@stackonward/cli 0.0.1 → 1.0.1

package/dist/resources/templates/go-backend/migrations/000001_infrastructure.up.sql

@@ -0,0 +1,886 @@
+BEGIN;
+
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+
+CREATE TABLE public.sys_access_logs (
+    id bigint NOT NULL,
+    trace_id character varying(64) DEFAULT ''::character varying NOT NULL,
+    request_id character varying(64) DEFAULT ''::character varying NOT NULL,
+    actor_type character varying(20) NOT NULL,
+    actor_id bigint DEFAULT 0 NOT NULL,
+    actor_ip character varying(45) DEFAULT ''::character varying NOT NULL,
+    actor_user_agent text DEFAULT ''::text NOT NULL,
+    http_method character varying(10) DEFAULT ''::character varying NOT NULL,
+    http_path character varying(500) DEFAULT ''::character varying NOT NULL,
+    http_status smallint DEFAULT 0 NOT NULL,
+    product_code character varying(50) DEFAULT ''::character varying NOT NULL,
+    resource_type character varying(50) DEFAULT ''::character varying NOT NULL,
+    resource_id character varying(100) DEFAULT ''::character varying NOT NULL,
+    is_success boolean DEFAULT true NOT NULL,
+    error_message character varying(500) DEFAULT ''::character varying NOT NULL,
+    duration_ms integer DEFAULT 0 NOT NULL,
+    created_at timestamp(3) with time zone DEFAULT CURRENT_TIMESTAMP NOT NULL,
+    auth_subject_type character varying(32) DEFAULT ''::character varying NOT NULL,
+    iam_principal_id bigint DEFAULT 0 NOT NULL,
+    credential_public_id character varying(80) DEFAULT ''::character varying NOT NULL,
+    token_fingerprint character(64) DEFAULT ''::bpchar NOT NULL,
+    auth_mechanism character varying(32) DEFAULT ''::character varying NOT NULL
+)
+PARTITION BY RANGE (created_at);
+
+CREATE SEQUENCE public.sys_access_logs_id_seq
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1;
+
+ALTER SEQUENCE public.sys_access_logs_id_seq OWNED BY public.sys_access_logs.id;
+
+ALTER TABLE ONLY public.sys_access_logs ALTER COLUMN id SET DEFAULT nextval('public.sys_access_logs_id_seq'::regclass);
+
+ALTER TABLE ONLY public.sys_access_logs
+    ADD CONSTRAINT sys_access_logs_pkey PRIMARY KEY (id, created_at);
+
+CREATE INDEX idx_access_actor ON ONLY public.sys_access_logs USING btree (actor_id, created_at DESC);
+
+CREATE INDEX idx_access_product ON ONLY public.sys_access_logs USING btree (product_code, created_at DESC) WHERE ((product_code)::text <> ''::text);
+
+CREATE INDEX idx_access_request ON ONLY public.sys_access_logs USING btree (request_id) WHERE ((request_id)::text <> ''::text);
+
+CREATE INDEX idx_access_status ON ONLY public.sys_access_logs USING btree (http_status, created_at DESC) WHERE (http_status >= 400);
+
+CREATE INDEX idx_sys_access_logs_created_at_brin ON ONLY public.sys_access_logs USING brin (created_at) WITH (pages_per_range='128');
+
+CREATE INDEX idx_sys_access_logs_failure_created_at ON ONLY public.sys_access_logs USING btree (created_at DESC) WHERE (is_success = false);
+
+CREATE INDEX idx_sys_access_logs_http_method_created_at ON ONLY public.sys_access_logs USING btree (http_method, created_at DESC);
+
+CREATE INDEX idx_sys_access_logs_iam_principal_time ON ONLY public.sys_access_logs USING btree (iam_principal_id, created_at DESC) WHERE (iam_principal_id > 0);
+
+CREATE INDEX idx_sys_access_logs_trace_id ON ONLY public.sys_access_logs USING btree (trace_id) WHERE ((trace_id)::text <> ''::text);
+
+COMMENT ON TABLE public.sys_access_logs IS '访问日志表（按周分区）：记录全平台 HTTP 请求，30 天保留';
+
+COMMENT ON COLUMN public.sys_access_logs.id IS '主键 ID，bigserial 自增';
+
+COMMENT ON COLUMN public.sys_access_logs.trace_id IS '分布式追踪 ID，关联 OpenTelemetry Span';
+
+COMMENT ON COLUMN public.sys_access_logs.request_id IS 'HTTP 请求唯一 ID，由 APISIX 或服务自动生成';
+
+COMMENT ON COLUMN public.sys_access_logs.actor_type IS '操作者类型: user/admin/system/api_key/webhook';
+
+COMMENT ON COLUMN public.sys_access_logs.actor_id IS '操作者业务 ID，0 表示匿名或系统触发';
+
+COMMENT ON COLUMN public.sys_access_logs.actor_ip IS '客户端 IP 地址，支持 IPv6';
+
+COMMENT ON COLUMN public.sys_access_logs.actor_user_agent IS '客户端 User-Agent 字符串';
+
+COMMENT ON COLUMN public.sys_access_logs.http_method IS 'HTTP 方法: GET/POST/PUT/PATCH/DELETE';
+
+COMMENT ON COLUMN public.sys_access_logs.http_path IS '请求路径，不含查询参数';
+
+COMMENT ON COLUMN public.sys_access_logs.http_status IS 'HTTP 响应状态码';
+
+COMMENT ON COLUMN public.sys_access_logs.product_code IS '所属产品标识（snake_case），空表示平台级操作';
+
+COMMENT ON COLUMN public.sys_access_logs.resource_type IS '资源类型: identity/user/order/subscription 等';
+
+COMMENT ON COLUMN public.sys_access_logs.resource_id IS '资源业务 ID，字符串格式兼容 bigint 和 UUID';
+
+COMMENT ON COLUMN public.sys_access_logs.is_success IS '请求是否成功（HTTP 2xx/3xx 为 true）';
+
+COMMENT ON COLUMN public.sys_access_logs.error_message IS '失败原因（英文），成功时为空字符串';
+
+COMMENT ON COLUMN public.sys_access_logs.duration_ms IS '请求耗时（毫秒）';
+
+COMMENT ON COLUMN public.sys_access_logs.created_at IS '日志写入时间，毫秒精度，用作分区键';
+
+COMMENT ON COLUMN public.sys_access_logs.auth_subject_type IS '认证主体类型（user/service_account 等）';
+
+COMMENT ON COLUMN public.sys_access_logs.iam_principal_id IS 'IAM 主体 ID（机器主体或可关联主体）';
+
+COMMENT ON COLUMN public.sys_access_logs.credential_public_id IS '凭证公开 ID（非机密）';
+
+COMMENT ON COLUMN public.sys_access_logs.token_fingerprint IS 'Token 指纹（SHA-256，不泄漏明文）';
