@straiffi/archon 1.8.22 → 1.10.0

package/dist/server/db.js

@@ -4,6 +4,7 @@ import { parseCheckDefinitionsJsonStrict, parseLegacyTestCommandsJsonStrict, pro
 import { ensureParentDirectory, resolveArchonDbPath } from './lib/runtimePaths.js';
 import { TRANSCRIPT_RUN_TEXT_LIMIT_BYTES, truncateUtf8 } from './lib/transcriptRuns.js';
 import { createExecutionProfile, EXECUTION_PROFILE_SCHEMA_VERSION, fingerprintExecutionProfile, normalizeExecutionProfile, serializeExecutionProfile, } from './lib/executionProfiles.js';
+import { hasConfiguredCheckPolicy } from './lib/executionProfileCheckPolicy.js';
 const dbPath = ensureParentDirectory(resolveArchonDbPath());
 const db = new Database(dbPath);
 db.pragma('foreign_keys = ON');
@@ -181,7 +182,7 @@ db.exec(`
     id             TEXT PRIMARY KEY,
     project_id     TEXT NOT NULL,
     revision       INTEGER NOT NULL CHECK (revision > 0),
-    schema_version INTEGER NOT NULL CHECK (schema_version IN (1, 2)),
+    schema_version INTEGER NOT NULL CHECK (schema_version IN (1, 2, 3)),
     fingerprint    TEXT NOT NULL CHECK (length(fingerprint) = 64),
     profile_json   TEXT NOT NULL CHECK (
       json_valid(profile_json)
@@ -221,7 +222,7 @@ db.exec(`
     ON execution_profile_audit_events(project_id, created_at DESC, id DESC);
 `);
 const executionProfileRevisionsTableSql = db.prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'execution_profile_revisions'").get()?.sql ?? '';
-if (!executionProfileRevisionsTableSql.includes('schema_version IN (1, 2)')) {
+if (!executionProfileRevisionsTableSql.includes('schema_version IN (1, 2, 3)')) {
     db.pragma('foreign_keys = OFF');
     db.transaction(() => {
         const referencingTriggers = db.prepare(`
@@ -236,7 +237,7 @@ if (!executionProfileRevisionsTableSql.includes('schema_version IN (1, 2)')) {
         id             TEXT PRIMARY KEY,
         project_id     TEXT NOT NULL,
         revision       INTEGER NOT NULL CHECK (revision > 0),
-        schema_version INTEGER NOT NULL CHECK (schema_version IN (1, 2)),
+        schema_version INTEGER NOT NULL CHECK (schema_version IN (1, 2, 3)),
         fingerprint    TEXT NOT NULL CHECK (length(fingerprint) = 64),
         profile_json   TEXT NOT NULL CHECK (
           json_valid(profile_json)
@@ -297,7 +298,7 @@ const backfillExecutionProfiles = () => {
         }
     })();
 };
-const backfillExecutionProfilesToSchemaV2 = () => {
+const backfillExecutionProfilesToCurrentSchema = () => {
     const legacyRows = db.prepare(`
     SELECT projects.id AS project_id,
       revisions.id AS revision_id,
@@ -306,7 +307,7 @@ const backfillExecutionProfilesToSchemaV2 = () => {
     INNER JOIN execution_profile_revisions revisions
       ON revisions.id = projects.active_execution_profile_revision_id
       AND revisions.project_id = projects.id
-    WHERE revisions.schema_version = 1 AND projects.deletion_started_at IS NULL
+    WHERE revisions.schema_version IN (1, 2) AND projects.deletion_started_at IS NULL
   `).all();
     const nextRevisionNumber = db.prepare(`
     SELECT COALESCE(MAX(revision), 0) + 1 AS revision
@@ -348,19 +349,118 @@ const backfillExecutionProfilesToSchemaV2 = () => {
                 revisionId = existing.id;
             }
             else {
-                revisionId = `${row.project_id}:execution-profile:v2`;
+                revisionId = `${row.project_id}:execution-profile:v${EXECUTION_PROFILE_SCHEMA_VERSION}`;
                 const revisionNumber = nextRevisionNumber.get(row.project_id).revision;
                 insertRevision.run(revisionId, row.project_id, revisionNumber, fingerprint, serializeExecutionProfile(normalized.profile));
             }
