create-ailk 0.24.0 → 0.25.1

package/templates/database/migrations/20260922120000_tenancy_fence/migration.sql

@@ -1,1067 +0,0 @@
--- #6254 — the tenancy fence keystone. THE ONE schema migration M32 emits
--- (AC-1): #6256 #6257 #6258 #6259 #6260 #6171 #6314 land their model
--- changes INTO this file rather than each adding their own (issue #6254
--- comment, Sam, 2026-09-20; spec docs/specs/6254-the-composite-fk-pattern-
--- workspacesiteidentity-spec.md D4).
---
--- ── What this file does ─────────────────────────────────────────────────────
--- 1. `WorkspaceSiteIdentity` gains `@@unique([id, workspaceId])` (AC-2) — a
---    named Postgres unique constraint, redundant today (`id` is already the
---    PK) but the target a future composite FK can bind to (spec D3).
--- 2. Four ALREADY-KEYED-but-nullable models — `leads`, `project_listings`,
---    `flow_definitions`, `flow_sessions` — are retrofitted to NOT NULL
---    `workspace_id` plus a `CHECK (workspace_id = site_id)` (spec D1b).
--- 3. #6374 — the fence fan-out. ELEVEN `site_id` tables gain `workspace_id`
---    and take the same five steps in the same order: `subscribers`,
---    `callbacks`, `consent_grants`, `appointments`, `deliverable_assets`,
---    `flow_checkouts`, `waitlist_experiments`, `waitlist_scores`,
---    `waitlist_followup_sends`, `playbook_instances`, `site_listing_configs`.
--- 4. #6374 — `listing_csv_sends` has NO `site_id`, so it gains `workspace_id`
---    backfilled from its parent `project_listings` row, NOT NULL and the
---    format CHECK, and NO equality CHECK (spec D2, operator 2026-09-20).
--- 5. #6374 — `site_settings` has NO `site_id` either. It gains `workspace_id`
---    backfilled to the sentinel workspace — but ONLY after an abort-not-guess
---    guard (AC-14) refuses any unattributed row whose `key` already embeds a
---    NON-sentinel workspace id, which the sentinel assignment would misfile —
---    NOT NULL and the format CHECK, and
---    its UNIQUE INDEX moves from `(key)` to `(workspace_id, key)` so two
---    sellers may each hold a `feature_flags` row (spec D3, operator
---    2026-09-20). The `key` TEXT is left verbatim.
--- 6. #6374 — `deliverable_grants` gains NO column and NO row is touched: its
---    `workspace_id` stays nullable (NULL is the serve path's fail-closed
---    sentinel). It gains only the NULL-TOLERANT
---    `CHECK (workspace_id IS NULL OR workspace_id = site_id)`, so a STAMPED
---    grant can never disagree with its site while a legacy one stays
---    storable (spec D4).
---
--- ── Why a CHECK and not a foreign key (spec §0, §1.3, §1.4) ────────────────
--- The issue's literal ask — a composite FK from these four models to
--- `WorkspaceSiteIdentity` — is not buildable against this tree: (F1) the
--- relation crosses the inbox -> config namespace boundary ADR-0009
--- invariant #1 forbids, and `tools/lint-architecture.ts`'s
--- cross-namespace-prisma-relation rule lints it; (F2) `site_id` never holds
--- a `WorkspaceSiteIdentity.id` (`siteid_<uuidv7>`) — it holds the resolved
--- WORKSPACE id (`wksp_<uuidv7>`) or the legacy alias `"default"`, so
--- `references: [id, workspaceId]` would reject 100% of existing rows and
--- 100% of writes from every current path; (F3) `WorkspaceSiteIdentity` is a
--- per-workspace config blob written lazily by an upsert, not a site
--- registry — a required FK parent would make anonymous lead capture (a
--- never-gate surface) depend on a config row that need not exist.
---
--- AC-4's stated GOAL — "Postgres rejects a row whose workspaceId disagrees
--- with its site's workspace" — is delivered without a FK: since `site_id`
--- IS the workspace id (F2), the disagreement is exactly
--- `workspace_id <> site_id`, and an equality CHECK makes it unstorable. This
--- is strictly TIGHTER than the FK the issue asked for (the FK would admit
--- any pair present in `workspace_site_identities`; the CHECK admits exactly
--- one value per row). Disposed by the operator 2026-09-20, spec §10.1 Q1 ->
--- Option A' (docs/internal/decisions/tenancy-fence-model-classification.md
--- D1 amendment, same commit).
---
--- `DeliverableGrant` (the fifth already-keyed model) is DELIBERATELY NOT
--- touched here. Its `workspace_id` has no source column to derive from (its
--- own migration, 20260921120000_deliverable_grant_workspace_key, says so
--- explicitly) and NULL is the serve path's fail-closed sentinel
--- (`deliverable-asset-store.ts` `readDeliverableAsset`) — retrofitting it
--- here would hand a legacy grant an authorization scope no mint granted, on
--- a bearer-token download path. Carved out of this unit (spec §10.1 Q2 ->
--- carve out); #6257 fences it at mint grain, where the workspace is known.
---
--- ── The CHECK requires `site_id` normalized FIRST (spec D1a, SEC-01) ───────
--- A bare `CHECK (workspace_id = site_id)` is unsatisfiable for the shipped
--- default: `site_id = 'default'` is the canonical seeded row, and both
--- precedent backfills (20260919140000, 20260919120000) already resolve
--- `'default'` to the sentinel workspace id in `workspace_id` while leaving
--- `site_id` untouched. So this migration rewrites `site_id = 'default'` to
--- the same sentinel on every fenced table BEFORE the CHECK lands — the
--- application-code half of D1a (the write paths that still stamp the raw
--- alias) is fixed in the same PR (apps/api/src/lib/site.ts,
--- routes/flows/index.ts, routes/flows/recommender.ts, bin/seed-presets.ts,
--- services/listing-config.ts, services/flow-engine.ts,
--- services/project-listings.ts, services/recommender-capture.ts).
---
--- ── Ordering (spec D2) — never guess, never delete, abort if unresolvable ──
--- 1. Normalize site_id ('default' -> sentinel).
--- 2. Resolve any remaining NULL workspace_id via an INNER JOIN to
---    "workspaces" only (never an assignment) — a row whose site_id resolves
---    to nothing is left NULL, never guessed. This is mostly a no-op today:
---    20260919140000/20260919120000 already backfilled these four tables:
---    kept here so this migration proves its OWN correctness re-run against
---    fixture rows (NFR3, § 8.3) rather than depending on migration order.
--- 3. Post-assert: nothing lost, nothing guessed, nothing missed — carried
---    forward from the precedent — PLUS a NEW assertion this migration adds
---    and the precedent could not: zero rows remain NULL. Unlike the
---    precedent (which only RAISE NOTICEs on a remaining NULL, because it
---    never enforces NOT NULL), THIS migration is about to enforce NOT NULL,
---    so an unresolvable row must abort the transaction rather than pass
---    through silently — "the same silent data loss AC-7 exists to close"
---    (spec §0), never a delete, never a guess.
--- 4. THEN `SET NOT NULL`, then the CHECKs.
