@taskforcehq/taskforce 0.3.326 → 0.3.328

package/dist/migrations/taskSchemaMigrations.js

@@ -1,3 +1,5 @@
+import { MIGRATION_COMPAT_ENABLED } from '../runtime/migrationFlags.js';
+import { backfillLegacyTaskforceAgentDefinitions } from './taskforceAgentDefinitionMigration.js';
 function hasTable(db, tableName) {
     if (db.provider === 'postgres') {
         const row = db.prepare(`
@@ -28,11 +30,11 @@ export function ensureTenantSchema(db) {
     if (!hasCommentTenantColumn) {
         db.exec(`ALTER TABLE comments ADD COLUMN tenant_id TEXT NOT NULL DEFAULT 'default'`);
     }
-    db.exec(`
+    db.transaction(() => db.exec(`
         CREATE INDEX IF NOT EXISTS idx_tasks_tenant ON tasks(tenant_id);
         CREATE INDEX IF NOT EXISTS idx_tasks_tenant_archived ON tasks(tenant_id, is_archived);
         CREATE INDEX IF NOT EXISTS idx_comments_tenant_task ON comments(tenant_id, task_id);
-    `);
+    `))();
 }
 export function ensureScheduleTaskSchema(db) {
     const columns = db.prepare(`PRAGMA table_info(tasks)`).all();
@@ -58,6 +60,16 @@ export function ensureScheduleTaskSchema(db) {
         CREATE INDEX IF NOT EXISTS idx_tasks_due_date ON tasks(due_date);
     `);
 }
+export function ensureWorkstreamTaskOrderSchema(db) {
+    const columns = db.prepare(`PRAGMA table_info(tasks)`).all();
+    if (!columns.some((column) => column.name === 'workstream_order')) {
+        db.exec(`ALTER TABLE tasks ADD COLUMN workstream_order INTEGER`);
+    }
+    db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_tasks_workstream_order
+        ON tasks(tenant_id, workspace_id, workstream_id, workstream_order)
+    `);
+}
 export function ensureAssigneeTaskSchema(db) {
     const columns = db.prepare(`PRAGMA table_info(tasks)`).all();
     const hasAssigneeColumn = columns.some((c) => c.name === 'assignee');
@@ -67,6 +79,41 @@ export function ensureAssigneeTaskSchema(db) {
     }
     db.exec(`CREATE INDEX IF NOT EXISTS idx_tasks_assignee ON tasks(assignee)`);
 }
+/** Permanently removes the retired task approach field from existing databases. */
+export function ensureTaskApproachRemoved(db) {
+    const columnNames = db.provider === 'postgres'
+        ? new Set(db.prepare(`
+            SELECT column_name AS name
+            FROM information_schema.columns
+            WHERE table_name = 'tasks'
+        `).all().map((column) => column.name))
+        : new Set(db.prepare(`PRAGMA table_info(tasks)`).all().map((column) => column.name));
+    if (!columnNames.has('approach'))
+        return;
+    if (columnNames.has('taxonomies')) {
+        const rows = db.prepare(`SELECT id, taxonomies FROM tasks`).all();
+        const updateTaxonomies = db.prepare(`UPDATE tasks SET taxonomies = ? WHERE id = ?`);
+        for (const row of rows) {
+            if (!row.taxonomies)
+                continue;
+            try {
+                const taxonomies = JSON.parse(row.taxonomies);
+                if (!Object.prototype.hasOwnProperty.call(taxonomies, 'approach'))
+                    continue;
+                delete taxonomies.approach;
+                updateTaxonomies.run(JSON.stringify(taxonomies), row.id);
+            }
+            catch {
+                // Preserve malformed legacy taxonomy payloads for separate data repair.
+            }
+        }
+    }
+    if (db.provider === 'postgres') {
+        db.exec(`ALTER TABLE tasks DROP COLUMN IF EXISTS approach`);
+        return;
+    }
+    db.exec(`ALTER TABLE tasks DROP COLUMN approach`);
+}
 export function ensureTaskReferenceSchema(db) {
     const columns = db.prepare(`PRAGMA table_info(tasks)`).all();
     const hasReferenceNumberColumn = columns.some((c) => c.name === 'reference_number');
@@ -156,6 +203,240 @@ export function ensureTaskReferenceSchema(db) {
         ON tasks(tenant_id, workspace_id, local_reference_number);
     `);
 }
+const PLANNING_REFERENCE_DOMAINS = [
+    {
+        domain: 'initiative',
+        tableName: 'initiatives',
+        sequenceTableName: 'workspace_initiative_reference_sequences',
+        uniqueIndexName: 'idx_initiatives_workspace_reference',
+    },
+    {
+        domain: 'workstream',
+        tableName: 'workstreams',
+        sequenceTableName: 'workspace_workstream_reference_sequences',
+        uniqueIndexName: 'idx_workstreams_workspace_reference',
+    },
+];
+/**
+ * Establishes one canonical planning reference per workspace before adding the
+ * database uniqueness constraint used by both ordinary and durable writes.
+ */
+export function ensurePlanningReferenceSchema(db) {
+    const repair = db.transaction(() => {
+        const hasDurableOutbox = db.provider === 'postgres'
+            ? Boolean(db.prepare(`SELECT to_regclass('workspace_sync_outbox') AS name`).get()?.name)
+            : Boolean(db.prepare(`
+                SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'workspace_sync_outbox'
+            `).get()?.name);
+        for (const domain of PLANNING_REFERENCE_DOMAINS) {
+            const workspaceRows = db.prepare(`
+                SELECT DISTINCT
+                    COALESCE(tenant_id, 'default') AS tenant_id,
+                    COALESCE(workspace_id, 'default') AS workspace_id
+                FROM ${domain.tableName}
+                ORDER BY tenant_id ASC, workspace_id ASC
+            `).all();
+            const selectEntities = db.prepare(`
+                SELECT id, reference_number
+                FROM ${domain.tableName}
+                WHERE tenant_id = ? AND workspace_id = ?
+                ORDER BY created_at ASC, id ASC
+            `);
+            const updateReference = db.prepare(`
+                UPDATE ${domain.tableName}
+                SET reference_number = ?
+                WHERE tenant_id = ? AND workspace_id = ? AND id = ?
+            `);
+            const upsertSequence = db.prepare(`
+                INSERT INTO ${domain.sequenceTableName} (tenant_id, workspace_id, next_reference_number)
+                VALUES (?, ?, ?)
+                ON CONFLICT (tenant_id, workspace_id) DO UPDATE SET
+                    next_reference_number = CASE
+                        WHEN ${domain.sequenceTableName}.next_reference_number < EXCLUDED.next_reference_number
+                            THEN EXCLUDED.next_reference_number
+                        ELSE ${domain.sequenceTableName}.next_reference_number
+                    END
+            `);
+            for (const workspaceRow of workspaceRows) {
+                const tenantId = String(workspaceRow.tenant_id || 'default').trim() || 'default';
+                const workspaceId = String(workspaceRow.workspace_id || 'default').trim() || 'default';
+                const entities = selectEntities.all(tenantId, workspaceId);
+                let provisionalIds = new Set();
+                if (hasDurableOutbox) {
+                    const rows = db.prepare(`
+                        SELECT entity_id
+                        FROM workspace_sync_outbox
+                        WHERE tenant_id = ? AND workspace_id = ?
+                          AND domain = ? AND mutation_kind = 'create'
+                          AND status IN ('pending', 'in_flight', 'blocked')
+                    `).all(tenantId, workspaceId, domain.domain);
+                    provisionalIds = new Set(rows.map((row) => String(row.entity_id || '').trim()).filter(Boolean));
+                }
+                const seen = new Set();
+                let maxReferenceNumber = 0;
+                const needsReference = [];
+                for (const entity of entities) {
+                    const id = String(entity.id || '').trim();
+                    if (!id)
+                        continue;
+                    if (provisionalIds.has(id)) {
+                        if (entity.reference_number != null) {
+                            updateReference.run(null, tenantId, workspaceId, id);
+                        }
+                        continue;
+                    }
+                    const numericReference = Number(entity.reference_number);
+                    const referenceNumber = Number.isInteger(numericReference) && numericReference > 0
+                        ? numericReference
+                        : null;
+                    if (referenceNumber && !seen.has(referenceNumber)) {
+                        seen.add(referenceNumber);
+                        maxReferenceNumber = Math.max(maxReferenceNumber, referenceNumber);
+                    }
+                    else {
+                        needsReference.push(id);
+                    }
+                }
+                for (const id of needsReference) {
+                    maxReferenceNumber += 1;
+                    updateReference.run(maxReferenceNumber, tenantId, workspaceId, id);
+                }
+                upsertSequence.run(tenantId, workspaceId, maxReferenceNumber);
+            }
+            db.exec(`
+                CREATE UNIQUE INDEX IF NOT EXISTS ${domain.uniqueIndexName}
+                ON ${domain.tableName}(tenant_id, workspace_id, reference_number)
+            `);
+        }
+    });
+    repair();
+}
+const CANONICAL_DOCUMENT_CONTENT_PATH = /^\/api\/taskforce\/documents\/([^/?#]+)\/content$/;
+function inferPlanningAttachmentAssetId(pathValue) {
+    if (typeof pathValue !== 'string')
+        return null;
+    const encodedAssetId = pathValue.trim().match(CANONICAL_DOCUMENT_CONTENT_PATH)?.[1];
+    if (!encodedAssetId)
+        return null;
+    try {
+        const assetId = decodeURIComponent(encodedAssetId);
+        return assetId && assetId === assetId.trim() ? assetId : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Repairs the physical planning JSON representation after legacy v2 writers
+ * omitted assetId even though the exact document content path and canonical
+ * workspace asset link already identified the attachment. This is an
+ * idempotent invariant repair rather than a journaled product mutation: the
+ * normalized planning model already exposed the same canonical identity.
+ */
+export function backfillPlanningAttachmentAssetIdentities(db, tenantId = 'default') {
+    const normalizedTenantId = String(tenantId || '').trim() || 'default';
+    const result = {
+        scannedAttachments: 0,
+        backfilledAttachments: 0,
+        updatedRows: 0,
+    };
+    const hasRequiredTables = ['initiatives', 'workstreams', 'workspace_assets', 'workspace_asset_links', 'system_settings']
+        .every((tableName) => hasTable(db, tableName));
+    if (!hasRequiredTables)
+        return result;
+    const verifyIdentity = db.prepare(`
+        SELECT 1 AS found
+        FROM workspace_assets a
+        INNER JOIN workspace_asset_links l
+            ON l.tenant_id = a.tenant_id
+           AND l.workspace_id = a.workspace_id
+           AND l.asset_id = a.asset_id
+        WHERE a.tenant_id = ? AND a.workspace_id = ? AND a.asset_id = ?
+          AND a.kind = 'document' AND a.deleted_at IS NULL
+          AND l.target_type = ? AND l.task_id = ? AND l.deleted_at IS NULL
+        LIMIT 1
+    `);
+    const upsertMigrationState = db.prepare(`
+        INSERT INTO system_settings (tenant_id, settings_key, payload, updated_at)
+        VALUES (?, 'migration.planning_attachment_asset_identity.v1', ?, ?)
