package sqlite

import (
	"context"
	"database/sql"
	"encoding/json"
	"errors"
	"fmt"
	"sort"
	"strings"
	"time"

	"github.com/google/uuid"
	"github.com/jackc/pgx/v5/pgconn"
	"github.com/jmoiron/sqlx"

	"github.com/kandev/kandev/internal/agentctl/tracing"
	internaldb "github.com/kandev/kandev/internal/db"
	"github.com/kandev/kandev/internal/db/dialect"
	"github.com/kandev/kandev/internal/orchestrator/messagequeue"
	"github.com/kandev/kandev/internal/steptelemetry"
	"github.com/kandev/kandev/internal/task/models"
	usermodels "github.com/kandev/kandev/internal/user/models"
	wfmodels "github.com/kandev/kandev/internal/workflow/models"
	v1 "github.com/kandev/kandev/pkg/api/v1"
)

// defaultTaskAlias is the fallback alias the projection helpers use when
// the caller passes an empty string — i.e., when the SELECT references
// the `tasks` table directly rather than through a join alias.
const defaultTaskAlias = "tasks"

type taskScanColumn struct {
	name       string
	selectExpr func(alias string) string
}

// Automation runs are hidden from the board and from task lists by their
// provenance, not by ephemerality: their tasks are ordinary persistent tasks
// that keep their worktree and stay repliable, they just have their own
// destination (docs/specs/office/requirements/automations-settings.md). is_ephemeral keeps
// its original quick-chat meaning, so every board read pairs the two.
const (
	andNotAutomationOrigin  = ` AND COALESCE(origin, '') != '` + models.TaskOriginAutomationRun + `'`
	andNotAutomationOriginT = ` AND COALESCE(t.origin, '') != '` + models.TaskOriginAutomationRun + `'`
)

var taskScanColumns = []taskScanColumn{
	{name: "id"},
	{name: "workspace_id"},
	{name: "workflow_id"},
	{name: "workflow_step_id"},
	{name: "title"},
	{name: "description"},
	{name: "state"},
	{name: "priority"},
	{name: "position"},
	{name: "wip_admitted"},
	{name: "queued_for_step_id"},
	{name: "queued_at"},
	{name: "metadata"},
	{name: "is_ephemeral"},
	{name: "parent_id"},
	{name: "autopilot_enabled"},
	{name: "archived_at"},
	{name: "archived_by_cascade_id", selectExpr: func(alias string) string {
		return `COALESCE(` + alias + `.archived_by_cascade_id, '') AS archived_by_cascade_id`
	}},
	{name: "created_at"},
	{name: "updated_at"},
	{name: "assignee_agent_profile_id", selectExpr: func(alias string) string {
		return runnerProjection(alias) + ` AS assignee_agent_profile_id`
	}},
	// The HUMAN assignee, independent of the agent one above. A task can have
	// both: an Office agent doing the work and a person accountable for it.
	{name: "assignee_user_id"},
	{name: "origin"},
	{name: "project_id"},
	{name: "labels"},
	{name: "identifier"},
	{name: "external_id"},
	{name: "external_id_settled_at"},
	{name: "is_from_office", selectExpr: func(alias string) string {
		return isFromOfficeProjection(alias) + ` AS is_from_office`
	}},
}

// taskSelectColumns returns the column projection (with runner subquery)
// for a SELECT against tasks aliased as `alias`. The output column order
// matches scanSingleTask / scanTasks.
func taskSelectColumns(alias string) string {
	if alias == "" {
		alias = defaultTaskAlias
	}
	return taskScanColumnSQL(alias, true)
}

func taskProjectedColumns(alias string) string {
	if alias == "" {
		alias = defaultTaskAlias
	}
	return taskScanColumnSQL(alias, false)
}

func taskScanColumnSQL(alias string, useExpressions bool) string {
	prefix := alias + "."
	cols := make([]string, 0, len(taskScanColumns))
	for _, col := range taskScanColumns {
		if useExpressions && col.selectExpr != nil {
			cols = append(cols, col.selectExpr(alias))
			continue
		}
		cols = append(cols, prefix+col.name)
	}
	return strings.Join(cols, ", ")
}

// isFromOfficeProjection returns a SQL boolean expression that is true
// when the task is owned by office: either it has a non-empty project_id
// (explicit office task) or its workflow matches the workspace's
// office_workflow_id (the canonical "office workflow"). Kanban tasks live
// in any other workflow and have no project.
func isFromOfficeProjection(alias string) string {
	if alias == "" {
		alias = defaultTaskAlias
	}
	return `(
		COALESCE(` + alias + `.project_id, '') != ''
		OR EXISTS (
			SELECT 1 FROM workspaces w
			WHERE w.id = ` + alias + `.workspace_id
			  AND COALESCE(w.office_workflow_id, '') != ''
			  AND w.office_workflow_id = ` + alias + `.workflow_id
		)
	)`
}

// IsFromOfficePredicate returns the shared SQL predicate for authoritative
// Office-task identity. Callers that query tasks outside this repository must
// use this expression so project-linked tasks and canonical Office-workflow
// tasks are classified consistently with models.Task.IsFromOffice.
func IsFromOfficePredicate(alias string) string {
	return isFromOfficeProjection(alias)
}

// excludeConfigModePredicate delegates to the shared dialect helper (also
// used by internal/analytics/repository/sqlite's CodeStats read, so both
// cover the same office config-mode exclusion).
func excludeConfigModePredicate(driver, col string) string {
	return dialect.ExcludeConfigModePredicate(driver, col)
}

// runnerProjection produces the correlated subquery (without alias) that
// resolves the runner for the row of `tasks` with the given alias. Used
// inline in SELECT projections.
func runnerProjection(alias string) string {
	if alias == "" {
		alias = defaultTaskAlias
	}
	return `COALESCE(
		(SELECT wsp.agent_profile_id FROM workflow_step_participants wsp
		 WHERE wsp.step_id = ` + alias + `.workflow_step_id
		   AND wsp.task_id = ` + alias + `.id
		   AND wsp.role = 'runner'
		 ORDER BY wsp.position ASC, wsp.id ASC LIMIT 1),
		(SELECT ws.agent_profile_id FROM workflow_steps ws WHERE ws.id = ` + alias + `.workflow_step_id),
		''
	)`
}

// CreateTask creates a new task. The assignee column has been removed
// (ADR 0005 Wave F); when the request carries AssigneeAgentProfileID we
// upsert a 'runner' row in workflow_step_participants instead.
func (r *Repository) CreateTask(ctx context.Context, task *models.Task) error {
	if task.WorkflowStepID != "" && task.QueuedForStepID == "" && !task.IsEphemeral {
		task.WIPAdmitted = true
		models.DropWIPDeferredLaunch(task)
	}
	return r.createTask(ctx, task, "", 0)
}

// CreateTaskIfWorkflowStepHasCapacity atomically admits a task into a
// WIP-limited workflow step. The occupancy check and insert share one writer
// transaction, so concurrent watcher events cannot overfill the step.
func (r *Repository) CreateTaskIfWorkflowStepHasCapacity(ctx context.Context, task *models.Task, targetStepID string, limit int) error {
	if limit <= 0 {
		return r.CreateTask(ctx, task)
	}
	task.WIPAdmitted = true
	task.QueuedForStepID = ""
	task.QueuedAt = nil
	return r.createTask(ctx, task, targetStepID, limit)
}

// CreateTaskWithWorkflowStepAdmission persists a task according to the
// destination step's WIP state. Overflow is either kept visibly queued in the
// destination or placed in the configured feeder for one-hop promotion.
func (r *Repository) CreateTaskWithWorkflowStepAdmission(
	ctx context.Context,
	task *models.Task,
	targetStepID string,
	targetLimit int,
	feederStepID string,
	feederLimit int,
) error {
	if task.IsEphemeral || targetStepID == "" || targetLimit <= 0 {
		task.WIPAdmitted = !task.IsEphemeral
		task.QueuedForStepID = ""
		task.QueuedAt = nil
		models.DropWIPDeferredLaunch(task)
		return r.CreateTask(ctx, task)
	}

	if err := r.prepareTaskForCreate(task); err != nil {
		return err
	}
	tx, err := r.db.BeginTx(ctx, nil)
	if err != nil {
		return err
	}
	defer func() { _ = tx.Rollback() }()

	// Same order as createTask and the workspace cascade: workspace row
	// first, then workflow-step locks. Without it an admission holding a step
	// lock while the cascade holds the workspace and waits for that step
	// deadlocks on Postgres.
	if err := r.lockWorkspaceRowStdTx(ctx, tx, task.WorkspaceID); err != nil {
		return err
	}
	if err := r.lockWorkflowStepsForAdmission(ctx, tx, targetStepID, feederStepID); err != nil {
		return err
	}
	targetOccupants, err := r.countAdmittedInTx(ctx, tx, targetStepID, "")
	if err != nil {
		return err
	}
	if err := r.applyAdmissionPlacement(ctx, tx, task, targetStepID, targetLimit, feederStepID, feederLimit, targetOccupants); err != nil {
		return err
	}

	entryID, err := r.insertTaskTx(ctx, tx, task)
	if err != nil {
		return err
	}
	if err := tx.Commit(); err != nil {
		return err
	}
	r.dispatchStepEntry(ctx, task.ID, task.WorkflowID, task.WorkflowStepID, entryID)
	return nil
}

func (r *Repository) applyAdmissionPlacement(
	ctx context.Context,
	tx *sql.Tx,
	task *models.Task,
	targetStepID string,
	targetLimit int,
	feederStepID string,
	feederLimit int,
	targetOccupants int,
) error {
	switch {
	case targetOccupants < targetLimit:
		task.WorkflowStepID = targetStepID
		task.WIPAdmitted = true
		task.QueuedForStepID = ""
		task.QueuedAt = nil
		models.DropWIPDeferredLaunch(task)
	case feederStepID == "":
		task.WorkflowStepID = targetStepID
		task.WIPAdmitted = false
		task.QueuedForStepID = targetStepID
		task.QueuedAt = &task.CreatedAt
	case feederStepID == targetStepID:
		return wfmodels.NewWIPLimitError(targetStepID, targetLimit, targetOccupants)
	default:
		feederOccupants, err := r.countAdmittedInTx(ctx, tx, feederStepID, "")
		if err != nil {
			return err
		}
		if feederLimit > 0 && feederOccupants >= feederLimit {
			return wfmodels.NewWIPLimitError(feederStepID, feederLimit, feederOccupants)
		}
		task.WorkflowStepID = feederStepID
		task.WIPAdmitted = true
		task.QueuedForStepID = targetStepID
		task.QueuedAt = &task.CreatedAt
	}
	return nil
}

func (r *Repository) createTask(ctx context.Context, task *models.Task, targetStepID string, limit int) error {
	if err := r.prepareTaskForCreate(task); err != nil {
		return err
	}

	tx, err := r.db.BeginTx(ctx, nil)
	if err != nil {
		return err
	}
	defer func() { _ = tx.Rollback() }()

	// Serialize with the workspace delete cascade: the cascade locks the
	// workspace row before inventorying its tasks, so a task created here
	// either commits before the cascade's inventory (and is purged with the
	// rest) or blocks until the cascade finishes, when the workspace is gone
	// and the insert fails its foreign key. The workspace lock is taken
	// before any workflow-step lock so the creation/admission paths share one
	// order with the cascade.
	if err := r.lockWorkspaceRowStdTx(ctx, tx, task.WorkspaceID); err != nil {
		return err
	}

	if err := r.ensureWorkflowStepCapacity(ctx, tx, targetStepID, limit); err != nil {
		return err
	}

	entryID, err := r.insertTaskTx(ctx, tx, task)
	if err != nil {
		if rollbackErr := tx.Rollback(); rollbackErr != nil {
			return fmt.Errorf("failed to rollback task insert: %w", rollbackErr)
		}
		return err
	}

	if err := tx.Commit(); err != nil {
		return err
	}
	r.dispatchStepEntry(ctx, task.ID, task.WorkflowID, task.WorkflowStepID, entryID)
	return nil
}

func (r *Repository) prepareTaskForCreate(task *models.Task) error {
	if task.ID == "" {
		task.ID = uuid.New().String()
	}
	now := time.Now().UTC()
	task.CreatedAt = now
	task.UpdatedAt = now
	if task.Metadata == nil {
		task.Metadata = map[string]interface{}{}
	}
	if task.Labels == "" {
		task.Labels = "[]"
	}
	if task.Priority == "" {
		task.Priority = "medium"
	}
	return nil
}

func (r *Repository) insertTaskTx(ctx context.Context, tx *sql.Tx, task *models.Task) (entryID string, err error) {
	metadata, err := json.Marshal(task.Metadata)
	if err != nil {
		metadata = []byte("{}")
	}
	var externalID interface{}
	if task.ExternalID != "" {
		externalID = task.ExternalID
	}
	_, err = tx.ExecContext(ctx, r.db.Rebind(`
		INSERT INTO tasks (id, workspace_id, workflow_id, workflow_step_id, title, description, state, priority, position, wip_admitted, queued_for_step_id, queued_at, metadata, is_ephemeral, parent_id, autopilot_enabled, created_at, updated_at, origin, project_id, labels, identifier, external_id, assignee_user_id)
		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
	`), task.ID, task.WorkspaceID, task.WorkflowID, task.WorkflowStepID, task.Title, task.Description, task.State, task.Priority, task.Position, dialect.BoolToInt(task.WIPAdmitted), task.QueuedForStepID, task.QueuedAt, string(metadata), dialect.BoolToInt(task.IsEphemeral), task.ParentID, dialect.BoolToInt(task.Autopilot), task.CreatedAt, task.UpdatedAt, task.Origin, task.ProjectID, task.Labels, task.Identifier, externalID, task.AssigneeUserID)
	if err != nil {
		if isExternalIDUniqueViolation(err) {
			return "", fmt.Errorf("%w: %w", ErrExternalIDConflict, err)
		}
		return "", err
	}
	// Genesis ledger row. By this point applyAdmissionPlacement has already
	// rewritten task.WorkflowStepID to the actual placement (feeder step when
	// WIP diverted it), so this satisfies the spec's feeder-step scenario for
	// free. A task created with no workflow writes nothing.
	genesisCtx := steptelemetry.WithAttribution(ctx, genesisAttribution(ctx))
	transitionID, err := r.recordStepTransition(genesisCtx, tx, stepTransitionInput{
		taskID:           task.ID,
		toWorkflowID:     task.WorkflowID,
		toWorkflowStepID: task.WorkflowStepID,
		occurredAt:       task.CreatedAt,
	})
	if err != nil {
		return "", err
	}
	task.WorkflowStepTransitionID = transitionID
	entryID = formatEntryID(transitionID)
	if task.AssigneeAgentProfileID != "" && task.WorkflowStepID != "" {
		if err := upsertRunnerInTx(ctx, tx, r.db.Rebind, task.WorkflowStepID, task.ID, task.AssigneeAgentProfileID); err != nil {
			return "", err
		}
	}
	return entryID, nil
}

func (r *Repository) lockWorkflowStepsForAdmission(ctx context.Context, tx *sql.Tx, targetStepID, feederStepID string) error {
	ids := []string{targetStepID}
	if feederStepID != "" && feederStepID != targetStepID {
		ids = append(ids, feederStepID)
	}
	if ids[0] > ids[len(ids)-1] && len(ids) == 2 {
		ids[0], ids[1] = ids[1], ids[0]
	}
	for _, id := range ids {
		if err := lockWorkflowStepForCapacity(ctx, tx, r.db.DriverName(), r.db.Rebind, id); err != nil {
			return err
		}
	}
	return nil
}

func (r *Repository) countAdmittedInTx(ctx context.Context, tx *sql.Tx, stepID, excludeTaskID string) (int, error) {
	query := `SELECT COUNT(*) FROM tasks WHERE workflow_step_id = ? AND wip_admitted = 1 AND archived_at IS NULL AND is_ephemeral = 0` + andNotAutomationOrigin
	args := []interface{}{stepID}
	if excludeTaskID != "" {
		query += " AND id != ?"
		args = append(args, excludeTaskID)
	}
	var count int
	err := tx.QueryRowContext(ctx, r.db.Rebind(query), args...).Scan(&count)
	return count, err
}

func (r *Repository) ensureWorkflowStepCapacity(ctx context.Context, tx *sql.Tx, targetStepID string, limit int) error {
	if limit <= 0 {
		return nil
	}
	if err := lockWorkflowStepForCapacity(ctx, tx, r.db.DriverName(), r.db.Rebind, targetStepID); err != nil {
		return err
	}
	var occupants int
	if err := tx.QueryRowContext(ctx, r.db.Rebind(`
		SELECT COUNT(*) FROM tasks
		WHERE workflow_step_id = ?
		  AND wip_admitted = 1
		  AND archived_at IS NULL
		  AND is_ephemeral = 0`+andNotAutomationOrigin+`
	`), targetStepID).Scan(&occupants); err != nil {
		return err
	}
	if occupants >= limit {
		return wfmodels.NewWIPLimitError(targetStepID, limit, occupants)
	}
	return nil
}

func lockWorkflowStepForCapacity(ctx context.Context, tx *sql.Tx, driver string, rebind func(string) string, stepID string) error {
	if !dialect.IsPostgres(driver) {
		return nil
	}
	var lockedID string
	return tx.QueryRowContext(ctx, rebind(`SELECT id FROM workflow_steps WHERE id = ? FOR UPDATE`), stepID).Scan(&lockedID)
}