+
+COMMENT ON COLUMN public.sys_access_logs.auth_mechanism IS '认证机制（gateway_jwt/iam_credential 等）';
+
+CREATE TABLE public.sys_access_logs_default PARTITION OF public.sys_access_logs DEFAULT;
+
+CREATE TABLE public.sys_login_logs (
+    id bigint NOT NULL,
+    identity_id bigint DEFAULT 0 NOT NULL,
+    actor_type character varying(20) NOT NULL,
+    actor_ip character varying(45) DEFAULT ''::character varying NOT NULL,
+    actor_user_agent text DEFAULT ''::text NOT NULL,
+    login_action character varying(30) NOT NULL,
+    login_method character varying(30) DEFAULT ''::character varying NOT NULL,
+    is_success boolean DEFAULT true NOT NULL,
+    failure_reason character varying(500) DEFAULT ''::character varying NOT NULL,
+    product_code character varying(50) DEFAULT ''::character varying NOT NULL,
+    session_id character varying(100) DEFAULT ''::character varying NOT NULL,
+    request_id character varying(64) DEFAULT ''::character varying NOT NULL,
+    device_type character varying(30) DEFAULT ''::character varying NOT NULL,
+    device_fingerprint character varying(64) DEFAULT ''::character varying NOT NULL,
+    os_name character varying(50) DEFAULT ''::character varying NOT NULL,
+    browser_name character varying(50) DEFAULT ''::character varying NOT NULL,
+    geo_country character varying(10) DEFAULT ''::character varying NOT NULL,
+    geo_city character varying(100) DEFAULT ''::character varying NOT NULL,
+    created_at timestamp(3) with time zone DEFAULT CURRENT_TIMESTAMP NOT NULL
+)
+PARTITION BY RANGE (created_at);
+
+CREATE SEQUENCE public.sys_login_logs_id_seq
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1;
+
+ALTER SEQUENCE public.sys_login_logs_id_seq OWNED BY public.sys_login_logs.id;
+
+ALTER TABLE ONLY public.sys_login_logs ALTER COLUMN id SET DEFAULT nextval('public.sys_login_logs_id_seq'::regclass);
+
+ALTER TABLE ONLY public.sys_login_logs
+    ADD CONSTRAINT sys_login_logs_pkey PRIMARY KEY (id, created_at);
+
+CREATE INDEX idx_login_action ON ONLY public.sys_login_logs USING btree (login_action, created_at DESC);
+
+CREATE INDEX idx_login_failed ON ONLY public.sys_login_logs USING btree (actor_ip, identity_id, created_at DESC) WHERE (is_success = false);
+
+CREATE INDEX idx_login_identity ON ONLY public.sys_login_logs USING btree (identity_id, created_at DESC);
+
+CREATE INDEX idx_login_ip ON ONLY public.sys_login_logs USING btree (actor_ip, created_at DESC);
+
+CREATE INDEX idx_login_product ON ONLY public.sys_login_logs USING btree (product_code, created_at DESC) WHERE ((product_code)::text <> ''::text);
+
+CREATE INDEX idx_login_request ON ONLY public.sys_login_logs USING btree (request_id) WHERE ((request_id)::text <> ''::text);
+
+CREATE INDEX idx_login_session ON ONLY public.sys_login_logs USING btree (session_id, created_at DESC) WHERE ((session_id)::text <> ''::text);
+
+CREATE INDEX idx_sys_login_logs_created_at_brin ON ONLY public.sys_login_logs USING brin (created_at) WITH (pages_per_range='128');
+
+CREATE INDEX idx_sys_login_logs_failure_created_at ON ONLY public.sys_login_logs USING btree (created_at DESC) WHERE (is_success = false);
+
+COMMENT ON TABLE public.sys_login_logs IS '登录日志表（按月分区）：记录认证安全事件，1 年保留';
+
+COMMENT ON COLUMN public.sys_login_logs.id IS '主键 ID，bigserial 自增';
+
+COMMENT ON COLUMN public.sys_login_logs.identity_id IS '认证身份 ID，0 表示未识别用户（如登录失败）';
+
+COMMENT ON COLUMN public.sys_login_logs.actor_type IS '操作者类型: user/admin';
+
+COMMENT ON COLUMN public.sys_login_logs.actor_ip IS '客户端 IP 地址，支持 IPv6';
+
+COMMENT ON COLUMN public.sys_login_logs.actor_user_agent IS '客户端 User-Agent 字符串';
+
+COMMENT ON COLUMN public.sys_login_logs.login_action IS '登录动作: login/logout/refresh/mfa_verify/password_reset';
+
+COMMENT ON COLUMN public.sys_login_logs.login_method IS '认证方式: password/oauth_google/oauth_apple/magic_link/api_key';
+
+COMMENT ON COLUMN public.sys_login_logs.is_success IS '操作是否成功';
+
+COMMENT ON COLUMN public.sys_login_logs.failure_reason IS '失败原因（英文），成功时为空字符串';
+
+COMMENT ON COLUMN public.sys_login_logs.product_code IS '所属产品标识（snake_case），空表示平台级操作';
+
+COMMENT ON COLUMN public.sys_login_logs.session_id IS '会话 ID，用于追踪完整登录生命周期';
+
+COMMENT ON COLUMN public.sys_login_logs.request_id IS 'HTTP 请求唯一 ID，关联 sys_access_logs';
+
+COMMENT ON COLUMN public.sys_login_logs.device_type IS '设备类型: desktop/mobile/tablet/unknown';
+
+COMMENT ON COLUMN public.sys_login_logs.device_fingerprint IS '设备指纹哈希值，用于异常登录检测';
+
+COMMENT ON COLUMN public.sys_login_logs.os_name IS '操作系统名称: Windows/macOS/iOS/Android/Linux';
+
+COMMENT ON COLUMN public.sys_login_logs.browser_name IS '浏览器名称: Chrome/Safari/Firefox/Edge';
+
+COMMENT ON COLUMN public.sys_login_logs.geo_country IS '地理位置国家代码（ISO 3166-1 alpha-2）';
+
+COMMENT ON COLUMN public.sys_login_logs.geo_city IS '地理位置城市名称';
+
+COMMENT ON COLUMN public.sys_login_logs.created_at IS '日志写入时间，毫秒精度，用作分区键';
+
+CREATE TABLE public.sys_login_logs_default PARTITION OF public.sys_login_logs DEFAULT;
+
+CREATE TABLE public.sys_audit_logs (
+    id bigint NOT NULL,
+    trace_id character varying(64) DEFAULT ''::character varying NOT NULL,
+    request_id character varying(64) DEFAULT ''::character varying NOT NULL,
+    actor_type character varying(20) NOT NULL,
+    actor_id bigint DEFAULT 0 NOT NULL,