+        ON CONFLICT (tenant_id, settings_key) DO UPDATE SET
+            payload = EXCLUDED.payload,
+            updated_at = EXCLUDED.updated_at
+    `);
+    const existingMigrationState = db.prepare(`
+        SELECT 1 AS found
+        FROM system_settings
+        WHERE tenant_id = ? AND settings_key = 'migration.planning_attachment_asset_identity.v1'
+        LIMIT 1
+    `).get(normalizedTenantId);
+    const repair = db.transaction(() => {
+        for (const domain of PLANNING_REFERENCE_DOMAINS) {
+            const rows = db.prepare(`
+                SELECT id, workspace_id, attachments_json
+                FROM ${domain.tableName}
+                WHERE tenant_id = ? AND attachments_json IS NOT NULL
+                ORDER BY workspace_id ASC, id ASC
+            `).all(normalizedTenantId);
+            const updateRow = db.prepare(`
+                UPDATE ${domain.tableName}
+                SET attachments_json = ?
+                WHERE tenant_id = ? AND workspace_id = ? AND id = ? AND attachments_json = ?
+            `);
+            for (const row of rows) {
+                const entityId = String(row.id || '').trim();
+                const workspaceId = String(row.workspace_id || '').trim();
+                if (!entityId || !workspaceId)
+                    continue;
+                const sourceAttachmentsJson = String(row.attachments_json || '[]');
+                let attachments;
+                try {
+                    attachments = JSON.parse(sourceAttachmentsJson);
+                }
+                catch {
+                    continue;
+                }
+                if (!Array.isArray(attachments))
+                    continue;
+                let changed = false;
+                const repaired = attachments.map((attachment) => {
+                    if (!attachment || typeof attachment !== 'object' || Array.isArray(attachment))
+                        return attachment;
+                    result.scannedAttachments += 1;
+                    const record = attachment;
+                    if (typeof record.assetId === 'string' && record.assetId.trim())
+                        return attachment;
+                    const assetId = inferPlanningAttachmentAssetId(record.path);
+                    if (!assetId)
+                        return attachment;
+                    const canonicalIdentity = verifyIdentity.get(normalizedTenantId, workspaceId, assetId, domain.domain, entityId);
+                    if (!canonicalIdentity?.found) {
+                        throw new Error(`Cannot backfill ${domain.domain} attachment ${entityId}: canonical asset/link identity is missing for ${assetId}.`);
+                    }
+                    changed = true;
+                    result.backfilledAttachments += 1;
+                    return { ...record, assetId };
+                });
+                if (!changed)
+                    continue;
+                const updateResult = updateRow.run(JSON.stringify(repaired), normalizedTenantId, workspaceId, entityId, sourceAttachmentsJson);
+                if (Number(updateResult?.changes || 0) !== 1) {
+                    throw new Error(`Cannot backfill ${domain.domain} attachment ${entityId}: attachments changed during migration.`);
+                }
+                result.updatedRows += 1;
+            }
+        }
+        if (result.backfilledAttachments > 0 || !existingMigrationState?.found) {
+            const now = new Date().toISOString();
+            upsertMigrationState.run(normalizedTenantId, JSON.stringify({
+                completedAt: now,
+                backfilledAttachments: result.backfilledAttachments,
+                updatedRows: result.updatedRows,
+            }), now);
+        }
+    });
+    repair();
+    return result;
+}
 export function ensureWorkspaceSchema(db) {
     db.exec(`
         CREATE TABLE IF NOT EXISTS workspaces (
@@ -877,6 +1158,24 @@ export function ensureWorkspaceAssetsSchema(db) {
         ON workspace_asset_links(tenant_id, workspace_id, task_id, deleted_at, updated_at);
         CREATE INDEX IF NOT EXISTS idx_workspace_asset_links_asset
         ON workspace_asset_links(tenant_id, workspace_id, asset_id, deleted_at, updated_at);
+        CREATE INDEX IF NOT EXISTS idx_workspace_asset_links_workspace_updated
+        ON workspace_asset_links(tenant_id, workspace_id, updated_at, asset_id);
+
+        CREATE TABLE IF NOT EXISTS workspace_asset_upload_drafts (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL,
+            draft_id TEXT NOT NULL,
+            asset_id TEXT NOT NULL,
+            storage_key TEXT NOT NULL,
+            purpose TEXT NOT NULL,
+            created_by_user_id TEXT NOT NULL,
+            created_at TEXT NOT NULL,
+            retired_at TEXT,
+            PRIMARY KEY (tenant_id, workspace_id, draft_id, asset_id)
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_workspace_asset_upload_drafts_expiry
+        ON workspace_asset_upload_drafts(tenant_id, workspace_id, retired_at, created_at);
     `);
     const linkColumns = db.prepare(`PRAGMA table_info(workspace_asset_links)`).all();
     const hasDisplayNameColumn = linkColumns.some((c) => c.name === 'display_name');
@@ -991,97 +1290,1617 @@ export function ensureSyncEventsSchema(db) {
             error_message TEXT,
             change_count INTEGER,
             request_ms INTEGER,
+            details_json TEXT,
             occurred_at TEXT NOT NULL
         );
         CREATE INDEX IF NOT EXISTS idx_sync_events_workspace_occurred
         ON sync_events(tenant_id, workspace_id, occurred_at);
     `);
+    try {
+        db.prepare(`SELECT details_json FROM sync_events LIMIT 1`).get();
+    }
+    catch {
+        db.exec(`ALTER TABLE sync_events ADD COLUMN details_json TEXT`);
+    }
 }
-export function ensureWorkspaceDocumentsSchema(db) {
-    db.exec(`
-        CREATE TABLE IF NOT EXISTS workspace_documents (
+/**
+ * Creates the durable storage contract for the next workspace sync protocol.
+ *
+ * This migration intentionally does not route mutations through the journal or
+ * outbox. Keeping schema installation behavior-neutral lets both runtimes ship
+ * and verify the persistence contract before any sync path depends on it.
+ */
+export function buildWorkspaceSyncDurabilitySchemaSql(provider) {
+    const revisionType = provider === 'postgres' ? 'BIGINT' : 'INTEGER';
+    return `
+        CREATE TABLE IF NOT EXISTS workspace_sync_installation (
+            installation_key TEXT PRIMARY KEY,
+            client_id TEXT NOT NULL UNIQUE,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL
+        );
+
+        CREATE TABLE IF NOT EXISTS workspace_sync_sequences (
             tenant_id TEXT NOT NULL DEFAULT 'default',
             workspace_id TEXT NOT NULL DEFAULT 'default',
-            path TEXT NOT NULL,
-            content_hash TEXT NOT NULL,
+            last_sequence ${revisionType} NOT NULL DEFAULT 0,
             updated_at TEXT NOT NULL,
-            PRIMARY KEY (tenant_id, workspace_id, path)
+            PRIMARY KEY (tenant_id, workspace_id)
         );
-        CREATE INDEX IF NOT EXISTS idx_workspace_documents_workspace_path
-        ON workspace_documents(tenant_id, workspace_id, path);
-    `);
-}
-export function ensureAnnotatedAttachmentSessionsSchema(db) {
-    db.exec(`
-        CREATE TABLE IF NOT EXISTS annotated_attachment_sessions (
-            id TEXT PRIMARY KEY,
+
+        CREATE TABLE IF NOT EXISTS workspace_sync_outbox_sequences (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            last_sequence ${revisionType} NOT NULL DEFAULT 0,
+            updated_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, workspace_id)
+        );
+
+        CREATE TABLE IF NOT EXISTS workspace_sync_domain_locks (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            domain TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, workspace_id, domain)
+        );
+
+        CREATE TABLE IF NOT EXISTS workspace_sync_task_create_guards (
             tenant_id TEXT NOT NULL DEFAULT 'default',
             workspace_id TEXT NOT NULL DEFAULT 'default',
             task_id TEXT NOT NULL,
-            base_image_asset_id TEXT NOT NULL,
-            title TEXT,
-            global_instruction TEXT,
-            annotations_json TEXT NOT NULL DEFAULT '[]',
-            created_by_actor_id TEXT,
-            updated_by_actor_id TEXT,
             created_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, workspace_id, task_id)
+        );
+
+        CREATE TABLE IF NOT EXISTS workspace_sync_entity_revisions (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            domain TEXT NOT NULL,
+            entity_id TEXT NOT NULL,
+            contract_version INTEGER NOT NULL DEFAULT 3,
+            entity_revision ${revisionType} NOT NULL DEFAULT 0,
+            lifecycle_revision ${revisionType} NOT NULL DEFAULT 0,
+            coexistence_owned INTEGER NOT NULL DEFAULT 1,
+            metadata_owned INTEGER NOT NULL DEFAULT 0,
+            reopen_assignee_owned INTEGER NOT NULL DEFAULT 0,
+            last_sequence ${revisionType} NOT NULL,
+            canonical_fingerprint TEXT NOT NULL,
             updated_at TEXT NOT NULL,
-            deleted_at TEXT
+            PRIMARY KEY (tenant_id, workspace_id, domain, entity_id)
         );
 
-        CREATE INDEX IF NOT EXISTS idx_annotated_attachment_sessions_task
-        ON annotated_attachment_sessions(tenant_id, workspace_id, task_id, deleted_at, updated_at);
-        CREATE INDEX IF NOT EXISTS idx_annotated_attachment_sessions_image
-        ON annotated_attachment_sessions(tenant_id, workspace_id, base_image_asset_id, deleted_at, updated_at);
-    `);
-}
-export function ensureDocumentReviewSessionsSchema(db) {
-    db.exec(`
-        CREATE TABLE IF NOT EXISTS document_review_sessions (
-            id TEXT PRIMARY KEY,
+        CREATE TABLE IF NOT EXISTS workspace_sync_journal (
             tenant_id TEXT NOT NULL DEFAULT 'default',
             workspace_id TEXT NOT NULL DEFAULT 'default',
-            asset_id TEXT NOT NULL,
-            document_id TEXT,
-            document_version INTEGER,
-            title TEXT,
-            status TEXT NOT NULL DEFAULT 'open',
-            comments_json TEXT NOT NULL DEFAULT '[]',
-            created_by_actor_id TEXT,
-            updated_by_actor_id TEXT,
+            sequence ${revisionType} NOT NULL,
+            contract_version INTEGER NOT NULL DEFAULT 3,
+            operation_id TEXT NOT NULL,
+            client_id TEXT NOT NULL,
+            domain TEXT NOT NULL,
+            entity_id TEXT NOT NULL,
+            mutation_kind TEXT NOT NULL,
+            entity_revision ${revisionType} NOT NULL,
+            lifecycle_revision ${revisionType} NOT NULL,
+            content_sha256 TEXT,
+            size_bytes ${revisionType},
+            payload_json TEXT NOT NULL,
+            occurred_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, workspace_id, sequence)
+        );
+
+        CREATE TABLE IF NOT EXISTS workspace_sync_operation_results (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            client_id TEXT NOT NULL,
+            operation_id TEXT NOT NULL,
+            contract_version INTEGER NOT NULL DEFAULT 3,
+            request_fingerprint TEXT NOT NULL,
+            status TEXT NOT NULL DEFAULT 'processing',
+            response_json TEXT,
+            accepted_sequence ${revisionType},
+            lease_owner TEXT,
+            lease_expires_at TEXT,
             created_at TEXT NOT NULL,
             updated_at TEXT NOT NULL,
-            deleted_at TEXT
+            expires_at TEXT,
+            PRIMARY KEY (tenant_id, workspace_id, client_id, operation_id)
         );
 
-        CREATE INDEX IF NOT EXISTS idx_document_review_sessions_asset
