create-ailk 0.5.0 → 0.6.0

package/templates/database/inbox/schema.prisma

@@ -8,16 +8,53 @@
 //
 // Generator + datasource blocks live in database/schema.prisma (the root schema
 // file). This file holds only model definitions for the inbox namespace.
+//
+// ── The fence fan-out (#6374) — why `workspaceId` sits where it does ────────
+// Eleven models in this file carry the tenancy fence: a NOT NULL
+// `workspaceId` mapped to `workspace_id`, an `@@index([workspaceId])`, and a
+// `<table>_workspace_site_agree` CHECK added by
+// database/migrations/20260922120000_tenancy_fence. No Prisma relation is
+// declared for it (no Prisma relation directive) and no raw-SQL foreign key
+// is added (ADR-0009 invariant #1) — the CHECK is the fence, and it is
+// strictly tighter than an FK, because `site_id` IS the resolved workspace id.
 
 /// Lead — anonymous lead submission (Phase B submit_lead tool / B6 route)
 model Lead {
   id        String   @id @default(dbgenerated("('lead_'::text || (uuidv7())::text)")) @db.Text
   siteId    String   @map("site_id")
+  // #6203 — the isolation key `tenantDb(tenant).leads` filters on. Plain
+  // scalar, no @relation (ADR 0009 D1, the same reasoning `promotedUserId`
+  // below already applies). Backfilled by
+  // database/migrations/20260919140000_inbox_workspace_key.
+  //
+  // #6254 AC-3/AC-4/AC-7 — NOT NULL as of
+  // database/migrations/20260922120000_tenancy_fence, which also normalizes
+  // `siteId` to the resolved workspace id and adds
+  // `leads_workspace_site_agree CHECK ("workspace_id" = "site_id")`: since
+  // `siteId` IS the workspace id (never a WorkspaceSiteIdentity id — see
+  // that model's docblock), Postgres itself now rejects a row whose two
+  // columns disagree, in place of the issue's literal (and unbuildable,
+  // ADR-0009-crossing) composite FK — docs/database/namespaces.md. Every
+  // write site derives this value server-side from the resolved site
+  // alias; never from a request body (AC-6).
+  workspaceId String @map("workspace_id")
   source    String
   email     String
   payload   Json
   createdAt DateTime @default(now()) @map("created_at")
 
+  // #6204 — the triage stamp. NOT `promotedAt`'s sibling: `promotedAt` below
+  // is the lead→user PROMOTION stamp, written by the email-verification
+  // reconciler and true of a lead regardless of whether anyone has answered
+  // it. `handledAt` is written by an operator (or an agent acting for one)
+  // clearing a MESSAGE out of the Needs-you queue (spec D8). Nullable, no
+  // default — every existing row reads NULL, i.e. unhandled (spec D5).
+  // `handledBy` is the actor, mirroring `ProjectListing.decidedBy` below
+  // (spec D4/S-7) — plain scalar, no @relation (ADR 0009 D2), the same
+  // posture `promotedUserId` already takes.
+  handledAt DateTime? @map("handled_at")
+  handledBy String?   @map("handled_by")
+
   // Lead → user promotion (#3586). Plain scalars — no cross-namespace
   // @relation into auth.User (ADR 0009 invariant #1). Set by
   // apps/api/src/services/lead-promotion.ts once the reconciling user's
@@ -29,6 +66,18 @@ model Lead {
   @@index([siteId])
   @@index([createdAt])
   @@index([email])
+  @@index([workspaceId])
+  // #6204 — the message-inbox read: workspaceId = $1 AND handledAt IS NULL
+  // AND source = ANY($2), ordered by createdAt desc. Two columns, not three
+  // (spec D10): `source` is an IN over four values Postgres applies cheaply
+  // after this narrowing, so it is not worth widening the index on every
+  // write.
+  @@index([workspaceId, handledAt])
+  // #6246 — the per-magnet read: workspaceId = $1 AND source = $2, ordered
+  // by createdAt desc (spec § 1.5/D1). `source` here is an EXACT-equality
+  // `'flow:' + <magnet slug>` value, not the `handledAt` index's allowlist
+  // `IN` — a distinct query shape that composite does not serve.
+  @@index([workspaceId, source])
   @@map("leads")
 }
 
@@ -36,27 +85,91 @@ model Lead {
 model Subscriber {
   id        String   @id @default(dbgenerated("('subscr_'::text || (uuidv7())::text)")) @db.Text
   siteId    String   @map("site_id")
+  // #6374 — the tenancy fence, extended to this model (spec
+  // docs/specs/6374-the-fence-schema-wave-spec.md D1). NOT NULL, no
+  // Prisma relation directive (ADR-0009 invariant #1), and
+  // subscribers_workspace_site_agree CHECK (workspace_id = site_id) — since
+  // siteId IS the resolved workspace id, Postgres itself rejects a row
+  // whose two columns disagree. Every write site stamps a SERVER-RESOLVED
+  // value, never one from a request body (AC-6).
+  workspaceId String @map("workspace_id")
   email     String
   source    String
   createdAt DateTime @default(now()) @map("created_at")
 