+    actor_ip character varying(45) DEFAULT ''::character varying NOT NULL,
+    actor_user_agent text DEFAULT ''::text NOT NULL,
+    action character varying(50) NOT NULL,
+    category character varying(30) NOT NULL,
+    risk_level character varying(10) DEFAULT 'medium'::character varying NOT NULL,
+    resource_type character varying(50) DEFAULT ''::character varying NOT NULL,
+    resource_id character varying(100) DEFAULT ''::character varying NOT NULL,
+    product_code character varying(50) DEFAULT ''::character varying NOT NULL,
+    tenant_id character varying(50) DEFAULT ''::character varying NOT NULL,
+    changes jsonb,
+    metadata jsonb,
+    is_success boolean DEFAULT true NOT NULL,
+    error_message character varying(500) DEFAULT ''::character varying NOT NULL,
+    created_at timestamp(3) with time zone DEFAULT CURRENT_TIMESTAMP NOT NULL,
+    event_id character varying(64),
+    occurred_at timestamp(3) with time zone,
+    auth_subject_type character varying(32) DEFAULT ''::character varying NOT NULL,
+    iam_principal_id bigint DEFAULT 0 NOT NULL,
+    credential_public_id character varying(80) DEFAULT ''::character varying NOT NULL,
+    token_fingerprint character(64) DEFAULT ''::bpchar NOT NULL,
+    auth_mechanism character varying(32) DEFAULT ''::character varying NOT NULL
+)
+PARTITION BY RANGE (created_at);
+
+CREATE SEQUENCE public.sys_audit_logs_id_seq
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1;
+
+ALTER SEQUENCE public.sys_audit_logs_id_seq OWNED BY public.sys_audit_logs.id;
+
+ALTER TABLE ONLY public.sys_audit_logs ALTER COLUMN id SET DEFAULT nextval('public.sys_audit_logs_id_seq'::regclass);
+
+ALTER TABLE ONLY public.sys_audit_logs
+    ADD CONSTRAINT sys_audit_logs_pkey PRIMARY KEY (id, created_at);
+
+CREATE INDEX idx_audit_actor ON ONLY public.sys_audit_logs USING btree (actor_id, created_at DESC);
+
+CREATE INDEX idx_audit_category ON ONLY public.sys_audit_logs USING btree (category, created_at DESC);
+
+CREATE INDEX idx_audit_product ON ONLY public.sys_audit_logs USING btree (product_code, created_at DESC) WHERE ((product_code)::text <> ''::text);
+
+CREATE INDEX idx_audit_request ON ONLY public.sys_audit_logs USING btree (request_id) WHERE ((request_id)::text <> ''::text);
+
+CREATE INDEX idx_audit_resource ON ONLY public.sys_audit_logs USING btree (resource_type, resource_id, created_at DESC);
+
+CREATE INDEX idx_audit_risk ON ONLY public.sys_audit_logs USING btree (risk_level, created_at DESC) WHERE ((risk_level)::text = ANY (ARRAY[('critical'::character varying)::text, ('high'::character varying)::text]));
+
+CREATE INDEX idx_audit_trace ON ONLY public.sys_audit_logs USING btree (trace_id) WHERE ((trace_id)::text <> ''::text);
+
+CREATE INDEX idx_sys_audit_logs_created_at_brin ON ONLY public.sys_audit_logs USING brin (created_at) WITH (pages_per_range='128');
+
+CREATE INDEX idx_sys_audit_logs_effective_time ON ONLY public.sys_audit_logs USING btree (COALESCE(occurred_at, created_at) DESC);
+
+CREATE INDEX idx_sys_audit_logs_event_id ON ONLY public.sys_audit_logs USING btree (event_id) WHERE (event_id IS NOT NULL);
+
+CREATE INDEX idx_sys_audit_logs_iam_principal_time ON ONLY public.sys_audit_logs USING btree (iam_principal_id, created_at DESC) WHERE (iam_principal_id > 0);
+
+COMMENT ON TABLE public.sys_audit_logs IS '审计日志表（按月分区）：记录业务变更事件，7 年合规保留';
+
+COMMENT ON COLUMN public.sys_audit_logs.id IS '主键 ID，bigserial 自增';
+
+COMMENT ON COLUMN public.sys_audit_logs.trace_id IS '分布式追踪 ID，关联 OpenTelemetry Span';
+
+COMMENT ON COLUMN public.sys_audit_logs.request_id IS 'HTTP 请求唯一 ID，关联 sys_access_logs 获取完整 HTTP 上下文';
+
+COMMENT ON COLUMN public.sys_audit_logs.actor_type IS '操作者类型: user/admin/system/api_key/webhook';
+
+COMMENT ON COLUMN public.sys_audit_logs.actor_id IS '操作者业务 ID，0 表示匿名或系统触发';
+
+COMMENT ON COLUMN public.sys_audit_logs.actor_ip IS '客户端 IP 地址，支持 IPv6';
+
+COMMENT ON COLUMN public.sys_audit_logs.actor_user_agent IS '客户端 User-Agent（access_logs 过期后保留取证依据）';
+
+COMMENT ON COLUMN public.sys_audit_logs.action IS '操作动作: create/update/delete/login/logout/export/refund 等';
+
+COMMENT ON COLUMN public.sys_audit_logs.category IS '业务分类: auth/identity/user/commerce/config/content/storage/system';
+
+COMMENT ON COLUMN public.sys_audit_logs.risk_level IS '风险级别: critical/high/medium/low';
+
+COMMENT ON COLUMN public.sys_audit_logs.resource_type IS '资源类型: identity/user/order/subscription/payment 等';
+
+COMMENT ON COLUMN public.sys_audit_logs.resource_id IS '资源业务 ID，字符串格式兼容 bigint 和 UUID';
+
+COMMENT ON COLUMN public.sys_audit_logs.product_code IS '所属产品标识（snake_case），空表示平台级操作';
+
+COMMENT ON COLUMN public.sys_audit_logs.tenant_id IS '所属租户 ID，空表示非租户操作';
+
+COMMENT ON COLUMN public.sys_audit_logs.changes IS '数据变更前后快照: {"before": {...}, "after": {...}}';
+
+COMMENT ON COLUMN public.sys_audit_logs.metadata IS '扩展上下文信息（错误码、原因、session_id 等）';
+
+COMMENT ON COLUMN public.sys_audit_logs.is_success IS '操作是否成功';
+
+COMMENT ON COLUMN public.sys_audit_logs.error_message IS '失败原因（英文），成功时为空字符串';
+
+COMMENT ON COLUMN public.sys_audit_logs.created_at IS '审计记录写入时间，毫秒精度，用作分区键';
+
+COMMENT ON COLUMN public.sys_audit_logs.event_id IS '领域事件唯一标识；由 sys_audit_event_inbox 保证消费幂等';
+
+COMMENT ON COLUMN public.sys_audit_logs.occurred_at IS '领域事件发生时间；非事件型审计为空';
+