-        ON document_review_sessions(tenant_id, workspace_id, asset_id, deleted_at, updated_at);
-        CREATE INDEX IF NOT EXISTS idx_document_review_sessions_workspace
-        ON document_review_sessions(tenant_id, workspace_id, updated_at, id);
+        CREATE TABLE IF NOT EXISTS workspace_sync_outbox (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            operation_id TEXT NOT NULL,
+            contract_version INTEGER NOT NULL DEFAULT 3,
+            client_id TEXT NOT NULL,
+            dispatch_class TEXT NOT NULL DEFAULT 'ordinary',
+            domain TEXT NOT NULL,
+            entity_id TEXT NOT NULL,
+            mutation_kind TEXT NOT NULL,
+            owns_task_metadata INTEGER NOT NULL DEFAULT 0,
+            owns_task_lifecycle INTEGER NOT NULL DEFAULT 0,
+            owns_task_assignee INTEGER NOT NULL DEFAULT 0,
+            base_entity_revision ${revisionType} NOT NULL DEFAULT 0,
+            base_lifecycle_revision ${revisionType} NOT NULL DEFAULT 0,
+            payload_json TEXT NOT NULL,
+            payload_fingerprint TEXT NOT NULL,
+            status TEXT NOT NULL DEFAULT 'pending',
+            attempt_count INTEGER NOT NULL DEFAULT 0,
+            initial_not_found_attempt_count INTEGER NOT NULL DEFAULT 0,
+            enqueue_sequence ${revisionType} NOT NULL DEFAULT 0,
+            rebase_before_first_attempt INTEGER NOT NULL DEFAULT 0,
+            origin_assertion_recovery_count INTEGER NOT NULL DEFAULT 0,
+            accepted_replay_recovery_count INTEGER NOT NULL DEFAULT 0,
+            task_attachment_reference_metadata_recovery_count INTEGER NOT NULL DEFAULT 0,
+            task_status_revision_rebase_count INTEGER NOT NULL DEFAULT 0,
+            task_status_workflow_ack_recovery_count INTEGER NOT NULL DEFAULT 0,
+            workstream_metadata_revision_rebase_count INTEGER NOT NULL DEFAULT 0,
+            initiative_metadata_revision_rebase_count INTEGER NOT NULL DEFAULT 0,
+            next_attempt_at TEXT NOT NULL,
+            lease_owner TEXT,
+            lease_expires_at TEXT,
+            authoritative_response_json TEXT,
+            accepted_sequence ${revisionType},
+            last_error_code TEXT,
+            last_error_message TEXT,
+            recovery_batch_id TEXT,
+            replay_of_client_id TEXT,
+            replay_of_operation_id TEXT,
+            superseded_at TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, workspace_id, client_id, operation_id)
+        );
 
-        CREATE TABLE IF NOT EXISTS document_review_comments (
-            id TEXT PRIMARY KEY,
-            session_id TEXT NOT NULL,
+        CREATE TABLE IF NOT EXISTS workspace_sync_outbox_recoveries (
             tenant_id TEXT NOT NULL DEFAULT 'default',
             workspace_id TEXT NOT NULL DEFAULT 'default',
-            body TEXT NOT NULL,
-            anchor_json TEXT,
-            author_actor_id TEXT,
-            order_index INTEGER NOT NULL DEFAULT 0,
+            recovery_batch_id TEXT NOT NULL,
+            root_client_id TEXT NOT NULL,
+            root_operation_id TEXT NOT NULL,
+            state TEXT NOT NULL,
+            baseline_marker TEXT,
+            baseline_applied_at TEXT,
+            replay_queued_at TEXT,
+            completed_at TEXT,
             created_at TEXT NOT NULL,
             updated_at TEXT NOT NULL,
-            deleted_at TEXT
+            PRIMARY KEY (tenant_id, workspace_id, recovery_batch_id)
         );
 
-        CREATE INDEX IF NOT EXISTS idx_document_review_comments_session
-        ON document_review_comments(tenant_id, workspace_id, session_id, deleted_at, order_index, created_at, id);
-        CREATE INDEX IF NOT EXISTS idx_document_review_comments_workspace
-        ON document_review_comments(tenant_id, workspace_id, updated_at, id);
+        CREATE TABLE IF NOT EXISTS workspace_sync_outbox_targets (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            client_id TEXT NOT NULL,
+            operation_id TEXT NOT NULL,
+            domain TEXT NOT NULL,
+            entity_id TEXT NOT NULL,
+            mutation_kind TEXT NOT NULL,
+            base_entity_revision ${revisionType} NOT NULL DEFAULT 0,
+            base_lifecycle_revision ${revisionType} NOT NULL DEFAULT 0,
+            owns_task_metadata INTEGER NOT NULL DEFAULT 0,
+            owns_task_lifecycle INTEGER NOT NULL DEFAULT 0,
+            owns_task_assignee INTEGER NOT NULL DEFAULT 0,
+            created_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, workspace_id, client_id, operation_id, domain, entity_id)
+        );
+
+        CREATE TABLE IF NOT EXISTS workspace_sync_task_taxonomy_ownership (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            task_id TEXT NOT NULL,
+            created_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, workspace_id, task_id)
+        );
+
+        CREATE TABLE IF NOT EXISTS workspace_sync_projection_state (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            projection_id TEXT NOT NULL,
+            contract_version INTEGER NOT NULL DEFAULT 3,
+            owner_mode TEXT NOT NULL DEFAULT 'v2',
+            epoch ${revisionType} NOT NULL DEFAULT 0,
+            coverage_profile_id TEXT,
+            coverage_version INTEGER,
+            coverage_digest TEXT,
+            opaque_cursor TEXT,
+            cycle_high_watermark ${revisionType},
+            last_scanned_sequence ${revisionType},
+            repair_snapshot_id TEXT,
+            repair_expires_at TEXT,
+            repair_snapshot_sequence ${revisionType},
+            repair_epoch ${revisionType},
+            repair_resume_cursor TEXT,
+            repair_cursor TEXT,
+            applied_snapshot_id TEXT,
+            applied_page_digest TEXT,
+            updated_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, workspace_id, projection_id)
+        );
+
+        CREATE TABLE IF NOT EXISTS workspace_sync_projection_repair_entries (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            projection_id TEXT NOT NULL,
+            epoch ${revisionType} NOT NULL,
+            entity_id TEXT NOT NULL,
+            sequence ${revisionType} NOT NULL,
+            mutation_kind TEXT NOT NULL,
+            entity_revision ${revisionType} NOT NULL,
+            lifecycle_revision ${revisionType} NOT NULL,
+            payload_fingerprint TEXT NOT NULL,
+            payload_json TEXT NOT NULL,
+            occurred_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, workspace_id, projection_id, epoch, entity_id)
+        );
+
+        CREATE TABLE IF NOT EXISTS workspace_sync_coverage_repair_entries (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            coverage_id TEXT NOT NULL,
+            epoch ${revisionType} NOT NULL,
+            entry_index INTEGER NOT NULL,
+            projection_id TEXT NOT NULL,
+            domain TEXT NOT NULL,
+            entity_id TEXT NOT NULL,
+            sequence ${revisionType} NOT NULL,
+            mutation_kind TEXT NOT NULL,
+            entity_revision ${revisionType} NOT NULL,
+            lifecycle_revision ${revisionType} NOT NULL,
+            canonical_fingerprint TEXT,
+            payload_fingerprint TEXT NOT NULL,
+            payload_json TEXT NOT NULL,
+            occurred_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, workspace_id, coverage_id, epoch, entry_index)
+        );
+
+        CREATE TABLE IF NOT EXISTS workspace_sync_repair_snapshots (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            snapshot_id TEXT NOT NULL,
+            contract_version INTEGER NOT NULL DEFAULT 3,
+            coverage_profile_id TEXT NOT NULL,
+            coverage_version INTEGER NOT NULL,
+            coverage_digest TEXT NOT NULL,
+            snapshot_sequence ${revisionType} NOT NULL,
+            entry_count INTEGER NOT NULL,
+            created_at TEXT NOT NULL,
+            expires_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, workspace_id, snapshot_id)
+        );
+
+        CREATE TABLE IF NOT EXISTS workspace_sync_repair_snapshot_entries (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            snapshot_id TEXT NOT NULL,
+            entry_index INTEGER NOT NULL,
+            projection_id TEXT NOT NULL,
+            domain TEXT NOT NULL,
+            entity_id TEXT NOT NULL,
+            sequence ${revisionType} NOT NULL,
+            mutation_kind TEXT NOT NULL,
+            entity_revision ${revisionType} NOT NULL,
+            lifecycle_revision ${revisionType} NOT NULL,
+            canonical_fingerprint TEXT,
+            payload_fingerprint TEXT NOT NULL,
+            payload_json TEXT NOT NULL,
+            occurred_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, workspace_id, snapshot_id, entry_index)
+        );
+
+        CREATE TABLE IF NOT EXISTS workspace_sync_content_versions (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            version_id TEXT NOT NULL,
+            kind TEXT NOT NULL CHECK (kind IN ('document', 'asset')),
+            logical_path TEXT NOT NULL,
+            storage_provider TEXT NOT NULL CHECK (storage_provider IN ('local', 'r2')),
+            physical_key TEXT NOT NULL,
+            content_sha256 TEXT NOT NULL,
+            size_bytes ${revisionType} NOT NULL,
+            mime_type TEXT NOT NULL,
+            state TEXT NOT NULL CHECK (state IN ('preparing', 'ready', 'published', 'retired', 'deleting', 'deleted')),
+            created_at TEXT NOT NULL,
+            ready_at TEXT,
+            published_at TEXT,
+            retired_at TEXT,
+            gc_after TEXT,
+            deleted_at TEXT,
+            gc_attempt_count INTEGER NOT NULL DEFAULT 0,
+            gc_next_attempt_at TEXT,
+            gc_last_error TEXT,
+            preparation_token TEXT,
+            preparation_lease_until TEXT,
+            storage_generation INTEGER NOT NULL DEFAULT 0,
+            gc_claim_token TEXT,
+            gc_claim_lease_until TEXT,
+            gc_completed_claim_token TEXT,
+            gc_quarantine_sweep_required INTEGER NOT NULL DEFAULT 0,
+            gc_final_sweep_after TEXT,
+            PRIMARY KEY (tenant_id, workspace_id, version_id)
+        );
+
+        CREATE TABLE IF NOT EXISTS workspace_sync_content_heads (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            kind TEXT NOT NULL CHECK (kind IN ('document', 'asset')),
+            logical_path TEXT NOT NULL,
+            version_id TEXT,
+            source_updated_at TEXT NOT NULL,
+            content_sha256 TEXT,
+            size_bytes ${revisionType},
+            published_at TEXT NOT NULL,
+            deleted_at TEXT,
+            PRIMARY KEY (tenant_id, workspace_id, kind, logical_path)
+        );
+
+        CREATE TABLE IF NOT EXISTS workspace_sync_content_preparation_attempts (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            version_id TEXT NOT NULL,
+            preparation_token TEXT NOT NULL,
+            storage_provider TEXT NOT NULL CHECK (storage_provider IN ('local', 'r2')),
+            physical_key TEXT NOT NULL,
+            storage_generation INTEGER NOT NULL,
+            state TEXT NOT NULL CHECK (state IN ('preparing', 'current', 'cleanup_pending', 'deleting', 'deleted')),
+            created_at TEXT NOT NULL,
+            promoted_at TEXT,
+            available_after TEXT NOT NULL,
+            deleted_at TEXT,
+            gc_attempt_count INTEGER NOT NULL DEFAULT 0,
+            gc_next_attempt_at TEXT,
+            gc_last_error TEXT,
+            gc_claim_token TEXT,
+            gc_claim_lease_until TEXT,
+            gc_completed_claim_token TEXT,
+            PRIMARY KEY (tenant_id, workspace_id, version_id, preparation_token)
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_entity_revisions_sequence