   @@unique([siteId, email])
   @@index([siteId])
+  @@index([workspaceId])
   @@map("subscribers")
 }
 
-/// Callback — callback request (Phase B request_callback tool / B6 route)
+/// Callback — callback request (Phase B request_callback tool / B6 route),
+/// plus the request-and-confirm lifecycle (#5970, D-67 / SUB-100).
+///
+/// The eleven trailing members are the confirm/pay lifecycle. They are
+/// deliberately ON THIS MODEL rather than on a second `ServiceRequest` row
+/// (spec #5970 D1), and the cost of that choice is stated rather than hidden:
+/// every ORDINARY callback row — the overwhelming majority — now carries
+/// eleven NULL columns it will never use. The alternative duplicates
+/// siteId/name/phone/preferredTime/payload or carries a cross-row join for a
+/// one-to-one relationship, and it puts a SECOND write inside the anonymous
+/// lead-capture path, which is a never-gate surface. Eleven nullable columns
+/// is the cheaper side.
 model Callback {
   id            String   @id @default(dbgenerated("('callbk_'::text || (uuidv7())::text)")) @db.Text
   siteId        String   @map("site_id")
+  // #6374 — the tenancy fence, extended to this model (spec
+  // docs/specs/6374-the-fence-schema-wave-spec.md D1). NOT NULL, no
+  // Prisma relation directive (ADR-0009 invariant #1), and
+  // callbacks_workspace_site_agree CHECK (workspace_id = site_id) — since
+  // siteId IS the resolved workspace id, Postgres itself rejects a row
+  // whose two columns disagree. Every write site stamps a SERVER-RESOLVED
+  // value, never one from a request body (AC-6).
+  workspaceId String @map("workspace_id")
   name          String
   phone         String
   preferredTime String?  @map("preferred_time")
   payload       Json
   createdAt     DateTime @default(now()) @map("created_at")
 
+  // ── request-and-confirm lifecycle (#5970) ──────────────────────────────
+  /// sha-256 hex digest of the tenant's confirm token. The token itself is
+  /// emailed once and never stored; NULLED when the credential is spent,
+  /// which is the single-use mechanism. `@unique` mirrors `resumeTokenHash` —
+  /// a digest collision is a bug, not a state.
+  confirmTokenHash        String?   @unique @map("confirm_token_hash")
+  /// When the credential stops resolving (mint + 7 days).
+  confirmTokenExpiresAt   DateTime? @map("confirm_token_expires_at")
+  /// Stamped by the tenant's confirm POST. Also the "already confirmed" predicate.
+  confirmedAt             DateTime? @map("confirmed_at")
+  /// What the tenant agreed to, as they typed it — a string like
+  /// `preferredTime` above, not a parsed instant.
+  confirmedTime           String?   @map("confirmed_time")
+  /// Where the hosted payment URL is sent. Typed on the confirm form,
+  /// prefilled from `payload.email` when the capture form carried one.
+  buyerEmail              String?   @map("buyer_email")
+  /// MINOR units, never major — Stripe's own `unit_amount` convention.
+  amountMinor             Int?      @map("amount_minor")
+  /// Lowercase ISO-4217.
+  currency                String?
+  /// The Payment Link the confirm step minted — THE artifact id the webhook
+  /// stamp matches on (`session.payment_link`).
+  stripePaymentLinkId     String?   @map("stripe_payment_link_id")
+  /// The session written from the same event, for support lookups. NOT a
+  /// match key, which is why it carries no index.
+  stripeCheckoutSessionId String?   @map("stripe_checkout_session_id")
+  /// NULL-forever at #5970's boundary — present so the hosted-invoice rung
+  /// lands additively, with no second migration.
+  stripeInvoiceId         String?   @map("stripe_invoice_id")
+  /// Stamped exactly once by the Stripe webhook; the `paidAt: null` guard on
+  /// that update IS the durable idempotency key.
+  paidAt                  DateTime? @map("paid_at")
+
   @@index([siteId])
   @@index([createdAt])
+  @@index([stripePaymentLinkId])
+  @@index([stripeInvoiceId])
+  @@index([workspaceId])
   @@map("callbacks")
 }
 
