now')),
+    updated_at   TEXT
+  );
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_agent_groups_name ON agent_groups(network_id, name);
+
+  CREATE TABLE IF NOT EXISTS agent_group_members (
+    group_id   TEXT NOT NULL,
+    node_id    TEXT NOT NULL,
+    added_by   TEXT,
+    added_at   TEXT NOT NULL DEFAULT (datetime('now')),
+    PRIMARY KEY (group_id, node_id)
+  );
+
+  CREATE TABLE IF NOT EXISTS network_member_group_grants (
+    network_id   TEXT NOT NULL,
+    user_id      TEXT NOT NULL,
+    group_id     TEXT NOT NULL,
+    can_message  INTEGER NOT NULL DEFAULT 1,
+    created_by   TEXT,
+    created_at   TEXT NOT NULL DEFAULT (datetime('now')),
+    PRIMARY KEY (network_id, user_id, group_id)
+  );
+  -- 改组成员 / 删组时按组找被授权成员(usersGrantedGroup、granted_user_count):主键以 network_id 开头用不上。
+  -- 展开查询本身走各表主键,见 agent-groups-perf.test.ts 的 EXPLAIN QUERY PLAN。
+  CREATE INDEX IF NOT EXISTS idx_group_grants_group ON network_member_group_grants(group_id);
+`);
+
 // ── #84: node rename — rename_txn table (RFC-010 §4) ──
 // Single isolated table holding the rename 2PC transaction state. It doubles
 // as the alias_rename_log (RFC §4 risk #5): the audit log of completed renames
@@ -410,6 +1159,14 @@ for (const table of ["sessions", "nodes", "tasks", "inbox", "task_events", "comp
   try { db.exec(`ALTER TABLE ${table} ADD COLUMN network_id TEXT`); } catch {}
 }
 
+// #167 — stable lifecycle event names plus an internal idempotency key.
+// Ordinary status transitions keep event_key NULL, so retries and repeated
+// transitions remain auditable. Watcher warnings set a stable key; the unique
+// index makes every (task, threshold) write-once across patrol rounds/workers.
+try { db.exec("ALTER TABLE task_events ADD COLUMN event_type TEXT"); } catch {}
+try { db.exec("ALTER TABLE task_events ADD COLUMN event_key TEXT"); } catch {}
+try { db.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_task_events_task_key ON task_events(task_id, event_key)"); } catch {}
+
 // PR-1 (#146): durable node identity on historical inbox/tasks rows. Some
 // existing databases created `tasks` before from_node_id/to_node_id were in the
 // CREATE TABLE statement, so keep these ALTERs explicit and idempotent.
@@ -685,6 +1442,12 @@ migrateSessionsNetworkAliasUnique();
 try { db.exec("CREATE INDEX IF NOT EXISTS idx_sessions_network ON sessions(network_id)"); } catch {}
 try { db.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_sessions_network_alias_unique ON sessions(network_id, alias)"); } catch {}
 try { db.exec("CREATE INDEX IF NOT EXISTS idx_tasks_network ON tasks(network_id)"); } catch {}
+// #500 — covering index for the full /api/status queue_depth GROUP BY (task-queue-ahead.ts queueDepthQuery): the 24 h
+// created_at range plus every column that query reads, so it never touches the (wide) task rows. Here, not in the
+// CREATE TABLE block: tasks.network_id only exists after the ALTER above. On a read-only copy of the production DB
+// (57k tasks, 1.9k in the last 24 h) the statement went from ~3 ms (idx_tasks_created + one row lookup per task) to
+// ~0.3 ms; building it there took ~170 ms once. Plain composite index: the same DDL runs on PostgreSQL.
+try { db.exec("CREATE INDEX IF NOT EXISTS idx_tasks_created_queue ON tasks(created_at, status, network_id, to_name)"); } catch {}
 try { db.exec("CREATE INDEX IF NOT EXISTS idx_nodes_network ON nodes(network_id)"); } catch {}
 try { db.exec("CREATE INDEX IF NOT EXISTS idx_inbox_network ON inbox(network_id)"); } catch {}
 try { db.exec("CREATE INDEX IF NOT EXISTS idx_task_events_network ON task_events(network_id)"); } catch {}
@@ -696,6 +1459,176 @@ try { db.exec("CREATE INDEX IF NOT EXISTS idx_completions_network ON completions
 // the reply up the chain via parent_task_id.
 try { db.exec("ALTER TABLE tasks ADD COLUMN parent_task_id TEXT"); } catch {}
 try { db.exec("ALTER TABLE tasks ADD COLUMN meta_json TEXT"); } catch {}
+// #520 — two monotonic evidence levels for this exact task:
+// runtime_submitted_at means agent-node handed the body to the vendor runtime;
+// consumed_at requires an attributable turn-start/first-activity signal.