---
--- ── Re-runnability (NFR3) ───────────────────────────────────────────────────
--- `ADD COLUMN`/`CREATE INDEX` are not needed here (the columns/indexes
--- already exist from the precedent migrations). The equality CHECKs use
--- `DROP CONSTRAINT IF EXISTS` then `ADD CONSTRAINT` — NOT the precedent's
--- existence-guarded `DO $$` block, which would silently no-op the
--- TIGHTENING this migration performs on any database that already carries a
--- same-named constraint (spec D5, SEC-06: a false-green control). The
--- `WorkspaceSiteIdentity` composite unique is a pure ADD (nothing to
--- tighten), so it keeps the existence-guarded idiom.
---
--- ── Rollback (NFR5) ─────────────────────────────────────────────────────────
--- Reverses the CONSTRAINTS only, not the tenant attribution:
---   ALTER TABLE "leads" DROP CONSTRAINT "leads_workspace_site_agree", ALTER COLUMN "workspace_id" DROP NOT NULL;
---   ALTER TABLE "project_listings" DROP CONSTRAINT "project_listings_workspace_site_agree", ALTER COLUMN "workspace_id" DROP NOT NULL;
---   ALTER TABLE "flow_definitions" DROP CONSTRAINT "flow_definitions_workspace_site_agree", ALTER COLUMN "workspace_id" DROP NOT NULL;
---   ALTER TABLE "flow_sessions" DROP CONSTRAINT "flow_sessions_workspace_site_agree", ALTER COLUMN "workspace_id" DROP NOT NULL;
---   ALTER TABLE "workspace_site_identities" DROP CONSTRAINT "workspace_site_identities_id_workspace_id_key";
--- #6374's own reversal, same posture — CONSTRAINTS only, never the tenant
--- attribution: for each of the twelve tables it fences
---   ALTER TABLE "<table>" DROP CONSTRAINT "<table>_workspace_site_agree",
---     DROP CONSTRAINT "<table>_workspace_id_format",
---     ALTER COLUMN "workspace_id" DROP NOT NULL;
--- (`listing_csv_sends` and `site_settings` have no `_workspace_site_agree`;
--- `site_settings` additionally needs its old `site_settings_key_key` unique
--- index recreated, which is only possible while no two workspaces hold the
--- same key.) `deliverable_grants` reverses by dropping its one new CHECK.
--- Unlike the four keystone tables, `workspace_id` does NOT predate this
--- migration on the twelve, so a full DOWN would also DROP COLUMN it — which
--- DOES discard tenant attribution. Stated so it is not read as a safe revert.
--- `workspace_id` predates this migration on all four tables (§1.6), and the
--- `site_id` normalization (D1a) is one-way — a DOWN does not un-normalize
--- `site_id`, because the pre-normalization alias value is not recoverable
--- from the row. NOT a full revert; stated so it is not read as one.
-
--- The census the post-assertions compare against. ON COMMIT DROP: `prisma
--- migrate` runs each migration in one transaction, so this disappears with it.
-CREATE TEMP TABLE "_6254_fence_census" ON COMMIT DROP AS
-  SELECT (SELECT count(*) FROM "leads")            AS l,
-         (SELECT count(*) FROM "project_listings") AS p,
-         (SELECT count(*) FROM "flow_definitions") AS d,
-         (SELECT count(*) FROM "flow_sessions")    AS s;
-
--- ── AC-2 — WorkspaceSiteIdentity composite unique ──────────────────────────
-DO $$ BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM pg_constraint WHERE conname = 'workspace_site_identities_id_workspace_id_key'
-  ) THEN
-    ALTER TABLE "workspace_site_identities"
-      ADD CONSTRAINT "workspace_site_identities_id_workspace_id_key" UNIQUE ("id", "workspace_id");
-  END IF;
-END $$;
-
--- ── Step 1 (D1a) — normalize site_id: 'default' -> the sentinel workspace id ─
--- The sentinel id is a literal because SQL cannot import database/tenancy.ts
--- (spec §5.3 step 5); database/__tests__/composite-fence.db.test.ts pins the
--- same literal against the exported DEFAULT_WORKSPACE_ID constant, mirroring
--- the #6155/#6203 precedents' own technique.
-UPDATE "leads"
-   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
- WHERE "site_id" = 'default';
-
-UPDATE "project_listings"
-   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
- WHERE "site_id" = 'default';
-
-UPDATE "flow_definitions"
-   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
- WHERE "site_id" = 'default';
-
-UPDATE "flow_sessions"
-   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
- WHERE "site_id" = 'default';
-
--- ── Step 2 (D2) — resolve any remaining NULL workspace_id via INNER JOIN ────
--- site_id is already normalized (step 1), so no CASE/alias branch is needed
--- here, unlike the precedent migrations this runs after. A row whose site_id
--- resolves to nothing is simply not touched and stays NULL — never guessed.
-UPDATE "leads" l
-   SET "workspace_id" = w."id"
-  FROM "workspaces" w
- WHERE l."workspace_id" IS NULL
-   AND w."id" = l."site_id";
-
-UPDATE "project_listings" p
-   SET "workspace_id" = w."id"
-  FROM "workspaces" w
- WHERE p."workspace_id" IS NULL
-   AND w."id" = p."site_id";
-
-UPDATE "flow_definitions" d
-   SET "workspace_id" = w."id"
-  FROM "workspaces" w
- WHERE d."workspace_id" IS NULL
-   AND w."id" = d."site_id";
-
-UPDATE "flow_sessions" s
-   SET "workspace_id" = w."id"
-  FROM "workspaces" w
- WHERE s."workspace_id" IS NULL
-   AND w."id" = s."site_id";
-
--- ── Step 3 — POST-ASSERTIONS ─────────────────────────────────────────────────
-DO $$
-DECLARE
-  before_l bigint; before_p bigint; before_d bigint; before_s bigint;
-  after_l  bigint; after_p  bigint; after_d  bigint; after_s  bigint;
-  bad      bigint;
-BEGIN
-  SELECT l, p, d, s INTO before_l, before_p, before_d, before_s FROM "_6254_fence_census";
-  SELECT count(*) INTO after_l FROM "leads";
-  SELECT count(*) INTO after_p FROM "project_listings";
-  SELECT count(*) INTO after_d FROM "flow_definitions";
-  SELECT count(*) INTO after_s FROM "flow_sessions";
-
-  -- 1. Nothing lost: row counts unchanged.
-  IF before_l <> after_l OR before_p <> after_p OR before_d <> after_d OR before_s <> after_s THEN
-    RAISE EXCEPTION
-      '#6254 post-assertion: row count changed across a purely additive migration (leads % -> %, project_listings % -> %, flow_definitions % -> %, flow_sessions % -> %)',
-      before_l, after_l, before_p, after_p, before_d, after_d, before_s, after_s;
-  END IF;
-
-  -- 2. Nothing guessed: no row's workspace_id names a workspace absent from "workspaces".
-  SELECT count(*) INTO bad FROM "leads" l
-   WHERE l."workspace_id" IS NOT NULL AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = l."workspace_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6254 post-assertion: % leads row(s) carry a workspace_id absent from workspaces', bad;
-  END IF;
-  SELECT count(*) INTO bad FROM "project_listings" p
-   WHERE p."workspace_id" IS NOT NULL AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = p."workspace_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6254 post-assertion: % project_listings row(s) carry a workspace_id absent from workspaces', bad;
-  END IF;
-  SELECT count(*) INTO bad FROM "flow_definitions" d
-   WHERE d."workspace_id" IS NOT NULL AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = d."workspace_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6254 post-assertion: % flow_definitions row(s) carry a workspace_id absent from workspaces', bad;
-  END IF;
-  SELECT count(*) INTO bad FROM "flow_sessions" s
-   WHERE s."workspace_id" IS NOT NULL AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = s."workspace_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6254 post-assertion: % flow_sessions row(s) carry a workspace_id absent from workspaces', bad;
-  END IF;
-
-  -- 3. Nothing missed: no row whose (normalized) site_id names a real workspace
-  --    came out of the backfill with workspace_id still NULL.