+COMMENT ON COLUMN public.sys_audit_logs.auth_subject_type IS '认证主体类型（user/service_account 等）';
+
+COMMENT ON COLUMN public.sys_audit_logs.iam_principal_id IS 'IAM 主体 ID（机器主体或可关联主体）';
+
+COMMENT ON COLUMN public.sys_audit_logs.credential_public_id IS '凭证公开 ID（非机密）';
+
+COMMENT ON COLUMN public.sys_audit_logs.token_fingerprint IS 'Token 指纹（SHA-256，不泄漏明文）';
+
+COMMENT ON COLUMN public.sys_audit_logs.auth_mechanism IS '认证机制（gateway_jwt/iam_credential 等）';
+
+CREATE TABLE public.sys_audit_logs_default PARTITION OF public.sys_audit_logs DEFAULT;
+
+CREATE TABLE public.sys_operation_logs (
+    id bigint NOT NULL,
+    trace_id character varying(64) DEFAULT ''::character varying NOT NULL,
+    request_id character varying(64) DEFAULT ''::character varying NOT NULL,
+    actor_type character varying(20) NOT NULL,
+    actor_id bigint DEFAULT 0 NOT NULL,
+    auth_subject_type character varying(32) DEFAULT ''::character varying NOT NULL,
+    iam_principal_id bigint DEFAULT 0 NOT NULL,
+    credential_public_id character varying(80) DEFAULT ''::character varying NOT NULL,
+    token_fingerprint character(64) DEFAULT ''::bpchar NOT NULL,
+    auth_mechanism character varying(32) DEFAULT ''::character varying NOT NULL,
+    actor_ip character varying(45) DEFAULT ''::character varying NOT NULL,
+    actor_user_agent text DEFAULT ''::text NOT NULL,
+    operation_action character varying(50) NOT NULL,
+    operation_category character varying(30) DEFAULT 'system'::character varying NOT NULL,
+    risk_level character varying(10) DEFAULT 'medium'::character varying NOT NULL,
+    source_module character varying(80) DEFAULT ''::character varying NOT NULL,
+    iam_action character varying(120) DEFAULT ''::character varying NOT NULL,
+    iam_resource character varying(300) DEFAULT ''::character varying NOT NULL,
+    decision_allowed boolean DEFAULT false NOT NULL,
+    decision_reason_code character varying(80) DEFAULT ''::character varying NOT NULL,
+    decision_reason_kind character varying(40) DEFAULT ''::character varying NOT NULL,
+    http_method character varying(10) DEFAULT ''::character varying NOT NULL,
+    http_path character varying(500) DEFAULT ''::character varying NOT NULL,
+    http_status smallint DEFAULT 0 NOT NULL,
+    duration_ms integer DEFAULT 0 NOT NULL,
+    product_code character varying(50) DEFAULT ''::character varying NOT NULL,
+    tenant_id character varying(50) DEFAULT ''::character varying NOT NULL,
+    resource_type character varying(50) DEFAULT ''::character varying NOT NULL,
+    resource_id character varying(100) DEFAULT ''::character varying NOT NULL,
+    is_success boolean DEFAULT true NOT NULL,
+    error_message character varying(500) DEFAULT ''::character varying NOT NULL,
+    request_context jsonb DEFAULT '{}'::jsonb NOT NULL,
+    response_context jsonb DEFAULT '{}'::jsonb NOT NULL,
+    operation_metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    policy_violation jsonb DEFAULT '{}'::jsonb NOT NULL,
+    record_status character varying(20) DEFAULT 'started'::character varying NOT NULL,
+    completed_at timestamp(3) with time zone,
+    created_at timestamp(3) with time zone DEFAULT CURRENT_TIMESTAMP NOT NULL
+)
+PARTITION BY RANGE (created_at);
+
+CREATE SEQUENCE public.sys_operation_logs_id_seq
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1;
+
+ALTER SEQUENCE public.sys_operation_logs_id_seq OWNED BY public.sys_operation_logs.id;
+
+ALTER TABLE ONLY public.sys_operation_logs ALTER COLUMN id SET DEFAULT nextval('public.sys_operation_logs_id_seq'::regclass);
+
+ALTER TABLE ONLY public.sys_operation_logs
+    ADD CONSTRAINT sys_operation_logs_pkey PRIMARY KEY (id, created_at);
+
+CREATE INDEX idx_operation_action_time ON ONLY public.sys_operation_logs USING btree (operation_action, created_at DESC);
+
+CREATE INDEX idx_operation_created_at_brin ON ONLY public.sys_operation_logs USING brin (created_at) WITH (pages_per_range='128');
+
+CREATE INDEX idx_operation_failure_time ON ONLY public.sys_operation_logs USING btree (created_at DESC) WHERE (is_success = false);
+
+CREATE INDEX idx_operation_iam_action_time ON ONLY public.sys_operation_logs USING btree (iam_action, created_at DESC) WHERE ((iam_action)::text <> ''::text);
+
+CREATE INDEX idx_operation_principal_time ON ONLY public.sys_operation_logs USING btree (iam_principal_id, created_at DESC) WHERE (iam_principal_id > 0);
+
+CREATE INDEX idx_operation_product_time ON ONLY public.sys_operation_logs USING btree (product_code, created_at DESC) WHERE ((product_code)::text <> ''::text);
+
+CREATE INDEX idx_operation_record_status_time ON ONLY public.sys_operation_logs USING btree (record_status, created_at DESC) WHERE ((record_status)::text <> 'completed'::text);
+
+CREATE INDEX idx_operation_request ON ONLY public.sys_operation_logs USING btree (request_id) WHERE ((request_id)::text <> ''::text);
+
+CREATE INDEX idx_operation_resource_time ON ONLY public.sys_operation_logs USING btree (resource_type, resource_id, created_at DESC) WHERE (((resource_type)::text <> ''::text) AND ((resource_id)::text <> ''::text));
+
+CREATE INDEX idx_operation_time ON ONLY public.sys_operation_logs USING btree (created_at DESC, id DESC);
+
+CREATE INDEX idx_operation_trace ON ONLY public.sys_operation_logs USING btree (trace_id) WHERE ((trace_id)::text <> ''::text);
