dsh-kingdom 2.0.0 → 3.2.0

package/lib/core/db.js

@@ -44,118 +44,118 @@ import { asExecutionState, isTerminalExecutionState, transitionExecution, } from
  * - v4 DDL 不进 SCHEMA_SQL bootstrap（避免迁移事务语义失效；见 ensureSchemaV4 头注）。
  */
 export const SCHEMA_VERSION = 4;
-export const SCHEMA_SQL = `
-CREATE TABLE IF NOT EXISTS kingdoms (
-  kingdom_id   TEXT PRIMARY KEY,
-  name         TEXT NOT NULL,
-  created_at   TEXT NOT NULL,
-  owner_id     TEXT NOT NULL,
-  owner_name   TEXT NOT NULL,
-  schema_version INTEGER NOT NULL DEFAULT 1
-);
-
-CREATE TABLE IF NOT EXISTS territories (
-  territory_id  TEXT PRIMARY KEY,
-  kingdom_id    TEXT NOT NULL,
-  name          TEXT NOT NULL,
-  workspace_path TEXT,
-  summary       TEXT,
-  supervisor_binding_id TEXT,
-  status        TEXT NOT NULL DEFAULT 'ACTIVE',
-  created_at    TEXT NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS role_bindings (
-  binding_id   TEXT PRIMARY KEY,
-  kingdom_id   TEXT NOT NULL,
-  role_type    TEXT NOT NULL CHECK(role_type IN ('OWNER','CHANCELLOR','SUPERVISOR','WORKER')),
-  role_name    TEXT NOT NULL,
-  runtime_type TEXT NOT NULL DEFAULT 'dsh',
-  session_id   TEXT,
-  model_name   TEXT,
-  agent_name   TEXT,
-  session_meta TEXT,
-  principal_id TEXT,
-  created_at   TEXT NOT NULL,
-  updated_at   TEXT NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS tasks (
-  task_id         TEXT PRIMARY KEY,
-  territory_id    TEXT NOT NULL,
-  parent_task_id  TEXT,
-  title           TEXT NOT NULL,
-  description     TEXT,
-  assigned_binding_id TEXT,
-  status          TEXT NOT NULL DEFAULT 'CREATED',
-  acceptance_criteria TEXT,
-  result_summary  TEXT,
-  created_at      TEXT NOT NULL,
-  updated_at      TEXT NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS events (
-  event_id    TEXT PRIMARY KEY,
-  kingdom_id  TEXT NOT NULL,
-  event_type  TEXT NOT NULL,
-  actor_role  TEXT,
-  actor_id    TEXT,
-  target_type TEXT,
-  target_id   TEXT,
-  payload_json TEXT NOT NULL DEFAULT '{}',
-  created_at  TEXT NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS worker_results (
-  result_id          TEXT PRIMARY KEY,
-  task_id            TEXT NOT NULL,
-  attempt_no         INTEGER NOT NULL,
-  worker_binding_id  TEXT,
-  session_id         TEXT,
-  outcome            TEXT NOT NULL,
-  result_json        TEXT NOT NULL DEFAULT '{}',
-  created_at         TEXT NOT NULL,
-  UNIQUE(task_id, attempt_no)
-);
-
-CREATE UNIQUE INDEX IF NOT EXISTS territories_kingdom_name_uk
-  ON territories(kingdom_id, name);
-
-CREATE TABLE IF NOT EXISTS executions (
-  execution_id       TEXT PRIMARY KEY,
-  task_id            TEXT NOT NULL,
-  attempt_no         INTEGER NOT NULL,
-  worker_binding_id  TEXT,
-  session_id         TEXT,
-  state              TEXT NOT NULL,
-  detail             TEXT,
-  started_at         TEXT NOT NULL,
-  heartbeat_at       TEXT,
-  ended_at           TEXT,
-  pause_requested_at TEXT,
-  UNIQUE(task_id, attempt_no)
-);
-
-CREATE INDEX IF NOT EXISTS executions_task_idx ON executions(task_id);
-
-CREATE TABLE IF NOT EXISTS task_assignments (
-  assignment_id          TEXT PRIMARY KEY,
-  task_id                TEXT NOT NULL,
-  territory_id           TEXT NOT NULL,
-  worker_binding_id      TEXT NOT NULL,
-  assigned_by            TEXT NOT NULL,
-  assigned_at            TEXT NOT NULL,
-  ended_at               TEXT,
-  end_reason             TEXT,
-  previous_assignment_id TEXT,
-  handoff_reason         TEXT,
-  created_at             TEXT NOT NULL
-);
-
-CREATE UNIQUE INDEX IF NOT EXISTS one_active_assignment_per_task
-  ON task_assignments(task_id) WHERE ended_at IS NULL;
-
-CREATE INDEX IF NOT EXISTS task_assignments_task_idx ON task_assignments(task_id);
+export const SCHEMA_SQL = `
+CREATE TABLE IF NOT EXISTS kingdoms (
+  kingdom_id   TEXT PRIMARY KEY,
+  name         TEXT NOT NULL,
+  created_at   TEXT NOT NULL,
+  owner_id     TEXT NOT NULL,
+  owner_name   TEXT NOT NULL,
+  schema_version INTEGER NOT NULL DEFAULT 1
+);
+
+CREATE TABLE IF NOT EXISTS territories (
+  territory_id  TEXT PRIMARY KEY,
+  kingdom_id    TEXT NOT NULL,
+  name          TEXT NOT NULL,
+  workspace_path TEXT,
+  summary       TEXT,
+  supervisor_binding_id TEXT,
+  status        TEXT NOT NULL DEFAULT 'ACTIVE',
+  created_at    TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS role_bindings (
+  binding_id   TEXT PRIMARY KEY,
+  kingdom_id   TEXT NOT NULL,
+  role_type    TEXT NOT NULL CHECK(role_type IN ('OWNER','CHANCELLOR','SUPERVISOR','WORKER')),
+  role_name    TEXT NOT NULL,
+  runtime_type TEXT NOT NULL DEFAULT 'dsh',
+  session_id   TEXT,
+  model_name   TEXT,
+  agent_name   TEXT,
+  session_meta TEXT,
+  principal_id TEXT,
+  created_at   TEXT NOT NULL,
+  updated_at   TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS tasks (
+  task_id         TEXT PRIMARY KEY,
+  territory_id    TEXT NOT NULL,
+  parent_task_id  TEXT,
+  title           TEXT NOT NULL,
+  description     TEXT,
+  assigned_binding_id TEXT,
+  status          TEXT NOT NULL DEFAULT 'CREATED',
+  acceptance_criteria TEXT,
+  result_summary  TEXT,
+  created_at      TEXT NOT NULL,
+  updated_at      TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS events (
+  event_id    TEXT PRIMARY KEY,
+  kingdom_id  TEXT NOT NULL,
+  event_type  TEXT NOT NULL,
+  actor_role  TEXT,
+  actor_id    TEXT,
+  target_type TEXT,
+  target_id   TEXT,
+  payload_json TEXT NOT NULL DEFAULT '{}',
+  created_at  TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS worker_results (
+  result_id          TEXT PRIMARY KEY,
+  task_id            TEXT NOT NULL,
+  attempt_no         INTEGER NOT NULL,
+  worker_binding_id  TEXT,
+  session_id         TEXT,
+  outcome            TEXT NOT NULL,
+  result_json        TEXT NOT NULL DEFAULT '{}',
+  created_at         TEXT NOT NULL,
+  UNIQUE(task_id, attempt_no)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS territories_kingdom_name_uk
+  ON territories(kingdom_id, name);
+
+CREATE TABLE IF NOT EXISTS executions (
+  execution_id       TEXT PRIMARY KEY,
+  task_id            TEXT NOT NULL,
+  attempt_no         INTEGER NOT NULL,
+  worker_binding_id  TEXT,
+  session_id         TEXT,
+  state              TEXT NOT NULL,
+  detail             TEXT,
+  started_at         TEXT NOT NULL,
+  heartbeat_at       TEXT,
+  ended_at           TEXT,
+  pause_requested_at TEXT,
+  UNIQUE(task_id, attempt_no)
+);
+
+CREATE INDEX IF NOT EXISTS executions_task_idx ON executions(task_id);
+
+CREATE TABLE IF NOT EXISTS task_assignments (
+  assignment_id          TEXT PRIMARY KEY,
+  task_id                TEXT NOT NULL,
+  territory_id           TEXT NOT NULL,
+  worker_binding_id      TEXT NOT NULL,
+  assigned_by            TEXT NOT NULL,
+  assigned_at            TEXT NOT NULL,
+  ended_at               TEXT,
+  end_reason             TEXT,
+  previous_assignment_id TEXT,
+  handoff_reason         TEXT,
+  created_at             TEXT NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS one_active_assignment_per_task
+  ON task_assignments(task_id) WHERE ended_at IS NULL;
+
+CREATE INDEX IF NOT EXISTS task_assignments_task_idx ON task_assignments(task_id);
 `;
 export class KingdomStore {
     db;
@@ -163,6 +163,11 @@ export class KingdomStore {
     existed;
     /** 库的 schema 版本（经 kingdoms.schema_version 收敛；v4 判定用）。 */
     schemaVersion;
+    /**
+     * withImmediateTransaction 的重入深度。
+     * 0 = 无事务在跑；>0 = 已有外层事务，内层调用只加入、不再 BEGIN/COMMIT/ROLLBACK。
+     */
+    transactionDepth = 0;
     constructor(dbPath, options = {}) {
         mkdirSync(dirname(dbPath), { recursive: true });
         const existed = isExistingDatabase(dbPath);
