create-ailk 0.5.0 → 0.6.0

package/templates/database/migrations/20260922120000_tenancy_fence/migration.sql

@@ -0,0 +1,1067 @@
+-- #6254 — the tenancy fence keystone. THE ONE schema migration M32 emits
+-- (AC-1): #6256 #6257 #6258 #6259 #6260 #6171 #6314 land their model
+-- changes INTO this file rather than each adding their own (issue #6254
+-- comment, Sam, 2026-09-20; spec docs/specs/6254-the-composite-fk-pattern-
+-- workspacesiteidentity-spec.md D4).
+--
+-- ── What this file does ─────────────────────────────────────────────────────
+-- 1. `WorkspaceSiteIdentity` gains `@@unique([id, workspaceId])` (AC-2) — a
+--    named Postgres unique constraint, redundant today (`id` is already the
+--    PK) but the target a future composite FK can bind to (spec D3).
+-- 2. Four ALREADY-KEYED-but-nullable models — `leads`, `project_listings`,
+--    `flow_definitions`, `flow_sessions` — are retrofitted to NOT NULL
+--    `workspace_id` plus a `CHECK (workspace_id = site_id)` (spec D1b).
+-- 3. #6374 — the fence fan-out. ELEVEN `site_id` tables gain `workspace_id`
+--    and take the same five steps in the same order: `subscribers`,
+--    `callbacks`, `consent_grants`, `appointments`, `deliverable_assets`,
+--    `flow_checkouts`, `waitlist_experiments`, `waitlist_scores`,
+--    `waitlist_followup_sends`, `playbook_instances`, `site_listing_configs`.
+-- 4. #6374 — `listing_csv_sends` has NO `site_id`, so it gains `workspace_id`
+--    backfilled from its parent `project_listings` row, NOT NULL and the
+--    format CHECK, and NO equality CHECK (spec D2, operator 2026-09-20).
+-- 5. #6374 — `site_settings` has NO `site_id` either. It gains `workspace_id`
+--    backfilled to the sentinel workspace — but ONLY after an abort-not-guess
+--    guard (AC-14) refuses any unattributed row whose `key` already embeds a
+--    NON-sentinel workspace id, which the sentinel assignment would misfile —
+--    NOT NULL and the format CHECK, and
+--    its UNIQUE INDEX moves from `(key)` to `(workspace_id, key)` so two
+--    sellers may each hold a `feature_flags` row (spec D3, operator
+--    2026-09-20). The `key` TEXT is left verbatim.
+-- 6. #6374 — `deliverable_grants` gains NO column and NO row is touched: its
+--    `workspace_id` stays nullable (NULL is the serve path's fail-closed
+--    sentinel). It gains only the NULL-TOLERANT
+--    `CHECK (workspace_id IS NULL OR workspace_id = site_id)`, so a STAMPED
+--    grant can never disagree with its site while a legacy one stays
+--    storable (spec D4).
+--
+-- ── Why a CHECK and not a foreign key (spec §0, §1.3, §1.4) ────────────────
+-- The issue's literal ask — a composite FK from these four models to
+-- `WorkspaceSiteIdentity` — is not buildable against this tree: (F1) the
+-- relation crosses the inbox -> config namespace boundary ADR-0009
+-- invariant #1 forbids, and `tools/lint-architecture.ts`'s
+-- cross-namespace-prisma-relation rule lints it; (F2) `site_id` never holds
+-- a `WorkspaceSiteIdentity.id` (`siteid_<uuidv7>`) — it holds the resolved
+-- WORKSPACE id (`wksp_<uuidv7>`) or the legacy alias `"default"`, so
+-- `references: [id, workspaceId]` would reject 100% of existing rows and
+-- 100% of writes from every current path; (F3) `WorkspaceSiteIdentity` is a
+-- per-workspace config blob written lazily by an upsert, not a site
+-- registry — a required FK parent would make anonymous lead capture (a
+-- never-gate surface) depend on a config row that need not exist.
+--
+-- AC-4's stated GOAL — "Postgres rejects a row whose workspaceId disagrees
+-- with its site's workspace" — is delivered without a FK: since `site_id`
+-- IS the workspace id (F2), the disagreement is exactly
+-- `workspace_id <> site_id`, and an equality CHECK makes it unstorable. This
+-- is strictly TIGHTER than the FK the issue asked for (the FK would admit
+-- any pair present in `workspace_site_identities`; the CHECK admits exactly
+-- one value per row). Disposed by the operator 2026-09-20, spec §10.1 Q1 ->
+-- Option A' (docs/internal/decisions/tenancy-fence-model-classification.md
+-- D1 amendment, same commit).
+--
+-- `DeliverableGrant` (the fifth already-keyed model) is DELIBERATELY NOT
+-- touched here. Its `workspace_id` has no source column to derive from (its
+-- own migration, 20260921120000_deliverable_grant_workspace_key, says so
+-- explicitly) and NULL is the serve path's fail-closed sentinel
+-- (`deliverable-asset-store.ts` `readDeliverableAsset`) — retrofitting it
+-- here would hand a legacy grant an authorization scope no mint granted, on
+-- a bearer-token download path. Carved out of this unit (spec §10.1 Q2 ->
+-- carve out); #6257 fences it at mint grain, where the workspace is known.
+--
+-- ── The CHECK requires `site_id` normalized FIRST (spec D1a, SEC-01) ───────
+-- A bare `CHECK (workspace_id = site_id)` is unsatisfiable for the shipped
+-- default: `site_id = 'default'` is the canonical seeded row, and both
+-- precedent backfills (20260919140000, 20260919120000) already resolve
+-- `'default'` to the sentinel workspace id in `workspace_id` while leaving
+-- `site_id` untouched. So this migration rewrites `site_id = 'default'` to
+-- the same sentinel on every fenced table BEFORE the CHECK lands — the
+-- application-code half of D1a (the write paths that still stamp the raw
+-- alias) is fixed in the same PR (apps/api/src/lib/site.ts,
+-- routes/flows/index.ts, routes/flows/recommender.ts, bin/seed-presets.ts,
+-- services/listing-config.ts, services/flow-engine.ts,
+-- services/project-listings.ts, services/recommender-capture.ts).
+--
+-- ── Ordering (spec D2) — never guess, never delete, abort if unresolvable ──
+-- 1. Normalize site_id ('default' -> sentinel).
+-- 2. Resolve any remaining NULL workspace_id via an INNER JOIN to
+--    "workspaces" only (never an assignment) — a row whose site_id resolves
+--    to nothing is left NULL, never guessed. This is mostly a no-op today:
+--    20260919140000/20260919120000 already backfilled these four tables:
+--    kept here so this migration proves its OWN correctness re-run against
+--    fixture rows (NFR3, § 8.3) rather than depending on migration order.
+-- 3. Post-assert: nothing lost, nothing guessed, nothing missed — carried
+--    forward from the precedent — PLUS a NEW assertion this migration adds
+--    and the precedent could not: zero rows remain NULL. Unlike the
+--    precedent (which only RAISE NOTICEs on a remaining NULL, because it
+--    never enforces NOT NULL), THIS migration is about to enforce NOT NULL,
+--    so an unresolvable row must abort the transaction rather than pass
+--    through silently — "the same silent data loss AC-7 exists to close"
+--    (spec §0), never a delete, never a guess.
+-- 4. THEN `SET NOT NULL`, then the CHECKs.