+
+COMMENT ON TABLE public.sys_operation_logs IS '操作日志表（按月分区）：记录管理后台控制面请求、IAM 判定和执行结果';
+
+COMMENT ON COLUMN public.sys_operation_logs.id IS '主键 ID，bigserial 自增';
+
+COMMENT ON COLUMN public.sys_operation_logs.trace_id IS '分布式追踪 ID，与 OpenTelemetry Span 关联';
+
+COMMENT ON COLUMN public.sys_operation_logs.request_id IS 'HTTP 请求唯一 ID';
+
+COMMENT ON COLUMN public.sys_operation_logs.actor_type IS '操作者类型';
+
+COMMENT ON COLUMN public.sys_operation_logs.actor_id IS '操作者业务 ID，0 表示匿名或系统触发';
+
+COMMENT ON COLUMN public.sys_operation_logs.auth_subject_type IS '认证主体类型';
+
+COMMENT ON COLUMN public.sys_operation_logs.iam_principal_id IS 'IAM 主体 ID';
+
+COMMENT ON COLUMN public.sys_operation_logs.credential_public_id IS '凭证公开 ID（非机密）';
+
+COMMENT ON COLUMN public.sys_operation_logs.token_fingerprint IS 'Token 指纹（SHA-256，不泄漏明文）';
+
+COMMENT ON COLUMN public.sys_operation_logs.auth_mechanism IS '认证机制';
+
+COMMENT ON COLUMN public.sys_operation_logs.actor_ip IS '客户端 IP 地址，支持 IPv6';
+
+COMMENT ON COLUMN public.sys_operation_logs.actor_user_agent IS '客户端 User-Agent 字符串';
+
+COMMENT ON COLUMN public.sys_operation_logs.operation_action IS '操作动作';
+
+COMMENT ON COLUMN public.sys_operation_logs.operation_category IS '操作分类';
+
+COMMENT ON COLUMN public.sys_operation_logs.risk_level IS '风险级别';
+
+COMMENT ON COLUMN public.sys_operation_logs.source_module IS '来源模块';
+
+COMMENT ON COLUMN public.sys_operation_logs.iam_action IS 'IAM 规范动作';
+
+COMMENT ON COLUMN public.sys_operation_logs.iam_resource IS 'IAM 资源 ARN';
+
+COMMENT ON COLUMN public.sys_operation_logs.decision_allowed IS 'IAM 判定是否允许';
+
+COMMENT ON COLUMN public.sys_operation_logs.decision_reason_code IS 'IAM 判定原因码';
+
+COMMENT ON COLUMN public.sys_operation_logs.decision_reason_kind IS 'IAM 判定原因类型';
+
+COMMENT ON COLUMN public.sys_operation_logs.http_method IS 'HTTP 方法';
+
+COMMENT ON COLUMN public.sys_operation_logs.http_path IS 'HTTP 路径或路由模板';
+
+COMMENT ON COLUMN public.sys_operation_logs.http_status IS 'HTTP 响应状态码';
+
+COMMENT ON COLUMN public.sys_operation_logs.duration_ms IS '操作耗时（毫秒）';
+
+COMMENT ON COLUMN public.sys_operation_logs.product_code IS '所属产品标识（snake_case），空表示平台级操作';
+
+COMMENT ON COLUMN public.sys_operation_logs.tenant_id IS '所属租户 ID，空表示非租户操作';
+
+COMMENT ON COLUMN public.sys_operation_logs.resource_type IS '资源类型';
+
+COMMENT ON COLUMN public.sys_operation_logs.resource_id IS '资源业务 ID';
+
+COMMENT ON COLUMN public.sys_operation_logs.is_success IS '操作是否成功';
+
+COMMENT ON COLUMN public.sys_operation_logs.error_message IS '失败原因（英文），成功时为空字符串';
+
+COMMENT ON COLUMN public.sys_operation_logs.request_context IS '脱敏请求证据包';
+
+COMMENT ON COLUMN public.sys_operation_logs.response_context IS '脱敏响应证据包';
+
+COMMENT ON COLUMN public.sys_operation_logs.operation_metadata IS '操作路由和模块元数据';
+
+COMMENT ON COLUMN public.sys_operation_logs.policy_violation IS '授权拒绝或范围裁剪证据';
+
+COMMENT ON COLUMN public.sys_operation_logs.record_status IS '记录状态（started/completed 等）';
+
+COMMENT ON COLUMN public.sys_operation_logs.completed_at IS '操作完成时间';
+
+COMMENT ON COLUMN public.sys_operation_logs.created_at IS '日志写入时间，毫秒精度，用作分区键';
+
+CREATE TABLE public.sys_operation_logs_default PARTITION OF public.sys_operation_logs DEFAULT;
+
+CREATE TABLE public.sys_audit_event_inbox (
+    id bigint NOT NULL,
+    event_id character varying(64) NOT NULL,
+    occurred_at timestamp(3) with time zone NOT NULL,
+    processed_at timestamp(3) with time zone DEFAULT CURRENT_TIMESTAMP NOT NULL,
+    created_at timestamp(3) with time zone DEFAULT CURRENT_TIMESTAMP NOT NULL,
+    updated_at timestamp(3) with time zone DEFAULT CURRENT_TIMESTAMP NOT NULL
+);
+
+CREATE SEQUENCE public.sys_audit_event_inbox_id_seq
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1;
+
+ALTER SEQUENCE public.sys_audit_event_inbox_id_seq OWNED BY public.sys_audit_event_inbox.id;
+
+ALTER TABLE ONLY public.sys_audit_event_inbox ALTER COLUMN id SET DEFAULT nextval('public.sys_audit_event_inbox_id_seq'::regclass);
+
+ALTER TABLE ONLY public.sys_audit_event_inbox
+    ADD CONSTRAINT pk_sys_audit_event_inbox PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.sys_audit_event_inbox
+    ADD CONSTRAINT uk_sys_audit_event_inbox_event_id UNIQUE (event_id);
+
+COMMENT ON TABLE public.sys_audit_event_inbox IS '审计领域事件消费 inbox；event_id 唯一保证关键事件审计幂等';
+
+COMMENT ON COLUMN public.sys_audit_event_inbox.id IS '主键 ID';
+
+COMMENT ON COLUMN public.sys_audit_event_inbox.event_id IS '领域事件唯一标识';
+
+COMMENT ON COLUMN public.sys_audit_event_inbox.occurred_at IS '领域事件发生时间';
+
+COMMENT ON COLUMN public.sys_audit_event_inbox.processed_at IS '审计消费完成时间';
+
+COMMENT ON COLUMN public.sys_audit_event_inbox.created_at IS '创建时间';
+
+COMMENT ON COLUMN public.sys_audit_event_inbox.updated_at IS '更新时间';
+
+CREATE TABLE public.sys_outbox_events (
+    id uuid DEFAULT public.gen_random_uuid() NOT NULL,
+    aggregate_type character varying(100) NOT NULL,
+    aggregate_id character varying(100) NOT NULL,
+    event_type character varying(200) NOT NULL,
+    payload jsonb NOT NULL,
+    metadata jsonb,
+    occurred_at timestamp(3) with time zone DEFAULT now() NOT NULL,
+    created_at timestamp(3) with time zone DEFAULT now() NOT NULL,
+    status character varying(20) DEFAULT 'pending'::character varying NOT NULL,