// upsertRunnerInTx writes (or replaces) a 'runner' participant row for
// (stepID, taskID) inside the provided transaction. Mirrors
// workflow.Repository.SetTaskRunner but reuses the caller's tx.
//
// rebind is the caller's r.db.Rebind — required on Postgres, where the raw
// "?" placeholders below are not valid bind syntax (unlike SQLite, which
// accepts them natively). Mirrors lockWorkflowStepForCapacity's pattern for
// a free function that isn't a *Repository method.
func upsertRunnerInTx(ctx context.Context, tx *sql.Tx, rebind func(string) string, stepID, taskID, agentProfileID string) error {
	if stepID == "" || taskID == "" || agentProfileID == "" {
		return nil
	}
	var existing string
	err := tx.QueryRowContext(ctx, rebind(`SELECT id FROM workflow_step_participants
		WHERE step_id = ? AND task_id = ? AND role = 'runner' LIMIT 1`),
		stepID, taskID).Scan(&existing)
	if err == nil {
		_, uerr := tx.ExecContext(ctx,
			rebind(`UPDATE workflow_step_participants SET agent_profile_id = ? WHERE id = ?`),
			agentProfileID, existing)
		return uerr
	}
	if err != sql.ErrNoRows {
		return err
	}
	id := uuid.New().String()
	_, ierr := tx.ExecContext(ctx, rebind(`INSERT INTO workflow_step_participants
		(id, step_id, task_id, role, agent_profile_id, decision_required, position, created_at)
		VALUES (?, ?, ?, 'runner', ?, 0, 0, ?)`),
		id, stepID, taskID, agentProfileID, time.Now().UTC())
	return ierr
}

// clearRunnerInTx removes any 'runner' participant row for (stepID, taskID).
func clearRunnerInTx(ctx context.Context, tx *sql.Tx, rebind func(string) string, stepID, taskID string) error {
	if stepID == "" || taskID == "" {
		return nil
	}
	_, err := tx.ExecContext(ctx,
		rebind(`DELETE FROM workflow_step_participants
		 WHERE step_id = ? AND task_id = ? AND role = 'runner'`),
		stepID, taskID)
	return err
}

// syncRunnerInTx upserts the runner participant when agentProfileID is set,
// otherwise clears it. No-op when stepID is empty.
func syncRunnerInTx(ctx context.Context, tx *sql.Tx, rebind func(string) string, stepID, taskID, agentProfileID string) error {
	if stepID == "" {
		return nil
	}
	if agentProfileID != "" {
		return upsertRunnerInTx(ctx, tx, rebind, stepID, taskID, agentProfileID)
	}
	return clearRunnerInTx(ctx, tx, rebind, stepID, taskID)
}

// GetTask retrieves a task by ID
func (r *Repository) GetTask(ctx context.Context, id string) (*models.Task, error) {
	row := r.ro.QueryRowContext(ctx, r.ro.Rebind(
		`SELECT `+taskSelectColumns("t")+` FROM tasks t WHERE t.id = ?`), id)
	task, err := r.scanSingleTask(row)
	if err == sql.ErrNoRows {
		return nil, fmt.Errorf("%w: %s", ErrTaskNotFound, id)
	}
	return task, err
}

// UpdateTaskPriority updates only the priority column and its modification
// timestamp. Priority changes must not write a task snapshot that can carry
// stale title, metadata, workflow, or position values.
func (r *Repository) UpdateTaskPriority(ctx context.Context, taskID, priority string) error {
	result, err := r.db.ExecContext(ctx, r.db.Rebind(
		`UPDATE tasks SET priority = ?, updated_at = ? WHERE id = ?`),
		priority, r.nowUTC(), taskID)
	if err != nil {
		return err
	}
	rows, err := result.RowsAffected()
	if err != nil {
		return err
	}
	if rows == 0 {
		return fmt.Errorf("%w: %s", ErrTaskNotFound, taskID)
	}
	return nil
}

// UpdateTask updates an existing task. The runner write lands as an
// upsert/clear on workflow_step_participants inside the same tx as the
// task UPDATE.
func (r *Repository) UpdateTask(ctx context.Context, task *models.Task) error {
	metadata, err := json.Marshal(task.Metadata)
	if err != nil {
		metadata = []byte("{}")
	}

	tx, err := r.db.BeginTx(ctx, nil)
	if err != nil {
		return err
	}
	defer func() { _ = tx.Rollback() }()

	entryID, err := r.updateTaskTx(ctx, tx, task, metadata, "")
	if err != nil {
		return err
	}

	if err := tx.Commit(); err != nil {
		return err
	}
	r.dispatchStepEntry(ctx, task.ID, task.WorkflowID, task.WorkflowStepID, entryID)
	return nil
}

// UpdateTaskIfWorkflowMatches is the same-step counterpart of the
// expectedWorkflowID guard threaded through updateTaskWithWorkflowStepAdmission:
// it performs the same write as UpdateTask, but first rechecks — inside the
// same write transaction, via the readTaskStepInTx row lock — that the task's
// persisted workflow_id still equals expectedWorkflowID. This closes the
// same-step half of the plugin-move TOCTOU window: a caller that resolved
// "the task's current workflow" via a separate pre-read (see
// service.MoveTaskOptions.ExpectedWorkflowID) can otherwise silently overwrite
// a concurrent legitimate reassignment landing between that pre-read and this
// write. A mismatch returns repoerrors.ErrWorkflowResolutionConflict and the
// transaction rolls back untouched.
func (r *Repository) UpdateTaskIfWorkflowMatches(ctx context.Context, task *models.Task, expectedWorkflowID string) error {
	metadata, err := json.Marshal(task.Metadata)
	if err != nil {
		metadata = []byte("{}")
	}

	tx, err := r.db.BeginTx(ctx, nil)
	if err != nil {
		return err
	}
	defer func() { _ = tx.Rollback() }()

	entryID, err := r.updateTaskTx(ctx, tx, task, metadata, expectedWorkflowID)
	if err != nil {
		return err
	}

	if err := tx.Commit(); err != nil {
		return err
	}
	r.dispatchStepEntry(ctx, task.ID, task.WorkflowID, task.WorkflowStepID, entryID)
	return nil
}

func (r *Repository) updateTaskTx(ctx context.Context, tx *sql.Tx, task *models.Task, metadata []byte, expectedWorkflowID string) (entryID string, err error) {
	fromWorkflowID, fromStepID, found, err := r.readTaskStepInTx(ctx, tx, task.ID)
	if err != nil {
		return "", err
	}
	if !found {
		// A concurrently deleted task must surface as ErrTaskNotFound, not
		// fall through to the CAS comparison below: with fromWorkflowID=""
		// (never equal to a non-empty expectedWorkflowID) that branch would
		// misreport the deletion as a workflow-resolution conflict. NotFound
		// is reserved for the addressed resource and wins the precedence
		// ladder over every other case (design's error-mapping table).
		return "", fmt.Errorf("%w: %s", ErrTaskNotFound, task.ID)
	}
	if expectedWorkflowID != "" && fromWorkflowID != expectedWorkflowID {
		// Checked here, immediately before the UPDATE below and using the
		// same in-transaction, lock-protected read the ledger's "from" value
		// already comes from — this is the narrowest possible point to close
		// the race a caller-side pre-read (GetTask, well before this write)
		// cannot rule out on its own. See ErrWorkflowResolutionConflict (errors.go).
		return "", fmt.Errorf("%w: expected %q, task is now in %q",
			ErrWorkflowResolutionConflict, expectedWorkflowID, fromWorkflowID)
	}
	// Stamped after the transactional read/lock above, not before BeginTx: on
	// Postgres, readTaskStepInTx's FOR UPDATE blocks until this transaction's
	// turn to touch the row, so the timestamp now reflects true serialization
	// order. Stamping it earlier let two concurrent movers commit out of
	// timestamp order relative to their actual commit order, which broke the
	// (occurred_at, id) chain invariant under real concurrent load — SQLite's
	// single-writer connection pool serializes callers regardless, so this
	// was invisible until exercised against Postgres with real concurrency.
	task.UpdatedAt = r.nowUTC()

	updateQuery := `
		UPDATE tasks SET workspace_id = ?, workflow_id = ?, workflow_step_id = ?, title = ?, description = ?, state = ?, priority = ?, position = ?, wip_admitted = ?, queued_for_step_id = ?, queued_at = ?, metadata = ?, parent_id = ?, updated_at = ?, origin = ?, project_id = ?, labels = ?, identifier = ?, assignee_user_id = ?
		WHERE id = ?
	`
	if models.IsAgentTitlePending(task.Metadata) {
		pending := agentTitlePendingPredicate(r.db.DriverName())
		metadataMerge := pendingTaskMetadataMergeExpression(r.db.DriverName())
		updateQuery = fmt.Sprintf(`
			UPDATE tasks SET workspace_id = ?, workflow_id = ?, workflow_step_id = ?,
				title = CASE WHEN %s THEN ? ELSE title END,
				description = ?, state = ?, priority = ?, position = ?, wip_admitted = ?,
				queued_for_step_id = ?, queued_at = ?,
				metadata = %s,
				parent_id = ?, updated_at = ?, origin = ?, project_id = ?, labels = ?, identifier = ?, assignee_user_id = ?
			WHERE id = ?
		`, pending, metadataMerge)
	}
	result, err := tx.ExecContext(ctx, r.db.Rebind(updateQuery), task.WorkspaceID, task.WorkflowID, task.WorkflowStepID, task.Title, task.Description, task.State, task.Priority, task.Position, dialect.BoolToInt(task.WIPAdmitted), task.QueuedForStepID, task.QueuedAt, string(metadata), task.ParentID, task.UpdatedAt, task.Origin, task.ProjectID, task.Labels, task.Identifier, task.AssigneeUserID, task.ID)
	if err != nil {
		return "", err
	}
	rows, _ := result.RowsAffected()
	if rows == 0 {
		return "", fmt.Errorf("%w: %s", ErrTaskNotFound, task.ID)
	}

	transitionID, err := r.recordStepTransition(ctx, tx, stepTransitionInput{
		taskID:             task.ID,
		fromWorkflowID:     fromWorkflowID,
		fromWorkflowStepID: fromStepID,
		toWorkflowID:       task.WorkflowID,
		toWorkflowStepID:   task.WorkflowStepID,
		occurredAt:         task.UpdatedAt,
	})
	if err != nil {
		return "", err
	}
	task.WorkflowStepTransitionID = transitionID
	entryID = formatEntryID(transitionID)
	if transitionID != 0 {
		task.FromWorkflowID = fromWorkflowID
		task.FromStepID = fromStepID
	} else {
		task.FromWorkflowID = ""
		task.FromStepID = ""
	}

	// Both sides kept. pr-2907's allocateStepEntryIfPending is a write with its
	// own concern; #3043's entryID is a pure format of transitionID (line above),
	// so neither subsumes the other and dropping either loses real behaviour.
	// The two-value return is #3043's signature, which this function now carries.
	if err := r.allocateStepEntryIfPending(ctx, tx, task.ID, task.UpdatedAt); err != nil {
		return "", err
	}

	if err := syncRunnerInTx(ctx, tx, r.db.Rebind, task.WorkflowStepID, task.ID, task.AssigneeAgentProfileID); err != nil {
		return "", err
	}
	return entryID, nil
}

// UpdateTaskWithWorkflowStepAdmission atomically moves a task into a workflow
// step. A limited full target stores the task in that destination as queued;
// it never rejects the move for WIP capacity.
func (r *Repository) UpdateTaskWithWorkflowStepAdmission(
	ctx context.Context,
	task *models.Task,
	targetStepID string,
	limit int,
) (bool, error) {
	admitted, _, err := r.updateTaskWithWorkflowStepAdmission(ctx, task, targetStepID, limit, nil, false, "", "", nil)
	return admitted, err
}

// UpdateTaskWithWorkflowStepAdmissionAndState is the manual-move variant of
// UpdateTaskWithWorkflowStepAdmission. It keeps the destination admission,
// the state that applies after admission, and the queued source-exit marker
// in one transaction so a later full-row update cannot strand the move.
//
// expectedWorkflowID, when non-empty, is rechecked atomically inside this
// transaction (see updateTaskTx) immediately before the row is written,
// closing the step-changed half of the plugin-move TOCTOU window — see
// UpdateTaskIfWorkflowMatches for the same-step half. Pass "" for callers that
// do not carry a pre-resolved expected workflow (e.g. queue promotion/pull).
func (r *Repository) UpdateTaskWithWorkflowStepAdmissionAndState(
	ctx context.Context,
	task *models.Task,
	targetStepID string,
	limit int,
	admittedState *v1.TaskState,
	queueExitPending bool,
	expectedWorkflowID string,
) (bool, error) {
	admitted, _, err := r.updateTaskWithWorkflowStepAdmission(
		ctx, task, targetStepID, limit, admittedState, queueExitPending, "", expectedWorkflowID, nil,
	)
	return admitted, err
}

// UpdateTaskWithWorkflowStepAdmissionIfAtStep is the AC-46/48 compare-and-swap
// variant used by the workflow engine's guarded-transition re-evaluation
// apply path (see engine.TransitionStore.ApplyTransitionIfAtStep). The move
// is applied only if the task's persisted workflow_step_id still equals
// expectedStepID when read inside this transaction, after the workspace row
// lock — so on PostgreSQL a concurrent admission for the same workspace
// cannot race between the check and the write. applied=false means the
// precondition failed (the task already left expectedStepID by the time this
// ran) and is not an error; the task row is left untouched.
func (r *Repository) UpdateTaskWithWorkflowStepAdmissionIfAtStep(
	ctx context.Context,
	task *models.Task,
	expectedStepID string,
	targetStepID string,
	limit int,
) (applied bool, err error) {
	_, applied, err = r.updateTaskWithWorkflowStepAdmission(ctx, task, targetStepID, limit, nil, false, expectedStepID, "", nil)
	return applied, err
}

func (r *Repository) UpdateTaskWithWorkflowStepAdmissionForDeferredMove(
	ctx context.Context,
	task *models.Task,
	expectedStepID, targetStepID string,
	limit int,
	record messagequeue.PendingMoveRecord,
) (admitted, applied bool, err error) {
	return r.updateTaskWithWorkflowStepAdmission(
		ctx, task, targetStepID, limit, nil, false, expectedStepID, "", &record,
	)
}

func (r *Repository) MarkDeferredMoveAppliedForSession(
	ctx context.Context,
	taskID, moveID string,
	record messagequeue.PendingMoveRecord,
) (bool, error) {
	tx, err := r.db.BeginTx(ctx, nil)
	if err != nil {
		return false, err
	}
	defer func() { _ = tx.Rollback() }()
	if err := r.validateDeferredMoveGuardTx(ctx, tx, record); err != nil {
		return false, err
	}
	if _, _, found, err := r.readTaskStepInTx(ctx, tx, taskID); err != nil {
		return false, err
	} else if !found {
		return false, sql.ErrNoRows
	}
	task, err := r.scanSingleTask(tx.QueryRowContext(ctx, r.db.Rebind(
		`SELECT `+taskSelectColumns("t")+` FROM tasks t WHERE t.id = ?`), taskID))
	if err != nil {
		return false, err
	}
	if task.Metadata == nil {
		task.Metadata = map[string]interface{}{}
	}
	applied, _ := task.Metadata[models.MetaKeyAppliedDeferredMoves].(map[string]interface{})
	if _, exists := applied[moveID]; exists {
		return false, nil
	}
	if applied == nil {
		applied = map[string]interface{}{}
	}
	applied[moveID] = true
	task.Metadata[models.MetaKeyAppliedDeferredMoves] = applied
	task.UpdatedAt = time.Now().UTC()
	metadata, err := json.Marshal(task.Metadata)
	if err != nil {
		return false, err
	}
	if _, err := r.updateTaskTx(ctx, tx, task, metadata, ""); err != nil {
		return false, err
	}
	if err := r.deleteDeferredMoveGuardTx(ctx, tx, record); err != nil {
		return false, err
	}
	if err := tx.Commit(); err != nil {
		return false, err
	}
	return true, nil
}

func (r *Repository) validateDeferredMoveGuardTx(
	ctx context.Context,
	tx *sql.Tx,
	record messagequeue.PendingMoveRecord,
) error {
	move := record.Move
	if record.SessionID == "" || move.SessionIncarnationID == "" || move.TaskID == "" {
		return messagequeue.ErrSessionIdentityMismatch
	}
	if _, err := tx.ExecContext(ctx, r.db.Rebind(`
		INSERT INTO queue_session_locks (session_id) VALUES (?)
		ON CONFLICT(session_id) DO UPDATE SET session_id = excluded.session_id
	`), record.SessionID); err != nil {
		return fmt.Errorf("lock deferred move session: %w", err)
	}
	var matched int
	err := tx.QueryRowContext(ctx, r.db.Rebind(`
		SELECT COUNT(*)
		  FROM task_sessions s
		  JOIN pending_moves p ON p.session_id = s.id
		 WHERE s.id = ? AND s.task_id = ? AND s.queue_incarnation_id = ?
		   AND p.move_id = ? AND p.session_incarnation_id = ?
		   AND p.task_id = ? AND p.workflow_id = ? AND p.workflow_step_id = ?
		   AND p.step_position = ? AND p.queued_at = ?
		   AND p.actor = ? AND p.sender_session_id = ?
	`), record.SessionID, move.TaskID, move.SessionIncarnationID,
		move.MoveID, move.SessionIncarnationID, move.TaskID, move.WorkflowID,
		move.WorkflowStepID, move.Position, move.QueuedAt, move.Actor, move.SenderSessionID,
	).Scan(&matched)
	if err != nil {
		return fmt.Errorf("validate deferred move identity: %w", err)
	}
	if matched != 1 {
		return messagequeue.ErrSessionIdentityMismatch
	}
	return nil
}

func (r *Repository) deleteDeferredMoveGuardTx(
	ctx context.Context,
	tx *sql.Tx,
	record messagequeue.PendingMoveRecord,
) error {
	move := record.Move
	result, err := tx.ExecContext(ctx, r.db.Rebind(`
		DELETE FROM pending_moves
		 WHERE session_id = ? AND move_id = ? AND session_incarnation_id = ?
		   AND task_id = ? AND workflow_id = ? AND workflow_step_id = ?
		   AND step_position = ? AND queued_at = ?
		   AND actor = ? AND sender_session_id = ?
	`), record.SessionID, move.MoveID, move.SessionIncarnationID, move.TaskID,
		move.WorkflowID, move.WorkflowStepID, move.Position, move.QueuedAt,
		move.Actor, move.SenderSessionID,
	)
	if err != nil {
		return fmt.Errorf("consume deferred move: %w", err)
	}
	affected, err := result.RowsAffected()
	if err != nil {
		return err
	}
	if affected != 1 {
		return messagequeue.ErrSessionIdentityMismatch
	}
	return nil
}