-  SELECT count(*) INTO bad FROM "leads" l
-   WHERE l."workspace_id" IS NULL AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = l."site_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6254 post-assertion: % leads row(s) had a resolvable site_id but came out of the backfill NULL', bad;
-  END IF;
-  SELECT count(*) INTO bad FROM "project_listings" p
-   WHERE p."workspace_id" IS NULL AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = p."site_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6254 post-assertion: % project_listings row(s) had a resolvable site_id but came out of the backfill NULL', bad;
-  END IF;
-  SELECT count(*) INTO bad FROM "flow_definitions" d
-   WHERE d."workspace_id" IS NULL AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = d."site_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6254 post-assertion: % flow_definitions row(s) had a resolvable site_id but came out of the backfill NULL', bad;
-  END IF;
-  SELECT count(*) INTO bad FROM "flow_sessions" s
-   WHERE s."workspace_id" IS NULL AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = s."site_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6254 post-assertion: % flow_sessions row(s) had a resolvable site_id but came out of the backfill NULL', bad;
-  END IF;
-
-  -- 4. AC-7 / spec D2 point 4 — an unresolvable row must ABORT, never pass
-  --    through as a silent NULL: this migration is about to SET NOT NULL, so
-  --    (unlike the precedent's NOTICE-only posture) a remaining NULL here
-  --    means a row's site_id names no workspace this database holds, and
-  --    there is no correct value to write. Never deleted, never guessed.
-  SELECT count(*) INTO bad FROM "leads" WHERE "workspace_id" IS NULL;
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6254: % leads row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
-  END IF;
-  SELECT count(*) INTO bad FROM "project_listings" WHERE "workspace_id" IS NULL;
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6254: % project_listings row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
-  END IF;
-  SELECT count(*) INTO bad FROM "flow_definitions" WHERE "workspace_id" IS NULL;
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6254: % flow_definitions row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
-  END IF;
-  SELECT count(*) INTO bad FROM "flow_sessions" WHERE "workspace_id" IS NULL;
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6254: % flow_sessions row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
-  END IF;
-END $$;
-
--- ── Step 4 — SET NOT NULL (AC-3, AC-4, AC-7) ────────────────────────────────
-ALTER TABLE "leads"            ALTER COLUMN "workspace_id" SET NOT NULL;
-ALTER TABLE "project_listings" ALTER COLUMN "workspace_id" SET NOT NULL;
-ALTER TABLE "flow_definitions" ALTER COLUMN "workspace_id" SET NOT NULL;
-ALTER TABLE "flow_sessions"    ALTER COLUMN "workspace_id" SET NOT NULL;
-
--- ── Step 5 — equality CHECKs (AC-3, AC-4, AC-5) — DROP then ADD, not guarded ─
-ALTER TABLE "leads" DROP CONSTRAINT IF EXISTS "leads_workspace_site_agree";
-ALTER TABLE "leads" ADD CONSTRAINT "leads_workspace_site_agree" CHECK ("workspace_id" = "site_id");
-
-ALTER TABLE "project_listings" DROP CONSTRAINT IF EXISTS "project_listings_workspace_site_agree";
-ALTER TABLE "project_listings" ADD CONSTRAINT "project_listings_workspace_site_agree" CHECK ("workspace_id" = "site_id");
-
-ALTER TABLE "flow_definitions" DROP CONSTRAINT IF EXISTS "flow_definitions_workspace_site_agree";
-ALTER TABLE "flow_definitions" ADD CONSTRAINT "flow_definitions_workspace_site_agree" CHECK ("workspace_id" = "site_id");
-
-ALTER TABLE "flow_sessions" DROP CONSTRAINT IF EXISTS "flow_sessions_workspace_site_agree";
-ALTER TABLE "flow_sessions" ADD CONSTRAINT "flow_sessions_workspace_site_agree" CHECK ("workspace_id" = "site_id");
-
--- ════════════════════════════════════════════════════════════════════════════
--- #6374 — the fence fan-out. THIRTEEN more models join the fence, amended INTO
--- this file rather than added as a new migration, because #6254 AC-1 makes
--- this THE ONE schema migration M32 emits. Amending a merged migration is a
--- silent no-op on a database that already applied it; the operator disposed
--- the assumption that makes that safe on 2026-09-20 (spec § 1.5 — no
--- persistent database carries state that must survive; every site is
--- rebuildable). If that assumption ever stops holding, everything below moves
--- verbatim into a new migration directory and nothing else changes.
---
--- Eleven tables carry `site_id` and take the keystone shape above unchanged,
--- in the keystone's own five-step order: normalize -> backfill by INNER JOIN
--- -> four post-assertions -> SET NOT NULL -> the two CHECKs. Two do not carry
--- `site_id` and take the operator-disposed shapes (spec § 5 D2/D3), and
--- `deliverable_grants` gains a NULL-TOLERANT equality CHECK only (D4).
--- ════════════════════════════════════════════════════════════════════════════
-
--- The #6374 census, the twin of the #6254 one above. ON COMMIT DROP for the
--- same reason: `prisma migrate` runs each migration in one transaction.
-CREATE TEMP TABLE "_6374_fence_census" ON COMMIT DROP AS
-  SELECT (SELECT count(*) FROM "subscribers") AS "subscribers"
-       , (SELECT count(*) FROM "callbacks") AS "callbacks"
-       , (SELECT count(*) FROM "consent_grants") AS "consent_grants"
-       , (SELECT count(*) FROM "appointments") AS "appointments"
-       , (SELECT count(*) FROM "deliverable_assets") AS "deliverable_assets"
-       , (SELECT count(*) FROM "flow_checkouts") AS "flow_checkouts"
-       , (SELECT count(*) FROM "waitlist_experiments") AS "waitlist_experiments"
-       , (SELECT count(*) FROM "waitlist_scores") AS "waitlist_scores"
-       , (SELECT count(*) FROM "waitlist_followup_sends") AS "waitlist_followup_sends"
-       , (SELECT count(*) FROM "playbook_instances") AS "playbook_instances"
-       , (SELECT count(*) FROM "site_listing_configs") AS "site_listing_configs"
-;
-
--- ── Step 1 (D1 step 1) — the column and its index ─────────────────────────
--- Unlike the four keystone tables, these eleven have no `workspace_id`
--- column yet, so it is ADDED nullable here and tightened in step 4. ONE
--- index per table and nothing query-shaped (D6): a read-side unit that turns
--- out to need a composite gets a post-M32 migration, filed with the query
--- that justifies it.