@@ -67,8 +180,51 @@ model Callback {
 model FlowDefinition {
   id        String   @id @default(dbgenerated("('flow_'::text || (uuidv7())::text)")) @db.Text
   siteId    String   @map("site_id")
+  /// #6155 AD-2 — the workspace isolation key. Backfilled from `siteId`: the
+  /// literal "default" resolves to the seeded sentinel workspace
+  /// (wksp_00000000-0000-7000-8000-000000000001); any other value resolves
+  /// only by exact `workspaces.id` match. Plain string, no `@relation`: ADR
+  /// 0009 forbids a Prisma relation across the inbox -> auth (and, per
+  /// #6254, inbox -> config) namespace boundary, the same reason
+  /// `Asset.workspaceId` (database/content/schema.prisma) carries none.
+  ///
+  /// #6254 AC-3/AC-4/AC-7 — NOT NULL as of
+  /// database/migrations/20260922120000_tenancy_fence, which also
+  /// normalizes `siteId` to the resolved workspace id and adds
+  /// `flow_definitions_workspace_site_agree CHECK ("workspace_id" =
+  /// "site_id")` — see `Lead.workspaceId` above for the full rationale
+  /// (identical here). Every write site derives this value server-side;
+  /// never from a request body (AC-6).
+  workspaceId String @map("workspace_id")
   slug      String
   config    Json
+  /// #6156 D1/D3 — the magnet's classification, derived structurally (never
+  /// from slug) by `deriveFlowKind` on CREATE only: special-report |
+  /// diagnostic | listicle | waitlist | contact | newsletter. Keeps its
+  /// column default ('contact') — unlike `status`, a mis-classified magnet
+  /// is a mislabel, not a publication or security control.
+  kind      String   @default("contact")
+  /// #6156 D1 — the operator-facing name; the slug is not a name. NOT NULL
+  /// with NO column default (D1): a nameless magnet must never enter the
+  /// table silently, so every future writer is required by `tsc` to state
+  /// one, exactly as `status` below is required to state a status.
+  title     String
+  /// #6156 D1/D4 — an operator-declared publish address, site-relative only
+  /// (`flowLandingPageSchema`, packages/validation/src/schemas/flow.ts).
+  /// NULL means "no operator-declared landing page; the canonical
+  /// `/{locale}/flows/{slug}` route serves it" — never a derived guess, since
+  /// a magnet has THREE public addresses (the indexed landing route, the
+  /// walk route one segment deeper, and the results route), and only the
+  /// operator can say which one they are publishing.
+  landingPage String? @db.Text @map("landing_page")
+  /// #6156 D1/D2/D10 — draft | live. NOT NULL with NO column default (D1,
+  /// SEC-08): silence must never publish, so every future writer is required
+  /// by `tsc` to name a status. Existing rows are backfilled 'live' by the
+  /// migration (every row that exists today is already serving). The
+  /// `flow_definitions_status_domain` CHECK (D2) closes the deny-list gate in
+  /// `resolveSession` (D10): an unknown value is unstorable, so "not
+  /// 'draft'" and "'live'" are the same set at the database level.
+  status    String
   // #5036 D6d — the listing this definition was projected from, when it was.
   // Null for every flow that is not a listing diagnostic. Before this column
   // the only link was that the generated flow's slug HAPPENED to equal the
@@ -81,6 +237,7 @@ model FlowDefinition {
   updatedAt DateTime @updatedAt @map("updated_at")
 
   @@unique([siteId, slug])
+  @@index([workspaceId])
   @@map("flow_definitions")
 }
 
@@ -94,6 +251,18 @@ model FlowDefinition {
 model FlowSession {
   id             String    @id @default(dbgenerated("('flsess_'::text || (uuidv7())::text)")) @db.Text
   siteId         String    @map("site_id")
+  /// #6155 AD-2 — the workspace isolation key, same backfill contract as
+  /// `FlowDefinition.workspaceId` above; #6254 makes it NOT NULL plus the
+  /// same `flow_sessions_workspace_site_agree` equality CHECK — see
+  /// `Lead.workspaceId` (database/inbox/schema.prisma, top of file) for the
+  /// full rationale. Declared here, immediately after `siteId` and before
+  /// `state`'s empty-object-literal default below: the drift guard's model
+  /// regex (`tests/architecture/tenant-scope-pattern.test.ts`) truncates a
+  /// model's captured body at its first closing brace — including one
+  /// inside a comment or a string literal, not only in code — so a field
+  /// placed after that point (or a stray brace pair written ABOVE it, as
+  /// this very note must avoid) would be invisible to it.
+  workspaceId    String    @map("workspace_id")
   // Informational only — never joined on (ADR 0009 D1: logical, not FK,
   // isolation). Session resumption + completion key on flowSlug, not this
   // column; deliberate, per code-review finding on #3956's acceptance PR.
@@ -138,6 +307,7 @@ model FlowSession {
 
   @@index([siteId])
   @@index([siteId, completedAt])
+  @@index([workspaceId])
   @@index([email])
   // Backs the abandon-email sweep's per-definition selection query
   // (apps/api/src/services/abandon-email.ts — flowId equality + completedAt
@@ -151,16 +321,32 @@ model FlowSession {
   @@map("flow_sessions")
 }
 