+--
+-- ── Re-runnability (NFR3) ───────────────────────────────────────────────────
+-- `ADD COLUMN`/`CREATE INDEX` are not needed here (the columns/indexes
+-- already exist from the precedent migrations). The equality CHECKs use
+-- `DROP CONSTRAINT IF EXISTS` then `ADD CONSTRAINT` — NOT the precedent's
+-- existence-guarded `DO $$` block, which would silently no-op the
+-- TIGHTENING this migration performs on any database that already carries a
+-- same-named constraint (spec D5, SEC-06: a false-green control). The
+-- `WorkspaceSiteIdentity` composite unique is a pure ADD (nothing to
+-- tighten), so it keeps the existence-guarded idiom.
+--
+-- ── Rollback (NFR5) ─────────────────────────────────────────────────────────
+-- Reverses the CONSTRAINTS only, not the tenant attribution:
+--   ALTER TABLE "leads" DROP CONSTRAINT "leads_workspace_site_agree", ALTER COLUMN "workspace_id" DROP NOT NULL;
+--   ALTER TABLE "project_listings" DROP CONSTRAINT "project_listings_workspace_site_agree", ALTER COLUMN "workspace_id" DROP NOT NULL;
+--   ALTER TABLE "flow_definitions" DROP CONSTRAINT "flow_definitions_workspace_site_agree", ALTER COLUMN "workspace_id" DROP NOT NULL;
+--   ALTER TABLE "flow_sessions" DROP CONSTRAINT "flow_sessions_workspace_site_agree", ALTER COLUMN "workspace_id" DROP NOT NULL;
+--   ALTER TABLE "workspace_site_identities" DROP CONSTRAINT "workspace_site_identities_id_workspace_id_key";
+-- #6374's own reversal, same posture — CONSTRAINTS only, never the tenant
+-- attribution: for each of the twelve tables it fences
+--   ALTER TABLE "<table>" DROP CONSTRAINT "<table>_workspace_site_agree",
+--     DROP CONSTRAINT "<table>_workspace_id_format",
+--     ALTER COLUMN "workspace_id" DROP NOT NULL;
+-- (`listing_csv_sends` and `site_settings` have no `_workspace_site_agree`;
+-- `site_settings` additionally needs its old `site_settings_key_key` unique
+-- index recreated, which is only possible while no two workspaces hold the
+-- same key.) `deliverable_grants` reverses by dropping its one new CHECK.
+-- Unlike the four keystone tables, `workspace_id` does NOT predate this
+-- migration on the twelve, so a full DOWN would also DROP COLUMN it — which
+-- DOES discard tenant attribution. Stated so it is not read as a safe revert.
+-- `workspace_id` predates this migration on all four tables (§1.6), and the
+-- `site_id` normalization (D1a) is one-way — a DOWN does not un-normalize
+-- `site_id`, because the pre-normalization alias value is not recoverable
+-- from the row. NOT a full revert; stated so it is not read as one.
+
+-- The census the post-assertions compare against. ON COMMIT DROP: `prisma
+-- migrate` runs each migration in one transaction, so this disappears with it.
+CREATE TEMP TABLE "_6254_fence_census" ON COMMIT DROP AS
+  SELECT (SELECT count(*) FROM "leads")            AS l,
+         (SELECT count(*) FROM "project_listings") AS p,
+         (SELECT count(*) FROM "flow_definitions") AS d,
+         (SELECT count(*) FROM "flow_sessions")    AS s;
+
+-- ── AC-2 — WorkspaceSiteIdentity composite unique ──────────────────────────
+DO $$ BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = 'workspace_site_identities_id_workspace_id_key'
+  ) THEN
+    ALTER TABLE "workspace_site_identities"
+      ADD CONSTRAINT "workspace_site_identities_id_workspace_id_key" UNIQUE ("id", "workspace_id");
+  END IF;
+END $$;
+
+-- ── Step 1 (D1a) — normalize site_id: 'default' -> the sentinel workspace id ─
+-- The sentinel id is a literal because SQL cannot import database/tenancy.ts
+-- (spec §5.3 step 5); database/__tests__/composite-fence.db.test.ts pins the
+-- same literal against the exported DEFAULT_WORKSPACE_ID constant, mirroring
+-- the #6155/#6203 precedents' own technique.
+UPDATE "leads"
+   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
+ WHERE "site_id" = 'default';
+
+UPDATE "project_listings"
+   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
+ WHERE "site_id" = 'default';
+
+UPDATE "flow_definitions"
+   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
+ WHERE "site_id" = 'default';
+
+UPDATE "flow_sessions"
+   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
+ WHERE "site_id" = 'default';
+
+-- ── Step 2 (D2) — resolve any remaining NULL workspace_id via INNER JOIN ────
+-- site_id is already normalized (step 1), so no CASE/alias branch is needed
+-- here, unlike the precedent migrations this runs after. A row whose site_id
+-- resolves to nothing is simply not touched and stays NULL — never guessed.
+UPDATE "leads" l
+   SET "workspace_id" = w."id"
+  FROM "workspaces" w
+ WHERE l."workspace_id" IS NULL
+   AND w."id" = l."site_id";
+
+UPDATE "project_listings" p
+   SET "workspace_id" = w."id"
+  FROM "workspaces" w
+ WHERE p."workspace_id" IS NULL
+   AND w."id" = p."site_id";
+
+UPDATE "flow_definitions" d
+   SET "workspace_id" = w."id"
+  FROM "workspaces" w
+ WHERE d."workspace_id" IS NULL
+   AND w."id" = d."site_id";
+
+UPDATE "flow_sessions" s
+   SET "workspace_id" = w."id"
+  FROM "workspaces" w
+ WHERE s."workspace_id" IS NULL
+   AND w."id" = s."site_id";
+
+-- ── Step 3 — POST-ASSERTIONS ─────────────────────────────────────────────────
+DO $$
+DECLARE
+  before_l bigint; before_p bigint; before_d bigint; before_s bigint;
+  after_l  bigint; after_p  bigint; after_d  bigint; after_s  bigint;
+  bad      bigint;
+BEGIN
+  SELECT l, p, d, s INTO before_l, before_p, before_d, before_s FROM "_6254_fence_census";
+  SELECT count(*) INTO after_l FROM "leads";
+  SELECT count(*) INTO after_p FROM "project_listings";
+  SELECT count(*) INTO after_d FROM "flow_definitions";
+  SELECT count(*) INTO after_s FROM "flow_sessions";
+
+  -- 1. Nothing lost: row counts unchanged.
+  IF before_l <> after_l OR before_p <> after_p OR before_d <> after_d OR before_s <> after_s THEN
+    RAISE EXCEPTION
+      '#6254 post-assertion: row count changed across a purely additive migration (leads % -> %, project_listings % -> %, flow_definitions % -> %, flow_sessions % -> %)',
+      before_l, after_l, before_p, after_p, before_d, after_d, before_s, after_s;
+  END IF;
+
+  -- 2. Nothing guessed: no row's workspace_id names a workspace absent from "workspaces".