+    locked_at timestamp(3) with time zone,
+    locked_by character varying(100),
+    retry_count smallint DEFAULT 0 NOT NULL,
+    max_retries smallint DEFAULT 10 NOT NULL,
+    next_retry_at timestamp(3) with time zone,
+    last_error text,
+    audit_changes jsonb,
+    audit_meta jsonb,
+    schema_version character varying(40),
+    outbox_ref character varying(80) NOT NULL,
+    aggregate_version bigint,
+    product_code character varying(50),
+    CONSTRAINT chk_sys_outbox_events_aggregate_version CHECK ((aggregate_version > 0)),
+    CONSTRAINT chk_sys_outbox_events_outbox_ref CHECK (((outbox_ref)::text ~ '^obx_[A-Za-z0-9_-]{8,64}$'::text)),
+    CONSTRAINT chk_sys_outbox_events_product_code CHECK (((product_code IS NULL) OR ((product_code)::text ~ '^[a-z][a-z0-9_]{1,49}$'::text)))
+);
+
+ALTER TABLE ONLY public.sys_outbox_events
+    ADD CONSTRAINT sys_outbox_events_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.sys_outbox_events
+    ADD CONSTRAINT uk_sys_outbox_events_outbox_ref UNIQUE (outbox_ref);
+
+CREATE INDEX idx_outbox_aggregate ON public.sys_outbox_events USING btree (aggregate_type, aggregate_id, created_at);
+
+CREATE INDEX idx_outbox_event_type ON public.sys_outbox_events USING btree (event_type, created_at);
+
+CREATE INDEX idx_outbox_locked ON public.sys_outbox_events USING btree (status, locked_at) WHERE ((status)::text = 'locked'::text);
+
+CREATE INDEX idx_outbox_pending ON public.sys_outbox_events USING btree (status, created_at) WHERE ((status)::text = 'pending'::text);
+
+CREATE INDEX idx_outbox_retry ON public.sys_outbox_events USING btree (status, next_retry_at) WHERE ((status)::text = 'retry_pending'::text);
+
+CREATE INDEX idx_sys_outbox_events_product_created_at ON public.sys_outbox_events USING btree (product_code, created_at DESC) WHERE (product_code IS NOT NULL);
+
+COMMENT ON TABLE public.sys_outbox_events IS 'Transactional Outbox: 事件与业务数据同事务写入，Relay 异步分发';
+
+COMMENT ON COLUMN public.sys_outbox_events.id IS '事件唯一标识 (UUID v4)';
+
+COMMENT ON COLUMN public.sys_outbox_events.aggregate_type IS '聚合根类型 (如 identity, order, payment)';
+
+COMMENT ON COLUMN public.sys_outbox_events.aggregate_id IS '聚合根 ID';
+
+COMMENT ON COLUMN public.sys_outbox_events.event_type IS '事件类型 (如 identity.created, order.paid)';
+
+COMMENT ON COLUMN public.sys_outbox_events.payload IS '事件载荷 (JSON)';
+
+COMMENT ON COLUMN public.sys_outbox_events.metadata IS '事件元数据 (trace_id, user_id 等)';
+
+COMMENT ON COLUMN public.sys_outbox_events.occurred_at IS '事件发生时间（业务时间）';
+
+COMMENT ON COLUMN public.sys_outbox_events.created_at IS '记录创建时间（数据库时间）';
+
+COMMENT ON COLUMN public.sys_outbox_events.status IS '处理状态: pending → locked → dispatched / retry_pending → dead_letter';
+
+COMMENT ON COLUMN public.sys_outbox_events.locked_at IS 'Relay 锁定时间';
+
+COMMENT ON COLUMN public.sys_outbox_events.locked_by IS 'Relay 实例标识';
+
+COMMENT ON COLUMN public.sys_outbox_events.retry_count IS '已重试次数';
+
+COMMENT ON COLUMN public.sys_outbox_events.max_retries IS '最大重试次数';
+
+COMMENT ON COLUMN public.sys_outbox_events.next_retry_at IS '下次重试时间（指数退避）';
+
+COMMENT ON COLUMN public.sys_outbox_events.last_error IS '最后一次错误信息';
+
+COMMENT ON COLUMN public.sys_outbox_events.audit_changes IS 'CloudTrail 审计变更信封（DomainEvent.AuditChanges：before/after 快照）';
+
+COMMENT ON COLUMN public.sys_outbox_events.audit_meta IS 'CloudTrail 审计元信息信封（DomainEvent.AuditMeta：reason/related_resource 等）';
+
+COMMENT ON COLUMN public.sys_outbox_events.schema_version IS '事件产生时绑定的 Integration Event schema 版本；写入后不可变';
+
+COMMENT ON COLUMN public.sys_outbox_events.outbox_ref IS 'Outbox 记录稳定公共引用，与 CloudEvents event_id 语义隔离';
+
+COMMENT ON COLUMN public.sys_outbox_events.aggregate_version IS '声明版本合同的事件生产者固化的正整数版本；其他事件为空';
+
+COMMENT ON COLUMN public.sys_outbox_events.product_code IS '事件所属产品；平台全局事件为空';
+
+CREATE TABLE public.sys_outbox_event_deliveries (
+    event_id uuid NOT NULL,
+    target character varying(40) NOT NULL,
+    status character varying(20) DEFAULT 'pending'::character varying NOT NULL,
+    retry_count smallint DEFAULT 0 NOT NULL,
+    max_retries smallint DEFAULT 10 NOT NULL,
+    next_retry_at timestamp(3) with time zone,
+    last_error text,
+    dispatched_at timestamp(3) with time zone,
+    locked_at timestamp(3) with time zone,
+    locked_by character varying(100),
+    created_at timestamp(3) with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp(3) with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT chk_sys_outbox_event_deliveries_max_retries CHECK ((max_retries > 0)),
+    CONSTRAINT chk_sys_outbox_event_deliveries_retry_count CHECK ((retry_count >= 0)),
+    CONSTRAINT chk_sys_outbox_event_deliveries_status CHECK (((status)::text = ANY (ARRAY[('pending'::character varying)::text, ('dispatched'::character varying)::text, ('retry_pending'::character varying)::text, ('dead_letter'::character varying)::text]))),
+    CONSTRAINT chk_sys_outbox_event_deliveries_target CHECK (((target)::text = ANY (ARRAY[('local_eventbus'::character varying)::text, ('asynq'::character varying)::text, ('redis_stream'::character varying)::text])))
+);
+
+ALTER TABLE ONLY public.sys_outbox_event_deliveries
+    ADD CONSTRAINT sys_outbox_event_deliveries_pkey PRIMARY KEY (event_id, target);
+