-/// DeliverableAsset — an operator-uploaded asset the funnel's `deliverables`
-/// config block references by `key` (#3961 D1). Bytes live IN THE DATABASE
-/// (Postgres bytea) behind one internal resolver — zero new infrastructure;
-/// reversibility is structural (a later blob-storage swap changes only the
-/// resolver + the upload CLI, never the config contract, grant model, or
-/// email link shape). Uploaded via the `deliverable:upload` CLI
-/// (apps/api/src/bin/deliverable-upload.ts) only — no HTTP upload route.
+/// DeliverableAsset — LEGACY (#6310 D3/D11). An operator-uploaded asset the
+/// funnel's `deliverables` config block references by `key` (#3961 D1).
+/// Bytes live IN THE DATABASE (Postgres bytea) behind one internal
+/// resolver — zero new infrastructure; reversibility is structural (a later
+/// blob-storage swap changes only the resolver + the upload CLI, never the
+/// config contract, grant model, or email link shape). Uploaded via the
+/// `deliverable:upload` CLI (apps/api/src/bin/deliverable-upload.ts) only —
+/// no HTTP upload route.
+///
+/// Since #6310: a magnet deliverable resolves against the workspace-scoped
+/// `Asset` model (database/content/schema.prisma) FIRST; this store is the
+/// FALLBACK, tried only on an `Asset` miss (D2). No existing row is
+/// migrated — D3 grounds why in the two server-internal write/read paths —
+/// so every row here keeps delivering, unmigrated, until an operator
+/// confirms none remain (§2.3's exit condition).
 model DeliverableAsset {
   id          String   @id @default(dbgenerated("('dasset_'::text || (uuidv7())::text)")) @db.Text
   siteId      String   @map("site_id")
+  // #6374 — the tenancy fence, extended to this model (spec
+  // docs/specs/6374-the-fence-schema-wave-spec.md D1). NOT NULL, no
+  // Prisma relation directive (ADR-0009 invariant #1), and
+  // deliverable_assets_workspace_site_agree CHECK (workspace_id = site_id) — since
+  // siteId IS the resolved workspace id, Postgres itself rejects a row
+  // whose two columns disagree. Every write site stamps a SERVER-RESOLVED
+  // value, never one from a request body (AC-6).
+  workspaceId String @map("workspace_id")
   // The assetKey a flow config's deliverables.assets entry references.
   key         String
   // Download filename (Content-Disposition). Stored RAW at upload time
@@ -178,6 +364,7 @@ model DeliverableAsset {
   updatedAt   DateTime @updatedAt @map("updated_at")
 
   @@unique([siteId, key])
+  @@index([workspaceId])
   @@map("deliverable_assets")
 }
 
@@ -188,12 +375,63 @@ model DeliverableAsset {
 /// value — only the uuidv7-random grant id, delivered once via the lead's
 /// own email. `assetId`/`leadId` are stable-id refs (ADR 0009 invariant 1
 /// posture) — no cross-model `@relation`.
+///
+/// `assetId`'s three id classes (#6310): `asset_` (a workspace `Asset`,
+/// scoped serve via `workspaceId` below), `dasset_` (legacy
+/// `DeliverableAsset`, scoped by `siteId` above), `playbook:` (the FEAT-074
+/// U4b virtual asset — no store row at all).
 model DeliverableGrant {
   id        String   @id @default(dbgenerated("('dgrant_'::text || (uuidv7())::text)")) @db.Text
   siteId    String   @map("site_id")
   assetId   String   @map("asset_id")
   leadId    String   @map("lead_id")
   sessionId String   @map("session_id")
+  /// The workspace that authorized this grant's asset resolution (#6310
+  /// D15). Plain string, no
+  /// @relation (ADR 0009 invariant 1) — the same shape
+  /// FlowDefinition.workspaceId carries. The serve path reads it ONLY for
+  /// the `asset_` class, and a NULL there is a 404, never an unscoped read.
+  ///
+  /// #6374 CHANGED WHO WRITES IT, AND THE SAFETY ARGUMENT MOVED WITH IT.
+  /// Before #6374 this was written ONLY when `assetId` was an `asset_` id,
+  /// and stayed NULL for a legacy `dasset_` grant and a `playbook:` virtual
+  /// one. As of #6374 BOTH mint sites stamp it unconditionally
+  /// (services/deliverable-fulfillment.ts, services/listing-csv-sweep.ts),
+  /// so NO newly-minted grant is NULL and the fail-closed sentinel below
+  /// now protects PRE-EXISTING rows only — the migration still touches none
+  /// of them.
+  ///
+  /// That is safe because of a DIFFERENT invariant than the one that used to
+  /// carry it, and the new one is more fragile, so it is written down here
+  /// rather than left implicit. What makes stamping safe is NOT "the column
+  /// is NULL on legacy grants" — it no longer is. It is that
+  /// routes/deliverables/index.ts branches on the `assetId` PREFIX, and only
+  /// the `asset_` arm ever reads this column: the `playbook:` arm scopes by
+  /// siteId + leadId, and the legacy `dasset_` arm scopes by
+  /// `asset.siteId === grant.siteId`. Neither reads `workspaceId`, so a
+  /// stamped legacy grant gains no reach it did not already have.
+  /// DO NOT make the legacy or playbook arm consult this column without
+  /// re-deriving that argument — doing so WOULD be an authorization
+  /// widening, which is exactly what the pre-#6374 NULL used to prevent.
+  ///
+  /// #6254 DELIBERATELY DOES NOT TOUCH THIS FIELD. It stays nullable, with
+  /// no equality CHECK — unlike Lead/ProjectListing/FlowDefinition/
+  /// FlowSession above, this column has no source column to derive from
+  /// (its own migration says so: "no source column to derive from ... a
+  /// wholly new fact, captured only at a FUTURE mint"), and `NULL` is the
+  /// serve path's fail-closed sentinel (`deliverable-asset-store.ts`
+  /// `readDeliverableAsset` opens `if (workspaceId === null) return null`).
+  /// Stamping `workspace_id := site_id` would hand a legacy grant an
+  /// authorization scope no mint ever granted, on a bearer-token download
+  /// path — a security regression, not a tightening. That reasoning still
+  /// holds for EXISTING rows, which is why the column stays nullable and why
+  /// #6374's migration adds no column and rewrites no row. Carved out of the
+  /// #6254 retrofit by the operator (spec §10.1 Q2 -> carve out); #6374
+  /// fences it at mint grain, where the workspace is actually known, and
+  /// adds the NULL-TOLERANT
+  /// deliverable_grants_workspace_site_agree CHECK — so a STAMPED grant can
+  /// never disagree with its site while a legacy grant stays storable.
+  workspaceId String? @map("workspace_id")
   createdAt DateTime @default(now()) @map("created_at")
   // Post-mint send-outcome stamp (#3998 D1) — set at most once, by the
   // send-and-stamp tail shared between fulfillDeliverable and the
@@ -223,6 +461,14 @@ model DeliverableGrant {
 model WaitlistExperiment {
   id        String   @id @default(dbgenerated("('wlexp_'::text || (uuidv7())::text)")) @db.Text
   siteId    String   @map("site_id")
+  // #6374 — the tenancy fence, extended to this model (spec
+  // docs/specs/6374-the-fence-schema-wave-spec.md D1). NOT NULL, no
+  // Prisma relation directive (ADR-0009 invariant #1), and
+  // waitlist_experiments_workspace_site_agree CHECK (workspace_id = site_id) — since
+  // siteId IS the resolved workspace id, Postgres itself rejects a row
+  // whose two columns disagree. Every write site stamps a SERVER-RESOLVED
+  // value, never one from a request body (AC-6).
+  workspaceId String @map("workspace_id")
   key       String
   mode      String                        // lead-capture | qualifying | paid
   status    String                        // draft | live | closed
@@ -231,6 +477,7 @@ model WaitlistExperiment {
   updatedAt DateTime @updatedAt @map("updated_at")
 