             const activated = activateRevision.run(revisionId, row.project_id, row.revision_id);
             if (activated.changes > 0) {
-                insertEvent.run(`${revisionId}:v2-backfill`, row.project_id, revisionId, row.revision_id);
+                insertEvent.run(`${revisionId}:schema-backfill`, row.project_id, revisionId, row.revision_id);
             }
         }
     })();
 };
+const backfillExecutionProfileWorkloadEligibility = () => {
+    const listActiveRows = db.prepare(`
+    SELECT projects.id AS project_id,
+      revisions.id AS revision_id,
+      revisions.profile_json,
+      projects.required_check_definition_ids,
+      projects.pre_review_check_definition_ids,
+      projects.post_build_check_definition_ids,
+      projects.auto_fix_check_definition_ids
+    FROM projects
+    INNER JOIN execution_profile_revisions revisions
+      ON revisions.id = projects.active_execution_profile_revision_id
+      AND revisions.project_id = projects.id
+    WHERE revisions.schema_version = ${EXECUTION_PROFILE_SCHEMA_VERSION}
+      AND projects.deletion_started_at IS NULL
+  `);
+    const nextRevisionNumber = db.prepare(`
+    SELECT COALESCE(MAX(revision), 0) + 1 AS revision
+    FROM execution_profile_revisions WHERE project_id = ?
+  `);
+    const findRevisionByFingerprint = db.prepare(`
+    SELECT id FROM execution_profile_revisions WHERE project_id = ? AND fingerprint = ?
+  `);
+    const insertRevision = db.prepare(`
+    INSERT OR IGNORE INTO execution_profile_revisions (
+      id, project_id, revision, schema_version, fingerprint, profile_json
+    ) VALUES (?, ?, ?, ${EXECUTION_PROFILE_SCHEMA_VERSION}, ?, ?)
+  `);
+    const activateRevision = db.prepare(`
+    UPDATE projects SET active_execution_profile_revision_id = ?
+    WHERE id = ? AND active_execution_profile_revision_id = ?
+  `);
+    const insertEvent = db.prepare(`
+    INSERT OR IGNORE INTO execution_profile_audit_events (
+      id, project_id, event_type, profile_revision_id, previous_profile_revision_id
+    ) VALUES (?, ?, ?, ?, ?)
+  `);
+    db.transaction(() => {
+        const activeRows = listActiveRows.all();
+        for (const row of activeRows) {
+            let normalized;
+            try {
+                normalized = normalizeExecutionProfile(JSON.parse(row.profile_json));
+            }
+            catch {
+                normalized = null;
+            }
+            if (!normalized?.ok) {
+                throw new Error(`Stored execution profile revision ${row.revision_id} is invalid`);
+            }
+            const buildEligible = normalized.profile.eligible_workloads.includes('build');
+            const needsChatBuild = buildEligible && !normalized.profile.eligible_workloads.includes('chat_build');
+            const needsCheckTemplate = buildEligible
+                && hasConfiguredCheckPolicy(row)
+                && normalized.profile.check_template_policy.mode !== 'agent_template';
+            if (!needsChatBuild && !needsCheckTemplate) {
+                continue;
+            }
+            const repaired = normalizeExecutionProfile({
+                ...normalized.profile,
+                eligible_workloads: [
+                    ...normalized.profile.eligible_workloads,
+                    ...(needsChatBuild ? ['chat_build'] : []),
+                    ...(needsCheckTemplate ? ['check'] : []),
+                ],
+                check_template_policy: needsCheckTemplate
+                    ? { mode: 'agent_template', agent: 'opencode' }
+                    : normalized.profile.check_template_policy,
+            });
+            if (!repaired.ok) {