+  SELECT count(*) INTO bad FROM "leads" l
+   WHERE l."workspace_id" IS NOT NULL AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = l."workspace_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6254 post-assertion: % leads row(s) carry a workspace_id absent from workspaces', bad;
+  END IF;
+  SELECT count(*) INTO bad FROM "project_listings" p
+   WHERE p."workspace_id" IS NOT NULL AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = p."workspace_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6254 post-assertion: % project_listings row(s) carry a workspace_id absent from workspaces', bad;
+  END IF;
+  SELECT count(*) INTO bad FROM "flow_definitions" d
+   WHERE d."workspace_id" IS NOT NULL AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = d."workspace_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6254 post-assertion: % flow_definitions row(s) carry a workspace_id absent from workspaces', bad;
+  END IF;
+  SELECT count(*) INTO bad FROM "flow_sessions" s
+   WHERE s."workspace_id" IS NOT NULL AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = s."workspace_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6254 post-assertion: % flow_sessions row(s) carry a workspace_id absent from workspaces', bad;
+  END IF;
+
+  -- 3. Nothing missed: no row whose (normalized) site_id names a real workspace
+  --    came out of the backfill with workspace_id still NULL.
+  SELECT count(*) INTO bad FROM "leads" l
+   WHERE l."workspace_id" IS NULL AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = l."site_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6254 post-assertion: % leads row(s) had a resolvable site_id but came out of the backfill NULL', bad;
+  END IF;
+  SELECT count(*) INTO bad FROM "project_listings" p
+   WHERE p."workspace_id" IS NULL AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = p."site_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6254 post-assertion: % project_listings row(s) had a resolvable site_id but came out of the backfill NULL', bad;
+  END IF;
+  SELECT count(*) INTO bad FROM "flow_definitions" d
+   WHERE d."workspace_id" IS NULL AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = d."site_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6254 post-assertion: % flow_definitions row(s) had a resolvable site_id but came out of the backfill NULL', bad;
+  END IF;
+  SELECT count(*) INTO bad FROM "flow_sessions" s
+   WHERE s."workspace_id" IS NULL AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = s."site_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6254 post-assertion: % flow_sessions row(s) had a resolvable site_id but came out of the backfill NULL', bad;
+  END IF;
+
+  -- 4. AC-7 / spec D2 point 4 — an unresolvable row must ABORT, never pass
+  --    through as a silent NULL: this migration is about to SET NOT NULL, so
+  --    (unlike the precedent's NOTICE-only posture) a remaining NULL here
+  --    means a row's site_id names no workspace this database holds, and
+  --    there is no correct value to write. Never deleted, never guessed.
+  SELECT count(*) INTO bad FROM "leads" WHERE "workspace_id" IS NULL;
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6254: % leads row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
+  END IF;
+  SELECT count(*) INTO bad FROM "project_listings" WHERE "workspace_id" IS NULL;
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6254: % project_listings row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
+  END IF;
+  SELECT count(*) INTO bad FROM "flow_definitions" WHERE "workspace_id" IS NULL;
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6254: % flow_definitions row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
+  END IF;
+  SELECT count(*) INTO bad FROM "flow_sessions" WHERE "workspace_id" IS NULL;
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6254: % flow_sessions row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
+  END IF;
+END $$;
+
+-- ── Step 4 — SET NOT NULL (AC-3, AC-4, AC-7) ────────────────────────────────
+ALTER TABLE "leads"            ALTER COLUMN "workspace_id" SET NOT NULL;
+ALTER TABLE "project_listings" ALTER COLUMN "workspace_id" SET NOT NULL;
+ALTER TABLE "flow_definitions" ALTER COLUMN "workspace_id" SET NOT NULL;
+ALTER TABLE "flow_sessions"    ALTER COLUMN "workspace_id" SET NOT NULL;
+
+-- ── Step 5 — equality CHECKs (AC-3, AC-4, AC-5) — DROP then ADD, not guarded ─
+ALTER TABLE "leads" DROP CONSTRAINT IF EXISTS "leads_workspace_site_agree";
+ALTER TABLE "leads" ADD CONSTRAINT "leads_workspace_site_agree" CHECK ("workspace_id" = "site_id");
+
+ALTER TABLE "project_listings" DROP CONSTRAINT IF EXISTS "project_listings_workspace_site_agree";
+ALTER TABLE "project_listings" ADD CONSTRAINT "project_listings_workspace_site_agree" CHECK ("workspace_id" = "site_id");
+
+ALTER TABLE "flow_definitions" DROP CONSTRAINT IF EXISTS "flow_definitions_workspace_site_agree";
+ALTER TABLE "flow_definitions" ADD CONSTRAINT "flow_definitions_workspace_site_agree" CHECK ("workspace_id" = "site_id");
+
+ALTER TABLE "flow_sessions" DROP CONSTRAINT IF EXISTS "flow_sessions_workspace_site_agree";
+ALTER TABLE "flow_sessions" ADD CONSTRAINT "flow_sessions_workspace_site_agree" CHECK ("workspace_id" = "site_id");
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- #6374 — the fence fan-out. THIRTEEN more models join the fence, amended INTO
+-- this file rather than added as a new migration, because #6254 AC-1 makes
+-- this THE ONE schema migration M32 emits. Amending a merged migration is a
+-- silent no-op on a database that already applied it; the operator disposed
+-- the assumption that makes that safe on 2026-09-20 (spec § 1.5 — no
+-- persistent database carries state that must survive; every site is
+-- rebuildable). If that assumption ever stops holding, everything below moves
+-- verbatim into a new migration directory and nothing else changes.
+--
+-- Eleven tables carry `site_id` and take the keystone shape above unchanged,
+-- in the keystone's own five-step order: normalize -> backfill by INNER JOIN
+-- -> four post-assertions -> SET NOT NULL -> the two CHECKs. Two do not carry
+-- `site_id` and take the operator-disposed shapes (spec § 5 D2/D3), and
+-- `deliverable_grants` gains a NULL-TOLERANT equality CHECK only (D4).
+-- ════════════════════════════════════════════════════════════════════════════
+
+-- The #6374 census, the twin of the #6254 one above. ON COMMIT DROP for the
+-- same reason: `prisma migrate` runs each migration in one transaction.
+CREATE TEMP TABLE "_6374_fence_census" ON COMMIT DROP AS
+  SELECT (SELECT count(*) FROM "subscribers") AS "subscribers"
+       , (SELECT count(*) FROM "callbacks") AS "callbacks"
+       , (SELECT count(*) FROM "consent_grants") AS "consent_grants"
+       , (SELECT count(*) FROM "appointments") AS "appointments"
+       , (SELECT count(*) FROM "deliverable_assets") AS "deliverable_assets"
+       , (SELECT count(*) FROM "flow_checkouts") AS "flow_checkouts"
+       , (SELECT count(*) FROM "waitlist_experiments") AS "waitlist_experiments"
+       , (SELECT count(*) FROM "waitlist_scores") AS "waitlist_scores"
+       , (SELECT count(*) FROM "waitlist_followup_sends") AS "waitlist_followup_sends"
+       , (SELECT count(*) FROM "playbook_instances") AS "playbook_instances"
+       , (SELECT count(*) FROM "site_listing_configs") AS "site_listing_configs"
+;
+
+-- ── Step 1 (D1 step 1) — the column and its index ─────────────────────────
+-- Unlike the four keystone tables, these eleven have no `workspace_id`
+-- column yet, so it is ADDED nullable here and tightened in step 4. ONE
+-- index per table and nothing query-shaped (D6): a read-side unit that turns
+-- out to need a composite gets a post-M32 migration, filed with the query
+-- that justifies it.
