@winspan/claude-forge 8.54.4 → 9.12.0

package/dist/core/storage/base.js

@@ -8,6 +8,12 @@
  * - 一次性 sessions 回填
  *
  * 不涉及业务读写。所有业务读写由 *Operations 类组合 db 实例实现。
+ *
+ * 迁移机制（无编号 .sql runner）：schema.sql 是当前 schema 的唯一真相
+ * （全 idempotent CREATE ... IF NOT EXISTS，每次启动 db.exec 重放）+
+ * 本文件 runColumnMigrations()/runIndexMigrations()/runPostMigrations()
+ * 对旧库就地补列/补索引/补 CHECK。migrations/ 目录下不存在被读取的编号 .sql。
+ * 详见 migrations/README.md。
  */
 import Database from 'better-sqlite3';
 import { readFileSync, existsSync, mkdirSync, statSync } from 'node:fs';
@@ -15,6 +21,48 @@ import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { DATABASE } from '../constants.js';
 import { logger } from '../utils/logger.js';
+import { extractSpawnFields } from '../event-fields.js';
+import { decodeToolInput } from './codec/tool-input-codec.js';
+/**
+ * Backfill window for events.decision_id / subagent_type (decision c425f26f,
+ * spec 1544 § 1.3, user ruling #4). The spec aligns the window to existing
+ * retention; the only retention constant that bounds recoverability is the
+ * event-ttl-sweep WARM TTL (default 7 days), past which `tool_input` is NULLed
+ * (gzip blob gone — nothing left to decode). We use 10 days (spec default) as a
+ * conservative-but-safe ceiling: rows older than the warm TTL simply have NULL
+ * tool_input and are skipped by the WHERE (`tool_input IS NOT NULL` implied by a
+ * successful decode). base.ts is in the leaf-most `core` layer and MUST NOT
+ * depend on the daemon ConfigStore (decision ed98c8e8), so this is a static
+ * constant, not a config read.
+ */
+export const SPAWN_FIELD_BACKFILL_WINDOW = "-10 days";
+/**
+ * Backfill window for the one-shot tasks.parent_task_id historical linkage
+ * (decision f47c2c90, spec 1711 § Phase 1.1, user ruling Q2 = -10 days). Aligned
+ * with SPAWN_FIELD_BACKFILL_WINDOW so the two boot-time backfills cover the same
+ * recent slice. Historical rows cannot read the in-memory agentJustReturned flag,
+ * so the backfill uses a WEAKER pure-SQL heuristic (ack-title + same session +
+ * ≤30min prior non-ack user task); anything ambiguous stays NULL (宁缺毋滥).
+ */
+export const TASK_PARENT_BACKFILL_WINDOW = "-10 days";
+/**
+ * Resume window in minutes (mirrors TASK_RESUME_WINDOW_MS=30min in the daemon
+ * TaskSegmenter). The parent backfill only links a follow-up ack task to a prior
+ * user task started within this window. Kept as a static constant here because
+ * base.ts is leaf-most core and MUST NOT depend on the daemon config (ed98c8e8).
+ */
+const TASK_PARENT_BACKFILL_WINDOW_MIN = 30;
+/**
+ * Conservative ack-title set for the parent backfill (decision f47c2c90). A
+ * follow-up task whose title is one of these short acknowledgements is treated
+ * as an approval/continue turn that should chain back to the prior user task.
+ * Mirrors the segmenter's ACK_CONTINUE_KEYWORDS spirit but is a SQL-side
+ * lowercase exact-match list (titles are short ack tokens, not free text).
+ */
+const TASK_PARENT_ACK_TITLES = [
+    '批准', '同意', 'approve', '好', '好的', '嗯', 'ok', 'okay',
+    '可以', '是', '是的', '继续', 'yes', '对', '行', '没问题',
+];
 export class SQLiteBase {
     db;
     dbPath;
@@ -25,6 +73,20 @@ export class SQLiteBase {
             mkdirSync(dir, { recursive: true });
         }
         this.db = new Database(dbPath);
+        // ── Bootstrap PRAGMAs ─────────────────────────────────────────────────
+        //
+        // auto_vacuum MUST be set BEFORE any table is created on a new DB
+        // (SQLite requirement: see https://sqlite.org/pragma.html#pragma_auto_vacuum).
+        // On a fresh DB this sets the persistent header bit; on an existing DB it
+        // is a no-op and the conversion has to happen via VACUUM (handled below
+        // in `migrateAutoVacuumIfNeeded`).
+        //
+        // INCREMENTAL (=2) means free pages are kept on a freelist instead of
+        // being released at the OS level, and the daemon's TTL sweep can call
+        // `PRAGMA incremental_vacuum(N)` to reclaim N pages at a time without
+        // a full-table VACUUM. NONE (=0, the prior default) caused freelist
+        // growth on every TTL sweep with no way to shrink the on-disk file.
+        this.db.pragma('auto_vacuum = INCREMENTAL');
         // WAL mode optimization for better concurrency
         this.db.pragma('journal_mode = WAL');
         this.db.pragma('synchronous = NORMAL');
@@ -48,6 +110,73 @@ export class SQLiteBase {
         this.initSchema();
         this.runIndexMigrations();
         this.runPostMigrations();
+        this.migrateAutoVacuumIfNeeded();
+    }
+    /**
+     * One-shot migration: convert auto_vacuum from NONE (0) to INCREMENTAL (2)
+     * on existing DBs.
+     *
+     * Why this exists
+     * ---------------
+     * Setting `PRAGMA auto_vacuum = INCREMENTAL` in the constructor only takes
+     * effect on a *new* DB (before any table is created). On an existing DB it
+     * silently no-ops, so we must detect mode=0 and run a one-time `VACUUM`
+     * (which rewrites the whole file and flips the persistent header bit).
+     *
+     * Cost: O(DB size). For a 269 MB DB this is a few seconds of writer-lock.
+     * We log around it so an operator notices.
+     *
+     * Idempotent: after the first successful run, `auto_vacuum` reads as 2 and
+     * the migration short-circuits.
+     *
+     * Errors are warn-logged and swallowed — daemon startup must not fail.
+     * Worst case the DB stays on auto_vacuum=0 and the incremental_vacuum calls
+     * elsewhere become no-ops; freelist still grows but nothing breaks.
+     */
+    migrateAutoVacuumIfNeeded() {
+        try {
+            const current = this.db.pragma('auto_vacuum', { simple: true });
+            if (Number(current) === 2)
+                return; // already INCREMENTAL — done
+            logger.info(`[SQLiteStorage] migration: converting auto_vacuum ${current} → INCREMENTAL (2) via VACUUM (one-shot; may take seconds on large DBs)`);
+            const startMs = Date.now();
+            // Setting + VACUUM is the documented way to migrate. Both must execute
+            // outside any transaction; the constructor's caller has no open tx so
+            // we're safe.
+            this.db.pragma('auto_vacuum = INCREMENTAL');
+            this.db.exec('VACUUM');
+            const elapsedMs = Date.now() - startMs;
+            const after = this.db.pragma('auto_vacuum', { simple: true });
+            logger.info(`[SQLiteStorage] migration: auto_vacuum is now ${after} (took ${elapsedMs}ms)`);
+        }
+        catch (err) {
+            logger.warn(`[SQLiteStorage] migrateAutoVacuumIfNeeded failed: ${err}`);
+        }
+    }
+    /**
+     * Reclaim up to `maxPages` free pages from the auto_vacuum=INCREMENTAL
+     * freelist back to the OS. Returns the number of pages reclaimed.
+     *
+     * Called by the event-ttl-sweep service after TTL deletes accumulate free
+     * pages. Safe to call when auto_vacuum != INCREMENTAL — SQLite just returns
+     * 0 pages reclaimed.
+     *
+     * NOTE: not on the public SQLiteStorage facade by default — the daemon
+     * calls through `MaintenanceOperations.incrementalVacuum`. Kept here as a
+     * protected helper so any *Operations subclass can invoke it.
+     */
+    incrementalVacuumPages(maxPages) {
+        const before = this.db.pragma('freelist_count', { simple: true });
+        try {
+            this.db.exec(`PRAGMA incremental_vacuum(${Math.max(0, Math.floor(maxPages))})`);
+        }
+        catch (err) {
+            logger.warn(`[SQLiteStorage] incremental_vacuum(${maxPages}) failed: ${err}`);
+            return 0;
+        }
+        const after = this.db.pragma('freelist_count', { simple: true });
+        const reclaimed = Math.max(0, Number(before) - Number(after));
+        return reclaimed;
     }
     initSchema() {
         const thisDir = dirname(fileURLToPath(import.meta.url));
@@ -131,10 +260,189 @@ export class SQLiteBase {
         this.addColumnIfMissing('sessions', 'first_prompt', 'TEXT');
         this.addColumnIfMissing('routing_events', 'skill_confidence', 'REAL');
         this.addColumnIfMissing('routing_events', 'skill_source', 'TEXT');
+        // R9 (decision 1544, 2026-06-10): routing row provenance. NULL for normal
+        // hook-driven events; 'programmatic' for rows minted by code paths. Nullable,
+        // DEFAULT NULL keeps every legacy row untouched.