@@ -335,13 +340,13 @@ export class KingdomStore {
                 .prepare(`SELECT COUNT(*) AS n FROM role_bindings WHERE role_type = 'SUPERVISOR' AND status = 'ACTIVE'`)
                 .get();
             if (supervisorCount.n === 1) {
-                this.db.exec(`
-          UPDATE territories
-             SET supervisor_binding_id = (
-               SELECT binding_id FROM role_bindings
-                WHERE role_type = 'SUPERVISOR' AND status = 'ACTIVE' LIMIT 1
-             )
-           WHERE supervisor_binding_id IS NULL AND status = 'ACTIVE'
+                this.db.exec(`
+          UPDATE territories
+             SET supervisor_binding_id = (
+               SELECT binding_id FROM role_bindings
+                WHERE role_type = 'SUPERVISOR' AND status = 'ACTIVE' LIMIT 1
+             )
+           WHERE supervisor_binding_id IS NULL AND status = 'ACTIVE'
         `);
             }
             // verify：全部预期列/表/索引存在，缺失即失败（fail-loud）
@@ -386,351 +391,351 @@ export class KingdomStore {
     // 既有 v3 库开库瞬间就被建出 v4 表，ensureSchemaV4 的"单事务迁移 + 失败 ROLLBACK"
     // 语义失效。因此 v4 全部 DDL 只在 ensureSchemaV4 的 BEGIN IMMEDIATE 事务内落地。
     /** v4 Ledger 表（affinity/lease/decision）+ 各自索引与 trigger（不含 executions 重建与 dispatch）。 */
-    static V4_LEDGER_SQL = `
-CREATE TABLE IF NOT EXISTS session_territory_affinities (
-  affinity_id       TEXT PRIMARY KEY,
-  kingdom_id        TEXT NOT NULL,
-  worker_binding_id TEXT NOT NULL,
-  runtime_type      TEXT NOT NULL,
-  runtime_instance_ref TEXT NOT NULL,
-  session_ref       TEXT NOT NULL,
-  territory_id      TEXT NOT NULL,
-  established_at    TEXT NOT NULL,
-  retired_at        TEXT,
-  is_current        INTEGER NOT NULL DEFAULT 1,
-  created_at        TEXT NOT NULL,
-  UNIQUE (runtime_type, runtime_instance_ref, session_ref),
-  CHECK (
-    (is_current = 1 AND retired_at IS NULL)
-    OR
-    (is_current = 0 AND retired_at IS NOT NULL)
-  )
-);
-CREATE UNIQUE INDEX IF NOT EXISTS affinity_one_current_per_worker
-  ON session_territory_affinities(kingdom_id, worker_binding_id)
-  WHERE is_current = 1;
-CREATE TRIGGER IF NOT EXISTS affinity_identity_immutable
-BEFORE UPDATE OF kingdom_id, worker_binding_id, runtime_type,
-                 runtime_instance_ref, session_ref, territory_id,
-                 established_at, created_at
-ON session_territory_affinities
-BEGIN SELECT RAISE(ABORT, 'AFFINITY_IDENTITY_IMMUTABLE'); END;
-CREATE TRIGGER IF NOT EXISTS affinity_retire
-BEFORE UPDATE OF is_current, retired_at
-ON session_territory_affinities
-BEGIN
-  SELECT RAISE(ABORT, 'AFFINITY_RETIRE_ONLY_JOINT')
-  WHERE NOT (
-    OLD.is_current = 1 AND OLD.retired_at IS NULL
-    AND NEW.is_current = 0 AND NEW.retired_at IS NOT NULL
-  );
-  SELECT RAISE(ABORT, 'AFFINITY_ALREADY_RETIRED')
-  WHERE OLD.retired_at IS NOT NULL;
-END;
-CREATE TRIGGER IF NOT EXISTS affinity_no_delete
-BEFORE DELETE ON session_territory_affinities
-BEGIN SELECT RAISE(ABORT, 'AFFINITY_NO_DELETE'); END;
-
-CREATE TABLE IF NOT EXISTS execution_leases (
-  lease_id               TEXT PRIMARY KEY,
-  kingdom_id             TEXT NOT NULL,
-  worker_binding_id      TEXT NOT NULL,
-  runtime_type           TEXT NOT NULL,
-  runtime_instance_ref   TEXT NOT NULL,
-  session_ref            TEXT NOT NULL,
-  territory_id           TEXT NOT NULL,
-  task_id                TEXT NOT NULL,
-  attempt_no             INTEGER NOT NULL,
-  state                  TEXT NOT NULL CHECK(state IN
-    ('ACQUIRED','PREPARING','MATERIALIZING','DISPATCH_READY',
-     'EXECUTING','SETTLING','RELEASING','RECOVERING','RELEASED')),
-  capability_decision_id TEXT,
-  enforcement_plan_snapshot TEXT,
-  release_evidence_json  TEXT,
-  release_reason         TEXT,
-  acquired_at            TEXT NOT NULL,
-  released_at            TEXT,
-  updated_at             TEXT NOT NULL,
-  UNIQUE (task_id, attempt_no),
-  UNIQUE (runtime_type, runtime_instance_ref, session_ref, task_id, attempt_no)
-);
-CREATE UNIQUE INDEX IF NOT EXISTS lease_one_active_per_session
-  ON execution_leases(runtime_type, runtime_instance_ref, session_ref)
-  WHERE state <> 'RELEASED';
-CREATE TRIGGER IF NOT EXISTS lease_requires_matching_affinity
-BEFORE INSERT ON execution_leases
-BEGIN
-  SELECT RAISE(ABORT, 'LEASE_REQUIRES_MATCHING_CURRENT_AFFINITY')
-  WHERE NOT EXISTS (
-    SELECT 1
-    FROM session_territory_affinities a
-    JOIN tasks t ON t.task_id = NEW.task_id
-    WHERE a.kingdom_id = NEW.kingdom_id
-      AND a.worker_binding_id = NEW.worker_binding_id
-      AND a.runtime_type = NEW.runtime_type
-      AND a.runtime_instance_ref = NEW.runtime_instance_ref
-      AND a.session_ref = NEW.session_ref
-      AND a.is_current = 1 AND a.retired_at IS NULL
-      AND a.territory_id = NEW.territory_id
-      AND t.territory_id = NEW.territory_id
-  );
-END;
-CREATE TRIGGER IF NOT EXISTS lease_identity_immutable
-BEFORE UPDATE OF kingdom_id, worker_binding_id, runtime_type, runtime_instance_ref,
-                 session_ref, territory_id, task_id, attempt_no, acquired_at
-ON execution_leases
-BEGIN SELECT RAISE(ABORT, 'LEASE_IDENTITY_IMMUTABLE'); END;
-CREATE TRIGGER IF NOT EXISTS lease_plan_once
-BEFORE UPDATE OF enforcement_plan_snapshot
-ON execution_leases
-WHEN OLD.enforcement_plan_snapshot IS NOT NULL
-BEGIN SELECT RAISE(ABORT, 'LEASE_PLAN_ALREADY_SET'); END;
-CREATE TRIGGER IF NOT EXISTS lease_decision_once
-BEFORE UPDATE OF capability_decision_id
-ON execution_leases
-WHEN OLD.capability_decision_id IS NOT NULL
-BEGIN SELECT RAISE(ABORT, 'LEASE_DECISION_ALREADY_BOUND'); END;
-CREATE TRIGGER IF NOT EXISTS lease_release_evidence_once
-BEFORE UPDATE OF release_evidence_json, release_reason
-ON execution_leases
-WHEN OLD.release_evidence_json IS NOT NULL
-BEGIN SELECT RAISE(ABORT, 'LEASE_RELEASE_EVIDENCE_ALREADY_SET'); END;
-CREATE TRIGGER IF NOT EXISTS lease_state_guard
-BEFORE UPDATE OF state ON execution_leases
-WHEN NEW.state <> OLD.state
-BEGIN
-  SELECT RAISE(ABORT, 'ILLEGAL_LEASE_TRANSITION') WHERE NOT (
-    (OLD.state='ACQUIRED' AND NEW.state IN ('PREPARING','RECOVERING'))
-    OR (OLD.state='PREPARING' AND NEW.state IN ('MATERIALIZING','RECOVERING'))
-    OR (OLD.state='MATERIALIZING' AND NEW.state IN ('DISPATCH_READY','RECOVERING','RELEASED'))
-    OR (OLD.state='DISPATCH_READY' AND NEW.state IN ('EXECUTING','RECOVERING'))
-    OR (OLD.state='EXECUTING' AND NEW.state IN ('SETTLING','RECOVERING'))
-    OR (OLD.state='SETTLING' AND NEW.state IN ('RELEASING','RECOVERING'))
-    OR (OLD.state='RELEASING' AND NEW.state IN ('RELEASED','RECOVERING'))
-    OR (OLD.state='RECOVERING' AND NEW.state IN ('RELEASED','RECOVERING'))
-  );
-  SELECT RAISE(ABORT, 'LEASE_MATERIALIZING_REQUIRES_PLAN')
-  WHERE NEW.state='MATERIALIZING' AND (NEW.enforcement_plan_snapshot IS NULL OR json_valid(NEW.enforcement_plan_snapshot)=0);
-  SELECT RAISE(ABORT, 'LEASE_DISPATCH_READY_REQUIRES_DECISION')
-  WHERE NEW.state='DISPATCH_READY' AND NOT EXISTS (
-    SELECT 1 FROM capability_decisions d
-    WHERE d.decision_id = NEW.capability_decision_id
-      AND d.decision='GRANTED' AND d.enforcement_status='ENFORCED'
-      AND d.enforcement_evidence_json IS NOT NULL
-  );
-  SELECT RAISE(ABORT, 'LEASE_RELEASED_REQUIRES_EVIDENCE')
-  WHERE NEW.state='RELEASED' AND (NEW.release_evidence_json IS NULL OR NEW.released_at IS NULL);
-END;
-CREATE TRIGGER IF NOT EXISTS lease_insert_state_guard
-BEFORE INSERT ON execution_leases
-WHEN NEW.state <> 'ACQUIRED'
-BEGIN SELECT RAISE(ABORT, 'LEASE_INSERT_MUST_BE_ACQUIRED'); END;
-CREATE TRIGGER IF NOT EXISTS lease_no_delete
-BEFORE DELETE ON execution_leases
-BEGIN SELECT RAISE(ABORT, 'LEASE_NO_DELETE'); END;
-
-CREATE TABLE IF NOT EXISTS capability_decisions (