+CREATE INDEX idx_sys_outbox_event_deliveries_event ON public.sys_outbox_event_deliveries USING btree (event_id);
+
+CREATE INDEX idx_sys_outbox_event_deliveries_target_due ON public.sys_outbox_event_deliveries USING btree (target, status, next_retry_at, created_at) WHERE ((status)::text = ANY (ARRAY[('pending'::character varying)::text, ('retry_pending'::character varying)::text]));
+
+COMMENT ON TABLE public.sys_outbox_event_deliveries IS 'Outbox 事件按投递目标拆分的状态账本';
+
+COMMENT ON COLUMN public.sys_outbox_event_deliveries.event_id IS 'Outbox 事件唯一标识（逻辑引用 sys_outbox_events.id）';
+
+COMMENT ON COLUMN public.sys_outbox_event_deliveries.target IS '投递目标：local_eventbus / asynq / redis_stream';
+
+COMMENT ON COLUMN public.sys_outbox_event_deliveries.status IS '目标投递状态：pending / dispatched / retry_pending / dead_letter';
+
+COMMENT ON COLUMN public.sys_outbox_event_deliveries.retry_count IS '目标已重试次数';
+
+COMMENT ON COLUMN public.sys_outbox_event_deliveries.max_retries IS '目标最大重试次数';
+
+COMMENT ON COLUMN public.sys_outbox_event_deliveries.next_retry_at IS '目标下次重试时间';
+
+COMMENT ON COLUMN public.sys_outbox_event_deliveries.last_error IS '目标最后一次错误信息';
+
+COMMENT ON COLUMN public.sys_outbox_event_deliveries.dispatched_at IS '目标投递完成时间';
+
+COMMENT ON COLUMN public.sys_outbox_event_deliveries.locked_at IS 'Relay 锁定目标时间';
+
+COMMENT ON COLUMN public.sys_outbox_event_deliveries.locked_by IS 'Relay 实例标识';
+
+COMMENT ON COLUMN public.sys_outbox_event_deliveries.created_at IS '记录创建时间';
+
+COMMENT ON COLUMN public.sys_outbox_event_deliveries.updated_at IS '记录更新时间';
+
+CREATE FUNCTION public.reject_sys_outbox_event_delivery_identity_change() RETURNS trigger
+    LANGUAGE plpgsql
+    AS $$
+BEGIN
+    IF NEW.outbox_ref IS DISTINCT FROM OLD.outbox_ref
+        OR NEW.aggregate_version IS DISTINCT FROM OLD.aggregate_version
+        OR NEW.product_code IS DISTINCT FROM OLD.product_code THEN
+        RAISE EXCEPTION 'sys_outbox_events delivery identity is immutable'
+            USING ERRCODE = '23514';
+    END IF;
+    RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER trg_sys_outbox_events_delivery_identity_immutable BEFORE UPDATE OF outbox_ref, aggregate_version, product_code ON public.sys_outbox_events FOR EACH ROW EXECUTE FUNCTION public.reject_sys_outbox_event_delivery_identity_change();
+
+CREATE FUNCTION public.reject_sys_outbox_event_schema_version_change() RETURNS trigger
+    LANGUAGE plpgsql
+    AS $$
+BEGIN
+    IF NEW.schema_version IS DISTINCT FROM OLD.schema_version THEN
+        RAISE EXCEPTION 'sys_outbox_events.schema_version is immutable'
+            USING ERRCODE = '55000';
+    END IF;
+    RETURN NEW;
+END
+$$;
+
+CREATE TRIGGER trg_sys_outbox_events_schema_version_immutable BEFORE UPDATE OF schema_version ON public.sys_outbox_events FOR EACH ROW EXECUTE FUNCTION public.reject_sys_outbox_event_schema_version_change();
+
+CREATE FUNCTION public.sys_operation_logs_finalization_guard() RETURNS trigger
+    LANGUAGE plpgsql
+    AS $$
+BEGIN
+    IF TG_OP = 'DELETE' THEN
+        RAISE EXCEPTION 'sys_operation_logs are append-only';
+    END IF;
+
+    IF OLD.record_status = 'started' AND NEW.record_status = 'completed' THEN
+        RETURN NEW;
+    END IF;
+
+    RAISE EXCEPTION 'sys_operation_logs only allow started to completed transition';
+END;
+$$;
+
+CREATE TRIGGER trg_sys_operation_logs_finalization_guard BEFORE DELETE OR UPDATE ON public.sys_operation_logs FOR EACH ROW EXECUTE FUNCTION public.sys_operation_logs_finalization_guard();
+
+CREATE TABLE sys_command_replay_records (
+    id bigserial PRIMARY KEY,
+    created_at timestamp(3) with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp(3) with time zone DEFAULT now() NOT NULL,
+    command_scope character varying(128) NOT NULL,
+    idempotency_key character varying(191) NOT NULL,
+    request_hash character varying(64) NOT NULL,
+    principal_type character varying(32),
+    principal_ref character varying(64),
+    status character varying(20) DEFAULT 'started'::character varying NOT NULL,
+    response_payload jsonb DEFAULT '{}'::jsonb NOT NULL,
+    error_code character varying(120),
+    error_status integer,
+    expires_at timestamp(3) with time zone NOT NULL,
+    completed_at timestamp(3) with time zone,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    namespace varchar(200) NOT NULL,
+    external_reference_type varchar(64),
+    external_reference_no varchar(191),
+    execution_token_hash char(64),
+    lease_expires_at timestamptz(3),
+    external_next_recovery_at timestamptz(3),
+    external_attempt_count integer NOT NULL DEFAULT 0,
+    external_last_error_code varchar(120)
+);
+
+ALTER TABLE sys_command_replay_records
+ADD CONSTRAINT "uk_sys_command_replay_records_namespace_scope_key"
+        UNIQUE ("namespace", "command_scope", "idempotency_key"),
+    ADD CONSTRAINT "ck_sys_command_replay_records_namespace"
+        CHECK ("namespace" ~ '^[a-z][a-z0-9_-]*([.][a-z][a-z0-9_-]*){2,7}$'),
+    ADD CONSTRAINT "ck_sys_command_replay_records_scope"
+        CHECK (BTRIM("command_scope") <> '' AND BTRIM("idempotency_key") <> ''),
+    ADD CONSTRAINT "ck_sys_command_replay_records_request_hash"
+        CHECK ("request_hash" ~ '^[0-9a-f]{64}$'),
+    ADD CONSTRAINT "ck_sys_command_replay_records_status"
+        CHECK ("status" IN ('started', 'succeeded', 'failed')),
