@winspan/claude-forge 8.54.3 → 9.2.0

package/dist/core/storage/base.js

@@ -25,6 +25,20 @@ export class SQLiteBase {
             mkdirSync(dir, { recursive: true });
         }
         this.db = new Database(dbPath);
+        // ── Bootstrap PRAGMAs ─────────────────────────────────────────────────
+        //
+        // auto_vacuum MUST be set BEFORE any table is created on a new DB
+        // (SQLite requirement: see https://sqlite.org/pragma.html#pragma_auto_vacuum).
+        // On a fresh DB this sets the persistent header bit; on an existing DB it
+        // is a no-op and the conversion has to happen via VACUUM (handled below
+        // in `migrateAutoVacuumIfNeeded`).
+        //
+        // INCREMENTAL (=2) means free pages are kept on a freelist instead of
+        // being released at the OS level, and the daemon's TTL sweep can call
+        // `PRAGMA incremental_vacuum(N)` to reclaim N pages at a time without
+        // a full-table VACUUM. NONE (=0, the prior default) caused freelist
+        // growth on every TTL sweep with no way to shrink the on-disk file.
+        this.db.pragma('auto_vacuum = INCREMENTAL');
         // WAL mode optimization for better concurrency
         this.db.pragma('journal_mode = WAL');
         this.db.pragma('synchronous = NORMAL');
@@ -48,6 +62,73 @@ export class SQLiteBase {
         this.initSchema();
         this.runIndexMigrations();
         this.runPostMigrations();
+        this.migrateAutoVacuumIfNeeded();
+    }
+    /**
+     * One-shot migration: convert auto_vacuum from NONE (0) to INCREMENTAL (2)
+     * on existing DBs.
+     *
+     * Why this exists
+     * ---------------
+     * Setting `PRAGMA auto_vacuum = INCREMENTAL` in the constructor only takes
+     * effect on a *new* DB (before any table is created). On an existing DB it
+     * silently no-ops, so we must detect mode=0 and run a one-time `VACUUM`
+     * (which rewrites the whole file and flips the persistent header bit).
+     *
+     * Cost: O(DB size). For a 269 MB DB this is a few seconds of writer-lock.
+     * We log around it so an operator notices.
+     *
+     * Idempotent: after the first successful run, `auto_vacuum` reads as 2 and
+     * the migration short-circuits.
+     *
+     * Errors are warn-logged and swallowed — daemon startup must not fail.
+     * Worst case the DB stays on auto_vacuum=0 and the incremental_vacuum calls
+     * elsewhere become no-ops; freelist still grows but nothing breaks.
+     */
+    migrateAutoVacuumIfNeeded() {
+        try {
+            const current = this.db.pragma('auto_vacuum', { simple: true });
+            if (Number(current) === 2)
+                return; // already INCREMENTAL — done
+            logger.info(`[SQLiteStorage] migration: converting auto_vacuum ${current} → INCREMENTAL (2) via VACUUM (one-shot; may take seconds on large DBs)`);
+            const startMs = Date.now();
+            // Setting + VACUUM is the documented way to migrate. Both must execute
+            // outside any transaction; the constructor's caller has no open tx so
+            // we're safe.
+            this.db.pragma('auto_vacuum = INCREMENTAL');
+            this.db.exec('VACUUM');
+            const elapsedMs = Date.now() - startMs;
+            const after = this.db.pragma('auto_vacuum', { simple: true });
+            logger.info(`[SQLiteStorage] migration: auto_vacuum is now ${after} (took ${elapsedMs}ms)`);
+        }
+        catch (err) {
+            logger.warn(`[SQLiteStorage] migrateAutoVacuumIfNeeded failed: ${err}`);
+        }
+    }
+    /**
+     * Reclaim up to `maxPages` free pages from the auto_vacuum=INCREMENTAL
+     * freelist back to the OS. Returns the number of pages reclaimed.
+     *
+     * Called by the event-ttl-sweep service after TTL deletes accumulate free
+     * pages. Safe to call when auto_vacuum != INCREMENTAL — SQLite just returns
+     * 0 pages reclaimed.
+     *
+     * NOTE: not on the public SQLiteStorage facade by default — the daemon
+     * calls through `MaintenanceOperations.incrementalVacuum`. Kept here as a
+     * protected helper so any *Operations subclass can invoke it.