+        this.addColumnIfMissing('routing_events', 'source', 'TEXT');
         this.addColumnIfMissing('skill_invocations', 'workflow', 'TEXT');
         this.addColumnIfMissing('skill_invocations', 'phase', 'TEXT');
         this.addColumnIfMissing('skill_invocations', 'feature_slug', 'TEXT');
         this.addColumnIfMissing('skill_invocations', 'artifact_path', 'TEXT');
+        // audit #2 (decision f61b8a0c, 2026-06-09): distinguish "injected" rows from
+        // "really invoked" rows. The UserPromptSubmit auto-match path writes a row
+        // with success=1 the moment a skill is INJECTED — it never observes whether
+        // the skill was actually followed. That made every web "skill hit /
+        // effectiveness" metric (weekly-report / drift-detector / skill-stats) read
+        // injection counts as if they were real-call counts.
+        //
+        // Fix without breaking the old `success` semantics (5+ readers depend on the
+        // old column): add a NULLABLE marker `recorded_at_inject`. Auto-match
+        // injection rows stamp it 1; real-call rows (MCP skill_invoke /
+        // events.tool_name='Skill') leave it NULL. Readers filter on it to separate
+        // "injected" from "really invoked". DEFAULT NULL keeps legacy rows untouched.
+        this.addColumnIfMissing('skill_invocations', 'recorded_at_inject', 'INTEGER');
+        // Skill usefulness feedback (decision d24cd3a2 P0, spec
+        // docs/design/2026-06-11/1524-skill-usefulness-feedback-spec.md). Agent
+        // POST-USE self-assessment of whether a pulled skill's CONTENT was actionable
+        // on THIS project's task. DISTINCT from `success` (which only means the
+        // invoke call didn't throw) — usefulness measures content transfer.
+        //   usefulness      = 'helped' | 'partial' | 'not-actionable' (advisory enum,
+        //                     stored as free TEXT, nullable, DEFAULT NULL).
+        //   usefulness_note = one-line "what was/wasn't applicable", nullable.
+        // Nullable + no backfill → every legacy row reads usefulness=NULL untouched,
+        // verbatim mirror of the reason/workflow/recorded_at_inject additive columns.
+        this.addColumnIfMissing('skill_invocations', 'usefulness', 'TEXT');
+        this.addColumnIfMissing('skill_invocations', 'usefulness_note', 'TEXT');
+        // Project scope (decision 39839e30 Part 2, 2026-06-13): the project a skill
+        // pull belongs to, so the workplace "Skill 调用" KPI can filter by project
+        // like the other 3 KPIs already do. Mirror of kb_query_log.project_path.
+        // Nullable, DEFAULT NULL → every legacy row reads project_path=NULL untouched;
+        // aggregations only add `AND project_path = ?` when a project is passed
+        // (additive, back-compat with Phase 2c / Skill 详情页 / cf skill usefulness).
+        // Historical rows are one-shot back-filled from sessions.project_path in
+        // runPostMigrations → backfillSkillInvocationsProjectPathIfNeeded (join miss
+        // → stays NULL).
+        this.addColumnIfMissing('skill_invocations', 'project_path', 'TEXT');
+        // Outcome instrumentation (v9.x). NOTE: SQLite ALTER TABLE ADD COLUMN can
+        // only add CHECK constraints that don't reference other rows — the
+        // outcome CHECK is therefore embedded in the column type clause below.
+        // spec 1100 Option C (2026-06-02): when ADDED on a fresh-ish legacy DB the
+        // column gets the RELAXED non-empty CHECK (matches schema.sql). DBs that
+        // already have the column with the OLD enum CHECK are widened in-place by
+        // rebuildOutcomeCheckIfNeeded (runPostMigrations).
+        this.addColumnIfMissing('sessions', 'outcome', `TEXT CHECK(outcome IS NULL OR length(outcome) > 0)`);
+        this.addColumnIfMissing('sessions', 'outcome_reason', 'TEXT');
+        this.addColumnIfMissing('sessions', 'commit_count', 'INTEGER DEFAULT 0');
+        this.addColumnIfMissing('sessions', 'reverted_commits', 'INTEGER DEFAULT 0');
+        this.addColumnIfMissing('sessions', 'user_violation_count', 'INTEGER DEFAULT 0');
+        this.addColumnIfMissing('sessions', 'classified_at', 'TEXT');
+        // Phase 2 metrics rollup (master roadmap §2): per-session counters.
+        // Default 0 keeps existing analytics queries (SUM/AVG) honest on legacy
+        // rows; back-fill happens at Stop time by classifyAndPersistOutcome.
+        this.addColumnIfMissing('sessions', 'intercept_count', 'INTEGER DEFAULT 0');
+        this.addColumnIfMissing('sessions', 'kb_inject_count', 'INTEGER DEFAULT 0');
+        this.addColumnIfMissing('sessions', 'skill_match_count', 'INTEGER DEFAULT 0');
+        // spec 1100 Option C (2026-06-02): relaxed CHECK (see sessions.outcome).
+        this.addColumnIfMissing('tasks', 'outcome', `TEXT CHECK(outcome IS NULL OR length(outcome) > 0)`);
+        this.addColumnIfMissing('tasks', 'outcome_reason', 'TEXT');
+        this.addColumnIfMissing('tasks', 'commit_count', 'INTEGER DEFAULT 0');
+        this.addColumnIfMissing('tasks', 'reverted_commits', 'INTEGER DEFAULT 0');
+        this.addColumnIfMissing('tasks', 'user_violation_count', 'INTEGER DEFAULT 0');
+        this.addColumnIfMissing('tasks', 'classified_at', 'TEXT');
+        // decision 265f59d5 (2026-06-08): LLM task-boundary classifier idempotency
+        // marker. Stamped on a task row when the async classifier (Option A) has
+        // already run for the prompt that minted it, so a re-delivered / replayed
+        // event never re-spawns claude or re-attributes the same prompt twice.
+        // Nullable TEXT (ISO timestamp); NULL = not yet classified.
+        this.addColumnIfMissing('tasks', 'llm_classified_at', 'TEXT');
+        // Task-tracking overhaul (2026-05-27): write-time noise classification.
+        // ALTER ADD COLUMN cannot enforce NOT NULL without a DEFAULT on legacy
+        // rows — DEFAULT 0 keeps existing data intact. The post-migration
+        // backfill (backfillTasksIsNoiseIfNeeded) flips matching rows to 1.
+        this.addColumnIfMissing('tasks', 'is_noise', 'INTEGER NOT NULL DEFAULT 0');
+        // spec b1480935 (2026-06-01): task_kind successor column. SQLite ALTER
+        // TABLE ADD COLUMN with NOT NULL DEFAULT 'user' back-fills every legacy
+        // row to 'user' atomically; the post-migration backfill
+        // (backfillTasksTaskKindIfNeeded) then promotes envelope/system rows
+        // to their granular kind via title-prefix sniff. The CHECK constraint
+        // here is the same one schema.sql declares for fresh DBs.
+        this.addColumnIfMissing('tasks', 'task_kind', `TEXT NOT NULL DEFAULT 'user' CHECK(task_kind IN ('user','agent-callback','image','system'))`);
+        // decision f47c2c90 (二期B, spec 1711): parent_task_id self-referencing FK
+        // for cross-turn workflow linkage on tasks that carry NO decision_id. The
+        // TaskSegmenter fills it (conservatively, triple-gate) for approval/continue
+        // follow-up turns; timeline aggregates the parent chain only when the task
+        // has no decision_id (else-branch fallback, strictly mutually exclusive with
+        // the decision_id path). Nullable, DEFAULT NULL → every legacy row untouched.
+        // SQLite ALTER ADD COLUMN cannot carry inline REFERENCES, so legacy DBs get
+        // a plain TEXT column with no FK enforcement — the app layer never relies on
+        // SQLite FK enforce (logical FK only). The one-shot backfill runs in
+        // runPostMigrations (backfillTasksParentIfNeeded).
+        this.addColumnIfMissing('tasks', 'parent_task_id', 'TEXT');
+        // C1 (spec 0854, 2026-06-02): the pending_specs table was retired and is
+        // DROPped by schema.sql. Its former `source` column migration + spec_path
+        // index migration were removed here — schema.sql runs AFTER these column
+        // migrations, so any addColumn/createIndex targeting pending_specs would
+        // hit a non-existent table on fresh DBs.
+        // v9.x MVP1: KB injection metadata column. Stores JSON array of KB hits
+        // (page name + score + refs) for the 'UserPromptSubmitHandler:kb' source.