+                throw new Error(`Stored execution profile revision ${row.revision_id} is invalid`);
+            }
+            const fingerprint = fingerprintExecutionProfile(repaired.profile);
+            let target = findRevisionByFingerprint.get(row.project_id, fingerprint);
+            const repairKey = needsChatBuild && needsCheckTemplate
+                ? 'chat-build-check'
+                : needsChatBuild
+                    ? 'chat-build'
+                    : 'configured-check';
+            if (!target) {
+                const revisionId = `${row.project_id}:execution-profile:${repairKey}-v${EXECUTION_PROFILE_SCHEMA_VERSION}`;
+                const revisionNumber = nextRevisionNumber.get(row.project_id).revision;
+                const inserted = insertRevision.run(revisionId, row.project_id, revisionNumber, fingerprint, serializeExecutionProfile(repaired.profile));
+                target = findRevisionByFingerprint.get(row.project_id, fingerprint);
+                if (!target) {
+                    throw new Error(`Failed to migrate stored execution profile revision ${row.revision_id}`);
+                }
+                if (inserted.changes > 0) {
+                    insertEvent.run(`${target.id}:${repairKey}-backfill-created`, row.project_id, 'revision_created', target.id, row.revision_id);
+                }
+            }
+            const activated = activateRevision.run(target.id, row.project_id, row.revision_id);
+            if (activated.changes > 0) {
+                insertEvent.run(`${target.id}:${repairKey}-backfill-activated`, row.project_id, 'revision_activated', target.id, row.revision_id);
+            }
+        }
+    }).immediate();
+};
 backfillExecutionProfiles();
-backfillExecutionProfilesToSchemaV2();
+backfillExecutionProfilesToCurrentSchema();
+backfillExecutionProfileWorkloadEligibility();
 const hostCompatibilityProfile = createExecutionProfile('host');
 const hostCompatibilityProfileJson = serializeExecutionProfile(hostCompatibilityProfile).replaceAll("'", "''");
 const hostCompatibilityFingerprint = fingerprintExecutionProfile(hostCompatibilityProfile);
@@ -2195,6 +2295,7 @@ db.exec(`
     stage              TEXT NOT NULL,
     diff_signature     TEXT,
     workspace_signature TEXT,
+    change_scope       TEXT,
     message_id         TEXT,
     model              TEXT,
     variant            TEXT,
@@ -2212,6 +2313,7 @@ const migrateReviewRunsLifecycleSchema = () => {
     const workspaceSignatureColumn = columns.find(column => column.name === 'workspace_signature');
     const needsMigration = diffSignatureColumn?.notnull === 1
         || workspaceSignatureColumn?.notnull === 1
+        || !columns.some(column => column.name === 'change_scope')
         || !columns.some(column => column.name === 'model')
         || !columns.some(column => column.name === 'variant')
         || !columns.some(column => column.name === 'failure_message')
@@ -2232,6 +2334,7 @@ const migrateReviewRunsLifecycleSchema = () => {
         stage               TEXT NOT NULL,
         diff_signature      TEXT,
         workspace_signature TEXT,
+        change_scope        TEXT,
         message_id          TEXT,
         model               TEXT,
         variant             TEXT,
@@ -2246,12 +2349,13 @@ const migrateReviewRunsLifecycleSchema = () => {
         db.exec(`
       INSERT INTO review_runs_v2 (
         id, ticket_id, project_id, worktree_bundle_id, stage, diff_signature,
-        workspace_signature, message_id, model, variant, failure_message,
+        workspace_signature, change_scope, message_id, model, variant, failure_message,
         status, created_at, updated_at
       )
       SELECT