   @@unique([siteId, key])
+  @@index([workspaceId])
   @@map("waitlist_experiments")
 }
 
@@ -240,6 +487,14 @@ model WaitlistExperiment {
 model WaitlistScore {
   id             String   @id @default(dbgenerated("('wlscore_'::text || (uuidv7())::text)")) @db.Text
   siteId         String   @map("site_id")
+  // #6374 — the tenancy fence, extended to this model (spec
+  // docs/specs/6374-the-fence-schema-wave-spec.md D1). NOT NULL, no
+  // Prisma relation directive (ADR-0009 invariant #1), and
+  // waitlist_scores_workspace_site_agree CHECK (workspace_id = site_id) — since
+  // siteId IS the resolved workspace id, Postgres itself rejects a row
+  // whose two columns disagree. Every write site stamps a SERVER-RESOLVED
+  // value, never one from a request body (AC-6).
+  workspaceId String @map("workspace_id")
   leadId         String   @map("lead_id")
   experimentKey  String   @map("experiment_key")
   waitlistKey    String   @map("waitlist_key")
@@ -261,6 +516,7 @@ model WaitlistScore {
   // that `scoreCompletedSignup` relies on, per project rather than globally.
   @@unique([leadId, experimentKey])
   @@index([siteId, experimentKey, waitlistKey])
+  @@index([workspaceId])
   @@map("waitlist_scores")
 }
 
@@ -277,6 +533,14 @@ model WaitlistScore {
 model PlaybookInstance {
   id            String   @id @default(dbgenerated("('pbk_'::text || (uuidv7())::text)")) @db.Text
   siteId        String   @map("site_id")
+  // #6374 — the tenancy fence, extended to this model (spec
+  // docs/specs/6374-the-fence-schema-wave-spec.md D1). NOT NULL, no
+  // Prisma relation directive (ADR-0009 invariant #1), and
+  // playbook_instances_workspace_site_agree CHECK (workspace_id = site_id) — since
+  // siteId IS the resolved workspace id, Postgres itself rejects a row
+  // whose two columns disagree. Every write site stamps a SERVER-RESOLVED
+  // value, never one from a request body (AC-6).
+  workspaceId String @map("workspace_id")
   leadId        String   @map("lead_id")
   experimentKey String   @map("experiment_key")
   scoreId       String   @map("score_id")
@@ -288,6 +552,7 @@ model PlaybookInstance {
   createdAt     DateTime @default(now()) @map("created_at")
 
   @@index([siteId, leadId, createdAt])
+  @@index([workspaceId])
   @@map("playbook_instances")
 }
 