+    ADD CONSTRAINT "ck_sys_command_replay_records_principal"
+        CHECK (
+            (
+                "principal_type" IS NULL
+                AND "principal_ref" IS NULL
+            )
+            OR (
+                "principal_type" IS NOT NULL
+                AND BTRIM("principal_type") <> ''
+                AND "principal_ref" IS NOT NULL
+                AND BTRIM("principal_ref") <> ''
+            )
+        ),
+    ADD CONSTRAINT "ck_sys_command_replay_records_error_state"
+        CHECK (
+            (
+                "status" = 'failed'
+                AND "error_code" IS NOT NULL
+                AND BTRIM("error_code") <> ''
+                AND "error_status" BETWEEN 400 AND 599
+            )
+            OR (
+                "status" <> 'failed'
+                AND "error_code" IS NULL
+                AND "error_status" IS NULL
+            )
+        ),
+    ADD CONSTRAINT "ck_sys_command_replay_records_json"
+        CHECK (
+            jsonb_typeof("response_payload") = 'object'
+            AND jsonb_typeof("metadata") = 'object'
+        ),
+    ADD CONSTRAINT "ck_sys_command_replay_records_completed_at"
+        CHECK (
+            (
+                "status" = 'started'
+                AND "completed_at" IS NULL
+            )
+            OR (
+                "status" IN ('succeeded', 'failed')
+                AND "completed_at" IS NOT NULL
+                AND "completed_at" >= "created_at"
+            )
+        ),
+    ADD CONSTRAINT "ck_sys_command_replay_records_external_execution"
+        CHECK (
+            (
+                "external_reference_type" IS NULL
+                AND "external_reference_no" IS NULL
+                AND "execution_token_hash" IS NULL
+                AND "lease_expires_at" IS NULL
+                AND "external_next_recovery_at" IS NULL
+                AND "external_attempt_count" = 0
+                AND "external_last_error_code" IS NULL
+            )
+            OR (
+                "status" = 'started'
+                AND "external_reference_type" IS NOT NULL
+                AND BTRIM("external_reference_type") <> ''
+                AND "external_reference_no" IS NOT NULL
+                AND BTRIM("external_reference_no") <> ''
+                AND "external_next_recovery_at" IS NOT NULL
+                AND "external_attempt_count" > 0
+                AND (
+                    (
+                        "execution_token_hash" ~ '^[0-9a-f]{64}$'
+                        AND "lease_expires_at" IS NOT NULL
+                        AND "external_next_recovery_at" = "lease_expires_at"
+                        AND "external_last_error_code" IS NULL
+                    )
+                    OR (
+                        "execution_token_hash" IS NULL
+                        AND "lease_expires_at" IS NULL
+                        AND "external_last_error_code" IS NOT NULL
+                        AND BTRIM("external_last_error_code") <> ''
+                    )
+                )
+            )
+        );
+
+CREATE INDEX "idx_sys_command_replay_records_external_recovery"
+    ON "sys_command_replay_records" ("external_reference_type", "external_next_recovery_at", "id")
+    WHERE "status" = 'started' AND "external_reference_no" IS NOT NULL;
+
+COMMENT ON TABLE "sys_command_replay_records" IS '跨领域持久化命令回放与外部副作用恢复记录';
+
+COMMENT ON COLUMN "sys_command_replay_records"."id" IS '主键 ID';
+
+COMMENT ON COLUMN "sys_command_replay_records"."created_at" IS '创建时间';
+
+COMMENT ON COLUMN "sys_command_replay_records"."updated_at" IS '更新时间';
+
+COMMENT ON COLUMN "sys_command_replay_records"."namespace" IS '命令所有者全局命名空间';
+
+COMMENT ON COLUMN "sys_command_replay_records"."command_scope" IS '命令幂等作用域';
+
+COMMENT ON COLUMN "sys_command_replay_records"."idempotency_key" IS '调用方幂等键';
+
+COMMENT ON COLUMN "sys_command_replay_records"."request_hash" IS '规范请求载荷 SHA-256 摘要';
+
+COMMENT ON COLUMN "sys_command_replay_records"."principal_type" IS '调用主体类型';
+
+COMMENT ON COLUMN "sys_command_replay_records"."principal_ref" IS '调用主体公开引用';
+
+COMMENT ON COLUMN "sys_command_replay_records"."status" IS '命令执行状态';
+
+COMMENT ON COLUMN "sys_command_replay_records"."response_payload" IS '可回放响应载荷';
+
+COMMENT ON COLUMN "sys_command_replay_records"."error_code" IS '失败稳定错误码';
+
+COMMENT ON COLUMN "sys_command_replay_records"."error_status" IS '失败 HTTP 状态码';
+
+COMMENT ON COLUMN "sys_command_replay_records"."expires_at" IS '回放记录保留截止时间';
+
+COMMENT ON COLUMN "sys_command_replay_records"."completed_at" IS '命令完成时间';
+
+COMMENT ON COLUMN "sys_command_replay_records"."metadata" IS '非敏感扩展元数据';
+
+COMMENT ON COLUMN "sys_command_replay_records"."external_reference_type" IS '外部执行恢复处理器类型';
+
+COMMENT ON COLUMN "sys_command_replay_records"."external_reference_no" IS '外部执行业务引用';
+
+COMMENT ON COLUMN "sys_command_replay_records"."execution_token_hash" IS '外部执行租约令牌摘要';
+
+COMMENT ON COLUMN "sys_command_replay_records"."lease_expires_at" IS '外部执行租约截止时间';
+
+COMMENT ON COLUMN "sys_command_replay_records"."external_next_recovery_at" IS '外部执行下次恢复时间';
+
+COMMENT ON COLUMN "sys_command_replay_records"."external_attempt_count" IS '外部执行领取次数';
+
+COMMENT ON COLUMN "sys_command_replay_records"."external_last_error_code" IS '最近一次规范化恢复错误码';
+
+COMMIT;