+        this.addColumnIfMissing('injections', 'metadata_json', 'TEXT');
+        // KB 采纳 telemetry（decision 148f7a0a, 2026-06-10 审计）：注入后同会话
+        // 出现主动 KB MCP 调用（mcp__claude-forge__knowledge*）时，PostToolUse
+        // handler 给该会话所有 source_handler LIKE '%:kb' 且 adopted_at IS NULL
+        // 的注入行盖 epoch-ms 时间戳。4 周后用一条 SQL 即可回答「注入的 KB 被
+        // 用了没」（adopted/total）。Nullable INTEGER；NULL = 从未被采纳。
+        this.addColumnIfMissing('injections', 'adopted_at', 'INTEGER');
+        // F3 (audit-20260522 migration 009): writer-side tool_output 50KB truncation
+        // marker. Legacy rows default to 0 (full content preserved).
+        this.addColumnIfMissing('events', 'tool_output_truncated', 'INTEGER DEFAULT 0');
+        // decision c425f26f (spec 1544): cross-task execution-chain aggregation.
+        // decision_id + subagent_type are extracted to PLAINTEXT columns so a SQL
+        // GROUP BY decision_id can stitch a workflow fragmented across per-prompt
+        // tasks. Both nullable, DEFAULT NULL → every legacy row untouched.
+        // CRITICAL: these are plaintext TEXT — they NEVER flow through the gzip
+        // codec (gzip one-way-door); the go-forward writer (events.ts) extracts them
+        // pre-codec, the one-shot backfill (runPostMigrations) decodes gzip once to
+        // fill historical rows. ALTER ADD COLUMN nullable is an O(1) metadata op
+        // (no row rewrite) so this is cheap even on the 295 MB events table.
+        this.addColumnIfMissing('events', 'decision_id', 'TEXT');
+        this.addColumnIfMissing('events', 'subagent_type', 'TEXT');
+        // decision-flow-overhaul (2026-05-28): link routing rows back to the decision
+        // that triggered the spawn. Both columns default NULL (additive).
+        this.addColumnIfMissing('routing_events', 'decision_id', 'TEXT');
+        this.addColumnIfMissing('routing_events', 'spawn_id', 'TEXT');
+        // decision d24cd3a2 Task B (2026-06-11): make agent KB pulls attributable.
+        // kb_query_log gains the same attribution fields as skill_invocations so a
+        // deliberate `cf knowledge query --reason` pull (source='cli') is
+        // distinguishable from the daemon's automatic per-prompt probe
+        // (source='daemon-probe'). All nullable — legacy rows stay NULL, no backfill.
+        this.addColumnIfMissing('kb_query_log', 'reason', 'TEXT');
+        this.addColumnIfMissing('kb_query_log', 'source', 'TEXT');
+        this.addColumnIfMissing('kb_query_log', 'agent_id', 'TEXT');
+        this.addColumnIfMissing('kb_query_log', 'workflow', 'TEXT');
+        this.addColumnIfMissing('kb_query_log', 'phase', 'TEXT');
+        // decision 096309e4 batch 1 item ① (2026-06-13): KB post-use usefulness
+        // self-assessment, mirroring skill_invocations.usefulness. An agent that
+        // pulled KB via `cf knowledge query/fetch --reason` rates whether the CONTENT
+        // helped on THIS task. Nullable + no backfill → legacy / daemon-probe rows
+        // read usefulness=NULL untouched. This is the real "KB was used AND helped"
+        // signal that the dead injections.adopted_at path (MCP-only, subagents have
+        // zero MCP) could never capture.
+        this.addColumnIfMissing('kb_query_log', 'usefulness', 'TEXT');
+        this.addColumnIfMissing('kb_query_log', 'usefulness_note', 'TEXT');
+        // decision-flow-overhaul (2026-05-28): update pending_specs.source CHECK to
+        // include 'decision'. SQLite does NOT support altering CHECK constraints on
+        // existing columns via ALTER TABLE, so for existing DBs the guard lives in
+        // application code (DecisionStore) rather than the schema. New DBs get the
+        // full CHECK via schema.sql CREATE TABLE.
+        // (no ALTER needed — addColumnIfMissing does nothing for existing columns)
+        // spec 1200 (2026-05-28): decision-maker recommended_agents/skills columns.
+        // Additive — existing rows get NULL by default.
+        this.addColumnIfMissing('decisions', 'recommended_agents', 'TEXT');
+        this.addColumnIfMissing('decisions', 'recommended_skills', 'TEXT');
+        // Option B (decision b95e0956, 2026-05-29) bypass-governance fields.
+        // bypass_flag=1 marks decisions resolved without a decision-maker spawn
+        // trace; bypass_reason holds the operator-supplied justification.
+        // Existing rows default to 0 / NULL — preserves legacy contract.
+        this.addColumnIfMissing('decisions', 'bypass_flag', 'INTEGER NOT NULL DEFAULT 0');
+        this.addColumnIfMissing('decisions', 'bypass_reason', 'TEXT');
+        // C1 (2026-06-02): unified approval subsystem. decisions absorbs the
+        // retired pending_specs table — kind distinguishes daemon-minted decision
+        // rows ('decision') from externally-registered spec rows ('spec'). The
+        // CHECK constraint lives in schema.sql for new DBs; legacy DBs get the
+        // column without the CHECK (enforced in app code), mirroring the existing
+        // status-CHECK migration note above. Existing rows default to 'decision'.
+        this.addColumnIfMissing('decisions', 'kind', "TEXT NOT NULL DEFAULT 'decision'");
+        this.addColumnIfMissing('decisions', 'spec_source', 'TEXT');
+        this.addColumnIfMissing('decisions', 'spec_intent_json', 'TEXT');
+        // decision-maker optimization Batch 1.1 (decision a5d5a85b, 2026-06-02):
+        // implementation-outcome column. NOTE: outcome (success|failed|partial) is
+        // the *implementation result* and is INDEPENDENT of status (the approval
+        // lifecycle pending/resolved/bypassed/expired). Mirrors the sessions/tasks
+        // outcome column convention (base.ts above). The enum is enforced in app
+        // code (writeDecisionOutcome); the column-level CHECK only guards non-empty
+        // — matching the relaxed sessions/tasks outcome CHECK so a future enum
+        // extension needs no in-place rebuild. Existing rows default to NULL.
+        this.addColumnIfMissing('decisions', 'outcome', `TEXT CHECK(outcome IS NULL OR length(outcome) > 0)`);
     }
     /**
      * Index migrations run AFTER initSchema(). Each call is guarded by hasIndex
@@ -148,22 +456,69 @@ export class SQLiteBase {
     runIndexMigrations() {
         this.createIndexIfMissing('idx_skill_invocations_workflow', `CREATE INDEX IF NOT EXISTS idx_skill_invocations_workflow ON skill_invocations(workflow, phase)`);
         this.createIndexIfMissing('idx_skill_invocations_feature', `CREATE INDEX IF NOT EXISTS idx_skill_invocations_feature ON skill_invocations(feature_slug)`);
+        // decision 39839e30 Part 2: project-scoped skill KPI filtering.
+        this.createIndexIfMissing('idx_skill_invocations_project', `CREATE INDEX IF NOT EXISTS idx_skill_invocations_project ON skill_invocations(project_path)`);
         this.createIndexIfMissing('idx_sessions_start_time', `CREATE INDEX IF NOT EXISTS idx_sessions_start_time ON sessions(start_time DESC)`);
         // Composite indexes for high-frequency session-scoped queries
         this.createIndexIfMissing('idx_events_session_ts', `CREATE INDEX IF NOT EXISTS idx_events_session_ts ON events(session_id, timestamp DESC)`);
         this.createIndexIfMissing('idx_routing_events_session_ts', `CREATE INDEX IF NOT EXISTS idx_routing_events_session_ts ON routing_events(session_id, ts DESC)`);
         this.createIndexIfMissing('idx_skill_invocations_session_ts', `CREATE INDEX IF NOT EXISTS idx_skill_invocations_session_ts ON skill_invocations(session_id, timestamp DESC)`);
+        // spec b1480935 (2026-06-01): task_kind index for hot WHERE filters.
+        this.createIndexIfMissing('idx_tasks_kind', `CREATE INDEX IF NOT EXISTS idx_tasks_kind ON tasks(task_kind)`);
+        // decision f47c2c90 (二期B): index on the parent FK column so the timeline
+        // chain query's `WHERE parent_task_id = ?` (向下收子 task) hits an index.
+        this.createIndexIfMissing('idx_tasks_parent', `CREATE INDEX IF NOT EXISTS idx_tasks_parent ON tasks(parent_task_id)`);
         // Phase 1 Refactor: Additional performance indexes
         this.createIndexIfMissing('idx_routing_events_obeyed_ts', `CREATE INDEX IF NOT EXISTS idx_routing_events_obeyed_ts ON routing_events(obeyed, ts DESC)`);
         this.createIndexIfMissing('idx_events_session_hook', `CREATE INDEX IF NOT EXISTS idx_events_session_hook ON events(session_id, hook_type, timestamp DESC)`);
+        // decision 7a3d07b5: covering index for the agent-board top_tools join.
