@taskforcehq/taskforce 0.3.305 → 0.3.307

package/dist/core/Taskforce.js

@@ -7,15 +7,18 @@ import { TemplateEngine } from '../services/templateEngine.js';
 import { createDatabaseAdapter } from '../storage/createDatabaseAdapter.js';
 import { WorkspaceAssetStore } from '../storage/workspaceAssetStore.js';
 import { AuthTokenService } from './AuthTokenService.js';
-import { getAiProfileByTokenService, listAiProfilesService, mergeAiProfilesService, resolveAiProfileService, upsertAiProfileForSyncService, } from './AiProfileService.js';
-import { syncCanonicalTaskAttachmentLinksService, } from './AttachmentLinkService.js';
-import { addTaskEventService, buildTaskActivityService, listTaskEventsInternalService, listWorkspaceTaskEventsService, replaceTaskCommentsService, replaceTaskEventsService, upsertTaskEventForSyncService, } from './TaskActivityService.js';
+import { AuthIdentityService } from './AuthIdentityService.js';
+import { archiveAiProfileService, getAiProfileByTokenService, listAiProfilesService, mergeAiProfilesService, resolveAiProfileService, updateAiProfileAvatarService, updateAiProfileSurfaceTypeService, upsertAiProfileForSyncService, } from './AiProfileService.js';
+import { syncCanonicalAttachmentLinksForTargetService, syncCanonicalTaskAttachmentLinksService, } from './AttachmentLinkService.js';
+import { addEntityEventService, addTaskEventService, buildEntityActivityService, buildTaskActivityService, getEntityEventForSyncService, getTaskEventForSyncService, listEntityEventsInternalService, listWorkspaceEntityEventsForSyncService, listTaskEventsInternalService, listWorkspaceTaskEventsForSyncService, replaceEntityEventsService, replaceTaskCommentsService, replaceTaskEventsService, upsertEntityEventForSyncService, upsertTaskEventForSyncService, } from './TaskActivityService.js';
 import { addDeletedTaskRecordService, getDeletedTaskService, listDeletedTasksService, mapDeletedTaskRowService, normalizeTaskSnapshotForRestoreService, pruneDeletedTasksService, purgeExpiredDeletedTasksService, } from './DeletedTaskLifecycleService.js';
 import { applyWorkspaceSyncSnapshotService, deleteDocumentWatermarkService, getDocumentWatermarkService, listTasksForSyncService, listWorkspaceSyncDeletesSinceService, readPushIdempotencyService, recordSyncEventService, upsertDocumentWatermarkService, writePushIdempotencyService, } from './SyncReconciliationService.js';
 import { getGlobalSettingsService, hasPersistedGlobalSettingsService, readGlobalConfigService, updateGlobalSettingsService, writeGlobalConfigService, } from './GlobalSettingsService.js';
 import { getWorkspaceTaxonomyStateService, upsertWorkspaceTaxonomyStateService, } from './TaxonomySettingsService.js';
 import { normalizeWorkspaceTaxonomyStatePayload, } from '../shared/taxonomyState.js';
 import { parseAiProfileSurfaceType } from '../shared/aiProfileSurfaceType.js';
+import { parseAiProfileSeatScope } from '../shared/aiProfileSeatScope.js';
+import { validatePasswordPolicy } from '../shared/passwordPolicy.js';
 import { normalizeTaskforceTheme } from '../utils/theme.js';
 import { McpTokenService } from './McpTokenService.js';
 import { PlanEntitlementService } from './PlanEntitlementService.js';
@@ -38,7 +41,7 @@ import { getDocumentReferenceLabel } from '../utils/documentReferences.js';
 import { getImageReferenceLabel } from '../utils/imageReferences.js';
 import { getCanonicalDocumentName } from '../utils/documentNames.js';
 import { DEFAULT_TASKFORCE_THEME } from '../utils/theme.js';
-import { ensureAssigneeTaskSchema, ensureAnnotatedAttachmentSessionsSchema, ensureBillingSchema, ensureDocumentReviewSessionsSchema, ensureDocumentReferenceSchema, ensureEntitlementsSchema, ensureParentTaskSchema, ensureScheduleTaskSchema, ensureTaskAssetsSchema, ensureTaskReferenceSchema, ensureTenantSchema, ensureWorkspaceAssetsSchema, ensureWorkspaceSchema } from '../migrations/taskSchemaMigrations.js';
+import { ensureAssigneeTaskSchema, ensureAnnotatedAttachmentSessionsSchema, ensureAuthIdentitySchema, ensureBillingSchema, ensureDocumentReviewSessionsSchema, ensureDocumentReferenceSchema, ensureEntitlementsSchema, ensureScheduleTaskSchema, ensureTaskAssetsSchema, ensureTaskReferenceSchema, ensureTenantSchema, ensureWorkspaceAssetsSchema, ensureWorkspaceSchema } from '../migrations/taskSchemaMigrations.js';
 export class TaskforceRuleError extends Error {
     statusCode;
     code;
@@ -54,52 +57,7 @@ export class TaskforceRuleError extends Error {
 const WORKSPACE_SYNC_SETTINGS_KEY_ALLOWLIST = new Set([]);
 const GENERIC_AI_ACTOR_COLOR = '#6B7280';
 const GENERIC_AI_ACTOR_ICON = 'Bot';
-const DOCUMENT_CLOUD_STORAGE_FEATURE_KEY = 'context.uploads';
-const LEGACY_REMOVED_PLAN_FEATURE_KEYS = Object.freeze([
-    'documents.workspace_access'
-]);
-const WORKSPACES_FEATURE_KEY = 'workspace.switching';
-const DOCUMENT_CLOUD_STORAGE_LIMIT_CONFIG_KEY = 'storageLimitMb';
-const WORKSPACES_LIMIT_CONFIG_KEY = 'maxWorkspaces';
-const MCP_ACCESS_TOKEN_MAX_ACTIVE_PER_USER_WORKSPACE = 10;
-const MCP_ACCESS_TOKEN_DEFAULT_PAGE_SIZE = 20;
-const MCP_ACCESS_TOKEN_MAX_PAGE_SIZE = 100;
-const MCP_OAUTH_AUTH_CODE_TTL_MS = 10 * 60 * 1000;
-const MCP_ACCESS_TOKEN_ALLOWED_SCOPES = ['tasks:read', 'tasks:write', 'workspace:read'];
 const DELETED_TASK_RETENTION_MS = 90 * 24 * 60 * 60 * 1000;
-const DEFAULT_PLAN_FEATURE_CATALOG = [
-    {
-        featureKey: 'collaboration.team_management',
-        label: 'Team Management',
-        description: 'Allow managing members, invites, roles, and collaboration settings.',
-        allowedAccessModes: ['enabled', 'disabled'],
-        configTemplate: {}
-    },
-    {
-        featureKey: DOCUMENT_CLOUD_STORAGE_FEATURE_KEY,
-        label: 'Document Cloud Storage',
-        description: 'Allow cloud document storage with an optional storage allowance in MB.',
-        allowedAccessModes: ['enabled', 'limited', 'disabled'],
-        configTemplate: {
-            [DOCUMENT_CLOUD_STORAGE_LIMIT_CONFIG_KEY]: 1024
-        }
-    },
-    {
-        featureKey: WORKSPACES_FEATURE_KEY,
-        label: 'Workspaces',
-        description: 'Allow multiple workspaces with a configurable workspace limit.',
-        allowedAccessModes: ['enabled', 'disabled'],
-        configTemplate: {
-            [WORKSPACES_LIMIT_CONFIG_KEY]: 1
-        }
-    }
-];
-const PLAN_FEATURE_DEPENDENCIES = Object.freeze(DEFAULT_PLAN_FEATURE_CATALOG.reduce((acc, feature) => {
-    if (Array.isArray(feature.dependsOn) && feature.dependsOn.length > 0) {
-        acc[feature.featureKey] = [...feature.dependsOn];
-    }
-    return acc;
-}, {}));
 function hashPassword(password) {
     const iterations = 120000;
     const salt = randomBytes(16).toString('hex');
@@ -121,6 +79,12 @@ function verifyPassword(password, encoded) {
         return false;
     return timingSafeEqual(actual, expected);
 }
+function assertPasswordPolicy(password, context) {
+    const validation = validatePasswordPolicy(password, context);
+    if (!validation.ok) {
+        throw new TaskforceRuleError(validation.message || 'Password does not meet the password policy.', 400, validation.code || 'PASSWORD_TOO_SHORT');
+    }
+}
 function hashAuthToken(token) {
     return createHash('sha256').update(token).digest('hex');
 }
@@ -179,6 +143,7 @@ export class TaskforceCore {
     db;
     globalSettingsDb = null;
     authTokenService;
+    identityService;
     mcpTokenService;
     planEntitlementService;
     realtimeMutationListeners = new Set();
@@ -303,6 +268,15 @@ export class TaskforceCore {
         const normalized = String(value || '').trim().toLowerCase();
         return normalized === 'user' || normalized === 'human';
     }
+    isStableActorReference(value) {
+        const normalized = String(value || '').trim().toLowerCase();
+        if (!normalized)
+            return false;
+        return normalized === 'user'
+            || normalized === 'system'
+            || normalized.startsWith('user-')
+            || normalized.startsWith('ai-profile-');
+    }
     normalizeAiProfileName(name) {
         const normalized = String(name || '').trim();
         if (!normalized) {
@@ -408,12 +382,24 @@ export class TaskforceCore {
             username: String(row.username || '').trim() || this.normalizeAiProfileUsername(row.name, 'ai'),
             icon: this.normalizeAiProfileIcon(row.icon),
             color: this.normalizeAiProfileColor(row.color),
+            avatarUrl: typeof row.avatar_url === 'string' && row.avatar_url.trim().length > 0 ? row.avatar_url.trim() : null,
+            avatarSourceUrl: typeof row.avatar_source_url === 'string' && row.avatar_source_url.trim().length > 0 ? row.avatar_source_url.trim() : null,
+            avatarRevision: Number.isFinite(Number(row.avatar_revision)) ? Math.max(0, Math.floor(Number(row.avatar_revision))) : 0,
+            avatarUpdatedAt: typeof row.avatar_updated_at === 'string' && row.avatar_updated_at.trim().length > 0 ? row.avatar_updated_at.trim() : null,
             description: typeof row.description === 'string' && row.description.trim().length > 0 ? row.description.trim() : null,
             role: typeof row.role === 'string' && row.role.trim().length > 0 ? row.role.trim() : null,
             provider: typeof row.provider === 'string' && row.provider.trim().length > 0 ? row.provider.trim() : null,
             model: typeof row.model === 'string' && row.model.trim().length > 0 ? row.model.trim() : null,
             surfaceType: parseAiProfileSurfaceType(row.surface_type),
+            seatScope: parseAiProfileSeatScope(row.seat_scope),
             providerMetadata,
+            archivedAt: typeof row.archived_at === 'string' ? row.archived_at : null,
+            archivedBy: typeof row.archived_by === 'string' && row.archived_by.trim().length > 0 ? row.archived_by.trim() : null,
+            archivedReason: typeof row.archived_reason === 'string' && row.archived_reason.trim().length > 0 ? row.archived_reason.trim() : null,
+            mergedIntoProfileId: typeof row.merged_into_profile_id === 'string' && row.merged_into_profile_id.trim().length > 0 ? row.merged_into_profile_id.trim() : null,
+            rosterStateUpdatedAt: typeof row.roster_state_updated_at === 'string' && row.roster_state_updated_at.trim().length > 0
+                ? row.roster_state_updated_at.trim()
+                : null,
             createdAt: String(row.created_at || '').trim(),
             updatedAt: String(row.updated_at || '').trim(),
             lastActiveAt: typeof row.last_active_at === 'string' ? row.last_active_at : null
@@ -429,17 +415,77 @@ export class TaskforceCore {
             color: profile.color,
             isNamed: true,
             meta: {
-                profileToken: profile.profileToken,
                 workspaceId: profile.workspaceId,
+                avatarUrl: profile.avatarUrl ?? null,
+                avatarSourceUrl: profile.avatarSourceUrl ?? null,
                 lastActiveAt: profile.lastActiveAt ?? null,
                 description: profile.description ?? null,
                 role: profile.role ?? null,
                 provider: profile.provider ?? null,
                 model: profile.model ?? null,
-                surfaceType: profile.surfaceType ?? null
+                surfaceType: profile.surfaceType ?? null,
+                seatScope: profile.seatScope ?? null,
+                archivedAt: profile.archivedAt ?? null,
+                archivedBy: profile.archivedBy ?? null,
+                archivedReason: profile.archivedReason ?? null,
+                mergedIntoProfileId: profile.mergedIntoProfileId ?? null,
+                rosterStateUpdatedAt: profile.rosterStateUpdatedAt ?? null
             }
         };
     }
+    resolveCanonicalAiProfileId(rowById, profileId) {
+        let currentId = String(profileId || '').trim();
+        const visited = new Set();
+        while (currentId) {
+            if (visited.has(currentId))
+                break;
+            visited.add(currentId);
+            const row = rowById.get(currentId);
+            const mergedIntoProfileId = String(row?.merged_into_profile_id || '').trim();
+            if (!mergedIntoProfileId || mergedIntoProfileId === currentId)
+                break;
+            currentId = mergedIntoProfileId;
+        }
+        return currentId;
+    }
+    findCanonicalAiProfileIdsByAlias(workspaceId, actorRef) {
+        const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
+        const rawActorRef = String(actorRef || '').trim();
+        if (!rawActorRef)
+            return [];
+        const matches = this.db.prepare(`
+            SELECT *
+            FROM ai_profiles
+            WHERE tenant_id = ?
+              AND workspace_id = ?
+              AND (
+                  LOWER(name) = LOWER(?)
+                  OR LOWER(username) = LOWER(?)
+              )
+            ORDER BY COALESCE(last_active_at, updated_at, created_at) DESC, id ASC
+        `).all(this.tenantId, normalizedWorkspaceId, rawActorRef, rawActorRef);
+        const rowById = new Map(matches
+            .map((row) => [String(row.id || '').trim(), row])
+            .filter(([id]) => Boolean(id)));
+        return [...new Set(matches
+                .map((row) => this.resolveCanonicalAiProfileId(rowById, String(row.id || '').trim()))
+                .filter(Boolean))];
+    }
+    resolveUniqueAiProfileActorByAlias(workspaceId, actorRef) {
+        const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
+        const uniqueCanonicalIds = this.findCanonicalAiProfileIdsByAlias(normalizedWorkspaceId, actorRef);
+        if (uniqueCanonicalIds.length !== 1)
+            return null;
+        const resolvedRow = this.db.prepare(`
+            SELECT *
+            FROM ai_profiles
+            WHERE tenant_id = ?
+              AND workspace_id = ?
+              AND id = ?