+     */
+    incrementalVacuumPages(maxPages) {
+        const before = this.db.pragma('freelist_count', { simple: true });
+        try {
+            this.db.exec(`PRAGMA incremental_vacuum(${Math.max(0, Math.floor(maxPages))})`);
+        }
+        catch (err) {
+            logger.warn(`[SQLiteStorage] incremental_vacuum(${maxPages}) failed: ${err}`);
+            return 0;
+        }
+        const after = this.db.pragma('freelist_count', { simple: true });
+        const reclaimed = Math.max(0, Number(before) - Number(after));
+        return reclaimed;
     }
     initSchema() {
         const thisDir = dirname(fileURLToPath(import.meta.url));
@@ -135,6 +216,99 @@ export class SQLiteBase {
         this.addColumnIfMissing('skill_invocations', 'phase', 'TEXT');
         this.addColumnIfMissing('skill_invocations', 'feature_slug', 'TEXT');
         this.addColumnIfMissing('skill_invocations', 'artifact_path', 'TEXT');
+        // Outcome instrumentation (v9.x). NOTE: SQLite ALTER TABLE ADD COLUMN can
+        // only add CHECK constraints that don't reference other rows — the
+        // outcome CHECK is therefore embedded in the column type clause below.
+        // spec 1100 Option C (2026-06-02): when ADDED on a fresh-ish legacy DB the
+        // column gets the RELAXED non-empty CHECK (matches schema.sql). DBs that
+        // already have the column with the OLD enum CHECK are widened in-place by
+        // rebuildOutcomeCheckIfNeeded (runPostMigrations).
+        this.addColumnIfMissing('sessions', 'outcome', `TEXT CHECK(outcome IS NULL OR length(outcome) > 0)`);
+        this.addColumnIfMissing('sessions', 'outcome_reason', 'TEXT');
+        this.addColumnIfMissing('sessions', 'commit_count', 'INTEGER DEFAULT 0');
+        this.addColumnIfMissing('sessions', 'reverted_commits', 'INTEGER DEFAULT 0');
+        this.addColumnIfMissing('sessions', 'user_violation_count', 'INTEGER DEFAULT 0');
+        this.addColumnIfMissing('sessions', 'classified_at', 'TEXT');
+        // Phase 2 metrics rollup (master roadmap §2): per-session counters.
+        // Default 0 keeps existing analytics queries (SUM/AVG) honest on legacy
+        // rows; back-fill happens at Stop time by classifyAndPersistOutcome.
+        this.addColumnIfMissing('sessions', 'intercept_count', 'INTEGER DEFAULT 0');
+        this.addColumnIfMissing('sessions', 'kb_inject_count', 'INTEGER DEFAULT 0');
+        this.addColumnIfMissing('sessions', 'skill_match_count', 'INTEGER DEFAULT 0');
+        // spec 1100 Option C (2026-06-02): relaxed CHECK (see sessions.outcome).
+        this.addColumnIfMissing('tasks', 'outcome', `TEXT CHECK(outcome IS NULL OR length(outcome) > 0)`);
+        this.addColumnIfMissing('tasks', 'outcome_reason', 'TEXT');
+        this.addColumnIfMissing('tasks', 'commit_count', 'INTEGER DEFAULT 0');
+        this.addColumnIfMissing('tasks', 'reverted_commits', 'INTEGER DEFAULT 0');
+        this.addColumnIfMissing('tasks', 'user_violation_count', 'INTEGER DEFAULT 0');
+        this.addColumnIfMissing('tasks', 'classified_at', 'TEXT');
+        // decision 265f59d5 (2026-06-08): LLM task-boundary classifier idempotency
+        // marker. Stamped on a task row when the async classifier (Option A) has
+        // already run for the prompt that minted it, so a re-delivered / replayed
+        // event never re-spawns claude or re-attributes the same prompt twice.
+        // Nullable TEXT (ISO timestamp); NULL = not yet classified.
+        this.addColumnIfMissing('tasks', 'llm_classified_at', 'TEXT');
+        // Task-tracking overhaul (2026-05-27): write-time noise classification.
+        // ALTER ADD COLUMN cannot enforce NOT NULL without a DEFAULT on legacy
+        // rows — DEFAULT 0 keeps existing data intact. The post-migration
+        // backfill (backfillTasksIsNoiseIfNeeded) flips matching rows to 1.
+        this.addColumnIfMissing('tasks', 'is_noise', 'INTEGER NOT NULL DEFAULT 0');
+        // spec b1480935 (2026-06-01): task_kind successor column. SQLite ALTER
+        // TABLE ADD COLUMN with NOT NULL DEFAULT 'user' back-fills every legacy
+        // row to 'user' atomically; the post-migration backfill
+        // (backfillTasksTaskKindIfNeeded) then promotes envelope/system rows
+        // to their granular kind via title-prefix sniff. The CHECK constraint
+        // here is the same one schema.sql declares for fresh DBs.
+        this.addColumnIfMissing('tasks', 'task_kind', `TEXT NOT NULL DEFAULT 'user' CHECK(task_kind IN ('user','agent-callback','image','system'))`);
+        // C1 (spec 0854, 2026-06-02): the pending_specs table was retired and is
+        // DROPped by schema.sql. Its former `source` column migration + spec_path
+        // index migration were removed here — schema.sql runs AFTER these column
+        // migrations, so any addColumn/createIndex targeting pending_specs would
+        // hit a non-existent table on fresh DBs.