-  decision_id              TEXT PRIMARY KEY,
-  kingdom_id               TEXT NOT NULL,
-  task_id                  TEXT NOT NULL,
-  worker_binding_id        TEXT,
-  supervisor_binding_id    TEXT,
-  requirement_snapshot     TEXT,
-  ceiling_snapshot         TEXT,
-  proposed_grant_snapshot  TEXT,
-  scope_snapshot           TEXT,
-  effective_snapshot       TEXT,
-  decision                 TEXT NOT NULL,
-  enforcement_status       TEXT NOT NULL,
-  enforcement_evidence_json TEXT,
-  requirement_coverage     TEXT NOT NULL DEFAULT 'NONE'
-                            CHECK(requirement_coverage IN ('FULL','PARTIAL','NONE')),
-  reason_code              TEXT,
-  execution_id             TEXT,
-  created_at               TEXT NOT NULL,
-  CHECK (
-    (decision = 'GRANTED' AND enforcement_status = 'ENFORCED')
-    OR
-    (decision = 'DENIED' AND enforcement_status IN
-       ('NOT_ATTEMPTED','UNAVAILABLE','FAILED'))
-  ),
-  CHECK (decision <> 'GRANTED' OR
-    (enforcement_evidence_json IS NOT NULL AND json_valid(enforcement_evidence_json)=1))
-);
-CREATE UNIQUE INDEX IF NOT EXISTS capability_decision_execution_uk
-  ON capability_decisions(execution_id) WHERE execution_id IS NOT NULL;
-CREATE TRIGGER IF NOT EXISTS capability_decision_immutable
-BEFORE UPDATE OF kingdom_id, task_id, worker_binding_id, supervisor_binding_id,
-                 requirement_snapshot, ceiling_snapshot, proposed_grant_snapshot,
-                 scope_snapshot, effective_snapshot, decision, enforcement_status,
-                 enforcement_evidence_json, requirement_coverage, reason_code, created_at
-ON capability_decisions
-BEGIN SELECT RAISE(ABORT, 'CAPABILITY_DECISION_IMMUTABLE'); END;
-CREATE TRIGGER IF NOT EXISTS capability_decision_execution_bind
-BEFORE UPDATE OF execution_id
-ON capability_decisions
-WHEN NEW.execution_id IS NOT NULL
-BEGIN
-  SELECT RAISE(ABORT, 'CAPABILITY_DECISION_EXECUTION_ALREADY_BOUND')
-  WHERE OLD.execution_id IS NOT NULL;
-  SELECT RAISE(ABORT, 'CAPABILITY_DECISION_BIND_REQUIRES_GRANTED')
-  WHERE NOT (OLD.decision='GRANTED' AND OLD.enforcement_status='ENFORCED');
-END;
-CREATE TRIGGER IF NOT EXISTS capability_decision_no_delete
-BEFORE DELETE ON capability_decisions
-BEGIN SELECT RAISE(ABORT, 'CAPABILITY_DECISION_NO_DELETE'); END;
+    static V4_LEDGER_SQL = `
+CREATE TABLE IF NOT EXISTS session_territory_affinities (
+  affinity_id       TEXT PRIMARY KEY,
+  kingdom_id        TEXT NOT NULL,
+  worker_binding_id TEXT NOT NULL,
+  runtime_type      TEXT NOT NULL,
+  runtime_instance_ref TEXT NOT NULL,
+  session_ref       TEXT NOT NULL,
+  territory_id      TEXT NOT NULL,
+  established_at    TEXT NOT NULL,
+  retired_at        TEXT,
+  is_current        INTEGER NOT NULL DEFAULT 1,
+  created_at        TEXT NOT NULL,
+  UNIQUE (runtime_type, runtime_instance_ref, session_ref),
+  CHECK (
+    (is_current = 1 AND retired_at IS NULL)
+    OR
+    (is_current = 0 AND retired_at IS NOT NULL)
+  )
+);
+CREATE UNIQUE INDEX IF NOT EXISTS affinity_one_current_per_worker
+  ON session_territory_affinities(kingdom_id, worker_binding_id)
+  WHERE is_current = 1;
+CREATE TRIGGER IF NOT EXISTS affinity_identity_immutable
+BEFORE UPDATE OF kingdom_id, worker_binding_id, runtime_type,
+                 runtime_instance_ref, session_ref, territory_id,
+                 established_at, created_at
+ON session_territory_affinities
+BEGIN SELECT RAISE(ABORT, 'AFFINITY_IDENTITY_IMMUTABLE'); END;
+CREATE TRIGGER IF NOT EXISTS affinity_retire
+BEFORE UPDATE OF is_current, retired_at
+ON session_territory_affinities
+BEGIN
+  SELECT RAISE(ABORT, 'AFFINITY_RETIRE_ONLY_JOINT')
+  WHERE NOT (
+    OLD.is_current = 1 AND OLD.retired_at IS NULL
+    AND NEW.is_current = 0 AND NEW.retired_at IS NOT NULL
+  );
+  SELECT RAISE(ABORT, 'AFFINITY_ALREADY_RETIRED')
+  WHERE OLD.retired_at IS NOT NULL;
+END;
+CREATE TRIGGER IF NOT EXISTS affinity_no_delete
+BEFORE DELETE ON session_territory_affinities
+BEGIN SELECT RAISE(ABORT, 'AFFINITY_NO_DELETE'); END;
+
+CREATE TABLE IF NOT EXISTS execution_leases (
+  lease_id               TEXT PRIMARY KEY,
+  kingdom_id             TEXT NOT NULL,
+  worker_binding_id      TEXT NOT NULL,
+  runtime_type           TEXT NOT NULL,
+  runtime_instance_ref   TEXT NOT NULL,
+  session_ref            TEXT NOT NULL,
+  territory_id           TEXT NOT NULL,
+  task_id                TEXT NOT NULL,
+  attempt_no             INTEGER NOT NULL,
+  state                  TEXT NOT NULL CHECK(state IN
+    ('ACQUIRED','PREPARING','MATERIALIZING','DISPATCH_READY',
+     'EXECUTING','SETTLING','RELEASING','RECOVERING','RELEASED')),
+  capability_decision_id TEXT,
+  enforcement_plan_snapshot TEXT,
+  release_evidence_json  TEXT,
+  release_reason         TEXT,
+  acquired_at            TEXT NOT NULL,
+  released_at            TEXT,
+  updated_at             TEXT NOT NULL,
+  UNIQUE (task_id, attempt_no),
+  UNIQUE (runtime_type, runtime_instance_ref, session_ref, task_id, attempt_no)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS lease_one_active_per_session
+  ON execution_leases(runtime_type, runtime_instance_ref, session_ref)
+  WHERE state <> 'RELEASED';
+CREATE TRIGGER IF NOT EXISTS lease_requires_matching_affinity
+BEFORE INSERT ON execution_leases
+BEGIN
+  SELECT RAISE(ABORT, 'LEASE_REQUIRES_MATCHING_CURRENT_AFFINITY')
+  WHERE NOT EXISTS (
+    SELECT 1
+    FROM session_territory_affinities a
+    JOIN tasks t ON t.task_id = NEW.task_id
+    WHERE a.kingdom_id = NEW.kingdom_id
+      AND a.worker_binding_id = NEW.worker_binding_id
+      AND a.runtime_type = NEW.runtime_type
+      AND a.runtime_instance_ref = NEW.runtime_instance_ref
+      AND a.session_ref = NEW.session_ref
+      AND a.is_current = 1 AND a.retired_at IS NULL
+      AND a.territory_id = NEW.territory_id
+      AND t.territory_id = NEW.territory_id
+  );
+END;
+CREATE TRIGGER IF NOT EXISTS lease_identity_immutable
+BEFORE UPDATE OF kingdom_id, worker_binding_id, runtime_type, runtime_instance_ref,
+                 session_ref, territory_id, task_id, attempt_no, acquired_at
+ON execution_leases
+BEGIN SELECT RAISE(ABORT, 'LEASE_IDENTITY_IMMUTABLE'); END;
+CREATE TRIGGER IF NOT EXISTS lease_plan_once
+BEFORE UPDATE OF enforcement_plan_snapshot
+ON execution_leases
+WHEN OLD.enforcement_plan_snapshot IS NOT NULL
+BEGIN SELECT RAISE(ABORT, 'LEASE_PLAN_ALREADY_SET'); END;
+CREATE TRIGGER IF NOT EXISTS lease_decision_once
+BEFORE UPDATE OF capability_decision_id
+ON execution_leases
+WHEN OLD.capability_decision_id IS NOT NULL
+BEGIN SELECT RAISE(ABORT, 'LEASE_DECISION_ALREADY_BOUND'); END;
+CREATE TRIGGER IF NOT EXISTS lease_release_evidence_once
+BEFORE UPDATE OF release_evidence_json, release_reason
+ON execution_leases
+WHEN OLD.release_evidence_json IS NOT NULL
+BEGIN SELECT RAISE(ABORT, 'LEASE_RELEASE_EVIDENCE_ALREADY_SET'); END;
+CREATE TRIGGER IF NOT EXISTS lease_state_guard
+BEFORE UPDATE OF state ON execution_leases
+WHEN NEW.state <> OLD.state
+BEGIN
+  SELECT RAISE(ABORT, 'ILLEGAL_LEASE_TRANSITION') WHERE NOT (
+    (OLD.state='ACQUIRED' AND NEW.state IN ('PREPARING','RECOVERING'))
+    OR (OLD.state='PREPARING' AND NEW.state IN ('MATERIALIZING','RECOVERING'))
+    OR (OLD.state='MATERIALIZING' AND NEW.state IN ('DISPATCH_READY','RECOVERING','RELEASED'))
+    OR (OLD.state='DISPATCH_READY' AND NEW.state IN ('EXECUTING','RECOVERING'))
+    OR (OLD.state='EXECUTING' AND NEW.state IN ('SETTLING','RECOVERING'))
+    OR (OLD.state='SETTLING' AND NEW.state IN ('RELEASING','RECOVERING'))
+    OR (OLD.state='RELEASING' AND NEW.state IN ('RELEASED','RECOVERING'))
+    OR (OLD.state='RECOVERING' AND NEW.state IN ('RELEASED','RECOVERING'))
+  );