+// Both stay separate from delivered_at (enqueue), acked (process receipt), and
+// started_at (legacy report_status/content matching). Old binaries ignore them.
+try { db.exec("ALTER TABLE tasks ADD COLUMN runtime_submitted_at TEXT"); } catch {}
+try { db.exec("ALTER TABLE tasks ADD COLUMN consumed_at TEXT"); } catch {}
+// Exact vendor-runtime boundary for SideThread-capable clients. These values
+// are written only by the token-bound target node after attributable runtime
+// evidence; the Hub never derives them from task text or caller input.
+try { db.exec("ALTER TABLE tasks ADD COLUMN thread_id TEXT"); } catch {}
+try { db.exec("ALTER TABLE tasks ADD COLUMN turn_id TEXT"); } catch {}
+
+// #1181 durable outbound terminal cursor.  A task's created_at cannot be used
+// as a recovery watermark because an old task may become terminal after newer
+// tasks.  Record terminal transitions in their own monotonically increasing
+// journal instead.  The journal is append-only for a logical task; retry keeps
+// the existing task identity and therefore the same idempotency domain.
+db.exec(`
+  CREATE TABLE IF NOT EXISTS task_terminal_events (
+    terminal_seq INTEGER PRIMARY KEY AUTOINCREMENT,
+    task_id TEXT NOT NULL UNIQUE,
+    network_id TEXT,
+    from_node_id TEXT,
+    completed_at TEXT NOT NULL DEFAULT (datetime('now'))
+  );
+  CREATE INDEX IF NOT EXISTS idx_task_terminal_events_sender_seq
+    ON task_terminal_events(network_id, from_node_id, terminal_seq);
+`);
+if (db.dialect === "sqlite") {
+  db.exec(`
+    CREATE TRIGGER IF NOT EXISTS tasks_terminal_event_insert
+    AFTER INSERT ON tasks
+    WHEN NEW.status IN ('replied', 'failed', 'cancelled', 'expired')
+    BEGIN
+      INSERT OR IGNORE INTO task_terminal_events (task_id, network_id, from_node_id, completed_at)
+      VALUES (NEW.task_id, NEW.network_id, NEW.from_node_id, COALESCE(NEW.completed_at, datetime('now')));
+    END;
+    CREATE TRIGGER IF NOT EXISTS tasks_terminal_event_update
+    AFTER UPDATE OF status ON tasks
+    WHEN NEW.status IN ('replied', 'failed', 'cancelled', 'expired')
+      AND OLD.status NOT IN ('replied', 'failed', 'cancelled', 'expired')
+    BEGIN
+      INSERT OR IGNORE INTO task_terminal_events (task_id, network_id, from_node_id, completed_at)
+      VALUES (NEW.task_id, NEW.network_id, NEW.from_node_id, COALESCE(NEW.completed_at, datetime('now')));
+    END;
+  `);
+  db.run(`INSERT OR IGNORE INTO task_terminal_events (task_id, network_id, from_node_id, completed_at)
+          SELECT task_id, network_id, from_node_id, COALESCE(completed_at, created_at)
+            FROM tasks
+           WHERE status IN ('replied', 'failed', 'cancelled', 'expired')
+           ORDER BY COALESCE(completed_at, created_at), task_id`);
+} else {
+  db.exec(`
+    CREATE OR REPLACE FUNCTION record_task_terminal_event() RETURNS trigger AS $$
+    BEGIN
+      IF NEW.status IN ('replied', 'failed', 'cancelled', 'expired')
+         AND (TG_OP = 'INSERT' OR OLD.status NOT IN ('replied', 'failed', 'cancelled', 'expired')) THEN
+        INSERT INTO task_terminal_events (task_id, network_id, from_node_id, completed_at)
+        VALUES (NEW.task_id, NEW.network_id, NEW.from_node_id, COALESCE(NEW.completed_at, datetime('now')))
+        ON CONFLICT (task_id) DO NOTHING;
+      END IF;
+      RETURN NEW;
+    END;
+    $$ LANGUAGE plpgsql;
+    DROP TRIGGER IF EXISTS tasks_terminal_event_insert ON tasks;
+    DROP TRIGGER IF EXISTS tasks_terminal_event_update ON tasks;
+    CREATE TRIGGER tasks_terminal_event_insert AFTER INSERT ON tasks
+      FOR EACH ROW EXECUTE FUNCTION record_task_terminal_event();
+    CREATE TRIGGER tasks_terminal_event_update AFTER UPDATE OF status ON tasks
+      FOR EACH ROW EXECUTE FUNCTION record_task_terminal_event();
+    INSERT INTO task_terminal_events (task_id, network_id, from_node_id, completed_at)
+    SELECT task_id, network_id, from_node_id, COALESCE(completed_at, created_at)
+      FROM tasks WHERE status IN ('replied', 'failed', 'cancelled', 'expired')
+    ON CONFLICT (task_id) DO NOTHING;
+  `);
+}
+
+// ── Hub scheduled tasks ──────────────────────────────────────────────
+// Scheduling is a Hub concern: clients manage these rows, while agents only
+// receive the ordinary inbox/tasks rows produced for each occurrence.  Keep
+// the occurrence table separate so retries, skips and failures remain
+// auditable without overloading the task lifecycle.