+        // (event_id, hook_type, tool_name) lets the per-row events lookup satisfy the
+        // PostToolUse + tool_name filter and project tool_name without a table hit;
+        // paired with `INDEXED BY idx_task_events_task` in tasks.queryAgentBoardTasks
+        // it flips the join driver off the full PostToolUse scan (485ms → ~10ms).
+        this.createIndexIfMissing('idx_events_eid_hook_tool', `CREATE INDEX IF NOT EXISTS idx_events_eid_hook_tool ON events(event_id, hook_type, tool_name)`);
+        // decision c425f26f (spec 1544): cross-task decision_id aggregation indexes.
+        this.createIndexIfMissing('idx_events_decision_id', `CREATE INDEX IF NOT EXISTS idx_events_decision_id ON events(decision_id)`);
+        this.createIndexIfMissing('idx_events_decision_spawn', `CREATE INDEX IF NOT EXISTS idx_events_decision_spawn ON events(decision_id, hook_type, tool_name, timestamp)`);
         this.createIndexIfMissing('idx_injections_session_handler', `CREATE INDEX IF NOT EXISTS idx_injections_session_handler ON injections(session_id, source_handler)`);
         this.createIndexIfMissing('idx_routing_events_type_ts', `CREATE INDEX IF NOT EXISTS idx_routing_events_type_ts ON routing_events(routed_to_type, ts DESC)`);
+        // Outcome instrumentation indexes (v9.x)
+        this.createIndexIfMissing('idx_sessions_outcome', `CREATE INDEX IF NOT EXISTS idx_sessions_outcome ON sessions(outcome)`);
+        this.createIndexIfMissing('idx_sessions_project_outcome', `CREATE INDEX IF NOT EXISTS idx_sessions_project_outcome ON sessions(project_path, outcome)`);
+        this.createIndexIfMissing('idx_tasks_session_outcome', `CREATE INDEX IF NOT EXISTS idx_tasks_session_outcome ON tasks(session_id, outcome)`);
+        // C1 (spec 0854, 2026-06-02): pending_specs.spec_path UNIQUE index removed
+        // — the table is retired/DROPped by schema.sql. Its dedup role now lives on
+        // decisions (idx_decisions_approval_token + app-level findSpecByPath probe).
+        // decision-flow-overhaul (2026-05-28): index for decision → spawn JOIN.
+        this.createIndexIfMissing('idx_routing_decision', `CREATE INDEX IF NOT EXISTS idx_routing_decision ON routing_events(decision_id)`);
+        // decision-flow-overhaul (2026-05-28): indexes for decisions table (new DBs
+        // get these via schema.sql; legacy DBs need the migration guard here).
+        this.createIndexIfMissing('idx_decisions_session', `CREATE INDEX IF NOT EXISTS idx_decisions_session ON decisions(session_id, created_at DESC)`);
+        this.createIndexIfMissing('idx_decisions_status', `CREATE INDEX IF NOT EXISTS idx_decisions_status ON decisions(status, expires_at)`);
+        this.createIndexIfMissing('idx_decisions_trigger', `CREATE INDEX IF NOT EXISTS idx_decisions_trigger ON decisions(trigger_event_id)`);
+        // C1 (2026-06-02): spec-kind row lookups + partial-unique approval_token.
+        // New DBs get these via schema.sql; legacy DBs need the migration guard.
+        this.createIndexIfMissing('idx_decisions_kind_session', `CREATE INDEX IF NOT EXISTS idx_decisions_kind_session ON decisions(kind, session_id, status)`);
+        this.createIndexIfMissing('idx_decisions_approval_token', `CREATE UNIQUE INDEX IF NOT EXISTS idx_decisions_approval_token ON decisions(approval_token) WHERE approval_token IS NOT NULL`);
     }
     /**
      * One-shot data migrations + deprecated table cleanup.
      */
     runPostMigrations() {
         this.backfillSessionsIfNeeded();
+        this.rebuildWorkflowRecommendationsCheckIfNeeded();
+        this.rebuildOutcomeCheckIfNeeded();
+        this.widenDecisionsStatusCheckIfNeeded();
+        this.dropDecisionsWorkflowTypeIfNeeded();
+        this.dropDeadKbQueryLogColumnsIfNeeded();
+        this.dropTokenUsageIfNeeded();
+        this.dropRoutingIsForcedIfNeeded();
+        this.backfillRoutingRoutedToTypePending();
+        this.backfillTasksIsNoiseIfNeeded();
+        this.backfillTasksTaskKindIfNeeded();
+        this.backfillSkillInvocationsProjectPathIfNeeded();
+        this.backfillEventsDecisionIdIfNeeded();
+        this.backfillTasksParentIfNeeded();
         const deprecatedTables = [
             'quality_issues', 'distill_results', 'v2_decisions',
             'v2_tool_events', 'experiment_assignments', 'routing_rule_states',
@@ -175,6 +530,744 @@ export class SQLiteBase {
             catch { /* ignore */ }
         }
     }
+    /**
+     * Task-tracking overhaul (2026-05-27): one-shot back-fill of `tasks.is_noise`
+     * from existing title heuristics. Idempotent — runs every startup but the
+     * WHERE clause restricts to rows that don't yet match the new state. We do
+     * NOT include the semantic blocklist ('批准', 'approve', '好', 'ok', '可以'
+     * …) intentionally; those are real human acknowledgements and the Bug 1
+     * spec-approval path now absorbs them — see spec § 3.2.
+     *
+     * Backfill only sets is_noise=1; rows already marked stay marked. We never
+     * flip 1→0 here (a future writer change could reclassify a legacy noise
+     * row; that case is best handled by a one-shot script, not boot-time).
+     *
+     * Errors are warn-logged and swallowed — daemon startup must not fail on
+     * data backfill. Worst case the column stays 0 and the Web filter shows
+     * extra rows (which the user can spot and report).
+     */
+    backfillTasksIsNoiseIfNeeded() {
+        if (!this.hasTable('tasks'))
+            return;
+        if (!this.hasColumn('tasks', 'is_noise'))
+            return;
+        try {
+            // Spec § 3.2 + § R1: backfill is intentionally CONSERVATIVE — we flip
+            // envelope / single-word slash / sub-3-char titles, but EXEMPT the
+            // semantic blocklist ('批准', 'approve', '好', 'ok', '可以', '同意', …).
+            // Those titles are real human acknowledgements that historically got
+            // mis-classified as user task starts; the Web should now SHOW them
+            // (so the user sees how many "approve" replies were silently dropped
+            // pre-Bug-1 fix). Going forward, SpecGate.handleApproval intercepts
+            // them BEFORE TaskSegmenter runs so they never reach createTask.
+            const res = this.db
+                .prepare(`UPDATE tasks SET is_noise = 1
+             WHERE is_noise = 0
+               AND LOWER(trim(title)) NOT IN
+                 ('批准', '同意', 'approve', '好', '好的', '嗯', 'ok', 'okay',
+                  '可以', '是', '是的', '继续', '停', 'stop', 'yes', 'no')
+               AND (
+                 length(trim(title)) < 3
+                 OR title LIKE '<task-notification>%'
+                 OR title LIKE '<system-reminder>%'
+                 OR title LIKE '<local-command-stdout>%'
+                 OR title LIKE '<command-message>%'
+                 OR title LIKE '<command-name>%'
+                 OR title LIKE '[Image #%'
+                 OR (substr(title, 1, 1) = '/' AND instr(title, ' ') = 0)
+               )`)
+                .run();
+            if (res.changes > 0) {
+                logger.info(`[SQLiteStorage] migration: backfilled tasks.is_noise=1 on ${res.changes} rows`);
+            }
+        }
+        catch (err) {
+            logger.warn(`[SQLiteStorage] migration: backfillTasksIsNoiseIfNeeded failed: ${err}`);
+        }
+    }
+    /**
+     * spec b1480935 (2026-06-01 Option A § OQ Q3): one-shot back-fill of
+     * `tasks.task_kind` from existing title prefixes. The is_noise column
+     * is deprecated but we keep its backfill running first so legacy rows
+     * still have a usable filter signal during the transition window.
+     *
+     * Mapping (mirrors NOISE_PREFIX_TO_KIND in core/utils/noise-prompt.ts):
+     *   - title LIKE '<task-notification>%'  → 'agent-callback'
+     *   - title LIKE '[Image #%'             → 'image'
+     *   - title LIKE '<system-reminder>%' / '<local-command-stdout>%' /
+     *     '<command-message>%' / '<command-name>%'  → 'system'
+     *   - everything else                    → stays 'user' (default)
+     *
+     * Idempotent: WHERE task_kind = 'user' AND title LIKE ... so a second
+     * boot only touches rows that haven't been promoted yet. We never demote
+     * (1→0 for is_noise had the same invariant) — a row already classified as
+     * 'agent-callback' stays put even if a future writer would have called it
+     * 'system'.