+ALTER TABLE "subscribers" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
+CREATE INDEX IF NOT EXISTS "subscribers_workspace_id_idx" ON "subscribers" ("workspace_id");
+ALTER TABLE "callbacks" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
+CREATE INDEX IF NOT EXISTS "callbacks_workspace_id_idx" ON "callbacks" ("workspace_id");
+ALTER TABLE "consent_grants" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
+CREATE INDEX IF NOT EXISTS "consent_grants_workspace_id_idx" ON "consent_grants" ("workspace_id");
+ALTER TABLE "appointments" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
+CREATE INDEX IF NOT EXISTS "appointments_workspace_id_idx" ON "appointments" ("workspace_id");
+ALTER TABLE "deliverable_assets" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
+CREATE INDEX IF NOT EXISTS "deliverable_assets_workspace_id_idx" ON "deliverable_assets" ("workspace_id");
+ALTER TABLE "flow_checkouts" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
+CREATE INDEX IF NOT EXISTS "flow_checkouts_workspace_id_idx" ON "flow_checkouts" ("workspace_id");
+ALTER TABLE "waitlist_experiments" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
+CREATE INDEX IF NOT EXISTS "waitlist_experiments_workspace_id_idx" ON "waitlist_experiments" ("workspace_id");
+ALTER TABLE "waitlist_scores" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
+CREATE INDEX IF NOT EXISTS "waitlist_scores_workspace_id_idx" ON "waitlist_scores" ("workspace_id");
+ALTER TABLE "waitlist_followup_sends" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
+CREATE INDEX IF NOT EXISTS "waitlist_followup_sends_workspace_id_idx" ON "waitlist_followup_sends" ("workspace_id");
+ALTER TABLE "playbook_instances" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
+CREATE INDEX IF NOT EXISTS "playbook_instances_workspace_id_idx" ON "playbook_instances" ("workspace_id");
+ALTER TABLE "site_listing_configs" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
+CREATE INDEX IF NOT EXISTS "site_listing_configs_workspace_id_idx" ON "site_listing_configs" ("workspace_id");
+
+-- ── Step 2 (D1 step 2 / keystone D1a) — normalize site_id -> the sentinel ──
+-- The same literal, and the same one-way rewrite, the four keystone tables
+-- above already took. database/__tests__/composite-fence.db.test.ts pins
+-- EVERY `wksp_` literal in this file against the exported
+-- DEFAULT_WORKSPACE_ID, so these eleven cannot drift from it either.
+UPDATE "subscribers"
+   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
+ WHERE "site_id" = 'default';
+
+UPDATE "callbacks"
+   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
+ WHERE "site_id" = 'default';
+
+UPDATE "consent_grants"
+   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
+ WHERE "site_id" = 'default';
+
+UPDATE "appointments"
+   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
+ WHERE "site_id" = 'default';
+
+UPDATE "deliverable_assets"
+   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
+ WHERE "site_id" = 'default';
+
+UPDATE "flow_checkouts"
+   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
+ WHERE "site_id" = 'default';
+
+UPDATE "waitlist_experiments"
+   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
+ WHERE "site_id" = 'default';
+
+UPDATE "waitlist_scores"
+   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
+ WHERE "site_id" = 'default';
+
+UPDATE "waitlist_followup_sends"
+   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
+ WHERE "site_id" = 'default';
+
+UPDATE "playbook_instances"
+   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
+ WHERE "site_id" = 'default';
+
+UPDATE "site_listing_configs"
+   SET "site_id" = 'wksp_00000000-0000-7000-8000-000000000001'
+ WHERE "site_id" = 'default';
+
+-- ── Step 3 (D1 step 3 / keystone D2) — backfill by INNER JOIN, never by assignment ─
+-- site_id is already normalized (step 1), so no CASE/alias branch is needed.
+-- A row whose site_id resolves to nothing is simply not touched and stays
+-- NULL — never guessed. Step 3's assertion 4 then aborts on it.
+UPDATE "subscribers" x
+   SET "workspace_id" = w."id"
+  FROM "workspaces" w
+ WHERE x."workspace_id" IS NULL
+   AND w."id" = x."site_id";
+
+UPDATE "callbacks" x
+   SET "workspace_id" = w."id"
+  FROM "workspaces" w
+ WHERE x."workspace_id" IS NULL
+   AND w."id" = x."site_id";
+
+UPDATE "consent_grants" x
+   SET "workspace_id" = w."id"
+  FROM "workspaces" w
+ WHERE x."workspace_id" IS NULL
+   AND w."id" = x."site_id";
+
+UPDATE "appointments" x
+   SET "workspace_id" = w."id"
+  FROM "workspaces" w
+ WHERE x."workspace_id" IS NULL
+   AND w."id" = x."site_id";
+
+UPDATE "deliverable_assets" x
+   SET "workspace_id" = w."id"
+  FROM "workspaces" w
+ WHERE x."workspace_id" IS NULL
+   AND w."id" = x."site_id";
+
+UPDATE "flow_checkouts" x
+   SET "workspace_id" = w."id"
+  FROM "workspaces" w
+ WHERE x."workspace_id" IS NULL
+   AND w."id" = x."site_id";
+
+UPDATE "waitlist_experiments" x
+   SET "workspace_id" = w."id"
+  FROM "workspaces" w
+ WHERE x."workspace_id" IS NULL
+   AND w."id" = x."site_id";
+
+UPDATE "waitlist_scores" x
+   SET "workspace_id" = w."id"
+  FROM "workspaces" w
+ WHERE x."workspace_id" IS NULL
+   AND w."id" = x."site_id";
+
+UPDATE "waitlist_followup_sends" x
+   SET "workspace_id" = w."id"
+  FROM "workspaces" w
+ WHERE x."workspace_id" IS NULL
+   AND w."id" = x."site_id";
+
+UPDATE "playbook_instances" x
+   SET "workspace_id" = w."id"
+  FROM "workspaces" w
+ WHERE x."workspace_id" IS NULL
+   AND w."id" = x."site_id";
+
+UPDATE "site_listing_configs" x
+   SET "workspace_id" = w."id"
+  FROM "workspaces" w
+ WHERE x."workspace_id" IS NULL
+   AND w."id" = x."site_id";
+
+-- ── Step 4 (D1 step 4) — POST-ASSERTIONS, four per table ──────────────────
+-- Nothing lost (row census unchanged), nothing guessed (no workspace_id
+-- absent from "workspaces"), nothing missed (no resolvable site_id left
+-- NULL), and ABORT on any remaining NULL — this migration is about to
+-- SET NOT NULL, so an unresolvable row has no correct value to write. Never
+-- deleted, never guessed (NFR3).