-ALTER TABLE "subscribers" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
-CREATE INDEX IF NOT EXISTS "subscribers_workspace_id_idx" ON "subscribers" ("workspace_id");
-ALTER TABLE "callbacks" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
-CREATE INDEX IF NOT EXISTS "callbacks_workspace_id_idx" ON "callbacks" ("workspace_id");
-ALTER TABLE "consent_grants" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
-CREATE INDEX IF NOT EXISTS "consent_grants_workspace_id_idx" ON "consent_grants" ("workspace_id");
-ALTER TABLE "appointments" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
-CREATE INDEX IF NOT EXISTS "appointments_workspace_id_idx" ON "appointments" ("workspace_id");
-ALTER TABLE "deliverable_assets" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
-CREATE INDEX IF NOT EXISTS "deliverable_assets_workspace_id_idx" ON "deliverable_assets" ("workspace_id");
-ALTER TABLE "flow_checkouts" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
-CREATE INDEX IF NOT EXISTS "flow_checkouts_workspace_id_idx" ON "flow_checkouts" ("workspace_id");
-ALTER TABLE "waitlist_experiments" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
-CREATE INDEX IF NOT EXISTS "waitlist_experiments_workspace_id_idx" ON "waitlist_experiments" ("workspace_id");
-ALTER TABLE "waitlist_scores" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
-CREATE INDEX IF NOT EXISTS "waitlist_scores_workspace_id_idx" ON "waitlist_scores" ("workspace_id");
-ALTER TABLE "waitlist_followup_sends" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
-CREATE INDEX IF NOT EXISTS "waitlist_followup_sends_workspace_id_idx" ON "waitlist_followup_sends" ("workspace_id");
-ALTER TABLE "playbook_instances" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
-CREATE INDEX IF NOT EXISTS "playbook_instances_workspace_id_idx" ON "playbook_instances" ("workspace_id");
-ALTER TABLE "site_listing_configs" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
-CREATE INDEX IF NOT EXISTS "site_listing_configs_workspace_id_idx" ON "site_listing_configs" ("workspace_id");
-
--- ── Step 2 (D1 step 2 / keystone D1a) — normalize site_id -> the sentinel ──
--- The same literal, and the same one-way rewrite, the four keystone tables
--- above already took. database/__tests__/composite-fence.db.test.ts pins
--- EVERY `wksp_` literal in this file against the exported
--- DEFAULT_WORKSPACE_ID, so these eleven cannot drift from it either.
-UPDATE "subscribers"
-   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
- WHERE "site_id" = 'default';
-
-UPDATE "callbacks"
-   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
- WHERE "site_id" = 'default';
-
-UPDATE "consent_grants"
-   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
- WHERE "site_id" = 'default';
-
-UPDATE "appointments"
-   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
- WHERE "site_id" = 'default';
-
-UPDATE "deliverable_assets"
-   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
- WHERE "site_id" = 'default';
-
-UPDATE "flow_checkouts"
-   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
- WHERE "site_id" = 'default';
-
-UPDATE "waitlist_experiments"
-   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
- WHERE "site_id" = 'default';
-
-UPDATE "waitlist_scores"
-   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
- WHERE "site_id" = 'default';
-
-UPDATE "waitlist_followup_sends"
-   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
- WHERE "site_id" = 'default';
-
-UPDATE "playbook_instances"
-   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
- WHERE "site_id" = 'default';
-
-UPDATE "site_listing_configs"
-   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
- WHERE "site_id" = 'default';
-
--- ── Step 3 (D1 step 3 / keystone D2) — backfill by INNER JOIN, never by assignment ─
--- site_id is already normalized (step 1), so no CASE/alias branch is needed.
--- A row whose site_id resolves to nothing is simply not touched and stays
--- NULL — never guessed. Step 3's assertion 4 then aborts on it.
-UPDATE "subscribers" x
-   SET "workspace_id" = w."id"
-  FROM "workspaces" w
- WHERE x."workspace_id" IS NULL
-   AND w."id" = x."site_id";
-
-UPDATE "callbacks" x
-   SET "workspace_id" = w."id"
-  FROM "workspaces" w
- WHERE x."workspace_id" IS NULL
-   AND w."id" = x."site_id";
-
-UPDATE "consent_grants" x
-   SET "workspace_id" = w."id"
-  FROM "workspaces" w
- WHERE x."workspace_id" IS NULL
-   AND w."id" = x."site_id";
-
-UPDATE "appointments" x
-   SET "workspace_id" = w."id"
-  FROM "workspaces" w
- WHERE x."workspace_id" IS NULL
-   AND w."id" = x."site_id";
-
-UPDATE "deliverable_assets" x
-   SET "workspace_id" = w."id"
-  FROM "workspaces" w
- WHERE x."workspace_id" IS NULL
-   AND w."id" = x."site_id";
-
-UPDATE "flow_checkouts" x
-   SET "workspace_id" = w."id"
-  FROM "workspaces" w
- WHERE x."workspace_id" IS NULL
-   AND w."id" = x."site_id";
-
-UPDATE "waitlist_experiments" x
-   SET "workspace_id" = w."id"
-  FROM "workspaces" w
- WHERE x."workspace_id" IS NULL
-   AND w."id" = x."site_id";
-
-UPDATE "waitlist_scores" x
-   SET "workspace_id" = w."id"
-  FROM "workspaces" w
- WHERE x."workspace_id" IS NULL
-   AND w."id" = x."site_id";
-
-UPDATE "waitlist_followup_sends" x
-   SET "workspace_id" = w."id"
-  FROM "workspaces" w
- WHERE x."workspace_id" IS NULL
-   AND w."id" = x."site_id";
-
-UPDATE "playbook_instances" x
-   SET "workspace_id" = w."id"
-  FROM "workspaces" w
- WHERE x."workspace_id" IS NULL
-   AND w."id" = x."site_id";
-
-UPDATE "site_listing_configs" x
-   SET "workspace_id" = w."id"
-  FROM "workspaces" w
- WHERE x."workspace_id" IS NULL
-   AND w."id" = x."site_id";
-
--- ── Step 4 (D1 step 4) — POST-ASSERTIONS, four per table ──────────────────
--- Nothing lost (row census unchanged), nothing guessed (no workspace_id
--- absent from "workspaces"), nothing missed (no resolvable site_id left
--- NULL), and ABORT on any remaining NULL — this migration is about to
--- SET NOT NULL, so an unresolvable row has no correct value to write. Never
--- deleted, never guessed (NFR3).