+            LIMIT 1
+        `).get(this.tenantId, normalizedWorkspaceId, uniqueCanonicalIds[0]);
+        return resolvedRow ? this.aiProfileToActor(this.aiProfileRowToRecord(resolvedRow)) : null;
+    }
     canonicalizeActorReference(workspaceId, value, fallback) {
         const raw = String(value || '').trim();
         if (!raw)
@@ -548,8 +594,21 @@ export class TaskforceCore {
                 normalized.fsPath = raw.fsPath.trim();
             if (typeof raw.caption === 'string' && raw.caption.trim())
                 normalized.caption = raw.caption.trim();
+            if (typeof raw.displayName === 'string' && raw.displayName.trim())
+                normalized.displayName = raw.displayName.trim();
+            if (typeof raw.originalFilename === 'string' && raw.originalFilename.trim())
+                normalized.originalFilename = raw.originalFilename.trim();
             if (typeof raw.timestamp === 'string' && raw.timestamp.trim())
                 normalized.timestamp = raw.timestamp.trim();
+            if (typeof raw.assetId === 'string' && raw.assetId.trim())
+                normalized.assetId = raw.assetId.trim();
+            const referenceNumber = this.sanitizeTaskReferenceNumber(raw.referenceNumber);
+            if (referenceNumber !== null)
+                normalized.referenceNumber = referenceNumber;
+            if (typeof raw.referenceLabel === 'string' && raw.referenceLabel.trim())
+                normalized.referenceLabel = raw.referenceLabel.trim();
+            if (typeof raw.taskId === 'string' && raw.taskId.trim())
+                normalized.taskId = raw.taskId.trim();
             return normalized;
         })
             .filter((attachment) => attachment !== null);
@@ -569,15 +628,27 @@ export class TaskforceCore {
             actorProfile
         };
     }
+    listEntityEventsInternal(entityType, entityId, workspaceId) {
+        return listEntityEventsInternalService(this.getTaskActivityServiceDeps(), entityType, entityId, workspaceId);
+    }
     listTaskEventsInternal(taskId, workspaceId) {
         return listTaskEventsInternalService(this.getTaskActivityServiceDeps(), taskId, workspaceId);
     }
+    buildEntityActivity(comments, entityEvents, hiddenActions) {
+        return buildEntityActivityService(comments, entityEvents, hiddenActions?.length ? { hiddenActions } : undefined);
+    }
     buildTaskActivity(comments, taskEvents) {
         return buildTaskActivityService(comments, taskEvents);
     }
+    addEntityEvent(input) {
+        addEntityEventService(this.getTaskActivityServiceDeps(), input);
+    }
     addTaskEvent(input) {
         addTaskEventService(this.getTaskActivityServiceDeps(), input);
     }
+    replaceEntityEvents(entityType, entityId, workspaceId, entityEvents) {
+        replaceEntityEventsService(this.getTaskActivityServiceDeps(), entityType, entityId, workspaceId, entityEvents);
+    }
     replaceTaskEvents(taskId, workspaceId, taskEvents) {
         replaceTaskEventsService(this.getTaskActivityServiceDeps(), taskId, workspaceId, taskEvents);
     }
@@ -1083,6 +1154,65 @@ export class TaskforceCore {
         }
         return (existingValue ?? null) === (nextValue ?? null);
     }
+    buildPlanningEntityEventChanges(existing, next, fields) {
+        const changes = {};
+        for (const field of fields) {
+            const previousValue = existing[field] ?? null;
+            const nextValue = next[field] ?? null;
+            if (JSON.stringify(previousValue) === JSON.stringify(nextValue))
+                continue;
+            changes[field] = { from: previousValue, to: nextValue };
+        }
+        return changes;
+    }
+    getPlanningEntityEventAction(entityType, changes) {
+        const fields = Object.keys(changes);
+        if (fields.length === 1 && fields[0] === 'attachments') {
+            return `${entityType}-attachments-changed`;
+        }
+        if (entityType === 'workstream' && fields.length === 1 && fields[0] === 'initiativeId') {
+            return 'workstream-relationship-changed';
+        }
+        return `${entityType}-updated`;
+    }
+    addWorkstreamTaskMembershipEvents(input) {
+        const previousWorkstreamId = this.sanitizeWorkstreamId(input.previousWorkstreamId);
+        const nextWorkstreamId = this.sanitizeWorkstreamId(input.nextWorkstreamId);
+        if (previousWorkstreamId === nextWorkstreamId)
+            return;
+        const details = {
+            taskId: input.task.id,
+            taskTitle: input.task.title,
+            changes: {
+                workstreamId: {
+                    from: previousWorkstreamId ?? null,
+                    to: nextWorkstreamId ?? null,
+                }
+            }
+        };
+        if (previousWorkstreamId) {
+            this.addEntityEvent({
+                entityType: 'workstream',
+                entityId: previousWorkstreamId,
+                workspaceId: input.workspaceId,
+                action: 'workstream-task-removed',
+                actor: input.actor,
+                createdAt: input.createdAt,
+                details,
+            });
+        }
+        if (nextWorkstreamId) {
+            this.addEntityEvent({
+                entityType: 'workstream',
+                entityId: nextWorkstreamId,
+                workspaceId: input.workspaceId,
+                action: 'workstream-task-added',
+                actor: input.actor,
+                createdAt: input.createdAt,
+                details,
+            });
+        }
+    }
     assertWorkstreamLinkAllowed(workstreamId, workspaceId) {
         const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
         if (!workstreamId)
@@ -1160,7 +1290,6 @@ export class TaskforceCore {
         this.initializeSchema();
         ensureTenantSchema(this.db);
         ensureWorkspaceSchema(this.db);
-        ensureParentTaskSchema(this.db);
         ensureScheduleTaskSchema(this.db);
         ensureAssigneeTaskSchema(this.db);
         ensureTaskReferenceSchema(this.db);
@@ -1171,6 +1300,7 @@ export class TaskforceCore {
         ensureAnnotatedAttachmentSessionsSchema(this.db);
         ensureBillingSchema(this.db);
         ensureEntitlementsSchema(this.db);
+        ensureAuthIdentitySchema(this.db);
         this.performMigrationIfNeeded();
         this.planEntitlementService = new PlanEntitlementService(this.db, this.tenantId, {
             getWorkspaceOwnerUserId: (wid) => this.getWorkspaceOwnerUserId(wid),
@@ -1182,6 +1312,8 @@ export class TaskforceCore {
         this.planEntitlementService.backfillAccountEntitlements();
         this.repairDetachedAnnotatedAttachmentSessions();
         this.authTokenService = new AuthTokenService(this.db, this.tenantId);
+        this.identityService = new AuthIdentityService(this.db, this.tenantId);
+        this.authTokenService.setIdentityService(this.identityService);
         this.mcpTokenService = new McpTokenService(this.db, this.tenantId, {
             getAccountAccessStatus: (userId) => this.getAccountAccessStatus(userId),
         });
@@ -1225,11 +1357,23 @@ export class TaskforceCore {
         if (!accountId) {
             throw new TaskforceRuleError('accountId is required', 400, 'ACCOUNT_ID_REQUIRED');
         }
-        if (this.hasAccountEntitlement(accountId)) {
-            return this.getAccountEntitlement(accountId);
+        const existingEntitlement = this.hasAccountEntitlement(accountId)
+            ? this.getAccountEntitlement(accountId)
+            : null;
+        if (existingEntitlement) {
+            if (options?.source !== 'invite-accept') {
+                return existingEntitlement;
+            }
+            const existingAccess = this.getAccountAccessStatus(accountId);
+            if (existingAccess.canAccessApp) {
+                return existingAccess.entitlement || existingEntitlement;
+            }
         }
         const now = options?.now || new Date().toISOString();
-        const onboardingOutcome = this.resolveRegistrationOnboardingOutcome();
+        const inviteOutcome = options?.source === 'invite-accept'
+            ? this.planEntitlementService.resolveInviteAcceptanceDefaultEntitlement()
+            : null;
+        const onboardingOutcome = inviteOutcome || this.resolveRegistrationOnboardingOutcome();
         this.transitionCanonicalCommercialState({
             accountId,
             planVersionId: onboardingOutcome.planVersionId,
@@ -1315,6 +1459,26 @@ export class TaskforceCore {
             }
         }
     }
+    supportsWorkspaceAssetLinkTargetType() {
+        try {
+            if (this.db.provider === 'postgres') {
+                const row = this.db.prepare(`
+                    SELECT 1
+                    FROM information_schema.columns
+                    WHERE table_schema = current_schema()
+                      AND table_name = 'workspace_asset_links'
+                      AND column_name = 'target_type'
+                    LIMIT 1
+                `).get();
+                return Boolean(row);
+            }
+            const columns = this.db.prepare(`PRAGMA table_info(workspace_asset_links)`).all();
+            return columns.some((column) => String(column.name || '').trim() === 'target_type');
+        }
+        catch {
+            return false;
+        }
+    }
     initializeSchema() {
         const syncEventsIdColumnSql = this.db.provider === 'postgres'
             ? 'id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY'
@@ -1350,10 +1514,7 @@ export class TaskforceCore {
                 scheduled_week_key TEXT,
                 order_in_day INTEGER,
                 workstream_id TEXT,
-                parent_task_id TEXT,
-                child_display_order INTEGER,
-                FOREIGN KEY(workstream_id) REFERENCES workstreams(id) ON DELETE SET NULL,
-                FOREIGN KEY(parent_task_id) REFERENCES tasks(id) ON DELETE RESTRICT
+                FOREIGN KEY(workstream_id) REFERENCES workstreams(id) ON DELETE SET NULL
             );
 
             CREATE TABLE IF NOT EXISTS workspace_task_reference_sequences (
@@ -1456,6 +1617,19 @@ export class TaskforceCore {
                 FOREIGN KEY(task_id) REFERENCES tasks(id) ON DELETE CASCADE
             );
 
+            CREATE TABLE IF NOT EXISTS entity_events (
+                id TEXT PRIMARY KEY,
+                tenant_id TEXT NOT NULL DEFAULT 'default',
+                workspace_id TEXT NOT NULL DEFAULT 'default',
+                entity_type TEXT NOT NULL,
+                entity_id TEXT NOT NULL,
+                action TEXT NOT NULL,
+                actor TEXT NOT NULL,
+                actor_type TEXT NOT NULL,
+                details_json TEXT,
+                created_at TEXT NOT NULL
+            );
+
             CREATE TABLE IF NOT EXISTS deleted_tasks (
                 id TEXT PRIMARY KEY,
                 tenant_id TEXT NOT NULL DEFAULT 'default',
@@ -1584,6 +1758,9 @@ export class TaskforceCore {
                 token_prefix TEXT NOT NULL,
                 token_hash TEXT NOT NULL,
                 status TEXT NOT NULL DEFAULT 'active',
+                ai_profile_id TEXT,
+                ai_profile_token TEXT,
+                ai_profile_name TEXT,
                 last_used_at TEXT,
                 revoked_at TEXT,
                 revoked_by_user_id TEXT,
@@ -1640,12 +1817,22 @@ export class TaskforceCore {
                 username TEXT NOT NULL,
                 icon TEXT NOT NULL,
                 color TEXT NOT NULL,
+                avatar_url TEXT,
+                avatar_source_url TEXT,
+                avatar_revision INTEGER NOT NULL DEFAULT 0,
+                avatar_updated_at TEXT,
                 description TEXT,
                 role TEXT,
                 provider TEXT,
                 model TEXT,
                 surface_type TEXT,
+                seat_scope TEXT,
                 provider_metadata_json TEXT,
+                archived_at TEXT,
+                archived_by TEXT,
+                archived_reason TEXT,
+                merged_into_profile_id TEXT,
+                roster_state_updated_at TEXT,
                 created_at TEXT NOT NULL,
                 updated_at TEXT NOT NULL,
                 last_active_at TEXT
@@ -1660,6 +1847,8 @@ export class TaskforceCore {
             CREATE INDEX IF NOT EXISTS idx_admin_audit_logs_workspace_created ON admin_audit_logs(workspace_id, created_at);
             CREATE INDEX IF NOT EXISTS idx_task_events_task_created ON task_events(tenant_id, workspace_id, task_id, created_at);
             CREATE INDEX IF NOT EXISTS idx_task_events_workspace_created ON task_events(tenant_id, workspace_id, created_at);
+            CREATE INDEX IF NOT EXISTS idx_entity_events_entity_created ON entity_events(tenant_id, workspace_id, entity_type, entity_id, created_at);
+            CREATE INDEX IF NOT EXISTS idx_entity_events_workspace_created ON entity_events(tenant_id, workspace_id, created_at);
             CREATE UNIQUE INDEX IF NOT EXISTS idx_deleted_tasks_workspace_task ON deleted_tasks(tenant_id, workspace_id, task_id);
             CREATE INDEX IF NOT EXISTS idx_deleted_tasks_workspace_deleted ON deleted_tasks(tenant_id, workspace_id, deleted_at);
             CREATE INDEX IF NOT EXISTS idx_mcp_audit_logs_workspace_created ON mcp_audit_logs(tenant_id, workspace_id, created_at);
@@ -1764,7 +1953,27 @@ export class TaskforceCore {
                 // Best-effort schema repair for older deployments.
             }
         }
+        if (this.db.provider === 'sqlite') {
+            this.db.exec(`
+                INSERT OR IGNORE INTO entity_events (
+                    id, tenant_id, workspace_id, entity_type, entity_id, action, actor, actor_type, details_json, created_at
+                )
+                SELECT id, tenant_id, workspace_id, 'task', task_id, action, actor, actor_type, details_json, created_at
+                FROM task_events
+            `);
+        }
+        else {
+            this.db.exec(`
+                INSERT INTO entity_events (
+                    id, tenant_id, workspace_id, entity_type, entity_id, action, actor, actor_type, details_json, created_at
+                )
+                SELECT id, tenant_id, workspace_id, 'task', task_id, action, actor, actor_type, details_json, created_at
+                FROM task_events
+                ON CONFLICT (id) DO NOTHING
+            `);
+        }
         this.db.exec(`CREATE INDEX IF NOT EXISTS idx_tasks_workstream ON tasks(tenant_id, workspace_id, workstream_id)`);
+        this.db.exec(`CREATE INDEX IF NOT EXISTS idx_tasks_assignee ON tasks(tenant_id, workspace_id, assignee, is_archived)`);
         this.db.exec(`CREATE INDEX IF NOT EXISTS idx_workstreams_initiative ON workstreams(tenant_id, workspace_id, initiative_id)`);
         this.db.exec(`CREATE INDEX IF NOT EXISTS idx_checklist_items_task_order ON checklist_items(tenant_id, workspace_id, task_id, sort_order)`);
         if (this.db.provider === 'sqlite') {
@@ -1783,6 +1992,28 @@ export class TaskforceCore {
             }
         }
         this.db.exec(`CREATE INDEX IF NOT EXISTS idx_auth_tokens_workspace_purpose ON auth_tokens(workspace_id, purpose)`);
+        if (this.db.provider === 'sqlite') {
+            const mcpOauthGrantColumns = this.db.prepare(`PRAGMA table_info(mcp_oauth_connector_grants)`).all();
+            if (!mcpOauthGrantColumns.some((c) => c.name === 'ai_profile_id')) {
+                this.db.exec(`ALTER TABLE mcp_oauth_connector_grants ADD COLUMN ai_profile_id TEXT`);
+            }
+            if (!mcpOauthGrantColumns.some((c) => c.name === 'ai_profile_token')) {
+                this.db.exec(`ALTER TABLE mcp_oauth_connector_grants ADD COLUMN ai_profile_token TEXT`);
+            }
+            if (!mcpOauthGrantColumns.some((c) => c.name === 'ai_profile_name')) {
+                this.db.exec(`ALTER TABLE mcp_oauth_connector_grants ADD COLUMN ai_profile_name TEXT`);
+            }
+        }
+        else {
+            try {
+                this.db.exec(`ALTER TABLE mcp_oauth_connector_grants ADD COLUMN IF NOT EXISTS ai_profile_id TEXT`);
+                this.db.exec(`ALTER TABLE mcp_oauth_connector_grants ADD COLUMN IF NOT EXISTS ai_profile_token TEXT`);
+                this.db.exec(`ALTER TABLE mcp_oauth_connector_grants ADD COLUMN IF NOT EXISTS ai_profile_name TEXT`);
+            }
+            catch {
+                // Best-effort schema repair for existing deployments.