+     *
+     * Errors are warn-logged and swallowed — daemon startup must not fail on
+     * a backfill. Worst case the column stays 'user' on a few legacy envelopes
+     * and they surface in the default Web view (cosmetic only).
+     */
+    backfillTasksTaskKindIfNeeded() {
+        if (!this.hasTable('tasks'))
+            return;
+        if (!this.hasColumn('tasks', 'task_kind'))
+            return;
+        try {
+            // Each kind gets its own UPDATE so we can log per-bucket counts (helpful
+            // diagnostic when a user reports "why did 50 rows just turn grey?").
+            // Using a single CASE WHEN would collapse the count to one line.
+            const updates = [
+                { kind: 'agent-callback', like: '<task-notification>%' },
+                { kind: 'image', like: '[Image #%' },
+                { kind: 'system', like: '<system-reminder>%' },
+                { kind: 'system', like: '<local-command-stdout>%' },
+                { kind: 'system', like: '<command-message>%' },
+                { kind: 'system', like: '<command-name>%' },
+            ];
+            let total = 0;
+            for (const { kind, like } of updates) {
+                const res = this.db
+                    .prepare(`UPDATE tasks SET task_kind = ?
+               WHERE task_kind = 'user' AND title LIKE ?`)
+                    .run(kind, like);
+                total += res.changes;
+            }
+            if (total > 0) {
+                logger.info(`[SQLiteStorage] migration: backfilled tasks.task_kind on ${total} rows`);
+            }
+        }
+        catch (err) {
+            logger.warn(`[SQLiteStorage] migration: backfillTasksTaskKindIfNeeded failed: ${err}`);
+        }
+    }
+    /**
+     * Migration (Spec 2 § B1): drop the rerank-related columns from
+     * `kb_query_log` (strategy / rerank_cache_hit / rerank_failed) and the
+     * compound index that referenced `strategy`. Idempotent — new DBs created
+     * from the current schema.sql skip this entirely; legacy DBs lose the dead
+     * columns on next boot.
+     *
+     * SQLite ≥ 3.35 supports ALTER TABLE DROP COLUMN; better-sqlite3 12.x ships
+     * 3.46 so we use that directly. Errors are warn-logged but never thrown —
+     * worst case the columns linger and the writer just stops populating them.
+     */
+    dropDeadKbQueryLogColumnsIfNeeded() {
+        if (!this.hasTable('kb_query_log'))
+            return;
+        try {
+            // Drop the index first (still references `strategy`).
+            this.db.exec(`DROP INDEX IF EXISTS idx_kb_query_log_project_strategy`);
+        }
+        catch (err) {
+            logger.warn(`[SQLiteStorage] migration: drop idx_kb_query_log_project_strategy failed: ${err}`);
+        }
+        for (const col of ['strategy', 'rerank_cache_hit', 'rerank_failed']) {
+            if (!this.hasColumn('kb_query_log', col))
+                continue;
+            try {
+                this.db.exec(`ALTER TABLE kb_query_log DROP COLUMN ${col}`);
+                logger.info(`[SQLiteStorage] migration: dropped kb_query_log.${col}`);
+            }
+            catch (err) {
+                logger.warn(`[SQLiteStorage] migration: drop kb_query_log.${col} failed: ${err}`);
+            }
+        }
+    }
+    /**
+     * Migration (Spec 2 § B2): drop the unused `token_usage` table + indexes.
+     * 7d evidence showed 0 rows; the only "live" writer path was never wired
+     * through TokenTracker, so deleting is safe. Idempotent — DROP TABLE IF
+     * EXISTS noops on new DBs (schema.sql no longer declares the table).
+     */
+    dropTokenUsageIfNeeded() {
+        try {
+            this.db.exec(`DROP INDEX IF EXISTS idx_token_usage_session`);
+            this.db.exec(`DROP INDEX IF EXISTS idx_token_usage_timestamp`);
+            this.db.exec(`DROP TABLE IF EXISTS token_usage`);
+        }
+        catch (err) {
+            logger.warn(`[SQLiteStorage] migration: drop token_usage failed: ${err}`);
+        }
+    }
+    /**
+     * Migration (Spec 2 § B3): drop `routing_events.is_forced`. 7d evidence
+     * showed 0 rows with is_forced=1 — the field was reserved for a feature
+     * (forced/fallback routing) that was never wired. ALTER TABLE DROP COLUMN
+     * lands the column removal in-place; SQLite ≥ 3.35 required.
+     */
+    dropRoutingIsForcedIfNeeded() {
+        if (!this.hasTable('routing_events'))
+            return;
+        if (!this.hasColumn('routing_events', 'is_forced'))
+            return;
+        try {
+            this.db.exec(`ALTER TABLE routing_events DROP COLUMN is_forced`);
+            logger.info(`[SQLiteStorage] migration: dropped routing_events.is_forced`);
+        }
+        catch (err) {
+            logger.warn(`[SQLiteStorage] migration: drop routing_events.is_forced failed: ${err}`);
+        }
+    }
+    /**
+     * Migration (Spec 2 § B4): backfill `routing_events.routed_to_type='pending'`
+     * for the historical rows that user-prompt.ts wrote with NULL placeholder.
+     * 7d evidence showed 297/555 (54%) rows had NULL; with the new write-side
+     * default already minting 'pending', this one-shot UPDATE realigns history.
+     */
+    backfillRoutingRoutedToTypePending() {
+        if (!this.hasTable('routing_events'))
+            return;
+        try {
+            const res = this.db
+                .prepare(`UPDATE routing_events SET routed_to_type='pending' WHERE routed_to_type IS NULL`)
+                .run();
+            if (res.changes > 0) {
+                logger.info(`[SQLiteStorage] migration: backfilled routed_to_type='pending' on ${res.changes} rows`);
+            }
+        }
+        catch (err) {
+            logger.warn(`[SQLiteStorage] migration: backfill routed_to_type='pending' failed: ${err}`);
+        }
+    }
+    /**
+     * One-shot back-fill of skill_invocations.project_path from
+     * sessions.project_path (decision 39839e30 Part 2). A skill pull's session_id
+     * JOINs sessions to recover the project it belonged to. Idempotent: the WHERE
+     * clause restricts to `project_path IS NULL AND session_id IS NOT NULL`, so a
+     * second startup touches 0 rows. Rows whose session can't be joined (sentinel
+     * session 'cli-no-session', or a session not in the sessions table) stay NULL
+     * — we deliberately do NOT invent a project for them.
+     *
+     * Errors are warn-logged and swallowed — daemon startup must not fail on a
+     * data back-fill; worst case some legacy rows stay project_path=NULL and only
+     * the all-projects view counts them.
+     */
+    backfillSkillInvocationsProjectPathIfNeeded() {
+        if (!this.hasTable('skill_invocations'))
+            return;
+        if (!this.hasColumn('skill_invocations', 'project_path'))
+            return;
+        try {
+            const res = this.db.prepare(`
+        UPDATE skill_invocations
+        SET project_path = (
+          SELECT s.project_path FROM sessions s
+          WHERE s.session_id = skill_invocations.session_id
+        )
+        WHERE project_path IS NULL
+          AND session_id IS NOT NULL
+          AND EXISTS (
+            SELECT 1 FROM sessions s2
+            WHERE s2.session_id = skill_invocations.session_id
+              AND s2.project_path IS NOT NULL
+          )
+      `).run();
+            if (res.changes > 0) {
+                logger.info(`[SQLiteStorage] migration: back-filled skill_invocations.project_path on ${res.changes} rows from sessions`);
+            }
+        }
+        catch (err) {
+            logger.warn(`[SQLiteStorage] migration: backfill skill_invocations.project_path failed: ${err}`);
+        }
+    }
+    /**
+     * decision f47c2c90 (二期B, spec 1711 § Phase 1.1): one-shot, idempotent,
+     * gzip-free backfill of `tasks.parent_task_id` for recent ack/continue-class
+     * follow-up tasks that have no parent linked yet.
+     *
+     * Why gzip-free + weaker than go-forward: this runs over HISTORY, which has no
+     * in-memory `agentJustReturned` flag to read (R2). It uses a pure-SQL heuristic
+     * over the plaintext tasks columns ONLY (title / start_time / session_id —
+     * never the gzip events.tool_input, R7). Conservatism over recall:
+     *   - child candidate: task_kind='user', parent_task_id IS NULL, title is a
+     *     short ack token (TASK_PARENT_ACK_TITLES), start_time within the window.
+     *   - parent: the MOST RECENT same-session task_kind='user' task whose
+     *     start_time is STRICTLY earlier than the child AND within 30min AND whose
+     *     title is NOT itself an ack token (avoid ack→ack chains, prefer a
+     *     substantive originating task). No qualifying parent → stays NULL.
+     *   - never self-links (parent.id != child.id is implied by strict earlier
+     *     start_time + the explicit guard below).