@@ -306,6 +571,14 @@ model PlaybookInstance {
 model WaitlistFollowUpSend {
   id          String   @id @default(dbgenerated("('wlfu_'::text || (uuidv7())::text)")) @db.Text
   siteId      String   @map("site_id")
+  // #6374 — the tenancy fence, extended to this model (spec
+  // docs/specs/6374-the-fence-schema-wave-spec.md D1). NOT NULL, no
+  // Prisma relation directive (ADR-0009 invariant #1), and
+  // waitlist_followup_sends_workspace_site_agree CHECK (workspace_id = site_id) — since
+  // siteId IS the resolved workspace id, Postgres itself rejects a row
+  // whose two columns disagree. Every write site stamps a SERVER-RESOLVED
+  // value, never one from a request body (AC-6).
+  workspaceId String @map("workspace_id")
   leadId      String   @map("lead_id")
   followUpKey String   @map("follow_up_key")
   sentAt      DateTime @map("sent_at")
@@ -313,6 +586,7 @@ model WaitlistFollowUpSend {
 
   @@unique([leadId, followUpKey])
   @@index([siteId])
+  @@index([workspaceId])
   @@map("waitlist_followup_sends")
 }
 
@@ -327,12 +601,21 @@ model WaitlistFollowUpSend {
 /// visible in the data, not only in the sweep's control flow.
 model ListingCsvSend {
   id        String   @id @default(dbgenerated("('lcsv_'::text || (uuidv7())::text)")) @db.Text
+  // #6374 D2 — the tenancy fence, in the shape this model's ABSENT site_id
+  // forces (operator disposition, 2026-09-20). It gets NOT NULL plus the
+  // listing_csv_sends_workspace_id_format CHECK and NOTHING else: with no
+  // site_id column there is nothing for an equality CHECK to compare, and a
+  // composite FK to ProjectListing — legal, both models are inbox — was
+  // offered and declined in favour of ONE fence shape. Backfilled and
+  // stamped from the parent listing row, never from a request body (AC-6).
+  workspaceId String @map("workspace_id")
   listingId String   @map("listing_id")
   sentAt    DateTime @map("sent_at")
   rowCount  Int      @map("row_count")
   grantId   String   @map("grant_id")
 
   @@index([listingId, sentAt])
+  @@index([workspaceId])
   @@map("listing_csv_sends")
 }
 
@@ -350,6 +633,14 @@ model ListingCsvSend {
 model FlowCheckout {
   id               String    @id @default(dbgenerated("('flchk_'::text || (uuidv7())::text)")) @db.Text
   siteId           String    @map("site_id")
+  // #6374 — the tenancy fence, extended to this model (spec
+  // docs/specs/6374-the-fence-schema-wave-spec.md D1). NOT NULL, no
+  // Prisma relation directive (ADR-0009 invariant #1), and
+  // flow_checkouts_workspace_site_agree CHECK (workspace_id = site_id) — since
+  // siteId IS the resolved workspace id, Postgres itself rejects a row
+  // whose two columns disagree. Every write site stamps a SERVER-RESOLVED
+  // value, never one from a request body (AC-6).
+  workspaceId String @map("workspace_id")
   flowSlug         String    @map("flow_slug")
   experimentKey    String    @map("experiment_key")
   sessionId        String    @map("session_id")
@@ -388,6 +679,7 @@ model FlowCheckout {
   @@index([siteId, experimentKey, status])
   // Onboarding's read: everything a lead bought.
   @@index([leadId])
+  @@index([workspaceId])
   @@map("flow_checkouts")
 }
 