+            }
+        }
         if (this.db.provider === 'sqlite') {
             const mcpAuditColumns = this.db.prepare(`PRAGMA table_info(mcp_audit_logs)`).all();
             if (!mcpAuditColumns.some((c) => c.name === 'request_id')) {
@@ -1881,12 +2112,22 @@ export class TaskforceCore {
                 { name: 'username', ddl: `ALTER TABLE ai_profiles ADD COLUMN username TEXT NOT NULL DEFAULT 'ai'` },
                 { name: 'icon', ddl: `ALTER TABLE ai_profiles ADD COLUMN icon TEXT NOT NULL DEFAULT 'Bot'` },
                 { name: 'color', ddl: `ALTER TABLE ai_profiles ADD COLUMN color TEXT NOT NULL DEFAULT '#64748b'` },
+                { name: 'avatar_url', ddl: `ALTER TABLE ai_profiles ADD COLUMN avatar_url TEXT` },
+                { name: 'avatar_source_url', ddl: `ALTER TABLE ai_profiles ADD COLUMN avatar_source_url TEXT` },
+                { name: 'avatar_revision', ddl: `ALTER TABLE ai_profiles ADD COLUMN avatar_revision INTEGER NOT NULL DEFAULT 0` },
+                { name: 'avatar_updated_at', ddl: `ALTER TABLE ai_profiles ADD COLUMN avatar_updated_at TEXT` },
                 { name: 'description', ddl: `ALTER TABLE ai_profiles ADD COLUMN description TEXT` },
                 { name: 'role', ddl: `ALTER TABLE ai_profiles ADD COLUMN role TEXT` },
                 { name: 'provider', ddl: `ALTER TABLE ai_profiles ADD COLUMN provider TEXT` },
                 { name: 'model', ddl: `ALTER TABLE ai_profiles ADD COLUMN model TEXT` },
                 { name: 'surface_type', ddl: `ALTER TABLE ai_profiles ADD COLUMN surface_type TEXT` },
+                { name: 'seat_scope', ddl: `ALTER TABLE ai_profiles ADD COLUMN seat_scope TEXT` },
                 { name: 'provider_metadata_json', ddl: `ALTER TABLE ai_profiles ADD COLUMN provider_metadata_json TEXT` },
+                { name: 'archived_at', ddl: `ALTER TABLE ai_profiles ADD COLUMN archived_at TEXT` },
+                { name: 'archived_by', ddl: `ALTER TABLE ai_profiles ADD COLUMN archived_by TEXT` },
+                { name: 'archived_reason', ddl: `ALTER TABLE ai_profiles ADD COLUMN archived_reason TEXT` },
+                { name: 'merged_into_profile_id', ddl: `ALTER TABLE ai_profiles ADD COLUMN merged_into_profile_id TEXT` },
+                { name: 'roster_state_updated_at', ddl: `ALTER TABLE ai_profiles ADD COLUMN roster_state_updated_at TEXT` },
                 { name: 'created_at', ddl: `ALTER TABLE ai_profiles ADD COLUMN created_at TEXT NOT NULL DEFAULT ''` },
                 { name: 'updated_at', ddl: `ALTER TABLE ai_profiles ADD COLUMN updated_at TEXT NOT NULL DEFAULT ''` },
                 { name: 'last_active_at', ddl: `ALTER TABLE ai_profiles ADD COLUMN last_active_at TEXT` }
@@ -1905,12 +2146,22 @@ export class TaskforceCore {
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS username TEXT NOT NULL DEFAULT 'ai'`,
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS icon TEXT NOT NULL DEFAULT 'Bot'`,
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS color TEXT NOT NULL DEFAULT '#64748b'`,
+                `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS avatar_url TEXT`,
+                `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS avatar_source_url TEXT`,
+                `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS avatar_revision INTEGER NOT NULL DEFAULT 0`,
+                `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS avatar_updated_at TEXT`,
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS description TEXT`,
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS role TEXT`,
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS provider TEXT`,
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS model TEXT`,
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS surface_type TEXT`,
+                `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS seat_scope TEXT`,
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS provider_metadata_json TEXT`,
+                `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS archived_at TEXT`,
+                `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS archived_by TEXT`,
+                `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS archived_reason TEXT`,
+                `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS merged_into_profile_id TEXT`,
+                `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS roster_state_updated_at TEXT`,
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS created_at TEXT NOT NULL DEFAULT ''`,
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS updated_at TEXT NOT NULL DEFAULT ''`,
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS last_active_at TEXT`
@@ -1924,10 +2175,45 @@ export class TaskforceCore {
                 }
             }
         }
+        this.db.exec(`
+            UPDATE ai_profiles
+            SET roster_state_updated_at = CASE
+                WHEN archived_at IS NOT NULL AND TRIM(archived_at) <> '' THEN archived_at
+                WHEN created_at IS NOT NULL AND TRIM(created_at) <> '' THEN created_at
+                ELSE updated_at
+            END
+            WHERE roster_state_updated_at IS NULL
+               OR TRIM(roster_state_updated_at) = ''
+               OR (
+                    archived_at IS NOT NULL
+                    AND TRIM(archived_at) <> ''
+                    AND roster_state_updated_at < archived_at
+               )
+        `);
+        this.db.exec(`
+            UPDATE ai_profiles
+            SET avatar_revision = CASE
+                    WHEN (
+                        (avatar_url IS NOT NULL AND TRIM(avatar_url) <> '')
+                        OR (avatar_source_url IS NOT NULL AND TRIM(avatar_source_url) <> '')
+                    ) THEN 1
+                    ELSE 0
+                END,
+                avatar_updated_at = CASE
+                    WHEN (
+                        (avatar_url IS NOT NULL AND TRIM(avatar_url) <> '')
+                        OR (avatar_source_url IS NOT NULL AND TRIM(avatar_source_url) <> '')
+                    ) THEN COALESCE(NULLIF(TRIM(avatar_updated_at), ''), NULLIF(TRIM(updated_at), ''), NULLIF(TRIM(created_at), ''))
+                    ELSE NULL
+                END
+            WHERE avatar_revision IS NULL
+               OR avatar_revision = 0
+        `);
         this.migrateSystemRoleBackfillIfNeeded();
         this.migrateUserBetaAccessBackfillIfNeeded();
         this.migrateDuplicateAiProfilesIfNeeded();
         this.migrateLegacyActorReferencesIfNeeded();
+        this.migrateLegacyCommentActorReferencesIfNeeded();
         // Ensure sync watermark index exists on existing databases (added in v0.3.52+).
         this.db.exec(`
             CREATE INDEX IF NOT EXISTS idx_tasks_sync_watermark ON tasks(tenant_id, workspace_id, updated_at, id);
@@ -2074,7 +2360,7 @@ export class TaskforceCore {
         if (existing?.payload)
             return;
         const rows = this.db.prepare(`
-            SELECT id, workspace_id, name, username, created_at, updated_at, last_active_at
+            SELECT id, workspace_id, name, username, seat_scope, created_at, updated_at, last_active_at
             FROM ai_profiles
             WHERE tenant_id = ?
         `).all(this.tenantId);
@@ -2083,7 +2369,8 @@ export class TaskforceCore {
             const workspaceId = this.normalizeWorkspaceId(row.workspace_id);
             const normalizedName = String(row.name || '').trim().toLowerCase();
             const normalizedUsername = String(row.username || '').trim().toLowerCase();
-            const dedupeKey = `${workspaceId}::${normalizedName || normalizedUsername}`;
+            const seatScope = String(row.seat_scope || 'unknown').trim().toLowerCase() || 'unknown';
+            const dedupeKey = `${workspaceId}::${seatScope}::${normalizedName || normalizedUsername}`;
             if (!normalizedName && !normalizedUsername)
                 continue;
             const list = groups.get(dedupeKey) || [];
@@ -2131,15 +2418,19 @@ export class TaskforceCore {
         if (existing?.payload)
             return;
         const rows = this.db.prepare(`
-            SELECT id, workspace_id, name, username
+            SELECT id, workspace_id, name, username, merged_into_profile_id
             FROM ai_profiles
             WHERE tenant_id = ?
         `).all(this.tenantId);
+        const rowById = new Map(rows
+            .map((row) => [String(row.id || '').trim(), row])
+            .filter(([id]) => Boolean(id)));
         const aliasesByWorkspace = new Map();
         for (const row of rows) {
             const workspaceId = this.normalizeWorkspaceId(row.workspace_id);
             const profileId = String(row.id || '').trim();
-            if (!profileId)
+            const canonicalProfileId = this.resolveCanonicalAiProfileId(rowById, profileId);
+            if (!canonicalProfileId)
                 continue;
             const aliases = [
                 String(row.name || '').trim().toLowerCase(),
@@ -2154,8 +2445,8 @@ export class TaskforceCore {
             }
             for (const alias of aliases) {
                 const ids = aliasMap.get(alias) || [];
-                if (!ids.includes(profileId))
-                    ids.push(profileId);
+                if (!ids.includes(canonicalProfileId))
+                    ids.push(canonicalProfileId);
                 aliasMap.set(alias, ids);
             }
         }
@@ -2196,6 +2487,135 @@ export class TaskforceCore {
                 updated_at = excluded.updated_at
         `).run(this.tenantId, migrationKey, JSON.stringify({ completedAt: now }), now);
     }
+    migrateLegacyCommentActorReferencesIfNeeded() {
+        const migrationKey = 'migration.actor_refs.canonicalize_comments.v2';
+        const existing = this.db.prepare(`
+            SELECT payload
+            FROM system_settings
+            WHERE tenant_id = ? AND settings_key = ?
+            LIMIT 1
+        `).get(this.tenantId, migrationKey);
+        if (existing?.payload)
+            return;
+        const commentRows = this.db.prepare(`
+            SELECT id, task_id, workspace_id, author, submitted_author
+            FROM comments
+            WHERE tenant_id = ?
+        `).all(this.tenantId);
+        const updateCommentAuthor = this.db.prepare(`
+            UPDATE comments
+            SET author = ?
+            WHERE tenant_id = ? AND workspace_id = ? AND id = ?
+        `);
+        const updateTaskSyncWatermark = this.db.prepare(`
+            UPDATE tasks
+            SET updated_at = ?
+            WHERE tenant_id = ? AND workspace_id = ? AND id = ?
+        `);
+        const selectTaskSyncWatermark = this.db.prepare(`
+            SELECT updated_at, created_at
+            FROM tasks
+            WHERE tenant_id = ? AND workspace_id = ? AND id = ?
+            LIMIT 1
+        `);
+        let repairedCount = 0;
+        let ambiguousCount = 0;
+        let skippedCount = 0;
+        const touchedTaskIdsByWorkspace = new Map();
+        const now = new Date().toISOString();
+        const nowMs = Date.parse(now);
+        const tx = this.db.transaction(() => {
+            for (const row of commentRows) {
+                const workspaceId = this.normalizeWorkspaceId(row.workspace_id);
+                const commentId = String(row.id || '').trim();
+                const taskId = String(row.task_id || '').trim();
+                const rawAuthor = String(row.author || '').trim();
+                const rawSubmittedAuthor = String(row.submitted_author || '').trim();
+                const normalizedAuthor = rawAuthor.toLowerCase();
+                if (!commentId) {
+                    skippedCount += 1;
+                    continue;
+                }
+                if (this.isStableActorReference(rawAuthor)
+                    || this.isHumanActorReference(rawAuthor)
+                    || normalizedAuthor === 'system') {
+                    skippedCount += 1;
+                    continue;
+                }
+                const candidateIds = new Set();
+                let hasAmbiguousEvidence = false;
+                const evidenceValues = [rawAuthor, rawSubmittedAuthor];
+                for (const value of evidenceValues) {
+                    const rawValue = String(value || '').trim();
+                    const normalizedValue = rawValue.toLowerCase();
+                    if (!rawValue)
+                        continue;
+                    if (this.isHumanActorReference(rawValue)
+                        || this.isGenericAiActorReference(rawValue)
+                        || normalizedValue === 'system'
+                        || normalizedValue.startsWith('user-')) {
+                        continue;
+                    }
+                    if (normalizedValue.startsWith('ai-profile-')) {
+                        const actor = this.resolveWorkspaceActor(workspaceId, rawValue);
+                        if (actor?.kind === 'ai' && actor.meta?.unresolved !== true) {
+                            candidateIds.add(actor.id);
+                        }
+                        continue;
+                    }
+                    const matches = this.findCanonicalAiProfileIdsByAlias(workspaceId, rawValue);
+                    if (matches.length === 1) {
+                        candidateIds.add(matches[0]);
+                    }
+                    else if (matches.length > 1) {
+                        hasAmbiguousEvidence = true;
+                    }
+                }
+                if (!hasAmbiguousEvidence && candidateIds.size === 1) {
+                    updateCommentAuthor.run([...candidateIds][0], this.tenantId, workspaceId, commentId);
+                    if (taskId) {
+                        let touchedTaskIds = touchedTaskIdsByWorkspace.get(workspaceId);
+                        if (!touchedTaskIds) {
+                            touchedTaskIds = new Set();
+                            touchedTaskIdsByWorkspace.set(workspaceId, touchedTaskIds);
+                        }
+                        touchedTaskIds.add(taskId);
+                    }
+                    repairedCount += 1;
+                    continue;
+                }
+                if (hasAmbiguousEvidence || candidateIds.size > 1) {
+                    ambiguousCount += 1;
+                    continue;
+                }
+                skippedCount += 1;
+            }
+            for (const [workspaceId, touchedTaskIds] of touchedTaskIdsByWorkspace.entries()) {
+                for (const taskId of touchedTaskIds) {
+                    const taskRow = selectTaskSyncWatermark.get(this.tenantId, workspaceId, taskId);
+                    const existingWatermark = String(taskRow?.updated_at || taskRow?.created_at || '').trim();
+                    const existingWatermarkMs = Date.parse(existingWatermark);
+                    const nextWatermarkMs = Number.isFinite(existingWatermarkMs)
+                        ? Math.max(existingWatermarkMs, nowMs) + 1
+                        : nowMs;
+                    updateTaskSyncWatermark.run(new Date(nextWatermarkMs).toISOString(), this.tenantId, workspaceId, taskId);
+                }
+            }
+        });
+        tx();
+        this.db.prepare(`
+            INSERT INTO system_settings (tenant_id, settings_key, payload, updated_at)
+            VALUES (?, ?, ?, ?)
+            ON CONFLICT (tenant_id, settings_key) DO UPDATE SET
+                payload = excluded.payload,
+                updated_at = excluded.updated_at
+        `).run(this.tenantId, migrationKey, JSON.stringify({
+            completedAt: now,
+            repairedCount,
+            ambiguousCount,
+            skippedCount,
+        }), now);
+    }
     getWorkspaceOwnerUserId(workspaceId) {
         const normalizedWorkspaceId = String(workspaceId || '').trim();
         if (!normalizedWorkspaceId)
@@ -2668,6 +3088,9 @@ export class TaskforceCore {
     getOnboardingPolicy() {
         return this.planEntitlementService.getOnboardingPolicy();
     }
+    listOnboardingPlanOptions() {
+        return this.planEntitlementService.listOnboardingPlanOptions();
+    }
     validateOnboardingPolicy(input) {
         return this.planEntitlementService.validateOnboardingPolicy(input);
     }
@@ -2709,31 +3132,58 @@ export class TaskforceCore {
     listCanonicalTaskAttachments(taskId, workspaceId) {
         try {
             const workspaceAssetStore = new WorkspaceAssetStore(this.db, this.tenantId);
-            const rows = this.db.prepare(`
-                SELECT
-                    a.asset_id,
-                    a.kind,
-                    a.reference_number,
-                    a.storage_provider,
-                    a.storage_key,
-                    a.logical_name,
-                    a.original_filename,
-                    a.updated_at,
-                    a.created_at,
-                    l.role,
-                    l.display_name
-                FROM workspace_asset_links l
-                JOIN workspace_assets a
-                  ON a.tenant_id = l.tenant_id
-                 AND a.workspace_id = l.workspace_id
-                 AND a.asset_id = l.asset_id
-                WHERE l.tenant_id = ?
-                  AND l.workspace_id = ?
-                  AND l.task_id = ?