+     *
+     * Idempotent gate: only runs when at least one un-linked recent ack child
+     * exists; the UPDATE itself only touches `parent_task_id IS NULL` rows, so a
+     * second boot updates 0 rows (success criterion: `backfilled 0 rows`).
+     *
+     * Wrapped in a transaction. Errors are warn-logged and swallowed — daemon
+     * startup must not fail on a data backfill. Time math uses
+     * `datetime('now', ?)` + ISO lexical comparison (tasks.start_time is ISO TEXT;
+     * NO numeric probe — DB column type landmine, MEMORY).
+     */
+    backfillTasksParentIfNeeded() {
+        if (!this.hasTable('tasks'))
+            return;
+        if (!this.hasColumn('tasks', 'parent_task_id'))
+            return;
+        try {
+            const ackPh = TASK_PARENT_ACK_TITLES.map(() => '?').join(',');
+            // Idempotent gate: any un-linked recent ack child left to consider?
+            const pending = this.db.prepare(`SELECT 1 FROM tasks
+          WHERE task_kind = 'user'
+            AND parent_task_id IS NULL
+            AND LOWER(trim(title)) IN (${ackPh})
+            AND start_time >= datetime('now', ?)
+          LIMIT 1`).get(...TASK_PARENT_ACK_TITLES, TASK_PARENT_BACKFILL_WINDOW);
+            if (!pending)
+                return;
+            // Correlated UPDATE: for each eligible ack child, pick the most recent
+            // same-session non-ack user task strictly earlier and within 30min.
+            const upd = this.db.prepare(`UPDATE tasks AS child
+            SET parent_task_id = (
+              SELECT p.id FROM tasks p
+               WHERE p.session_id = child.session_id
+                 AND p.task_kind = 'user'
+                 AND p.id != child.id
+                 AND p.start_time < child.start_time
+                 AND p.start_time >= datetime(child.start_time, '-${TASK_PARENT_BACKFILL_WINDOW_MIN} minutes')
+                 AND LOWER(trim(p.title)) NOT IN (${ackPh})
+               ORDER BY p.start_time DESC
+               LIMIT 1
+            )
+          WHERE child.task_kind = 'user'
+            AND child.parent_task_id IS NULL
+            AND LOWER(trim(child.title)) IN (${ackPh})
+            AND child.start_time >= datetime('now', ?)
+            AND EXISTS (
+              SELECT 1 FROM tasks p2
+               WHERE p2.session_id = child.session_id
+                 AND p2.task_kind = 'user'
+                 AND p2.id != child.id
+                 AND p2.start_time < child.start_time
+                 AND p2.start_time >= datetime(child.start_time, '-${TASK_PARENT_BACKFILL_WINDOW_MIN} minutes')
+                 AND LOWER(trim(p2.title)) NOT IN (${ackPh})
+            )`);
+            let changes = 0;
+            const tx = this.db.transaction(() => {
+                const res = upd.run(...TASK_PARENT_ACK_TITLES, // parent NOT IN (subquery)
+                ...TASK_PARENT_ACK_TITLES, // child IN (WHERE)
+                TASK_PARENT_BACKFILL_WINDOW, ...TASK_PARENT_ACK_TITLES);
+                changes = res.changes;
+            });
+            tx();
+            if (changes > 0) {
+                logger.info(`[SQLiteStorage] migration: backfilled tasks.parent_task_id on ${changes} rows`);
+            }
+        }
+        catch (err) {
+            logger.warn(`[SQLiteStorage] migration: backfillTasksParentIfNeeded failed: ${err}`);
+        }
+    }
+    /**
+     * decision c425f26f (spec 1544 § 1.3): one-shot, idempotent backfill of the
+     * PLAINTEXT `events.decision_id` / `events.subagent_type` columns for recent
+     * Task/Agent spawn rows whose values still live only inside the gzip
+     * `tool_input` blob.
+     *
+     * Idempotent gate: only spawn rows in the backfill window where BOTH new
+     * columns are still NULL are touched, so a second daemon boot updates 0 rows
+     * (success criterion: `backfilled 0 rows`).
+     *
+     * gzip one-way-door: we DECODE `tool_input` via the codec (sniffs gzip magic),
+     * run `extractSpawnFields` on the decoded object, then write the extracted
+     * strings to the plaintext columns. The columns themselves never see gzip.
+     * Rows whose `tool_input` was already NULLed by the warm-TTL sweep have
+     * nothing to decode and are skipped (decode → undefined → both NULL, but the
+     * WHERE already excludes most via `tool_input IS NOT NULL`).
+     *
+     * Per-row try/catch: one malformed gzip blob never aborts the batch. Wrapped
+     * in a single transaction. Errors are warn-logged and swallowed — daemon
+     * startup must not fail on a data backfill.
+     *
+     * This is the boot-time wrapper (gated). The re-runnable engine lives in
+     * {@link backfillEventsDecisionId} so `cf maintenance backfill-spawn-fields`
+     * can force a full re-scan of the window.
+     */
+    backfillEventsDecisionIdIfNeeded() {
+        if (!this.hasTable('events'))
+            return;
+        if (!this.hasColumn('events', 'decision_id') || !this.hasColumn('events', 'subagent_type'))
+            return;
+        try {
+            // Idempotent gate: any un-backfilled recent spawn row left?
+            const pending = this.db.prepare(`SELECT 1 FROM events
+          WHERE hook_type = 'PreToolUse'
+            AND tool_name IN ('Task','Agent')
+            AND tool_input IS NOT NULL
+            AND decision_id IS NULL AND subagent_type IS NULL
+            AND timestamp >= datetime('now', ?)
+          LIMIT 1`).get(SPAWN_FIELD_BACKFILL_WINDOW);
+            if (!pending)
+                return;
+            const n = this.backfillEventsDecisionId();
+            if (n > 0) {
+                logger.info(`[SQLiteStorage] migration: backfilled events.decision_id/subagent_type on ${n} rows`);
+            }
+        }
+        catch (err) {
+            logger.warn(`[SQLiteStorage] migration: backfillEventsDecisionIdIfNeeded failed: ${err}`);
+        }
+    }
+    /**
+     * Re-runnable engine for the decision_id / subagent_type backfill (decision
+     * c425f26f, user ruling #3 manual fallback). Scans the backfill window for
+     * Pre/Post Task/Agent spawn rows that still have NULL plaintext columns,
+     * decodes their gzip `tool_input`, and writes the extracted fields. Returns
+     * the number of rows updated. Safe to call repeatedly (idempotent: only NULL
+     * rows are touched). Exposed via the SQLiteStorage facade for the
+     * `cf maintenance backfill-spawn-fields` command.
+     */
+    backfillEventsDecisionId() {
+        if (!this.hasTable('events'))
+            return 0;
+        if (!this.hasColumn('events', 'decision_id') || !this.hasColumn('events', 'subagent_type'))
+            return 0;
+        const rows = this.db.prepare(`SELECT event_id, tool_name, tool_input FROM events
+        WHERE hook_type IN ('PreToolUse','PostToolUse')
+          AND tool_name IN ('Task','Agent')
+          AND tool_input IS NOT NULL
+          AND decision_id IS NULL AND subagent_type IS NULL
+          AND timestamp >= datetime('now', ?)`).all(SPAWN_FIELD_BACKFILL_WINDOW);
+        if (rows.length === 0)
+            return 0;
+        const upd = this.db.prepare(`UPDATE events SET decision_id = ?, subagent_type = ? WHERE event_id = ?`);
+        let updated = 0;
+        const tx = this.db.transaction(() => {
+            for (const row of rows) {
+                try {
+                    const decoded = decodeToolInput(row.tool_input);
+                    const { decisionId, subagentType } = extractSpawnFields(row.tool_name, decoded);
+                    // Only write when we actually extracted something — leaving both NULL
+                    // for unparseable / field-less rows keeps the idempotent gate honest
+                    // (they'd otherwise be re-scanned but never spuriously marked done).
+                    if (decisionId === null && subagentType === null)
+                        continue;
+                    upd.run(decisionId, subagentType, row.event_id);
+                    updated++;
+                }
+                catch (err) {
+                    logger.warn(`[SQLiteStorage] backfillEventsDecisionId: skip row ${row.event_id}: ${err}`);
+                }
+            }
+        });
+        tx();
+        return updated;
+    }
+    /**
+     * Migration 010: widen workflow_recommendations.outcome CHECK to include
+     * 'partial_accepted'. SQLite cannot ALTER a CHECK constraint in place — we
+     * detect legacy tables (CHECK string does NOT contain 'partial_accepted')
+     * and rebuild via temp-table copy/drop/rename. Idempotent — new DBs
+     * already created by schema.sql carry the new CHECK and skip.
+     *
+     * Errors are warn-logged but never thrown — daemon startup must not fail
+     * on a migration; worst case the new outcome value just gets rejected at
+     * write time and the calling code's try/catch swallows it (writes here are
+     * fire-and-forget observability).