+        ON workspace_sync_entity_revisions(tenant_id, workspace_id, last_sequence);
+
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_journal_entity
+        ON workspace_sync_journal(tenant_id, workspace_id, domain, entity_id, sequence);
+
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_journal_operation
+        ON workspace_sync_journal(tenant_id, workspace_id, client_id, operation_id);
+
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_operation_results_updated
+        ON workspace_sync_operation_results(tenant_id, workspace_id, updated_at);
+
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_outbox_dispatch
+        ON workspace_sync_outbox(tenant_id, workspace_id, status, next_attempt_at, created_at);
+
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_outbox_entity
+        ON workspace_sync_outbox(tenant_id, workspace_id, domain, entity_id, created_at);
+
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_outbox_targets_entity
+        ON workspace_sync_outbox_targets(tenant_id, workspace_id, domain, entity_id);
+
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_projection_repair_page
+        ON workspace_sync_projection_repair_entries(tenant_id, workspace_id, projection_id, epoch, entity_id);
+
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_workspace_sync_coverage_repair_entity
+        ON workspace_sync_coverage_repair_entries(
+            tenant_id, workspace_id, coverage_id, epoch, projection_id, domain, entity_id
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_repair_snapshots_expiry
+        ON workspace_sync_repair_snapshots(tenant_id, workspace_id, expires_at);
+
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_repair_snapshots_created
+        ON workspace_sync_repair_snapshots(tenant_id, workspace_id, created_at);
+
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_repair_snapshot_entries_entity
+        ON workspace_sync_repair_snapshot_entries(
+            tenant_id, workspace_id, snapshot_id, domain, entity_id
+        );
+
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_workspace_sync_content_versions_physical
+        ON workspace_sync_content_versions(tenant_id, workspace_id, storage_provider, physical_key);
+
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_content_versions_state
+        ON workspace_sync_content_versions(tenant_id, workspace_id, state, created_at);
+
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_content_versions_gc
+        ON workspace_sync_content_versions(
+            tenant_id, workspace_id, state, gc_after, gc_next_attempt_at, version_id
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_content_heads_version
+        ON workspace_sync_content_heads(tenant_id, workspace_id, version_id);
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_content_heads_source_updated
+        ON workspace_sync_content_heads(tenant_id, workspace_id, source_updated_at, logical_path);
+
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_workspace_sync_content_preparation_attempts_physical
+        ON workspace_sync_content_preparation_attempts(
+            tenant_id, workspace_id, storage_provider, physical_key
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_content_preparation_attempts_gc
+        ON workspace_sync_content_preparation_attempts(
+            tenant_id, workspace_id, state, available_after, gc_next_attempt_at
+        );
+
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_workspace_sync_content_preparation_attempts_current
+        ON workspace_sync_content_preparation_attempts(tenant_id, workspace_id, version_id)
+        WHERE state = 'current';
+
+    `;
+}
+export function ensureWorkspaceSyncDurabilitySchema(db) {
+    db.exec(buildWorkspaceSyncDurabilitySchemaSql(db.provider));
+    if (db.provider === 'sqlite' && hasTable(db, 'tasks')) {
+        db.exec(`
+            CREATE TRIGGER IF NOT EXISTS trg_tasks_v3_create_fence
+            BEFORE INSERT ON tasks
+            WHEN EXISTS (
+                SELECT 1
+                FROM workspace_sync_projection_state
+                WHERE tenant_id = NEW.tenant_id
+                  AND workspace_id = NEW.workspace_id
+                  AND projection_id = 'coverage/task-planning-metadata-v1'
+                  AND owner_mode = 'v3'
+            )
+            AND NOT EXISTS (
+                SELECT 1
+                FROM workspace_sync_task_create_guards
+                WHERE tenant_id = NEW.tenant_id
+                  AND workspace_id = NEW.workspace_id
+                  AND task_id = NEW.id
+            )
+            BEGIN
+                SELECT RAISE(ABORT, 'TASK_DURABLE_SYNC_REQUIRED');
+            END;
+        `);
+    }
+    const coverageRepairColumns = db.prepare(`PRAGMA table_info(workspace_sync_coverage_repair_entries)`).all();
+    if (!coverageRepairColumns.some((column) => column.name === 'canonical_fingerprint')) {
+        db.exec(`ALTER TABLE workspace_sync_coverage_repair_entries ADD COLUMN canonical_fingerprint TEXT`);
+    }
+    const repairSnapshotEntryColumns = db.prepare(`PRAGMA table_info(workspace_sync_repair_snapshot_entries)`).all();
+    if (!repairSnapshotEntryColumns.some((column) => column.name === 'canonical_fingerprint')) {
+        db.exec(`ALTER TABLE workspace_sync_repair_snapshot_entries ADD COLUMN canonical_fingerprint TEXT`);
+    }
+    const contentVersionColumns = db.prepare(`PRAGMA table_info(workspace_sync_content_versions)`).all();
+    if (!contentVersionColumns.some((column) => column.name === 'gc_claim_token')) {
+        db.exec(`ALTER TABLE workspace_sync_content_versions ADD COLUMN gc_claim_token TEXT`);
+    }
+    if (!contentVersionColumns.some((column) => column.name === 'gc_claim_lease_until')) {
+        db.exec(`ALTER TABLE workspace_sync_content_versions ADD COLUMN gc_claim_lease_until TEXT`);
+    }
+    if (!contentVersionColumns.some((column) => column.name === 'storage_generation')) {
+        db.exec(`ALTER TABLE workspace_sync_content_versions ADD COLUMN storage_generation INTEGER NOT NULL DEFAULT 0`);
+    }
+    if (!contentVersionColumns.some((column) => column.name === 'gc_completed_claim_token')) {
+        db.exec(`ALTER TABLE workspace_sync_content_versions ADD COLUMN gc_completed_claim_token TEXT`);
+    }
+    if (!contentVersionColumns.some((column) => column.name === 'gc_quarantine_sweep_required')) {
+        db.exec(`ALTER TABLE workspace_sync_content_versions ADD COLUMN gc_quarantine_sweep_required INTEGER NOT NULL DEFAULT 0`);
+    }
+    if (!contentVersionColumns.some((column) => column.name === 'gc_final_sweep_after')) {
+        db.exec(`ALTER TABLE workspace_sync_content_versions ADD COLUMN gc_final_sweep_after TEXT`);
+    }
+    const outboxColumns = db.prepare(`PRAGMA table_info(workspace_sync_outbox)`).all();
+    if (!outboxColumns.some((column) => column.name === 'dispatch_class')) {
+        db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN dispatch_class TEXT NOT NULL DEFAULT 'ordinary'`);
+    }
+    db.exec(db.provider === 'postgres' ? `
+        UPDATE workspace_sync_outbox
+        SET dispatch_class = 'legacy-adoption'
+        WHERE dispatch_class = 'ordinary'
+          AND status IN ('pending', 'in_flight', 'blocked')
+          AND (
+            (
+              domain = 'task'
+              AND mutation_kind = 'create'
+              AND jsonb_typeof(payload_json::jsonb -> 'adoptedRoot') = 'object'
+              AND payload_json::jsonb -> 'adoptedRoot' ->> 'id' = entity_id
+            )
+            OR (
+              domain = 'task-relationship'
+              AND mutation_kind IN ('link', 'unlink')
+              AND jsonb_typeof(payload_json::jsonb -> 'adoptedRelationship') = 'object'
+              AND payload_json::jsonb -> 'adoptedRelationship' ->> 'id' = entity_id
+            )
+          )
+    ` : `
+        UPDATE workspace_sync_outbox
+        SET dispatch_class = 'legacy-adoption'
+        WHERE dispatch_class = 'ordinary'
+          AND status IN ('pending', 'in_flight', 'blocked')
+          AND json_valid(payload_json) = 1
+          AND (
+            (
+              domain = 'task'
+              AND mutation_kind = 'create'
+              AND json_type(payload_json, '$.adoptedRoot') = 'object'
+              AND json_extract(payload_json, '$.adoptedRoot.id') = entity_id
+            )
+            OR (
+              domain = 'task-relationship'
+              AND mutation_kind IN ('link', 'unlink')
+              AND json_type(payload_json, '$.adoptedRelationship') = 'object'
+              AND json_extract(payload_json, '$.adoptedRelationship.id') = entity_id
+            )
+          )
     `);
-    const sessionRows = db.prepare(`
-        SELECT
-            id,
-            tenant_id,
+    if (!outboxColumns.some((column) => column.name === 'initial_not_found_attempt_count')) {
+        db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN initial_not_found_attempt_count INTEGER NOT NULL DEFAULT 0`);
+    }
+    if (!outboxColumns.some((column) => column.name === 'owns_task_metadata')) {
+        db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN owns_task_metadata INTEGER NOT NULL DEFAULT 0`);
+    }
+    if (!outboxColumns.some((column) => column.name === 'owns_task_lifecycle')) {
+        db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN owns_task_lifecycle INTEGER NOT NULL DEFAULT 0`);
+    }
+    if (!outboxColumns.some((column) => column.name === 'owns_task_assignee')) {
+        db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN owns_task_assignee INTEGER NOT NULL DEFAULT 0`);
+    }
+    if (!outboxColumns.some((column) => column.name === 'enqueue_sequence')) {
+        db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN enqueue_sequence ${db.provider === 'postgres' ? 'BIGINT' : 'INTEGER'} NOT NULL DEFAULT 0`);
+    }
+    if (!outboxColumns.some((column) => column.name === 'rebase_before_first_attempt')) {
+        db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN rebase_before_first_attempt INTEGER NOT NULL DEFAULT 0`);
+    }
+    if (!outboxColumns.some((column) => column.name === 'origin_assertion_recovery_count')) {
+        db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN origin_assertion_recovery_count INTEGER NOT NULL DEFAULT 0`);
+    }
+    if (!outboxColumns.some((column) => column.name === 'accepted_replay_recovery_count')) {
+        db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN accepted_replay_recovery_count INTEGER NOT NULL DEFAULT 0`);
+    }
+    if (!outboxColumns.some((column) => column.name === 'task_attachment_reference_metadata_recovery_count')) {
+        db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN task_attachment_reference_metadata_recovery_count INTEGER NOT NULL DEFAULT 0`);
+    }
+    const needsTaskStatusRecoveryBudgetSplit = !outboxColumns.some((column) => column.name === 'task_status_revision_rebase_count') || !outboxColumns.some((column) => column.name === 'task_status_workflow_ack_recovery_count');
+    if (!outboxColumns.some((column) => column.name === 'task_status_revision_rebase_count')) {
+        db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN task_status_revision_rebase_count INTEGER NOT NULL DEFAULT 0`);
+    }
+    if (!outboxColumns.some((column) => column.name === 'task_status_workflow_ack_recovery_count')) {
+        db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN task_status_workflow_ack_recovery_count INTEGER NOT NULL DEFAULT 0`);
+    }
+    if (needsTaskStatusRecoveryBudgetSplit) {
+        // The former shared counter cannot reveal which recovery consumed it.
+        // Preserve durable markers where available, then grant active task-status
+        // rows one fresh, independently bounded accepted-replay attempt. A
+        // partially applied migration can grant one extra replay, never a loop.