-                  AND l.deleted_at IS NULL
-                  AND a.deleted_at IS NULL
-                ORDER BY COALESCE(l.sort_order, 2147483647) ASC, a.updated_at DESC, a.asset_id ASC
-            `).all(this.tenantId, workspaceId, taskId);
+            const rows = (this.supportsWorkspaceAssetLinkTargetType()
+                ? this.db.prepare(`
+                    SELECT
+                        a.asset_id,
+                        a.kind,
+                        a.reference_number,
+                        a.storage_provider,
+                        a.storage_key,
+                        a.logical_name,
+                        a.original_filename,
+                        a.updated_at,
+                        a.created_at,
+                        l.role,
+                        l.display_name
+                    FROM workspace_asset_links l
+                    JOIN workspace_assets a
+                      ON a.tenant_id = l.tenant_id
+                     AND a.workspace_id = l.workspace_id
+                     AND a.asset_id = l.asset_id
+                    WHERE l.tenant_id = ?
+                      AND l.workspace_id = ?
+                      AND l.target_type = 'task'
+                      AND l.task_id = ?
+                      AND l.deleted_at IS NULL
+                      AND a.deleted_at IS NULL
+                    ORDER BY COALESCE(l.sort_order, 2147483647) ASC, a.updated_at DESC, a.asset_id ASC
+                `).all(this.tenantId, workspaceId, taskId)
+                : this.db.prepare(`
+                    SELECT
+                        a.asset_id,
+                        a.kind,
+                        a.reference_number,
+                        a.storage_provider,
+                        a.storage_key,
+                        a.logical_name,
+                        a.original_filename,
+                        a.updated_at,
+                        a.created_at,
+                        l.role,
+                        l.display_name
+                    FROM workspace_asset_links l
+                    JOIN workspace_assets a
+                      ON a.tenant_id = l.tenant_id
+                     AND a.workspace_id = l.workspace_id
+                     AND a.asset_id = l.asset_id
+                    WHERE l.tenant_id = ?
+                      AND l.workspace_id = ?
+                      AND l.task_id = ?
+                      AND l.deleted_at IS NULL
+                      AND a.deleted_at IS NULL
+                    ORDER BY COALESCE(l.sort_order, 2147483647) ASC, a.updated_at DESC, a.asset_id ASC
+                `).all(this.tenantId, workspaceId, taskId));
             const attachments = rows.map((row) => {
                 const storageKey = String(row.storage_key || '').trim();
                 const storageProvider = String(row.storage_provider || 'local').trim();
@@ -2841,6 +3291,9 @@ export class TaskforceCore {
     syncCanonicalTaskAttachmentLinks(taskId, workspaceId, attachments) {
         syncCanonicalTaskAttachmentLinksService(this.getAttachmentLinkServiceDeps(), taskId, workspaceId, attachments);
     }
+    syncCanonicalPlanningAttachmentLinks(targetType, targetId, workspaceId, attachments) {
+        syncCanonicalAttachmentLinksForTargetService(this.getAttachmentLinkServiceDeps(), targetType, targetId, workspaceId, attachments);
+    }
     rowToTask(row) {
         const workspaceId = this.normalizeWorkspaceId(row?.workspace_id);
         const commentsRaw = this.db.prepare('SELECT * FROM comments WHERE tenant_id = ? AND workspace_id = ? AND task_id = ? ORDER BY timestamp ASC').all(this.tenantId, workspaceId, row.id);
@@ -2899,12 +3352,21 @@ export class TaskforceCore {
             checklistItems
         };
     }
-    rowToInitiative(row) {
+    rowToInitiative(row, options) {
+        const id = String(row.id || '').trim();
+        const workspaceId = this.normalizeWorkspaceId(typeof row.workspace_id === 'string' ? row.workspace_id : undefined);
         const referenceNumber = this.sanitizeTaskReferenceNumber(row.reference_number);
         const comments = this.normalizeIncomingComments(this.parseJsonField(row.comments_json, []));
+        const includeActivity = options?.includeActivity === true;
+        const entityEvents = includeActivity
+            ? this.listEntityEventsInternal('initiative', id, workspaceId)
+            : undefined;
+        const activity = includeActivity
+            ? this.buildEntityActivity(comments, entityEvents || [])
+            : undefined;
         const attachments = this.normalizePlanningAttachments(this.parseJsonField(row.attachments_json, []));
         return {
-            id: String(row.id || '').trim(),
+            id,
             referenceNumber,
             referenceLabel: formatInitiativeReference(referenceNumber),
             title: String(row.title || '').trim() || 'Untitled Initiative',
@@ -2916,14 +3378,27 @@ export class TaskforceCore {
             isArchived: Boolean(row.is_archived),
             comments,
             attachments,
+            ...(includeActivity ? {
+                activity,
+                entityEvents,
+            } : {}),
         };
     }
-    rowToWorkstream(row) {
+    rowToWorkstream(row, options) {
+        const id = String(row.id || '').trim();
+        const workspaceId = this.normalizeWorkspaceId(typeof row.workspace_id === 'string' ? row.workspace_id : undefined);
         const referenceNumber = this.sanitizeTaskReferenceNumber(row.reference_number);
         const comments = this.normalizeIncomingComments(this.parseJsonField(row.comments_json, []));
+        const includeActivity = options?.includeActivity === true;
+        const entityEvents = includeActivity
+            ? this.listEntityEventsInternal('workstream', id, workspaceId)
+            : undefined;
+        const activity = includeActivity
+            ? this.buildEntityActivity(comments, entityEvents || [])
+            : undefined;
         const attachments = this.normalizePlanningAttachments(this.parseJsonField(row.attachments_json, []));
         return {
-            id: String(row.id || '').trim(),
+            id,
             referenceNumber,
             referenceLabel: formatWorkstreamReference(referenceNumber),
             initiativeId: typeof row.initiative_id === 'string' && row.initiative_id.trim().length > 0 ? row.initiative_id.trim() : null,
@@ -2936,6 +3411,10 @@ export class TaskforceCore {
             isArchived: Boolean(row.is_archived),
             comments,
             attachments,
+            ...(includeActivity ? {
+                activity,
+                entityEvents,
+            } : {}),
         };
     }
     rowToChecklistItem(row) {
@@ -2988,7 +3467,7 @@ export class TaskforceCore {
         `).get(this.tenantId, normalizedWorkspaceId, normalizedId);
         if (!row)
             return null;
-        return this.rowToInitiative(row);
+        return this.rowToInitiative(row, { includeActivity: true });
     }
     listInitiatives(workspaceId) {
         const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
@@ -3000,7 +3479,45 @@ export class TaskforceCore {
         `).all(this.tenantId, normalizedWorkspaceId);
         return rows.map((row) => this.rowToInitiative(row));
     }
-    createInitiative(input, workspaceId) {
+    isTransientPlanningHydrationError(error) {
+        const message = error instanceof Error ? String(error.message || '').trim() : String(error || '').trim();
+        if (!message)
+            return false;
+        return /(timed out|timeout|ETIMEDOUT|query canceled|statement timeout|database timeout|postgres worker)/i.test(message);
+    }
+    getInitiativeForWriteResult(id, workspaceId, fallback, context) {
+        try {
+            return this.getInitiative(id, workspaceId) || fallback;
+        }
+        catch (error) {
+            if (!this.isTransientPlanningHydrationError(error))
+                throw error;
+            console.warn('[Taskforce] Falling back to post-write initiative snapshot after hydration failed', {
+                context,
+                initiativeId: id,
+                workspaceId,
+                message: error instanceof Error ? error.message : String(error),
+            });
+            return fallback;
+        }
+    }
+    getWorkstreamForWriteResult(id, workspaceId, fallback, context) {
+        try {
+            return this.getWorkstream(id, workspaceId) || fallback;
+        }
+        catch (error) {
+            if (!this.isTransientPlanningHydrationError(error))
+                throw error;
+            console.warn('[Taskforce] Falling back to post-write workstream snapshot after hydration failed', {
+                context,
+                workstreamId: id,
+                workspaceId,
+                message: error instanceof Error ? error.message : String(error),
+            });
+            return fallback;
+        }
+    }
+    createInitiative(input, workspaceId, options) {
         const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
         const id = String(input.id || '').trim() || this.generateEntityId('initiative');
         const referenceNumber = this.reserveInitiativeReferenceNumber(normalizedWorkspaceId, input.referenceNumber);
@@ -3039,18 +3556,37 @@ export class TaskforceCore {
             sortOrder: initiative.order,
             isArchived: initiative.isArchived ? 1 : 0,
         });
-        return initiative;
+        this.syncCanonicalPlanningAttachmentLinks('initiative', initiative.id, normalizedWorkspaceId, initiative.attachments || []);
+        if (options?.skipEntityEvents !== true) {
+            this.addEntityEvent({
+                entityType: 'initiative',
+                entityId: initiative.id,
+                workspaceId: normalizedWorkspaceId,
+                action: 'initiative-created',
+                actor: options?.actorRef || 'system',
+                createdAt: initiative.updatedAt || initiative.createdAt,
+                details: {
+                    title: initiative.title,
+                    ownerId: initiative.ownerId || null,
+                }
+            });
+        }
+        return this.getInitiativeForWriteResult(initiative.id, normalizedWorkspaceId, initiative, 'createInitiative:post-write');
     }
-    updateInitiative(id, patch, workspaceId) {
+    updateInitiative(id, patch, workspaceId, options) {
         const existing = this.getInitiative(id, workspaceId);
         if (!existing) {
             throw new TaskforceRuleError(`Initiative not found: ${id}`, 404, 'INITIATIVE_NOT_FOUND');
         }
         const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
+        const nextAttachments = Object.prototype.hasOwnProperty.call(patch, 'attachments') && Array.isArray(patch.attachments)
+            ? patch.attachments
+            : existing.attachments;
         const next = {
             ...existing,
             ...patch,
             id: existing.id,
+            attachments: nextAttachments,
             updatedAt: String(patch.updatedAt || '').trim() || new Date().toISOString(),
             referenceLabel: formatInitiativeReference(patch.referenceNumber ?? existing.referenceNumber),
         };
@@ -3080,25 +3616,68 @@ export class TaskforceCore {
             sortOrder: next.order,
             isArchived: next.isArchived ? 1 : 0,
         });
-        return this.getInitiative(existing.id, normalizedWorkspaceId);
+        this.syncCanonicalPlanningAttachmentLinks('initiative', existing.id, normalizedWorkspaceId, next.attachments || []);
+        const hydrated = this.getInitiativeForWriteResult(existing.id, normalizedWorkspaceId, next, 'updateInitiative:post-write');
+        if (options?.skipEntityEvents !== true) {
+            const changes = this.buildPlanningEntityEventChanges(existing, next, ['title', 'description', 'ownerId', 'attachments']);
+            if (Object.keys(changes).length > 0) {
+                this.addEntityEvent({
+                    entityType: 'initiative',
+                    entityId: existing.id,
+                    workspaceId: normalizedWorkspaceId,
+                    action: this.getPlanningEntityEventAction('initiative', changes),
+                    actor: options?.actorRef || 'system',
+                    createdAt: next.updatedAt,
+                    details: { changes }
+                });
+                return this.getInitiativeForWriteResult(existing.id, normalizedWorkspaceId, hydrated, 'updateInitiative:post-event');
+            }
+        }
+        return hydrated;
     }
-    archiveInitiative(id, workspaceId) {
+    archiveInitiative(id, workspaceId, options) {
         const existing = this.getInitiative(id, workspaceId);
         if (!existing) {
             throw new TaskforceRuleError(`Initiative not found: ${id}`, 404, 'INITIATIVE_NOT_FOUND');
         }
         if (existing.isArchived)
             return existing;
-        return this.updateInitiative(id, { isArchived: true }, workspaceId);
+        const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
+        const archived = this.updateInitiative(id, { isArchived: true }, workspaceId, { ...options, skipEntityEvents: true });
+        if (options?.skipEntityEvents !== true) {
+            this.addEntityEvent({
+                entityType: 'initiative',
+                entityId: id,
+                workspaceId: normalizedWorkspaceId,
+                action: 'initiative-archived',
+                actor: options?.actorRef || 'system',
+                createdAt: archived.updatedAt || new Date().toISOString(),
+            });
+            return this.getInitiativeForWriteResult(id, normalizedWorkspaceId, archived, 'archiveInitiative:post-event');
+        }
+        return archived;
     }
-    unarchiveInitiative(id, workspaceId) {
+    unarchiveInitiative(id, workspaceId, options) {
         const existing = this.getInitiative(id, workspaceId);
         if (!existing) {
             throw new TaskforceRuleError(`Initiative not found: ${id}`, 404, 'INITIATIVE_NOT_FOUND');
         }
         if (!existing.isArchived)
             return existing;
-        return this.updateInitiative(id, { isArchived: false }, workspaceId);
+        const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
+        const restored = this.updateInitiative(id, { isArchived: false }, workspaceId, { ...options, skipEntityEvents: true });
+        if (options?.skipEntityEvents !== true) {
+            this.addEntityEvent({
+                entityType: 'initiative',
+                entityId: id,
+                workspaceId: normalizedWorkspaceId,
+                action: 'initiative-unarchived',
+                actor: options?.actorRef || 'system',
+                createdAt: restored.updatedAt || new Date().toISOString(),
+            });
+            return this.getInitiativeForWriteResult(id, normalizedWorkspaceId, restored, 'unarchiveInitiative:post-event');
+        }
+        return restored;
     }
     getWorkstream(id, workspaceId) {
         const normalizedId = String(id || '').trim();
@@ -3113,7 +3692,7 @@ export class TaskforceCore {
         `).get(this.tenantId, normalizedWorkspaceId, normalizedId);
         if (!row)
             return null;
-        return this.rowToWorkstream(row);
+        return this.rowToWorkstream(row, { includeActivity: true });
     }
     listWorkstreams(workspaceId) {
         const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
@@ -3125,7 +3704,64 @@ export class TaskforceCore {
         `).all(this.tenantId, normalizedWorkspaceId);
         return rows.map((row) => this.rowToWorkstream(row));
     }
-    createWorkstream(input, workspaceId) {
+    listPlanningBootstrap(workspaceId, diagnostics) {
+        const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
+        const startedAt = Date.now();
+        const initiatives = this.listInitiatives(workspaceId);
+        const initiativesLoadedAt = Date.now();
+        const workstreams = this.listWorkstreams(workspaceId);
+        const workstreamsLoadedAt = Date.now();
+        const planningTaskRows = this.db.prepare(`
+            SELECT id, reference_number, title, status, workstream_id
+            FROM tasks
+            WHERE tenant_id = ? AND workspace_id = ? AND is_archived = 0
+              AND workstream_id IS NOT NULL AND TRIM(workstream_id) <> ''
+            ORDER BY created_at DESC
+        `).all(this.tenantId, normalizedWorkspaceId);
+        const taskRowsLoadedAt = Date.now();
+        const workstreamTaskSummaries = new Map();
+        for (const row of planningTaskRows) {
+            const workstreamId = String(row.workstream_id || '').trim();
+            if (!workstreamId)
+                continue;
+            const status = this.normalizeStatusValue(row.status);
+            const referenceNumber = this.sanitizeTaskReferenceNumber(row.reference_number);
+            const current = workstreamTaskSummaries.get(workstreamId) || {