+        // v9.x MVP1: KB injection metadata column. Stores JSON array of KB hits
+        // (page name + score + refs) for the 'UserPromptSubmitHandler:kb' source.
+        this.addColumnIfMissing('injections', 'metadata_json', 'TEXT');
+        // F3 (audit-20260522 migration 009): writer-side tool_output 50KB truncation
+        // marker. Legacy rows default to 0 (full content preserved).
+        this.addColumnIfMissing('events', 'tool_output_truncated', 'INTEGER DEFAULT 0');
+        // decision-flow-overhaul (2026-05-28): link routing rows back to the decision
+        // that triggered the spawn. Both columns default NULL (additive).
+        this.addColumnIfMissing('routing_events', 'decision_id', 'TEXT');
+        this.addColumnIfMissing('routing_events', 'spawn_id', 'TEXT');
+        // decision-flow-overhaul (2026-05-28): update pending_specs.source CHECK to
+        // include 'decision'. SQLite does NOT support altering CHECK constraints on
+        // existing columns via ALTER TABLE, so for existing DBs the guard lives in
+        // application code (DecisionStore) rather than the schema. New DBs get the
+        // full CHECK via schema.sql CREATE TABLE.
+        // (no ALTER needed — addColumnIfMissing does nothing for existing columns)
+        // spec 1200 (2026-05-28): decision-maker recommended_agents/skills columns.
+        // Additive — existing rows get NULL by default.
+        this.addColumnIfMissing('decisions', 'recommended_agents', 'TEXT');
+        this.addColumnIfMissing('decisions', 'recommended_skills', 'TEXT');
+        // Option B (decision b95e0956, 2026-05-29) bypass-governance fields.
+        // bypass_flag=1 marks decisions resolved without a decision-maker spawn
+        // trace; bypass_reason holds the operator-supplied justification.
+        // Existing rows default to 0 / NULL — preserves legacy contract.
+        this.addColumnIfMissing('decisions', 'bypass_flag', 'INTEGER NOT NULL DEFAULT 0');
+        this.addColumnIfMissing('decisions', 'bypass_reason', 'TEXT');
+        // C1 (2026-06-02): unified approval subsystem. decisions absorbs the
+        // retired pending_specs table — kind distinguishes daemon-minted decision
+        // rows ('decision') from externally-registered spec rows ('spec'). The
+        // CHECK constraint lives in schema.sql for new DBs; legacy DBs get the
+        // column without the CHECK (enforced in app code), mirroring the existing
+        // status-CHECK migration note above. Existing rows default to 'decision'.
+        this.addColumnIfMissing('decisions', 'kind', "TEXT NOT NULL DEFAULT 'decision'");
+        this.addColumnIfMissing('decisions', 'spec_source', 'TEXT');
+        this.addColumnIfMissing('decisions', 'spec_intent_json', 'TEXT');
+        // decision-maker optimization Batch 1.1 (decision a5d5a85b, 2026-06-02):
+        // implementation-outcome column. NOTE: outcome (success|failed|partial) is
+        // the *implementation result* and is INDEPENDENT of status (the approval
+        // lifecycle pending/resolved/bypassed/expired). Mirrors the sessions/tasks
+        // outcome column convention (base.ts above). The enum is enforced in app
+        // code (writeDecisionOutcome); the column-level CHECK only guards non-empty
+        // — matching the relaxed sessions/tasks outcome CHECK so a future enum
+        // extension needs no in-place rebuild. Existing rows default to NULL.
+        this.addColumnIfMissing('decisions', 'outcome', `TEXT CHECK(outcome IS NULL OR length(outcome) > 0)`);
     }
     /**
      * Index migrations run AFTER initSchema(). Each call is guarded by hasIndex
@@ -153,17 +327,45 @@ export class SQLiteBase {
         this.createIndexIfMissing('idx_events_session_ts', `CREATE INDEX IF NOT EXISTS idx_events_session_ts ON events(session_id, timestamp DESC)`);
         this.createIndexIfMissing('idx_routing_events_session_ts', `CREATE INDEX IF NOT EXISTS idx_routing_events_session_ts ON routing_events(session_id, ts DESC)`);
         this.createIndexIfMissing('idx_skill_invocations_session_ts', `CREATE INDEX IF NOT EXISTS idx_skill_invocations_session_ts ON skill_invocations(session_id, timestamp DESC)`);
+        // spec b1480935 (2026-06-01): task_kind index for hot WHERE filters.