+db.exec(`
+  CREATE TABLE IF NOT EXISTS scheduled_tasks (
+    schedule_id      TEXT PRIMARY KEY,
+    network_id       TEXT NOT NULL,
+    created_by       TEXT,
+    name             TEXT NOT NULL,
+    target_node_id   TEXT NOT NULL,
+    target_alias     TEXT NOT NULL,
+    task_content     TEXT NOT NULL,
+    priority         TEXT NOT NULL DEFAULT 'normal',
+    schedule_type    TEXT NOT NULL,
+    schedule_json    TEXT NOT NULL,
+    timezone         TEXT NOT NULL DEFAULT 'UTC',
+    overlap_policy   TEXT NOT NULL DEFAULT 'skip',
+    misfire_policy   TEXT NOT NULL DEFAULT 'catch_up_once',
+    status           TEXT NOT NULL DEFAULT 'active',
+    next_run_at      TEXT,
+    last_run_at      TEXT,
+    revision         INTEGER NOT NULL DEFAULT 1,
+    created_at       TEXT NOT NULL DEFAULT (datetime('now')),
+    updated_at       TEXT NOT NULL DEFAULT (datetime('now'))
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_scheduled_tasks_due
+    ON scheduled_tasks(status, next_run_at);
+  CREATE INDEX IF NOT EXISTS idx_scheduled_tasks_network
+    ON scheduled_tasks(network_id, updated_at DESC);
+  CREATE INDEX IF NOT EXISTS idx_scheduled_tasks_target
+    ON scheduled_tasks(network_id, target_node_id);
+
+  CREATE TABLE IF NOT EXISTS scheduled_task_runs (
+    run_id           TEXT PRIMARY KEY,
+    schedule_id      TEXT NOT NULL,
+    network_id       TEXT NOT NULL,
+    scheduled_for    TEXT NOT NULL,
+    task_id          TEXT,
+    status           TEXT NOT NULL,
+    error_code       TEXT,
+    error_message    TEXT,
+    created_at       TEXT NOT NULL DEFAULT (datetime('now')),
+    completed_at     TEXT,
+    UNIQUE(schedule_id, scheduled_for)
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_scheduled_runs_schedule
+    ON scheduled_task_runs(schedule_id, created_at DESC);
+  CREATE INDEX IF NOT EXISTS idx_scheduled_runs_network
+    ON scheduled_task_runs(network_id, created_at DESC);
+`);
+try { db.exec("ALTER TABLE scheduled_tasks ADD COLUMN misfire_policy TEXT NOT NULL DEFAULT 'catch_up_once'"); } catch {}
+// Skipped runs (overlap_policy=skip) name the open task that blocked them and
+// whether the node had ever picked it up: not_received | in_progress.
+try { db.exec("ALTER TABLE scheduled_task_runs ADD COLUMN blocked_by_task_id TEXT"); } catch {}
+try { db.exec("ALTER TABLE scheduled_task_runs ADD COLUMN blocked_by_state TEXT"); } catch {}
+
+// RFC-036 / B4 — owner-authorized edits of node-host managed schedules.
+// This is intentionally separate from Hub scheduled_tasks: these rows are
+// one-shot control intents consumed by the exact token-bound node. The partial
+// unique index makes the single-flight promise survive multiple Hub workers.