+     */
+    rebuildWorkflowRecommendationsCheckIfNeeded() {
+        if (!this.hasTable('workflow_recommendations'))
+            return;
+        try {
+            const sqlRow = this.db
+                .prepare(`SELECT sql FROM sqlite_master WHERE type='table' AND name='workflow_recommendations'`)
+                .get();
+            if (!sqlRow || !sqlRow.sql)
+                return;
+            if (sqlRow.sql.includes('partial_accepted'))
+                return; // already widened
+            logger.info('[SQLiteStorage] migration 010: widening workflow_recommendations.outcome CHECK to include partial_accepted');
+            const rebuild = this.db.transaction(() => {
+                // 1) create the new table with widened CHECK
+                this.db.exec(`
+          CREATE TABLE workflow_recommendations_new (
+              id INTEGER PRIMARY KEY AUTOINCREMENT,
+              session_id TEXT NOT NULL,
+              timestamp TEXT NOT NULL,
+              rule_id TEXT NOT NULL,
+              matched_keywords TEXT,
+              recommended_workflow TEXT NOT NULL,
+              recommended_agent_type TEXT NOT NULL,
+              reason TEXT,
+              outcome TEXT CHECK(outcome IS NULL OR outcome IN ('pending','accepted','partial_accepted','rejected','ignored','bypassed')),
+              outcome_at TEXT,
+              source TEXT DEFAULT 'workflow_classifier',
+              created_at TEXT DEFAULT (datetime('now'))
+          );
+        `);
+                // 2) copy rows preserving id
+                this.db.exec(`
+          INSERT INTO workflow_recommendations_new (
+            id, session_id, timestamp, rule_id, matched_keywords,
+            recommended_workflow, recommended_agent_type, reason,
+            outcome, outcome_at, source, created_at
+          )
+          SELECT id, session_id, timestamp, rule_id, matched_keywords,
+                 recommended_workflow, recommended_agent_type, reason,
+                 outcome, outcome_at, source, created_at
+          FROM workflow_recommendations;
+        `);
+                // 3) drop old + rename new (indexes auto-dropped with table; recreated below)
+                this.db.exec(`DROP TABLE workflow_recommendations;`);
+                this.db.exec(`ALTER TABLE workflow_recommendations_new RENAME TO workflow_recommendations;`);
+                // 4) recreate indexes (mirrors schema.sql lines 378-379)
+                this.db.exec(`CREATE INDEX IF NOT EXISTS idx_workflow_rec_session ON workflow_recommendations(session_id, outcome);`);
+                this.db.exec(`CREATE INDEX IF NOT EXISTS idx_workflow_rec_ts ON workflow_recommendations(timestamp DESC);`);
+            });
+            rebuild();
+            logger.info('[SQLiteStorage] migration 010: workflow_recommendations rebuild complete');
+        }
+        catch (err) {
+            logger.warn(`[SQLiteStorage] migration 010: rebuild failed: ${err}`);
+        }
+    }
+    /**
+     * Migration 011 (spec 1100 Option C, 2026-06-02): widen the `outcome` CHECK
+     * on `sessions` + `tasks` from the fixed value enum
+     * `IN ('success','partial','failed','abandoned')` to a non-empty-string
+     * guard `length(outcome) > 0`. This lets the classifier emit the new
+     * `answered` outcome (and any future value) WITHOUT a table rebuild per
+     * value. The rebuild here is the ONE-TIME widening for existing live DBs.
+     *
+     * Why a rebuild: SQLite cannot ALTER a CHECK constraint in place. We mirror
+     * the migration-010 pattern: CREATE *_new → INSERT SELECT → DROP old →
+     * RENAME → recreate indexes.
+     *
+     * Robustness choices:
+     *   - **Idempotent**: detected by sniffing the stored CREATE TABLE `sql`. If
+     *     it no longer contains the old enum fragment (`outcome IN (`) we skip —
+     *     a second boot is a no-op. New DBs created from current schema.sql carry
+     *     the relaxed CHECK already and skip.
+     *   - **Data-preserving**: we don't hand-write the new column list. We take
+     *     the table's existing CREATE statement and string-replace ONLY the
+     *     outcome CHECK fragment, so every column (incl. migration-added ones
+     *     like task_kind / intercept_count) is preserved verbatim, then copy all
+     *     rows with `INSERT INTO new SELECT * FROM old`.
+     *   - **Index-preserving**: we snapshot every non-autoindex on the table
+     *     from sqlite_master BEFORE the drop and replay each `sql` after rename.
+     *   - **FK-safe**: tasks is referenced by task_events(task_id) FK. We run the
+     *     whole rebuild inside a transaction with foreign_keys temporarily OFF so
+     *     the DROP/RENAME doesn't cascade-delete task_events rows. (PRAGMA
+     *     foreign_keys is a no-op inside a transaction in SQLite, so we toggle it
+     *     around the transaction.)
+     *
+     * Errors are warn-logged, never thrown — daemon startup must not fail. Worst
+     * case the old enum CHECK lingers and writing `answered` is rejected at write
+     * time (callers swallow the throw); the operator can re-run after the next
+     * build.
+     */
+    rebuildOutcomeCheckIfNeeded() {
+        for (const table of ['sessions', 'tasks']) {
+            try {
+                if (!this.hasTable(table))
+                    continue;
+                const sqlRow = this.db
+                    .prepare(`SELECT sql FROM sqlite_master WHERE type='table' AND name=?`)
+                    .get(table);
+                if (!sqlRow || !sqlRow.sql)
+                    continue;
+                // Detect the OLD enum CHECK. The relaxed form uses `length(outcome)`,
+                // so the presence of `outcome IN (` is the legacy marker.
+                if (!/outcome\s+IN\s*\(/i.test(sqlRow.sql))
+                    continue; // already widened
+                logger.info(`[SQLiteStorage] migration 011: widening ${table}.outcome CHECK (enum → non-empty) via table rebuild`);
+                // Build the new CREATE statement by replacing the legacy outcome CHECK
+                // fragment in-place. Two known shapes (sessions vs tasks columns differ
+                // but the outcome CHECK fragment is identical):
+                //   outcome TEXT CHECK(outcome IS NULL OR outcome IN ('success', 'partial', 'failed', 'abandoned'))
+                const newTableName = `${table}_oc_new`;
+                const newCreate = sqlRow.sql
+                    .replace(/outcome\s+TEXT\s+CHECK\s*\(\s*outcome\s+IS\s+NULL\s+OR\s+outcome\s+IN\s*\([^)]*\)\s*\)/i, 'outcome TEXT CHECK(outcome IS NULL OR length(outcome) > 0)')
+                    // Point the CREATE at the temp table name. The original name appears
+                    // right after CREATE TABLE (optionally quoted) — replace the FIRST
+                    // occurrence only.
+                    .replace(new RegExp(`CREATE\\s+TABLE\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?["'\`]?${table}["'\`]?`, 'i'), `CREATE TABLE ${newTableName}`);
+                if (newCreate === sqlRow.sql || newCreate.includes(`outcome IN (`)) {
+                    logger.warn(`[SQLiteStorage] migration 011: could not rewrite ${table}.outcome CHECK (unexpected DDL shape) — skipping`);
+                    continue;
+                }
+                // Snapshot user indexes on the table (skip auto-indexes which have NULL sql).
+                const indexRows = this.db
+                    .prepare(`SELECT sql FROM sqlite_master WHERE type='index' AND tbl_name=? AND sql IS NOT NULL`)
+                    .all(table);
+                // task_events FK references tasks(id); toggle FK enforcement off around
+                // the transaction so DROP TABLE tasks doesn't cascade.
+                const fkOn = this.db.pragma('foreign_keys', { simple: true });
+                if (Number(fkOn) === 1)
+                    this.db.pragma('foreign_keys = OFF');
+                try {
+                    const rebuild = this.db.transaction(() => {
+                        this.db.exec(newCreate);
+                        this.db.exec(`INSERT INTO ${newTableName} SELECT * FROM ${table};`);
+                        this.db.exec(`DROP TABLE ${table};`);
+                        this.db.exec(`ALTER TABLE ${newTableName} RENAME TO ${table};`);
+                        for (const idx of indexRows) {
+                            // idx.sql is the original CREATE INDEX — replay verbatim. Make it
+                            // idempotent in case schema.sql already recreated it on this boot.
+                            const ddl = idx.sql.replace(/CREATE\s+(UNIQUE\s+)?INDEX\s+/i, (m) => /IF\s+NOT\s+EXISTS/i.test(idx.sql) ? m : `${m}IF NOT EXISTS `);
+                            this.db.exec(ddl);
+                        }
+                    });
+                    rebuild();
+                }
+                finally {
+                    if (Number(fkOn) === 1)
+                        this.db.pragma('foreign_keys = ON');
+                }
+                logger.info(`[SQLiteStorage] migration 011: ${table}.outcome CHECK widened`);
+            }
+            catch (err) {
+                logger.warn(`[SQLiteStorage] migration 011: ${table} rebuild failed: ${err}`);
+            }
+        }
+    }
+    /**
+     * Migration 012 (decision 0fc1883c, 2026-06-08): DROP the dead
+     * `decisions.workflow_type` column. It was hard-coded to the literal
+     * 'pending' by decision-hint.ts (daemon no longer pre-classifies) and had
+     * ZERO consumers — no UPDATE path, no business logic branch. (The
+     * `intent.workflow_type` read by rules/pipeline-rollup is a DIFFERENT field
+     * sourced from injection metadata, NOT this column.)