         id, ticket_id, project_id, worktree_bundle_id, stage, diff_signature,
-        ${selectColumn('workspace_signature', 'NULL')}, message_id,
+        ${selectColumn('workspace_signature', 'NULL')},
+        ${selectColumn('change_scope', 'NULL')}, message_id,
         ${selectColumn('model', 'NULL')}, ${selectColumn('variant', 'NULL')},
         ${selectColumn('failure_message', 'NULL')}, status, created_at,
         ${selectColumn('updated_at', 'created_at')}
@@ -2497,6 +2601,49 @@ const migrateExecutionLifecycleSchema = () => {
     }
 };
 migrateExecutionLifecycleSchema();
+db.exec(`
+  CREATE TABLE IF NOT EXISTS service_run_details (
+    execution_run_id                 TEXT PRIMARY KEY,
+    project_id                       TEXT NOT NULL,
+    context_key                      TEXT NOT NULL,
+    target_kind                      TEXT NOT NULL,
+    target_key                       TEXT NOT NULL,
+    target_workspace_path            TEXT NOT NULL,
+    execution_profile_revision_id    TEXT NOT NULL,
+    execution_profile_fingerprint    TEXT NOT NULL,
+    provider_kind                    TEXT,
+    environment_id                   TEXT,
+    environment_revision             INTEGER,
+    service_snapshot_json            TEXT NOT NULL,
+    placement_json                   TEXT,
+    interruption_scope               TEXT,
+    created_at                       DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    started_at                       DATETIME,
+    completed_at                     DATETIME,
+    updated_at                       DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    FOREIGN KEY (execution_run_id, project_id) REFERENCES execution_runs(id, project_id) ON DELETE CASCADE,
+    FOREIGN KEY (project_id, execution_profile_revision_id)
+      REFERENCES execution_profile_revisions(project_id, id) ON DELETE RESTRICT,
+    CHECK (length(CAST(context_key AS BLOB)) BETWEEN 1 AND 1000),
+    CHECK (length(CAST(target_kind AS BLOB)) BETWEEN 1 AND 100),
+    CHECK (length(CAST(target_key AS BLOB)) BETWEEN 1 AND 1000),
+    CHECK (length(CAST(target_workspace_path AS BLOB)) BETWEEN 1 AND 4096),
+    CHECK (length(execution_profile_fingerprint) = 64 AND execution_profile_fingerprint NOT GLOB '*[^0-9a-f]*'),
+    CHECK (provider_kind IS NULL OR provider_kind IN ('host', 'docker_sandbox')),
+    CHECK ((environment_id IS NULL) = (environment_revision IS NULL)),
+    CHECK (environment_revision IS NULL OR environment_revision >= 1),
+    CHECK (length(CAST(service_snapshot_json AS BLOB)) BETWEEN 2 AND 16384),
+    CHECK (placement_json IS NULL OR length(CAST(placement_json AS BLOB)) BETWEEN 2 AND 16384),
+    CHECK (interruption_scope IS NULL OR interruption_scope IN ('local_processes', 'whole_environment'))
+  );
+
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_active_service_run_context
+    ON service_run_details(project_id, context_key)
+    WHERE completed_at IS NULL;
+
+  CREATE INDEX IF NOT EXISTS idx_service_run_profile
+    ON service_run_details(project_id, execution_profile_revision_id, created_at);
+`);
 const executionEnvironmentStates = "'queued', 'preparing', 'ready', 'running', 'stopped', 'retiring', 'cleanup_pending', 'retired', 'failed', 'unavailable'";
 db.exec(`
   CREATE TABLE IF NOT EXISTS execution_environments (
@@ -2526,6 +2673,11 @@ db.exec(`
     cleanup_claim_id                    TEXT,
     cleanup_claimed_at                  DATETIME,
     cleanup_attempts                    INTEGER NOT NULL DEFAULT 0,
+    cleanup_retry_at                    DATETIME,
+    idle_stop_at                        DATETIME,
+    operation_claim_id                  TEXT,
+    operation_kind                      TEXT,