+db.exec(`
+  CREATE TABLE IF NOT EXISTS external_schedule_edits (
+    intent_id          TEXT PRIMARY KEY,
+    network_id         TEXT NOT NULL,
+    node_id            TEXT NOT NULL,
+    schedule_id        TEXT NOT NULL,
+    base_revision      INTEGER NOT NULL,
+    patch_json         TEXT NOT NULL,
+    status             TEXT NOT NULL DEFAULT 'pending',
+    expires_at         INTEGER NOT NULL,
+    created_at         INTEGER NOT NULL,
+    delivered_at       INTEGER,
+    acked_at           INTEGER,
+    created_by_user    TEXT NOT NULL,
+    created_by_token   TEXT NOT NULL,
+    consumed_by_token  TEXT,
+    result_revision    INTEGER,
+    error_code         TEXT
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_external_schedule_edits_node
+    ON external_schedule_edits(network_id, node_id, status, created_at);
+  CREATE INDEX IF NOT EXISTS idx_external_schedule_edits_owner
+    ON external_schedule_edits(created_by_user, created_at DESC);
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_external_schedule_edits_singleflight
+    ON external_schedule_edits(node_id, schedule_id)
+    WHERE status IN ('pending', 'delivered');
+`);
 try { db.exec("CREATE INDEX IF NOT EXISTS idx_tasks_parent ON tasks(parent_task_id)"); } catch {}
 
 // Helpers
@@ -707,8 +1640,179 @@ export function generateId(prefix: string): string {
   return `${prefix}_${crypto.randomUUID().replace(/-/g, "").slice(0, 12)}`;
 }
 
-export function hashPassword(password: string): string {
-  return new Bun.CryptoHasher("sha256").update(`anet:${password}`).digest("hex");
+// ──────────────────────────────────────────────────────────────────
+// Round-6 A1 — Password hashing: salted scrypt with lazy migration
+//
+// Format: `scrypt$<N>$<salt-b64>$<hash-b64>`
+//   N        = log2(cost). E.g. 14 → 2^14 = 16384 (~50ms on modern hw).
+//   salt-b64 = base64 of 16 random bytes.
+//   hash-b64 = base64 of 64-byte scrypt output.
+//
+// Why scrypt: Node built-in crypto.scryptSync — zero new deps.
+//   Memory-hard, ASIC-resistant. Better than bcrypt under modern GPU
+//   attack. argon2id would be marginally better but pulls a native
+//   dep (argon2 npm package) we don't want on the hub.
+//
+// Why "$" delimiter: legacy hashes are bare hex (0-9a-f only). Any
+//   "$" in stored hash means new format. Trivial detect with zero
+//   false-positives.
+//
+// Lazy migration:
+//   - register/bootstrap/changePassword/resetUserPassword always
+//     write the new format.
+//   - login + changePassword (old-verify) accept BOTH formats.
+//   - on successful login against a legacy hash, the caller rehashes
+//     in place. Zero downtime, no forced password change.
+//
+// See feedback_assume_unit_before_threshold.md: explicit-set
+// crypto parameters; don't rely on library defaults.
+// ──────────────────────────────────────────────────────────────────
+
+import { scryptSync, randomBytes, timingSafeEqual } from "node:crypto";
+
+// Default cost parameter (N = 2^14 = 16384). Tunable via env for
+// test suites that don't want to spend ~50ms per scrypt call.
+//   N=10 → 2^10 = 1024 iter, ~5ms (test-only)
+//   N=14 → 2^14 = 16384 iter, ~50ms (production)
+//   N=15 → 2^15 = 32768 iter, ~100ms (if hw improves and ops want headroom)
+const DEFAULT_SCRYPT_N = 14;
+const SCRYPT_R = 8;
+const SCRYPT_P = 1;
+const SCRYPT_KEYLEN = 64;
+const SCRYPT_SALT_BYTES = 16;
+// Bun's scrypt defaults maxmem to ~32 MiB which is too tight for
+// N ≥ 14 (128 * r * 2^N = ~16 MiB at r=8, N=14; default has no
+// headroom for the internal buffers). Set explicitly so a higher-N
+// upgrade later doesn't suddenly throw at runtime.
+const SCRYPT_MAXMEM = 128 * 1024 * 1024; // 128 MiB
+
+function getScryptN(): number {
+  const raw = process.env.COMMHUB_SCRYPT_N;
+  if (!raw) return DEFAULT_SCRYPT_N;
+  const n = parseInt(raw, 10);
+  // Bound: 8 (way-too-weak, only for unit tests) — 20 (DoS risk).