-DO $$
-DECLARE
-  before_n bigint; after_n bigint; bad bigint;
-BEGIN
-  -- 1. Nothing lost — "subscribers"
-  SELECT "subscribers" INTO before_n FROM "_6374_fence_census";
-  SELECT count(*) INTO after_n FROM "subscribers";
-  IF before_n <> after_n THEN
-    RAISE EXCEPTION '#6374 post-assertion: row count changed across a purely additive migration (subscribers % -> %)', before_n, after_n;
-  END IF;
-
-  -- 2. Nothing guessed — "subscribers"
-  SELECT count(*) INTO bad FROM "subscribers" x
-   WHERE x."workspace_id" IS NOT NULL
-     AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."workspace_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374 post-assertion: % subscribers row(s) carry a workspace_id absent from workspaces', bad;
-  END IF;
-
-  -- 3. Nothing missed — "subscribers"
-  SELECT count(*) INTO bad FROM "subscribers" x
-   WHERE x."workspace_id" IS NULL
-     AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."site_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374 post-assertion: % subscribers row(s) had a resolvable site_id but came out of the backfill NULL', bad;
-  END IF;
-
-  -- 4. Abort on any remaining NULL — "subscribers"
-  SELECT count(*) INTO bad FROM "subscribers" WHERE "workspace_id" IS NULL;
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374: % subscribers row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
-  END IF;
-
-  -- 1. Nothing lost — "callbacks"
-  SELECT "callbacks" INTO before_n FROM "_6374_fence_census";
-  SELECT count(*) INTO after_n FROM "callbacks";
-  IF before_n <> after_n THEN
-    RAISE EXCEPTION '#6374 post-assertion: row count changed across a purely additive migration (callbacks % -> %)', before_n, after_n;
-  END IF;
-
-  -- 2. Nothing guessed — "callbacks"
-  SELECT count(*) INTO bad FROM "callbacks" x
-   WHERE x."workspace_id" IS NOT NULL
-     AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."workspace_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374 post-assertion: % callbacks row(s) carry a workspace_id absent from workspaces', bad;
-  END IF;
-
-  -- 3. Nothing missed — "callbacks"
-  SELECT count(*) INTO bad FROM "callbacks" x
-   WHERE x."workspace_id" IS NULL
-     AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."site_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374 post-assertion: % callbacks row(s) had a resolvable site_id but came out of the backfill NULL', bad;
-  END IF;
-
-  -- 4. Abort on any remaining NULL — "callbacks"
-  SELECT count(*) INTO bad FROM "callbacks" WHERE "workspace_id" IS NULL;
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374: % callbacks row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
-  END IF;
-
-  -- 1. Nothing lost — "consent_grants"
-  SELECT "consent_grants" INTO before_n FROM "_6374_fence_census";
-  SELECT count(*) INTO after_n FROM "consent_grants";
-  IF before_n <> after_n THEN
-    RAISE EXCEPTION '#6374 post-assertion: row count changed across a purely additive migration (consent_grants % -> %)', before_n, after_n;
-  END IF;
-
-  -- 2. Nothing guessed — "consent_grants"
-  SELECT count(*) INTO bad FROM "consent_grants" x
-   WHERE x."workspace_id" IS NOT NULL
-     AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."workspace_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374 post-assertion: % consent_grants row(s) carry a workspace_id absent from workspaces', bad;
-  END IF;
-
-  -- 3. Nothing missed — "consent_grants"
-  SELECT count(*) INTO bad FROM "consent_grants" x
-   WHERE x."workspace_id" IS NULL
-     AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."site_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374 post-assertion: % consent_grants row(s) had a resolvable site_id but came out of the backfill NULL', bad;
-  END IF;
-
-  -- 4. Abort on any remaining NULL — "consent_grants"
-  SELECT count(*) INTO bad FROM "consent_grants" WHERE "workspace_id" IS NULL;
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374: % consent_grants row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
-  END IF;
-
-  -- 1. Nothing lost — "appointments"
-  SELECT "appointments" INTO before_n FROM "_6374_fence_census";
-  SELECT count(*) INTO after_n FROM "appointments";
-  IF before_n <> after_n THEN
-    RAISE EXCEPTION '#6374 post-assertion: row count changed across a purely additive migration (appointments % -> %)', before_n, after_n;
-  END IF;
-
-  -- 2. Nothing guessed — "appointments"
-  SELECT count(*) INTO bad FROM "appointments" x
-   WHERE x."workspace_id" IS NOT NULL
-     AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."workspace_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374 post-assertion: % appointments row(s) carry a workspace_id absent from workspaces', bad;
-  END IF;
-
-  -- 3. Nothing missed — "appointments"
-  SELECT count(*) INTO bad FROM "appointments" x
-   WHERE x."workspace_id" IS NULL
-     AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."site_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374 post-assertion: % appointments row(s) had a resolvable site_id but came out of the backfill NULL', bad;
-  END IF;
-
-  -- 4. Abort on any remaining NULL — "appointments"
-  SELECT count(*) INTO bad FROM "appointments" WHERE "workspace_id" IS NULL;
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374: % appointments row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
-  END IF;
-
-  -- 1. Nothing lost — "deliverable_assets"
-  SELECT "deliverable_assets" INTO before_n FROM "_6374_fence_census";
-  SELECT count(*) INTO after_n FROM "deliverable_assets";
-  IF before_n <> after_n THEN
-    RAISE EXCEPTION '#6374 post-assertion: row count changed across a purely additive migration (deliverable_assets % -> %)', before_n, after_n;
-  END IF;
-
-  -- 2. Nothing guessed — "deliverable_assets"
-  SELECT count(*) INTO bad FROM "deliverable_assets" x
-   WHERE x."workspace_id" IS NOT NULL
-     AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."workspace_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374 post-assertion: % deliverable_assets row(s) carry a workspace_id absent from workspaces', bad;
-  END IF;
-
-  -- 3. Nothing missed — "deliverable_assets"
-  SELECT count(*) INTO bad FROM "deliverable_assets" x
-   WHERE x."workspace_id" IS NULL
-     AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."site_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374 post-assertion: % deliverable_assets row(s) had a resolvable site_id but came out of the backfill NULL', bad;
-  END IF;
-
-  -- 4. Abort on any remaining NULL — "deliverable_assets"
-  SELECT count(*) INTO bad FROM "deliverable_assets" WHERE "workspace_id" IS NULL;
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374: % deliverable_assets row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
-  END IF;
-
-  -- 1. Nothing lost — "flow_checkouts"
-  SELECT "flow_checkouts" INTO before_n FROM "_6374_fence_census";
-  SELECT count(*) INTO after_n FROM "flow_checkouts";
-  IF before_n <> after_n THEN
-    RAISE EXCEPTION '#6374 post-assertion: row count changed across a purely additive migration (flow_checkouts % -> %)', before_n, after_n;
-  END IF;
-
-  -- 2. Nothing guessed — "flow_checkouts"
-  SELECT count(*) INTO bad FROM "flow_checkouts" x
-   WHERE x."workspace_id" IS NOT NULL
-     AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."workspace_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374 post-assertion: % flow_checkouts row(s) carry a workspace_id absent from workspaces', bad;
-  END IF;
-
-  -- 3. Nothing missed — "flow_checkouts"
-  SELECT count(*) INTO bad FROM "flow_checkouts" x
-   WHERE x."workspace_id" IS NULL
-     AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."site_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374 post-assertion: % flow_checkouts row(s) had a resolvable site_id but came out of the backfill NULL', bad;
-  END IF;
-
-  -- 4. Abort on any remaining NULL — "flow_checkouts"
-  SELECT count(*) INTO bad FROM "flow_checkouts" WHERE "workspace_id" IS NULL;
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374: % flow_checkouts row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
-  END IF;
-
-  -- 1. Nothing lost — "waitlist_experiments"
-  SELECT "waitlist_experiments" INTO before_n FROM "_6374_fence_census";