+  SELECT RAISE(ABORT, 'LEASE_MATERIALIZING_REQUIRES_PLAN')
+  WHERE NEW.state='MATERIALIZING' AND (NEW.enforcement_plan_snapshot IS NULL OR json_valid(NEW.enforcement_plan_snapshot)=0);
+  SELECT RAISE(ABORT, 'LEASE_DISPATCH_READY_REQUIRES_DECISION')
+  WHERE NEW.state='DISPATCH_READY' AND NOT EXISTS (
+    SELECT 1 FROM capability_decisions d
+    WHERE d.decision_id = NEW.capability_decision_id
+      AND d.decision='GRANTED' AND d.enforcement_status='ENFORCED'
+      AND d.enforcement_evidence_json IS NOT NULL
+  );
+  SELECT RAISE(ABORT, 'LEASE_RELEASED_REQUIRES_EVIDENCE')
+  WHERE NEW.state='RELEASED' AND (NEW.release_evidence_json IS NULL OR NEW.released_at IS NULL);
+END;
+CREATE TRIGGER IF NOT EXISTS lease_insert_state_guard
+BEFORE INSERT ON execution_leases
+WHEN NEW.state <> 'ACQUIRED'
+BEGIN SELECT RAISE(ABORT, 'LEASE_INSERT_MUST_BE_ACQUIRED'); END;
+CREATE TRIGGER IF NOT EXISTS lease_no_delete
+BEFORE DELETE ON execution_leases
+BEGIN SELECT RAISE(ABORT, 'LEASE_NO_DELETE'); END;
+
+CREATE TABLE IF NOT EXISTS capability_decisions (
+  decision_id              TEXT PRIMARY KEY,
+  kingdom_id               TEXT NOT NULL,
+  task_id                  TEXT NOT NULL,
+  worker_binding_id        TEXT,
+  supervisor_binding_id    TEXT,
+  requirement_snapshot     TEXT,
+  ceiling_snapshot         TEXT,
+  proposed_grant_snapshot  TEXT,
+  scope_snapshot           TEXT,
+  effective_snapshot       TEXT,
+  decision                 TEXT NOT NULL,
+  enforcement_status       TEXT NOT NULL,
+  enforcement_evidence_json TEXT,
+  requirement_coverage     TEXT NOT NULL DEFAULT 'NONE'
+                            CHECK(requirement_coverage IN ('FULL','PARTIAL','NONE')),
+  reason_code              TEXT,
+  execution_id             TEXT,
+  created_at               TEXT NOT NULL,
+  CHECK (
+    (decision = 'GRANTED' AND enforcement_status = 'ENFORCED')
+    OR
+    (decision = 'DENIED' AND enforcement_status IN
+       ('NOT_ATTEMPTED','UNAVAILABLE','FAILED'))
+  ),
+  CHECK (decision <> 'GRANTED' OR
+    (enforcement_evidence_json IS NOT NULL AND json_valid(enforcement_evidence_json)=1))
+);
+CREATE UNIQUE INDEX IF NOT EXISTS capability_decision_execution_uk
+  ON capability_decisions(execution_id) WHERE execution_id IS NOT NULL;
+CREATE TRIGGER IF NOT EXISTS capability_decision_immutable
+BEFORE UPDATE OF kingdom_id, task_id, worker_binding_id, supervisor_binding_id,
+                 requirement_snapshot, ceiling_snapshot, proposed_grant_snapshot,
+                 scope_snapshot, effective_snapshot, decision, enforcement_status,
+                 enforcement_evidence_json, requirement_coverage, reason_code, created_at
+ON capability_decisions
+BEGIN SELECT RAISE(ABORT, 'CAPABILITY_DECISION_IMMUTABLE'); END;
+CREATE TRIGGER IF NOT EXISTS capability_decision_execution_bind
+BEFORE UPDATE OF execution_id
+ON capability_decisions
+WHEN NEW.execution_id IS NOT NULL
+BEGIN
+  SELECT RAISE(ABORT, 'CAPABILITY_DECISION_EXECUTION_ALREADY_BOUND')
+  WHERE OLD.execution_id IS NOT NULL;
+  SELECT RAISE(ABORT, 'CAPABILITY_DECISION_BIND_REQUIRES_GRANTED')
+  WHERE NOT (OLD.decision='GRANTED' AND OLD.enforcement_status='ENFORCED');
+END;
+CREATE TRIGGER IF NOT EXISTS capability_decision_no_delete
+BEFORE DELETE ON capability_decisions
+BEGIN SELECT RAISE(ABORT, 'CAPABILITY_DECISION_NO_DELETE'); END;
 `;
     /**
      * executions 重建形态（暂存名 executions_v4，迁移后 RENAME 回 executions）。
      * = 旧 executions 全部列（含 v2 证据列）+ 新增 3 列（v6 §8.1）。
      */
-    static V4_EXECUTIONS_STAGING_SQL = `
-CREATE TABLE IF NOT EXISTS executions_v4 (
-  execution_id       TEXT PRIMARY KEY,
-  task_id            TEXT NOT NULL,
-  attempt_no         INTEGER NOT NULL,
-  worker_binding_id  TEXT,
-  session_id         TEXT,
-  state              TEXT NOT NULL CHECK(state IN
-    ('STARTING','RUNNING','PAUSED','RECOVERING','COMPLETED','FAILED','ABORTED')),
-  detail             TEXT,
-  started_at         TEXT NOT NULL,
-  heartbeat_at       TEXT,
-  ended_at           TEXT,
-  pause_requested_at TEXT,
-  executor_kind      TEXT,
-  provider           TEXT,
-  provider_source    TEXT,
-  requested_model    TEXT,
-  resolved_model     TEXT,
-  model_source       TEXT,
-  execution_profile_json TEXT,
-  execution_contract TEXT NOT NULL DEFAULT 'LEGACY_COMPAT'
-                       CHECK(execution_contract IN ('LEGACY_COMPAT','GOVERNED_PERSISTENT')),
-  lease_id           TEXT,
-  capability_decision_id TEXT,
-  UNIQUE (task_id, attempt_no),
-  CHECK (
-    execution_contract = 'LEGACY_COMPAT'
-    OR (
-      execution_contract = 'GOVERNED_PERSISTENT'
-      AND lease_id IS NOT NULL
-      AND capability_decision_id IS NOT NULL
-    )
-  ),
-  FOREIGN KEY (lease_id) REFERENCES execution_leases(lease_id),
-  FOREIGN KEY (capability_decision_id) REFERENCES capability_decisions(decision_id)
-);
+    static V4_EXECUTIONS_STAGING_SQL = `
+CREATE TABLE IF NOT EXISTS executions_v4 (
+  execution_id       TEXT PRIMARY KEY,
+  task_id            TEXT NOT NULL,
+  attempt_no         INTEGER NOT NULL,
+  worker_binding_id  TEXT,
+  session_id         TEXT,
+  state              TEXT NOT NULL CHECK(state IN
+    ('STARTING','RUNNING','PAUSED','RECOVERING','COMPLETED','FAILED','ABORTED')),
+  detail             TEXT,
+  started_at         TEXT NOT NULL,
+  heartbeat_at       TEXT,
+  ended_at           TEXT,
+  pause_requested_at TEXT,
+  executor_kind      TEXT,
+  provider           TEXT,
+  provider_source    TEXT,
+  requested_model    TEXT,
+  resolved_model     TEXT,
+  model_source       TEXT,
+  execution_profile_json TEXT,
+  execution_contract TEXT NOT NULL DEFAULT 'LEGACY_COMPAT'
+                       CHECK(execution_contract IN ('LEGACY_COMPAT','GOVERNED_PERSISTENT')),
+  lease_id           TEXT,
+  capability_decision_id TEXT,
+  UNIQUE (task_id, attempt_no),
+  CHECK (
+    execution_contract = 'LEGACY_COMPAT'
+    OR (
+      execution_contract = 'GOVERNED_PERSISTENT'
+      AND lease_id IS NOT NULL
+      AND capability_decision_id IS NOT NULL
+    )
+  ),
+  FOREIGN KEY (lease_id) REFERENCES execution_leases(lease_id),
+  FOREIGN KEY (capability_decision_id) REFERENCES capability_decisions(decision_id)
+);
 `;
     /** executions 重建后的 trigger（RENAME 回 executions 之后创建；不依赖 RENAME 自动改写）。 */
-    static V4_EXECUTIONS_TRIGGERS_SQL = `
-CREATE TRIGGER IF NOT EXISTS execution_governed_consistency
-BEFORE INSERT ON executions
-WHEN NEW.execution_contract = 'GOVERNED_PERSISTENT'
-BEGIN
-  SELECT RAISE(ABORT, 'EXECUTION_GOVERNED_REQUIRES_MATCHING_LEASE')
-  WHERE NOT EXISTS (
-    SELECT 1
-    FROM execution_leases l
-    JOIN capability_decisions d ON d.decision_id = NEW.capability_decision_id
-    WHERE l.lease_id = NEW.lease_id
-      AND l.task_id = NEW.task_id
-      AND l.attempt_no = NEW.attempt_no
-      AND l.capability_decision_id = NEW.capability_decision_id
-      AND l.kingdom_id = d.kingdom_id
-      AND d.task_id = NEW.task_id
-      AND d.decision='GRANTED' AND d.enforcement_status='ENFORCED'
-      AND (d.execution_id IS NULL OR d.execution_id = NEW.execution_id)
-  );
-END;
-CREATE TRIGGER IF NOT EXISTS execution_contract_immutable
-BEFORE UPDATE OF execution_contract ON executions
-BEGIN SELECT RAISE(ABORT, 'EXECUTION_CONTRACT_IMMUTABLE'); END;
+    static V4_EXECUTIONS_TRIGGERS_SQL = `
+CREATE TRIGGER IF NOT EXISTS execution_governed_consistency
+BEFORE INSERT ON executions
+WHEN NEW.execution_contract = 'GOVERNED_PERSISTENT'
+BEGIN
+  SELECT RAISE(ABORT, 'EXECUTION_GOVERNED_REQUIRES_MATCHING_LEASE')
+  WHERE NOT EXISTS (
+    SELECT 1
+    FROM execution_leases l
+    JOIN capability_decisions d ON d.decision_id = NEW.capability_decision_id