@@ -430,6 +722,18 @@ model FlowCheckout {
 model ProjectListing {
   id             String    @id @default(dbgenerated("('prjl_'::text || (uuidv7())::text)")) @db.Text
   siteId         String    @map("site_id")
+  // #6203 — the isolation key `tenantDb(tenant).projectListings` filters on.
+  // Plain scalar, no @relation (ADR 0009 D1, same reasoning as ownerUserId
+  // below).
+  //
+  // #6254 AC-3/AC-4/AC-7 — NOT NULL as of
+  // database/migrations/20260922120000_tenancy_fence, which also normalizes
+  // `siteId` to the resolved workspace id and adds
+  // `project_listings_workspace_site_agree CHECK ("workspace_id" =
+  // "site_id")` — see `Lead.workspaceId` (top of database/inbox/schema.prisma)
+  // for the full rationale. Every write site derives this value
+  // server-side; never from a request body (AC-6).
+  workspaceId    String    @map("workspace_id")
   // #5036 — written at SUBMIT, not at start. The founder's contact details are
   // already captured on THIS row at step one, so a `Lead` at step one adds no
   // capture; what it does add is an operator notification email per abandoned
@@ -445,6 +749,10 @@ model ProjectListing {
   name           String?
   oneLiner       String?   @map("one_liner")
   problem        String?   @db.Text
+  // #5096 — `problem`'s narrative other half ("how are you solving it?").
+  // OPT-IN, not required: it is absent from the platform's default
+  // `collectedFields` mask, so a site collects it only by naming it.
+  solution       String?   @db.Text
   url            String?
   // #5036 D2 — the six-rung product ladder that replaced the four-value
   // `stage`. The migration remaps every old value by an explicit map; there
@@ -574,7 +882,7 @@ model ProjectListing {
   status         String
   // #5036 D1/D6 — when the founder ticked step one's consent box. Never null:
   // a row cannot exist without it, because `start` requires it.
-  consentAt      DateTime  @default(now()) @map("consent_at")
+  consentAt      DateTime  @default(now()) @map("consent_at") @db.Timestamptz(3)
   // #5036 D1 — sha-256 of the opaque resume token, never the token itself.
   // The token is the ONLY credential on an anonymous surface, so the column
   // holds a digest an attacker who reads the table still cannot present.
@@ -636,6 +944,64 @@ model ProjectListing {
   // a link nobody proved, which is the bug this column exists to remove.
   ownerUserId    String?   @map("owner_user_id")
   ownerLinkedAt  DateTime? @map("owner_linked_at")
+  // #6314 — the listicle-kind `FlowDefinition` that CAPTURED this
+  // application: the magnet the visitor arrived through, so a magnet's own
+  // Applications list can be scoped to its own submissions rather than to the
+  // whole workspace (nothing constrains a workspace to one listicle magnet —
+  // `FlowDefinition` carries `@@unique([siteId, slug])` and no
+  // `@@unique([siteId, kind])`, so workspace-only scoping would conflate two).
+  //
+  // NOT `FlowDefinition.listingId` reversed: that column is written at
+  // APPROVAL time by `services/project-listing-flow.ts`, when an approved
+  // listing is projected into its own per-listing diagnostic sub-flow. A
+  // different link, at a different time, in the other direction.
+  //
+  // AN ID, NOT A SLUG (operator ruling 2026-09-19): a slug is a natural key
+  // `@@unique([siteId, slug])` implies is mutable, and `Lead.source`'s
+  // `'flow:' + slug` pattern is the weaker one, used there only because that
+  // write path has no resolve step. This one does — the wire carries a slug
+  // (no public surface hands a visitor a `flow_<uuidv7>`), and
+  // `startProjectListingDraft` resolves it server-side against `siteId` +
+  // `workspaceId` + `kind: "listicle"` before storing the id.
+  //
+  // PLAIN SCALAR REF — no `@relation`, no foreign key, no `onDelete`
+  // (operator decision 2026-09-20, withdrawing the ruling's "on-delete
+  // set-null" clause). Both models live in `inbox/`, so ADR 0009 invariant #1
+  // (which bans CROSS-namespace relations) does not reach this column and
+  // permission was never the question — the convention is: every
+  // intra-`inbox` reference on this model and its siblings (`leadId`,
+  // `listingId`, `grantId`, `flowSessionId`) is a plain scalar, and of the 24
+  // FOREIGN KEY constraints in `database/migrations/**` every one targets
+  // `auth`. The composite shape specifically was offered and declined on
+  // `ListingCsvSend` below.
+  //
+  // WHAT THAT GIVES UP, stated rather than argued away: the database does not
+  // constrain this to name a real magnet, nor one in the same workspace. Three
+  // things bound it — the resolve carries `siteId` and `kind`, so storing a
+  // foreign id needs the service layer to actively misbehave; nothing deletes
+  // a `FlowDefinition` (`routes/magnets/index.ts` D5: "No DELETE"), so
+  // `SET NULL` would have described no live code path; and the read carries
+  // the injected `workspaceId` alongside this id, so a dangling or foreign
+  // value yields NO rows, never another workspace's.
+  //
+  // WRITE-ONCE, at START. The magnet a visitor arrived through is knowable
+  // only on arrival — by submit, ten steps and possibly a resume-email
+  // round-trip later, the referring context is gone. `draftUpdateData` never
+  // learns this key, so no patch body can re-attribute a draft after the fact,
+  // the same shape `emailVerifiedAt`'s write-once stamp has.
+  //
+  // PERMANENTLY NULLABLE, and NOT a backfill target. Every row written before
+  // this column has no evidence naming the magnet that captured it — no
+  // referrer, no session link, no slug — so a backfill would have to guess
+  // "the workspace's only listicle magnet", which is exactly the conflation
+  // this column exists to remove, made permanent and unauditable. It is the
+  // reason `founder_name` parts (#5407), the address parts (#5279) and
+  // `owner_user_id` (#5295) each backfill nothing: a value that can only be
+  // guessed must not be asserted. NULL means "not attributed" — never
+  // "attribution failed" and never "captured directly": an application
+  // started through a direct link AFTER this ships is NULL for the same
+  // reason and is indistinguishable from a legacy row.
+  capturedByFlowId String? @map("captured_by_flow_id")
   createdAt      DateTime  @default(now()) @map("created_at")
   updatedAt      DateTime  @updatedAt @map("updated_at")
 
@@ -650,6 +1016,15 @@ model ProjectListing {
   // design: the promotion match (`founderEmail` + `siteId` + null owner) is
   // already served by the (site_id, founder_email) index above.
   @@index([ownerUserId])
+  // #6203 — backs a per-workspace list (tenantDb(tenant).projectListings.list).
+  @@index([workspaceId])
+  // #6314 — backs the per-magnet Applications read
+  // (tenantDb(tenant).projectListings.listByCapturingFlow), whose WHERE is
+  // exactly these two columns. Leading on `workspaceId`, matching the
+  // `@@index([workspaceId])` convention the fence set on this table. ONE
+  // index: no read reaches `capturedByFlowId` without a tenant, and with no
+  // foreign key there is no cascade wanting a referencing-side index either.
+  @@index([workspaceId, capturedByFlowId])
   @@map("project_listings")
 }
 