// rebaseTaskForStepAdmissionCAS applies the AC-46/48 compare-and-swap
// precondition for the CAS-guarded admission path: it reads the task's
// current step inside the transaction, after the workspace lock, via
// readTaskStepInTx so the read also takes its row-level FOR UPDATE lock on
// PostgreSQL. The workspace lock alone only serializes this method against
// other callers that take it (other admission calls); a plain writer like
// UpdateTask never takes the workspace lock and instead relies on that same
// FOR UPDATE lock via readTaskStepInTx, so a bare (lockless) SELECT here
// could read a stale expectedStepID, let UpdateTask commit a concurrent
// move, and then have this transaction's own write below overwrite it — a
// lost update. Taking the same row lock here blocks that writer until this
// transaction commits or rolls back, closing the race.
//
// This CAS path also reloads and rebases the full row (instead of writing
// the caller's snapshot) into task. The CAS caller (the workflow engine's
// guarded re-evaluation) can hold a task snapshot loaded well before this
// write — long enough for an unrelated concurrent edit (title, other
// metadata keys) to land in between. Writing that stale snapshot would
// silently clobber the concurrent edit. Only the fields this operation owns
// (workflow id, the deferred-moves metadata sub-map) are carried forward
// from the caller's request; everything else comes from the fresh row.
//
// The unconditional (expectedStepID == "") callers — manual/bulk/feeder
// moves — must NOT call this: their caller-built `task` already carries
// this operation's own field changes (Position, move-lifecycle metadata,
// …) that have no other source of truth, so rebasing from a fresh row would
// drop them instead of protecting them.
//
// Returns applied=false, err=nil when the CAS precondition fails (the task
// already left expectedStepID) — that is a lost race, not an error.
func (r *Repository) rebaseTaskForStepAdmissionCAS(
	ctx context.Context,
	tx *sql.Tx,
	task *models.Task,
	expectedStepID string,
	now time.Time,
) (applied bool, err error) {
	requestedWorkflowID := task.WorkflowID
	requestedAppliedMoves := map[string]interface{}{}
	if appliedMoves, ok := task.Metadata[models.MetaKeyAppliedDeferredMoves].(map[string]interface{}); ok {
		for moveID, value := range appliedMoves {
			requestedAppliedMoves[moveID] = value
		}
	}

	_, currentStepID, found, err := r.readTaskStepInTx(ctx, tx, task.ID)
	if err != nil {
		return false, fmt.Errorf("read task step for admission CAS check: %w", err)
	}
	if !found {
		return false, fmt.Errorf("%w: %s", ErrTaskNotFound, task.ID)
	}
	if currentStepID != expectedStepID {
		return false, nil
	}
	currentTask, err := r.scanSingleTask(tx.QueryRowContext(ctx, r.db.Rebind(
		`SELECT `+taskSelectColumns("t")+` FROM tasks t WHERE t.id = ?`), task.ID))
	if err != nil {
		return false, fmt.Errorf("reload task for admission CAS rebase: %w", err)
	}
	if requestedWorkflowID == "" {
		requestedWorkflowID = currentTask.WorkflowID
	}
	*task = *currentTask
	if requestedWorkflowID != "" {
		task.WorkflowID = requestedWorkflowID
	}
	if task.Metadata == nil {
		task.Metadata = map[string]interface{}{}
	}
	if len(requestedAppliedMoves) > 0 {
		currentAppliedMoves := map[string]interface{}{}
		if existing, ok := task.Metadata[models.MetaKeyAppliedDeferredMoves].(map[string]interface{}); ok {
			for moveID, value := range existing {
				currentAppliedMoves[moveID] = value
			}
		}
		for moveID, value := range requestedAppliedMoves {
			currentAppliedMoves[moveID] = value
		}
		task.Metadata[models.MetaKeyAppliedDeferredMoves] = currentAppliedMoves
	}
	task.UpdatedAt = now
	return true, nil
}

func (r *Repository) updateTaskWithWorkflowStepAdmission(
	ctx context.Context,
	task *models.Task,
	targetStepID string,
	limit int,
	admittedState *v1.TaskState,
	queueExitPending bool,
	expectedStepID string,
	expectedWorkflowID string,
	deferredMove *messagequeue.PendingMoveRecord,
) (admitted bool, applied bool, err error) {
	now := time.Now().UTC()
	task.UpdatedAt = now
	if task.Metadata == nil {
		task.Metadata = map[string]interface{}{}
	}

	tx, err := r.db.BeginTx(ctx, nil)
	if err != nil {
		return false, false, err
	}
	defer func() { _ = tx.Rollback() }()

	// Workspace row before workflow-step lock, matching createTask and the
	// workspace cascade: the update path must not hold a step lock while the
	// cascade holds the workspace and waits for that step (Postgres
	// deadlock). The task's workspace is read from its row so the caller's
	// model cannot bypass the ordering.
	var workspaceID string
	if err := tx.QueryRowContext(ctx, r.db.Rebind(`SELECT workspace_id FROM tasks WHERE id = ?`), task.ID).Scan(&workspaceID); err != nil {
		if errors.Is(err, sql.ErrNoRows) {
			// Preserve the ErrTaskNotFound sentinel callers relied on before
			// the workspace read was introduced (a task deleted concurrently
			// with a move is reachable).
			return false, false, fmt.Errorf("%w: %s", ErrTaskNotFound, task.ID)
		}
		return false, false, fmt.Errorf("read task workspace for admission: %w", err)
	}
	if err := r.lockWorkspaceRowStdTx(ctx, tx, workspaceID); err != nil {
		return false, false, err
	}
	if deferredMove != nil {
		if err := r.validateDeferredMoveGuardTx(ctx, tx, *deferredMove); err != nil {
			return false, false, err
		}
	}

	// AC-46/48 compare-and-swap precondition, only for CAS callers (see
	// rebaseTaskForStepAdmissionCAS for the full rationale). A mismatch means
	// the task already left expectedStepID (lost the race) — that is
	// reported as applied=false, not an error, and the transaction is rolled
	// back untouched.
	if expectedStepID != "" {
		casApplied, err := r.rebaseTaskForStepAdmissionCAS(ctx, tx, task, expectedStepID, now)
		if err != nil {
			return false, false, err
		}
		if !casApplied {
			return false, false, nil
		}
	}

	if err := lockWorkflowStepForCapacity(ctx, tx, r.db.DriverName(), r.db.Rebind, targetStepID); err != nil {
		return false, false, err
	}
	occupants, err := r.countAdmittedInTx(ctx, tx, targetStepID, task.ID)
	if err != nil {
		return false, false, err
	}
	admitted = task.IsEphemeral || limit <= 0 || occupants < limit
	task.WorkflowStepID = targetStepID
	if admitted {
		task.WIPAdmitted = !task.IsEphemeral
		task.QueuedForStepID = ""
		task.QueuedAt = nil
		if admittedState != nil {
			task.State = *admittedState
		}
	} else {
		task.WIPAdmitted = false
		task.QueuedForStepID = targetStepID
		task.QueuedAt = &now
	}
	if queueExitPending {
		if admitted {
			delete(task.Metadata, models.MetaKeyQueuedMoveExitPending)
		} else {
			if _, exists := task.Metadata[models.MetaKeyQueuedMoveExitPending]; !exists {
				task.Metadata[models.MetaKeyQueuedMoveExitPending] = true
			}
		}
	}
	metadata, err := json.Marshal(task.Metadata)
	if err != nil {
		metadata = []byte("{}")
	}
	entryID, err := r.updateTaskTx(ctx, tx, task, metadata, expectedWorkflowID)
	if err != nil {
		return false, false, err
	}
	if deferredMove != nil {
		result, err := tx.ExecContext(ctx, r.db.Rebind(`
			UPDATE task_sessions SET review_status = ''
			 WHERE id = ? AND task_id = ? AND queue_incarnation_id = ?
		`), deferredMove.SessionID, deferredMove.Move.TaskID, deferredMove.Move.SessionIncarnationID)
		if err != nil {
			return false, false, err
		}
		if affected, rowsErr := result.RowsAffected(); rowsErr != nil || affected != 1 {
			if rowsErr != nil {
				return false, false, rowsErr
			}
			return false, false, messagequeue.ErrSessionIdentityMismatch
		}
	}
	if deferredMove != nil {
		if err := r.deleteDeferredMoveGuardTx(ctx, tx, *deferredMove); err != nil {
			return false, false, err
		}
	}
	if err := tx.Commit(); err != nil {
		return false, false, err
	}
	r.dispatchStepEntry(ctx, task.ID, task.WorkflowID, task.WorkflowStepID, entryID)
	return admitted, true, nil
}

// RemoveTaskMetadataKey removes one metadata key without replacing concurrent
// task fields. It returns whether the key was present and removed.
func (r *Repository) RemoveTaskMetadataKey(ctx context.Context, taskID, key string) (bool, error) {
	return r.removeTaskMetadataKeyWithExecutor(ctx, r.db, taskID, key)
}

// ClearManualMoveLifecycleMarkersIfCompleted atomically removes the pending
// and completed markers for a manual move only while the completed marker and
// task update generation still match the recovery snapshot. A new move clears
// the old completed marker in the same task write that creates its pending
// marker, and a later completion reuses the boolean marker value, so the
// generation predicate prevents either newer move from being erased.
func (r *Repository) ClearManualMoveLifecycleMarkersIfCompleted(ctx context.Context, taskID string, completedAt time.Time) (bool, error) {
	var query string
	var args []interface{}
	if dialect.IsPostgres(r.db.DriverName()) {
		query = `
			UPDATE tasks
			SET metadata = (
				CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}'::jsonb ELSE metadata::jsonb END
				#- ARRAY[?]::text[] #- ARRAY[?]::text[]
			)::text, updated_at = ?
			WHERE id = ?
			  AND jsonb_extract_path(
				CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}'::jsonb ELSE metadata::jsonb END,
				?
			  ) IS NOT NULL
			  AND updated_at = ?
		`
		args = []interface{}{
			models.MetaKeyManualMoveLifecyclePending,
			models.MetaKeyManualMoveLifecycleCompleted,
			r.nowUTC(),
			taskID,
			models.MetaKeyManualMoveLifecycleCompleted,
			completedAt,
		}
	} else {
		query = `
			UPDATE tasks
			SET metadata = json_remove(
				CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}' ELSE metadata END,
				?, ?
			), updated_at = ?
			WHERE id = ?
			  AND json_type(
				CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}' ELSE metadata END,
				?
			  ) IS NOT NULL
			  AND updated_at = ?
		`
		args = []interface{}{
			jsonPath(models.MetaKeyManualMoveLifecyclePending),
			jsonPath(models.MetaKeyManualMoveLifecycleCompleted),
			r.nowUTC(),
			taskID,
			jsonPath(models.MetaKeyManualMoveLifecycleCompleted),
			completedAt,
		}
	}
	result, err := r.db.ExecContext(ctx, r.db.Rebind(query), args...)
	if err != nil {
		return false, err
	}
	rows, err := result.RowsAffected()
	return rows > 0, err
}

// RemoveTaskMetadataKeyIfStamp removes one metadata object only when its
// nested stamp still equals expectedStamp. The comparison and key removal are
// one statement so a successful launch cannot erase a newer failure.
func (r *Repository) RemoveTaskMetadataKeyIfStamp(
	ctx context.Context,
	taskID, key, expectedStamp string,
) (bool, error) {
	if strings.TrimSpace(expectedStamp) == "" {
		return false, nil
	}
	var query string
	var args []interface{}
	if dialect.IsPostgres(r.db.DriverName()) {
		query = `
			UPDATE tasks
			SET metadata = (CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}'::jsonb ELSE metadata::jsonb END #- ARRAY[?]::text[])::text, updated_at = ?
			WHERE id = ? AND jsonb_extract_path_text(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}'::jsonb ELSE metadata::jsonb END, ?, 'stamp') = ?
		`
		args = []interface{}{key, time.Now().UTC(), taskID, key, expectedStamp}
	} else {
		path := jsonPath(key)
		stampPath := path + ".stamp"
		query = `
			UPDATE tasks
			SET metadata = json_remove(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}' ELSE metadata END, ?), updated_at = ?
			WHERE id = ? AND json_extract(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}' ELSE metadata END, ?) = ?
		`
		args = []interface{}{path, time.Now().UTC(), taskID, stampPath, expectedStamp}
	}
	result, err := r.db.ExecContext(ctx, r.db.Rebind(query), args...)
	if err != nil {
		return false, err
	}
	rows, err := result.RowsAffected()
	return rows > 0, err
}

// TakeTaskMetadataKeyIfDestinationStep removes one metadata object only when
// its nested step_id and stamp both equal the caller's expectations, and
// returns the object's raw JSON on a successful claim. The advisory read
// happens before the conditional removal; since stamp is a fresh unique value
// minted on every write (never content-derived), a removal that matches both
// step_id and stamp can only have removed the exact object just read.
func (r *Repository) TakeTaskMetadataKeyIfDestinationStep(
	ctx context.Context,
	taskID, key, expectedStepID, expectedStamp string,
) (json.RawMessage, bool, error) {
	if strings.TrimSpace(expectedStepID) == "" || strings.TrimSpace(expectedStamp) == "" {
		return nil, false, nil
	}
	task, err := r.GetTask(ctx, taskID)
	if err != nil {
		return nil, false, err
	}
	value, present := task.Metadata[key]
	if !present {
		return nil, false, nil
	}
	raw, err := json.Marshal(value)
	if err != nil {
		return nil, false, err
	}

	var query string
	var args []interface{}
	if dialect.IsPostgres(r.db.DriverName()) {
		query = `
			UPDATE tasks
			SET metadata = (CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}'::jsonb ELSE metadata::jsonb END #- ARRAY[?]::text[])::text, updated_at = ?
			WHERE id = ?
			  AND jsonb_extract_path_text(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}'::jsonb ELSE metadata::jsonb END, ?, 'step_id') = ?
			  AND jsonb_extract_path_text(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}'::jsonb ELSE metadata::jsonb END, ?, 'stamp') = ?
		`
		args = []interface{}{key, time.Now().UTC(), taskID, key, expectedStepID, key, expectedStamp}
	} else {
		path := jsonPath(key)
		stepIDPath := path + ".step_id"
		stampPath := path + ".stamp"
		query = `
			UPDATE tasks
			SET metadata = json_remove(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}' ELSE metadata END, ?), updated_at = ?
			WHERE id = ?
			  AND json_extract(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}' ELSE metadata END, ?) = ?
			  AND json_extract(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}' ELSE metadata END, ?) = ?
		`
		args = []interface{}{path, time.Now().UTC(), taskID, stepIDPath, expectedStepID, stampPath, expectedStamp}
	}
	result, err := r.db.ExecContext(ctx, r.db.Rebind(query), args...)
	if err != nil {
		return nil, false, err
	}
	rows, err := result.RowsAffected()
	if err != nil {
		return nil, false, err
	}
	if rows == 0 {
		return nil, false, nil
	}
	return raw, true, nil
}

func (r *Repository) removeTaskMetadataKeyWithExecutor(
	ctx context.Context,
	exec taskSessionExecutor,
	taskID, key string,
) (bool, error) {
	var query string
	if dialect.IsPostgres(r.db.DriverName()) {
		query = `
			UPDATE tasks SET metadata = (CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}'::jsonb ELSE metadata::jsonb END #- ARRAY[?]::text[])::text, updated_at = ?
			WHERE id = ? AND jsonb_extract_path(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}'::jsonb ELSE metadata::jsonb END, ?) IS NOT NULL
		`
	} else {
		query = `
			UPDATE tasks SET metadata = json_remove(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}' ELSE metadata END, ?), updated_at = ?
			WHERE id = ? AND json_type(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}' ELSE metadata END, ?) IS NOT NULL
		`
	}
	path := jsonPath(key)
	if dialect.IsPostgres(r.db.DriverName()) {
		path = key
	}
	result, err := exec.ExecContext(ctx, r.db.Rebind(query), path, time.Now().UTC(), taskID, path)
	if err != nil {
		return false, err
	}
	rows, err := result.RowsAffected()
	return rows > 0, err
}

// ClaimTaskTitleSession atomically assigns the first eligible session as the
// owner of a pending title handoff. Repeated calls by that same session are
// idempotent; a different session observes the existing owner and returns
// false.
func (r *Repository) ClaimTaskTitleSession(ctx context.Context, taskID, sessionID string) (bool, bool, error) {
	if sessionID == "" {
		return false, false, nil
	}

	var query string
	var args []interface{}
	if dialect.IsPostgres(r.db.DriverName()) {
		query = `
			UPDATE tasks
			SET metadata = jsonb_set(
				CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}'::jsonb ELSE metadata::jsonb END,
				ARRAY['agent_title_owner_session_id']::text[], ?::jsonb, true
			)::text,
				updated_at = ?
			WHERE id = ?
			  AND jsonb_extract_path(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}'::jsonb ELSE metadata::jsonb END, 'agent_title_pending') = 'true'::jsonb
			  AND jsonb_extract_path(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}'::jsonb ELSE metadata::jsonb END, 'agent_title_owner_session_id') IS NULL
		`
		payload, err := json.Marshal(sessionID)
		if err != nil {
			return false, false, err
		}
		args = []interface{}{string(payload), time.Now().UTC(), taskID}
	} else {
		query = `
			UPDATE tasks
			SET metadata = json_set(
				CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}' ELSE metadata END,
				'$.agent_title_owner_session_id', json(?)
			), updated_at = ?
			WHERE id = ?
			  AND json_type(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}' ELSE metadata END, '$.agent_title_pending') = 'true'
			  AND json_type(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}' ELSE metadata END, '$.agent_title_owner_session_id') IS NULL
		`
		payload, err := json.Marshal(sessionID)
		if err != nil {
			return false, false, err
		}
		args = []interface{}{string(payload), time.Now().UTC(), taskID}
	}
	result, err := r.db.ExecContext(ctx, r.db.Rebind(query), args...)
	if err != nil {
		return false, false, err
	}
	if rows, rowsErr := result.RowsAffected(); rowsErr == nil && rows > 0 {
		return true, true, nil
	}

	task, err := r.GetTask(ctx, taskID)
	if err != nil {
		return false, false, err
	}
	return models.IsAgentTitleOwner(task.Metadata, sessionID), false, nil
}