+     *
+     * SQLite cannot reliably DROP COLUMN on older engines, so we mirror the
+     * migration-010/011 table-rebuild pattern: read the table's stored CREATE
+     * statement, strip the `workflow_type` line, CREATE the temp table, copy
+     * every OTHER column by EXPLICIT name (never `SELECT *` — the live column
+     * ORDER differs from schema.sql because migration-added columns are appended),
+     * DROP old, RENAME, replay indexes.
+     *
+     * Robustness choices:
+     *   - **Idempotent**: guarded by hasColumn — if workflow_type is already gone
+     *     (fresh DB from current schema.sql, or a prior boot) this is a no-op.
+     *   - **Data-preserving**: copies all non-workflow_type columns by name, so
+     *     every decision row keeps its other fields verbatim.
+     *   - **Index-preserving**: snapshots user indexes before the drop and replays
+     *     each `sql` after rename (made IF NOT EXISTS so schema.sql's recreate on
+     *     the same boot doesn't clash).
+     *
+     * Errors are warn-logged, never thrown — daemon startup must not fail on a
+     * migration. Worst case the dead column lingers (harmless — nothing reads it).
+     */
+    /**
+     * Migration 013 (decision 93e8fff1, 2026-06-08): widen the
+     * `decisions.status` CHECK to include 'advisory'. The advisory mint default
+     * (writeDecision) writes status='advisory', which the legacy CHECK
+     * (`status IN ('pending','resolved','bypassed','expired')`) would REJECT on
+     * existing live DBs — SQLite cannot ALTER a CHECK in place, so we mirror the
+     * migration-011/012 table-rebuild pattern: read the stored CREATE, string-
+     * replace ONLY the status CHECK fragment, CREATE temp → INSERT SELECT * →
+     * DROP → RENAME → replay indexes.
+     *
+     * Robustness:
+     *   - **Idempotent**: detected by sniffing the stored CREATE for the legacy
+     *     status enum WITHOUT 'advisory'. New DBs (schema.sql already carries
+     *     'advisory') and a second boot are no-ops.
+     *   - **Data-preserving**: copies every column verbatim via `SELECT *`.
+     *   - **Index-preserving**: snapshots non-autoindexes before the drop, replays
+     *     each (made IF NOT EXISTS so schema.sql's recreate on the same boot is
+     *     harmless).
+     *
+     * Errors are warn-logged, never thrown — daemon startup must not fail on a
+     * migration. Worst case the old CHECK lingers and a fresh advisory write is
+     * rejected at write time (writeDecision callers fail-silent), and the operator
+     * can re-run after the next build.
+     */
+    widenDecisionsStatusCheckIfNeeded() {
+        try {
+            if (!this.hasTable('decisions'))
+                return;
+            const sqlRow = this.db
+                .prepare(`SELECT sql FROM sqlite_master WHERE type='table' AND name='decisions'`)
+                .get();
+            if (!sqlRow || !sqlRow.sql)
+                return;
+            // Already widened? The new CHECK contains 'advisory'. Skip if present.
+            if (/status\s+IN\s*\([^)]*'advisory'/i.test(sqlRow.sql))
+                return;
+            // Only act when the legacy status CHECK enum is present.
+            if (!/status\s+IN\s*\(\s*'pending'/i.test(sqlRow.sql))
+                return;
+            logger.info('[SQLiteStorage] migration 013: widening decisions.status CHECK to include advisory via table rebuild');
+            const newTableName = 'decisions_st_new';
+            const newCreate = sqlRow.sql
+                .replace(
+            // Match the status CHECK fragment regardless of internal whitespace.
+            /status\s+IN\s*\(\s*'pending'\s*,\s*'resolved'\s*,\s*'bypassed'\s*,\s*'expired'\s*\)/i, "status IN ('advisory','pending','resolved','bypassed','expired')")
+                .replace(/CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?["'`]?decisions["'`]?/i, `CREATE TABLE ${newTableName}`);
+            if (newCreate === sqlRow.sql || !/'advisory'/i.test(newCreate)) {
+                logger.warn('[SQLiteStorage] migration 013: could not rewrite decisions.status CHECK (unexpected DDL shape) — skipping');
+                return;
+            }
+            const indexRows = this.db
+                .prepare(`SELECT sql FROM sqlite_master WHERE type='index' AND tbl_name='decisions' AND sql IS NOT NULL`)
+                .all();
+            const rebuild = this.db.transaction(() => {
+                this.db.exec(newCreate);
+                this.db.exec(`INSERT INTO ${newTableName} SELECT * FROM decisions;`);
+                this.db.exec(`DROP TABLE decisions;`);
+                this.db.exec(`ALTER TABLE ${newTableName} RENAME TO decisions;`);
+                for (const idx of indexRows) {
+                    const ddl = idx.sql.replace(/CREATE\s+(UNIQUE\s+)?INDEX\s+/i, (m) => /IF\s+NOT\s+EXISTS/i.test(idx.sql) ? m : `${m}IF NOT EXISTS `);
+                    this.db.exec(ddl);
+                }
+            });
+            rebuild();
+            logger.info('[SQLiteStorage] migration 013: decisions.status CHECK widened');
+        }
+        catch (err) {
+            logger.warn(`[SQLiteStorage] migration 013: widen status CHECK failed: ${err}`);
+        }
+    }
+    dropDecisionsWorkflowTypeIfNeeded() {
+        try {
+            if (!this.hasTable('decisions'))
+                return;
+            if (!this.hasColumn('decisions', 'workflow_type'))
+                return; // already dropped
+            const sqlRow = this.db
+                .prepare(`SELECT sql FROM sqlite_master WHERE type='table' AND name='decisions'`)
+                .get();
+            if (!sqlRow || !sqlRow.sql)
+                return;
+            logger.info('[SQLiteStorage] migration 012: dropping dead decisions.workflow_type column via table rebuild');
+            const newTableName = 'decisions_wf_new';
+            // Strip the entire `workflow_type ...` column line (up to and including
+            // its trailing comma + newline). The column is declared NOT NULL with a
+            // trailing comment, e.g.:
+            //   workflow_type TEXT NOT NULL,          -- intent.workflow_type (...)
+            let newCreate = sqlRow.sql.replace(/^[ \t]*workflow_type\b[^\n]*\n/im, '');
+            // Point CREATE at the temp table (first occurrence of the table name).
+            newCreate = newCreate.replace(/CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?["'`]?decisions["'`]?/i, `CREATE TABLE ${newTableName}`);
+            if (newCreate === sqlRow.sql || /\bworkflow_type\b/.test(newCreate)) {
+                logger.warn('[SQLiteStorage] migration 012: could not strip decisions.workflow_type from DDL (unexpected shape) — skipping');
+                return;
+            }
+            // Explicit column list (every column EXCEPT workflow_type), preserving the
+            // live table's order. Never `SELECT *` — live order != schema.sql order.
+            const liveCols = this.db.prepare(`PRAGMA table_info(decisions)`).all()
+                .map((c) => c.name)
+                .filter((name) => name !== 'workflow_type');
+            const colList = liveCols.join(', ');
+            // Snapshot user indexes (auto-indexes have NULL sql and are skipped).
+            const indexRows = this.db
+                .prepare(`SELECT sql FROM sqlite_master WHERE type='index' AND tbl_name='decisions' AND sql IS NOT NULL`)
+                .all();
+            const rebuild = this.db.transaction(() => {
+                this.db.exec(newCreate);
+                this.db.exec(`INSERT INTO ${newTableName} (${colList}) SELECT ${colList} FROM decisions;`);
+                this.db.exec(`DROP TABLE decisions;`);
+                this.db.exec(`ALTER TABLE ${newTableName} RENAME TO decisions;`);
+                for (const idx of indexRows) {
+                    const ddl = idx.sql.replace(/CREATE\s+(UNIQUE\s+)?INDEX\s+/i, (m) => /IF\s+NOT\s+EXISTS/i.test(idx.sql) ? m : `${m}IF NOT EXISTS `);
+                    this.db.exec(ddl);
+                }
+            });
+            rebuild();
+            logger.info('[SQLiteStorage] migration 012: decisions.workflow_type dropped');
+        }
+        catch (err) {
+            logger.warn(`[SQLiteStorage] migration 012: drop workflow_type failed: ${err}`);
+        }
+    }
     /**
      * 将 events 表按 session_id 聚合回填到 sessions 表，仅在 sessions 尚未对齐
      * （没有任何一行带 first_prompt）时触发。