+        this.createIndexIfMissing('idx_tasks_kind', `CREATE INDEX IF NOT EXISTS idx_tasks_kind ON tasks(task_kind)`);
         // Phase 1 Refactor: Additional performance indexes
         this.createIndexIfMissing('idx_routing_events_obeyed_ts', `CREATE INDEX IF NOT EXISTS idx_routing_events_obeyed_ts ON routing_events(obeyed, ts DESC)`);
         this.createIndexIfMissing('idx_events_session_hook', `CREATE INDEX IF NOT EXISTS idx_events_session_hook ON events(session_id, hook_type, timestamp DESC)`);
         this.createIndexIfMissing('idx_injections_session_handler', `CREATE INDEX IF NOT EXISTS idx_injections_session_handler ON injections(session_id, source_handler)`);
         this.createIndexIfMissing('idx_routing_events_type_ts', `CREATE INDEX IF NOT EXISTS idx_routing_events_type_ts ON routing_events(routed_to_type, ts DESC)`);
+        // Outcome instrumentation indexes (v9.x)
+        this.createIndexIfMissing('idx_sessions_outcome', `CREATE INDEX IF NOT EXISTS idx_sessions_outcome ON sessions(outcome)`);
+        this.createIndexIfMissing('idx_sessions_project_outcome', `CREATE INDEX IF NOT EXISTS idx_sessions_project_outcome ON sessions(project_path, outcome)`);
+        this.createIndexIfMissing('idx_tasks_session_outcome', `CREATE INDEX IF NOT EXISTS idx_tasks_session_outcome ON tasks(session_id, outcome)`);
+        // C1 (spec 0854, 2026-06-02): pending_specs.spec_path UNIQUE index removed
+        // — the table is retired/DROPped by schema.sql. Its dedup role now lives on
+        // decisions (idx_decisions_approval_token + app-level findSpecByPath probe).
+        // decision-flow-overhaul (2026-05-28): index for decision → spawn JOIN.
+        this.createIndexIfMissing('idx_routing_decision', `CREATE INDEX IF NOT EXISTS idx_routing_decision ON routing_events(decision_id)`);
+        // decision-flow-overhaul (2026-05-28): indexes for decisions table (new DBs
+        // get these via schema.sql; legacy DBs need the migration guard here).
+        this.createIndexIfMissing('idx_decisions_session', `CREATE INDEX IF NOT EXISTS idx_decisions_session ON decisions(session_id, created_at DESC)`);
+        this.createIndexIfMissing('idx_decisions_status', `CREATE INDEX IF NOT EXISTS idx_decisions_status ON decisions(status, expires_at)`);
+        this.createIndexIfMissing('idx_decisions_trigger', `CREATE INDEX IF NOT EXISTS idx_decisions_trigger ON decisions(trigger_event_id)`);
+        // C1 (2026-06-02): spec-kind row lookups + partial-unique approval_token.
+        // New DBs get these via schema.sql; legacy DBs need the migration guard.
+        this.createIndexIfMissing('idx_decisions_kind_session', `CREATE INDEX IF NOT EXISTS idx_decisions_kind_session ON decisions(kind, session_id, status)`);
+        this.createIndexIfMissing('idx_decisions_approval_token', `CREATE UNIQUE INDEX IF NOT EXISTS idx_decisions_approval_token ON decisions(approval_token) WHERE approval_token IS NOT NULL`);
     }
     /**
      * One-shot data migrations + deprecated table cleanup.
      */
     runPostMigrations() {
         this.backfillSessionsIfNeeded();
+        this.rebuildWorkflowRecommendationsCheckIfNeeded();
+        this.rebuildOutcomeCheckIfNeeded();
+        this.dropDeadKbQueryLogColumnsIfNeeded();
+        this.dropTokenUsageIfNeeded();
+        this.dropRoutingIsForcedIfNeeded();
+        this.backfillRoutingRoutedToTypePending();
+        this.backfillTasksIsNoiseIfNeeded();
+        this.backfillTasksTaskKindIfNeeded();
         const deprecatedTables = [
             'quality_issues', 'distill_results', 'v2_decisions',
             'v2_tool_events', 'experiment_assignments', 'routing_rule_states',
@@ -175,6 +377,374 @@ export class SQLiteBase {
             catch { /* ignore */ }
         }
     }
+    /**
+     * Task-tracking overhaul (2026-05-27): one-shot back-fill of `tasks.is_noise`
+     * from existing title heuristics. Idempotent — runs every startup but the
+     * WHERE clause restricts to rows that don't yet match the new state. We do
+     * NOT include the semantic blocklist ('批准', 'approve', '好', 'ok', '可以'
+     * …) intentionally; those are real human acknowledgements and the Bug 1
+     * spec-approval path now absorbs them — see spec § 3.2.
+     *
+     * Backfill only sets is_noise=1; rows already marked stay marked. We never
+     * flip 1→0 here (a future writer change could reclassify a legacy noise
+     * row; that case is best handled by a one-shot script, not boot-time).