// SetTaskTitleIfPending replaces a provisional title and removes its pending
// and owner markers in one conditional write. The compare-and-set prevents two
// agent sessions (or a late agent call racing a human rename) from both winning.
func (r *Repository) SetTaskTitleIfPending(ctx context.Context, taskID, sessionID, title string) (bool, error) {
	if sessionID == "" {
		return false, nil
	}
	var query string
	if dialect.IsPostgres(r.db.DriverName()) {
		query = `
			UPDATE tasks
			SET title = ?,
				metadata = (CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}'::jsonb ELSE metadata::jsonb END #- ARRAY['agent_title_pending']::text[] #- ARRAY['agent_title_owner_session_id']::text[])::text,
				updated_at = ?
			WHERE id = ?
			  AND jsonb_extract_path(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}'::jsonb ELSE metadata::jsonb END, ?) = 'true'::jsonb
			  AND jsonb_extract_path_text(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}'::jsonb ELSE metadata::jsonb END, 'agent_title_owner_session_id') = ?
		`
	} else {
		query = `
			UPDATE tasks
			SET title = ?,
				metadata = json_remove(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}' ELSE metadata END, '$.agent_title_pending', '$.agent_title_owner_session_id'),
				updated_at = ?
			WHERE id = ?
			  AND json_type(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}' ELSE metadata END, ?) = 'true'
			  AND json_extract(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}' ELSE metadata END, '$.agent_title_owner_session_id') = ?
			`
	}
	path := jsonPath(models.MetaKeyAgentTitlePending)
	if dialect.IsPostgres(r.db.DriverName()) {
		path = models.MetaKeyAgentTitlePending
	}
	result, err := r.db.ExecContext(ctx, r.db.Rebind(query), title, time.Now().UTC(), taskID, path, sessionID)
	if err != nil {
		return false, err
	}
	rows, err := result.RowsAffected()
	return rows > 0, err
}

// SetTaskMetadataKey updates one metadata key without replacing concurrent
// task fields. It is used to restore a deferred launch after a failed launch.
func (r *Repository) SetTaskMetadataKey(ctx context.Context, taskID, key string, value interface{}) error {
	payload, err := json.Marshal(value)
	if err != nil {
		return err
	}
	var query string
	if dialect.IsPostgres(r.db.DriverName()) {
		query = `UPDATE tasks SET metadata = jsonb_set(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}'::jsonb ELSE metadata::jsonb END, ARRAY[?]::text[], ?::jsonb, true)::text, updated_at = ? WHERE id = ?`
	} else {
		query = `UPDATE tasks SET metadata = json_set(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}' ELSE metadata END, ?, json(?)), updated_at = ? WHERE id = ?`
	}
	path := key
	if !dialect.IsPostgres(r.db.DriverName()) {
		path = jsonPath(key)
	}
	_, err = r.db.ExecContext(ctx, r.db.Rebind(query), path, string(payload), time.Now().UTC(), taskID)
	return err
}

// SetTaskMetadataKeyIfNoActiveSession writes one metadata key only when the
// task has no session in STARTING or RUNNING. This prevents a delayed failure
// callback from re-adding a marker after a newer launch has already started.
func (r *Repository) SetTaskMetadataKeyIfNoActiveSession(
	ctx context.Context, taskID, key string, value interface{},
) (bool, error) {
	payload, err := json.Marshal(value)
	if err != nil {
		return false, err
	}
	var query string
	if dialect.IsPostgres(r.db.DriverName()) {
		query = `UPDATE tasks
			SET metadata = jsonb_set(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}'::jsonb ELSE metadata::jsonb END, ARRAY[?]::text[], ?::jsonb, true)::text, updated_at = ?
			WHERE id = ?
			  AND NOT EXISTS (
				SELECT 1 FROM task_sessions
				WHERE task_id = ? AND state IN (?, ?)
			  )`
	} else {
		query = `UPDATE tasks
			SET metadata = json_set(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}' ELSE metadata END, ?, json(?)), updated_at = ?
			WHERE id = ?
			  AND NOT EXISTS (
				SELECT 1 FROM task_sessions
				WHERE task_id = ? AND state IN (?, ?)
			  )`
	}
	path := key
	if !dialect.IsPostgres(r.db.DriverName()) {
		path = jsonPath(key)
	}
	result, err := r.db.ExecContext(ctx, r.db.Rebind(query), path, string(payload), time.Now().UTC(),
		taskID, taskID, models.TaskSessionStateStarting, models.TaskSessionStateRunning)
	if err != nil {
		return false, err
	}
	rows, err := result.RowsAffected()
	return rows > 0, err
}

// SetTaskMetadataKeyIfNotArchived writes one metadata key atomically with the
// archived_at guard: the write only lands when the task row still has
// archived_at IS NULL, and reports whether it landed. Startup reconciliation
// uses it for the interrupted_at marker so an archive that commits between the
// guard read and the metadata write can never leave a marker on an archived
// task (the check and the write are one statement).
func (r *Repository) SetTaskMetadataKeyIfNotArchived(ctx context.Context, taskID, key string, value interface{}) (bool, error) {
	payload, err := json.Marshal(value)
	if err != nil {
		return false, err
	}
	var query string
	if dialect.IsPostgres(r.db.DriverName()) {
		query = `UPDATE tasks SET metadata = jsonb_set(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}'::jsonb ELSE metadata::jsonb END, ARRAY[?]::text[], ?::jsonb, true)::text, updated_at = ? WHERE id = ? AND archived_at IS NULL`
	} else {
		query = `UPDATE tasks SET metadata = json_set(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}' ELSE metadata END, ?, json(?)), updated_at = ? WHERE id = ? AND archived_at IS NULL`
	}
	path := key
	if !dialect.IsPostgres(r.db.DriverName()) {
		path = jsonPath(key)
	}
	result, err := r.db.ExecContext(ctx, r.db.Rebind(query), path, string(payload), time.Now().UTC(), taskID)
	if err != nil {
		return false, err
	}
	rows, err := result.RowsAffected()
	return rows > 0, err
}

// SetTaskMetadataKeyIfPresent rewrites one metadata key only while that key is
// still present, and reports whether the write landed.
//
// It is the compare-and-swap counterpart to RemoveTaskMetadataKey: an editor
// that read a key, decided to change it, and then writes it back must not
// RE-CREATE the key if a concurrent claim removed it in between. Editing a
// deferred launch prompt is the case this exists for — a full-row UpdateTask
// there would resurrect a launch intent that a just-started task had already
// consumed, and the gate would then fire a second session.
func (r *Repository) SetTaskMetadataKeyIfPresent(ctx context.Context, taskID, key string, value interface{}) (bool, error) {
	payload, err := json.Marshal(value)
	if err != nil {
		return false, err
	}
	var query string
	if dialect.IsPostgres(r.db.DriverName()) {
		query = `UPDATE tasks SET metadata = jsonb_set(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}'::jsonb ELSE metadata::jsonb END, ARRAY[?]::text[], ?::jsonb, true)::text, updated_at = ?
			WHERE id = ? AND jsonb_extract_path(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}'::jsonb ELSE metadata::jsonb END, ?) IS NOT NULL`
	} else {
		query = `UPDATE tasks SET metadata = json_set(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}' ELSE metadata END, ?, json(?)), updated_at = ?
			WHERE id = ? AND json_type(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}' ELSE metadata END, ?) IS NOT NULL`
	}
	path := key
	if !dialect.IsPostgres(r.db.DriverName()) {
		path = jsonPath(key)
	}
	result, err := r.db.ExecContext(ctx, r.db.Rebind(query), path, string(payload), time.Now().UTC(), taskID, path)
	if err != nil {
		return false, err
	}
	rows, err := result.RowsAffected()
	return rows > 0, err
}

func jsonPath(key string) string { return "$." + key }

func agentTitlePendingPredicate(driver string) string {
	if dialect.IsPostgres(driver) {
		return "jsonb_extract_path(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}'::jsonb ELSE metadata::jsonb END, 'agent_title_pending') = 'true'::jsonb"
	}
	return "json_type(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}' ELSE metadata END, '$.agent_title_pending') = 'true'"
}

func pendingTaskMetadataMergeExpression(driver string) string {
	if dialect.IsPostgres(driver) {
		return "(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}'::jsonb ELSE metadata::jsonb END || (?::jsonb - 'agent_title_pending' - 'agent_title_owner_session_id'))::text"
	}
	return "json_patch(CASE WHEN metadata IS NULL OR metadata = 'null' OR metadata = '' THEN '{}' ELSE metadata END, json_remove(?, '$.agent_title_pending', '$.agent_title_owner_session_id'))"
}

// DetachTask clears only the hierarchy fields involved in detachment. Keeping
// this as a targeted update prevents concurrent task edits from being replaced
// by a stale full-row write.
func (r *Repository) DetachTask(ctx context.Context, taskID string) (bool, error) {
	tx, err := r.db.BeginTxx(ctx, nil)
	if err != nil {
		return false, err
	}
	defer func() { _ = tx.Rollback() }()

	parentID, groupID, err := r.loadDetachmentState(ctx, tx, taskID)
	if err != nil {
		return false, err
	}
	if parentID == "" {
		return false, tx.Commit()
	}
	lockedTaskIDs := []string{parentID, taskID}
	sort.Strings(lockedTaskIDs)
	for _, lockedTaskID := range lockedTaskIDs {
		if err := r.taskCleanupBarrierLocked(ctx, tx, lockedTaskID); err != nil {
			return false, err
		}
	}
	lockedParentID, lockedGroupID, err := r.loadDetachmentState(ctx, tx, taskID)
	if err != nil {
		return false, err
	}
	if lockedParentID != parentID || lockedGroupID != groupID {
		return false, fmt.Errorf("detach task %s: hierarchy changed concurrently", taskID)
	}

	result, err := tx.ExecContext(ctx, r.db.Rebind(detachTaskQuery(r.db.DriverName())), time.Now().UTC(), taskID)
	if err != nil {
		return false, err
	}
	rows, err := result.RowsAffected()
	if err != nil {
		return false, err
	}
	if rows != 1 {
		return false, fmt.Errorf("detach task %s: hierarchy changed concurrently", taskID)
	}
	if groupID != "" {
		if err := r.transferDetachedWorkspaceStewardship(ctx, tx, groupID, taskID); err != nil {
			if !errors.Is(err, errDetachedWorkspaceTransferNotApplicable) {
				return false, err
			}
		}
	}
	return true, tx.Commit()
}

func (r *Repository) loadDetachmentState(ctx context.Context, tx *sqlx.Tx, taskID string) (string, string, error) {
	var parentID, rawMetadata string
	if err := tx.QueryRowContext(ctx, r.db.Rebind(
		`SELECT parent_id, COALESCE(metadata, '{}') FROM tasks WHERE id = ?`,
	), taskID).Scan(&parentID, &rawMetadata); err != nil {
		if errors.Is(err, sql.ErrNoRows) {
			return "", "", fmt.Errorf("%w: %s", ErrTaskNotFound, taskID)
		}
		return "", "", err
	}
	var metadata map[string]interface{}
	if trimmed := strings.TrimSpace(rawMetadata); trimmed != "" {
		if err := json.Unmarshal([]byte(trimmed), &metadata); err != nil {
			return "", "", fmt.Errorf("decode task workspace metadata: %w", err)
		}
	}
	workspace, _ := metadata["workspace"].(map[string]interface{})
	groupID, _ := workspace["group_id"].(string)
	if groupID == "" {
		if err := tx.QueryRowContext(ctx, r.db.Rebind(`
			SELECT workspace_group_id
			FROM task_workspace_group_members
			WHERE task_id = ? AND released_at IS NULL
			ORDER BY created_at DESC, workspace_group_id DESC
			LIMIT 1
		`), taskID).Scan(&groupID); err != nil && !errors.Is(err, sql.ErrNoRows) {
			// Minimal legacy task databases may not have the optional office
			// membership tables. In that case metadata remains the only
			// available ownership signal; a missing table is not a detach
			// failure.
			if !internaldb.IsMissingTableError(err) {
				return "", "", err
			}
		}
	}
	return parentID, groupID, nil
}

func (r *Repository) transferDetachedWorkspaceStewardship(
	ctx context.Context,
	tx *sqlx.Tx,
	groupID, taskID string,
) error {
	// Read the prospective owners without locking workspace rows first. The
	// corresponding task rows must be locked before any group/environment row
	// locks, otherwise two concurrent detachments can acquire those resources
	// in opposite order and deadlock on PostgreSQL.
	state, err := r.loadDetachedWorkspaceStewardship(ctx, tx, groupID, taskID, false)
	if err != nil {
		return err
	}
	if err := r.lockDetachedWorkspaceTransferTaskRows(ctx, tx, taskID, state); err != nil {
		return err
	}
	lockedState, err := r.loadDetachedWorkspaceStewardship(ctx, tx, groupID, taskID, true)
	if err != nil {
		return err
	}
	if lockedState.groupOwnerTaskID != state.groupOwnerTaskID ||
		lockedState.environmentOwnerTaskID != state.environmentOwnerTaskID {
		// Ownership changed between the unlocked read and the task-row locks.
		// Acquire any newly-discovered task barriers before applying the final
		// state; all normal paths already hold their initial barriers.
		if err := r.lockDetachedWorkspaceTransferTaskRows(ctx, tx, taskID, lockedState); err != nil {
			return err
		}
		lockedState, err = r.loadDetachedWorkspaceStewardship(ctx, tx, groupID, taskID, true)
		if err != nil {
			return err
		}
	}
	return r.applyDetachedWorkspaceStewardship(ctx, tx, groupID, taskID, lockedState)
}

type detachedWorkspaceStewardship struct {
	groupOwnerTaskID       string
	environmentID          string
	environmentOwnerTaskID string
	environmentGeneration  int64
}

func (r *Repository) loadDetachedWorkspaceStewardship(
	ctx context.Context,
	tx *sqlx.Tx,
	groupID, taskID string,
	lockRows bool,
) (detachedWorkspaceStewardship, error) {
	query := `
		SELECT g.owner_task_id, g.materialized_environment_id
		FROM task_workspace_groups g
		JOIN task_workspace_group_members m ON m.workspace_group_id = g.id
		WHERE g.id = ? AND m.task_id = ? AND m.released_at IS NULL
		  AND g.cleanup_status IN ('active', 'cleanup_failed')
	`
	if lockRows && dialect.IsPostgres(r.db.DriverName()) {
		query += ` FOR UPDATE OF g, m`
	}
	var state detachedWorkspaceStewardship
	if err := tx.QueryRowContext(ctx, r.db.Rebind(query), groupID, taskID).
		Scan(&state.groupOwnerTaskID, &state.environmentID); err != nil {
		if errors.Is(err, sql.ErrNoRows) {
			return state, fmt.Errorf("%w: detach task %s: active workspace group %s not found", errDetachedWorkspaceTransferNotApplicable, taskID, groupID)
		}
		return state, err
	}
	if state.environmentID == "" {
		return state, nil
	}
	owner, generation, err := r.loadDetachedEnvironmentOwnership(ctx, tx, state.environmentID, taskID, lockRows)
	state.environmentOwnerTaskID = owner
	state.environmentGeneration = generation
	return state, err
}

func (r *Repository) loadDetachedEnvironmentOwnership(
	ctx context.Context,
	tx *sqlx.Tx,
	environmentID, taskID string,
	lockRow bool,
) (string, int64, error) {
	query := taskEnvironmentOwnershipQuery
	if lockRow && dialect.IsPostgres(r.db.DriverName()) {
		query += ` FOR UPDATE`
	}
	var ownerTaskID string
	var generation int64
	if err := tx.QueryRowContext(ctx, r.db.Rebind(query), environmentID).
		Scan(&ownerTaskID, &generation); err != nil {
		if errors.Is(err, sql.ErrNoRows) {
			return "", 0, fmt.Errorf("detach task %s: materialized environment %s not found", taskID, environmentID)
		}
		return "", 0, err
	}
	return ownerTaskID, generation, nil
}

func (r *Repository) lockDetachedWorkspaceTransferTaskRows(
	ctx context.Context,
	tx *sqlx.Tx,
	taskID string,
	state detachedWorkspaceStewardship,
) error {
	ids := make([]string, 0, 2)
	if state.groupOwnerTaskID != "" && state.groupOwnerTaskID != taskID {
		ids = append(ids, state.groupOwnerTaskID)
	}
	if state.environmentOwnerTaskID != "" &&
		state.environmentOwnerTaskID != taskID &&
		state.environmentOwnerTaskID != state.groupOwnerTaskID {
		ids = append(ids, state.environmentOwnerTaskID)
	}
	sort.Strings(ids)
	for _, ownerTaskID := range ids {
		if err := r.taskCleanupBarrierLocked(ctx, tx, ownerTaskID); err != nil {
			return err
		}
	}
	return nil
}

func (r *Repository) applyDetachedWorkspaceStewardship(
	ctx context.Context,
	tx *sqlx.Tx,
	groupID, taskID string,
	state detachedWorkspaceStewardship,
) error {
	now := time.Now().UTC()
	if _, err := tx.ExecContext(ctx, r.db.Rebind(`
		UPDATE task_workspace_group_members SET role = 'member'
		WHERE workspace_group_id = ? AND released_at IS NULL
	`), groupID); err != nil {
		return err
	}
	if result, err := tx.ExecContext(ctx, r.db.Rebind(`
		UPDATE task_workspace_group_members SET role = 'owner'
		WHERE workspace_group_id = ? AND task_id = ? AND released_at IS NULL
	`), groupID, taskID); err != nil {
		return err
	} else if rows, rowsErr := result.RowsAffected(); rowsErr != nil || rows != 1 {
		return errors.Join(rowsErr, fmt.Errorf("detach task %s: owner membership changed concurrently", taskID))
	}
	if _, err := tx.ExecContext(ctx, r.db.Rebind(`
		UPDATE task_workspace_groups
		SET owner_task_id = ?, ownership_generation = ownership_generation + 1,
			cleanup_status = 'active', cleanup_error = '', cleaned_at = NULL, updated_at = ?
		WHERE id = ?
	`), taskID, now, groupID); err != nil {
		return err
	}
	if state.environmentID == "" {
		return nil
	}
	result, err := tx.ExecContext(ctx, r.db.Rebind(`
		UPDATE task_environments
		SET task_id = ?, ownership_generation = ownership_generation + 1, updated_at = ?
		WHERE id = ? AND task_id = ? AND ownership_generation = ?
	`), taskID, now, state.environmentID, state.environmentOwnerTaskID, state.environmentGeneration)
	if err != nil {
		return err
	}
	rows, err := result.RowsAffected()
	if err != nil {
		return err
	}
	if rows != 1 {
		return fmt.Errorf("detach task %s: materialized environment %s changed concurrently", taskID, state.environmentID)
	}
	return nil
}

func detachTaskQuery(driver string) string {
	if dialect.IsPostgres(driver) {
		return `
			UPDATE tasks
			SET parent_id = '',
				metadata = CASE
					WHEN jsonb_extract_path_text(
						CASE WHEN metadata IS NULL OR metadata = '' THEN '{}'::jsonb ELSE metadata::jsonb END,
						'workspace', 'mode'
					) = 'inherit_parent'
					THEN jsonb_set(metadata::jsonb, '{workspace,mode}', '"shared_group"'::jsonb, true)::text
					ELSE metadata
				END,
				updated_at = ?
			WHERE id = ? AND parent_id != ''
		`
	}
	return `
		UPDATE tasks
		SET parent_id = '',
			metadata = CASE
				WHEN json_valid(metadata) THEN CASE
					WHEN json_extract(metadata, '$.workspace.mode') = 'inherit_parent'
					THEN json_set(metadata, '$.workspace.mode', 'shared_group')
					ELSE metadata
				END
				ELSE metadata
			END,
			updated_at = ?
		WHERE id = ? AND parent_id != ''
	`
}