+  if (!Number.isFinite(n) || n < 8 || n > 20) return DEFAULT_SCRYPT_N;
+  return n;
+}
+
+export function hashPassword(plain: string): string {
+  const N = getScryptN();
+  const salt = randomBytes(SCRYPT_SALT_BYTES);
+  const hash = scryptSync(plain, salt, SCRYPT_KEYLEN, {
+    N: 1 << N,
+    r: SCRYPT_R,
+    p: SCRYPT_P,
+    maxmem: SCRYPT_MAXMEM,
+  });
+  return `scrypt$${N}$${salt.toString("base64")}$${hash.toString("base64")}`;
+}
+
+/**
+ * Verify a plaintext password against the stored hash. Accepts BOTH
+ * the new scrypt format and the legacy bare-hex SHA-256 format
+ * (back-compat for pre-A1 deployments).
+ *
+ * Returns:
+ *   ok           — true iff the password matches.
+ *   needsRehash  — true iff the stored hash was legacy format AND the
+ *                  password matched. The caller MUST rehash and write
+ *                  the new format back to disk so the legacy hash
+ *                  stops existing. Returned false for already-new
+ *                  hashes (no rehash needed even on N upgrade —
+ *                  follow-up if/when we bump default N).
+ */
+export function verifyPassword(plain: string, stored: string): { ok: boolean; needsRehash: boolean } {
+  // Format detection: new format always contains "$". Legacy bare
+  // sha256 hex never does (0-9a-f only).
+  if (stored.includes("$")) {
+    const parts = stored.split("$");
+    if (parts.length !== 4 || parts[0] !== "scrypt") {
+      // Unknown new-style scheme — be conservative, reject.
+      return { ok: false, needsRehash: false };
+    }
+    const N = parseInt(parts[1], 10);
+    if (!Number.isFinite(N) || N < 8 || N > 20) return { ok: false, needsRehash: false };
+    let saltBuf: Buffer;
+    let expectedBuf: Buffer;
+    try {
+      saltBuf = Buffer.from(parts[2], "base64");
+      expectedBuf = Buffer.from(parts[3], "base64");
+    } catch {
+      return { ok: false, needsRehash: false };
+    }
+    if (expectedBuf.length === 0) return { ok: false, needsRehash: false };
+    let actualBuf: Buffer;
+    try {
+      actualBuf = scryptSync(plain, saltBuf, expectedBuf.length, {
+        N: 1 << N,
+        r: SCRYPT_R,
+        p: SCRYPT_P,
+        maxmem: SCRYPT_MAXMEM,
+      });
+    } catch {
+      return { ok: false, needsRehash: false };
+    }
+    // timingSafeEqual requires equal-length buffers; we sized actual
+    // to expected.length above so this is safe.
+    const ok = timingSafeEqual(actualBuf, expectedBuf);
+    return { ok, needsRehash: false };
+  }
+
+  // Legacy bare-hex SHA-256 format (pre-A1).
+  const legacy = new Bun.CryptoHasher("sha256").update(`anet:${plain}`).digest("hex");
+  // Use timingSafeEqual on byte buffers (hex strings would be
+  // compared via JS === which is variable-time on first-differing
+  // char — the timing leak is tiny for fixed-format hex but pin the
+  // habit). Both are exactly 64 hex chars when sha256 produced.
+  if (stored.length !== legacy.length) {
+    // Length mismatch is itself indistinguishable from a parse miss
+    // — but we still pay the scrypt to keep this branch's timing
+    // peer to the verify branches below.
+    burnEqualTimeScrypt(plain);
+    return { ok: false, needsRehash: false };
+  }
+  let ok = false;
+  try {
+    ok = timingSafeEqual(Buffer.from(stored, "hex"), Buffer.from(legacy, "hex"));
+  } catch {
+    burnEqualTimeScrypt(plain);
+    return { ok: false, needsRehash: false };
+  }
+  // Timing-oracle close (round-6 round-2 — independent reviewer flag):
+  // legacy-OK   path callers (auth.ts:login) do `hashPassword(password)`
+  //             immediately after to rehash → one scrypt cost on top of
+  //             this function's return. ~50ms.
+  // legacy-WRONG path callers reject and return → ZERO additional cost.
+  //
+  // That asymmetry leaks "is this user on the legacy hash" via wall-
+  // clock difference (sub-ms wrong vs ~50ms ok). To close it, burn an
+  // equal-time scrypt on the wrong-password branch too. Now both
+  // legacy paths cost SHA-256 + one scrypt, matching new-format paths
+  // and the missing-user dummy-scrypt path.