+     *
+     * Errors are warn-logged and swallowed — daemon startup must not fail on
+     * data backfill. Worst case the column stays 0 and the Web filter shows
+     * extra rows (which the user can spot and report).
+     */
+    backfillTasksIsNoiseIfNeeded() {
+        if (!this.hasTable('tasks'))
+            return;
+        if (!this.hasColumn('tasks', 'is_noise'))
+            return;
+        try {
+            // Spec § 3.2 + § R1: backfill is intentionally CONSERVATIVE — we flip
+            // envelope / single-word slash / sub-3-char titles, but EXEMPT the
+            // semantic blocklist ('批准', 'approve', '好', 'ok', '可以', '同意', …).
+            // Those titles are real human acknowledgements that historically got
+            // mis-classified as user task starts; the Web should now SHOW them
+            // (so the user sees how many "approve" replies were silently dropped
+            // pre-Bug-1 fix). Going forward, SpecGate.handleApproval intercepts
+            // them BEFORE TaskSegmenter runs so they never reach createTask.
+            const res = this.db
+                .prepare(`UPDATE tasks SET is_noise = 1
+             WHERE is_noise = 0
+               AND LOWER(trim(title)) NOT IN
+                 ('批准', '同意', 'approve', '好', '好的', '嗯', 'ok', 'okay',
+                  '可以', '是', '是的', '继续', '停', 'stop', 'yes', 'no')
+               AND (
+                 length(trim(title)) < 3
+                 OR title LIKE '<task-notification>%'
+                 OR title LIKE '<system-reminder>%'
+                 OR title LIKE '<local-command-stdout>%'
+                 OR title LIKE '<command-message>%'
+                 OR title LIKE '<command-name>%'
+                 OR title LIKE '[Image #%'
+                 OR (substr(title, 1, 1) = '/' AND instr(title, ' ') = 0)
+               )`)
+                .run();
+            if (res.changes > 0) {
+                logger.info(`[SQLiteStorage] migration: backfilled tasks.is_noise=1 on ${res.changes} rows`);
+            }
+        }
+        catch (err) {
+            logger.warn(`[SQLiteStorage] migration: backfillTasksIsNoiseIfNeeded failed: ${err}`);
+        }
+    }
+    /**
+     * spec b1480935 (2026-06-01 Option A § OQ Q3): one-shot back-fill of
+     * `tasks.task_kind` from existing title prefixes. The is_noise column
+     * is deprecated but we keep its backfill running first so legacy rows
+     * still have a usable filter signal during the transition window.
+     *
+     * Mapping (mirrors NOISE_PREFIX_TO_KIND in core/utils/noise-prompt.ts):
+     *   - title LIKE '<task-notification>%'  → 'agent-callback'
+     *   - title LIKE '[Image #%'             → 'image'
+     *   - title LIKE '<system-reminder>%' / '<local-command-stdout>%' /
+     *     '<command-message>%' / '<command-name>%'  → 'system'
+     *   - everything else                    → stays 'user' (default)
+     *
+     * Idempotent: WHERE task_kind = 'user' AND title LIKE ... so a second
+     * boot only touches rows that haven't been promoted yet. We never demote
+     * (1→0 for is_noise had the same invariant) — a row already classified as
+     * 'agent-callback' stays put even if a future writer would have called it
+     * 'system'.
+     *
+     * Errors are warn-logged and swallowed — daemon startup must not fail on
+     * a backfill. Worst case the column stays 'user' on a few legacy envelopes
+     * and they surface in the default Web view (cosmetic only).
+     */
+    backfillTasksTaskKindIfNeeded() {
+        if (!this.hasTable('tasks'))
+            return;
+        if (!this.hasColumn('tasks', 'task_kind'))
+            return;
+        try {
+            // Each kind gets its own UPDATE so we can log per-bucket counts (helpful
+            // diagnostic when a user reports "why did 50 rows just turn grey?").
+            // Using a single CASE WHEN would collapse the count to one line.
+            const updates = [
+                { kind: 'agent-callback', like: '<task-notification>%' },
+                { kind: 'image', like: '[Image #%' },
+                { kind: 'system', like: '<system-reminder>%' },
+                { kind: 'system', like: '<local-command-stdout>%' },
+                { kind: 'system', like: '<command-message>%' },
+                { kind: 'system', like: '<command-name>%' },
+            ];
+            let total = 0;
+            for (const { kind, like } of updates) {
+                const res = this.db
+                    .prepare(`UPDATE tasks SET task_kind = ?