+        db.exec(`
+            UPDATE workspace_sync_outbox
+            SET task_status_revision_rebase_count = CASE
+                    WHEN rebase_before_first_attempt = 1 THEN 1
+                    ELSE task_status_revision_rebase_count
+                END,
+                task_status_workflow_ack_recovery_count = CASE
+                    WHEN last_error_code = 'WORKSPACE_SYNC_TASK_STATUS_WORKFLOW_ACK_RECOVERY' THEN 1
+                    ELSE task_status_workflow_ack_recovery_count
+                END,
+                accepted_replay_recovery_count = 0
+            WHERE domain = 'task'
+              AND mutation_kind = 'set-status'
+              AND status IN ('pending', 'in_flight', 'blocked')
+        `);
+    }
+    if (!outboxColumns.some((column) => column.name === 'workstream_metadata_revision_rebase_count')) {
+        db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN workstream_metadata_revision_rebase_count INTEGER NOT NULL DEFAULT 0`);
+    }
+    if (!outboxColumns.some((column) => column.name === 'initiative_metadata_revision_rebase_count')) {
+        db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN initiative_metadata_revision_rebase_count INTEGER NOT NULL DEFAULT 0`);
+    }
+    if (!outboxColumns.some((column) => column.name === 'recovery_batch_id')) {
+        db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN recovery_batch_id TEXT`);
+    }
+    if (!outboxColumns.some((column) => column.name === 'replay_of_client_id')) {
+        db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN replay_of_client_id TEXT`);
+    }
+    if (!outboxColumns.some((column) => column.name === 'replay_of_operation_id')) {
+        db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN replay_of_operation_id TEXT`);
+    }
+    if (!outboxColumns.some((column) => column.name === 'superseded_at')) {
+        db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN superseded_at TEXT`);
+    }
+    db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_outbox_entity_sequence
+        ON workspace_sync_outbox(tenant_id, workspace_id, domain, entity_id, enqueue_sequence, status)
+    `);
+    db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_outbox_recovery_batch
+        ON workspace_sync_outbox(tenant_id, workspace_id, recovery_batch_id, enqueue_sequence)
+    `);
+    db.exec(`
+        UPDATE workspace_sync_outbox
+        SET owns_task_metadata = CASE
+                WHEN domain = 'task' AND mutation_kind = 'metadata-update' THEN 1
+                ELSE owns_task_metadata
+            END,
+            owns_task_lifecycle = CASE
+                WHEN domain = 'task' AND mutation_kind IN ('archive', 'unarchive', 'complete', 'reopen') THEN 1
+                ELSE owns_task_lifecycle
+            END,
+            owns_task_assignee = CASE
+                WHEN domain = 'task' AND mutation_kind = 'reopen' THEN 1
+                ELSE owns_task_assignee
+            END
+        WHERE status IN ('pending', 'in_flight', 'blocked')
+    `);
+    db.exec(`
+        INSERT INTO workspace_sync_outbox_targets (
+            tenant_id, workspace_id, client_id, operation_id, domain, entity_id,
+            mutation_kind, base_entity_revision, base_lifecycle_revision,
+            owns_task_metadata, owns_task_lifecycle, owns_task_assignee, created_at
+        )
+        SELECT tenant_id, workspace_id, client_id, operation_id, domain, entity_id,
+               mutation_kind, base_entity_revision, base_lifecycle_revision,
+               owns_task_metadata, owns_task_lifecycle, owns_task_assignee, created_at
+        FROM workspace_sync_outbox
+        WHERE 1 = 1
+        ON CONFLICT (tenant_id, workspace_id, client_id, operation_id, domain, entity_id) DO NOTHING
+    `);
+    const projectionStateColumns = db.prepare(`PRAGMA table_info(workspace_sync_projection_state)`).all();
+    if (!projectionStateColumns.some((column) => column.name === 'repair_snapshot_id')) {
+        db.exec(`ALTER TABLE workspace_sync_projection_state ADD COLUMN repair_snapshot_id TEXT`);
+    }
+    if (!projectionStateColumns.some((column) => column.name === 'repair_expires_at')) {
+        db.exec(`ALTER TABLE workspace_sync_projection_state ADD COLUMN repair_expires_at TEXT`);
+    }
+    if (!projectionStateColumns.some((column) => column.name === 'applied_snapshot_id')) {
+        db.exec(`ALTER TABLE workspace_sync_projection_state ADD COLUMN applied_snapshot_id TEXT`);
+    }
+    if (!projectionStateColumns.some((column) => column.name === 'applied_page_digest')) {
+        db.exec(`ALTER TABLE workspace_sync_projection_state ADD COLUMN applied_page_digest TEXT`);
+    }
+    const revisionColumns = db.prepare(`PRAGMA table_info(workspace_sync_entity_revisions)`).all();
+    if (!revisionColumns.some((column) => column.name === 'coexistence_owned')) {
+        db.exec(`ALTER TABLE workspace_sync_entity_revisions ADD COLUMN coexistence_owned INTEGER NOT NULL DEFAULT 1`);
+    }
+    db.exec(`
+        UPDATE workspace_sync_entity_revisions
+        SET coexistence_owned = 0
+        WHERE EXISTS (
+            SELECT 1 FROM workspace_sync_journal
+            WHERE workspace_sync_journal.tenant_id = workspace_sync_entity_revisions.tenant_id
+              AND workspace_sync_journal.workspace_id = workspace_sync_entity_revisions.workspace_id
+              AND workspace_sync_journal.domain = workspace_sync_entity_revisions.domain
+              AND workspace_sync_journal.entity_id = workspace_sync_entity_revisions.entity_id
+              AND workspace_sync_journal.sequence = workspace_sync_entity_revisions.last_sequence
+              AND workspace_sync_journal.client_id = 'sync-v3-repair'
+              AND (
+                  workspace_sync_journal.operation_id LIKE 'repair-baseline-%'
+                  OR (
+                      workspace_sync_journal.domain = 'initiative'
+                      AND workspace_sync_journal.operation_id LIKE 'initiative-baseline-%'
+                  )
+              )
+        )
+    `);
+    if (!revisionColumns.some((column) => column.name === 'metadata_owned')) {
+        db.exec(`ALTER TABLE workspace_sync_entity_revisions ADD COLUMN metadata_owned INTEGER NOT NULL DEFAULT 0`);
+    }
+    if (!revisionColumns.some((column) => column.name === 'reopen_assignee_owned')) {
+        db.exec(`ALTER TABLE workspace_sync_entity_revisions ADD COLUMN reopen_assignee_owned INTEGER NOT NULL DEFAULT 0`);
+    }
+    db.exec(`
+        UPDATE workspace_sync_entity_revisions
+        SET metadata_owned = 1
+        WHERE metadata_owned = 0
+          AND EXISTS (
+              SELECT 1
+              FROM workspace_sync_journal
+              WHERE workspace_sync_journal.tenant_id = workspace_sync_entity_revisions.tenant_id
+                AND workspace_sync_journal.workspace_id = workspace_sync_entity_revisions.workspace_id
+                AND workspace_sync_journal.domain = workspace_sync_entity_revisions.domain
+                AND workspace_sync_journal.entity_id = workspace_sync_entity_revisions.entity_id
+                AND workspace_sync_journal.mutation_kind IN ('metadata-update', 'create')
+          )
+    `);
+}
+export function ensureLocalSyncCoordinatorSchema(db) {
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS local_sync_coordinator_state (
+            coordinator_id TEXT PRIMARY KEY,
+            active_workspace_id TEXT,
+            coordinator_generation INTEGER NOT NULL DEFAULT 0,
+            ownership_mode TEXT NOT NULL,
+            desired_ownership_mode TEXT NOT NULL DEFAULT 'browser-gateway',
+            transition_state TEXT NOT NULL,
+            accepted_switch_command_id TEXT,
+            target_workspace_id TEXT,
+            requested_by_json TEXT,
+            terminal_switch_result_json TEXT,
+            terminal_transfer_result_json TEXT,
+            accepted_transfer_command_id TEXT,
+            transfer_target_mode TEXT,
+            transfer_phase TEXT,
+            transfer_version INTEGER,
+            local_data_version INTEGER NOT NULL DEFAULT 0,
+            updated_at TEXT NOT NULL
+        );
+
+        CREATE TABLE IF NOT EXISTS local_sync_coordinator_commands (
+            command_id TEXT PRIMARY KEY,
+            workspace_id TEXT,
+            expected_coordinator_generation INTEGER NOT NULL,
+            command_type TEXT NOT NULL,
+            command_version INTEGER NOT NULL,
+            args_json TEXT NOT NULL,
+            canonical_fingerprint TEXT NOT NULL,
+            requested_by_json TEXT NOT NULL,
+            requested_at TEXT NOT NULL,
+            status TEXT NOT NULL,
+            started_at TEXT,
+            completed_at TEXT,
+            result_json TEXT,
+            error_code TEXT,
+            error_message TEXT,
+            updated_at TEXT NOT NULL
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_local_sync_coordinator_commands_status
+        ON local_sync_coordinator_commands(status, requested_at);
+
+        CREATE INDEX IF NOT EXISTS idx_local_sync_coordinator_commands_workspace
+        ON local_sync_coordinator_commands(workspace_id, requested_at);
+
+        CREATE INDEX IF NOT EXISTS idx_local_sync_coordinator_commands_terminal
+        ON local_sync_coordinator_commands(status, completed_at, command_id);
+
+        CREATE TABLE IF NOT EXISTS local_sync_execution_permits (
+            permit_id TEXT PRIMARY KEY,
+            workspace_id TEXT NOT NULL,
+            coordinator_generation INTEGER NOT NULL,
+            server_instance_id TEXT NOT NULL,
+            owner_mode TEXT NOT NULL DEFAULT 'browser-gateway',
+            operation_class TEXT NOT NULL,
+            operation_identity TEXT,
+            last_committed_cursor_json TEXT,
+            state TEXT NOT NULL,
+            upstream_disposition TEXT,
+            issued_at TEXT NOT NULL,
+            deadline_at TEXT NOT NULL,
+            last_transition_at TEXT NOT NULL,
+            completed_at TEXT,
+            error_code TEXT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_local_sync_execution_permits_live
+        ON local_sync_execution_permits(workspace_id, state, issued_at);
+
+        CREATE TABLE IF NOT EXISTS local_sync_recovery_obligations (
+            obligation_id TEXT PRIMARY KEY,
+            permit_id TEXT NOT NULL UNIQUE,
+            workspace_id TEXT NOT NULL,
+            operation_class TEXT NOT NULL,
+            operation_identity TEXT,
+            upstream_disposition TEXT NOT NULL,
+            last_committed_cursor_json TEXT,
+            required_action TEXT NOT NULL,
+            created_at TEXT NOT NULL,
+            resolved_at TEXT,
+            resolved_boundary_json TEXT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_local_sync_recovery_obligations_open
+        ON local_sync_recovery_obligations(workspace_id, resolved_at, created_at);
+
+        CREATE TABLE IF NOT EXISTS local_sync_legacy_adoption_state (
+            tenant_id TEXT NOT NULL,
+            workspace_id TEXT NOT NULL,
+            domain TEXT NOT NULL,
+            projection_epoch INTEGER NOT NULL,
+            settled_at TEXT NOT NULL,
+            next_scan_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, workspace_id, domain)
+        );
+
+        CREATE TABLE IF NOT EXISTS workspace_sync_content_pull_obligations (
+            tenant_id TEXT NOT NULL,
+            workspace_id TEXT NOT NULL,
+            kind TEXT NOT NULL,
+            path TEXT NOT NULL,
+            source_watermark TEXT NOT NULL,
+            metadata_fingerprint TEXT NOT NULL,
+            expected_sha256 TEXT NOT NULL,
+            expected_size_bytes INTEGER NOT NULL,
+            manifest_updated_at TEXT NOT NULL,
+            attempts INTEGER NOT NULL DEFAULT 0,
+            last_error TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            resolved_at TEXT,
+            PRIMARY KEY (tenant_id, workspace_id, kind, path)
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_content_pull_obligations_open
+        ON workspace_sync_content_pull_obligations(
+            tenant_id, workspace_id, resolved_at, updated_at, kind, path
+        );
+
+        CREATE TABLE IF NOT EXISTS workspace_sync_v3_attachment_apply_obligations (
+            tenant_id TEXT NOT NULL,
+            workspace_id TEXT NOT NULL,
+            task_id TEXT NOT NULL,
+            asset_ids_json TEXT NOT NULL,