+  if (!ok) {
+    burnEqualTimeScrypt(plain);
+  }
+  return { ok, needsRehash: ok };
+}
+
+// Round-6 round-2 hardening — throwaway scrypt to equalize timing on
+// failure paths. Burns the same wall-clock cost as a real
+// hashPassword() call. Result discarded; salt is a fresh random so
+// the work is real (not optimised away). Cost ~N=14 → 50ms,
+// COMMHUB_SCRYPT_N controlled like the real path.
+function burnEqualTimeScrypt(plain: string): void {
+  try {
+    const N = getScryptN();
+    scryptSync(plain, randomBytes(SCRYPT_SALT_BYTES), SCRYPT_KEYLEN, {
+      N: 1 << N,
+      r: SCRYPT_R,
+      p: SCRYPT_P,
+      maxmem: SCRYPT_MAXMEM,
+    });
+  } catch {
+    // Even on failure to scrypt (shouldn't happen), don't surface —
+    // this is a timing pacer, not a correctness path.
+  }
 }
 
 export function hashToken(token: string): string {
@@ -762,17 +1866,39 @@ export function logAudit(userId: string | null, username: string | null, action:
  * (e.g. server-internal bookkeeping that doesn't have a tenant
  * context) can omit `callerNetId`, but every MCP tool path MUST
  * supply it.
+ *
+ * Returns `{ chained, stoppedReason? }` so the caller can gate its
+ * follow-up SSE push on whether the chain actually wrote (round-2
+ * fix per #275 follow-up, 通信牛 catch): even when the WRITE was
+ * refused, callers were still running `SELECT parent.from_name;
+ * pushEvent(parent.from_name, { parent_task_id }, callerNetId)` —
+ * leaking the foreign parent's task_id into the caller's network
+ * via the SSE payload. Now the caller checks `result.chained` before
+ * pushing the chained_reply event.
  */
+export type ChainReplyResult = {
+  /** True iff this call actually wrote into at least one parent row.
+   *  When false, callers MUST NOT push SSE events for parent
+   *  listeners — the chain would otherwise leak the foreign parent's
+   *  identifiers into the caller's network. */
+  chained: boolean;
+  /** Optional reason the chain stopped short. Today the only enforced
+   *  reason is `cross_network`; future reasons (max-depth, parent-
+   *  archived, etc.) can land here without breaking callers. */
+  stoppedReason?: "cross_network";
+};
+
 export function chainReplyToParent(
   childTaskId: string,
   replyText: string,
   replyStatus: "replied" | "failed" | "cancelled" = "replied",
   maxDepth = 5,
   callerNetId?: string | null,
-): void {
+): ChainReplyResult {
   let currentChildId: string | null = childTaskId;
   let currentReply = replyText;
   let depth = 0;
+  let chained = false;
   // Normalize so undefined ("don't enforce") stays distinct from
   // null ("explicit default network"). Caller passes undefined to
   // opt out of the cross-tenant check; null to require the parent
@@ -788,12 +1914,12 @@ export function chainReplyToParent(
       "SELECT parent_task_id, to_name, from_name, content FROM tasks WHERE task_id = ?1",
       currentChildId
     );
-    if (!child?.parent_task_id) return;
+    if (!child?.parent_task_id) return { chained };
     const parent: ParentRow | null = db.get<ParentRow>(
       "SELECT task_id, from_name, to_name, status, result, network_id, parent_task_id FROM tasks WHERE task_id = ?1",
       child.parent_task_id
     );
-    if (!parent) return;
+    if (!parent) return { chained };
 
     // round5 F2 fix: refuse to write into a parent that lives in a
     // different network than the caller. Stops chain-reply being a
@@ -803,7 +1929,7 @@ export function chainReplyToParent(
       const parentNet = parent.network_id ?? null;
       if (parentNet !== callerNorm) {
         console.log(`[commhub] 🚫 chainReplyToParent cross-network blocked: parent=${parent.task_id.slice(0, 8)} parent-net=${parentNet ?? "null"} caller-net=${callerNorm ?? "null"}`);
-        return;
+        return { chained, stoppedReason: "cross_network" };
       }
     }
 
@@ -811,51 +1937,151 @@ export function chainReplyToParent(
     const marker = `\n\n[via ${childAlias} 子任务结果]\n${currentReply}`;
     const newResult = parent.result ? parent.result + marker : `[via ${childAlias} 子任务结果]\n${currentReply}`;
 
-    // Bump parent status to replied if still open. If it was already replied
-    // (e.g. 指挥室 sent an early status update), we still want to update the
-    // result so the dashboard can render the final chained answer — but keep
-    // status as replied (it was already terminal).