-  SELECT count(*) INTO after_n FROM "waitlist_experiments";
-  IF before_n <> after_n THEN
-    RAISE EXCEPTION '#6374 post-assertion: row count changed across a purely additive migration (waitlist_experiments % -> %)', before_n, after_n;
-  END IF;
-
-  -- 2. Nothing guessed — "waitlist_experiments"
-  SELECT count(*) INTO bad FROM "waitlist_experiments" x
-   WHERE x."workspace_id" IS NOT NULL
-     AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."workspace_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374 post-assertion: % waitlist_experiments row(s) carry a workspace_id absent from workspaces', bad;
-  END IF;
-
-  -- 3. Nothing missed — "waitlist_experiments"
-  SELECT count(*) INTO bad FROM "waitlist_experiments" x
-   WHERE x."workspace_id" IS NULL
-     AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."site_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374 post-assertion: % waitlist_experiments row(s) had a resolvable site_id but came out of the backfill NULL', bad;
-  END IF;
-
-  -- 4. Abort on any remaining NULL — "waitlist_experiments"
-  SELECT count(*) INTO bad FROM "waitlist_experiments" WHERE "workspace_id" IS NULL;
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374: % waitlist_experiments row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
-  END IF;
-
-  -- 1. Nothing lost — "waitlist_scores"
-  SELECT "waitlist_scores" INTO before_n FROM "_6374_fence_census";
-  SELECT count(*) INTO after_n FROM "waitlist_scores";
-  IF before_n <> after_n THEN
-    RAISE EXCEPTION '#6374 post-assertion: row count changed across a purely additive migration (waitlist_scores % -> %)', before_n, after_n;
-  END IF;
-
-  -- 2. Nothing guessed — "waitlist_scores"
-  SELECT count(*) INTO bad FROM "waitlist_scores" x
-   WHERE x."workspace_id" IS NOT NULL
-     AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."workspace_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374 post-assertion: % waitlist_scores row(s) carry a workspace_id absent from workspaces', bad;
-  END IF;
-
-  -- 3. Nothing missed — "waitlist_scores"
-  SELECT count(*) INTO bad FROM "waitlist_scores" x
-   WHERE x."workspace_id" IS NULL
-     AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."site_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374 post-assertion: % waitlist_scores row(s) had a resolvable site_id but came out of the backfill NULL', bad;
-  END IF;
-
-  -- 4. Abort on any remaining NULL — "waitlist_scores"
-  SELECT count(*) INTO bad FROM "waitlist_scores" WHERE "workspace_id" IS NULL;
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374: % waitlist_scores row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
-  END IF;
-
-  -- 1. Nothing lost — "waitlist_followup_sends"
-  SELECT "waitlist_followup_sends" INTO before_n FROM "_6374_fence_census";
-  SELECT count(*) INTO after_n FROM "waitlist_followup_sends";
-  IF before_n <> after_n THEN
-    RAISE EXCEPTION '#6374 post-assertion: row count changed across a purely additive migration (waitlist_followup_sends % -> %)', before_n, after_n;
-  END IF;
-
-  -- 2. Nothing guessed — "waitlist_followup_sends"
-  SELECT count(*) INTO bad FROM "waitlist_followup_sends" x
-   WHERE x."workspace_id" IS NOT NULL
-     AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."workspace_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374 post-assertion: % waitlist_followup_sends row(s) carry a workspace_id absent from workspaces', bad;
-  END IF;
-
-  -- 3. Nothing missed — "waitlist_followup_sends"
-  SELECT count(*) INTO bad FROM "waitlist_followup_sends" x
-   WHERE x."workspace_id" IS NULL
-     AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."site_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374 post-assertion: % waitlist_followup_sends row(s) had a resolvable site_id but came out of the backfill NULL', bad;
-  END IF;
-
-  -- 4. Abort on any remaining NULL — "waitlist_followup_sends"
-  SELECT count(*) INTO bad FROM "waitlist_followup_sends" WHERE "workspace_id" IS NULL;
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374: % waitlist_followup_sends row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
-  END IF;
-
-  -- 1. Nothing lost — "playbook_instances"
-  SELECT "playbook_instances" INTO before_n FROM "_6374_fence_census";
-  SELECT count(*) INTO after_n FROM "playbook_instances";
-  IF before_n <> after_n THEN
-    RAISE EXCEPTION '#6374 post-assertion: row count changed across a purely additive migration (playbook_instances % -> %)', before_n, after_n;
-  END IF;
-
-  -- 2. Nothing guessed — "playbook_instances"
-  SELECT count(*) INTO bad FROM "playbook_instances" x
-   WHERE x."workspace_id" IS NOT NULL
-     AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."workspace_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374 post-assertion: % playbook_instances row(s) carry a workspace_id absent from workspaces', bad;
-  END IF;
-
-  -- 3. Nothing missed — "playbook_instances"
-  SELECT count(*) INTO bad FROM "playbook_instances" x
-   WHERE x."workspace_id" IS NULL
-     AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."site_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374 post-assertion: % playbook_instances row(s) had a resolvable site_id but came out of the backfill NULL', bad;
-  END IF;
-
-  -- 4. Abort on any remaining NULL — "playbook_instances"
-  SELECT count(*) INTO bad FROM "playbook_instances" WHERE "workspace_id" IS NULL;
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374: % playbook_instances row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
-  END IF;
-
-  -- 1. Nothing lost — "site_listing_configs"
-  SELECT "site_listing_configs" INTO before_n FROM "_6374_fence_census";
-  SELECT count(*) INTO after_n FROM "site_listing_configs";
-  IF before_n <> after_n THEN
-    RAISE EXCEPTION '#6374 post-assertion: row count changed across a purely additive migration (site_listing_configs % -> %)', before_n, after_n;
-  END IF;
-
-  -- 2. Nothing guessed — "site_listing_configs"
-  SELECT count(*) INTO bad FROM "site_listing_configs" x
-   WHERE x."workspace_id" IS NOT NULL
-     AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."workspace_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374 post-assertion: % site_listing_configs row(s) carry a workspace_id absent from workspaces', bad;
-  END IF;
-
-  -- 3. Nothing missed — "site_listing_configs"
-  SELECT count(*) INTO bad FROM "site_listing_configs" x
-   WHERE x."workspace_id" IS NULL
-     AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."site_id");
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374 post-assertion: % site_listing_configs row(s) had a resolvable site_id but came out of the backfill NULL', bad;
-  END IF;
-
-  -- 4. Abort on any remaining NULL — "site_listing_configs"
-  SELECT count(*) INTO bad FROM "site_listing_configs" WHERE "workspace_id" IS NULL;
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374: % site_listing_configs row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
-  END IF;
-
-END $$;
-
--- ── Step 5a (D1 step 5) — SET NOT NULL (spec FR1, AC-1) ───────────────────
-ALTER TABLE "subscribers" ALTER COLUMN "workspace_id" SET NOT NULL;
-ALTER TABLE "callbacks" ALTER COLUMN "workspace_id" SET NOT NULL;
-ALTER TABLE "consent_grants" ALTER COLUMN "workspace_id" SET NOT NULL;
-ALTER TABLE "appointments" ALTER COLUMN "workspace_id" SET NOT NULL;
-ALTER TABLE "deliverable_assets" ALTER COLUMN "workspace_id" SET NOT NULL;
-ALTER TABLE "flow_checkouts" ALTER COLUMN "workspace_id" SET NOT NULL;
-ALTER TABLE "waitlist_experiments" ALTER COLUMN "workspace_id" SET NOT NULL;
-ALTER TABLE "waitlist_scores" ALTER COLUMN "workspace_id" SET NOT NULL;
-ALTER TABLE "waitlist_followup_sends" ALTER COLUMN "workspace_id" SET NOT NULL;
-ALTER TABLE "playbook_instances" ALTER COLUMN "workspace_id" SET NOT NULL;
-ALTER TABLE "site_listing_configs" ALTER COLUMN "workspace_id" SET NOT NULL;
-
--- ── Step 5b (D1 step 5) — the two CHECKs, DROP then ADD, never the guarded DO block ─
--- keystone D5 / SEC-06: an existence guard would silently no-op a TIGHTENING
--- on any database that already carries a same-named constraint — a
--- false-green control. The format CHECK carries NO `IS NULL OR` arm (the
--- precedent's did, because the precedent never enforced NOT NULL; step 4
--- just did).