+            payload_json TEXT NOT NULL,
+            canonical_fingerprint TEXT NOT NULL,
+            source_sequence TEXT NOT NULL,
+            entity_revision TEXT,
+            lifecycle_revision TEXT,
+            revision_fingerprint TEXT,
+            attempts INTEGER NOT NULL DEFAULT 0,
+            last_error TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            next_attempt_at TEXT NOT NULL,
+            resolved_at TEXT,
+            PRIMARY KEY (tenant_id, workspace_id, task_id)
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_workspace_sync_v3_attachment_apply_obligations_open
+        ON workspace_sync_v3_attachment_apply_obligations(
+            tenant_id, workspace_id, resolved_at, next_attempt_at
+        );
+
+        CREATE TABLE IF NOT EXISTS local_workspace_sync_runner_state (
+            tenant_id TEXT NOT NULL,
+            workspace_id TEXT NOT NULL,
+            state_version INTEGER NOT NULL,
+            coordinator_generation INTEGER NOT NULL,
+            checkpoint_revision INTEGER NOT NULL,
+            checkpoint_json TEXT NOT NULL,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, workspace_id)
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_local_workspace_sync_runner_generation
+        ON local_workspace_sync_runner_state(coordinator_generation, updated_at);
+    `);
+    const attachmentApplyColumns = db.provider === 'postgres'
+        ? new Set(db.prepare(`
+            SELECT column_name AS name
+            FROM information_schema.columns
+            WHERE table_schema = current_schema()
+              AND table_name = 'workspace_sync_v3_attachment_apply_obligations'
+        `).all().map((column) => column.name))
+        : new Set(db.prepare(`
+            PRAGMA table_info(workspace_sync_v3_attachment_apply_obligations)
+        `).all().map((column) => column.name));
+    if (!attachmentApplyColumns.has('entity_revision')) {
+        db.exec(`ALTER TABLE workspace_sync_v3_attachment_apply_obligations ADD COLUMN entity_revision TEXT`);
+    }
+    if (!attachmentApplyColumns.has('lifecycle_revision')) {
+        db.exec(`ALTER TABLE workspace_sync_v3_attachment_apply_obligations ADD COLUMN lifecycle_revision TEXT`);
+    }
+    if (!attachmentApplyColumns.has('revision_fingerprint')) {
+        db.exec(`ALTER TABLE workspace_sync_v3_attachment_apply_obligations ADD COLUMN revision_fingerprint TEXT`);
+    }
+    const coordinatorStateColumns = db.provider === 'postgres'
+        ? new Set(db.prepare(`
+            SELECT column_name AS name
+            FROM information_schema.columns
+            WHERE table_schema = current_schema()
+              AND table_name = 'local_sync_coordinator_state'
+        `).all().map((column) => column.name))
+        : new Set(db.prepare(`
+            PRAGMA table_info(local_sync_coordinator_state)
+        `).all().map((column) => column.name));
+    if (!coordinatorStateColumns.has('accepted_transfer_command_id')) {
+        db.exec(`ALTER TABLE local_sync_coordinator_state ADD COLUMN accepted_transfer_command_id TEXT`);
+    }
+    if (!coordinatorStateColumns.has('terminal_transfer_result_json')) {
+        db.exec(`ALTER TABLE local_sync_coordinator_state ADD COLUMN terminal_transfer_result_json TEXT`);
+    }
+    if (!coordinatorStateColumns.has('transfer_target_mode')) {
+        db.exec(`ALTER TABLE local_sync_coordinator_state ADD COLUMN transfer_target_mode TEXT`);
+    }
+    if (!coordinatorStateColumns.has('transfer_phase')) {
+        db.exec(`ALTER TABLE local_sync_coordinator_state ADD COLUMN transfer_phase TEXT`);
+    }
+    if (!coordinatorStateColumns.has('transfer_version')) {
+        db.exec(`ALTER TABLE local_sync_coordinator_state ADD COLUMN transfer_version INTEGER`);
+    }
+    if (!coordinatorStateColumns.has('local_data_version')) {
+        db.exec(`
+            ALTER TABLE local_sync_coordinator_state
+            ADD COLUMN local_data_version INTEGER NOT NULL DEFAULT 0
+        `);
+    }
+    if (!coordinatorStateColumns.has('desired_ownership_mode')) {
+        db.transaction(() => {
+            db.exec(`
+                ALTER TABLE local_sync_coordinator_state
+                ADD COLUMN desired_ownership_mode TEXT NOT NULL DEFAULT 'browser-gateway'
+            `);
+            const legacyStates = db.prepare(`
+                SELECT coordinator_id, ownership_mode, transition_state,
+                       transfer_target_mode, terminal_transfer_result_json
+                FROM local_sync_coordinator_state
+            `).all();
+            const updateDesiredOwner = db.prepare(`
+                UPDATE local_sync_coordinator_state
+                SET desired_ownership_mode = ?
+                WHERE coordinator_id = ?
+            `);
+            for (const state of legacyStates) {
+                let desiredOwner = 'browser-gateway';
+                if (state.ownership_mode === 'server') {
+                    desiredOwner = 'server';
+                }
+                else if (state.transition_state === 'transferring-ownership'
+                    && state.transfer_target_mode === 'browser-gateway') {
+                    desiredOwner = 'server';
+                }
+                else if (state.ownership_mode === 'stopped'
+                    && state.terminal_transfer_result_json) {
+                    try {
+                        const terminal = JSON.parse(state.terminal_transfer_result_json);
+                        if ((terminal.status === 'succeeded' && terminal.targetMode === 'server')
+                            || (terminal.status === 'failed' && terminal.sourceMode === 'server')) {
+                            desiredOwner = 'server';
+                        }
+                    }
+                    catch {
+                        // Invalid historical evidence cannot safely opt into server recovery.
+                    }
+                }
+                updateDesiredOwner.run(desiredOwner, state.coordinator_id);
+            }
+        })();
+    }
+    const permitColumns = db.provider === 'postgres'
+        ? new Set(db.prepare(`
+            SELECT column_name AS name
+            FROM information_schema.columns
+            WHERE table_schema = current_schema()
+              AND table_name = 'local_sync_execution_permits'
+        `).all().map((column) => column.name))
+        : new Set(db.prepare(`
+            PRAGMA table_info(local_sync_execution_permits)
+        `).all().map((column) => column.name));
+    if (!permitColumns.has('last_committed_cursor_json')) {
+        db.exec(`ALTER TABLE local_sync_execution_permits ADD COLUMN last_committed_cursor_json TEXT`);
+    }
+    if (!permitColumns.has('owner_mode')) {
+        db.exec(`
+            ALTER TABLE local_sync_execution_permits
+            ADD COLUMN owner_mode TEXT NOT NULL DEFAULT 'browser-gateway'
+        `);
+    }
+    const recoveryObligationColumns = db.provider === 'postgres'
+        ? new Set(db.prepare(`
+            SELECT column_name AS name
+            FROM information_schema.columns
+            WHERE table_schema = current_schema()
+              AND table_name = 'local_sync_recovery_obligations'
+        `).all().map((column) => column.name))
+        : new Set(db.prepare(`
+            PRAGMA table_info(local_sync_recovery_obligations)
+        `).all().map((column) => column.name));
+    if (!recoveryObligationColumns.has('resolved_boundary_json')) {
+        db.exec(`
+            ALTER TABLE local_sync_recovery_obligations
+            ADD COLUMN resolved_boundary_json TEXT
+        `);
+    }
+}
+export function ensureWorkspaceDocumentsSchema(db) {
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS workspace_documents (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            path TEXT NOT NULL,
+            content_hash TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, workspace_id, path)
+        );
+        CREATE INDEX IF NOT EXISTS idx_workspace_documents_workspace_path
+        ON workspace_documents(tenant_id, workspace_id, path);
+    `);
+}
+export function ensureAnnotatedAttachmentSessionsSchema(db) {
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS annotated_attachment_sessions (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            task_id TEXT NOT NULL,
+            base_image_asset_id TEXT NOT NULL,
+            title TEXT,
+            global_instruction TEXT,
+            annotations_json TEXT NOT NULL DEFAULT '[]',
+            created_by_actor_id TEXT,
+            updated_by_actor_id TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            deleted_at TEXT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_annotated_attachment_sessions_task
+        ON annotated_attachment_sessions(tenant_id, workspace_id, task_id, deleted_at, updated_at);
+        CREATE INDEX IF NOT EXISTS idx_annotated_attachment_sessions_image
+        ON annotated_attachment_sessions(tenant_id, workspace_id, base_image_asset_id, deleted_at, updated_at);
+    `);
+}
+export function ensureTaskforceAgentsSchema(db) {
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS taskforce_agents (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            name TEXT NOT NULL,
+            model_provider TEXT NOT NULL DEFAULT 'taskforce_hq',
+            provider_key TEXT NOT NULL DEFAULT 'anthropic',
+            model_key TEXT NOT NULL DEFAULT 'anthropic.claude-sonnet-4-6',
+            model_tier TEXT NOT NULL DEFAULT 'balanced',
+            system_prompt TEXT NOT NULL,
+            enabled INTEGER NOT NULL DEFAULT 1,
+            lifecycle_status TEXT NOT NULL DEFAULT 'active',
+            managed_profile_id TEXT,
+            definition_json TEXT,
+            definition_revision INTEGER NOT NULL DEFAULT 0,
+            definition_hash TEXT,
+            configuration_state TEXT NOT NULL DEFAULT 'needs-migration',
+            configuration_issues_json TEXT NOT NULL DEFAULT '[]',
+            created_by_user_id TEXT,
+            updated_by_user_id TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            deleted_at TEXT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_taskforce_agents_workspace
+        ON taskforce_agents(tenant_id, workspace_id, deleted_at, updated_at);
+
+        CREATE TABLE IF NOT EXISTS agent_conversations (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            agent_id TEXT NOT NULL,
+            task_id TEXT,
+            title TEXT NOT NULL DEFAULT 'Agent chat',
+            messages_json TEXT NOT NULL DEFAULT '[]',
+            model_provider TEXT,
+            model_id TEXT,
+            usage_json TEXT,
+            latency_ms INTEGER,
+            created_by_user_id TEXT,
+            updated_by_user_id TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            deleted_at TEXT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_agent_conversations_agent
+        ON agent_conversations(tenant_id, workspace_id, agent_id, deleted_at, updated_at);
+    `);
+    const agentColumns = db.provider === 'postgres'
+        ? db.prepare(`
+            SELECT column_name AS name
+            FROM information_schema.columns
+            WHERE table_name = 'taskforce_agents'
+        `).all()
+        : db.prepare(`PRAGMA table_info(taskforce_agents)`).all();
+    const agentColumnNames = new Set(agentColumns.map((column) => column.name));
+    const missingAgentColumns = [
+        ['provider_key', `TEXT NOT NULL DEFAULT 'anthropic'`],
+        ['model_key', `TEXT NOT NULL DEFAULT 'anthropic.claude-sonnet-4-6'`],
+        ['lifecycle_status', `TEXT NOT NULL DEFAULT 'active'`],
+        ['managed_profile_id', 'TEXT'],
+        ['definition_json', 'TEXT'],
+        ['definition_revision', 'INTEGER NOT NULL DEFAULT 0'],
+        ['definition_hash', 'TEXT'],
+        ['configuration_state', `TEXT NOT NULL DEFAULT 'needs-migration'`],
+        ['configuration_issues_json', `TEXT NOT NULL DEFAULT '[]'`],
+    ];
+    for (const [columnName, columnDefinition] of missingAgentColumns) {
+        if (agentColumnNames.has(columnName))
+            continue;
+        db.exec(db.provider === 'postgres'
+            ? `ALTER TABLE taskforce_agents ADD COLUMN IF NOT EXISTS ${columnName} ${columnDefinition}`
+            : `ALTER TABLE taskforce_agents ADD COLUMN ${columnName} ${columnDefinition}`);
+    }
+    if (MIGRATION_COMPAT_ENABLED)