+               WHERE task_kind = 'user' AND title LIKE ?`)
+                    .run(kind, like);
+                total += res.changes;
+            }
+            if (total > 0) {
+                logger.info(`[SQLiteStorage] migration: backfilled tasks.task_kind on ${total} rows`);
+            }
+        }
+        catch (err) {
+            logger.warn(`[SQLiteStorage] migration: backfillTasksTaskKindIfNeeded failed: ${err}`);
+        }
+    }
+    /**
+     * Migration (Spec 2 § B1): drop the rerank-related columns from
+     * `kb_query_log` (strategy / rerank_cache_hit / rerank_failed) and the
+     * compound index that referenced `strategy`. Idempotent — new DBs created
+     * from the current schema.sql skip this entirely; legacy DBs lose the dead
+     * columns on next boot.
+     *
+     * SQLite ≥ 3.35 supports ALTER TABLE DROP COLUMN; better-sqlite3 12.x ships
+     * 3.46 so we use that directly. Errors are warn-logged but never thrown —
+     * worst case the columns linger and the writer just stops populating them.
+     */
+    dropDeadKbQueryLogColumnsIfNeeded() {
+        if (!this.hasTable('kb_query_log'))
+            return;
+        try {
+            // Drop the index first (still references `strategy`).
+            this.db.exec(`DROP INDEX IF EXISTS idx_kb_query_log_project_strategy`);
+        }
+        catch (err) {
+            logger.warn(`[SQLiteStorage] migration: drop idx_kb_query_log_project_strategy failed: ${err}`);
+        }
+        for (const col of ['strategy', 'rerank_cache_hit', 'rerank_failed']) {
+            if (!this.hasColumn('kb_query_log', col))
+                continue;
+            try {
+                this.db.exec(`ALTER TABLE kb_query_log DROP COLUMN ${col}`);
+                logger.info(`[SQLiteStorage] migration: dropped kb_query_log.${col}`);
+            }
+            catch (err) {
+                logger.warn(`[SQLiteStorage] migration: drop kb_query_log.${col} failed: ${err}`);
+            }
+        }
+    }
+    /**
+     * Migration (Spec 2 § B2): drop the unused `token_usage` table + indexes.
+     * 7d evidence showed 0 rows; the only "live" writer path was never wired
+     * through TokenTracker, so deleting is safe. Idempotent — DROP TABLE IF
+     * EXISTS noops on new DBs (schema.sql no longer declares the table).
+     */
+    dropTokenUsageIfNeeded() {
+        try {
+            this.db.exec(`DROP INDEX IF EXISTS idx_token_usage_session`);
+            this.db.exec(`DROP INDEX IF EXISTS idx_token_usage_timestamp`);
+            this.db.exec(`DROP TABLE IF EXISTS token_usage`);
+        }
+        catch (err) {
+            logger.warn(`[SQLiteStorage] migration: drop token_usage failed: ${err}`);
+        }
+    }
+    /**
+     * Migration (Spec 2 § B3): drop `routing_events.is_forced`. 7d evidence
+     * showed 0 rows with is_forced=1 — the field was reserved for a feature
+     * (forced/fallback routing) that was never wired. ALTER TABLE DROP COLUMN
+     * lands the column removal in-place; SQLite ≥ 3.35 required.
+     */
+    dropRoutingIsForcedIfNeeded() {
+        if (!this.hasTable('routing_events'))
+            return;
+        if (!this.hasColumn('routing_events', 'is_forced'))
+            return;
+        try {
+            this.db.exec(`ALTER TABLE routing_events DROP COLUMN is_forced`);
+            logger.info(`[SQLiteStorage] migration: dropped routing_events.is_forced`);
+        }
+        catch (err) {
+            logger.warn(`[SQLiteStorage] migration: drop routing_events.is_forced failed: ${err}`);
+        }
+    }
+    /**
+     * Migration (Spec 2 § B4): backfill `routing_events.routed_to_type='pending'`
+     * for the historical rows that user-prompt.ts wrote with NULL placeholder.
+     * 7d evidence showed 297/555 (54%) rows had NULL; with the new write-side
+     * default already minting 'pending', this one-shot UPDATE realigns history.
+     */
+    backfillRoutingRoutedToTypePending() {
+        if (!this.hasTable('routing_events'))
+            return;
+        try {
+            const res = this.db
+                .prepare(`UPDATE routing_events SET routed_to_type='pending' WHERE routed_to_type IS NULL`)
+                .run();
+            if (res.changes > 0) {
+                logger.info(`[SQLiteStorage] migration: backfilled routed_to_type='pending' on ${res.changes} rows`);
+            }
+        }
+        catch (err) {
+            logger.warn(`[SQLiteStorage] migration: backfill routed_to_type='pending' failed: ${err}`);
+        }
+    }
+    /**
+     * Migration 010: widen workflow_recommendations.outcome CHECK to include
+     * 'partial_accepted'. SQLite cannot ALTER a CHECK constraint in place — we
+     * detect legacy tables (CHECK string does NOT contain 'partial_accepted')
+     * and rebuild via temp-table copy/drop/rename. Idempotent — new DBs
+     * already created by schema.sql carry the new CHECK and skip.