+                workstreamId,
+                taskCount: 0,
+                completedTaskCount: 0,
+                tasks: [],
+            };
+            current.taskCount += 1;
+            if (status === 'done' || status === 'cancelled') {
+                current.completedTaskCount += 1;
+            }
+            current.tasks.push({
+                id: String(row.id || '').trim(),
+                referenceNumber,
+                title: String(row.title || '').trim() || 'Untitled Task',
+                status,
+            });
+            workstreamTaskSummaries.set(workstreamId, current);
+        }
+        const summariesBuiltAt = Date.now();
+        if (diagnostics) {
+            diagnostics.initiativeCount = initiatives.length;
+            diagnostics.workstreamCount = workstreams.length;
+            diagnostics.workstreamLinkedTaskCount = planningTaskRows.length;
+            diagnostics.workstreamTaskSummaryCount = workstreamTaskSummaries.size;
+            diagnostics.initiativeLoadMs = Math.max(0, initiativesLoadedAt - startedAt);
+            diagnostics.workstreamLoadMs = Math.max(0, workstreamsLoadedAt - initiativesLoadedAt);
+            diagnostics.taskSummaryQueryMs = Math.max(0, taskRowsLoadedAt - workstreamsLoadedAt);
+            diagnostics.taskSummaryBuildMs = Math.max(0, summariesBuiltAt - taskRowsLoadedAt);
+        }
+        return {
+            initiatives,
+            workstreams,
+            workstreamTaskSummaries: Array.from(workstreamTaskSummaries.values()),
+        };
+    }
+    createWorkstream(input, workspaceId, options) {
         const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
         const id = String(input.id || '').trim() || this.generateEntityId('workstream');
         const referenceNumber = this.reserveWorkstreamReferenceNumber(normalizedWorkspaceId, input.referenceNumber);
@@ -3168,14 +3804,33 @@ export class TaskforceCore {
             sortOrder: workstream.order,
             isArchived: workstream.isArchived ? 1 : 0,
         });
-        return workstream;
+        this.syncCanonicalPlanningAttachmentLinks('workstream', workstream.id, normalizedWorkspaceId, workstream.attachments || []);
+        if (options?.skipEntityEvents !== true) {
+            this.addEntityEvent({
+                entityType: 'workstream',
+                entityId: workstream.id,
+                workspaceId: normalizedWorkspaceId,
+                action: 'workstream-created',
+                actor: options?.actorRef || 'system',
+                createdAt: workstream.updatedAt || workstream.createdAt,
+                details: {
+                    title: workstream.title,
+                    ownerId: workstream.ownerId || null,
+                    initiativeId: workstream.initiativeId || null,
+                }
+            });
+        }
+        return this.getWorkstreamForWriteResult(workstream.id, normalizedWorkspaceId, workstream, 'createWorkstream:post-write');
     }
-    updateWorkstream(id, patch, workspaceId) {
+    updateWorkstream(id, patch, workspaceId, options) {
         const existing = this.getWorkstream(id, workspaceId);
         if (!existing) {
             throw new TaskforceRuleError(`Workstream not found: ${id}`, 404, 'WORKSTREAM_NOT_FOUND');
         }
         const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
+        const nextAttachments = Object.prototype.hasOwnProperty.call(patch, 'attachments') && Array.isArray(patch.attachments)
+            ? patch.attachments
+            : existing.attachments;
         const next = {
             ...existing,
             ...patch,
@@ -3183,6 +3838,7 @@ export class TaskforceCore {
             initiativeId: Object.prototype.hasOwnProperty.call(patch, 'initiativeId')
                 ? this.sanitizeInitiativeId(patch.initiativeId)
                 : existing.initiativeId,
+            attachments: nextAttachments,
             updatedAt: String(patch.updatedAt || '').trim() || new Date().toISOString(),
             referenceLabel: formatWorkstreamReference(patch.referenceNumber ?? existing.referenceNumber),
         };
@@ -3215,41 +3871,94 @@ export class TaskforceCore {
             sortOrder: next.order,
             isArchived: next.isArchived ? 1 : 0,
         });
-        return this.getWorkstream(existing.id, normalizedWorkspaceId);
+        this.syncCanonicalPlanningAttachmentLinks('workstream', existing.id, normalizedWorkspaceId, next.attachments || []);
+        const hydrated = this.getWorkstreamForWriteResult(existing.id, normalizedWorkspaceId, next, 'updateWorkstream:post-write');
+        if (options?.skipEntityEvents !== true) {
+            const changes = this.buildPlanningEntityEventChanges(existing, next, ['title', 'description', 'ownerId', 'initiativeId', 'attachments']);
+            if (Object.keys(changes).length > 0) {
+                this.addEntityEvent({
+                    entityType: 'workstream',
+                    entityId: existing.id,
+                    workspaceId: normalizedWorkspaceId,
+                    action: this.getPlanningEntityEventAction('workstream', changes),
+                    actor: options?.actorRef || 'system',
+                    createdAt: next.updatedAt,
+                    details: { changes }
+                });
+                return this.getWorkstreamForWriteResult(existing.id, normalizedWorkspaceId, hydrated, 'updateWorkstream:post-event');
+            }
+        }
+        return hydrated;
     }
-    archiveWorkstream(id, workspaceId) {
+    archiveWorkstream(id, workspaceId, options) {
         const existing = this.getWorkstream(id, workspaceId);
         if (!existing) {
             throw new TaskforceRuleError(`Workstream not found: ${id}`, 404, 'WORKSTREAM_NOT_FOUND');
         }
         if (existing.isArchived)
             return existing;
-        return this.updateWorkstream(id, { isArchived: true }, workspaceId);
+        const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
+        const archived = this.updateWorkstream(id, { isArchived: true }, workspaceId, { ...options, skipEntityEvents: true });
+        if (options?.skipEntityEvents !== true) {
+            this.addEntityEvent({
+                entityType: 'workstream',
+                entityId: id,
+                workspaceId: normalizedWorkspaceId,
+                action: 'workstream-archived',
+                actor: options?.actorRef || 'system',
+                createdAt: archived.updatedAt || new Date().toISOString(),
+            });
+            return this.getWorkstreamForWriteResult(id, normalizedWorkspaceId, archived, 'archiveWorkstream:post-event');
+        }
+        return archived;
     }
-    unarchiveWorkstream(id, workspaceId) {
+    unarchiveWorkstream(id, workspaceId, options) {
         const existing = this.getWorkstream(id, workspaceId);
         if (!existing) {
             throw new TaskforceRuleError(`Workstream not found: ${id}`, 404, 'WORKSTREAM_NOT_FOUND');
         }
         if (!existing.isArchived)
             return existing;
-        return this.updateWorkstream(id, { isArchived: false }, workspaceId);
+        const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
+        const restored = this.updateWorkstream(id, { isArchived: false }, workspaceId, { ...options, skipEntityEvents: true });
+        if (options?.skipEntityEvents !== true) {
+            this.addEntityEvent({
+                entityType: 'workstream',
+                entityId: id,
+                workspaceId: normalizedWorkspaceId,
+                action: 'workstream-unarchived',
+                actor: options?.actorRef || 'system',
+                createdAt: restored.updatedAt || new Date().toISOString(),
+            });
+            return this.getWorkstreamForWriteResult(id, normalizedWorkspaceId, restored, 'unarchiveWorkstream:post-event');
+        }
+        return restored;
     }
     upsertInitiativeForSync(initiative, workspaceId) {
         const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
         const existing = this.getInitiative(initiative.id, normalizedWorkspaceId);
         if (existing) {
-            return this.updateInitiative(existing.id, initiative, normalizedWorkspaceId);
+            const existingUpdatedAtMs = Date.parse(String(existing.updatedAt || existing.createdAt || '').trim());
+            const incomingUpdatedAtMs = Date.parse(String(initiative.updatedAt || initiative.createdAt || '').trim());
+            if (Number.isFinite(existingUpdatedAtMs) && Number.isFinite(incomingUpdatedAtMs) && incomingUpdatedAtMs < existingUpdatedAtMs) {
+                return existing;
+            }
+            return this.updateInitiative(existing.id, initiative, normalizedWorkspaceId, { skipEntityEvents: true });
         }
-        return this.createInitiative(initiative, normalizedWorkspaceId);
+        return this.createInitiative(initiative, normalizedWorkspaceId, { skipEntityEvents: true });
     }
     upsertWorkstreamForSync(workstream, workspaceId) {
         const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
         const existing = this.getWorkstream(workstream.id, normalizedWorkspaceId);
         if (existing) {
-            return this.updateWorkstream(existing.id, workstream, normalizedWorkspaceId);
+            const existingUpdatedAtMs = Date.parse(String(existing.updatedAt || existing.createdAt || '').trim());
+            const incomingUpdatedAtMs = Date.parse(String(workstream.updatedAt || workstream.createdAt || '').trim());
+            if (Number.isFinite(existingUpdatedAtMs) && Number.isFinite(incomingUpdatedAtMs) && incomingUpdatedAtMs < existingUpdatedAtMs) {
+                return existing;
+            }
+            return this.updateWorkstream(existing.id, workstream, normalizedWorkspaceId, { skipEntityEvents: true });
         }
-        return this.createWorkstream(workstream, normalizedWorkspaceId);
+        return this.createWorkstream(workstream, normalizedWorkspaceId, { skipEntityEvents: true });
     }
     listChecklistItems(taskId, workspaceId) {
         const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
@@ -3899,7 +4608,7 @@ export class TaskforceCore {
     listTasks(workspaceId) {
         const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
         const rows = this.db.prepare(`
-            SELECT * FROM tasks 
+            SELECT * FROM tasks
             WHERE tenant_id = ?
               AND workspace_id = ?
               AND is_archived = 0
@@ -3910,30 +4619,136 @@ export class TaskforceCore {
             config: this.readConfig()
         };
     }
-    getDataVersion() {
-        if (this.db.provider === 'sqlite') {
-            const version = this.db.pragma('data_version', { simple: true });
-            return Number.isFinite(version) ? version : 0;
+    /**
+     * Filter-pushdown listing used by read-only surfaces that don't need the
+     * full task graph (MCP list_tasks, CLI summaries). Avoids the per-task
+     * comments/events/attachments/checklist subqueries and actor resolution
+     * that rowToTask performs, and applies filters + sort + limit at the SQL
+     * layer so hot polls don't load the entire workspace.
+     */
+    listTasksSlim(workspaceId, filters = {}) {
+        const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
+        const clauses = [
+            'tenant_id = ?',
+            'workspace_id = ?',
+            'is_archived = 0',
+        ];
+        const params = [this.tenantId, normalizedWorkspaceId];
+        if (filters.category) {
+            clauses.push('category = ?');
+            params.push(filters.category);
         }
-        // Fallback signal for non-SQLite backends until provider-specific versioning is implemented.
-        return 0;
-    }
-    getDatabaseProvider() {
-        return this.db.provider;
-    }
-    isDatabaseHealthy() {
-        try {
-            const row = this.db.prepare('SELECT 1 as ok').get();
-            return row?.ok === 1 || row?.ok === undefined;
+        if (filters.status) {
+            clauses.push('status = ?');
+            params.push(filters.status);
         }
-        catch {
-            return false;
+        else if (filters.openOnly) {
+            clauses.push("status IN ('task','on-hold','in-progress','review')");
         }
-    }
-    listArchive(workspaceId) {
-        const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
-        const rows = this.db.prepare(`
-            SELECT * FROM tasks 
+        if (filters.priority !== undefined) {
+            clauses.push('priority = ?');
+            params.push(Number(filters.priority));
+        }
+        if (filters.type) {
+            clauses.push('type = ?');
+            params.push(filters.type);
+        }
+        if (filters.assignee) {
+            if (filters.assignee === 'unassigned') {
+                clauses.push("(assignee IS NULL OR assignee = '' OR assignee = 'unassigned')");
+            }
+            else {
+                clauses.push('assignee = ?');
+                params.push(filters.assignee);
+            }
+        }
+        const order = filters.order === 'asc' ? 'ASC' : 'DESC';
+        const sort = filters.sort ?? 'created';
+        let orderBy;
+        if (sort === 'priority') {
+            orderBy = `priority ${order}, created_at ${order}`;
+        }
+        else if (sort === 'updated') {
+            orderBy = `COALESCE(updated_at, created_at) ${order}`;
+        }
+        else {
+            orderBy = `created_at ${order}`;
+        }
+        let sql = `SELECT * FROM tasks WHERE ${clauses.join(' AND ')} ORDER BY ${orderBy}`;
+        const rawLimit = Number(filters.limit);
+        const limit = Number.isFinite(rawLimit) ? Math.max(0, Math.floor(rawLimit)) : 0;
+        if (limit > 0) {
+            sql += ' LIMIT ?';
+            params.push(limit);
+        }
+        const rows = this.db.prepare(sql).all(...params);
+        return rows.map((row) => {
+            const sanitizedAssignee = this.sanitizeAssignee(row.assignee, normalizedWorkspaceId);
+            const scheduledDate = this.sanitizeDateOnly(row.scheduled_date);
+            const dueDate = this.sanitizeDateOnly(row.due_date);
+            const scheduledWeekKey = row.scheduled_week_key
+                || (scheduledDate ? this.dateOnlyToIsoWeekKey(scheduledDate) : null);
+            const referenceNumber = this.sanitizeTaskReferenceNumber(row.reference_number);
+            const localReferenceNumber = this.sanitizeTaskReferenceNumber(row.local_reference_number);
+            let taxonomies = {};
+            try {
+                taxonomies = JSON.parse(row.taxonomies || '{}');
+            }
+            catch {
+                taxonomies = {};
+            }
+            return {
+                id: String(row.id || '').trim(),
+                referenceNumber,
+                localReferenceNumber,
+                referenceLabel: deriveTaskReferenceLabel({ referenceNumber, localReferenceNumber }),
+                title: row.title,
+                status: this.normalizeStatusValue(row.status),
+                priority: this.normalizePriorityValue(row.priority),
+                complexity: row.complexity,
+                type: row.type,
+                category: row.category,
+                approach: row.approach || undefined,
+                createdAt: row.created_at,
+                updatedAt: row.updated_at,
+                completedAt: row.completed_at,
+                canceledReason: row.canceled_reason,
+                isArchived: row.is_archived === 1,
+                scheduledDate,
+                dueDate,
+                scheduledWeekKey,
+                orderInDay: this.sanitizeOrderInDay(row.order_in_day),
+                workstreamId: this.sanitizeWorkstreamId(row.workstream_id),
+                taxonomies,
+                createdBy: this.normalizeCreatedBy(row.created_by, normalizedWorkspaceId, { preserveGenericAi: true }),
+                assignee: sanitizedAssignee,
+            };
+        });
+    }
+    getDataVersion() {
+        if (this.db.provider === 'sqlite') {
+            const version = this.db.pragma('data_version', { simple: true });
+            return Number.isFinite(version) ? version : 0;
+        }
+        // Fallback signal for non-SQLite backends until provider-specific versioning is implemented.
+        return 0;
+    }
+    getDatabaseProvider() {
+        return this.db.provider;
+    }
+    isDatabaseHealthy() {
+        try {
+            const row = this.db.prepare('SELECT 1 as ok').get();
+            return row?.ok === 1 || row?.ok === undefined;
+        }
+        catch {
+            return false;
+        }
+    }
+    listArchive(workspaceId) {
+        const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
+        const rows = this.db.prepare(`
+            SELECT * FROM tasks 
             WHERE tenant_id = ?
               AND workspace_id = ?