// UpdateTaskIfWorkflowStepHasCapacity updates a task inside the same write
// transaction that checks a WIP-limited target step's current occupancy.
func (r *Repository) UpdateTaskIfWorkflowStepHasCapacity(ctx context.Context, task *models.Task, targetStepID, excludeTaskID string, limit int) error {
	metadata, err := json.Marshal(task.Metadata)
	if err != nil {
		metadata = []byte("{}")
	}

	tx, err := r.db.BeginTx(ctx, nil)
	if err != nil {
		return err
	}
	defer func() { _ = tx.Rollback() }()

	if err := lockWorkflowStepForCapacity(ctx, tx, r.db.DriverName(), r.db.Rebind, targetStepID); err != nil {
		return err
	}

	var occupants int
	if err := tx.QueryRowContext(ctx, r.db.Rebind(`
		SELECT COUNT(*) FROM tasks
		WHERE workflow_step_id = ?
		  AND wip_admitted = 1
		  AND id != ?
		  AND archived_at IS NULL
		  AND is_ephemeral = 0`+andNotAutomationOrigin+`
	`), targetStepID, excludeTaskID).Scan(&occupants); err != nil {
		return err
	}
	if occupants >= limit {
		return wfmodels.NewWIPLimitError(targetStepID, limit, occupants)
	}

	fromWorkflowID, fromStepID, _, err := r.readTaskStepInTx(ctx, tx, task.ID)
	if err != nil {
		return err
	}
	// See updateTaskTx's comment: stamped after the transactional lock, not
	// before BeginTx, so occurred_at reflects true commit-serialization order
	// under concurrent Postgres callers.
	task.UpdatedAt = time.Now().UTC()

	result, err := tx.ExecContext(ctx, r.db.Rebind(`
		UPDATE tasks SET workspace_id = ?, workflow_id = ?, workflow_step_id = ?, title = ?, description = ?, state = ?, priority = ?, position = ?, wip_admitted = ?, queued_for_step_id = ?, queued_at = ?, metadata = ?, parent_id = ?, updated_at = ?, origin = ?, project_id = ?, labels = ?, identifier = ?
		WHERE id = ?
	`), task.WorkspaceID, task.WorkflowID, task.WorkflowStepID, task.Title, task.Description, task.State, task.Priority, task.Position, dialect.BoolToInt(task.WIPAdmitted), task.QueuedForStepID, task.QueuedAt, string(metadata), task.ParentID, task.UpdatedAt, task.Origin, task.ProjectID, task.Labels, task.Identifier, task.ID)
	if err != nil {
		return err
	}
	rows, _ := result.RowsAffected()
	if rows == 0 {
		return fmt.Errorf("%w: %s", ErrTaskNotFound, task.ID)
	}
	transitionID, err := r.recordStepTransition(ctx, tx, stepTransitionInput{
		taskID:             task.ID,
		fromWorkflowID:     fromWorkflowID,
		fromWorkflowStepID: fromStepID,
		toWorkflowID:       task.WorkflowID,
		toWorkflowStepID:   task.WorkflowStepID,
		occurredAt:         task.UpdatedAt,
	})
	if err != nil {
		return err
	}
	task.WorkflowStepTransitionID = transitionID
	entryID := formatEntryID(transitionID)
	if transitionID != 0 {
		task.FromWorkflowID = fromWorkflowID
		task.FromStepID = fromStepID
	} else {
		task.FromWorkflowID = ""
		task.FromStepID = ""
	}
	if err := syncRunnerInTx(ctx, tx, r.db.Rebind, task.WorkflowStepID, task.ID, task.AssigneeAgentProfileID); err != nil {
		return err
	}
	if err := tx.Commit(); err != nil {
		return err
	}
	r.dispatchStepEntry(ctx, task.ID, task.WorkflowID, task.WorkflowStepID, entryID)
	return nil
}

// PromoteQueuedTaskIfWorkflowStepHasCapacity atomically claims a queued task
// for a destination step. The queue marker is part of the UPDATE predicate so
// concurrent reconcilers cannot promote the same row twice.
func (r *Repository) PromoteQueuedTaskIfWorkflowStepHasCapacity(
	ctx context.Context,
	task *models.Task,
	fromStepID,
	destinationStepID string,
	limit int,
) (bool, error) {
	metadata, err := json.Marshal(task.Metadata)
	if err != nil {
		metadata = []byte("{}")
	}

	tx, err := r.db.BeginTx(ctx, nil)
	if err != nil {
		return false, err
	}
	defer func() { _ = tx.Rollback() }()

	if err := lockWorkflowStepForCapacity(ctx, tx, r.db.DriverName(), r.db.Rebind, destinationStepID); err != nil {
		return false, err
	}
	if limit > 0 {
		var occupants int
		if err := tx.QueryRowContext(ctx, r.db.Rebind(`
			SELECT COUNT(*) FROM tasks
			WHERE workflow_step_id = ?
			  AND wip_admitted = 1
			  AND id != ?
			  AND archived_at IS NULL
			  AND is_ephemeral = 0`+andNotAutomationOrigin+`
		`), destinationStepID, task.ID).Scan(&occupants); err != nil {
			return false, err
		}
		if occupants >= limit {
			return false, nil
		}
	}
	queuePredicate := `
		  AND workflow_step_id = ?
		  AND (queued_for_step_id = ? OR queued_for_step_id = '' OR queued_for_step_id IS NULL)`
	predicateArgs := []interface{}{fromStepID, destinationStepID}
	if fromStepID == destinationStepID {
		// A same-step promotion is a claim on a visible queue row. Once the
		// first reconciler admits it, the row has no queue marker and must not
		// satisfy a second promotion attempt. The empty-marker form remains
		// reserved for legacy feeder rows below.
		queuePredicate = `
		  AND workflow_step_id = ?
		  AND wip_admitted = 0
		  AND queued_for_step_id = ?`
	}

	fromWorkflowID, _, _, err := r.readTaskStepInTx(ctx, tx, task.ID)
	if err != nil {
		return false, err
	}
	// See updateTaskTx's comment: stamped after the transactional lock, not
	// before BeginTx, so occurred_at reflects true commit-serialization order
	// under concurrent Postgres callers.
	task.UpdatedAt = time.Now().UTC()

	result, err := tx.ExecContext(ctx, r.db.Rebind(`
		UPDATE tasks SET workspace_id = ?, workflow_id = ?, workflow_step_id = ?, title = ?, description = ?, state = ?, priority = ?, position = ?, wip_admitted = ?, queued_for_step_id = ?, queued_at = ?, metadata = ?, parent_id = ?, updated_at = ?, origin = ?, project_id = ?, labels = ?, identifier = ?
		WHERE id = ?
		`+queuePredicate+`
		  AND archived_at IS NULL
		  AND is_ephemeral = 0`+andNotAutomationOrigin+`
	`), append([]interface{}{
		task.WorkspaceID, task.WorkflowID, task.WorkflowStepID, task.Title, task.Description, task.State, task.Priority, task.Position, dialect.BoolToInt(task.WIPAdmitted), task.QueuedForStepID, task.QueuedAt, string(metadata), task.ParentID, task.UpdatedAt, task.Origin, task.ProjectID, task.Labels, task.Identifier, task.ID,
	}, predicateArgs...)...)
	if err != nil {
		return false, err
	}
	rows, _ := result.RowsAffected()
	if rows == 0 {
		return false, nil
	}
	transitionID, err := r.recordStepTransition(ctx, tx, stepTransitionInput{
		taskID:             task.ID,
		fromWorkflowID:     fromWorkflowID,
		fromWorkflowStepID: fromStepID,
		toWorkflowID:       task.WorkflowID,
		toWorkflowStepID:   task.WorkflowStepID,
		occurredAt:         task.UpdatedAt,
	})
	if err != nil {
		return false, err
	}
	task.WorkflowStepTransitionID = transitionID
	entryID := formatEntryID(transitionID)
	if transitionID != 0 {
		task.FromWorkflowID = fromWorkflowID
		task.FromStepID = fromStepID
	} else {
		task.FromWorkflowID = ""
		task.FromStepID = ""
	}
	if err := syncRunnerInTx(ctx, tx, r.db.Rebind, task.WorkflowStepID, task.ID, task.AssigneeAgentProfileID); err != nil {
		return false, err
	}
	if err := tx.Commit(); err != nil {
		return false, err
	}
	r.dispatchStepEntry(ctx, task.ID, task.WorkflowID, task.WorkflowStepID, entryID)
	return true, nil
}

// DeleteTask deletes a task by ID
func (r *Repository) DeleteTask(ctx context.Context, id string) error {
	_, err := r.DeleteTaskWithVacatedStep(ctx, id)
	return err
}

// DeleteTaskWithVacatedStep deletes a task and returns the workflow step read
// under the same task-row lock as the deletion.
func (r *Repository) DeleteTaskWithVacatedStep(ctx context.Context, id string) (string, error) {
	tx, err := r.db.BeginTxx(ctx, nil)
	if err != nil {
		return "", err
	}
	defer func() { _ = tx.Rollback() }()
	// Serialize with session/worktree creation FIRST (task-row lock), then
	// capture the authoritative session set: a concurrent CreateTaskSession
	// holds the same task-row barrier, so every session committed before this
	// lock is visible to the capture and anything after blocks until the task
	// row is gone. Capturing before the lock could use a stale set (a session
	// created mid-flight would never be purged). The session capture must also
	// precede the task-row DELETE because task_sessions cascades on deletion.
	_, vacatedStepID, found, err := r.readTaskStepInTx(ctx, tx, id)
	if err != nil {
		return "", err
	}
	if !found {
		return "", fmt.Errorf("%w: %s", ErrTaskNotFound, id)
	}
	sessions, err := r.taskQueueSessionsInTx(ctx, tx, id)
	if err != nil {
		return "", err
	}
	result, err := tx.ExecContext(ctx, r.db.Rebind(`DELETE FROM tasks WHERE id = ?`), id)
	if err != nil {
		return "", err
	}

	rows, _ := result.RowsAffected()
	if rows == 0 {
		return "", fmt.Errorf("%w: %s", ErrTaskNotFound, id)
	}
	if err := r.purgeTaskQueueInTx(ctx, tx, id, sessions, true); err != nil {
		return "", err
	}
	if err := r.purgeQueueSessionPoliciesInTx(ctx, tx, sessions); err != nil {
		return "", err
	}
	if err := tx.Commit(); err != nil {
		return "", err
	}
	r.notifyTaskQueuePurged(ctx, id)
	return vacatedStepID, nil
}

// ListTasks returns all non-archived, non-ephemeral tasks for a workflow
func (r *Repository) ListTasks(ctx context.Context, workflowID string) ([]*models.Task, error) {
	ctx, span := tracing.Tracer("kandev-db").Start(ctx, "db.ListTasks")
	defer span.End()
	rows, err := r.ro.QueryContext(ctx, r.ro.Rebind(`
		SELECT `+taskSelectColumns("t")+`
		FROM tasks t
		WHERE t.workflow_id = ? AND t.archived_at IS NULL AND t.is_ephemeral = 0`+andNotAutomationOriginT+`
		ORDER BY t.created_at ASC
	`), workflowID)
	if err != nil {
		return nil, err
	}
	defer func() { _ = rows.Close() }()

	return r.scanTasks(rows)
}

// CountTasksByWorkflow returns the number of non-archived, non-ephemeral tasks in a workflow
func (r *Repository) CountTasksByWorkflow(ctx context.Context, workflowID string) (int, error) {
	var count int
	err := r.ro.QueryRowContext(ctx, r.ro.Rebind(`SELECT COUNT(*) FROM tasks WHERE workflow_id = ? AND archived_at IS NULL AND is_ephemeral = 0`+andNotAutomationOrigin), workflowID).Scan(&count)
	if err != nil {
		return 0, err
	}
	return count, nil
}

// CountTasksByWorkflowStep returns the number of non-archived, non-ephemeral tasks in a workflow step
func (r *Repository) CountTasksByWorkflowStep(ctx context.Context, stepID string) (int, error) {
	var count int
	err := r.ro.QueryRowContext(ctx, r.ro.Rebind(`SELECT COUNT(*) FROM tasks WHERE workflow_step_id = ? AND archived_at IS NULL AND is_ephemeral = 0`+andNotAutomationOrigin), stepID).Scan(&count)
	if err != nil {
		return 0, err
	}
	return count, nil
}

// CountTasksByWorkflowStepExcludingTask returns active, admitted WIP occupants
// in a workflow step, excluding the task currently being moved.
func (r *Repository) CountTasksByWorkflowStepExcludingTask(ctx context.Context, stepID, excludeTaskID string) (int, error) {
	var count int
	err := r.ro.QueryRowContext(ctx, r.ro.Rebind(`
		SELECT COUNT(*) FROM tasks
		WHERE workflow_step_id = ?
		  AND id != ?
		  AND wip_admitted = 1
		  AND archived_at IS NULL
		  AND is_ephemeral = 0`+andNotAutomationOrigin+`
	`), stepID, excludeTaskID).Scan(&count)
	if err != nil {
		return 0, err
	}
	return count, nil
}

// CountAdmittedTasksByWorkflowStep returns the active WIP occupants of a
// workflow step, excluding visible queued overflow cards.
func (r *Repository) CountAdmittedTasksByWorkflowStep(ctx context.Context, stepID string) (int, error) {
	var count int
	err := r.ro.QueryRowContext(ctx, r.ro.Rebind(`
		SELECT COUNT(*) FROM tasks
		WHERE workflow_step_id = ?
		  AND wip_admitted = 1
		  AND archived_at IS NULL
		  AND is_ephemeral = 0`+andNotAutomationOrigin+`
	`), stepID).Scan(&count)
	return count, err
}

// NextPullCandidate returns the next active, visible task from a feeder step.
func (r *Repository) NextPullCandidate(ctx context.Context, stepID, excludeTaskID string) (*models.Task, error) {
	excludeTaskIDs := []string(nil)
	if excludeTaskID != "" {
		excludeTaskIDs = append(excludeTaskIDs, excludeTaskID)
	}
	return r.NextPullCandidateExcluding(ctx, stepID, excludeTaskIDs)
}

// NextPullCandidateExcluding returns the next active, visible task from a
// feeder step, skipping any candidate IDs the caller already tried.
func (r *Repository) NextPullCandidateExcluding(ctx context.Context, stepID string, excludeTaskIDs []string) (*models.Task, error) {
	args := []any{stepID}
	excludeClause := ""
	if len(excludeTaskIDs) > 0 {
		placeholders := make([]string, 0, len(excludeTaskIDs))
		for _, id := range excludeTaskIDs {
			if id == "" {
				continue
			}
			placeholders = append(placeholders, "?")
			args = append(args, id)
		}
		if len(placeholders) > 0 {
			excludeClause = " AND t.id NOT IN (" + strings.Join(placeholders, ", ") + ")"
		}
	}
	row := r.ro.QueryRowContext(ctx, r.ro.Rebind(`
			SELECT `+taskSelectColumns("t")+`
			FROM tasks t
			WHERE t.workflow_step_id = ?
			  AND t.archived_at IS NULL
			  AND t.is_ephemeral = 0`+andNotAutomationOriginT+`
			  AND (t.queued_for_step_id = '' OR t.queued_for_step_id IS NULL)
			  `+excludeClause+`
			ORDER BY
			  t.position ASC,
			  CASE LOWER(COALESCE(t.priority, ''))
		    WHEN 'critical' THEN 0
		    WHEN 'high' THEN 1
		    WHEN 'medium' THEN 2
		    WHEN 'low' THEN 3
		    WHEN 'none' THEN 4
		    ELSE 4
		  END ASC,
		  t.created_at ASC,
			  t.id ASC
			LIMIT 1
		`), args...)
	task, err := r.scanSingleTask(row)
	if err == sql.ErrNoRows {
		return nil, nil
	}
	return task, err
}