+     *
+     * Errors are warn-logged but never thrown — daemon startup must not fail
+     * on a migration; worst case the new outcome value just gets rejected at
+     * write time and the calling code's try/catch swallows it (writes here are
+     * fire-and-forget observability).
+     */
+    rebuildWorkflowRecommendationsCheckIfNeeded() {
+        if (!this.hasTable('workflow_recommendations'))
+            return;
+        try {
+            const sqlRow = this.db
+                .prepare(`SELECT sql FROM sqlite_master WHERE type='table' AND name='workflow_recommendations'`)
+                .get();
+            if (!sqlRow || !sqlRow.sql)
+                return;
+            if (sqlRow.sql.includes('partial_accepted'))
+                return; // already widened
+            logger.info('[SQLiteStorage] migration 010: widening workflow_recommendations.outcome CHECK to include partial_accepted');
+            const rebuild = this.db.transaction(() => {
+                // 1) create the new table with widened CHECK
+                this.db.exec(`
+          CREATE TABLE workflow_recommendations_new (
+              id INTEGER PRIMARY KEY AUTOINCREMENT,
+              session_id TEXT NOT NULL,
+              timestamp TEXT NOT NULL,
+              rule_id TEXT NOT NULL,
+              matched_keywords TEXT,
+              recommended_workflow TEXT NOT NULL,
+              recommended_agent_type TEXT NOT NULL,
+              reason TEXT,
+              outcome TEXT CHECK(outcome IS NULL OR outcome IN ('pending','accepted','partial_accepted','rejected','ignored','bypassed')),
+              outcome_at TEXT,
+              source TEXT DEFAULT 'workflow_classifier',
+              created_at TEXT DEFAULT (datetime('now'))
+          );
+        `);
+                // 2) copy rows preserving id
+                this.db.exec(`
+          INSERT INTO workflow_recommendations_new (
+            id, session_id, timestamp, rule_id, matched_keywords,
+            recommended_workflow, recommended_agent_type, reason,
+            outcome, outcome_at, source, created_at
+          )
+          SELECT id, session_id, timestamp, rule_id, matched_keywords,
+                 recommended_workflow, recommended_agent_type, reason,
+                 outcome, outcome_at, source, created_at
+          FROM workflow_recommendations;
+        `);
+                // 3) drop old + rename new (indexes auto-dropped with table; recreated below)
+                this.db.exec(`DROP TABLE workflow_recommendations;`);
+                this.db.exec(`ALTER TABLE workflow_recommendations_new RENAME TO workflow_recommendations;`);
+                // 4) recreate indexes (mirrors schema.sql lines 378-379)
+                this.db.exec(`CREATE INDEX IF NOT EXISTS idx_workflow_rec_session ON workflow_recommendations(session_id, outcome);`);
+                this.db.exec(`CREATE INDEX IF NOT EXISTS idx_workflow_rec_ts ON workflow_recommendations(timestamp DESC);`);
+            });
+            rebuild();
+            logger.info('[SQLiteStorage] migration 010: workflow_recommendations rebuild complete');
+        }
+        catch (err) {
+            logger.warn(`[SQLiteStorage] migration 010: rebuild failed: ${err}`);
+        }
+    }
+    /**
+     * Migration 011 (spec 1100 Option C, 2026-06-02): widen the `outcome` CHECK
+     * on `sessions` + `tasks` from the fixed value enum
+     * `IN ('success','partial','failed','abandoned')` to a non-empty-string
+     * guard `length(outcome) > 0`. This lets the classifier emit the new
+     * `answered` outcome (and any future value) WITHOUT a table rebuild per
+     * value. The rebuild here is the ONE-TIME widening for existing live DBs.
+     *
+     * Why a rebuild: SQLite cannot ALTER a CHECK constraint in place. We mirror
+     * the migration-010 pattern: CREATE *_new → INSERT SELECT → DROP old →
+     * RENAME → recreate indexes.
+     *
+     * Robustness choices:
+     *   - **Idempotent**: detected by sniffing the stored CREATE TABLE `sql`. If
+     *     it no longer contains the old enum fragment (`outcome IN (`) we skip —
+     *     a second boot is a no-op. New DBs created from current schema.sql carry
+     *     the relaxed CHECK already and skip.
+     *   - **Data-preserving**: we don't hand-write the new column list. We take
+     *     the table's existing CREATE statement and string-replace ONLY the
+     *     outcome CHECK fragment, so every column (incl. migration-added ones
+     *     like task_kind / intercept_count) is preserved verbatim, then copy all
+     *     rows with `INSERT INTO new SELECT * FROM old`.
+     *   - **Index-preserving**: we snapshot every non-autoindex on the table
+     *     from sqlite_master BEFORE the drop and replay each `sql` after rename.