+    operation_claimed_at                DATETIME,
     created_at                          DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
     preparation_started_at              DATETIME,
     ready_at                            DATETIME,
@@ -2567,7 +2719,10 @@ db.exec(`
     CHECK (failure_message IS NULL OR length(failure_message) <= 4000),
     CHECK (failure_details_json IS NULL OR length(CAST(failure_details_json AS BLOB)) <= 16384),
     CHECK ((cleanup_claim_id IS NULL) = (cleanup_claimed_at IS NULL)),
-    CHECK (cleanup_attempts >= 0)
+    CHECK (cleanup_attempts >= 0),
+    CHECK ((operation_claim_id IS NULL) = (operation_kind IS NULL)),
+    CHECK ((operation_claim_id IS NULL) = (operation_claimed_at IS NULL)),
+    CHECK (operation_kind IS NULL OR operation_kind IN ('stop', 'retire', 'reset', 'cleanup_retry'))
   );
 
   CREATE TABLE IF NOT EXISTS execution_environment_events (
@@ -2691,6 +2846,11 @@ ensureColumn('execution_environments', 'execution_profile_revision_id', 'TEXT');
 ensureColumn('execution_environments', 'execution_profile_fingerprint', 'TEXT');
 ensureColumn('execution_environments', 'credential_requirements_fingerprint', 'TEXT');
 ensureColumn('execution_environments', 'retirement_requested_at', 'DATETIME');
+ensureColumn('execution_environments', 'cleanup_retry_at', 'DATETIME');
+ensureColumn('execution_environments', 'idle_stop_at', 'DATETIME');
+ensureColumn('execution_environments', 'operation_claim_id', 'TEXT');
+ensureColumn('execution_environments', 'operation_kind', 'TEXT');
+ensureColumn('execution_environments', 'operation_claimed_at', 'DATETIME');
 ensureColumn('execution_environment_run_bindings', 'execution_profile_fingerprint', 'TEXT');
 ensureColumn('execution_environment_run_bindings', 'authority_json', 'TEXT');
 ensureColumn('execution_environment_run_bindings', 'placement_json', 'TEXT');
@@ -3086,9 +3246,41 @@ db.exec('DROP INDEX IF EXISTS idx_execution_environments_reuse');
 db.exec('CREATE INDEX idx_execution_environments_reuse ON execution_environments(project_id, provider_kind, target_key, target_workspace_path, environment_revision, workspace_mode, environment_validation_fingerprint, execution_profile_fingerprint, credential_requirements_fingerprint, retirement_requested_at, lifecycle_state)');
 db.exec('CREATE UNIQUE INDEX IF NOT EXISTS idx_execution_environments_external_id ON execution_environments(provider_kind, external_id) WHERE external_id IS NOT NULL');
 db.exec('CREATE INDEX IF NOT EXISTS idx_execution_environments_cleanup ON execution_environments(lifecycle_state, cleanup_claim_id, updated_at, cleanup_attempts)');
+db.exec('CREATE INDEX IF NOT EXISTS idx_execution_environments_cleanup_retry ON execution_environments(lifecycle_state, cleanup_retry_at, cleanup_claim_id)');
+db.exec('CREATE INDEX IF NOT EXISTS idx_execution_environments_idle_stop ON execution_environments(idle_stop_at, lifecycle_state) WHERE idle_stop_at IS NOT NULL');
+db.exec('CREATE INDEX IF NOT EXISTS idx_execution_environments_operation_claim ON execution_environments(operation_claim_id, operation_claimed_at) WHERE operation_claim_id IS NOT NULL');
 db.exec('CREATE INDEX IF NOT EXISTS idx_execution_environment_events_sequence ON execution_environment_events(project_id, environment_id, sequence)');
 db.exec('CREATE INDEX IF NOT EXISTS idx_execution_environment_bindings_run ON execution_environment_run_bindings(project_id, execution_run_id, bound_at)');
 db.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_execution_environment_active_execution_lease ON execution_environment_run_bindings(environment_id) WHERE relationship = 'execution' AND released_at IS NULL");