+DO $$
+DECLARE
+  before_n bigint; after_n bigint; bad bigint;
+BEGIN
+  -- 1. Nothing lost — "subscribers"
+  SELECT "subscribers" INTO before_n FROM "_6374_fence_census";
+  SELECT count(*) INTO after_n FROM "subscribers";
+  IF before_n <> after_n THEN
+    RAISE EXCEPTION '#6374 post-assertion: row count changed across a purely additive migration (subscribers % -> %)', before_n, after_n;
+  END IF;
+
+  -- 2. Nothing guessed — "subscribers"
+  SELECT count(*) INTO bad FROM "subscribers" x
+   WHERE x."workspace_id" IS NOT NULL
+     AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."workspace_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374 post-assertion: % subscribers row(s) carry a workspace_id absent from workspaces', bad;
+  END IF;
+
+  -- 3. Nothing missed — "subscribers"
+  SELECT count(*) INTO bad FROM "subscribers" x
+   WHERE x."workspace_id" IS NULL
+     AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."site_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374 post-assertion: % subscribers row(s) had a resolvable site_id but came out of the backfill NULL', bad;
+  END IF;
+
+  -- 4. Abort on any remaining NULL — "subscribers"
+  SELECT count(*) INTO bad FROM "subscribers" WHERE "workspace_id" IS NULL;
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374: % subscribers row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
+  END IF;
+
+  -- 1. Nothing lost — "callbacks"
+  SELECT "callbacks" INTO before_n FROM "_6374_fence_census";
+  SELECT count(*) INTO after_n FROM "callbacks";
+  IF before_n <> after_n THEN
+    RAISE EXCEPTION '#6374 post-assertion: row count changed across a purely additive migration (callbacks % -> %)', before_n, after_n;
+  END IF;
+
+  -- 2. Nothing guessed — "callbacks"
+  SELECT count(*) INTO bad FROM "callbacks" x
+   WHERE x."workspace_id" IS NOT NULL
+     AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."workspace_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374 post-assertion: % callbacks row(s) carry a workspace_id absent from workspaces', bad;
+  END IF;
+
+  -- 3. Nothing missed — "callbacks"
+  SELECT count(*) INTO bad FROM "callbacks" x
+   WHERE x."workspace_id" IS NULL
+     AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."site_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374 post-assertion: % callbacks row(s) had a resolvable site_id but came out of the backfill NULL', bad;
+  END IF;
+
+  -- 4. Abort on any remaining NULL — "callbacks"
+  SELECT count(*) INTO bad FROM "callbacks" WHERE "workspace_id" IS NULL;
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374: % callbacks row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
+  END IF;
+
+  -- 1. Nothing lost — "consent_grants"
+  SELECT "consent_grants" INTO before_n FROM "_6374_fence_census";
+  SELECT count(*) INTO after_n FROM "consent_grants";
+  IF before_n <> after_n THEN
+    RAISE EXCEPTION '#6374 post-assertion: row count changed across a purely additive migration (consent_grants % -> %)', before_n, after_n;
+  END IF;
+
+  -- 2. Nothing guessed — "consent_grants"
+  SELECT count(*) INTO bad FROM "consent_grants" x
+   WHERE x."workspace_id" IS NOT NULL
+     AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."workspace_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374 post-assertion: % consent_grants row(s) carry a workspace_id absent from workspaces', bad;
+  END IF;
+
+  -- 3. Nothing missed — "consent_grants"
+  SELECT count(*) INTO bad FROM "consent_grants" x
+   WHERE x."workspace_id" IS NULL
+     AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."site_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374 post-assertion: % consent_grants row(s) had a resolvable site_id but came out of the backfill NULL', bad;
+  END IF;
+
+  -- 4. Abort on any remaining NULL — "consent_grants"
+  SELECT count(*) INTO bad FROM "consent_grants" WHERE "workspace_id" IS NULL;
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374: % consent_grants row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
+  END IF;
+
+  -- 1. Nothing lost — "appointments"
+  SELECT "appointments" INTO before_n FROM "_6374_fence_census";
+  SELECT count(*) INTO after_n FROM "appointments";
+  IF before_n <> after_n THEN
+    RAISE EXCEPTION '#6374 post-assertion: row count changed across a purely additive migration (appointments % -> %)', before_n, after_n;
+  END IF;
+
+  -- 2. Nothing guessed — "appointments"
+  SELECT count(*) INTO bad FROM "appointments" x
+   WHERE x."workspace_id" IS NOT NULL
+     AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."workspace_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374 post-assertion: % appointments row(s) carry a workspace_id absent from workspaces', bad;
+  END IF;
+
+  -- 3. Nothing missed — "appointments"
+  SELECT count(*) INTO bad FROM "appointments" x
+   WHERE x."workspace_id" IS NULL
+     AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."site_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374 post-assertion: % appointments row(s) had a resolvable site_id but came out of the backfill NULL', bad;
+  END IF;
+
+  -- 4. Abort on any remaining NULL — "appointments"
+  SELECT count(*) INTO bad FROM "appointments" WHERE "workspace_id" IS NULL;
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374: % appointments row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
+  END IF;
+
+  -- 1. Nothing lost — "deliverable_assets"
+  SELECT "deliverable_assets" INTO before_n FROM "_6374_fence_census";
+  SELECT count(*) INTO after_n FROM "deliverable_assets";
+  IF before_n <> after_n THEN
+    RAISE EXCEPTION '#6374 post-assertion: row count changed across a purely additive migration (deliverable_assets % -> %)', before_n, after_n;
+  END IF;
+
+  -- 2. Nothing guessed — "deliverable_assets"
+  SELECT count(*) INTO bad FROM "deliverable_assets" x
+   WHERE x."workspace_id" IS NOT NULL
+     AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."workspace_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374 post-assertion: % deliverable_assets row(s) carry a workspace_id absent from workspaces', bad;
+  END IF;
+
+  -- 3. Nothing missed — "deliverable_assets"
+  SELECT count(*) INTO bad FROM "deliverable_assets" x
+   WHERE x."workspace_id" IS NULL
+     AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."site_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374 post-assertion: % deliverable_assets row(s) had a resolvable site_id but came out of the backfill NULL', bad;
+  END IF;
+
+  -- 4. Abort on any remaining NULL — "deliverable_assets"
+  SELECT count(*) INTO bad FROM "deliverable_assets" WHERE "workspace_id" IS NULL;
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374: % deliverable_assets row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
+  END IF;
+
+  -- 1. Nothing lost — "flow_checkouts"
+  SELECT "flow_checkouts" INTO before_n FROM "_6374_fence_census";
+  SELECT count(*) INTO after_n FROM "flow_checkouts";
+  IF before_n <> after_n THEN
+    RAISE EXCEPTION '#6374 post-assertion: row count changed across a purely additive migration (flow_checkouts % -> %)', before_n, after_n;
+  END IF;
+
+  -- 2. Nothing guessed — "flow_checkouts"
+  SELECT count(*) INTO bad FROM "flow_checkouts" x
+   WHERE x."workspace_id" IS NOT NULL
+     AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."workspace_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374 post-assertion: % flow_checkouts row(s) carry a workspace_id absent from workspaces', bad;
+  END IF;
+
+  -- 3. Nothing missed — "flow_checkouts"
+  SELECT count(*) INTO bad FROM "flow_checkouts" x
+   WHERE x."workspace_id" IS NULL
+     AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."site_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374 post-assertion: % flow_checkouts row(s) had a resolvable site_id but came out of the backfill NULL', bad;
+  END IF;
+
+  -- 4. Abort on any remaining NULL — "flow_checkouts"
+  SELECT count(*) INTO bad FROM "flow_checkouts" WHERE "workspace_id" IS NULL;
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374: % flow_checkouts row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
+  END IF;
+
+  -- 1. Nothing lost — "waitlist_experiments"
+  SELECT "waitlist_experiments" INTO before_n FROM "_6374_fence_census";
+  SELECT count(*) INTO after_n FROM "waitlist_experiments";