+    WHERE l.lease_id = NEW.lease_id
+      AND l.task_id = NEW.task_id
+      AND l.attempt_no = NEW.attempt_no
+      AND l.capability_decision_id = NEW.capability_decision_id
+      AND l.kingdom_id = d.kingdom_id
+      AND d.task_id = NEW.task_id
+      AND d.decision='GRANTED' AND d.enforcement_status='ENFORCED'
+      AND (d.execution_id IS NULL OR d.execution_id = NEW.execution_id)
+  );
+END;
+CREATE TRIGGER IF NOT EXISTS execution_contract_immutable
+BEFORE UPDATE OF execution_contract ON executions
+BEGIN SELECT RAISE(ABORT, 'EXECUTION_CONTRACT_IMMUTABLE'); END;
 `;
     /** Dispatch Ledger（executions 重建完成后创建；FK 直接指向最终名 executions）。 */
-    static V4_DISPATCH_SQL = `
-CREATE TABLE IF NOT EXISTS dispatch_records (
-  dispatch_id          TEXT PRIMARY KEY,
-  kingdom_id           TEXT NOT NULL,
-  lease_id             TEXT NOT NULL,
-  execution_id         TEXT NOT NULL,
-  task_id              TEXT NOT NULL,
-  attempt_no           INTEGER NOT NULL,
-  runtime_type         TEXT NOT NULL,
-  runtime_instance_ref TEXT NOT NULL,
-  session_ref          TEXT NOT NULL,
-  state                TEXT NOT NULL CHECK(state IN
-    ('INTENDED','DISPATCHED','RECEIVED','CORRELATED','TERMINAL','FAILED','RECOVERING')),
-  dispatch_request_snapshot TEXT NOT NULL,
-  dispatch_input_ref_json  TEXT NOT NULL,
-  dispatch_payload_hash    TEXT NOT NULL,
-  runtime_dispatch_ref  TEXT,
-  runtime_execution_ref TEXT,
-  receipt_json          TEXT,
-  terminal_evidence_json TEXT,
-  output_ref_json       TEXT,
-  dispatched_at         TEXT,
-  receipt_at            TEXT,
-  terminal_at           TEXT,
-  created_at            TEXT NOT NULL,
-  updated_at            TEXT NOT NULL,
-  FOREIGN KEY (lease_id) REFERENCES execution_leases(lease_id),
-  FOREIGN KEY (execution_id) REFERENCES executions(execution_id),
-  UNIQUE (lease_id),
-  UNIQUE (execution_id)
-);
-CREATE TRIGGER IF NOT EXISTS dispatch_request_immutable
-BEFORE UPDATE OF dispatch_id, kingdom_id, lease_id, execution_id, task_id, attempt_no,
-                 runtime_type, runtime_instance_ref, session_ref,
-                 dispatch_request_snapshot, dispatch_input_ref_json, dispatch_payload_hash,
-                 created_at
-ON dispatch_records
-BEGIN SELECT RAISE(ABORT, 'DISPATCH_REQUEST_IMMUTABLE'); END;
-CREATE TRIGGER IF NOT EXISTS dispatch_requires_ready_lease
-BEFORE INSERT ON dispatch_records
-BEGIN
-  SELECT RAISE(ABORT, 'DISPATCH_REQUIRES_MATCHING_READY_LEASE')
-  WHERE NOT EXISTS (
-    SELECT 1
-    FROM execution_leases l
-    JOIN executions e ON e.execution_id = NEW.execution_id
-    WHERE l.lease_id = NEW.lease_id
-      AND l.state = 'DISPATCH_READY'
-      AND l.kingdom_id = NEW.kingdom_id
-      AND l.task_id = NEW.task_id
-      AND l.attempt_no = NEW.attempt_no
-      AND l.runtime_type = NEW.runtime_type
-      AND l.runtime_instance_ref = NEW.runtime_instance_ref
-      AND l.session_ref = NEW.session_ref
-      AND e.task_id = NEW.task_id
-      AND e.attempt_no = NEW.attempt_no
-  );
-END;
-CREATE TRIGGER IF NOT EXISTS dispatch_state_guard
-BEFORE UPDATE OF state ON dispatch_records
-WHEN NEW.state <> OLD.state
-BEGIN
-  SELECT RAISE(ABORT, 'ILLEGAL_DISPATCH_TRANSITION') WHERE NOT (
-    (OLD.state='INTENDED' AND NEW.state IN ('DISPATCHED','FAILED','RECOVERING'))
-    OR (OLD.state='DISPATCHED' AND NEW.state IN ('RECEIVED','RECOVERING'))
-    OR (OLD.state='RECEIVED' AND NEW.state IN ('CORRELATED','RECOVERING'))
-    OR (OLD.state='CORRELATED' AND NEW.state IN ('TERMINAL','RECOVERING'))
-    OR (OLD.state='RECOVERING' AND NEW.state IN ('TERMINAL','FAILED','RECOVERING'))
-  );
-  SELECT RAISE(ABORT, 'DISPATCH_RECEIVED_REQUIRES_REF_RECEIPT')
-  WHERE NEW.state='RECEIVED' AND (NEW.runtime_dispatch_ref IS NULL OR NEW.receipt_json IS NULL OR NEW.receipt_at IS NULL);
-  SELECT RAISE(ABORT, 'DISPATCH_CORRELATED_REQUIRES_EXEC_REF')
-  WHERE NEW.state='CORRELATED' AND NEW.runtime_execution_ref IS NULL;
-  SELECT RAISE(ABORT, 'DISPATCH_TERMINAL_REQUIRES_EVIDENCE')
-  WHERE NEW.state='TERMINAL' AND (NEW.terminal_evidence_json IS NULL OR NEW.terminal_at IS NULL);
-END;
-CREATE TRIGGER IF NOT EXISTS dispatch_insert_state_guard
-BEFORE INSERT ON dispatch_records
-WHEN NEW.state <> 'INTENDED'
-BEGIN SELECT RAISE(ABORT, 'DISPATCH_INSERT_MUST_BE_INTENDED'); END;
-CREATE TRIGGER IF NOT EXISTS dispatch_no_delete
-BEFORE DELETE ON dispatch_records
-BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
+    static V4_DISPATCH_SQL = `
+CREATE TABLE IF NOT EXISTS dispatch_records (
+  dispatch_id          TEXT PRIMARY KEY,
+  kingdom_id           TEXT NOT NULL,
+  lease_id             TEXT NOT NULL,
+  execution_id         TEXT NOT NULL,
+  task_id              TEXT NOT NULL,
+  attempt_no           INTEGER NOT NULL,
+  runtime_type         TEXT NOT NULL,
+  runtime_instance_ref TEXT NOT NULL,
+  session_ref          TEXT NOT NULL,
+  state                TEXT NOT NULL CHECK(state IN
+    ('INTENDED','DISPATCHED','RECEIVED','CORRELATED','TERMINAL','FAILED','RECOVERING')),
+  dispatch_request_snapshot TEXT NOT NULL,
+  dispatch_input_ref_json  TEXT NOT NULL,
+  dispatch_payload_hash    TEXT NOT NULL,
+  runtime_dispatch_ref  TEXT,
+  runtime_execution_ref TEXT,
+  receipt_json          TEXT,
+  terminal_evidence_json TEXT,
+  output_ref_json       TEXT,
+  dispatched_at         TEXT,
+  receipt_at            TEXT,
+  terminal_at           TEXT,
+  created_at            TEXT NOT NULL,
+  updated_at            TEXT NOT NULL,
+  FOREIGN KEY (lease_id) REFERENCES execution_leases(lease_id),
+  FOREIGN KEY (execution_id) REFERENCES executions(execution_id),
+  UNIQUE (lease_id),
+  UNIQUE (execution_id)
+);
+CREATE TRIGGER IF NOT EXISTS dispatch_request_immutable
+BEFORE UPDATE OF dispatch_id, kingdom_id, lease_id, execution_id, task_id, attempt_no,
+                 runtime_type, runtime_instance_ref, session_ref,
+                 dispatch_request_snapshot, dispatch_input_ref_json, dispatch_payload_hash,
+                 created_at
+ON dispatch_records
+BEGIN SELECT RAISE(ABORT, 'DISPATCH_REQUEST_IMMUTABLE'); END;
+CREATE TRIGGER IF NOT EXISTS dispatch_requires_ready_lease
+BEFORE INSERT ON dispatch_records
+BEGIN
+  SELECT RAISE(ABORT, 'DISPATCH_REQUIRES_MATCHING_READY_LEASE')
+  WHERE NOT EXISTS (
+    SELECT 1
+    FROM execution_leases l
+    JOIN executions e ON e.execution_id = NEW.execution_id
+    WHERE l.lease_id = NEW.lease_id
+      AND l.state = 'DISPATCH_READY'
+      AND l.kingdom_id = NEW.kingdom_id
+      AND l.task_id = NEW.task_id
+      AND l.attempt_no = NEW.attempt_no
+      AND l.runtime_type = NEW.runtime_type
+      AND l.runtime_instance_ref = NEW.runtime_instance_ref
+      AND l.session_ref = NEW.session_ref
+      AND e.task_id = NEW.task_id
+      AND e.attempt_no = NEW.attempt_no
+  );
+END;
+CREATE TRIGGER IF NOT EXISTS dispatch_state_guard
+BEFORE UPDATE OF state ON dispatch_records
+WHEN NEW.state <> OLD.state
+BEGIN
+  SELECT RAISE(ABORT, 'ILLEGAL_DISPATCH_TRANSITION') WHERE NOT (
+    (OLD.state='INTENDED' AND NEW.state IN ('DISPATCHED','FAILED','RECOVERING'))
+    OR (OLD.state='DISPATCHED' AND NEW.state IN ('RECEIVED','RECOVERING'))
+    OR (OLD.state='RECEIVED' AND NEW.state IN ('CORRELATED','RECOVERING'))
+    OR (OLD.state='CORRELATED' AND NEW.state IN ('TERMINAL','RECOVERING'))
+    OR (OLD.state='RECOVERING' AND NEW.state IN ('TERMINAL','FAILED','RECOVERING'))
+  );
+  SELECT RAISE(ABORT, 'DISPATCH_RECEIVED_REQUIRES_REF_RECEIPT')
+  WHERE NEW.state='RECEIVED' AND (NEW.runtime_dispatch_ref IS NULL OR NEW.receipt_json IS NULL OR NEW.receipt_at IS NULL);
+  SELECT RAISE(ABORT, 'DISPATCH_CORRELATED_REQUIRES_EXEC_REF')
+  WHERE NEW.state='CORRELATED' AND NEW.runtime_execution_ref IS NULL;