-    if (parent.status === "delivered" || parent.status === "acked" || parent.status === "running" || parent.status === "created") {
-      db.run(
-        "UPDATE tasks SET status = ?1, result = ?2, completed_at = datetime('now') WHERE task_id = ?3",
-        [replyStatus, newResult.slice(0, 8000), parent.task_id]
-      );
-      logTaskEvent(parent.task_id, parent.status, replyStatus, "auto-chain", `from ${childAlias}`);
-    } else {
-      db.run(
-        "UPDATE tasks SET result = ?1, completed_at = datetime('now') WHERE task_id = ?2",
-        [newResult.slice(0, 8000), parent.task_id]
-      );
-      logTaskEvent(parent.task_id, parent.status, parent.status, "auto-chain-append", `from ${childAlias}`);
-    }
-
-    if (parent.from_name && parent.from_name !== "hub" && parent.from_name !== "api") {
-      try {
-        const notifyId = `chain_${crypto.randomUUID().replace(/-/g, "").slice(0, 16)}`;
-        const notifyNode = db.get<{ node_id: string | null }>(
-          "SELECT node_id FROM sessions WHERE alias = ?1 AND COALESCE(network_id, 'default') = COALESCE(?2, 'default') ORDER BY updated_at DESC LIMIT 1",
-          [parent.from_name, parent.network_id ?? null]
+    db.transaction(() => {
+      // Bump parent status to replied if still open. The task transition and
+      // its scheduler-run mirror share this transaction, so a crash cannot
+      // leave one terminal while the other remains delivered.
+      if (parent.status === "delivered" || parent.status === "acked" || parent.status === "running" || parent.status === "created") {
+        db.run(
+          "UPDATE tasks SET status = ?1, result = ?2, completed_at = datetime('now') WHERE task_id = ?3",
+          [replyStatus, newResult.slice(0, 8000), parent.task_id]
         );
+        syncScheduledRunForTask(parent.task_id, parent.network_id);
+        logTaskEvent(parent.task_id, parent.status, replyStatus, "auto-chain", `from ${childAlias}`);
+      } else {
         db.run(
-          `INSERT INTO inbox (id, session_name, node_id, type, priority, content, from_session, in_reply_to, requires_response, network_id)
-           VALUES (?1, ?2, ?3, 'reply', 'normal', ?4, ?5, ?6, 'none', ?7)`,
-          [notifyId, parent.from_name, notifyNode?.node_id ?? null, `[${childAlias} 子任务完成]\n${currentReply.slice(0, 4000)}`, parent.to_name, parent.task_id, parent.network_id ?? null]
+          "UPDATE tasks SET result = ?1, completed_at = datetime('now') WHERE task_id = ?2",
+          [newResult.slice(0, 8000), parent.task_id]
         );
-      } catch {}
-    }
+        logTaskEvent(parent.task_id, parent.status, parent.status, "auto-chain-append", `from ${childAlias}`);
+      }
+
+      if (parent.from_name && parent.from_name !== "hub" && parent.from_name !== "api") {
+        try {
+          const notifyId = `chain_${crypto.randomUUID().replace(/-/g, "").slice(0, 16)}`;
+          const notifyNode = db.get<{ node_id: string | null }>(
+            "SELECT node_id FROM sessions WHERE alias = ?1 AND COALESCE(network_id, 'default') = COALESCE(?2, 'default') ORDER BY updated_at DESC LIMIT 1",
+            [parent.from_name, parent.network_id ?? null]
+          );
+          db.run(
+            `INSERT INTO inbox (id, session_name, node_id, type, priority, content, from_session, in_reply_to, requires_response, network_id)
+             VALUES (?1, ?2, ?3, 'reply', 'normal', ?4, ?5, ?6, 'none', ?7)`,
+            [notifyId, parent.from_name, notifyNode?.node_id ?? null, `[${childAlias} 子任务完成]\n${currentReply.slice(0, 4000)}`, parent.to_name, parent.task_id, parent.network_id ?? null]
+          );
+        } catch {}
+      }
+    });
+
+    // This iteration actually wrote a parent row (and possibly an
+    // inbox notification). Record that so the caller can gate its
+    // SSE push on a real chain.
+    chained = true;
 
     // Recurse up the chain.
     currentChildId = parent.task_id;
     currentReply = newResult;
   }
+  return { chained };
+}
+
+const SCHEDULED_RUN_TERMINAL_STATUSES = new Set(["replied", "failed", "cancelled", "expired"]);
+
+type ScheduledTaskLifecycleRow = {
+  task_id: string;
+  network_id: string | null;
+  status: string;
+  completed_at: string | null;
+};
+
+type ScheduledTaskBinding = { run_id: string; schedule_id: string };
+
+/**
+ * Mirror an exact scheduler-created task's lifecycle into its run row.