               AND is_archived = 1
@@ -4050,9 +4865,9 @@ export class TaskforceCore {
         `).get(this.tenantId, userId);
         if (!existingUser) {
             this.db.prepare(`
-                INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, beta_access, is_disabled, created_at, updated_at)
-                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-            `).run(userId, this.tenantId, email, displayName, 'token', userId, 1, 0, now, now);
+                INSERT INTO users (id, tenant_id, email, display_name, beta_access, is_disabled, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+            `).run(userId, this.tenantId, email, displayName, 1, 0, now, now);
         }
         const membership = this.db.prepare(`
             SELECT id, role FROM workspace_memberships
@@ -4097,16 +4912,17 @@ export class TaskforceCore {
         `).get(this.tenantId, normalizedUserId, normalizedWorkspaceId);
         if (!membership?.workspace_id)
             return null;
-        const disabled = Boolean(userRow.is_disabled);
+        const accountDisabled = Boolean(userRow.is_disabled);
         const userBetaAccess = userRow.beta_access === undefined || userRow.beta_access === null
             ? true
             : Boolean(userRow.beta_access);
         const isSystemAdmin = this.normalizeSystemRole(userRow.system_role, 'user') === 'system_admin';
         const membershipActive = !membership.status || String(membership.status).toLowerCase() === 'active';
+        const workspaceDisabled = !membershipActive;
         const baseRole = this.normalizeAccessRole(membership.role || fallbackRole, fallbackRole);
         const permissionMode = this.normalizePermissionMode(membership.permission_mode, 'read-write');
         const isMemberReadOnly = baseRole === 'member' && permissionMode === 'read-only';
-        const resolvedRole = (disabled || !membershipActive || isMemberReadOnly)
+        const resolvedRole = (accountDisabled || workspaceDisabled || isMemberReadOnly)
             ? 'read-only'
             : baseRole;
         return {
@@ -4114,7 +4930,9 @@ export class TaskforceCore {
             workspaceId: String(membership.workspace_id || normalizedWorkspaceId),
             role: resolvedRole,
             permissionMode,
-            disabled,
+            disabled: accountDisabled || workspaceDisabled,
+            accountDisabled,
+            workspaceDisabled,
             betaAccess: userBetaAccess || isSystemAdmin
         };
     }
@@ -4292,6 +5110,91 @@ export class TaskforceCore {
         `).run(now, now, this.tenantId, normalizedUserId, cutoff);
         return staleDrafts;
     }
+    createTaskAttachmentUploadDraft(input) {
+        const draftId = String(input.draftId || '').trim();
+        const workspaceId = String(input.workspaceId || '').trim();
+        const taskId = String(input.taskId || '').trim();
+        const actorRef = String(input.actorRef || '').trim() || 'system';
+        const storageKey = String(input.storageKey || '').trim();
+        const mimeType = String(input.mimeType || 'application/octet-stream').trim() || 'application/octet-stream';
+        const originalFilename = String(input.originalFilename || '').trim() || 'attachment';
+        const sizeBytes = Number.isFinite(Number(input.sizeBytes)) ? Math.max(0, Math.floor(Number(input.sizeBytes))) : 0;
+        const storageProvider = input.storageProvider === 'r2' || input.storageProvider === 'external' ? input.storageProvider : 'local';
+        if (!draftId)
+            throw new TaskforceRuleError('draftId is required', 400, 'TASK_ATTACHMENT_DRAFT_ID_REQUIRED');
+        if (!workspaceId)
+            throw new TaskforceRuleError('workspaceId is required', 400, 'WORKSPACE_ID_REQUIRED');
+        if (!taskId)
+            throw new TaskforceRuleError('taskId is required', 400, 'TASK_ID_REQUIRED');
+        if (!storageKey)
+            throw new TaskforceRuleError('storageKey is required', 400, 'TASK_ATTACHMENT_STORAGE_KEY_REQUIRED');
+        const now = new Date().toISOString();
+        this.db.prepare(`
+            INSERT INTO task_attachment_upload_drafts (
+                draft_id, tenant_id, workspace_id, task_id, actor_ref, storage_key, mime_type, original_filename,
+                size_bytes, storage_provider, consumed_at, discarded_at, created_at, updated_at
+            )
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, NULL, ?, ?)
+        `).run(draftId, this.tenantId, workspaceId, taskId, actorRef, storageKey, mimeType, originalFilename, sizeBytes, storageProvider, now, now);
+        return this.getTaskAttachmentUploadDraft(draftId);
+    }
+    getTaskAttachmentUploadDraft(draftId) {
+        const normalizedDraftId = String(draftId || '').trim();
+        if (!normalizedDraftId)
+            return null;
+        const row = this.db.prepare(`
+            SELECT draft_id, workspace_id, task_id, actor_ref, storage_key, mime_type, original_filename,
+                   size_bytes, storage_provider, consumed_at, discarded_at, created_at, updated_at
+            FROM task_attachment_upload_drafts
+            WHERE tenant_id = ? AND draft_id = ?
+            LIMIT 1
+        `).get(this.tenantId, normalizedDraftId);
+        if (!row?.draft_id)
+            return null;
+        return {
+            draftId: String(row.draft_id),
+            workspaceId: String(row.workspace_id || ''),
+            taskId: String(row.task_id || ''),
+            actorRef: String(row.actor_ref || 'system'),
+            storageKey: String(row.storage_key || ''),
+            mimeType: String(row.mime_type || 'application/octet-stream'),
+            originalFilename: String(row.original_filename || 'attachment'),
+            sizeBytes: Number(row.size_bytes || 0),
+            storageProvider: String(row.storage_provider || 'local') === 'r2'
+                ? 'r2'
+                : String(row.storage_provider || 'local') === 'external'
+                    ? 'external'
+                    : 'local',
+            consumedAt: row.consumed_at ? String(row.consumed_at) : null,
+            discardedAt: row.discarded_at ? String(row.discarded_at) : null,
+            createdAt: String(row.created_at || ''),
+            updatedAt: String(row.updated_at || ''),
+        };
+    }
+    markTaskAttachmentUploadDraftConsumed(draftId) {
+        const existing = this.getTaskAttachmentUploadDraft(draftId);
+        if (!existing || existing.discardedAt)
+            return null;
+        const now = new Date().toISOString();
+        this.db.prepare(`
+            UPDATE task_attachment_upload_drafts
+            SET consumed_at = COALESCE(consumed_at, ?), updated_at = ?
+            WHERE tenant_id = ? AND draft_id = ? AND discarded_at IS NULL
+        `).run(now, now, this.tenantId, existing.draftId);
+        return this.getTaskAttachmentUploadDraft(existing.draftId);
+    }
+    discardTaskAttachmentUploadDraft(draftId) {
+        const existing = this.getTaskAttachmentUploadDraft(draftId);
+        if (!existing || existing.discardedAt)
+            return existing;
+        const now = new Date().toISOString();
+        this.db.prepare(`
+            UPDATE task_attachment_upload_drafts
+            SET discarded_at = ?, updated_at = ?
+            WHERE tenant_id = ? AND draft_id = ? AND discarded_at IS NULL
+        `).run(now, now, this.tenantId, existing.draftId);
+        return this.getTaskAttachmentUploadDraft(existing.draftId);
+    }
     getSystemRole(userId) {
         const normalizedUserId = String(userId || '').trim();
         if (!normalizedUserId || normalizedUserId === 'anonymous')
@@ -4333,7 +5236,68 @@ export class TaskforceCore {
     hasAnySystemAdmin() {
         return this.countSystemAdmins() > 0;
     }
-    listSystemUsers() {
+    countSystemUsers(input) {
+        const query = String(input?.query || '').trim().toLowerCase();
+        const queryPattern = query ? `%${query}%` : '';
+        const searchClause = query
+            ? `
+              AND (
+                LOWER(COALESCE(u.display_name, '')) LIKE ?
+                OR LOWER(COALESCE(u.id, '')) LIKE ?
+                OR LOWER(COALESCE(u.email, '')) LIKE ?
+                OR LOWER(COALESCE(COALESCE(p.display_name, v.plan_id), '')) LIKE ?
+                OR LOWER(COALESCE(v.plan_id, '')) LIKE ?
+                OR LOWER(COALESCE(e.entitlement_state, '')) LIKE ?
+                OR LOWER(COALESCE(u.system_role, 'user')) LIKE ?
+              )`
+            : '';
+        const params = [this.tenantId];
+        if (query) {
+            params.push(queryPattern, queryPattern, queryPattern, queryPattern, queryPattern, queryPattern, queryPattern);
+        }
+        const row = this.db.prepare(`
+            SELECT COUNT(*) AS count
+            FROM users u
+            LEFT JOIN account_entitlements e
+              ON e.tenant_id = u.tenant_id
+             AND e.account_id = u.id
+            LEFT JOIN plan_versions v
+              ON v.tenant_id = u.tenant_id
+             AND v.plan_version_id = e.plan_version_id
+            LEFT JOIN plan_catalog p
+              ON p.tenant_id = u.tenant_id
+             AND p.plan_id = v.plan_id
+            WHERE u.tenant_id = ?
+              ${searchClause}
+        `).get(...params);
+        return Number(row?.count || 0);
+    }
+    listSystemUsers(input) {
+        const query = String(input?.query || '').trim().toLowerCase();
+        const queryPattern = query ? `%${query}%` : '';
+        const sort = input?.sort === 'oldest' ? 'oldest' : 'newest';
+        const limit = Number.isFinite(Number(input?.limit)) ? Math.max(1, Math.min(200, Math.floor(Number(input?.limit)))) : 50;
+        const offset = Number.isFinite(Number(input?.offset)) ? Math.max(0, Math.floor(Number(input?.offset))) : 0;
+        const orderByClause = sort === 'oldest'
+            ? `ORDER BY COALESCE(u.created_at, u.updated_at) ASC, COALESCE(u.updated_at, u.created_at) ASC, u.id ASC`
+            : `ORDER BY COALESCE(u.created_at, u.updated_at) DESC, COALESCE(u.updated_at, u.created_at) DESC, u.id DESC`;
+        const searchClause = query
+            ? `
+              AND (
+                LOWER(COALESCE(u.display_name, '')) LIKE ?
+                OR LOWER(COALESCE(u.id, '')) LIKE ?
+                OR LOWER(COALESCE(u.email, '')) LIKE ?
+                OR LOWER(COALESCE(COALESCE(p.display_name, v.plan_id), '')) LIKE ?
+                OR LOWER(COALESCE(v.plan_id, '')) LIKE ?
+                OR LOWER(COALESCE(e.entitlement_state, '')) LIKE ?
+                OR LOWER(COALESCE(u.system_role, 'user')) LIKE ?
+              )`
+            : '';
+        const params = [this.tenantId];
+        if (query) {
+            params.push(queryPattern, queryPattern, queryPattern, queryPattern, queryPattern, queryPattern, queryPattern);
+        }
+        params.push(limit, offset);
         const rows = this.db.prepare(`
             SELECT
                 u.id AS user_id,
@@ -4360,8 +5324,10 @@ export class TaskforceCore {
               ON p.tenant_id = u.tenant_id
              AND p.plan_id = v.plan_id
             WHERE u.tenant_id = ?
-            ORDER BY COALESCE(u.updated_at, u.created_at) DESC, u.created_at DESC
-        `).all(this.tenantId);
+              ${searchClause}
+            ${orderByClause}
+            LIMIT ? OFFSET ?
+        `).all(...params);
         return rows
             .filter((row) => row.user_id && row.email)
             .map((row) => ({
@@ -4653,6 +5619,7 @@ export class TaskforceCore {
                 u.id AS user_id,
                 u.email AS email,
                 u.display_name AS display_name,
+                u.avatar_url AS avatar_url,
                 u.is_disabled AS is_disabled,
                 u.created_at AS created_at,
                 u.updated_at AS updated_at,
@@ -4669,19 +5636,23 @@ export class TaskforceCore {
               AND m.workspace_id = ?
             ORDER BY COALESCE(m.updated_at, m.created_at) DESC, u.created_at DESC
         `).all(this.tenantId, normalizedWorkspaceId);
-        return rows.map((row) => ({
-            userId: row.user_id,
-            email: row.email,
-            displayName: row.display_name || null,
-            role: this.normalizeAccessRole(row.role || 'member', 'member'),
-            permissionMode: this.normalizePermissionMode(row.permission_mode, 'read-write'),
-            betaAccess: row.beta_access === undefined || row.beta_access === null ? true : Boolean(row.beta_access),
-            status: String(row.status || 'active'),
-            disabled: Boolean(row.is_disabled),
-            createdAt: row.created_at || null,
-            updatedAt: row.updated_at || null,
-            emailVerifiedAt: row.email_verified_at || null
-        }));
+        return rows.map((row) => {
+            const status = String(row.status || 'active');
+            return {
+                userId: row.user_id,
+                email: row.email,
+                displayName: row.display_name || null,
+                avatarUrl: row.avatar_url || null,
+                role: this.normalizeAccessRole(row.role || 'member', 'member'),
+                permissionMode: this.normalizePermissionMode(row.permission_mode, 'read-write'),
+                betaAccess: row.beta_access === undefined || row.beta_access === null ? true : Boolean(row.beta_access),
+                status,
+                disabled: Boolean(row.is_disabled) || status.toLowerCase() === 'disabled',
+                createdAt: row.created_at || null,
+                updatedAt: row.updated_at || null,
+                emailVerifiedAt: row.email_verified_at || null
+            };
+        });
     }
     replaceWorkspaceUsersForSync(input) {
         const workspaceId = String(input.workspaceId || 'default').trim() || 'default';
@@ -4725,9 +5696,9 @@ export class TaskforceCore {
                 }
                 else {
                     this.db.prepare(`
-                        INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, beta_access, is_disabled, created_at, updated_at, email_verified_at)
-                        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-                    `).run(userId, this.tenantId, email, displayName, 'sync', userId, betaAccess ? 1 : 0, disabled ? 1 : 0, createdAt, updatedAt, emailVerifiedAt);
+                        INSERT INTO users (id, tenant_id, email, display_name, beta_access, is_disabled, created_at, updated_at, email_verified_at)
+                        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+                    `).run(userId, this.tenantId, email, displayName, betaAccess ? 1 : 0, disabled ? 1 : 0, createdAt, updatedAt, emailVerifiedAt);
                 }
                 const membership = this.db.prepare(`
                     SELECT id
@@ -4770,8 +5741,8 @@ export class TaskforceCore {
         tx();
         return this.listWorkspaceUsers(workspaceId);
     }
-    listAiProfiles(workspaceId) {
-        return listAiProfilesService(this.getAiProfileServiceDeps(), workspaceId);
+    listAiProfiles(workspaceId, options) {
+        return listAiProfilesService(this.getAiProfileServiceDeps(), workspaceId, options);
     }
     getAiProfileByToken(input) {
         return getAiProfileByTokenService(this.getAiProfileServiceDeps(), input);
@@ -4782,8 +5753,17 @@ export class TaskforceCore {
     mergeAiProfiles(input) {
         return mergeAiProfilesService(this.getAiProfileServiceDeps(), input);
     }
-    resolveAiProfile(input) {
-        return resolveAiProfileService(this.getAiProfileServiceDeps(), input);
+    archiveAiProfile(input) {
+        return archiveAiProfileService(this.getAiProfileServiceDeps(), input).profile;
+    }
+    updateAiProfileAvatar(input) {
+        return updateAiProfileAvatarService(this.getAiProfileServiceDeps(), input);
+    }
+    updateAiProfileSurfaceType(input) {
+        return updateAiProfileSurfaceTypeService(this.getAiProfileServiceDeps(), input);
+    }
+    resolveAiProfile(input, options) {
+        return resolveAiProfileService(this.getAiProfileServiceDeps(), input, options);
     }
     listAnnotatedAttachmentSessions(input) {
         return listAnnotatedAttachmentSessionsService(this.getAnnotatedAttachmentServiceDeps(), input);
@@ -4813,17 +5793,30 @@ export class TaskforceCore {
         const activeSessions = deps.sessionStore.listByWorkspace('default', { includeDeleted: false });
         if (activeSessions.length === 0)
             return;
-        const hasActiveImageLink = this.db.prepare(`
-            SELECT 1
-            FROM workspace_asset_links
-            WHERE tenant_id = ?
-              AND workspace_id = ?
-              AND task_id = ?
-              AND asset_id = ?
-              AND role = 'image'
-              AND deleted_at IS NULL
-            LIMIT 1
-        `);
+        const hasActiveImageLink = this.supportsWorkspaceAssetLinkTargetType()
+            ? this.db.prepare(`
+                SELECT 1
+                FROM workspace_asset_links
+                WHERE tenant_id = ?