+  SELECT RAISE(ABORT, 'DISPATCH_TERMINAL_REQUIRES_EVIDENCE')
+  WHERE NEW.state='TERMINAL' AND (NEW.terminal_evidence_json IS NULL OR NEW.terminal_at IS NULL);
+END;
+CREATE TRIGGER IF NOT EXISTS dispatch_insert_state_guard
+BEFORE INSERT ON dispatch_records
+WHEN NEW.state <> 'INTENDED'
+BEGIN SELECT RAISE(ABORT, 'DISPATCH_INSERT_MUST_BE_INTENDED'); END;
+CREATE TRIGGER IF NOT EXISTS dispatch_no_delete
+BEFORE DELETE ON dispatch_records
+BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
 `;
     /** v4 对象是否已存在（execution_leases 表是 v4 迁移完成的地标）。 */
     hasV4Objects() {
@@ -771,20 +776,20 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
             this.db.exec(KingdomStore.V4_LEDGER_SQL);
             // c. executions 重建：暂存表 → 复制（LEGACY_COMPAT backfill）→ 行数校验
             this.db.exec(KingdomStore.V4_EXECUTIONS_STAGING_SQL);
-            this.db.exec(`
-        INSERT INTO executions_v4
-          (execution_id, task_id, attempt_no, worker_binding_id, session_id, state,
-           detail, started_at, heartbeat_at, ended_at, pause_requested_at,
-           executor_kind, provider, provider_source, requested_model, resolved_model,
-           model_source, execution_profile_json,
-           execution_contract, lease_id, capability_decision_id)
-        SELECT
-           execution_id, task_id, attempt_no, worker_binding_id, session_id, state,
-           detail, started_at, heartbeat_at, ended_at, pause_requested_at,
-           executor_kind, provider, provider_source, requested_model, resolved_model,
-           model_source, execution_profile_json,
-           'LEGACY_COMPAT', NULL, NULL
-        FROM executions
+            this.db.exec(`
+        INSERT INTO executions_v4
+          (execution_id, task_id, attempt_no, worker_binding_id, session_id, state,
+           detail, started_at, heartbeat_at, ended_at, pause_requested_at,
+           executor_kind, provider, provider_source, requested_model, resolved_model,
+           model_source, execution_profile_json,
+           execution_contract, lease_id, capability_decision_id)
+        SELECT
+           execution_id, task_id, attempt_no, worker_binding_id, session_id, state,
+           detail, started_at, heartbeat_at, ended_at, pause_requested_at,
+           executor_kind, provider, provider_source, requested_model, resolved_model,
+           model_source, execution_profile_json,
+           'LEGACY_COMPAT', NULL, NULL
+        FROM executions
       `);
             const oldCount = this.db.prepare('SELECT COUNT(*) AS n FROM executions').get();
             const newCount = this.db.prepare('SELECT COUNT(*) AS n FROM executions_v4').get();
@@ -895,7 +900,7 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
             ...row,
         };
         this.db
-            .prepare(`INSERT INTO kingdoms (kingdom_id, name, created_at, owner_id, owner_name, schema_version)
+            .prepare(`INSERT INTO kingdoms (kingdom_id, name, created_at, owner_id, owner_name, schema_version)
          VALUES (?, ?, ?, ?, ?, ?)`)
             .run(full.kingdom_id, full.name, full.created_at, full.owner_id, full.owner_name, full.schema_version);
         return full;
@@ -921,8 +926,8 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
     }
     insertTerritory(row) {
         this.db
-            .prepare(`INSERT INTO territories
-           (territory_id, kingdom_id, name, workspace_path, summary, supervisor_binding_id, status, created_at)
+            .prepare(`INSERT INTO territories
+           (territory_id, kingdom_id, name, workspace_path, summary, supervisor_binding_id, status, created_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
             .run(row.territory_id, row.kingdom_id, row.name, row.workspace_path, row.summary, row.supervisor_binding_id, row.status, row.created_at);
         return row;
@@ -958,16 +963,16 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
     }
     /** Owner topology guards include RECOVERING and unknown future nonterminal states. */
     listUnsettledOwnerExecutions(kingdomId) {
-        return this.db.prepare(`SELECT e.* FROM executions e JOIN tasks t ON t.task_id = e.task_id
-      JOIN territories te ON te.territory_id = t.territory_id WHERE te.kingdom_id = ?
+        return this.db.prepare(`SELECT e.* FROM executions e JOIN tasks t ON t.task_id = e.task_id
+      JOIN territories te ON te.territory_id = t.territory_id WHERE te.kingdom_id = ?
       AND e.state NOT IN ('COMPLETED', 'FAILED', 'ABORTED') ORDER BY e.started_at`).all(kingdomId);
     }
     // ── task_assignments（v0.7.0 M2-B Assignment Ledger）──────────
     insertTaskAssignment(row) {
         this.db
-            .prepare(`INSERT INTO task_assignments
-           (assignment_id, task_id, territory_id, worker_binding_id, assigned_by, assigned_at,
-            ended_at, end_reason, previous_assignment_id, handoff_reason, created_at)
+            .prepare(`INSERT INTO task_assignments
+           (assignment_id, task_id, territory_id, worker_binding_id, assigned_by, assigned_at,
+            ended_at, end_reason, previous_assignment_id, handoff_reason, created_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
             .run(row.assignment_id, row.task_id, row.territory_id, row.worker_binding_id, row.assigned_by, row.assigned_at, row.ended_at, row.end_reason, row.previous_assignment_id, row.handoff_reason, row.created_at);
         return row;
@@ -1036,10 +1041,10 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
     }
     insertBinding(row) {
         this.db
-            .prepare(`INSERT INTO role_bindings
-           (binding_id, kingdom_id, role_type, role_name, runtime_type,
-            session_id, model_name, agent_name, session_meta, execution_profile_json,
-            status, retired_at, retired_reason, principal_id, created_at, updated_at)
+            .prepare(`INSERT INTO role_bindings
+           (binding_id, kingdom_id, role_type, role_name, runtime_type,
+            session_id, model_name, agent_name, session_meta, execution_profile_json,
+            status, retired_at, retired_reason, principal_id, created_at, updated_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
             .run(row.binding_id, row.kingdom_id, row.role_type, row.role_name, row.runtime_type, row.session_id, row.model_name ?? null, row.agent_name ?? null, row.session_meta ?? null, row.execution_profile_json ?? null, row.status ?? 'ACTIVE', row.retired_at ?? null, row.retired_reason ?? null, row.principal_id, row.created_at, row.updated_at);
         return row;
@@ -1108,8 +1113,8 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
      */
     listDispatchesForTaskAttempt(taskId, attemptNo) {
         return this.db
-            .prepare(`SELECT * FROM dispatch_records
-           WHERE task_id = ? AND attempt_no = ?
+            .prepare(`SELECT * FROM dispatch_records
+           WHERE task_id = ? AND attempt_no = ?
            ORDER BY created_at ASC`)
             .all(taskId, attemptNo);
     }
@@ -1129,11 +1134,11 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
             || dispatch.attempt_no !== attemptNo)
             return null;
         const rows = this.db
-            .prepare(`SELECT * FROM events
-           WHERE kingdom_id = ?
-             AND event_type = 'DISPATCH_TERMINAL_INTEGRITY_INCIDENT'
-             AND target_type = 'dispatch'
-             AND target_id = ?
+            .prepare(`SELECT * FROM events
+           WHERE kingdom_id = ?
+             AND event_type = 'DISPATCH_TERMINAL_INTEGRITY_INCIDENT'
+             AND target_type = 'dispatch'
+             AND target_id = ?