+  IF before_n <> after_n THEN
+    RAISE EXCEPTION '#6374 post-assertion: row count changed across a purely additive migration (waitlist_experiments % -> %)', before_n, after_n;
+  END IF;
+
+  -- 2. Nothing guessed — "waitlist_experiments"
+  SELECT count(*) INTO bad FROM "waitlist_experiments" x
+   WHERE x."workspace_id" IS NOT NULL
+     AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."workspace_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374 post-assertion: % waitlist_experiments row(s) carry a workspace_id absent from workspaces', bad;
+  END IF;
+
+  -- 3. Nothing missed — "waitlist_experiments"
+  SELECT count(*) INTO bad FROM "waitlist_experiments" x
+   WHERE x."workspace_id" IS NULL
+     AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."site_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374 post-assertion: % waitlist_experiments row(s) had a resolvable site_id but came out of the backfill NULL', bad;
+  END IF;
+
+  -- 4. Abort on any remaining NULL — "waitlist_experiments"
+  SELECT count(*) INTO bad FROM "waitlist_experiments" WHERE "workspace_id" IS NULL;
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374: % waitlist_experiments row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
+  END IF;
+
+  -- 1. Nothing lost — "waitlist_scores"
+  SELECT "waitlist_scores" INTO before_n FROM "_6374_fence_census";
+  SELECT count(*) INTO after_n FROM "waitlist_scores";
+  IF before_n <> after_n THEN
+    RAISE EXCEPTION '#6374 post-assertion: row count changed across a purely additive migration (waitlist_scores % -> %)', before_n, after_n;
+  END IF;
+
+  -- 2. Nothing guessed — "waitlist_scores"
+  SELECT count(*) INTO bad FROM "waitlist_scores" x
+   WHERE x."workspace_id" IS NOT NULL
+     AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."workspace_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374 post-assertion: % waitlist_scores row(s) carry a workspace_id absent from workspaces', bad;
+  END IF;
+
+  -- 3. Nothing missed — "waitlist_scores"
+  SELECT count(*) INTO bad FROM "waitlist_scores" x
+   WHERE x."workspace_id" IS NULL
+     AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."site_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374 post-assertion: % waitlist_scores row(s) had a resolvable site_id but came out of the backfill NULL', bad;
+  END IF;
+
+  -- 4. Abort on any remaining NULL — "waitlist_scores"
+  SELECT count(*) INTO bad FROM "waitlist_scores" WHERE "workspace_id" IS NULL;
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374: % waitlist_scores row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
+  END IF;
+
+  -- 1. Nothing lost — "waitlist_followup_sends"
+  SELECT "waitlist_followup_sends" INTO before_n FROM "_6374_fence_census";
+  SELECT count(*) INTO after_n FROM "waitlist_followup_sends";
+  IF before_n <> after_n THEN
+    RAISE EXCEPTION '#6374 post-assertion: row count changed across a purely additive migration (waitlist_followup_sends % -> %)', before_n, after_n;
+  END IF;
+
+  -- 2. Nothing guessed — "waitlist_followup_sends"
+  SELECT count(*) INTO bad FROM "waitlist_followup_sends" x
+   WHERE x."workspace_id" IS NOT NULL
+     AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."workspace_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374 post-assertion: % waitlist_followup_sends row(s) carry a workspace_id absent from workspaces', bad;
+  END IF;
+
+  -- 3. Nothing missed — "waitlist_followup_sends"
+  SELECT count(*) INTO bad FROM "waitlist_followup_sends" x
+   WHERE x."workspace_id" IS NULL
+     AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."site_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374 post-assertion: % waitlist_followup_sends row(s) had a resolvable site_id but came out of the backfill NULL', bad;
+  END IF;
+
+  -- 4. Abort on any remaining NULL — "waitlist_followup_sends"
+  SELECT count(*) INTO bad FROM "waitlist_followup_sends" WHERE "workspace_id" IS NULL;
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374: % waitlist_followup_sends row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
+  END IF;
+
+  -- 1. Nothing lost — "playbook_instances"
+  SELECT "playbook_instances" INTO before_n FROM "_6374_fence_census";
+  SELECT count(*) INTO after_n FROM "playbook_instances";
+  IF before_n <> after_n THEN
+    RAISE EXCEPTION '#6374 post-assertion: row count changed across a purely additive migration (playbook_instances % -> %)', before_n, after_n;
+  END IF;
+
+  -- 2. Nothing guessed — "playbook_instances"
+  SELECT count(*) INTO bad FROM "playbook_instances" x
+   WHERE x."workspace_id" IS NOT NULL
+     AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."workspace_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374 post-assertion: % playbook_instances row(s) carry a workspace_id absent from workspaces', bad;
+  END IF;
+
+  -- 3. Nothing missed — "playbook_instances"
+  SELECT count(*) INTO bad FROM "playbook_instances" x
+   WHERE x."workspace_id" IS NULL
+     AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."site_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374 post-assertion: % playbook_instances row(s) had a resolvable site_id but came out of the backfill NULL', bad;
+  END IF;
+
+  -- 4. Abort on any remaining NULL — "playbook_instances"
+  SELECT count(*) INTO bad FROM "playbook_instances" WHERE "workspace_id" IS NULL;
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374: % playbook_instances row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
+  END IF;
+
+  -- 1. Nothing lost — "site_listing_configs"
+  SELECT "site_listing_configs" INTO before_n FROM "_6374_fence_census";
+  SELECT count(*) INTO after_n FROM "site_listing_configs";
+  IF before_n <> after_n THEN
+    RAISE EXCEPTION '#6374 post-assertion: row count changed across a purely additive migration (site_listing_configs % -> %)', before_n, after_n;
+  END IF;
+
+  -- 2. Nothing guessed — "site_listing_configs"
+  SELECT count(*) INTO bad FROM "site_listing_configs" x
+   WHERE x."workspace_id" IS NOT NULL
+     AND NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."workspace_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374 post-assertion: % site_listing_configs row(s) carry a workspace_id absent from workspaces', bad;
+  END IF;
+
+  -- 3. Nothing missed — "site_listing_configs"
+  SELECT count(*) INTO bad FROM "site_listing_configs" x
+   WHERE x."workspace_id" IS NULL
+     AND EXISTS (SELECT 1 FROM "workspaces" w WHERE w."id" = x."site_id");
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374 post-assertion: % site_listing_configs row(s) had a resolvable site_id but came out of the backfill NULL', bad;
+  END IF;
+
+  -- 4. Abort on any remaining NULL — "site_listing_configs"
+  SELECT count(*) INTO bad FROM "site_listing_configs" WHERE "workspace_id" IS NULL;
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374: % site_listing_configs row(s) have a site_id that resolves to no workspace this database holds — resolve or remove them before re-running this migration', bad;
+  END IF;
+
+END $$;
+
+-- ── Step 5a (D1 step 5) — SET NOT NULL (spec FR1, AC-1) ───────────────────
+ALTER TABLE "subscribers" ALTER COLUMN "workspace_id" SET NOT NULL;
+ALTER TABLE "callbacks" ALTER COLUMN "workspace_id" SET NOT NULL;
+ALTER TABLE "consent_grants" ALTER COLUMN "workspace_id" SET NOT NULL;
+ALTER TABLE "appointments" ALTER COLUMN "workspace_id" SET NOT NULL;
+ALTER TABLE "deliverable_assets" ALTER COLUMN "workspace_id" SET NOT NULL;
+ALTER TABLE "flow_checkouts" ALTER COLUMN "workspace_id" SET NOT NULL;
+ALTER TABLE "waitlist_experiments" ALTER COLUMN "workspace_id" SET NOT NULL;
+ALTER TABLE "waitlist_scores" ALTER COLUMN "workspace_id" SET NOT NULL;
+ALTER TABLE "waitlist_followup_sends" ALTER COLUMN "workspace_id" SET NOT NULL;
+ALTER TABLE "playbook_instances" ALTER COLUMN "workspace_id" SET NOT NULL;
+ALTER TABLE "site_listing_configs" ALTER COLUMN "workspace_id" SET NOT NULL;
+
+-- ── Step 5b (D1 step 5) — the two CHECKs, DROP then ADD, never the guarded DO block ─
+-- keystone D5 / SEC-06: an existence guard would silently no-op a TIGHTENING
+-- on any database that already carries a same-named constraint — a
+-- false-green control. The format CHECK carries NO `IS NULL OR` arm (the
+-- precedent's did, because the precedent never enforced NOT NULL; step 4
+-- just did).