// NextQueuedTaskForStepExcluding returns the next task queued for destination
// from a feeder. Empty queue destinations preserve legacy feeder pull behavior.
func (r *Repository) NextQueuedTaskForStepExcluding(ctx context.Context, feederStepID, destinationStepID string, excludeTaskIDs []string) (*models.Task, error) {
	args := []any{feederStepID, destinationStepID}
	excludeClause := ""
	if len(excludeTaskIDs) > 0 {
		placeholders := make([]string, 0, len(excludeTaskIDs))
		for _, id := range excludeTaskIDs {
			if id == "" {
				continue
			}
			placeholders = append(placeholders, "?")
			args = append(args, id)
		}
		if len(placeholders) > 0 {
			excludeClause = " AND t.id NOT IN (" + strings.Join(placeholders, ", ") + ")"
		}
	}
	row := r.ro.QueryRowContext(ctx, r.ro.Rebind(`
		SELECT `+taskSelectColumns("t")+`
		FROM tasks t
		WHERE t.workflow_step_id = ?
		  AND t.archived_at IS NULL
		  AND t.is_ephemeral = 0`+andNotAutomationOriginT+`
		  AND (t.queued_for_step_id = '' OR t.queued_for_step_id IS NULL OR t.queued_for_step_id = ?)
		  `+excludeClause+`
		ORDER BY
		  t.position ASC,
		  CASE LOWER(COALESCE(t.priority, ''))
		    WHEN 'critical' THEN 0
		    WHEN 'high' THEN 1
		    WHEN 'medium' THEN 2
		    WHEN 'low' THEN 3
		    WHEN 'none' THEN 4
		    ELSE 4
		  END ASC,
		  COALESCE(t.queued_at, t.created_at) ASC,
		  t.created_at ASC,
		  t.id ASC
		LIMIT 1
	`), args...)
	task, err := r.scanSingleTask(row)
	if err == sql.ErrNoRows {
		return nil, nil
	}
	return task, err
}

// ListChildren returns non-archived, non-ephemeral children of parentID.
// Returns an empty list when parentID is empty (so root tasks resolve to
// "no children" cleanly).
func (r *Repository) ListChildren(ctx context.Context, parentID string) ([]*models.Task, error) {
	if parentID == "" {
		return []*models.Task{}, nil
	}
	rows, err := r.ro.QueryContext(ctx, r.ro.Rebind(`
		SELECT `+taskSelectColumns("t")+`
		FROM tasks t
		WHERE t.parent_id = ? AND t.archived_at IS NULL AND t.is_ephemeral = 0`+andNotAutomationOriginT+`
		ORDER BY t.created_at ASC, t.id ASC
	`), parentID)
	if err != nil {
		return nil, err
	}
	defer func() { _ = rows.Close() }()
	return r.scanTasks(rows)
}

// ListChildCompletionRows returns active direct children with the compact
// fields needed for on_children_completed readiness and operation idempotency.
func (r *Repository) ListChildCompletionRows(ctx context.Context, parentID string) ([]models.ChildCompletionRow, error) {
	if parentID == "" {
		return []models.ChildCompletionRow{}, nil
	}
	var rows []models.ChildCompletionRow
	err := r.ro.SelectContext(ctx, &rows, r.ro.Rebind(`
		SELECT id, state, title, workflow_step_id, updated_at
		FROM tasks
		WHERE parent_id = ? AND archived_at IS NULL AND is_ephemeral = 0`+andNotAutomationOrigin+`
		ORDER BY created_at ASC, id ASC
	`), parentID)
	if err != nil {
		return nil, err
	}
	return rows, nil
}

// ListChildrenIncludingArchived returns every child task of parentID
// regardless of archived state. Used by the office task-handoffs
// unarchive cascade (phase 6) to walk a previously-archived descendant
// subtree.
func (r *Repository) ListChildrenIncludingArchived(ctx context.Context, parentID string) ([]*models.Task, error) {
	if parentID == "" {
		return []*models.Task{}, nil
	}
	rows, err := r.ro.QueryContext(ctx, r.ro.Rebind(`
		SELECT `+taskSelectColumns("t")+`
		FROM tasks t
		WHERE t.parent_id = ? AND t.is_ephemeral = 0`+andNotAutomationOriginT+`
		ORDER BY t.created_at ASC, t.id ASC
	`), parentID)
	if err != nil {
		return nil, err
	}
	defer func() { _ = rows.Close() }()
	return r.scanTasks(rows)
}

// ReparentDirectChildren swaps the parent_id of every row matching
// oldParentID (archived or not) to newParentID. Used by no-cascade
// delete so the soon-to-be-orphaned direct children become roots
// instead of pointing at a row that's about to vanish.
func (r *Repository) ReparentDirectChildren(ctx context.Context, oldParentID, newParentID string) error {
	if oldParentID == "" {
		return nil
	}
	_, err := r.db.ExecContext(ctx, r.db.Rebind(`
		UPDATE tasks SET parent_id = ?, updated_at = ?
		WHERE parent_id = ?
	`), newParentID, time.Now().UTC(), oldParentID)
	return err
}

// ListSiblings returns non-archived, non-ephemeral sibling tasks. A task
// is a sibling when parent_id matches AND the parent_id is non-empty AND
// the workspace matches. Root tasks (empty parent_id) deliberately return
// an empty list so unrelated workspace roots don't surface as siblings.
func (r *Repository) ListSiblings(ctx context.Context, taskID string) ([]*models.Task, error) {
	self, err := r.GetTask(ctx, taskID)
	if err != nil {
		return nil, err
	}
	if self == nil || self.ParentID == "" {
		return []*models.Task{}, nil
	}
	rows, err := r.ro.QueryContext(ctx, r.ro.Rebind(`
		SELECT `+taskSelectColumns("t")+`
		FROM tasks t
		WHERE t.parent_id = ?
		  AND t.workspace_id = ?
		  AND t.id != ?
		  AND t.archived_at IS NULL
		  AND t.is_ephemeral = 0`+andNotAutomationOriginT+`
		ORDER BY t.created_at ASC, t.id ASC
	`), self.ParentID, self.WorkspaceID, self.ID)
	if err != nil {
		return nil, err
	}
	defer func() { _ = rows.Close() }()
	return r.scanTasks(rows)
}

// ListTasksByWorkflowStep returns all non-archived, non-ephemeral tasks in a workflow step
func (r *Repository) ListTasksByWorkflowStep(ctx context.Context, workflowStepID string) ([]*models.Task, error) {
	rows, err := r.ro.QueryContext(ctx, r.ro.Rebind(`
		SELECT `+taskSelectColumns("t")+`
		FROM tasks t
		WHERE t.workflow_step_id = ? AND t.archived_at IS NULL AND t.is_ephemeral = 0`+andNotAutomationOriginT+` ORDER BY t.created_at ASC
	`), workflowStepID)
	if err != nil {
		return nil, err
	}
	defer func() { _ = rows.Close() }()

	return r.scanTasks(rows)
}

// ListQueuedTasks returns non-archived, non-ephemeral tasks that are waiting
// for admission into a workflow step. It is used by startup reconciliation.
func (r *Repository) ListQueuedTasks(ctx context.Context) ([]*models.Task, error) {
	rows, err := r.ro.QueryContext(ctx, r.ro.Rebind(`
		SELECT `+taskSelectColumns("t")+`
		FROM tasks t
		WHERE t.queued_for_step_id IS NOT NULL AND t.queued_for_step_id != ''
		  AND t.archived_at IS NULL AND t.is_ephemeral = 0`+andNotAutomationOriginT+`
		ORDER BY t.queued_at ASC, t.created_at ASC, t.id ASC
	`))
	if err != nil {
		return nil, err
	}
	defer func() { _ = rows.Close() }()
	return r.scanTasks(rows)
}

// ListTasksWithMetadataKey returns active, non-ephemeral tasks carrying a
// named metadata key. It is used by startup lifecycle recovery, where queue
// destination columns alone cannot find already-admitted work whose entry or
// source-exit side effect still needs to run.
func (r *Repository) ListTasksWithMetadataKey(ctx context.Context, key string) ([]*models.Task, error) {
	var predicate, path string
	if dialect.IsPostgres(r.ro.DriverName()) {
		predicate = "jsonb_extract_path(CASE WHEN t.metadata IS NULL OR t.metadata = 'null' OR t.metadata = '' THEN '{}'::jsonb ELSE t.metadata::jsonb END, ?) IS NOT NULL"
		path = key
	} else {
		predicate = "json_type(CASE WHEN t.metadata IS NULL OR t.metadata = 'null' OR t.metadata = '' THEN '{}' ELSE t.metadata END, ?) IS NOT NULL"
		path = jsonPath(key)
	}
	rows, err := r.ro.QueryContext(ctx, r.ro.Rebind(`
		SELECT `+taskSelectColumns("t")+`
		FROM tasks t
		WHERE `+predicate+`
		  AND t.archived_at IS NULL
		  AND t.is_ephemeral = 0`+andNotAutomationOriginT+`
		ORDER BY t.updated_at ASC, t.created_at ASC, t.id ASC
	`), path)
	if err != nil {
		return nil, err
	}
	defer func() { _ = rows.Close() }()
	return r.scanTasks(rows)
}

// ListTasksByWorkspace returns paginated tasks for a workspace with total count
// If query is non-empty, filters by task title, description, repository name, or repository path
// If includeArchived is false, archived tasks are excluded. If onlyArchived
// is true, only archived tasks are returned and it takes precedence over
// includeArchived.
// If includeEphemeral is false, ephemeral tasks are excluded
// If onlyEphemeral is true, only ephemeral tasks are returned
func (r *Repository) ListTasksByWorkspace(ctx context.Context, workspaceID, workflowID, repositoryID, query string, page, pageSize int, sort string, includeArchived, includeEphemeral, onlyEphemeral, excludeConfig bool) ([]*models.Task, int, error) {
	return r.ListTasksByWorkspaceWithArchiveMode(ctx, workspaceID, workflowID, repositoryID, query, page, pageSize, sort, includeArchived, includeEphemeral, onlyEphemeral, excludeConfig, false)
}

// ListTasksByWorkspaceWithArchiveMode is the additive workspace-list contract
// used by the sidebar archive view. onlyArchived takes precedence over
// includeArchived when both are true.
func (r *Repository) ListTasksByWorkspaceWithArchiveMode(ctx context.Context, workspaceID, workflowID, repositoryID, query string, page, pageSize int, sort string, includeArchived, includeEphemeral, onlyEphemeral, excludeConfig, onlyArchived bool) ([]*models.Task, int, error) {
	ctx, span := tracing.Tracer("kandev-db").Start(ctx, "db.ListTasksByWorkspace")
	defer span.End()
	// Calculate offset
	offset := (page - 1) * pageSize
	if offset < 0 {
		offset = 0
	}
	sort = usermodels.NormalizeTasksListSort(sort)

	// Build filter conditions
	filter := ""
	if onlyEphemeral {
		// Only ephemeral tasks
		filter += " AND is_ephemeral = 1"
	} else if !includeEphemeral {
		// Exclude ephemeral tasks
		filter += " AND is_ephemeral = 0"
	}
	// If includeEphemeral is true and onlyEphemeral is false, include both
	// Automation runs are excluded regardless of the ephemeral toggles: they
	// are hidden by provenance, and "include quick chats" is not a request to
	// see them.
	filter += andNotAutomationOrigin

	if onlyArchived {
		filter += " AND archived_at IS NOT NULL"
	} else if !includeArchived {
		filter += " AND archived_at IS NULL"
	}

	if excludeConfig {
		filter += " AND " + excludeConfigModePredicate(r.ro.DriverName(), "metadata")
	}

	var rows *sql.Rows
	var total int
	var err error

	if query == "" {
		rows, total, err = r.queryAllTasks(ctx, workspaceID, filter, workflowID, repositoryID, pageSize, offset, sort)
	} else {
		rows, total, err = r.searchTasks(ctx, workspaceID, query, filter, workflowID, repositoryID, pageSize, offset, sort)
	}

	if err != nil {
		return nil, 0, err
	}
	defer func() { _ = rows.Close() }()

	tasks, err := r.scanTasks(rows)
	if err != nil {
		return nil, 0, err
	}

	return tasks, total, nil
}

// queryAllTasks fetches all tasks (no search) for a workspace with pagination.
func (r *Repository) queryAllTasks(ctx context.Context, workspaceID, taskFilter, workflowID, repositoryID string, pageSize, offset int, sort string) (*sql.Rows, int, error) {
	args := []interface{}{workspaceID}
	if workflowID != "" {
		taskFilter += " AND workflow_id = ?"
		args = append(args, workflowID)
	}
	if repositoryID != "" {
		taskFilter += " AND id IN (SELECT task_id FROM task_repositories WHERE repository_id = ?)"
		args = append(args, repositoryID)
	}
	var total int
	if err := r.ro.QueryRowContext(ctx, r.ro.Rebind(`SELECT COUNT(*) FROM tasks WHERE workspace_id = ?`+taskFilter), args...).Scan(&total); err != nil {
		return nil, 0, err
	}
	rows, err := r.ro.QueryContext(ctx, r.ro.Rebind(`
		SELECT `+taskSelectColumns("t")+`
		FROM tasks t
		WHERE t.workspace_id = ?`+rewriteFilterForAlias(taskFilter, "t")+`
		ORDER BY `+taskListOrderBy(r.ro.DriverName(), "t", sort)+`
		LIMIT ? OFFSET ?
	`), append(append([]interface{}{}, args...), pageSize, offset)...)
	return rows, total, err
}

func taskListOrderBy(driver, alias, sort string) string {
	prefix := alias + "."
	switch sort {
	case usermodels.TasksListSortUpdatedAsc:
		return prefix + "updated_at ASC, " + taskTitleOrder(driver, prefix, "ASC") + ", " + prefix + "id ASC"
	case usermodels.TasksListSortCreatedDesc:
		return prefix + "created_at DESC, " + taskTitleOrder(driver, prefix, "ASC") + ", " + prefix + "id ASC"
	case usermodels.TasksListSortCreatedAsc:
		return prefix + "created_at ASC, " + taskTitleOrder(driver, prefix, "ASC") + ", " + prefix + "id ASC"
	case usermodels.TasksListSortTitleAsc:
		return taskTitleOrder(driver, prefix, "ASC") + ", " + prefix + "updated_at DESC, " + prefix + "id ASC"
	case usermodels.TasksListSortTitleDesc:
		return taskTitleOrder(driver, prefix, "DESC") + ", " + prefix + "updated_at DESC, " + prefix + "id ASC"
	case usermodels.TasksListSortUpdatedDesc:
		fallthrough
	default:
		return prefix + "updated_at DESC, " + taskTitleOrder(driver, prefix, "ASC") + ", " + prefix + "id ASC"
	}
}

func taskTitleOrder(driver, prefix, direction string) string {
	if dialect.IsPostgres(driver) {
		return "LOWER(" + prefix + "title) " + direction + ", " + prefix + "title " + direction
	}
	return prefix + "title COLLATE NOCASE " + direction
}

// rewriteFilterForAlias prefixes bare column references in `filter` with
// the given alias. Only used for the small, controlled fragments built
// in queryAllTasks and searchTasks.
func rewriteFilterForAlias(filter, alias string) string {
	if alias == "" {
		return filter
	}
	out := filter
	for _, col := range []string{"is_ephemeral", "archived_at", "metadata", "workflow_id", "origin"} {
		// Replace " <col>" only when not already prefixed by `alias.`.
		out = simplePrefixCol(out, col, alias)
	}
	return out
}

// simplePrefixCol replaces standalone occurrences of column names in
// SQL fragments with their aliased form. Naïve string substitution but
// adequate for the filters built locally above.
func simplePrefixCol(s, col, alias string) string {
	if s == "" {
		return s
	}
	prefix := alias + "."
	out := ""
	i := 0
	for i < len(s) {
		idx := indexFrom(s, col, i)
		if idx == -1 {
			out += s[i:]
			break
		}
		// Boundary check: char before must not be alphanumeric or '.'.
		if idx > 0 {
			c := s[idx-1]
			if c == '.' || isWordByte(c) {
				out += s[i : idx+len(col)]
				i = idx + len(col)
				continue
			}
		}
		// Boundary after: char after must not be alphanumeric.
		end := idx + len(col)
		if end < len(s) && isWordByte(s[end]) {
			out += s[i : idx+len(col)]
			i = idx + len(col)
			continue
		}
		out += s[i:idx] + prefix + col
		i = end
	}
	return out
}

func indexFrom(s, sub string, from int) int {
	for i := from; i+len(sub) <= len(s); i++ {
		if s[i:i+len(sub)] == sub {
			return i
		}
	}
	return -1
}

func isWordByte(b byte) bool {
	return (b >= 'a' && b <= 'z') || (b >= 'A' && b <= 'Z') || (b >= '0' && b <= '9') || b == '_'
}

// searchTasks fetches tasks matching a search query for a workspace with pagination.
func (r *Repository) searchTasks(ctx context.Context, workspaceID, query, filter, workflowID, repositoryID string, pageSize, offset int, sort string) (*sql.Rows, int, error) {
	searchPattern := "%" + query + "%"
	like := dialect.Like(r.ro.DriverName())

	// Reuse the same archive, ephemeral, and config predicates as the
	// non-search path so count and page results cannot diverge by mode.
	tFilter := rewriteFilterForAlias(filter, "t")