-ALTER TABLE "subscribers" DROP CONSTRAINT IF EXISTS "subscribers_workspace_id_format";
-ALTER TABLE "subscribers" ADD CONSTRAINT "subscribers_workspace_id_format"
-  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "subscribers" DROP CONSTRAINT IF EXISTS "subscribers_workspace_site_agree";
-ALTER TABLE "subscribers" ADD CONSTRAINT "subscribers_workspace_site_agree"
-  CHECK ("workspace_id" = "site_id");
-
-ALTER TABLE "callbacks" DROP CONSTRAINT IF EXISTS "callbacks_workspace_id_format";
-ALTER TABLE "callbacks" ADD CONSTRAINT "callbacks_workspace_id_format"
-  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "callbacks" DROP CONSTRAINT IF EXISTS "callbacks_workspace_site_agree";
-ALTER TABLE "callbacks" ADD CONSTRAINT "callbacks_workspace_site_agree"
-  CHECK ("workspace_id" = "site_id");
-
-ALTER TABLE "consent_grants" DROP CONSTRAINT IF EXISTS "consent_grants_workspace_id_format";
-ALTER TABLE "consent_grants" ADD CONSTRAINT "consent_grants_workspace_id_format"
-  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "consent_grants" DROP CONSTRAINT IF EXISTS "consent_grants_workspace_site_agree";
-ALTER TABLE "consent_grants" ADD CONSTRAINT "consent_grants_workspace_site_agree"
-  CHECK ("workspace_id" = "site_id");
-
-ALTER TABLE "appointments" DROP CONSTRAINT IF EXISTS "appointments_workspace_id_format";
-ALTER TABLE "appointments" ADD CONSTRAINT "appointments_workspace_id_format"
-  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "appointments" DROP CONSTRAINT IF EXISTS "appointments_workspace_site_agree";
-ALTER TABLE "appointments" ADD CONSTRAINT "appointments_workspace_site_agree"
-  CHECK ("workspace_id" = "site_id");
-
-ALTER TABLE "deliverable_assets" DROP CONSTRAINT IF EXISTS "deliverable_assets_workspace_id_format";
-ALTER TABLE "deliverable_assets" ADD CONSTRAINT "deliverable_assets_workspace_id_format"
-  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "deliverable_assets" DROP CONSTRAINT IF EXISTS "deliverable_assets_workspace_site_agree";
-ALTER TABLE "deliverable_assets" ADD CONSTRAINT "deliverable_assets_workspace_site_agree"
-  CHECK ("workspace_id" = "site_id");
-
-ALTER TABLE "flow_checkouts" DROP CONSTRAINT IF EXISTS "flow_checkouts_workspace_id_format";
-ALTER TABLE "flow_checkouts" ADD CONSTRAINT "flow_checkouts_workspace_id_format"
-  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "flow_checkouts" DROP CONSTRAINT IF EXISTS "flow_checkouts_workspace_site_agree";
-ALTER TABLE "flow_checkouts" ADD CONSTRAINT "flow_checkouts_workspace_site_agree"
-  CHECK ("workspace_id" = "site_id");
-
-ALTER TABLE "waitlist_experiments" DROP CONSTRAINT IF EXISTS "waitlist_experiments_workspace_id_format";
-ALTER TABLE "waitlist_experiments" ADD CONSTRAINT "waitlist_experiments_workspace_id_format"
-  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "waitlist_experiments" DROP CONSTRAINT IF EXISTS "waitlist_experiments_workspace_site_agree";
-ALTER TABLE "waitlist_experiments" ADD CONSTRAINT "waitlist_experiments_workspace_site_agree"
-  CHECK ("workspace_id" = "site_id");
-
-ALTER TABLE "waitlist_scores" DROP CONSTRAINT IF EXISTS "waitlist_scores_workspace_id_format";
-ALTER TABLE "waitlist_scores" ADD CONSTRAINT "waitlist_scores_workspace_id_format"
-  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "waitlist_scores" DROP CONSTRAINT IF EXISTS "waitlist_scores_workspace_site_agree";
-ALTER TABLE "waitlist_scores" ADD CONSTRAINT "waitlist_scores_workspace_site_agree"
-  CHECK ("workspace_id" = "site_id");
-
-ALTER TABLE "waitlist_followup_sends" DROP CONSTRAINT IF EXISTS "waitlist_followup_sends_workspace_id_format";
-ALTER TABLE "waitlist_followup_sends" ADD CONSTRAINT "waitlist_followup_sends_workspace_id_format"
-  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "waitlist_followup_sends" DROP CONSTRAINT IF EXISTS "waitlist_followup_sends_workspace_site_agree";
-ALTER TABLE "waitlist_followup_sends" ADD CONSTRAINT "waitlist_followup_sends_workspace_site_agree"
-  CHECK ("workspace_id" = "site_id");
-
-ALTER TABLE "playbook_instances" DROP CONSTRAINT IF EXISTS "playbook_instances_workspace_id_format";
-ALTER TABLE "playbook_instances" ADD CONSTRAINT "playbook_instances_workspace_id_format"
-  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "playbook_instances" DROP CONSTRAINT IF EXISTS "playbook_instances_workspace_site_agree";
-ALTER TABLE "playbook_instances" ADD CONSTRAINT "playbook_instances_workspace_site_agree"
-  CHECK ("workspace_id" = "site_id");
-
-ALTER TABLE "site_listing_configs" DROP CONSTRAINT IF EXISTS "site_listing_configs_workspace_id_format";
-ALTER TABLE "site_listing_configs" ADD CONSTRAINT "site_listing_configs_workspace_id_format"
-  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "site_listing_configs" DROP CONSTRAINT IF EXISTS "site_listing_configs_workspace_site_agree";
-ALTER TABLE "site_listing_configs" ADD CONSTRAINT "site_listing_configs_workspace_site_agree"
-  CHECK ("workspace_id" = "site_id");
-
-
--- ── D2 — `listing_csv_sends`: NOT NULL + format CHECK, no equality CHECK ────
--- It has no `site_id`, so an equality CHECK has nothing to compare. The
--- backfill takes the workspace from the PARENT listing row, which the
--- keystone above already fenced. A composite FK to `project_listings` is
--- legal here (both models are `inbox`) and was offered; the operator chose
--- ONE fence shape over a second, stricter one for an audit-log table
--- (2026-09-20, spec § 8 Q1 -> option (a)).
-ALTER TABLE "listing_csv_sends" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
-CREATE INDEX IF NOT EXISTS "listing_csv_sends_workspace_id_idx"
-  ON "listing_csv_sends" ("workspace_id");
-
-UPDATE "listing_csv_sends" s
-   SET "workspace_id" = p."workspace_id"
-  FROM "project_listings" p
- WHERE s."workspace_id" IS NULL
-   AND p."id" = s."listing_id";
-
-DO $$
-DECLARE
-  bad bigint;
-BEGIN
-  -- The same abort-on-NULL rule the eleven take: a send row whose listing is
-  -- gone (or was never fenced) has no correct workspace to write, and this
-  -- is about to SET NOT NULL. Never deleted, never guessed (NFR3).