+        backfillLegacyTaskforceAgentDefinitions(db);
+    const conversationColumns = db.provider === 'postgres'
+        ? db.prepare(`
+            SELECT column_name AS name
+            FROM information_schema.columns
+            WHERE table_name = 'agent_conversations'
+        `).all()
+        : db.prepare(`PRAGMA table_info(agent_conversations)`).all();
+    const conversationColumnNames = new Set(conversationColumns.map((column) => column.name));
+    if (!conversationColumnNames.has('task_id')) {
+        db.exec(db.provider === 'postgres'
+            ? `ALTER TABLE agent_conversations ADD COLUMN IF NOT EXISTS task_id TEXT`
+            : `ALTER TABLE agent_conversations ADD COLUMN task_id TEXT`);
+    }
+}
+export function ensureAgentRolesSchema(db) {
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS agent_roles (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            lifecycle_status TEXT NOT NULL DEFAULT 'active'
+                CHECK (lifecycle_status IN ('active', 'retired')),
+            current_revision INTEGER NOT NULL,
+            current_content_hash TEXT NOT NULL,
+            created_by_actor_id TEXT,
+            updated_by_actor_id TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            retired_at TEXT,
+            deleted_at TEXT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_agent_roles_workspace
+        ON agent_roles(tenant_id, workspace_id, deleted_at, lifecycle_status, updated_at);
+
+        CREATE TABLE IF NOT EXISTS agent_role_revisions (
+            role_id TEXT NOT NULL,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            revision INTEGER NOT NULL,
+            definition_json TEXT NOT NULL,
+            content_hash TEXT NOT NULL,
+            created_by_actor_id TEXT,
+            created_at TEXT NOT NULL,
+            PRIMARY KEY (role_id, revision)
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_agent_role_revisions_workspace
+        ON agent_role_revisions(tenant_id, workspace_id, role_id, revision);
+    `);
+}
+export function ensureTaskforceAgentSkillsSchema(db) {
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS taskforce_agent_skills (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            name TEXT NOT NULL,
+            lifecycle_status TEXT NOT NULL DEFAULT 'active'
+                CHECK (lifecycle_status IN ('active', 'retired')),
+            definition_json TEXT NOT NULL,
+            revision_number INTEGER NOT NULL CHECK (revision_number >= 1),
+            content_hash TEXT NOT NULL,
+            created_by_actor_id TEXT,
+            updated_by_actor_id TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            retired_at TEXT,
+            retired_by_actor_id TEXT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_taskforce_agent_skills_workspace
+        ON taskforce_agent_skills(tenant_id, workspace_id, lifecycle_status, name);
+
+        CREATE TABLE IF NOT EXISTS taskforce_agent_skill_revisions (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            skill_id TEXT NOT NULL,
+            revision_number INTEGER NOT NULL CHECK (revision_number >= 1),
+            content_hash TEXT NOT NULL,
+            definition_json TEXT NOT NULL,
+            created_by_actor_id TEXT,
+            created_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, workspace_id, skill_id, revision_number)
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_taskforce_agent_skill_revisions_skill
+        ON taskforce_agent_skill_revisions(tenant_id, workspace_id, skill_id, revision_number);
+
+        CREATE TABLE IF NOT EXISTS taskforce_agent_skill_events (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            skill_id TEXT NOT NULL,
+            event_type TEXT NOT NULL,
+            actor_id TEXT,
+            details_json TEXT NOT NULL DEFAULT '{}',
+            created_at TEXT NOT NULL
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_taskforce_agent_skill_events_skill
+        ON taskforce_agent_skill_events(tenant_id, workspace_id, skill_id, created_at);
+    `);
+}
+export function ensureWorkflowSchema(db) {
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS workflow_templates (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            name TEXT NOT NULL,
+            description TEXT NOT NULL DEFAULT '',
+            status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'retired')),
+            created_by_actor_id TEXT,
+            updated_by_actor_id TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            deleted_at TEXT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_workflow_templates_workspace
+        ON workflow_templates(tenant_id, workspace_id, deleted_at, updated_at);
+
+        CREATE TABLE IF NOT EXISTS workflow_versions (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            workflow_template_id TEXT NOT NULL,
+            version_number INTEGER,
+            status TEXT NOT NULL DEFAULT 'draft' CHECK (status IN ('draft', 'published')),
+            name TEXT NOT NULL,
+            description TEXT NOT NULL DEFAULT '',
+            created_by_actor_id TEXT,
+            updated_by_actor_id TEXT,
+            published_by_actor_id TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            published_at TEXT,
+            deleted_at TEXT,
+            UNIQUE (id, workflow_template_id),
+            CHECK (
+                (status = 'draft' AND version_number IS NULL AND published_at IS NULL)
+                OR (status = 'published' AND version_number IS NOT NULL AND version_number > 0 AND published_at IS NOT NULL)
+            ),
+            FOREIGN KEY (workflow_template_id) REFERENCES workflow_templates(id) ON DELETE RESTRICT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_workflow_versions_template
+        ON workflow_versions(tenant_id, workspace_id, workflow_template_id, status, updated_at);
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_workflow_versions_published_number
+        ON workflow_versions(tenant_id, workspace_id, workflow_template_id, version_number)
+        WHERE status = 'published' AND deleted_at IS NULL;
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_workflow_versions_single_draft
+        ON workflow_versions(tenant_id, workspace_id, workflow_template_id)
+        WHERE status = 'draft' AND deleted_at IS NULL;
+
+        CREATE TABLE IF NOT EXISTS workflow_steps (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            workflow_version_id TEXT NOT NULL,
+            position INTEGER NOT NULL CHECK (position >= 0),
+            name TEXT NOT NULL,
+            instructions TEXT NOT NULL DEFAULT '',
+            owner_type TEXT CHECK (owner_type IS NULL OR owner_type IN ('user', 'agent')),
+            owner_id TEXT,
+            expected_artifact TEXT,
+            requires_comment_evidence INTEGER NOT NULL DEFAULT 0 CHECK (requires_comment_evidence IN (0, 1)),
+            is_required INTEGER NOT NULL DEFAULT 1 CHECK (is_required IN (0, 1)),
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            CHECK ((owner_type IS NULL AND owner_id IS NULL) OR (owner_type IS NOT NULL AND owner_id IS NOT NULL)),
+            FOREIGN KEY (workflow_version_id) REFERENCES workflow_versions(id) ON DELETE RESTRICT
+        );
+
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_workflow_steps_version_position
+        ON workflow_steps(tenant_id, workspace_id, workflow_version_id, position);
+
+        CREATE TABLE IF NOT EXISTS workflow_executions (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            task_id TEXT NOT NULL,
+            workflow_template_id TEXT NOT NULL,
+            workflow_version_id TEXT NOT NULL,
+            status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'running', 'paused', 'completed', 'failed', 'ended')),
+            current_step_id TEXT,
+            created_by_actor_id TEXT,
+            updated_by_actor_id TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            started_at TEXT,
+            completed_at TEXT,
+            ended_at TEXT,
+            deleted_at TEXT,
+            FOREIGN KEY (workflow_template_id) REFERENCES workflow_templates(id) ON DELETE RESTRICT,
+            FOREIGN KEY (workflow_version_id, workflow_template_id)
+                REFERENCES workflow_versions(id, workflow_template_id) ON DELETE RESTRICT
+        );
+
+        -- task_id intentionally remains a logical reference because Taskforce moves
+        -- deleted tasks out of the active tasks table while retaining execution history.
+
+        CREATE INDEX IF NOT EXISTS idx_workflow_executions_task
+        ON workflow_executions(tenant_id, workspace_id, task_id, updated_at);
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_workflow_executions_one_active_per_task
+        ON workflow_executions(tenant_id, workspace_id, task_id)
+        WHERE status IN ('pending', 'running', 'paused') AND deleted_at IS NULL;
+
+        CREATE TABLE IF NOT EXISTS workflow_execution_events (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            workflow_execution_id TEXT NOT NULL,
+            sequence_number INTEGER NOT NULL CHECK (sequence_number >= 0),
+            event_type TEXT NOT NULL CHECK (event_type IN (
+                'execution-created', 'execution-started', 'execution-paused',
+                'execution-resumed', 'execution-completed', 'execution-failed', 'execution-ended',
+                'step-completed', 'step-started'
+            )),
+            from_status TEXT CHECK (from_status IS NULL OR from_status IN ('pending', 'running', 'paused', 'completed', 'failed', 'ended')),
+            to_status TEXT NOT NULL CHECK (to_status IN ('pending', 'running', 'paused', 'completed', 'failed', 'ended')),
+            step_id TEXT,
+            actor_id TEXT NOT NULL,
+            idempotency_key TEXT,
+            details_json TEXT NOT NULL DEFAULT '{}',
+            created_at TEXT NOT NULL,
+            FOREIGN KEY (workflow_execution_id) REFERENCES workflow_executions(id) ON DELETE RESTRICT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_workflow_execution_events_execution
+        ON workflow_execution_events(tenant_id, workspace_id, workflow_execution_id, sequence_number);
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_workflow_execution_events_sequence
+        ON workflow_execution_events(tenant_id, workspace_id, workflow_execution_id, sequence_number);
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_workflow_execution_events_idempotency
+        ON workflow_execution_events(tenant_id, workspace_id, workflow_execution_id, idempotency_key)
+        WHERE idempotency_key IS NOT NULL;
+
+        INSERT INTO workflow_execution_events (
+            id, tenant_id, workspace_id, workflow_execution_id, sequence_number, event_type,
+            from_status, to_status, step_id, actor_id, idempotency_key,
+            details_json, created_at
+        )
+        SELECT
+            'workflow-execution-event-initial-' || execution.id,
+            execution.tenant_id,
+            execution.workspace_id,
+            execution.id,
+            0,
+            'execution-created',
+            NULL,
+            'pending',
+            NULL,
+            COALESCE(execution.created_by_actor_id, 'system'),
+            NULL,
+            '{}',
+            execution.created_at
+        FROM workflow_executions execution
+        WHERE NOT EXISTS (
+            SELECT 1 FROM workflow_execution_events event
+            WHERE event.tenant_id = execution.tenant_id
+              AND event.workspace_id = execution.workspace_id
+              AND event.workflow_execution_id = execution.id
+        );
+    `);
+    ensureWorkflowStepEventTypes(db);
+    if (db.provider !== 'postgres') {
+        db.exec(`
+            CREATE TRIGGER IF NOT EXISTS trg_workflow_execution_events_no_update
+            BEFORE UPDATE ON workflow_execution_events
+            BEGIN
+                SELECT RAISE(ABORT, 'Workflow execution events are append-only');
+            END;
+            CREATE TRIGGER IF NOT EXISTS trg_workflow_execution_events_no_delete
+            BEFORE DELETE ON workflow_execution_events
+            BEGIN
+                SELECT RAISE(ABORT, 'Workflow execution events are append-only');
+            END;
+        `);
+    }
+    else {
+        db.exec(`
+            CREATE OR REPLACE FUNCTION prevent_workflow_execution_event_mutation()