+                  AND workspace_id = ?
+                  AND target_type = 'task'
+                  AND task_id = ?
+                  AND asset_id = ?
+                  AND role = 'image'
+                  AND deleted_at IS NULL
+                LIMIT 1
+            `)
+            : this.db.prepare(`
+                SELECT 1
+                FROM workspace_asset_links
+                WHERE tenant_id = ?
+                  AND workspace_id = ?
+                  AND task_id = ?
+                  AND asset_id = ?
+                  AND role = 'image'
+                  AND deleted_at IS NULL
+                LIMIT 1
+            `);
         for (const session of activeSessions) {
             const taskId = String(session.taskId || '').trim();
             const imageAssetId = String(session.baseImageAssetId || '').trim();
@@ -4909,6 +5902,9 @@ export class TaskforceCore {
     upsertTaskEventForSync(event) {
         return upsertTaskEventForSyncService(this.getTaskActivityServiceDeps(), event);
     }
+    upsertEntityEventForSync(event) {
+        return upsertEntityEventForSyncService(this.getTaskActivityServiceDeps(), event);
+    }
     deleteDocumentReviewSessionForSync(input) {
         const deps = this.getDocumentReviewServiceDeps();
         return deps.sessionStore.softDelete(input.sessionId, deps.normalizeWorkspaceId(input.workspaceId), input.deletedAt || undefined);
@@ -4976,21 +5972,9 @@ export class TaskforceCore {
         if (aiProfile) {
             return this.aiProfileToActor(this.aiProfileRowToRecord(aiProfile));
         }
-        // Name-based fallback: agents may use their display name instead of profile ID
-        const aiProfileByName = this.db.prepare(`
-            SELECT *
-            FROM ai_profiles
-            WHERE tenant_id = ?
-              AND workspace_id = ?
-              AND (
-                  LOWER(name) = LOWER(?)
-                  OR LOWER(username) = LOWER(?)
-              )
-            ORDER BY COALESCE(last_active_at, updated_at, created_at) DESC, id ASC
-            LIMIT 1
-        `).get(this.tenantId, normalizedWorkspaceId, raw, raw);
-        if (aiProfileByName) {
-            return this.aiProfileToActor(this.aiProfileRowToRecord(aiProfileByName));
+        const uniqueAiProfileByAlias = this.resolveUniqueAiProfileActorByAlias(normalizedWorkspaceId, raw);
+        if (uniqueAiProfileByAlias) {
+            return uniqueAiProfileByAlias;
         }
         const workspaceUser = this.listWorkspaceUsers(normalizedWorkspaceId).find((user) => user.userId === raw);
         if (workspaceUser) {
@@ -5235,6 +6219,9 @@ export class TaskforceCore {
     listPlanFeatureCatalog() {
         return this.planEntitlementService.listPlanFeatureCatalog();
     }
+    updatePlanFeatureCatalogMarketingCopy(input) {
+        return this.planEntitlementService.updatePlanFeatureCatalogMarketingCopy(input);
+    }
     listPlanVersions(planId) {
         return this.planEntitlementService.listPlanVersions(planId);
     }
@@ -5354,11 +6341,6 @@ export class TaskforceCore {
                 }
             }
             const now = new Date().toISOString();
-            this.db.prepare(`
-                UPDATE users
-                SET is_disabled = ?, updated_at = ?
-                WHERE tenant_id = ? AND id = ?
-            `).run(disabled ? 1 : 0, now, this.tenantId, normalizedUserId);
             if (membership?.id) {
                 this.db.prepare(`
                     UPDATE workspace_memberships
@@ -5532,9 +6514,7 @@ export class TaskforceCore {
         if (!email || !email.includes('@')) {
             throw new TaskforceRuleError('Valid email is required', 400, 'EMAIL_REQUIRED');
         }
-        if (!password || password.length < 8) {
-            throw new TaskforceRuleError('Password must be at least 8 characters', 400, 'PASSWORD_TOO_SHORT');
-        }
+        assertPasswordPolicy(password, { email, displayName: input.displayName || null });
         if (!workspaceId || workspaceId.toLowerCase() === 'default') {
             throw new TaskforceRuleError('A non-default workspaceId is required', 400, 'WORKSPACE_ID_REQUIRED');
         }
@@ -5551,20 +6531,16 @@ export class TaskforceCore {
             email,
             displayName
         });
-        if (emailVerified) {
-            this.db.prepare(`
-                UPDATE users
-                SET password_hash = ?, auth_provider = ?, external_auth_id = ?, email_verified_at = ?, beta_access = ?, is_disabled = 0, updated_at = ?
-                WHERE tenant_id = ? AND id = ?
-            `).run(hashPassword(password), 'password', email, now, betaAccess ? 1 : 0, now, this.tenantId, userId);
-        }
-        else {
-            this.db.prepare(`
-                UPDATE users
-                SET password_hash = ?, auth_provider = ?, external_auth_id = ?, beta_access = ?, is_disabled = 0, updated_at = ?
-                WHERE tenant_id = ? AND id = ?
-            `).run(hashPassword(password), 'password', email, betaAccess ? 1 : 0, now, this.tenantId, userId);
-        }
+        this.db.prepare(`
+            UPDATE users
+            SET
+                email_verified_at = CASE WHEN ? = 1 THEN COALESCE(email_verified_at, ?) ELSE email_verified_at END,
+                beta_access = ?,
+                is_disabled = 0,
+                updated_at = ?
+            WHERE tenant_id = ? AND id = ?
+        `).run(emailVerified ? 1 : 0, now, betaAccess ? 1 : 0, now, this.tenantId, userId);
+        this.identityService.setPasswordIdentity(userId, password);
         this.updateWorkspaceUserRole(userId, workspaceId, role);
         this.setWorkspaceUserDisabled(userId, workspaceId, false);
         return { userId, workspaceId, role };
@@ -5575,9 +6551,7 @@ export class TaskforceCore {
         if (!email || !email.includes('@')) {
             throw new TaskforceRuleError('Valid email is required', 400, 'EMAIL_REQUIRED');
         }
-        if (!password || password.length < 8) {
-            throw new TaskforceRuleError('Password must be at least 8 characters', 400, 'PASSWORD_TOO_SHORT');
-        }
+        assertPasswordPolicy(password, { email, displayName: input.displayName || null });
         const existing = this.db.prepare(`
             SELECT id FROM users WHERE tenant_id = ? AND email = ? LIMIT 1
         `).get(this.tenantId, email);
@@ -5606,9 +6580,10 @@ export class TaskforceCore {
             const userId = this.generateEntityId('user');
             const displayName = String(input.displayName || email.split('@')[0] || email).trim() || email;
             this.db.prepare(`
-                INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, password_hash, system_role, beta_access, is_disabled, created_at, updated_at)
-                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 0, ?, ?)
-            `).run(userId, this.tenantId, email, displayName, 'password', email, hashPassword(password), assignFirstSystemAdmin ? 'system_admin' : 'user', betaAccess ? 1 : 0, now, now);
+                INSERT INTO users (id, tenant_id, email, display_name, system_role, beta_access, is_disabled, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?)
+            `).run(userId, this.tenantId, email, displayName, assignFirstSystemAdmin ? 'system_admin' : 'user', betaAccess ? 1 : 0, now, now);
+            this.identityService.createPasswordIdentity(userId, password);
             applyRegistrationCommercialState(userId, now);
             return {
                 userId,
@@ -5642,6 +6617,151 @@ export class TaskforceCore {
             commercialState: onboardingOutcome.commercialState
         };
     }
+    // ─── OAuth state management (delegated to AuthIdentityService) ────────────
+    /**
+     * Creates an OAuth state record and returns the state token + PKCE materials.
+     * Delegates to AuthIdentityService.createOAuthState.
+     */
+    createOAuthLoginState(input) {
+        return this.identityService.createOAuthState(input);
+    }
+    /**
+     * Atomically consumes an OAuth state token and returns the row.
+     * Returns null if invalid, expired, or already consumed.
+     */
+    consumeOAuthLoginState(state) {
+        return this.identityService.consumeOAuthState(state);
+    }
+    // ─── OAuth identity operations ─────────────────────────────────────────────
+    /**
+     * Finds the Taskforce user associated with a provider identity.
+     * Returns { userId, identityId } or null if not yet linked.
+     */
+    findUserByOAuthProvider(provider, providerSubject) {
+        return this.identityService.findUserByProviderIdentity({ provider, providerSubject });
+    }
+    /**
+     * Links an OAuth provider identity to an existing user.
+     * Throws IDENTITY_ALREADY_EXISTS if the user already has an identity for this provider.
+     */
+    linkOAuthProviderToUser(input) {
+        return this.identityService.linkProviderIdentity(input);
+    }
+    /**
+     * Lists all active login identities for a user.
+     * Used by the Account Hub "Login methods" section.
+     */
+    listLoginMethodsForUser(userId) {
+        return this.identityService.listIdentitiesForUser(userId);
+    }
+    /**
+     * Unlinks a provider identity from a user.
+     * Throws LAST_IDENTITY_REQUIRED if it would be the last active method.
+     */
+    unlinkLoginMethod(userId, provider) {
+        return this.identityService.unlinkProviderIdentity({ userId, provider });
+    }
+    /**
+     * Adds or replaces a password identity for a user that signed up via OAuth.
+     * Uses upsert semantics (safe to call on accounts that already have a password).
+     */
+    addPasswordToAccount(userId, password) {
+        const user = this.db.prepare(`
+            SELECT email, display_name
+            FROM users
+            WHERE tenant_id = ? AND id = ?
+            LIMIT 1
+        `).get(this.tenantId, String(userId || '').trim());
+        assertPasswordPolicy(password, {
+            email: user?.email || null,
+            displayName: user?.display_name || null
+        });
+        return this.identityService.setPasswordIdentity(userId, password);
+    }
+    /**
+     * Registers a new user account via an OAuth provider (no password).
+     *
+     * Creates the user row, applies commercial onboarding, and links the
+     * provider identity — all in a single transaction.
+     *
+     * Returns the same shape as `registerPasswordUser` so callers can use
+     * the same session-issuance path.
+     */
+    registerOAuthUser(input) {
+        const email = input.email ? String(input.email).trim().toLowerCase() : null;
+        if (email && !email.includes('@')) {
+            throw new TaskforceRuleError('Valid email is required', 400, 'EMAIL_REQUIRED');
+        }
+        // Duplicate guard — email uniqueness (if email is provided)
+        if (email) {
+            const existing = this.db.prepare(`
+                SELECT id FROM users WHERE tenant_id = ? AND email = ? LIMIT 1
+            `).get(this.tenantId, email);
+            if (existing?.id) {
+                throw new TaskforceRuleError('Email is already registered', 409, 'EMAIL_ALREADY_EXISTS');
+            }
+        }
+        const assignFirstSystemAdmin = !this.hasAnySystemAdmin();
+        const betaAccess = input.betaAccess !== false;
+        const onboardingOutcome = this.resolveRegistrationOnboardingOutcome(input.planVersionId);
+        const now = new Date().toISOString();
+        const userId = this.generateEntityId('user');
+        const displayName = String(input.displayName || (email ? email.split('@')[0] : '') || '').trim()
+            || (email || userId);
+        this.db.prepare(`
+            INSERT INTO users
+                (id, tenant_id, email, email_verified_at, display_name, system_role,
+                 beta_access, is_disabled, created_at, updated_at)
+            VALUES (?, ?, ?, ?, ?, ?, ?, 0, ?, ?)
+        `).run(userId, this.tenantId, email, 
+        // OAuth providers that attest email_verified give us a verified email up-front
+        (email && input.emailVerified) ? now : null, displayName, assignFirstSystemAdmin ? 'system_admin' : 'user', betaAccess ? 1 : 0, now, now);
+        const identityId = this.identityService.linkProviderIdentity({
+            userId,
+            provider: input.provider,
+            providerSubject: input.providerSubject,
+            providerEmail: email,
+            providerEmailVerified: input.emailVerified ?? null,
+            displayNameSnapshot: input.displayName ?? null,
+            avatarUrlSnapshot: input.avatarUrl ?? null,
+        });
+        this.transitionCanonicalCommercialState({
+            accountId: userId,
+            planVersionId: onboardingOutcome.planVersionId,
+            state: onboardingOutcome.commercialState,
+            billingMirrorPlanId: onboardingOutcome.planId,
+            source: 'registration',
+            updatedBy: 'registration',
+            createdAt: now,
+            updatedAt: now
+        });
+        return {
+            userId,
+            workspaceId: null,
+            role: 'member',
+            identityId,
+            planSelectionRequired: onboardingOutcome.requiresPlanSelection,
+            checkoutPending: onboardingOutcome.checkoutPending,
+            commercialState: onboardingOutcome.commercialState,
+        };
+    }
+    /**
+     * Looks up a user by email address (exact, case-insensitive).
+     * Returns { userId, email } or null.
+     */
+    findUserByEmail(email) {
+        const normalized = String(email || '').trim().toLowerCase();
+        if (!normalized)
+            return null;
+        const row = this.db.prepare(`
+            SELECT id, email FROM users
+            WHERE tenant_id = ? AND email = ? AND COALESCE(is_disabled, 0) = 0
+            LIMIT 1
+        `).get(this.tenantId, normalized);
+        if (!row?.id)
+            return null;
+        return { userId: row.id, email: row.email || normalized };
+    }
     createOneTimeAuthToken(userId, purpose, ttlSeconds, workspaceId) {
         return this.authTokenService.createOneTimeAuthToken(userId, purpose, ttlSeconds, workspaceId);
     }
@@ -5667,6 +6787,9 @@ export class TaskforceCore {
     revokeMcpAccessToken(input) {
         return this.mcpTokenService.revokeMcpAccessToken(input);
     }
+    deleteMcpAccessToken(input) {
+        return this.mcpTokenService.deleteMcpAccessToken(input);
+    }
     regenerateMcpAccessToken(input) {
         return this.mcpTokenService.regenerateMcpAccessToken(input);
     }
@@ -5700,6 +6823,9 @@ export class TaskforceCore {
     authenticateMcpOAuthAccessToken(token, workspaceId) {
         return this.mcpTokenService.authenticateMcpOAuthAccessToken(token, workspaceId);
     }
+    bindMcpOAuthConnectorGrantAiProfile(input) {
+        return this.mcpTokenService.bindMcpOAuthConnectorGrantAiProfile(input);
+    }
     recordMcpOAuthConnectorGrantUsage(input) {
         return this.mcpTokenService.recordMcpOAuthConnectorGrantUsage(input);
     }
@@ -5744,19 +6870,23 @@ export class TaskforceCore {
         if (!inspection.userId)
             return inspection;
         const user = this.db.prepare(`
-            SELECT email, password_hash
-            FROM users
-            WHERE tenant_id = ? AND id = ? LIMIT 1
+            SELECT email FROM users WHERE tenant_id = ? AND id = ? LIMIT 1
         `).get(this.tenantId, inspection.userId);
         const workspaceId = String(inspection.workspaceId || '').trim();
-        const hasPassword = Boolean(String(user?.password_hash || '').trim());
+        const hasIdentity = this.identityService.hasAnyActiveIdentity(inspection.userId);
+        const inviteeState = hasIdentity ? 'existing_account' : 'pending_setup';
+        const identities = this.identityService.listIdentitiesForUser(inspection.userId);
+        const availableMethods = identities.map(i => i.provider);
         return {
             state: inspection.state,
             email: user?.email,
             userId: inspection.userId,
             workspaceId: workspaceId || 'default',
-            inviteeKind: hasPassword ? 'existing_user' : 'new_user',
-            passwordRequired: !hasPassword
+            inviteeState,
+            availableMethods,
+            // Backward-compatible fields
+            inviteeKind: hasIdentity ? 'existing_user' : 'new_user',
+            passwordRequired: !hasIdentity
         };
     }
     completeInviteWorkspaceActivation(input) {
@@ -5813,14 +6943,20 @@ export class TaskforceCore {
             role: this.normalizeAccessRole(membership?.role || 'member', 'member')
         };
     }
-    acceptInviteWithToken(input) {
+    /**
+     * Claims an invite by linking an OAuth provider identity to the invited user.