-  SELECT count(*) INTO bad FROM "listing_csv_sends" WHERE "workspace_id" IS NULL;
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374: % listing_csv_sends row(s) have a listing_id that resolves to no project_listings row — resolve or remove them before re-running this migration', bad;
-  END IF;
-END $$;
-
-ALTER TABLE "listing_csv_sends" ALTER COLUMN "workspace_id" SET NOT NULL;
-
-ALTER TABLE "listing_csv_sends" DROP CONSTRAINT IF EXISTS "listing_csv_sends_workspace_id_format";
-ALTER TABLE "listing_csv_sends" ADD CONSTRAINT "listing_csv_sends_workspace_id_format"
-  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-
--- ── D3 — `site_settings`: keyed BY the workspace, read through the alias ────
--- It has no `site_id` either, and its one read
--- (apps/api/src/services/dunning-policy.ts) arrives with a site ALIAS. Every
--- existing row backfills to the SENTINEL workspace: a pre-fence row belonged
--- to "the site", which is exactly what the alias `default` resolves to — the
--- same rule step 1 applies to `site_id` on the eleven.
---
--- This is the one block that moves a UNIQUE INDEX, which is why index DDL
--- appears here and in none of the five steps above: `key` was globally
--- unique, so two sellers could not both hold `feature_flags`. The `key` TEXT
--- itself is left VERBATIM — `dunning-policy.ts` embeds the site alias in the
--- key string, and rebuilding it from the resolved id would match no row and
--- silently hand every seller the built-in default policy (spec D3).
-ALTER TABLE "site_settings" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
-CREATE INDEX IF NOT EXISTS "site_settings_workspace_id_idx"
-  ON "site_settings" ("workspace_id");
-
--- ── ABORT, NEVER GUESS — before the sentinel assignment below (AC-14) ──────
--- NFR3 ("an unresolvable row aborts the migration; it is never deleted and
--- never guessed") applied to the ONE table whose tenant lives in its key TEXT
--- rather than in a column. The assignment below attributes every unattributed
--- row to the sentinel, which is right for a row that belonged to "the site" —
--- and WRONG for a row whose key already names a DIFFERENT workspace. Such a
--- row would be silently misfiled under the sentinel, and
--- `dunning-policy.ts`'s read (keyed on the resolved workspace AND the verbatim
--- key) would then miss it forever, falling back to the built-in default
--- policy — MORE permissive than a configured one, on a delinquent-
--- subscription path. Found by this unit's own security review; disposed by
--- the operator 2026-09-20 as abort-not-derive.
---
--- This DETECTS; it never DERIVES. The embedded id is matched and counted, and
--- is never read back out and used as the backfill value — key parsing is
--- exactly what spec D3 forbids, because the alias in the key is load-bearing
--- for the read. An operator whose database trips this resolves or removes the
--- rows by hand and re-runs.
---
--- The negative lookahead is what makes this precise: it matches a well-formed
--- `wksp_`+UUIDv7 that is NOT the sentinel literal. A key carrying the sentinel
--- id, a bare alias (`…:default`), or no id at all is left for the sentinel
--- assignment below, exactly as before.
---
--- Guarded on `workspace_id IS NULL`, so on an already-migrated database every
--- row is attributed, the count is zero, and a verbatim re-run stays the no-op
--- NFR2 requires.
-DO $$
-DECLARE
-  bad bigint;
-BEGIN
-  SELECT count(*) INTO bad
-    FROM "site_settings"
-   WHERE "workspace_id" IS NULL
-     AND "key" ~ 'wksp_(?!00000000-0000-7000-8000-000000000001)[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}';
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374: % site_settings row(s) carry a NON-SENTINEL workspace id embedded in their key and no workspace_id of their own — assigning them to the sentinel would misfile them and make their read miss forever; resolve or remove them before re-running this migration', bad;
-  END IF;
-END $$;
-
-UPDATE "site_settings"
-   SET "workspace_id" = 'wksp_00000000-0000-7000-8000-000000000001'
- WHERE "workspace_id" IS NULL
-   AND EXISTS (
-     SELECT 1 FROM "workspaces" w
-      WHERE w."id" = 'wksp_00000000-0000-7000-8000-000000000001'
-   );
-
-DO $$
-DECLARE
-  bad bigint;
-BEGIN
-  -- Abort rather than guess: a settings row on a database with no sentinel
-  -- workspace has no workspace to belong to, and this is about to
-  -- SET NOT NULL.
-  SELECT count(*) INTO bad FROM "site_settings" WHERE "workspace_id" IS NULL;
-  IF bad <> 0 THEN
-    RAISE EXCEPTION '#6374: % site_settings row(s) remain unattributed — this database holds no sentinel workspace to backfill them to; resolve or remove them before re-running this migration', bad;
-  END IF;
-END $$;
-
-ALTER TABLE "site_settings" ALTER COLUMN "workspace_id" SET NOT NULL;
-
-ALTER TABLE "site_settings" DROP CONSTRAINT IF EXISTS "site_settings_workspace_id_format";
-ALTER TABLE "site_settings" ADD CONSTRAINT "site_settings_workspace_id_format"
-  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-
--- The unique key moves from (key) to (workspace_id, key).
---
--- DROP-then-CREATE for the REPLACEMENT too, never `CREATE UNIQUE INDEX IF NOT
--- EXISTS` — the same keystone D5 / SEC-06 rule the CHECKs above follow, and
--- this is the one place in this file where a constraint REPLACES a dropped
--- one, so it is the one place the false-green would actually cost something.
--- `IF NOT EXISTS` matches on NAME ALONE: an index of this name that was
--- non-unique, or over different columns, would silently satisfy the guard and
--- leave `site_settings` with NO uniqueness at all — having already dropped the
--- old one unconditionally on the line above. The old index is a plain index,
--- not a table constraint (20260508000000_add_inbox_namespace created it with
--- `CREATE UNIQUE INDEX`), so `DROP INDEX` is the correct verb for both.
-DROP INDEX IF EXISTS "site_settings_key_key";
-DROP INDEX IF EXISTS "site_settings_workspace_id_key_key";
-CREATE UNIQUE INDEX "site_settings_workspace_id_key_key"
-  ON "site_settings" ("workspace_id", "key");
-
--- ── D4 — `deliverable_grants`: stamped at mint, and STILL nullable ──────────
--- No column is added and no existing row is touched. NULL remains the serve
--- path's fail-closed sentinel (#6254 § 10.1 Q2): a legacy `dasset_` grant and
--- a `playbook:` virtual one keep their NULL and keep meaning "serve nothing".
--- `deliverable_grants.site_id` is deliberately NOT normalized — a legacy row
--- keeps its alias, which with a NULL workspace still means serve nothing.
---
--- What IS added is the NULL-TOLERANT equality CHECK, so a STAMPED grant can
--- never disagree with its site while a legacy grant stays storable. Both mint
--- sites stamp the workspace they already hold (AC-8).
-ALTER TABLE "deliverable_grants" DROP CONSTRAINT IF EXISTS "deliverable_grants_workspace_site_agree";
-ALTER TABLE "deliverable_grants" ADD CONSTRAINT "deliverable_grants_workspace_site_agree"
-  CHECK ("workspace_id" IS NULL OR "workspace_id" = "site_id");