+ALTER TABLE "subscribers" DROP CONSTRAINT IF EXISTS "subscribers_workspace_id_format";
+ALTER TABLE "subscribers" ADD CONSTRAINT "subscribers_workspace_id_format"
+  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "subscribers" DROP CONSTRAINT IF EXISTS "subscribers_workspace_site_agree";
+ALTER TABLE "subscribers" ADD CONSTRAINT "subscribers_workspace_site_agree"
+  CHECK ("workspace_id" = "site_id");
+
+ALTER TABLE "callbacks" DROP CONSTRAINT IF EXISTS "callbacks_workspace_id_format";
+ALTER TABLE "callbacks" ADD CONSTRAINT "callbacks_workspace_id_format"
+  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "callbacks" DROP CONSTRAINT IF EXISTS "callbacks_workspace_site_agree";
+ALTER TABLE "callbacks" ADD CONSTRAINT "callbacks_workspace_site_agree"
+  CHECK ("workspace_id" = "site_id");
+
+ALTER TABLE "consent_grants" DROP CONSTRAINT IF EXISTS "consent_grants_workspace_id_format";
+ALTER TABLE "consent_grants" ADD CONSTRAINT "consent_grants_workspace_id_format"
+  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "consent_grants" DROP CONSTRAINT IF EXISTS "consent_grants_workspace_site_agree";
+ALTER TABLE "consent_grants" ADD CONSTRAINT "consent_grants_workspace_site_agree"
+  CHECK ("workspace_id" = "site_id");
+
+ALTER TABLE "appointments" DROP CONSTRAINT IF EXISTS "appointments_workspace_id_format";
+ALTER TABLE "appointments" ADD CONSTRAINT "appointments_workspace_id_format"
+  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "appointments" DROP CONSTRAINT IF EXISTS "appointments_workspace_site_agree";
+ALTER TABLE "appointments" ADD CONSTRAINT "appointments_workspace_site_agree"
+  CHECK ("workspace_id" = "site_id");
+
+ALTER TABLE "deliverable_assets" DROP CONSTRAINT IF EXISTS "deliverable_assets_workspace_id_format";
+ALTER TABLE "deliverable_assets" ADD CONSTRAINT "deliverable_assets_workspace_id_format"
+  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "deliverable_assets" DROP CONSTRAINT IF EXISTS "deliverable_assets_workspace_site_agree";
+ALTER TABLE "deliverable_assets" ADD CONSTRAINT "deliverable_assets_workspace_site_agree"
+  CHECK ("workspace_id" = "site_id");
+
+ALTER TABLE "flow_checkouts" DROP CONSTRAINT IF EXISTS "flow_checkouts_workspace_id_format";
+ALTER TABLE "flow_checkouts" ADD CONSTRAINT "flow_checkouts_workspace_id_format"
+  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "flow_checkouts" DROP CONSTRAINT IF EXISTS "flow_checkouts_workspace_site_agree";
+ALTER TABLE "flow_checkouts" ADD CONSTRAINT "flow_checkouts_workspace_site_agree"
+  CHECK ("workspace_id" = "site_id");
+
+ALTER TABLE "waitlist_experiments" DROP CONSTRAINT IF EXISTS "waitlist_experiments_workspace_id_format";
+ALTER TABLE "waitlist_experiments" ADD CONSTRAINT "waitlist_experiments_workspace_id_format"
+  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "waitlist_experiments" DROP CONSTRAINT IF EXISTS "waitlist_experiments_workspace_site_agree";
+ALTER TABLE "waitlist_experiments" ADD CONSTRAINT "waitlist_experiments_workspace_site_agree"
+  CHECK ("workspace_id" = "site_id");
+
+ALTER TABLE "waitlist_scores" DROP CONSTRAINT IF EXISTS "waitlist_scores_workspace_id_format";
+ALTER TABLE "waitlist_scores" ADD CONSTRAINT "waitlist_scores_workspace_id_format"
+  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "waitlist_scores" DROP CONSTRAINT IF EXISTS "waitlist_scores_workspace_site_agree";
+ALTER TABLE "waitlist_scores" ADD CONSTRAINT "waitlist_scores_workspace_site_agree"
+  CHECK ("workspace_id" = "site_id");
+
+ALTER TABLE "waitlist_followup_sends" DROP CONSTRAINT IF EXISTS "waitlist_followup_sends_workspace_id_format";
+ALTER TABLE "waitlist_followup_sends" ADD CONSTRAINT "waitlist_followup_sends_workspace_id_format"
+  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "waitlist_followup_sends" DROP CONSTRAINT IF EXISTS "waitlist_followup_sends_workspace_site_agree";
+ALTER TABLE "waitlist_followup_sends" ADD CONSTRAINT "waitlist_followup_sends_workspace_site_agree"
+  CHECK ("workspace_id" = "site_id");
+
+ALTER TABLE "playbook_instances" DROP CONSTRAINT IF EXISTS "playbook_instances_workspace_id_format";
+ALTER TABLE "playbook_instances" ADD CONSTRAINT "playbook_instances_workspace_id_format"
+  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "playbook_instances" DROP CONSTRAINT IF EXISTS "playbook_instances_workspace_site_agree";
+ALTER TABLE "playbook_instances" ADD CONSTRAINT "playbook_instances_workspace_site_agree"
+  CHECK ("workspace_id" = "site_id");
+
+ALTER TABLE "site_listing_configs" DROP CONSTRAINT IF EXISTS "site_listing_configs_workspace_id_format";
+ALTER TABLE "site_listing_configs" ADD CONSTRAINT "site_listing_configs_workspace_id_format"
+  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "site_listing_configs" DROP CONSTRAINT IF EXISTS "site_listing_configs_workspace_site_agree";
+ALTER TABLE "site_listing_configs" ADD CONSTRAINT "site_listing_configs_workspace_site_agree"
+  CHECK ("workspace_id" = "site_id");
+
+
+-- ── D2 — `listing_csv_sends`: NOT NULL + format CHECK, no equality CHECK ────
+-- It has no `site_id`, so an equality CHECK has nothing to compare. The
+-- backfill takes the workspace from the PARENT listing row, which the
+-- keystone above already fenced. A composite FK to `project_listings` is
+-- legal here (both models are `inbox`) and was offered; the operator chose
+-- ONE fence shape over a second, stricter one for an audit-log table
+-- (2026-09-20, spec § 8 Q1 -> option (a)).
+ALTER TABLE "listing_csv_sends" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
+CREATE INDEX IF NOT EXISTS "listing_csv_sends_workspace_id_idx"
+  ON "listing_csv_sends" ("workspace_id");
+
+UPDATE "listing_csv_sends" s
+   SET "workspace_id" = p."workspace_id"
+  FROM "project_listings" p
+ WHERE s."workspace_id" IS NULL
+   AND p."id" = s."listing_id";
+
+DO $$
+DECLARE
+  bad bigint;
+BEGIN
+  -- The same abort-on-NULL rule the eleven take: a send row whose listing is
+  -- gone (or was never fenced) has no correct workspace to write, and this
+  -- is about to SET NOT NULL. Never deleted, never guessed (NFR3).