+     *
+     * Used when an invited user with `inviteeState: 'pending_setup'` completes an
+     * OAuth flow with `flow_mode: 'invite_claim'`.  The invite token must still be
+     * valid and the user must have zero active identities (pending setup).
+     *
+     * Returns the same shape as `acceptInviteWithToken` so callers can issue a
+     * session cookie on the same path.
+     */
+    claimInviteWithOAuthProvider(input) {
         const token = String(input.token || '').trim();
-        const password = String(input.password || '');
-        if (!token || !password) {
-            throw new TaskforceRuleError('Token and password are required', 400, 'TOKEN_PASSWORD_REQUIRED');
-        }
-        if (password.length < 8) {
-            throw new TaskforceRuleError('Password must be at least 8 characters', 400, 'PASSWORD_TOO_SHORT');
+        if (!token) {
+            throw new TaskforceRuleError('Invite token is required', 400, 'TOKEN_REQUIRED');
         }
         const consumed = this.consumeOneTimeAuthToken(token, 'invite_accept');
         if (!consumed?.userId) {
@@ -5841,38 +6977,111 @@ export class TaskforceCore {
             throw new TaskforceRuleError('Invite token is missing workspace context', 400, 'INVITE_WORKSPACE_REQUIRED');
         }
         const user = this.db.prepare(`
-            SELECT id, email, password_hash
+            SELECT id, email FROM users WHERE tenant_id = ? AND id = ? LIMIT 1
+        `).get(this.tenantId, consumed.userId);
+        if (!user?.id || !user.email) {
+            throw new TaskforceRuleError('User not found', 404, 'USER_NOT_FOUND');
+        }
+        if (this.identityService.hasAnyActiveIdentity(consumed.userId)) {
+            throw new TaskforceRuleError('Existing users must sign in before joining this workspace', 409, 'INVITE_SIGN_IN_REQUIRED');
+        }
+        const now = new Date().toISOString();
+        const identityId = this.identityService.linkProviderIdentity({
+            userId: consumed.userId,
+            provider: input.provider,
+            providerSubject: input.providerSubject,
+            providerEmail: input.providerEmail ?? null,
+            providerEmailVerified: input.providerEmailVerified ?? null,
+            displayNameSnapshot: input.displayNameSnapshot ?? null,
+            avatarUrlSnapshot: input.avatarUrlSnapshot ?? null,
+        });
+        // Mark email verified if the provider attested it
+        if (input.providerEmailVerified) {
+            this.db.prepare(`
+                UPDATE users
+                SET email_verified_at = COALESCE(email_verified_at, ?), is_disabled = 0, updated_at = ?
+                WHERE tenant_id = ? AND id = ?
+            `).run(now, now, this.tenantId, consumed.userId);
+        }
+        else {
+            this.db.prepare(`
+                UPDATE users SET is_disabled = 0, updated_at = ? WHERE tenant_id = ? AND id = ?
+            `).run(now, this.tenantId, consumed.userId);
+        }
+        this.ensureDefaultOnboardingEntitlement(consumed.userId, {
+            source: 'invite-accept',
+            updatedBy: 'invite-accept',
+            now
+        });
+        const activation = this.completeInviteWorkspaceActivation({
+            userId: consumed.userId,
+            workspaceId: inviteWorkspaceId
+        });
+        return { ...activation, identityId };
+    }
+    acceptInviteWithToken(input) {
+        const token = String(input.token || '').trim();
+        const password = String(input.password || '');
+        if (!token || !password) {
+            throw new TaskforceRuleError('Token and password are required', 400, 'TOKEN_PASSWORD_REQUIRED');
+        }
+        const inspected = this.inspectOneTimeAuthToken(token, 'invite_accept');
+        if (inspected.state !== 'valid' || !inspected.userId) {
+            if (inspected.state === 'expired') {
+                throw new TaskforceRuleError('Invite token expired', 400, 'INVITE_TOKEN_EXPIRED');
+            }
+            if (inspected.state === 'revoked') {
+                throw new TaskforceRuleError('Invite token revoked', 400, 'INVITE_TOKEN_REVOKED');
+            }
+            if (inspected.state === 'used') {
+                throw new TaskforceRuleError('Invite token already used', 400, 'INVITE_TOKEN_USED');
+            }
+            throw new TaskforceRuleError('Invalid invite token', 400, 'INVITE_TOKEN_INVALID');
+        }
+        const inviteWorkspaceId = String(inspected.workspaceId || '').trim();
+        if (!inviteWorkspaceId) {
+            throw new TaskforceRuleError('Invite token is missing workspace context', 400, 'INVITE_WORKSPACE_REQUIRED');
+        }
+        const user = this.db.prepare(`
+            SELECT id, email, display_name
             FROM users
             WHERE tenant_id = ? AND id = ?
             LIMIT 1
-        `).get(this.tenantId, consumed.userId);
+        `).get(this.tenantId, inspected.userId);
         if (!user?.id || !user.email) {
             throw new TaskforceRuleError('User not found', 404, 'USER_NOT_FOUND');
         }
-        if (String(user.password_hash || '').trim()) {
+        assertPasswordPolicy(password, {
+            email: user.email,
+            displayName: user.display_name || null
+        });
+        if (this.identityService.hasAnyActiveIdentity(inspected.userId)) {
             throw new TaskforceRuleError('Existing users must sign in before joining this workspace', 409, 'INVITE_SIGN_IN_REQUIRED');
         }
+        const consumed = this.consumeOneTimeAuthToken(token, 'invite_accept');
+        if (!consumed?.userId) {
+            throw new TaskforceRuleError('Invalid invite token', 400, 'INVITE_TOKEN_INVALID');
+        }
         const now = new Date().toISOString();
+        const identityId = this.identityService.setPasswordIdentity(consumed.userId, password);
         this.db.prepare(`
             UPDATE users
-            SET
-                password_hash = ?,
-                auth_provider = ?,
-                external_auth_id = ?,
-                email_verified_at = COALESCE(email_verified_at, ?),
-                is_disabled = 0,
-                updated_at = ?
+            SET email_verified_at = COALESCE(email_verified_at, ?), is_disabled = 0, updated_at = ?
             WHERE tenant_id = ? AND id = ?
-        `).run(hashPassword(password), 'password', user.email, now, now, this.tenantId, consumed.userId);
+        `).run(now, now, this.tenantId, consumed.userId);
         this.ensureDefaultOnboardingEntitlement(consumed.userId, {
             source: 'invite-accept',
             updatedBy: 'invite-accept',
             now
         });
-        return this.completeInviteWorkspaceActivation({
+        const activation = this.completeInviteWorkspaceActivation({
             userId: consumed.userId,
             workspaceId: inviteWorkspaceId
         });
+        return {
+            ...activation,
+            identityId
+        };
     }
     joinInviteWithAuthenticatedUser(input) {
         const token = String(input.token || '').trim();
@@ -5896,7 +7105,7 @@ export class TaskforceCore {
             }
             throw new TaskforceRuleError('Invalid invite token', 400, 'INVITE_TOKEN_INVALID');
         }
-        if (details.inviteeKind !== 'existing_user') {
+        if (details.inviteeState !== 'existing_account') {
             throw new TaskforceRuleError('This invite requires account setup before joining', 409, 'INVITE_PASSWORD_SETUP_REQUIRED');
         }
         if (details.userId !== authenticatedUserId) {
@@ -5930,32 +7139,31 @@ export class TaskforceCore {
         const workspaceId = String(input.workspaceId || 'default').trim() || 'default';
         if (!email || !password)
             return { ok: false, code: 'INVALID_CREDENTIALS' };
-        const row = this.db.prepare(`
-            SELECT id, password_hash, email_verified_at
-            FROM users
-            WHERE tenant_id = ? AND email = ?
-            LIMIT 1
-        `).get(this.tenantId, email);
-        if (!row?.id || !row.password_hash)
-            return { ok: false, code: 'INVALID_CREDENTIALS' };
-        if (!verifyPassword(password, row.password_hash))
+        const authResult = this.identityService.authenticatePasswordIdentity(email, password);
+        if (!authResult)
             return { ok: false, code: 'INVALID_CREDENTIALS' };
-        if (input.requireVerifiedEmail && !row.email_verified_at) {
-            return { ok: false, code: 'EMAIL_NOT_VERIFIED' };
+        if (input.requireVerifiedEmail) {
+            const userRow = this.db.prepare(`
+                SELECT email_verified_at FROM users WHERE tenant_id = ? AND id = ? LIMIT 1
+            `).get(this.tenantId, authResult.userId);
+            if (!userRow?.email_verified_at) {
+                return { ok: false, code: 'EMAIL_NOT_VERIFIED' };
+            }
         }
-        const resolvedWorkspaceId = this.resolvePreferredUserWorkspaceId(row.id, {
+        const resolvedWorkspaceId = this.resolvePreferredUserWorkspaceId(authResult.userId, {
             preferredWorkspaceId: workspaceId
         }) || workspaceId;
-        const access = this.resolveUserAccess(row.id, resolvedWorkspaceId, input.fallbackRole || 'member');
+        const access = this.resolveUserAccess(authResult.userId, resolvedWorkspaceId, input.fallbackRole || 'member');
         if (!access) {
             // Allow authenticated users without workspace memberships.
             // Provisioning flow will create/switch to a workspace after login.
             return {
                 ok: true,
                 access: {
-                    userId: row.id,
+                    userId: authResult.userId,
                     workspaceId: 'default',
-                    role: this.normalizeAccessRole(input.fallbackRole || 'member', 'member')
+                    role: this.normalizeAccessRole(input.fallbackRole || 'member', 'member'),
+                    identityId: authResult.identityId
                 }
             };
         }
@@ -5964,7 +7172,8 @@ export class TaskforceCore {
             access: {
                 userId: access.userId,
                 workspaceId: access.workspaceId,
-                role: access.role
+                role: access.role,
+                identityId: authResult.identityId
             }
         };
     }
@@ -6027,9 +7236,47 @@ export class TaskforceCore {
         const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
         return this.listTaskEventsInternal(taskId, normalizedWorkspaceId);
     }
+    taskExistsForSync(id, workspaceId) {
+        return this.taskExists(id, this.normalizeWorkspaceId(workspaceId || undefined));
+    }
+    initiativeExistsForSync(id, workspaceId) {
+        return this.initiativeExists(id, this.normalizeWorkspaceId(workspaceId || undefined));
+    }
+    workstreamExistsForSync(id, workspaceId) {
+        return this.workstreamExists(id, this.normalizeWorkspaceId(workspaceId || undefined));
+    }
+    recordTaskEvent(input) {
+        this.addTaskEvent({
+            taskId: input.taskId,
+            workspaceId: this.normalizeWorkspaceId(input.workspaceId || undefined),
+            action: input.action,
+            actor: input.actor || 'system',
+            createdAt: input.createdAt,
+            details: input.details,
+        });
+    }
     listTaskEventsForSync(input) {
         const normalizedWorkspaceId = this.normalizeWorkspaceId(input.workspaceId || undefined);
-        return listWorkspaceTaskEventsService(this.getTaskActivityServiceDeps(), normalizedWorkspaceId);
+        return listWorkspaceTaskEventsForSyncService(this.getTaskActivityServiceDeps(), normalizedWorkspaceId);
+    }
+    getTaskEventForSync(input) {
+        const normalizedWorkspaceId = this.normalizeWorkspaceId(input.workspaceId || undefined);
+        return getTaskEventForSyncService(this.getTaskActivityServiceDeps(), {
+            workspaceId: normalizedWorkspaceId,
+            taskId: input.taskId,
+            eventId: input.eventId,
+        });
+    }
+    listEntityEventsForSync(input) {
+        const normalizedWorkspaceId = this.normalizeWorkspaceId(input.workspaceId || undefined);
+        return listWorkspaceEntityEventsForSyncService(this.getTaskActivityServiceDeps(), normalizedWorkspaceId);
+    }
+    getEntityEventForSync(input) {
+        const normalizedWorkspaceId = this.normalizeWorkspaceId(input.workspaceId || undefined);
+        return getEntityEventForSyncService(this.getTaskActivityServiceDeps(), {
+            workspaceId: normalizedWorkspaceId,
+            eventId: input.eventId,
+        });
     }
     getScheduleBoard(weekKey, showWeekends = false, workspaceId) {
         const parsedWeek = this.parseIsoWeekKeyToDates(weekKey);
@@ -6293,6 +7540,16 @@ export class TaskforceCore {
                     workstreamId: task.workstreamId || null
                 }
             });
+            if (task.workstreamId) {
+                this.addWorkstreamTaskMembershipEvents({
+                    task,
+                    workspaceId: normalizedWorkspaceId,
+                    actor: options?.actorRef || createdBy || 'system',
+                    createdAt: task.updatedAt || task.createdAt,
+                    previousWorkstreamId: null,
+                    nextWorkstreamId: task.workstreamId,
+                });
+            }
         }
         if (persistBackup) {
             this.persistBackup();
@@ -6614,6 +7871,16 @@ export class TaskforceCore {
                         createdAt: nextTask.updatedAt,
                         details: { changes }
                     });
+                    if (changes.workstreamId) {
+                        this.addWorkstreamTaskMembershipEvents({
+                            task: nextTask,
+                            workspaceId: normalizedWorkspaceId,
+                            actor: options?.actorRef || 'system',
+                            createdAt: nextTask.updatedAt,
+                            previousWorkstreamId: existing.workstreamId || null,
+                            nextWorkstreamId: nextTask.workstreamId || null,
+                        });
+                    }
                 }
             }
             return this.getTask(taskId, normalizedWorkspaceId);
@@ -6633,7 +7900,11 @@ export class TaskforceCore {
     }
     addComment(id, text, author, workspaceId, options) {
         const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
-        const existing = this.db.prepare('SELECT id FROM tasks WHERE tenant_id = ? AND workspace_id = ? AND id = ?').get(this.tenantId, normalizedWorkspaceId, id);
+        const existing = this.db.prepare(`
+            SELECT id, updated_at, created_at
+            FROM tasks
+            WHERE tenant_id = ? AND workspace_id = ? AND id = ?
+        `).get(this.tenantId, normalizedWorkspaceId, id);
         if (!existing)
             return null;
         const submittedAuthor = String(author || '').trim() || 'user';
@@ -6658,7 +7929,13 @@ export class TaskforceCore {
             submitted_author: comment.submittedAuthor,
             timestamp: comment.timestamp
         });
-        this.db.prepare('UPDATE tasks SET updated_at = ? WHERE tenant_id = ? AND workspace_id = ? AND id = ?').run(comment.timestamp, this.tenantId, normalizedWorkspaceId, id);
+        const existingWatermark = String(existing.updated_at || existing.created_at || '').trim();
+        const existingWatermarkMs = Date.parse(existingWatermark);
+        const commentTimestampMs = Date.parse(comment.timestamp);
+        const nextTaskUpdatedAt = Number.isFinite(existingWatermarkMs) && existingWatermarkMs >= commentTimestampMs
+            ? new Date(existingWatermarkMs + 1).toISOString()
+            : comment.timestamp;
+        this.db.prepare('UPDATE tasks SET updated_at = ? WHERE tenant_id = ? AND workspace_id = ? AND id = ?').run(nextTaskUpdatedAt, this.tenantId, normalizedWorkspaceId, id);
         if (options?.skipTaskEvents !== true) {
             this.addTaskEvent({
                 taskId: id,