@@ -673,6 +1048,14 @@ model ProjectListing {
 model ConsentGrant {
   id            String   @id @default(dbgenerated("('cnsnt_'::text || (uuidv7())::text)")) @db.Text
   siteId        String   @map("site_id")
+  // #6374 — the tenancy fence, extended to this model (spec
+  // docs/specs/6374-the-fence-schema-wave-spec.md D1). NOT NULL, no
+  // Prisma relation directive (ADR-0009 invariant #1), and
+  // consent_grants_workspace_site_agree CHECK (workspace_id = site_id) — since
+  // siteId IS the resolved workspace id, Postgres itself rejects a row
+  // whose two columns disagree. Every write site stamps a SERVER-RESOLVED
+  // value, never one from a request body (AC-6).
+  workspaceId String @map("workspace_id")
   subjectType   String   @map("subject_type")
   subjectId     String   @map("subject_id")
   purposeId     String   @map("purpose_id")
@@ -686,5 +1069,65 @@ model ConsentGrant {
   @@index([siteId, subjectType, subjectId])
   // "Who agreed to this purpose" — the cross-surface count the id exists for (D1/D2).
   @@index([siteId, purposeId])
+  @@index([workspaceId])
   @@map("consent_grants")
 }
+
+/// Appointment — a Cal.com booking, normalized from the webhook receiver (#6085, brief H7).
+///
+/// siteId-scoped with no FK, like every other inbox model (ADR 0009 D2). The
+/// (siteId, provider, providerBookingUid) unique constraint IS the idempotency
+/// key: every write is a guarded updateMany, and the create that follows a zero
+/// match races on THIS index — which is what makes "exactly one row per booking
+/// uid" a DATABASE property rather than a property of a process that may have
+/// restarted. `provider` is in the key because a deployment may one day run two
+/// providers against one receiver and their uid spaces do not coordinate (#4288).
+model Appointment {
+  id                  String    @id @default(dbgenerated("('appt_'::text || (uuidv7())::text)")) @db.Text
+  siteId              String    @map("site_id") @db.VarChar(200)
+  // #6374 — the tenancy fence, extended to this model (spec
+  // docs/specs/6374-the-fence-schema-wave-spec.md D1). NOT NULL, no
+  // Prisma relation directive (ADR-0009 invariant #1), and
+  // appointments_workspace_site_agree CHECK (workspace_id = site_id) — since
+  // siteId IS the resolved workspace id, Postgres itself rejects a row
+  // whose two columns disagree. Every write site stamps a SERVER-RESOLVED
+  // value, never one from a request body (AC-6).
+  workspaceId String @map("workspace_id")
+  /// Cal.com's own booking `uid` — stable across reschedules of the same booking.
+  /// Bounded: a value above Postgres's btree entry limit cannot be indexed at all.
+  providerBookingUid  String    @map("provider_booking_uid") @db.VarChar(200)
+  /// Provider identifier, part of the unique key (#4288).
+  provider            String    @default("cal") @db.VarChar(32)
+  startTime           DateTime  @map("start_time")
+  endTime             DateTime  @map("end_time")
+  /// The event's own title as the provider stated it. PII-adjacent: never logged (NFR-1).
+  title               String?   @db.VarChar(300)
+  /// Free text typed by an anonymous prospect — bounded at the same 120/254 the
+  /// outbound seam already bounds them at (packages/validation SchedulingAttendeeSchema).
+  attendeeName        String    @map("attendee_name") @db.VarChar(120)
+  attendeeEmail       String    @map("attendee_email") @db.VarChar(254)
+  attendeeTimeZone    String?   @map("attendee_time_zone") @db.VarChar(64)
+  /// Normalized lifecycle state — see § D5. One of: pending | confirmed | cancelled.
+  status              String    @db.VarChar(32)
+  /// The payment flag. BOOKING_PAID sets it true; nothing else in this issue reads it.
+  paid                Boolean   @default(false)
+  /// Set by BOOKING_PAYMENT_INITIATED; a checkout was opened on Cal's side.
+  paymentInitiatedAt  DateTime? @map("payment_initiated_at")
+  /// Set by BOOKING_NO_SHOW_UPDATED.
+  noShow              Boolean   @default(false) @map("no_show")
+  cancelledAt         DateTime? @map("cancelled_at")
+  /// Three INDEPENDENT watermarks, one per event family (§ D7). One shared column
+  /// forced a choice between dropping a late payment fact and letting a replayed
+  /// one revert state; three columns make each family monotonic on its own terms.
+  lifecycleEventAt    DateTime  @map("lifecycle_event_at")
+  paymentEventAt      DateTime? @map("payment_event_at")
+  noShowEventAt       DateTime? @map("no_show_event_at")
+  createdAt           DateTime  @default(now()) @map("created_at")
+  updatedAt           DateTime  @updatedAt @map("updated_at")
+
+  @@unique([siteId, provider, providerBookingUid])
+  @@index([siteId, startTime])
+  @@index([createdAt])
+  @@index([workspaceId])
+  @@map("appointments")
+}