+            RETURNS trigger AS $$
+            BEGIN
+                RAISE EXCEPTION 'Workflow execution events are append-only';
+            END;
+            $$ LANGUAGE plpgsql;
+            DROP TRIGGER IF EXISTS trg_workflow_execution_events_no_mutation ON workflow_execution_events;
+            CREATE TRIGGER trg_workflow_execution_events_no_mutation
+            BEFORE UPDATE OR DELETE ON workflow_execution_events
+            FOR EACH ROW EXECUTE FUNCTION prevent_workflow_execution_event_mutation();
+        `);
+    }
+    const workflowStepColumns = db.provider === 'postgres'
+        ? new Set(db.prepare(`
+            SELECT column_name AS name
+            FROM information_schema.columns
+            WHERE table_name = 'workflow_steps'
+        `).all().map((column) => column.name))
+        : new Set(db.prepare(`PRAGMA table_info(workflow_steps)`).all().map((column) => column.name));
+    if (!workflowStepColumns.has('requires_comment_evidence')) {
+        db.exec(`
+            ALTER TABLE workflow_steps
+            ADD COLUMN requires_comment_evidence INTEGER NOT NULL DEFAULT 0
+            CHECK (requires_comment_evidence IN (0, 1))
+        `);
+    }
+}
+function ensureWorkflowStepEventTypes(db) {
+    if (db.provider === 'postgres') {
+        const row = db.prepare(`
+            SELECT pg_get_constraintdef(constraint_row.oid) AS definition
+            FROM pg_constraint constraint_row
+            JOIN pg_class table_row ON table_row.oid = constraint_row.conrelid
+            WHERE table_row.relname = 'workflow_execution_events'
+              AND constraint_row.conname = 'workflow_execution_events_event_type_check'
+            LIMIT 1
+        `).get();
+        if (String(row?.definition || '').includes('step-completed'))
+            return;
+        db.exec(`
+            ALTER TABLE workflow_execution_events
+            DROP CONSTRAINT IF EXISTS workflow_execution_events_event_type_check;
+            ALTER TABLE workflow_execution_events
+            ADD CONSTRAINT workflow_execution_events_event_type_check CHECK (event_type IN (
+                'execution-created', 'execution-started', 'execution-paused',
+                'execution-resumed', 'execution-completed', 'execution-failed', 'execution-ended',
+                'step-completed', 'step-started'
+            ));
+        `);
+        return;
+    }
+    const table = db.prepare(`
+        SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'workflow_execution_events'
+    `).get();
+    if (String(table?.sql || '').includes('step-completed'))
+        return;
+    db.transaction(() => db.exec(`
+        DROP TRIGGER IF EXISTS trg_workflow_execution_events_no_update;
+        DROP TRIGGER IF EXISTS trg_workflow_execution_events_no_delete;
+        ALTER TABLE workflow_execution_events RENAME TO workflow_execution_events_legacy;
+        CREATE TABLE workflow_execution_events (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            workflow_execution_id TEXT NOT NULL,
+            sequence_number INTEGER NOT NULL CHECK (sequence_number >= 0),
+            event_type TEXT NOT NULL CHECK (event_type IN (
+                'execution-created', 'execution-started', 'execution-paused',
+                'execution-resumed', 'execution-completed', 'execution-failed', 'execution-ended',
+                'step-completed', 'step-started'
+            )),
+            from_status TEXT CHECK (from_status IS NULL OR from_status IN ('pending', 'running', 'paused', 'completed', 'failed', 'ended')),
+            to_status TEXT NOT NULL CHECK (to_status IN ('pending', 'running', 'paused', 'completed', 'failed', 'ended')),
+            step_id TEXT,
+            actor_id TEXT NOT NULL,
+            idempotency_key TEXT,
+            details_json TEXT NOT NULL DEFAULT '{}',
+            created_at TEXT NOT NULL,
+            FOREIGN KEY (workflow_execution_id) REFERENCES workflow_executions(id) ON DELETE RESTRICT
+        );
+        INSERT INTO workflow_execution_events (
+            id, tenant_id, workspace_id, workflow_execution_id, sequence_number, event_type,
+            from_status, to_status, step_id, actor_id, idempotency_key, details_json, created_at
+        ) SELECT
+            id, tenant_id, workspace_id, workflow_execution_id, sequence_number, event_type,
+            from_status, to_status, step_id, actor_id, idempotency_key, details_json, created_at
+        FROM workflow_execution_events_legacy;
+        DROP TABLE workflow_execution_events_legacy;
+        CREATE INDEX IF NOT EXISTS idx_workflow_execution_events_execution
+        ON workflow_execution_events(tenant_id, workspace_id, workflow_execution_id, sequence_number);
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_workflow_execution_events_sequence
+        ON workflow_execution_events(tenant_id, workspace_id, workflow_execution_id, sequence_number);
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_workflow_execution_events_idempotency
+        ON workflow_execution_events(tenant_id, workspace_id, workflow_execution_id, idempotency_key)
+        WHERE idempotency_key IS NOT NULL;
+    `))();
+}
+export function ensureDocumentReviewSessionsSchema(db) {
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS document_review_sessions (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            asset_id TEXT NOT NULL,
+            document_id TEXT,
+            document_version INTEGER,
+            title TEXT,
+            status TEXT NOT NULL DEFAULT 'open',
+            comments_json TEXT NOT NULL DEFAULT '[]',
+            created_by_actor_id TEXT,
+            updated_by_actor_id TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            deleted_at TEXT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_document_review_sessions_asset
+        ON document_review_sessions(tenant_id, workspace_id, asset_id, deleted_at, updated_at);
+        CREATE INDEX IF NOT EXISTS idx_document_review_sessions_workspace
+        ON document_review_sessions(tenant_id, workspace_id, updated_at, id);
+
+        CREATE TABLE IF NOT EXISTS document_review_comments (
+            id TEXT PRIMARY KEY,
+            session_id TEXT NOT NULL,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            body TEXT NOT NULL,
+            anchor_json TEXT,
+            author_actor_id TEXT,
+            updated_by_actor_id TEXT,
+            deleted_by_actor_id TEXT,
+            parent_comment_id TEXT,
+            thread_status TEXT,
+            thread_status_updated_at TEXT,
+            resolved_at TEXT,
+            resolved_by_actor_id TEXT,
+            idempotency_key TEXT,
+            idempotency_fingerprint TEXT,
+            idempotency_actor_scope TEXT NOT NULL DEFAULT '',
+            order_index INTEGER NOT NULL DEFAULT 0,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            deleted_at TEXT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_document_review_comments_session
+        ON document_review_comments(tenant_id, workspace_id, session_id, deleted_at, order_index, created_at, id);
+        CREATE INDEX IF NOT EXISTS idx_document_review_comments_workspace
+        ON document_review_comments(tenant_id, workspace_id, updated_at, id);
+    `);
+    const commentColumnNames = db.provider === 'postgres'
+        ? new Set(db.prepare(`
+            SELECT column_name AS name
+            FROM information_schema.columns
+            WHERE table_schema = current_schema()
+              AND table_name = 'document_review_comments'
+        `).all().map((column) => column.name))
+        : new Set(db.prepare(`PRAGMA table_info(document_review_comments)`).all().map((column) => column.name));
+    const addCommentColumn = (name) => {
+        const ifNotExists = db.provider === 'postgres' ? ' IF NOT EXISTS' : '';
+        db.exec(`ALTER TABLE document_review_comments ADD COLUMN${ifNotExists} ${name} TEXT`);
+    };
+    if (!commentColumnNames.has('updated_by_actor_id')) {
+        addCommentColumn('updated_by_actor_id');
+    }
+    if (!commentColumnNames.has('deleted_by_actor_id')) {
+        addCommentColumn('deleted_by_actor_id');
+    }
+    if (!commentColumnNames.has('idempotency_key')) {
+        addCommentColumn('idempotency_key');
+    }
+    if (!commentColumnNames.has('idempotency_fingerprint')) {
+        addCommentColumn('idempotency_fingerprint');
+    }
+    if (!commentColumnNames.has('idempotency_actor_scope')) {
+        const ifNotExists = db.provider === 'postgres' ? ' IF NOT EXISTS' : '';
+        db.exec(`ALTER TABLE document_review_comments ADD COLUMN${ifNotExists} idempotency_actor_scope TEXT NOT NULL DEFAULT ''`);
+    }
+    db.exec(`
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_document_review_comments_idempotency
+        ON document_review_comments (
+            tenant_id, workspace_id, idempotency_actor_scope, idempotency_key
+        )
+    `);
+    if (!commentColumnNames.has('parent_comment_id')) {
+        addCommentColumn('parent_comment_id');
+    }
+    if (!commentColumnNames.has('thread_status')) {
+        addCommentColumn('thread_status');
+    }
+    if (!commentColumnNames.has('thread_status_updated_at')) {
+        addCommentColumn('thread_status_updated_at');
+    }
+    if (!commentColumnNames.has('resolved_at')) {
+        addCommentColumn('resolved_at');
+    }
+    if (!commentColumnNames.has('resolved_by_actor_id')) {
+        addCommentColumn('resolved_by_actor_id');
+    }
+    db.exec(`
+        UPDATE document_review_comments
+        SET updated_by_actor_id = author_actor_id
+        WHERE updated_by_actor_id IS NULL
+          AND author_actor_id IS NOT NULL
+    `);
+    db.exec(`
+        UPDATE document_review_comments
+        SET thread_status = 'open',
+            thread_status_updated_at = COALESCE(thread_status_updated_at, updated_at, created_at)
+        WHERE parent_comment_id IS NULL
+          AND (thread_status IS NULL OR thread_status = '')
+    `);
+    db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_document_review_comments_parent
+        ON document_review_comments(tenant_id, workspace_id, session_id, parent_comment_id, deleted_at, order_index, created_at, id)
+    `);
+    const sessionRows = db.prepare(`
+        SELECT
+            id,
+            tenant_id,
             workspace_id,
             comments_json
         FROM document_review_sessions
@@ -1104,11 +2923,13 @@ export function ensureDocumentReviewSessionsSchema(db) {
             body,
             anchor_json,
             author_actor_id,
+            updated_by_actor_id,
+            deleted_by_actor_id,
             order_index,
             created_at,
             updated_at,
             deleted_at
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     `);
     for (const row of sessionRows) {
         const sessionId = String(row.id || '').trim();
@@ -1137,13 +2958,20 @@ export function ensureDocumentReviewSessionsSchema(db) {
                 const anchorJson = record.anchor && typeof record.anchor === 'object' ? JSON.stringify(record.anchor) : null;
                 const rawOrder = Number(record.order);
                 const orderIndex = Number.isFinite(rawOrder) ? Math.max(0, Math.floor(rawOrder)) : index;
-                insertComment.run(commentId, sessionId, tenantId, workspaceId, body, anchorJson, String(record.authorActorId || '').trim() || null, orderIndex, createdAt, updatedAt, String(record.deletedAt || '').trim() || null);
+                insertComment.run(commentId, sessionId, tenantId, workspaceId, body, anchorJson, String(record.authorActorId || '').trim() || null, String(record.updatedByActorId || record.authorActorId || '').trim() || null, String(record.deletedByActorId || '').trim() || null, orderIndex, createdAt, updatedAt, String(record.deletedAt || '').trim() || null);
             }
         }
         catch {
             continue;
         }
     }
+    db.exec(`
+        UPDATE document_review_comments
+        SET thread_status = 'open',
+            thread_status_updated_at = COALESCE(thread_status_updated_at, updated_at, created_at)
+        WHERE parent_comment_id IS NULL
+          AND (thread_status IS NULL OR thread_status = '')
+    `);
     if (hasTable(db, 'workspace_memberships') && hasTable(db, 'users')) {
         const anonymousComments = db.prepare(`
             SELECT DISTINCT tenant_id, workspace_id