+     *   - **FK-safe**: tasks is referenced by task_events(task_id) FK. We run the
+     *     whole rebuild inside a transaction with foreign_keys temporarily OFF so
+     *     the DROP/RENAME doesn't cascade-delete task_events rows. (PRAGMA
+     *     foreign_keys is a no-op inside a transaction in SQLite, so we toggle it
+     *     around the transaction.)
+     *
+     * Errors are warn-logged, never thrown — daemon startup must not fail. Worst
+     * case the old enum CHECK lingers and writing `answered` is rejected at write
+     * time (callers swallow the throw); the operator can re-run after the next
+     * build.
+     */
+    rebuildOutcomeCheckIfNeeded() {
+        for (const table of ['sessions', 'tasks']) {
+            try {
+                if (!this.hasTable(table))
+                    continue;
+                const sqlRow = this.db
+                    .prepare(`SELECT sql FROM sqlite_master WHERE type='table' AND name=?`)
+                    .get(table);
+                if (!sqlRow || !sqlRow.sql)
+                    continue;
+                // Detect the OLD enum CHECK. The relaxed form uses `length(outcome)`,
+                // so the presence of `outcome IN (` is the legacy marker.
+                if (!/outcome\s+IN\s*\(/i.test(sqlRow.sql))
+                    continue; // already widened
+                logger.info(`[SQLiteStorage] migration 011: widening ${table}.outcome CHECK (enum → non-empty) via table rebuild`);
+                // Build the new CREATE statement by replacing the legacy outcome CHECK
+                // fragment in-place. Two known shapes (sessions vs tasks columns differ
+                // but the outcome CHECK fragment is identical):
+                //   outcome TEXT CHECK(outcome IS NULL OR outcome IN ('success', 'partial', 'failed', 'abandoned'))
+                const newTableName = `${table}_oc_new`;
+                const newCreate = sqlRow.sql
+                    .replace(/outcome\s+TEXT\s+CHECK\s*\(\s*outcome\s+IS\s+NULL\s+OR\s+outcome\s+IN\s*\([^)]*\)\s*\)/i, 'outcome TEXT CHECK(outcome IS NULL OR length(outcome) > 0)')
+                    // Point the CREATE at the temp table name. The original name appears
+                    // right after CREATE TABLE (optionally quoted) — replace the FIRST
+                    // occurrence only.
+                    .replace(new RegExp(`CREATE\\s+TABLE\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?["'\`]?${table}["'\`]?`, 'i'), `CREATE TABLE ${newTableName}`);
+                if (newCreate === sqlRow.sql || newCreate.includes(`outcome IN (`)) {
+                    logger.warn(`[SQLiteStorage] migration 011: could not rewrite ${table}.outcome CHECK (unexpected DDL shape) — skipping`);
+                    continue;
+                }
+                // Snapshot user indexes on the table (skip auto-indexes which have NULL sql).
+                const indexRows = this.db
+                    .prepare(`SELECT sql FROM sqlite_master WHERE type='index' AND tbl_name=? AND sql IS NOT NULL`)
+                    .all(table);
+                // task_events FK references tasks(id); toggle FK enforcement off around
+                // the transaction so DROP TABLE tasks doesn't cascade.
+                const fkOn = this.db.pragma('foreign_keys', { simple: true });
+                if (Number(fkOn) === 1)
+                    this.db.pragma('foreign_keys = OFF');
+                try {
+                    const rebuild = this.db.transaction(() => {
+                        this.db.exec(newCreate);
+                        this.db.exec(`INSERT INTO ${newTableName} SELECT * FROM ${table};`);
+                        this.db.exec(`DROP TABLE ${table};`);
+                        this.db.exec(`ALTER TABLE ${newTableName} RENAME TO ${table};`);
+                        for (const idx of indexRows) {
+                            // idx.sql is the original CREATE INDEX — replay verbatim. Make it
+                            // idempotent in case schema.sql already recreated it on this boot.
+                            const ddl = idx.sql.replace(/CREATE\s+(UNIQUE\s+)?INDEX\s+/i, (m) => /IF\s+NOT\s+EXISTS/i.test(idx.sql) ? m : `${m}IF NOT EXISTS `);
+                            this.db.exec(ddl);
+                        }
+                    });
+                    rebuild();
+                }
+                finally {
+                    if (Number(fkOn) === 1)
+                        this.db.pragma('foreign_keys = ON');
+                }
+                logger.info(`[SQLiteStorage] migration 011: ${table}.outcome CHECK widened`);
+            }
+            catch (err) {
+                logger.warn(`[SQLiteStorage] migration 011: ${table} rebuild failed: ${err}`);
+            }
+        }
+    }
     /**
      * 将 events 表按 session_id 聚合回填到 sessions 表，仅在 sessions 尚未对齐
      * （没有任何一行带 first_prompt）时触发。