+ *
+ * The status is always read back from `tasks`; callers cannot supply one.
+ * The scheduler's storage binding is the four-part tuple
+ * (run_id, schedule_id, task_id, network_id). It is read from
+ * `scheduled_task_runs`, not caller-controlled task metadata (which may also
+ * legitimately be replaced by reply attachment metadata).
+ *
+ * Terminal states close the run. `retry_task` calls this after resetting the
+ * same logical task_id to delivered, which deliberately reopens that run so
+ * the history reflects the current retry rather than the first failed attempt.
+ */
+export function syncScheduledRunForTask(taskId: string, expectedNetworkId?: string | null): { matched: boolean; status?: string } {
+  const task = db.get<ScheduledTaskLifecycleRow>(
+    `SELECT task_id, network_id, status, completed_at
+       FROM tasks
+      WHERE task_id = ?1
+        AND (CAST(?2 AS TEXT) IS NULL OR network_id = ?2)`,
+    taskId,
+    expectedNetworkId ?? null,
+  );
+  if (!task?.network_id) return { matched: false };
+  const bindings = db.all<ScheduledTaskBinding>(
+    `SELECT run_id, schedule_id FROM scheduled_task_runs
+      WHERE task_id = ?1 AND network_id = ?2`,
+    task.task_id,
+    task.network_id,
+  );
+  // One task belongs to at most one scheduled occurrence. Fail closed if a
+  // corrupt/legacy database violates that invariant rather than fanning one
+  // lifecycle transition into multiple runs.
+  if (bindings.length !== 1) return { matched: false };
+  const binding = bindings[0];
+
+  if (SCHEDULED_RUN_TERMINAL_STATUSES.has(task.status)) {
+    const errorCode = task.status === "replied" ? null : `task_${task.status}`;
+    const updated = db.run(
+      `UPDATE scheduled_task_runs
+          SET status = ?1,
+              error_code = ?2,
+              error_message = NULL,
+              completed_at = COALESCE(?3, datetime('now'))
+        WHERE run_id = ?4 AND task_id = ?5 AND network_id = ?6 AND schedule_id = ?7`,
+      [task.status, errorCode, task.completed_at, binding.run_id, task.task_id, task.network_id, binding.schedule_id],
+    );
+    return { matched: updated.changes === 1, status: task.status };
+  }
+
+  if (task.status === "delivered") {
+    const updated = db.run(
+      `UPDATE scheduled_task_runs
+          SET status = 'delivered', error_code = NULL, error_message = NULL, completed_at = NULL
+        WHERE run_id = ?1 AND task_id = ?2 AND network_id = ?3 AND schedule_id = ?4`,
+      [binding.run_id, task.task_id, task.network_id, binding.schedule_id],
+    );
+    return { matched: updated.changes === 1, status: task.status };
+  }
+
+  return { matched: false };
+}
+
+function taskEventTypeForStatus(toStatus: string): string {
+  switch (toStatus) {
+    case "delivered": return "task.send.delivered";
+    case "acked": return "task.ack";
+    case "running": return "task.started";
+    case "replied": return "task.replied";
+    case "expired": return "task.expired";
+    case "failed":
+    case "cancelled": return "task.failed";
+    default: return `task.status.${toStatus}`;
+  }
 }
 
 export function logTaskEvent(taskId: string, fromStatus: string | null, toStatus: string, actor: string, detail?: string) {
   try {
     db.run(
-      `INSERT INTO task_events (task_id, from_status, to_status, actor, detail, network_id)
-       VALUES (?1, ?2, ?3, ?4, ?5, (SELECT network_id FROM tasks WHERE task_id = ?1))`,
-      [taskId, fromStatus, toStatus, actor, detail ?? null]
+      `INSERT INTO task_events (task_id, from_status, to_status, event_type, actor, detail, network_id)
+       VALUES (?1, ?2, ?3, ?4, ?5, ?6, (SELECT network_id FROM tasks WHERE task_id = ?1))`,
+      [taskId, fromStatus, toStatus, taskEventTypeForStatus(toStatus), actor, detail ?? null]
     );
   } catch {}
 }
+
+// RFC-039 F3: queries break created_at ties with SQLite's implicit rowid
+// (insertion order). PostgreSQL has none, so give these tables a real one.
+if (db.dialect === "postgres") {
+  for (const table of ["nodes", "user_inbox"]) db.exec(`ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS rowid BIGSERIAL`);
+}