            ORDER BY seq ASC`)
             .all(kingdomId, dispatchId);
         for (const row of rows) {
@@ -1165,13 +1170,13 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
     }
     /** Observations and future admission/window policy cannot change an in-flight Runner relation. */
     runnerContextRevision(kingdomId, scope) {
-        const rows = this.db.prepare(`SELECT * FROM events
-      WHERE kingdom_id = ? AND event_type NOT IN (
-        'RUNTIME_ROLE_USAGE_OBSERVED', 'RUNTIME_PROMPT_COST_OBSERVED', 'DISPATCH_USAGE_OBSERVED',
-        'BUDGET_POLICY_UPDATED', 'BUDGET_ADMISSION_RESERVED', 'BUDGET_ADMISSION_BOUND', 'BUDGET_ADMISSION_CANCELLED',
-        'OWNER_DECISION_CREATED', 'OWNER_DECISION_REVOKED', 'OWNER_DECISION_CONSUMED'
-      ) AND NOT (event_type = 'OWNER_OPERATION_APPLIED' AND COALESCE(
-        CASE WHEN json_valid(payload_json) THEN json_extract(payload_json, '$.action') = 'budget.policy' ELSE 0 END, 0
+        const rows = this.db.prepare(`SELECT * FROM events
+      WHERE kingdom_id = ? AND event_type NOT IN (
+        'RUNTIME_ROLE_USAGE_OBSERVED', 'RUNTIME_PROMPT_COST_OBSERVED', 'DISPATCH_USAGE_OBSERVED',
+        'BUDGET_POLICY_UPDATED', 'BUDGET_ADMISSION_RESERVED', 'BUDGET_ADMISSION_BOUND', 'BUDGET_ADMISSION_CANCELLED',
+        'OWNER_DECISION_CREATED', 'OWNER_DECISION_REVOKED', 'OWNER_DECISION_CONSUMED'
+      ) AND NOT (event_type = 'OWNER_OPERATION_APPLIED' AND COALESCE(
+        CASE WHEN json_valid(payload_json) THEN json_extract(payload_json, '$.action') = 'budget.policy' ELSE 0 END, 0
       )) ORDER BY seq DESC`).all(kingdomId);
         if (!scope)
             return rows[0]?.seq ?? 0;
@@ -1233,9 +1238,37 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
     /**
      * v0.7.0（M2）：外层事务包装——HANDOFF 等**原子治理操作**（多步写 + 事件）整体提交/回滚。
      * appendEvent 的内层 BEGIN 在事务中会抛错，由 appendEvent 的嵌套容忍逻辑接管（见下）。
+     *
+     * v3.2.0：**支持真正的嵌套**。直接 Slash 的 ownerWrite 与 Owner GUI 窗口的 apply 各自已经开了
+     * 一层事务，而领域函数（如「建主管席位 + 设领地主理」）还要求自己的原子边界：
+     * - 外层：`BEGIN IMMEDIATE` / `COMMIT` / `ROLLBACK`；
+     * - 内层：`SAVEPOINT` / `RELEASE` / `ROLLBACK TO`——**内层失败只回滚内层写入**，
+     *   异常照常向上抛（若无人接管，最外层仍会整体 ROLLBACK）。
+     * 这一点是必须的：如果内层只是"加入外层"，那么内层捕获异常并返回错误文案时，
+     * 它已经写下的行会留在外层事务里被 COMMIT，原子性就名存实亡。
+     * 用自持深度计数（而非"BEGIN 失败即视为嵌套"）避免把真正的加锁失败误判成嵌套。
      */
     withImmediateTransaction(fn) {
+        if (this.transactionDepth > 0) {
+            const savepoint = `kingdom_nested_${this.transactionDepth}`;
+            this.db.exec(`SAVEPOINT ${savepoint}`);
+            this.transactionDepth += 1;
+            try {
+                const result = fn();
+                this.db.exec(`RELEASE ${savepoint}`);
+                return result;
+            }
+            catch (error) {
+                this.db.exec(`ROLLBACK TO ${savepoint}`);
+                this.db.exec(`RELEASE ${savepoint}`);
+                throw error;
+            }
+            finally {
+                this.transactionDepth -= 1;
+            }
+        }
         this.db.exec('BEGIN IMMEDIATE');
+        this.transactionDepth += 1;
         try {
             const result = fn();
             this.db.exec('COMMIT');
@@ -1245,6 +1278,9 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
             this.db.exec('ROLLBACK');
             throw error;
         }
+        finally {
+            this.transactionDepth -= 1;
+        }
     }
     /**
      * 追加事件并分配单调 seq。
@@ -1269,8 +1305,8 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
                 .get();
             const seq = (next?.n ?? 0) + 1;
             this.db
-                .prepare(`INSERT INTO events
-             (event_id, kingdom_id, event_type, actor_role, actor_id, target_type, target_id, payload_json, created_at, seq)
+                .prepare(`INSERT INTO events
+             (event_id, kingdom_id, event_type, actor_role, actor_id, target_type, target_id, payload_json, created_at, seq)
            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
                 .run(row.event_id, row.kingdom_id, row.event_type, row.actor_role, row.actor_id, row.target_type, row.target_id, row.payload_json, row.created_at, seq);
             if (!outer)
@@ -1306,9 +1342,9 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
             params.push(filter.status);
         }
         return this.db
-            .prepare(`SELECT t.* FROM tasks t
-           JOIN territories te ON te.territory_id = t.territory_id
-          WHERE ${clauses.join(' AND ')}
+            .prepare(`SELECT t.* FROM tasks t
+           JOIN territories te ON te.territory_id = t.territory_id
+          WHERE ${clauses.join(' AND ')}
           ORDER BY t.created_at`)
             .all(...params);
     }
@@ -1323,9 +1359,9 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
         const columns = hasRequirementColumn ? ', capability_requirement_json' : '';
         const values = hasRequirementColumn ? ', ?' : '';
         this.db
-            .prepare(`INSERT INTO tasks
-           (task_id, territory_id, parent_task_id, title, description, assigned_binding_id,
-             status, acceptance_criteria, result_summary, created_at, updated_at${columns})
+            .prepare(`INSERT INTO tasks
+           (task_id, territory_id, parent_task_id, title, description, assigned_binding_id,
+             status, acceptance_criteria, result_summary, created_at, updated_at${columns})
           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?${values})`)
             .run(row.task_id, row.territory_id, row.parent_task_id, row.title, row.description, row.assigned_binding_id, row.status, row.acceptance_criteria, row.result_summary, row.created_at, row.updated_at, ...(hasRequirementColumn ? [row.capability_requirement_json ?? null] : []));
         return row;
@@ -1351,7 +1387,7 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
             : patch.assigned_binding_id;
         const summary = patch.result_summary === undefined ? task.result_summary : patch.result_summary;
         this.db
-            .prepare(`UPDATE tasks SET status = ?, assigned_binding_id = ?, result_summary = ?, updated_at = ?
+            .prepare(`UPDATE tasks SET status = ?, assigned_binding_id = ?, result_summary = ?, updated_at = ?
           WHERE task_id = ?`)
             .run(next, assigned, summary, now, task.task_id);
         return { ...task, status: next, assigned_binding_id: assigned, result_summary: summary, updated_at: now };
@@ -1387,17 +1423,17 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
     }
     /** Complete exact budget ledger; display event windows must never be used as accounting history. */
     listBudgetEvents(kingdomId) {
-        return this.db.prepare(`SELECT * FROM events WHERE kingdom_id = ? AND event_type IN
-      ('BUDGET_POLICY_UPDATED', 'BUDGET_ADMISSION_RESERVED', 'BUDGET_ADMISSION_BOUND', 'BUDGET_ADMISSION_CANCELLED', 'DISPATCH_INTENDED')
+        return this.db.prepare(`SELECT * FROM events WHERE kingdom_id = ? AND event_type IN
+      ('BUDGET_POLICY_UPDATED', 'BUDGET_ADMISSION_RESERVED', 'BUDGET_ADMISSION_BOUND', 'BUDGET_ADMISSION_CANCELLED', 'DISPATCH_INTENDED')
       ORDER BY seq ASC`).all(kingdomId);
     }
     listWorkspaceAdmissionEvents(kingdomId) {
-        return this.db.prepare(`SELECT * FROM events WHERE kingdom_id = ? AND event_type IN
-      ('WORKSPACE_ADMISSION_RESERVED', 'WORKSPACE_ADMISSION_BOUND', 'WORKSPACE_ADMISSION_CANCELLED')
+        return this.db.prepare(`SELECT * FROM events WHERE kingdom_id = ? AND event_type IN
+      ('WORKSPACE_ADMISSION_RESERVED', 'WORKSPACE_ADMISSION_BOUND', 'WORKSPACE_ADMISSION_CANCELLED')
       ORDER BY seq ASC`).all(kingdomId);
     }
     listRuntimeCostEvents(kingdomId) {
-        return this.db.prepare(`SELECT * FROM events WHERE kingdom_id = ? AND event_type IN
+        return this.db.prepare(`SELECT * FROM events WHERE kingdom_id = ? AND event_type IN
       ('RUNTIME_ROLE_USAGE_OBSERVED', 'RUNTIME_PROMPT_COST_OBSERVED') ORDER BY seq ASC`).all(kingdomId);
     }
     listActorEventsSince(kingdomId, actorId, afterSeq) {
@@ -1435,8 +1471,8 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
     }
     insertWorkerResult(row) {
         this.db
-            .prepare(`INSERT INTO worker_results
-           (result_id, task_id, attempt_no, worker_binding_id, session_id, outcome, result_json, created_at)
+            .prepare(`INSERT INTO worker_results
+           (result_id, task_id, attempt_no, worker_binding_id, session_id, outcome, result_json, created_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
             .run(row.result_id, row.task_id, row.attempt_no, row.worker_binding_id, row.session_id, row.outcome, row.result_json, row.created_at);
         return row;
@@ -1462,21 +1498,21 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
     /** 王国内所有未终结的 Execution（人物应当在场的那些）。 */
     listLiveExecutions(kingdomId) {
         return this.db
-            .prepare(`SELECT e.* FROM executions e
-           JOIN tasks t      ON t.task_id = e.task_id
-           JOIN territories te ON te.territory_id = t.territory_id
-          WHERE te.kingdom_id = ?