+  SELECT count(*) INTO bad FROM "listing_csv_sends" WHERE "workspace_id" IS NULL;
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374: % listing_csv_sends row(s) have a listing_id that resolves to no project_listings row — resolve or remove them before re-running this migration', bad;
+  END IF;
+END $$;
+
+ALTER TABLE "listing_csv_sends" ALTER COLUMN "workspace_id" SET NOT NULL;
+
+ALTER TABLE "listing_csv_sends" DROP CONSTRAINT IF EXISTS "listing_csv_sends_workspace_id_format";
+ALTER TABLE "listing_csv_sends" ADD CONSTRAINT "listing_csv_sends_workspace_id_format"
+  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+
+-- ── D3 — `site_settings`: keyed BY the workspace, read through the alias ────
+-- It has no `site_id` either, and its one read
+-- (apps/api/src/services/dunning-policy.ts) arrives with a site ALIAS. Every
+-- existing row backfills to the SENTINEL workspace: a pre-fence row belonged
+-- to "the site", which is exactly what the alias `default` resolves to — the
+-- same rule step 1 applies to `site_id` on the eleven.
+--
+-- This is the one block that moves a UNIQUE INDEX, which is why index DDL
+-- appears here and in none of the five steps above: `key` was globally
+-- unique, so two sellers could not both hold `feature_flags`. The `key` TEXT
+-- itself is left VERBATIM — `dunning-policy.ts` embeds the site alias in the
+-- key string, and rebuilding it from the resolved id would match no row and
+-- silently hand every seller the built-in default policy (spec D3).
+ALTER TABLE "site_settings" ADD COLUMN IF NOT EXISTS "workspace_id" TEXT;
+CREATE INDEX IF NOT EXISTS "site_settings_workspace_id_idx"
+  ON "site_settings" ("workspace_id");
+
+-- ── ABORT, NEVER GUESS — before the sentinel assignment below (AC-14) ──────
+-- NFR3 ("an unresolvable row aborts the migration; it is never deleted and
+-- never guessed") applied to the ONE table whose tenant lives in its key TEXT
+-- rather than in a column. The assignment below attributes every unattributed
+-- row to the sentinel, which is right for a row that belonged to "the site" —
+-- and WRONG for a row whose key already names a DIFFERENT workspace. Such a
+-- row would be silently misfiled under the sentinel, and
+-- `dunning-policy.ts`'s read (keyed on the resolved workspace AND the verbatim
+-- key) would then miss it forever, falling back to the built-in default
+-- policy — MORE permissive than a configured one, on a delinquent-
+-- subscription path. Found by this unit's own security review; disposed by
+-- the operator 2026-09-20 as abort-not-derive.
+--
+-- This DETECTS; it never DERIVES. The embedded id is matched and counted, and
+-- is never read back out and used as the backfill value — key parsing is
+-- exactly what spec D3 forbids, because the alias in the key is load-bearing
+-- for the read. An operator whose database trips this resolves or removes the
+-- rows by hand and re-runs.
+--
+-- The negative lookahead is what makes this precise: it matches a well-formed
+-- `wksp_`+UUIDv7 that is NOT the sentinel literal. A key carrying the sentinel
+-- id, a bare alias (`…:default`), or no id at all is left for the sentinel
+-- assignment below, exactly as before.
+--
+-- Guarded on `workspace_id IS NULL`, so on an already-migrated database every
+-- row is attributed, the count is zero, and a verbatim re-run stays the no-op
+-- NFR2 requires.
+DO $$
+DECLARE
+  bad bigint;
+BEGIN
+  SELECT count(*) INTO bad
+    FROM "site_settings"
+   WHERE "workspace_id" IS NULL
+     AND "key" ~ 'wksp_(?!00000000-0000-7000-8000-000000000001)[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}';
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374: % site_settings row(s) carry a NON-SENTINEL workspace id embedded in their key and no workspace_id of their own — assigning them to the sentinel would misfile them and make their read miss forever; resolve or remove them before re-running this migration', bad;
+  END IF;
+END $$;
+
+UPDATE "site_settings"
+   SET "workspace_id" = 'wksp_00000000-0000-7000-8000-000000000001'
+ WHERE "workspace_id" IS NULL
+   AND EXISTS (
+     SELECT 1 FROM "workspaces" w
+      WHERE w."id" = 'wksp_00000000-0000-7000-8000-000000000001'
+   );
+
+DO $$
+DECLARE
+  bad bigint;
+BEGIN
+  -- Abort rather than guess: a settings row on a database with no sentinel
+  -- workspace has no workspace to belong to, and this is about to
+  -- SET NOT NULL.
+  SELECT count(*) INTO bad FROM "site_settings" WHERE "workspace_id" IS NULL;
+  IF bad <> 0 THEN
+    RAISE EXCEPTION '#6374: % site_settings row(s) remain unattributed — this database holds no sentinel workspace to backfill them to; resolve or remove them before re-running this migration', bad;
+  END IF;
+END $$;
+
+ALTER TABLE "site_settings" ALTER COLUMN "workspace_id" SET NOT NULL;
+
+ALTER TABLE "site_settings" DROP CONSTRAINT IF EXISTS "site_settings_workspace_id_format";
+ALTER TABLE "site_settings" ADD CONSTRAINT "site_settings_workspace_id_format"
+  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+
+-- The unique key moves from (key) to (workspace_id, key).
+--
+-- DROP-then-CREATE for the REPLACEMENT too, never `CREATE UNIQUE INDEX IF NOT
+-- EXISTS` — the same keystone D5 / SEC-06 rule the CHECKs above follow, and
+-- this is the one place in this file where a constraint REPLACES a dropped
+-- one, so it is the one place the false-green would actually cost something.
+-- `IF NOT EXISTS` matches on NAME ALONE: an index of this name that was
+-- non-unique, or over different columns, would silently satisfy the guard and
+-- leave `site_settings` with NO uniqueness at all — having already dropped the
+-- old one unconditionally on the line above. The old index is a plain index,
+-- not a table constraint (20260508000000_add_inbox_namespace created it with
+-- `CREATE UNIQUE INDEX`), so `DROP INDEX` is the correct verb for both.
+DROP INDEX IF EXISTS "site_settings_key_key";
+DROP INDEX IF EXISTS "site_settings_workspace_id_key_key";
+CREATE UNIQUE INDEX "site_settings_workspace_id_key_key"
+  ON "site_settings" ("workspace_id", "key");
+
+-- ── D4 — `deliverable_grants`: stamped at mint, and STILL nullable ──────────
+-- No column is added and no existing row is touched. NULL remains the serve
+-- path's fail-closed sentinel (#6254 § 10.1 Q2): a legacy `dasset_` grant and
+-- a `playbook:` virtual one keep their NULL and keep meaning "serve nothing".
+-- `deliverable_grants.site_id` is deliberately NOT normalized — a legacy row
+-- keeps its alias, which with a NULL workspace still means serve nothing.
+--
+-- What IS added is the NULL-TOLERANT equality CHECK, so a STAMPED grant can
+-- never disagree with its site while a legacy grant stays storable. Both mint
+-- sites stamp the workspace they already hold (AC-8).
+ALTER TABLE "deliverable_grants" DROP CONSTRAINT IF EXISTS "deliverable_grants_workspace_site_agree";
+ALTER TABLE "deliverable_grants" ADD CONSTRAINT "deliverable_grants_workspace_site_agree"
+  CHECK ("workspace_id" IS NULL OR "workspace_id" = "site_id");