+db.exec(`
+  CREATE TRIGGER IF NOT EXISTS validate_execution_environment_operation_claim
+  BEFORE UPDATE OF operation_claim_id, operation_kind, operation_claimed_at ON execution_environments
+  WHEN NOT (
+    (NEW.operation_claim_id IS NULL AND NEW.operation_kind IS NULL AND NEW.operation_claimed_at IS NULL)
+    OR (
+      length(NEW.operation_claim_id) BETWEEN 1 AND 128
+      AND NEW.operation_kind IN ('stop', 'retire', 'reset', 'cleanup_retry')
+      AND NEW.operation_claimed_at IS NOT NULL
+    )
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Invalid execution environment operation claim');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS validate_execution_environment_lease_admission
+  BEFORE INSERT ON execution_environment_run_bindings
+  WHEN NEW.relationship = 'execution' AND NOT EXISTS (
+    SELECT 1 FROM execution_environments
+    WHERE id = NEW.environment_id
+      AND project_id = NEW.project_id
+      AND lifecycle_state IN ('ready', 'running', 'stopped')
+      AND retirement_requested_at IS NULL
+      AND operation_claim_id IS NULL
+  )
+  BEGIN
+    SELECT RAISE(ABORT, 'Execution environment is not admitting leases');
+  END;
+`);
 db.exec(`
   CREATE TRIGGER IF NOT EXISTS validate_repository_graph_execution_run_binding
   BEFORE UPDATE OF execution_run_id ON repository_graph_scans
@@ -3360,6 +3552,8 @@ db.exec(`
     automation_boundary_purpose        TEXT,
     purpose                            TEXT NOT NULL DEFAULT 'manual',
     causal_source_run_id               TEXT,
+    runtime_compatibility_json         TEXT,
+    batch_environment_json             TEXT,
     FOREIGN KEY (execution_run_id) REFERENCES execution_runs(id) ON DELETE CASCADE,
     FOREIGN KEY (rerun_of_batch_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
     FOREIGN KEY (causal_source_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
@@ -3409,6 +3603,7 @@ db.exec(`
     total_persisted_bytes           INTEGER NOT NULL DEFAULT 0,
     retained_output                 TEXT NOT NULL DEFAULT '',
     output_retention_state          TEXT NOT NULL DEFAULT 'retained',
+    placement_json                  TEXT,
     FOREIGN KEY (execution_run_id) REFERENCES execution_runs(id) ON DELETE CASCADE,
     FOREIGN KEY (batch_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
     FOREIGN KEY (rerun_of_attempt_run_id) REFERENCES execution_runs(id) ON DELETE RESTRICT,
@@ -3416,7 +3611,7 @@ db.exec(`
     CHECK (length(definition_fingerprint) = 64 AND definition_fingerprint NOT GLOB '*[^0-9a-f]*'),
     CHECK (outcome IS NULL OR outcome IN ('passed', 'command_failure', 'spawn_failure',
       'infrastructure_failure', 'evidence_persistence_failure', 'timeout',
-      'workspace_changed_before_start', 'user_stop', 'restart_loss', 'shutdown_loss', 'ambiguous_process_loss')),
+      'workspace_changed_before_start', 'user_stop', 'restart_loss', 'shutdown_loss', 'ambiguous_process_loss', 'environment_loss')),
     CHECK (output_revision >= 0 AND retained_start_offset >= 0 AND retained_end_offset >= retained_start_offset
       AND total_persisted_bytes >= retained_end_offset),
     CHECK (output_retention_state IN ('retained', 'expired'))
@@ -3424,11 +3619,15 @@ db.exec(`
 `);
 ensureColumn('check_attempt_details', 'retained_end_offset', 'INTEGER NOT NULL DEFAULT 0');
 ensureColumn('check_attempt_details', 'retained_output', "TEXT NOT NULL DEFAULT ''");
+ensureColumn('check_attempt_details', 'placement_json', 'TEXT');
+ensureColumn('check_batch_details', 'runtime_compatibility_json', 'TEXT');
+ensureColumn('check_batch_details', 'batch_environment_json', 'TEXT');
 const checkAttemptSchema = db.prepare(`
   SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'check_attempt_details'
 `).get();
 if (checkAttemptSchema && (!checkAttemptSchema.sql.includes('evidence_persistence_failure')
-    || !checkAttemptSchema.sql.includes('ambiguous_process_loss'))) {
+    || !checkAttemptSchema.sql.includes('ambiguous_process_loss')
+    || !checkAttemptSchema.sql.includes('environment_loss'))) {
     const foreignKeysEnabled = db.pragma('foreign_keys', { simple: true }) === 1;
     if (foreignKeysEnabled) {
         db.pragma('foreign_keys = OFF');
@@ -3469,7 +3668,7 @@ if (checkAttemptSchema && (!checkAttemptSchema.sql.includes('evidence_persistenc
         CHECK (length(definition_fingerprint) = 64 AND definition_fingerprint NOT GLOB '*[^0-9a-f]*'),
         CHECK (outcome IS NULL OR outcome IN ('passed', 'command_failure', 'spawn_failure',
           'infrastructure_failure', 'evidence_persistence_failure', 'timeout',
-          'workspace_changed_before_start', 'user_stop', 'restart_loss', 'shutdown_loss', 'ambiguous_process_loss')),
+          'workspace_changed_before_start', 'user_stop', 'restart_loss', 'shutdown_loss', 'ambiguous_process_loss', 'environment_loss')),
         CHECK (output_revision >= 0 AND retained_start_offset >= 0 AND retained_end_offset >= retained_start_offset
           AND total_persisted_bytes >= retained_end_offset),
         CHECK (output_retention_state IN ('retained', 'expired'))
@@ -3503,6 +3702,7 @@ if (checkAttemptSchema && (!checkAttemptSchema.sql.includes('evidence_persistenc
         throw new Error(`Check attempt migration left an invalid foreign key: ${JSON.stringify(foreignKeyViolation)}`);
     }
 }
+ensureColumn('check_attempt_details', 'placement_json', 'TEXT');
 db.exec(`
   CREATE TABLE IF NOT EXISTS check_attempt_diagnostic_parsers (
     attempt_run_id   TEXT PRIMARY KEY,
@@ -4416,6 +4616,8 @@ db.prepare(`
 db.exec('DROP TRIGGER IF EXISTS validate_check_batch_details_insert');
 db.exec('DROP TRIGGER IF EXISTS preserve_check_batch_snapshots');
 db.exec('DROP TRIGGER IF EXISTS preserve_completed_check_batch_details');
+db.exec('DROP TRIGGER IF EXISTS preserve_check_batch_environment_binding');
+db.exec('DROP TRIGGER IF EXISTS preserve_check_attempt_placement');
 db.exec(`
   CREATE TRIGGER IF NOT EXISTS preserve_check_batch_snapshots
   BEFORE UPDATE OF execution_run_id, target_kind, target_bundle_id, target_label,
@@ -4432,6 +4634,14 @@ db.exec(`
     SELECT RAISE(ABORT, 'Completed check batch details are immutable');
   END;
 
+  CREATE TRIGGER IF NOT EXISTS preserve_check_batch_environment_binding
+  BEFORE UPDATE OF runtime_compatibility_json, batch_environment_json ON check_batch_details
+  WHEN OLD.runtime_compatibility_json IS NOT NULL OR OLD.batch_environment_json IS NOT NULL
+    OR NEW.runtime_compatibility_json IS NULL OR NEW.batch_environment_json IS NULL
+  BEGIN
+    SELECT RAISE(ABORT, 'Check batch environment binding is immutable');
+  END;
+
   CREATE TRIGGER IF NOT EXISTS preserve_check_attempt_snapshots
   BEFORE UPDATE OF execution_run_id, batch_run_id, definition_id, command_snapshot_json,
     definition_fingerprint, initial_workspace_identity_json, rerun_of_attempt_run_id
@@ -4448,6 +4658,13 @@ db.exec(`
     SELECT RAISE(ABORT, 'Completed check attempt details are immutable');
   END;
 
+  CREATE TRIGGER IF NOT EXISTS preserve_check_attempt_placement
+  BEFORE UPDATE OF placement_json ON check_attempt_details
+  WHEN OLD.placement_json IS NOT NULL OR NEW.placement_json IS NULL
+  BEGIN
+    SELECT RAISE(ABORT, 'Check attempt placement is immutable');
+  END;
+
   CREATE TRIGGER IF NOT EXISTS validate_check_batch_details_insert
   BEFORE INSERT ON check_batch_details
   WHEN NOT EXISTS (