-            AND e.state IN ('STARTING', 'RUNNING', 'PAUSED')
+            .prepare(`SELECT e.* FROM executions e
+           JOIN tasks t      ON t.task_id = e.task_id
+           JOIN territories te ON te.territory_id = t.territory_id
+          WHERE te.kingdom_id = ?
+            AND e.state IN ('STARTING', 'RUNNING', 'PAUSED')
           ORDER BY e.started_at`)
             .all(kingdomId);
     }
     insertExecution(row) {
         this.db
-            .prepare(`INSERT INTO executions
-           (execution_id, task_id, attempt_no, worker_binding_id, session_id, state, detail,
-            started_at, heartbeat_at, ended_at, pause_requested_at,
-            executor_kind, provider, provider_source, requested_model, resolved_model, model_source,
-            execution_profile_json, execution_contract, lease_id, capability_decision_id)
+            .prepare(`INSERT INTO executions
+           (execution_id, task_id, attempt_no, worker_binding_id, session_id, state, detail,
+            started_at, heartbeat_at, ended_at, pause_requested_at,
+            executor_kind, provider, provider_source, requested_model, resolved_model, model_source,
+            execution_profile_json, execution_contract, lease_id, capability_decision_id)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
             .run(row.execution_id, row.task_id, row.attempt_no, row.worker_binding_id, row.session_id, row.state, row.detail, row.started_at, row.heartbeat_at, row.ended_at, row.pause_requested_at, row.executor_kind, row.provider, row.provider_source, row.requested_model, row.resolved_model, row.model_source, row.execution_profile_json, row.execution_contract ?? 'LEGACY_COMPAT', row.lease_id ?? null, row.capability_decision_id ?? null);
         return row;
@@ -1509,8 +1545,8 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
             ? execution.pause_requested_at
             : patch.pauseRequestedAt;
         this.db
-            .prepare(`UPDATE executions
-            SET state = ?, detail = ?, session_id = ?, heartbeat_at = ?, ended_at = ?, pause_requested_at = ?
+            .prepare(`UPDATE executions
+            SET state = ?, detail = ?, session_id = ?, heartbeat_at = ?, ended_at = ?, pause_requested_at = ?
           WHERE execution_id = ?`)
             .run(next, detail, sessionId, now, ended, pauseRequestedAt, execution.execution_id);
         return {
@@ -1533,9 +1569,9 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
     // session_territory_affinities ────────────────────────────────
     insertAffinity(row) {
         this.db
-            .prepare(`INSERT INTO session_territory_affinities
-           (affinity_id, kingdom_id, worker_binding_id, runtime_type, runtime_instance_ref,
-            session_ref, territory_id, established_at, retired_at, is_current, created_at)
+            .prepare(`INSERT INTO session_territory_affinities
+           (affinity_id, kingdom_id, worker_binding_id, runtime_type, runtime_instance_ref,
+            session_ref, territory_id, established_at, retired_at, is_current, created_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
             .run(row.affinity_id, row.kingdom_id, row.worker_binding_id, row.runtime_type, row.runtime_instance_ref, row.session_ref, row.territory_id, row.established_at, row.retired_at ?? null, row.is_current ?? 1, row.created_at);
         return row;
@@ -1546,7 +1582,7 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
     }
     getAffinityBySession(session) {
         const rows = this.db
-            .prepare(`SELECT * FROM session_territory_affinities
+            .prepare(`SELECT * FROM session_territory_affinities
                  WHERE runtime_type = ? AND runtime_instance_ref = ? AND session_ref = ?`)
             .all(session.runtimeType, session.runtimeInstanceRef, session.sessionRef);
         return rows[0] ?? null;
@@ -1559,7 +1595,7 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
     /** Worker 当前（未退役）Affinity；DB 部分唯一索引保证至多一条。 */
     getCurrentAffinityForWorker(kingdomId, workerBindingId) {
         const rows = this.db
-            .prepare(`SELECT * FROM session_territory_affinities
+            .prepare(`SELECT * FROM session_territory_affinities
                  WHERE kingdom_id = ? AND worker_binding_id = ? AND is_current = 1 LIMIT 1`)
             .all(kingdomId, workerBindingId);
         return rows[0] ?? null;
@@ -1577,11 +1613,11 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
     // execution_leases ────────────────────────────────────────────
     insertLease(row) {
         this.db
-            .prepare(`INSERT INTO execution_leases
-           (lease_id, kingdom_id, worker_binding_id, runtime_type, runtime_instance_ref,
-            session_ref, territory_id, task_id, attempt_no, state,
-            capability_decision_id, enforcement_plan_snapshot, release_evidence_json, release_reason,
-            acquired_at, released_at, updated_at)
+            .prepare(`INSERT INTO execution_leases
+           (lease_id, kingdom_id, worker_binding_id, runtime_type, runtime_instance_ref,
+            session_ref, territory_id, task_id, attempt_no, state,
+            capability_decision_id, enforcement_plan_snapshot, release_evidence_json, release_reason,
+            acquired_at, released_at, updated_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
             .run(row.lease_id, row.kingdom_id, row.worker_binding_id, row.runtime_type, row.runtime_instance_ref, row.session_ref, row.territory_id, row.task_id, row.attempt_no, row.state, row.capability_decision_id ?? null, row.enforcement_plan_snapshot ?? null, row.release_evidence_json ?? null, row.release_reason ?? null, row.acquired_at, row.released_at ?? null, row.updated_at);
         return row;
@@ -1604,8 +1640,8 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
     /** 某 Session 当前未释放的 Lease（部分唯一索引保证至多一条非 RELEASED）。 */
     getActiveLeaseForSession(session) {
         const rows = this.db
-            .prepare(`SELECT * FROM execution_leases
-                 WHERE runtime_type = ? AND runtime_instance_ref = ? AND session_ref = ? AND state <> 'RELEASED'
+            .prepare(`SELECT * FROM execution_leases
+                 WHERE runtime_type = ? AND runtime_instance_ref = ? AND session_ref = ? AND state <> 'RELEASED'
                  LIMIT 1`)
             .all(session.runtimeType, session.runtimeInstanceRef, session.sessionRef);
         return rows[0] ?? null;
@@ -1653,11 +1689,11 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
     // capability_decisions ────────────────────────────────────────
     insertCapabilityDecision(row) {
         this.db
-            .prepare(`INSERT INTO capability_decisions
-           (decision_id, kingdom_id, task_id, worker_binding_id, supervisor_binding_id,
-            requirement_snapshot, ceiling_snapshot, proposed_grant_snapshot, scope_snapshot, effective_snapshot,
-            decision, enforcement_status, enforcement_evidence_json, requirement_coverage,
-            reason_code, execution_id, created_at)
+            .prepare(`INSERT INTO capability_decisions
+           (decision_id, kingdom_id, task_id, worker_binding_id, supervisor_binding_id,
+            requirement_snapshot, ceiling_snapshot, proposed_grant_snapshot, scope_snapshot, effective_snapshot,
+            decision, enforcement_status, enforcement_evidence_json, requirement_coverage,
+            reason_code, execution_id, created_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
             .run(row.decision_id, row.kingdom_id, row.task_id, row.worker_binding_id ?? null, row.supervisor_binding_id ?? null, row.requirement_snapshot ?? null, row.ceiling_snapshot ?? null, row.proposed_grant_snapshot ?? null, row.scope_snapshot ?? null, row.effective_snapshot ?? null, row.decision, row.enforcement_status, row.enforcement_evidence_json ?? null, row.requirement_coverage ?? 'NONE', row.reason_code ?? null, row.execution_id ?? null, row.created_at);
         return row;
@@ -1679,12 +1715,12 @@ BEGIN SELECT RAISE(ABORT, 'DISPATCH_NO_DELETE'); END;
     // dispatch_records ────────────────────────────────────────────
     insertDispatchIntent(row) {
         this.db
-            .prepare(`INSERT INTO dispatch_records
-           (dispatch_id, kingdom_id, lease_id, execution_id, task_id, attempt_no,
-            runtime_type, runtime_instance_ref, session_ref, state,
-            dispatch_request_snapshot, dispatch_input_ref_json, dispatch_payload_hash,
-            runtime_dispatch_ref, runtime_execution_ref, receipt_json, terminal_evidence_json,
-            output_ref_json, dispatched_at, receipt_at, terminal_at, created_at, updated_at)
+            .prepare(`INSERT INTO dispatch_records
+           (dispatch_id, kingdom_id, lease_id, execution_id, task_id, attempt_no,
+            runtime_type, runtime_instance_ref, session_ref, state,
+            dispatch_request_snapshot, dispatch_input_ref_json, dispatch_payload_hash,
+            runtime_dispatch_ref, runtime_execution_ref, receipt_json, terminal_evidence_json,
+            output_ref_json, dispatched_at, receipt_at, terminal_at, created_at, updated_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
             .run(row.dispatch_id, row.kingdom_id, row.lease_id, row.execution_id, row.task_id, row.attempt_no, row.runtime_type, row.runtime_instance_ref, row.session_ref, row.state, row.dispatch_request_snapshot, row.dispatch_input_ref_json, row.dispatch_payload_hash, row.runtime_dispatch_ref ?? null, row.runtime_execution_ref ?? null, row.receipt_json ?? null, row.terminal_evidence_json ?? null, row.output_ref_json ?? null, row.dispatched_at ?? null, row.receipt_at ?? null, row.terminal_at ?? null, row.created_at, row.updated_at);
         return row;