	// Collect extra filter args in query-argument order
	var extraArgs []interface{}
	if workflowID != "" {
		tFilter += " AND t.workflow_id = ?"
		extraArgs = append(extraArgs, workflowID)
	}
	if repositoryID != "" {
		tFilter += " AND tr.repository_id = ?"
		extraArgs = append(extraArgs, repositoryID)
	}

	countQuery := fmt.Sprintf(`
		SELECT COUNT(DISTINCT t.id) FROM tasks t
		LEFT JOIN task_repositories tr ON t.id = tr.task_id
		LEFT JOIN repositories r ON tr.repository_id = r.id
		WHERE t.workspace_id = ?%s
		AND (
			t.title %s ? OR
			t.description %s ? OR
			r.name %s ? OR
			r.local_path %s ?
		)
	`, tFilter, like, like, like, like)
	countArgs := append(append([]interface{}{workspaceID}, extraArgs...), searchPattern, searchPattern, searchPattern, searchPattern)
	var total int
	if err := r.ro.QueryRowContext(ctx, r.ro.Rebind(countQuery), countArgs...).Scan(&total); err != nil {
		return nil, 0, err
	}

	selectQuery := taskSearchSelectQuery(r.ro.DriverName(), tFilter, like, sort)
	selectArgs := append(append([]interface{}{}, countArgs...), pageSize, offset)
	rows, err := r.ro.QueryContext(ctx, r.ro.Rebind(selectQuery), selectArgs...)
	return rows, total, err
}

func taskSearchSelectQuery(driver, tFilter, like, sort string) string {
	return fmt.Sprintf(`
		SELECT %s
		FROM (
			SELECT DISTINCT %s
			FROM tasks t
			LEFT JOIN task_repositories tr ON t.id = tr.task_id
			LEFT JOIN repositories r ON tr.repository_id = r.id
			WHERE t.workspace_id = ?%s
			AND (
				t.title %s ? OR
				t.description %s ? OR
				r.name %s ? OR
				r.local_path %s ?
			)
		) task_search
		ORDER BY %s
		LIMIT ? OFFSET ?
	`, taskProjectedColumns("task_search"), taskSelectColumns("t"), tFilter, like, like, like, like, taskListOrderBy(driver, "task_search", sort))
}

// scanSingleTask scans a single row into a Task.
func (r *Repository) scanSingleTask(row *sql.Row) (*models.Task, error) {
	task := &models.Task{}
	var metadata string
	var archivedAt sql.NullTime
	var queuedAt sql.NullTime
	var identifier sql.NullString
	var externalID sql.NullString
	var externalIDSettledAt sql.NullTime
	err := row.Scan(
		&task.ID, &task.WorkspaceID, &task.WorkflowID, &task.WorkflowStepID,
		&task.Title, &task.Description, &task.State, &task.Priority, &task.Position,
		&task.WIPAdmitted, &task.QueuedForStepID, &queuedAt,
		&metadata, &task.IsEphemeral, &task.ParentID, &task.Autopilot, &archivedAt, &task.ArchivedByCascadeID,
		&task.CreatedAt, &task.UpdatedAt,
		&task.AssigneeAgentProfileID, &task.AssigneeUserID, &task.Origin, &task.ProjectID,
		&task.Labels, &identifier, &externalID, &externalIDSettledAt, &task.IsFromOffice,
	)
	if err != nil {
		return nil, err
	}
	if archivedAt.Valid {
		task.ArchivedAt = &archivedAt.Time
	}
	if queuedAt.Valid {
		task.QueuedAt = &queuedAt.Time
	}
	if identifier.Valid {
		task.Identifier = identifier.String
	}
	if externalID.Valid {
		task.ExternalID = externalID.String
	}
	if externalIDSettledAt.Valid {
		task.ExternalIDSettledAt = &externalIDSettledAt.Time
	}
	_ = json.Unmarshal([]byte(metadata), &task.Metadata)
	return task, nil
}

// scanTasks is a helper to scan task rows
func (r *Repository) scanTasks(rows *sql.Rows) ([]*models.Task, error) {
	var result []*models.Task
	for rows.Next() {
		task := &models.Task{}
		var metadata string
		var archivedAt sql.NullTime
		var queuedAt sql.NullTime
		var identifier sql.NullString
		var externalID sql.NullString
		var externalIDSettledAt sql.NullTime
		err := rows.Scan(
			&task.ID, &task.WorkspaceID, &task.WorkflowID, &task.WorkflowStepID,
			&task.Title, &task.Description, &task.State, &task.Priority, &task.Position,
			&task.WIPAdmitted, &task.QueuedForStepID, &queuedAt,
			&metadata, &task.IsEphemeral, &task.ParentID, &task.Autopilot, &archivedAt, &task.ArchivedByCascadeID,
			&task.CreatedAt, &task.UpdatedAt,
			&task.AssigneeAgentProfileID, &task.AssigneeUserID, &task.Origin, &task.ProjectID,
			&task.Labels, &identifier, &externalID, &externalIDSettledAt, &task.IsFromOffice,
		)
		if err != nil {
			return nil, err
		}
		if archivedAt.Valid {
			task.ArchivedAt = &archivedAt.Time
		}
		if queuedAt.Valid {
			task.QueuedAt = &queuedAt.Time
		}
		if identifier.Valid {
			task.Identifier = identifier.String
		}
		if externalID.Valid {
			task.ExternalID = externalID.String
		}
		if externalIDSettledAt.Valid {
			task.ExternalIDSettledAt = &externalIDSettledAt.Time
		}
		_ = json.Unmarshal([]byte(metadata), &task.Metadata)
		result = append(result, task)
	}
	return result, rows.Err()
}

// GetTasksByIDs fetches multiple tasks in a single query. Missing IDs are
// silently omitted; result order is not guaranteed, so callers that need a
// specific order should reorder by ID themselves.
func (r *Repository) GetTasksByIDs(ctx context.Context, ids []string) ([]*models.Task, error) {
	if len(ids) == 0 {
		return nil, nil
	}
	placeholders := make([]string, len(ids))
	args := make([]interface{}, len(ids))
	for i, id := range ids {
		placeholders[i] = "?"
		args[i] = id
	}
	query := fmt.Sprintf(`SELECT %s FROM tasks t WHERE t.id IN (%s)`,
		taskSelectColumns("t"), strings.Join(placeholders, ","))
	rows, err := r.ro.QueryContext(ctx, r.ro.Rebind(query), args...)
	if err != nil {
		return nil, err
	}
	defer func() { _ = rows.Close() }()
	return r.scanTasks(rows)
}

// ArchiveTask sets the archived_at timestamp on a task
func (r *Repository) ArchiveTask(ctx context.Context, id string) error {
	now := time.Now().UTC()
	tx, err := r.db.BeginTxx(ctx, nil)
	if err != nil {
		return err
	}
	defer func() { _ = tx.Rollback() }()
	result, err := tx.ExecContext(ctx, r.db.Rebind(`UPDATE tasks SET archived_at = ?, updated_at = ? WHERE id = ?`), now, now, id)
	if err != nil {
		return err
	}
	rows, _ := result.RowsAffected()
	if rows == 0 {
		return fmt.Errorf("%w: %s", ErrTaskNotFound, id)
	}
	sessions, err := r.taskQueueSessionsInTx(ctx, tx, id)
	if err != nil {
		return err
	}
	if err := r.purgeTaskQueueInTx(ctx, tx, id, sessions, false); err != nil {
		return err
	}
	if err := tx.Commit(); err != nil {
		return err
	}
	r.notifyTaskQueuePurged(ctx, id)
	return nil
}

// ArchiveTaskIfActive is the CAS variant used by office task-handoffs
// cascade archives. The update only fires when the task is currently
// active (archived_at IS NULL); this lets the cascade walk all
// descendants and archive only the ones not already archived by an
// earlier (manual or cascade) archive. Returns whether the row was
// actually updated.
//
// cascadeID is stamped on the archived row so UnarchiveTaskByCascade
// can scope its restoration to exactly the tasks this cascade owned.
// Pass empty cascadeID to opt out of cascade tracking (single-task
// manual archive); the column will simply not get set.
func (r *Repository) ArchiveTaskIfActive(ctx context.Context, id, cascadeID string) (bool, error) {
	_, changed, err := r.ArchiveTaskIfActiveWithVacatedStep(ctx, id, cascadeID)
	return changed, err
}

// ArchiveTaskIfActiveWithVacatedStep archives an active task and returns the
// workflow step read under the same task-row lock as the archive mutation.
func (r *Repository) ArchiveTaskIfActiveWithVacatedStep(
	ctx context.Context,
	id string,
	cascadeID string,
) (string, bool, error) {
	tx, err := r.db.BeginTxx(ctx, nil)
	if err != nil {
		return "", false, err
	}
	defer func() { _ = tx.Rollback() }()
	_, vacatedStepID, found, err := r.readTaskStepInTx(ctx, tx, id)
	if err != nil {
		return "", false, err
	}
	if !found {
		return "", false, tx.Commit()
	}
	now := time.Now().UTC()
	result, err := tx.ExecContext(ctx, r.db.Rebind(`
		UPDATE tasks SET archived_at = ?, archived_by_cascade_id = ?, updated_at = ?
		WHERE id = ? AND archived_at IS NULL
	`), now, cascadeID, now, id)
	if err != nil {
		return "", false, err
	}
	rows, _ := result.RowsAffected()
	if rows == 0 {
		return "", false, tx.Commit()
	}
	sessions, err := r.taskQueueSessionsInTx(ctx, tx, id)
	if err != nil {
		return "", false, err
	}
	if err := r.purgeTaskQueueInTx(ctx, tx, id, sessions, false); err != nil {
		return "", false, err
	}
	if err := tx.Commit(); err != nil {
		return "", false, err
	}
	r.notifyTaskQueuePurged(ctx, id)
	return vacatedStepID, true, nil
}

// taskQueueSessionsInTx returns the task's authoritative session set (its
// task_sessions rows). Callers must capture it BEFORE any statement that
// deletes the task row: task_sessions cascades on task deletion, so a
// post-delete discovery returns nothing and a concurrent admission to an
// empty session could survive the purge.
func (r *Repository) taskQueueSessionsInTx(ctx context.Context, tx *sqlx.Tx, taskID string) ([]string, error) {
	var sessions []string
	rows, err := tx.QueryxContext(ctx, r.db.Rebind(`SELECT id FROM task_sessions WHERE task_id = ?`), taskID)
	if err != nil {
		return nil, fmt.Errorf("list task purge sessions: %w", err)
	}
	for rows.Next() {
		var sessionID string
		if err := rows.Scan(&sessionID); err != nil {
			_ = rows.Close()
			return nil, fmt.Errorf("scan task purge session: %w", err)
		}
		sessions = append(sessions, sessionID)
	}
	if err := rows.Err(); err != nil {
		_ = rows.Close()
		return nil, fmt.Errorf("iterate task purge sessions: %w", err)
	}
	if err := rows.Close(); err != nil {
		return nil, fmt.Errorf("close task purge sessions: %w", err)
	}
	return sessions, nil
}

func (r *Repository) purgeTaskQueueInTx(
	ctx context.Context,
	tx *sqlx.Tx,
	taskID string,
	sessions []string,
	deleteTask bool,
) error {
	r.notifyTaskQueuePurging(ctx, taskID)
	if dialect.IsPostgres(r.db.DriverName()) {
		return r.purgeTaskQueuePostgres(ctx, tx, taskID, sessions, deleteTask)
	}
	queuedIDs, err := r.archiveQueuedIDsOrNil(ctx, tx, taskID, deleteTask)
	if err != nil {
		if internaldb.IsMissingTableError(err) {
			return nil
		}
		return err
	}
	if _, err := messagequeue.PurgeTaskInTransaction(ctx, tx, r.db, taskID, sessions); err != nil {
		if internaldb.IsMissingTableError(err) {
			return nil
		}
		return err
	}
	if deleteTask {
		return nil
	}
	return r.releaseUnreferencedTaskAttachmentClaimsTx(ctx, tx, taskID, queuedIDs)
}

// purgeTaskQueuePostgres purges under a savepoint so a missing queue schema
// does not abort the enclosing archive/delete transaction. The attachment
// release runs after the savepoint is released, with no cursor open across
// statements on the single-connection transaction.
func (r *Repository) purgeTaskQueuePostgres(
	ctx context.Context,
	tx *sqlx.Tx,
	taskID string,
	sessions []string,
	deleteTask bool,
) error {
	if _, err := tx.ExecContext(ctx, "SAVEPOINT purge_task_queue"); err != nil {
		return err
	}
	queuedIDs, err := r.archiveQueuedIDsOrNil(ctx, tx, taskID, deleteTask)
	if err != nil {
		return r.abortPurgeSavepoint(ctx, tx, err)
	}
	if _, err := messagequeue.PurgeTaskInTransaction(ctx, tx, r.db, taskID, sessions); err != nil {
		return r.abortPurgeSavepoint(ctx, tx, err)
	}
	if _, err := tx.ExecContext(ctx, "RELEASE SAVEPOINT purge_task_queue"); err != nil {
		return err
	}
	if deleteTask {
		return nil
	}
	return r.releaseUnreferencedTaskAttachmentClaimsTx(ctx, tx, taskID, queuedIDs)
}

// archiveQueuedIDsOrNil collects the pre-purge queued attachment set for the
// archive release. The delete path needs no ownership set. A missing queue
// schema means bare task storage with no queue-owned claims.
func (r *Repository) archiveQueuedIDsOrNil(
	ctx context.Context,
	tx *sqlx.Tx,
	taskID string,
	deleteTask bool,
) (map[string]struct{}, error) {
	if deleteTask {
		return nil, nil
	}
	queuedIDs, err := r.queuedAttachmentIDsForTaskTx(ctx, tx, taskID)
	if err != nil {
		return nil, err
	}
	return queuedIDs, nil
}

// abortPurgeSavepoint rolls back the purge savepoint. A missing queue schema
// is not an archive failure: bare task repositories never had queue rows, so
// there is nothing queue-owned to release.
func (r *Repository) abortPurgeSavepoint(ctx context.Context, tx *sqlx.Tx, cause error) error {
	if _, rbErr := tx.ExecContext(ctx, "ROLLBACK TO SAVEPOINT purge_task_queue"); rbErr != nil {
		return cause
	}
	if _, relErr := tx.ExecContext(ctx, "RELEASE SAVEPOINT purge_task_queue"); relErr != nil {
		return cause
	}
	if internaldb.IsMissingTableError(cause) {
		return nil
	}
	return cause
}

func (r *Repository) purgeQueueSessionPoliciesInTx(
	ctx context.Context,
	tx *sqlx.Tx,
	sessionIDs []string,
) error {
	for _, sessionID := range sessionIDs {
		if _, err := tx.ExecContext(
			ctx,
			r.db.Rebind(`DELETE FROM queue_session_state WHERE session_id = ?`),
			sessionID,
		); err != nil {
			if internaldb.IsMissingTableError(err) {
				return nil
			}
			return fmt.Errorf("purge queue session policy for %s: %w", sessionID, err)
		}
	}
	return nil
}

// UnarchiveTaskByCascade clears archived_at + archived_by_cascade_id only
// when the row was archived by the named cascade. Manually-archived tasks
// (empty cascade id) and tasks owned by a different cascade are left
// untouched — fixing the resurrection bug where unarchiving a parent
// would also un-archive descendants the user had archived manually
// before the cascade ran.
func (r *Repository) UnarchiveTaskByCascade(ctx context.Context, id, cascadeID string) (bool, error) {
	if cascadeID == "" {
		return false, fmt.Errorf("cascadeID is required")
	}
	result, err := r.db.ExecContext(ctx, r.db.Rebind(`
		UPDATE tasks SET archived_at = NULL, archived_by_cascade_id = '', updated_at = ?
		WHERE id = ? AND archived_by_cascade_id = ?
	`), time.Now().UTC(), id, cascadeID)
	if err != nil {
		return false, err
	}
	rows, _ := result.RowsAffected()
	return rows > 0, nil
}

// UnarchiveTask clears archived_at for a manually/legacy-archived task
// (no cascade stamp). The CAS guard on archived_by_cascade_id keeps a
// delayed manual unarchive from erasing a newer cascade archive that
// landed between the caller's read and this update — cascade-stamped
// rows are only restored via UnarchiveTaskByCascade. Returns whether a
// row was actually updated.
func (r *Repository) UnarchiveTask(ctx context.Context, id string) (bool, error) {
	result, err := r.db.ExecContext(ctx, r.db.Rebind(`
		UPDATE tasks SET archived_at = NULL, archived_by_cascade_id = '', updated_at = ?
		WHERE id = ? AND archived_at IS NOT NULL
			AND (archived_by_cascade_id = '' OR archived_by_cascade_id IS NULL)
	`), time.Now().UTC(), id)
	if err != nil {
		return false, err
	}
	rows, _ := result.RowsAffected()
	return rows > 0, nil
}

// ListTasksForAutoArchive returns tasks eligible for auto-archiving based on workflow step settings
func (r *Repository) ListTasksForAutoArchive(ctx context.Context) ([]*models.Task, error) {
	drv := r.ro.DriverName()
	query := fmt.Sprintf(`
		SELECT %s
		FROM tasks t
		JOIN workflow_steps ws ON ws.id = t.workflow_step_id
		WHERE ws.auto_archive_after_hours > 0
			AND t.archived_at IS NULL
			AND t.updated_at <= %s
	`, taskSelectColumns("t"), dialect.NowMinusHours(drv, "ws.auto_archive_after_hours"))
	rows, err := r.ro.QueryContext(ctx, r.ro.Rebind(query))
	if err != nil {
		return nil, err
	}
	defer func() { _ = rows.Close() }()
	return r.scanTasks(rows)
}

// ListArchivedTasksWithActiveSessions returns the IDs of archived tasks that
// still have at least one task_sessions row in an active DB state
// (CREATED/STARTING/RUNNING/WAITING_FOR_INPUT). This is the candidate list
// for the periodic reconciliation sweep (see
// service.StartArchivedSessionReconciliationLoop): finalizeCancelledSessions
// bounds its session-cancellation retry to a handful of attempts, so
// sustained SQLite writer contention can exhaust it and leave an archived
// task's sessions stuck active with no session.state_changed event ever
// delivered. The sweep re-derives this list every pass, so a later attempt
// recovers the task once the contention clears.
func (r *Repository) ListArchivedTasksWithActiveSessions(ctx context.Context) ([]string, error) {
	var ids []string
	err := r.ro.SelectContext(ctx, &ids, `
		SELECT DISTINCT t.id
		FROM tasks t
		JOIN task_sessions ts ON ts.task_id = t.id
		WHERE t.archived_at IS NOT NULL
			AND ts.state IN ('CREATED', 'STARTING', 'RUNNING', 'WAITING_FOR_INPUT')
	`)
	if err != nil {
		return nil, err
	}
	return ids, nil
}

// ListExpiredQuickChatTasks returns quick-chat tasks whose last task/session
// activity is older than cutoff. Active sessions are excluded so in-use chats
// are never deleted by the idle sweeper.
func (r *Repository) ListExpiredQuickChatTasks(ctx context.Context, cutoff time.Time) ([]*models.Task, error) {
	drv := r.ro.DriverName()
	sessionActivity := "COALESCE(MAX(ts.updated_at), t.updated_at)"
	lastActivity := dialect.GreatestTimestamp(drv, "t.updated_at", sessionActivity)
	query := fmt.Sprintf(`
		WITH candidates AS (
			SELECT t.id, %s AS last_activity
			FROM tasks t
			LEFT JOIN task_sessions ts ON ts.task_id = t.id
			WHERE t.is_ephemeral = 1
				AND COALESCE(t.workflow_id, '') = ''
				AND COALESCE(t.origin, '') != ?
				AND %s
				AND t.archived_at IS NULL
				AND NOT EXISTS (
					SELECT 1 FROM task_sessions active
					WHERE active.task_id = t.id
						AND active.state IN (?, ?)
				)
			GROUP BY t.id, t.updated_at
			HAVING %s < ?
		)
		SELECT %s
		FROM tasks t
		JOIN candidates c ON c.id = t.id
		ORDER BY c.last_activity ASC
	`,
		lastActivity,
		excludeConfigModePredicate(drv, "t.metadata"),
		lastActivity,
		taskSelectColumns("t"),
	)
	rows, err := r.ro.QueryContext(ctx, r.ro.Rebind(query),
		models.TaskOriginAutomationRun,
		models.TaskSessionStateRunning,
		models.TaskSessionStateIdle,
		cutoff,
	)
	if err != nil {
		return nil, err
	}
	defer func() { _ = rows.Close() }()
	return r.scanTasks(rows)
}

// DeleteExpiredQuickChatTask deletes id only when it still matches the expired
// quick-chat predicate at delete time.
func (r *Repository) DeleteExpiredQuickChatTask(ctx context.Context, id string, cutoff time.Time) (bool, error) {
	drv := r.db.DriverName()
	sessionActivity := "COALESCE(MAX(ts.updated_at), t.updated_at)"
	lastActivity := dialect.GreatestTimestamp(drv, "t.updated_at", sessionActivity)
	query := fmt.Sprintf(`
		WITH candidate AS (
			SELECT t.id, %s AS last_activity
			FROM tasks t
			LEFT JOIN task_sessions ts ON ts.task_id = t.id
			WHERE t.id = ?
				AND t.is_ephemeral = 1
				AND COALESCE(t.workflow_id, '') = ''
				AND COALESCE(t.origin, '') != ?
				AND %s
				AND t.archived_at IS NULL
				AND NOT EXISTS (
					SELECT 1 FROM task_sessions active
					WHERE active.task_id = t.id
						AND active.state IN (?, ?)
				)
			GROUP BY t.id, t.updated_at
			HAVING %s < ?
		)
		DELETE FROM tasks
		WHERE id = ?
			AND EXISTS (SELECT 1 FROM candidate)
	`,
		lastActivity,
		excludeConfigModePredicate(drv, "t.metadata"),
		lastActivity,
	)
	result, err := r.db.ExecContext(ctx, r.db.Rebind(query),
		id,
		models.TaskOriginAutomationRun,
		models.TaskSessionStateRunning,
		models.TaskSessionStateIdle,
		cutoff,
		id,
	)
	if err != nil {
		return false, err
	}
	rows, _ := result.RowsAffected()
	return rows > 0, nil
}

// isSafeMetadataKey reports whether s is a safe JSON metadata key to splice
// into a json_extract path. The key is concatenated into the SQL text (it
// cannot be a bind parameter inside the '$.<key>' path literal), so it must be
// constrained to a fixed identifier alphabet to keep the query injection-safe.
// Callers pass compile-time constants today (WatcherSource.WatchMetadataKey),
// but validating here keeps the repository safe regardless of caller.
func isSafeMetadataKey(s string) bool {
	if s == "" {
		return false
	}
	for _, c := range s {
		switch {
		case c >= 'a' && c <= 'z', c >= 'A' && c <= 'Z', c >= '0' && c <= '9', c == '_':
		default:
			return false
		}
	}
	return true
}

// CountOpenWatcherCreatedTasks returns the number of open watcher-created tasks
// for a single watch, identified by the task-metadata key the integration
// writes (metadataKey, e.g. "sentry_issue_watch_id") and the watch id. "Open"
// means non-archived AND not in a terminal state (COMPLETED, FAILED,
// CANCELLED). Distinct integrations use distinct metadata keys, so counts are
// naturally scoped per integration without this repository knowing which
// integrations exist — the caller supplies the key.
//
// An empty watchID returns (0, nil) — no watch to count. A malformed
// metadataKey (not a bare [A-Za-z0-9_] identifier) returns an error rather
// than silently counting nothing, so a wiring bug surfaces in the logs (the
// throttle gate fails open on the error).
func (r *Repository) CountOpenWatcherCreatedTasks(ctx context.Context, metadataKey, watchID string) (int, error) {
	if watchID == "" {
		return 0, nil
	}
	if !isSafeMetadataKey(metadataKey) {
		return 0, fmt.Errorf("invalid watcher metadata key %q", metadataKey)
	}
	query := r.ro.Rebind(fmt.Sprintf(`
		SELECT COUNT(*) FROM tasks
		WHERE archived_at IS NULL
			AND state NOT IN (?, ?, ?)
			AND %s = ?
	`, dialect.JSONExtract(r.ro.DriverName(), "metadata", metadataKey)))
	var n int
	if err := r.ro.QueryRowxContext(ctx, query,
		v1.TaskStateCompleted, v1.TaskStateFailed, v1.TaskStateCancelled, watchID,
	).Scan(&n); err != nil {
		return 0, err
	}
	return n, nil
}

// UpdateTaskState updates the state of a task
func (r *Repository) UpdateTaskState(ctx context.Context, id string, state v1.TaskState) error {
	result, err := r.db.ExecContext(ctx, r.db.Rebind(`UPDATE tasks SET state = ?, updated_at = ? WHERE id = ?`), state, time.Now().UTC(), id)
	if err != nil {
		return err
	}

	rows, _ := result.RowsAffected()
	if rows == 0 {
		return fmt.Errorf("%w: %s", ErrTaskNotFound, id)
	}
	return nil
}

// UpdateTaskStateIfSessionState atomically ties a task-state write to the
// current state of one owning session and to the task remaining unarchived.
// The task-state predicate makes the returned old state authoritative for
// task.state_changed events; a concurrent task or session write retries with
// a fresh snapshot or makes this update a no-op.
func (r *Repository) UpdateTaskStateIfSessionState(
	ctx context.Context,
	taskID, sessionID string,
	expectedSessionState models.TaskSessionState,
	state v1.TaskState,
) (v1.TaskState, bool, error) {
	return r.updateTaskStateIfSessionState(
		ctx, taskID, sessionID, expectedSessionState, state, false,
	)
}

// UpdateTaskStateIfPrimarySessionState additionally requires the named
// session to remain primary.
func (r *Repository) UpdateTaskStateIfPrimarySessionState(
	ctx context.Context,
	taskID, sessionID string,
	expectedSessionState models.TaskSessionState,
	state v1.TaskState,
) (v1.TaskState, bool, error) {
	return r.updateTaskStateIfSessionState(
		ctx, taskID, sessionID, expectedSessionState, state, true,
	)
}

func (r *Repository) updateTaskStateIfSessionState(
	ctx context.Context,
	taskID, sessionID string,
	expectedSessionState models.TaskSessionState,
	state v1.TaskState,
	requirePrimary bool,
) (v1.TaskState, bool, error) {
	for attempt := range updateTaskStateIfNotArchivedMaxAttempts {
		if attempt > 0 {
			select {
			case <-ctx.Done():
				return "", false, ctx.Err()
			case <-time.After(updateTaskStateIfNotArchivedBackoff):
			}
		}
		oldState, updated, retry, err := r.tryUpdateTaskStateIfSessionState(
			ctx, taskID, sessionID, expectedSessionState, state, requirePrimary,
		)
		if err != nil || !retry {
			return oldState, updated, err
		}
	}
	return "", false, fmt.Errorf("update task state if session state: exceeded %d attempts for task %s",
		updateTaskStateIfNotArchivedMaxAttempts, taskID)
}

func (r *Repository) tryUpdateTaskStateIfSessionState(
	ctx context.Context,
	taskID, sessionID string,
	expectedSessionState models.TaskSessionState,
	state v1.TaskState,
	requirePrimary bool,
) (oldState v1.TaskState, updated, retry bool, err error) {
	tx, err := r.db.BeginTx(ctx, nil)
	if err != nil {
		return "", false, false, err
	}
	defer func() { _ = tx.Rollback() }()

	var archivedAt sql.NullTime
	var currentSessionState models.TaskSessionState
	var currentSessionIsPrimary bool
	err = tx.QueryRowContext(ctx, r.db.Rebind(`
		SELECT tasks.state, tasks.archived_at, task_sessions.state, task_sessions.is_primary
		FROM tasks
		JOIN task_sessions ON task_sessions.task_id = tasks.id
		WHERE tasks.id = ? AND task_sessions.id = ?
	`), taskID, sessionID).Scan(&oldState, &archivedAt, &currentSessionState, &currentSessionIsPrimary)
	if errors.Is(err, sql.ErrNoRows) {
		return "", false, false, nil
	}
	if err != nil {
		return "", false, false, err
	}
	if archivedAt.Valid || currentSessionState != expectedSessionState ||
		(requirePrimary && !currentSessionIsPrimary) {
		return oldState, false, false, nil
	}
	requirePrimaryValue := 0
	if requirePrimary {
		requirePrimaryValue = 1
	}

	result, err := tx.ExecContext(ctx, r.db.Rebind(`
		UPDATE tasks
		SET state = ?, updated_at = ?
		WHERE id = ?
		  AND state = ?
		  AND archived_at IS NULL
		  AND EXISTS (
			SELECT 1
			FROM task_sessions
			WHERE task_sessions.id = ?
			  AND task_sessions.task_id = tasks.id
			  AND task_sessions.state = ?
			  AND (? = 0 OR task_sessions.is_primary = 1)
		  )
	`), state, time.Now().UTC(), taskID, oldState, sessionID, expectedSessionState, requirePrimaryValue)
	if err != nil {
		if isRetryableStateRaceError(err) {
			return oldState, false, true, nil
		}
		return "", false, false, err
	}
	rows, err := result.RowsAffected()
	if err != nil {
		return "", false, false, err
	}
	if rows == 0 {
		return oldState, false, true, nil
	}
	if err := tx.Commit(); err != nil {
		return "", false, false, err
	}
	return oldState, true, false, nil
}

// RestoreTaskMessageRollbackIfSessionState atomically restores the two task
// fields changed by message_task's on-turn-start preparation, but only while
// the owning session remains in the state restored by the same rollback. A
// coordinator cancellation therefore prevents a late dispatch-failure
// rollback from moving the task out of REVIEW or rewinding its workflow step.
func (r *Repository) RestoreTaskMessageRollbackIfSessionState(
	ctx context.Context,
	task *models.Task,
	sessionID string,
	expectedSessionState models.TaskSessionState,
) (bool, error) {
	if task == nil {
		return false, errors.New("restore task message rollback: task is nil")
	}
	tx, err := r.db.BeginTx(ctx, nil)
	if err != nil {
		return false, err
	}
	defer func() { _ = tx.Rollback() }()

	fromWorkflowID, fromStepID, _, err := r.readTaskStepInTx(ctx, tx, task.ID)
	if err != nil {
		return false, err
	}
	// See updateTaskTx's comment: stamped after the transactional lock, not
	// before BeginTx, so occurred_at reflects true commit-serialization order
	// under concurrent Postgres callers.
	updatedAt := time.Now().UTC()

	result, err := tx.ExecContext(ctx, r.db.Rebind(`
		UPDATE tasks
		SET state = ?, workflow_step_id = ?, updated_at = ?
		WHERE id = ?
		  AND EXISTS (
			SELECT 1
			FROM task_sessions
			WHERE task_sessions.id = ?
			  AND task_sessions.task_id = tasks.id
			  AND task_sessions.state = ?
		  )
	`), task.State, task.WorkflowStepID, updatedAt, task.ID, sessionID, expectedSessionState)
	if err != nil {
		return false, err
	}
	rows, err := result.RowsAffected()
	if err != nil {
		return false, err
	}
	if rows == 0 {
		return false, tx.Commit()
	}
	// workflow_id is not part of this UPDATE — a rollback restore only moves
	// the step, never the workflow — so to_workflow_id equals from_workflow_id.
	transitionID, err := r.recordStepTransition(ctx, tx, stepTransitionInput{
		taskID:             task.ID,
		fromWorkflowID:     fromWorkflowID,
		fromWorkflowStepID: fromStepID,
		toWorkflowID:       fromWorkflowID,
		toWorkflowStepID:   task.WorkflowStepID,
		occurredAt:         updatedAt,
	})
	if err != nil {
		return false, err
	}
	task.WorkflowStepTransitionID = transitionID
	entryID := formatEntryID(transitionID)
	if transitionID != 0 {
		task.FromWorkflowID = fromWorkflowID
		task.FromStepID = fromStepID
	} else {
		task.FromWorkflowID = ""
		task.FromStepID = ""
	}
	if err := syncRunnerInTx(ctx, tx, r.db.Rebind, task.WorkflowStepID, task.ID, task.AssigneeAgentProfileID); err != nil {
		return false, err
	}
	if err := tx.Commit(); err != nil {
		return false, err
	}
	task.UpdatedAt = updatedAt
	r.dispatchStepEntry(ctx, task.ID, fromWorkflowID, task.WorkflowStepID, entryID)
	return true, nil
}

// UpdateTaskStateIfCurrentIn transitions state inside a transaction, re-checking
// the current state on write so concurrent handlers cannot clobber a task that
// moved out of allowed between read and update. The write is also scoped to
// archived_at IS NULL: if ArchiveTask commits between the caller's earlier
// archived-state guard and this call, the archived_at check in the UPDATE's
// WHERE clause (not just the state check) makes the no-op atomic, so a late
// runtime write can never resurrect an archived task's state.
func (r *Repository) UpdateTaskStateIfCurrentIn(
	ctx context.Context, id string, state v1.TaskState, allowed []v1.TaskState,
) (v1.TaskState, bool, error) {
	if len(allowed) == 0 {
		return "", false, nil
	}

	tx, err := r.db.BeginTx(ctx, nil)
	if err != nil {
		return "", false, err
	}
	defer func() { _ = tx.Rollback() }()

	var currentState v1.TaskState
	err = tx.QueryRowContext(ctx, r.db.Rebind(`SELECT state FROM tasks WHERE id = ?`), id).Scan(&currentState)
	if err != nil {
		if errors.Is(err, sql.ErrNoRows) {
			return "", false, fmt.Errorf("%w: %s", ErrTaskNotFound, id)
		}
		return "", false, err
	}
	if !taskStateInSet(currentState, allowed) {
		return currentState, false, nil
	}

	result, err := tx.ExecContext(ctx, r.db.Rebind(`
		UPDATE tasks SET state = ?, updated_at = ?
		WHERE id = ? AND state = ? AND archived_at IS NULL
	`), state, time.Now().UTC(), id, currentState)
	if err != nil {
		return "", false, err
	}
	rows, _ := result.RowsAffected()
	if rows == 0 {
		return currentState, false, nil
	}
	if err := tx.Commit(); err != nil {
		return "", false, err
	}
	return currentState, true, nil
}

// updateTaskStateIfNotArchivedMaxAttempts bounds the optimistic-retry loop in
// UpdateTaskStateIfNotArchived. A retry only fires when another writer
// changed tasks.state (not archived_at) in the gap between this method's
// read and its write; real contention on a single task's state column is
// rare enough that a handful of attempts is generous headroom, not a
// meaningful latency risk. updateTaskStateIfNotArchivedBackoff is a fixed
// delay between attempts, giving the concurrent writer time to finish
// (commit or roll back) before the next attempt re-reads — without it, a
// tight spin-retry can exhaust every attempt in well under a millisecond,
// faster than any real concurrent write completes.
const (
	updateTaskStateIfNotArchivedMaxAttempts = 8
	updateTaskStateIfNotArchivedBackoff     = 15 * time.Millisecond
)

// UpdateTaskStateIfNotArchived atomically transitions state unless the task
// is archived — no prior-state constraint, unlike UpdateTaskStateIfCurrentIn.
// IN_PROGRESS writes (unlike the REVIEW CAS) are legitimately reachable from
// many prior states, so there is no "allowed" set to check; the only
// invariant that must hold atomically is archived_at IS NULL. Closes the
// same TOCTOU window as UpdateTaskStateIfCurrentIn: if ArchiveTask commits
// between a caller's earlier archived-state guard and this call, the
// archived_at check inside the transaction (not just the caller's read)
// makes the no-op atomic. Returns the pre-update state and whether a row
// was modified.
//
// The UPDATE's WHERE clause also pins state = currentState (the value read
// moments earlier in the same transaction), so the returned "pre-update
// state" is never stale: without that pin, a concurrent state write landing
// between the SELECT and the UPDATE would still match archived_at IS NULL
// alone, silently clobbering the newer state while this method kept
// reporting the old (now wrong) value as the pre-update state — which the
// service layer publishes as the task.state_changed event's old_state
// (CodeRabbit review on PR #1706). Losing the race on state (rows==0 while
// the row is still unarchived) means state moved, not that the row is gone
// or archived, so this is optimistic-concurrency-retried rather than
// treated as a no-op — an IN_PROGRESS write has no prior-state restriction
// to honor, so it always still applies once the retry re-reads a fresh
// state.
func (r *Repository) UpdateTaskStateIfNotArchived(
	ctx context.Context, id string, state v1.TaskState,
) (v1.TaskState, bool, error) {
	for attempt := range updateTaskStateIfNotArchivedMaxAttempts {
		if attempt > 0 {
			select {
			case <-ctx.Done():
				return "", false, ctx.Err()
			case <-time.After(updateTaskStateIfNotArchivedBackoff):
			}
		}
		currentState, updated, retry, err := r.tryUpdateTaskStateIfNotArchived(ctx, id, state)
		if err != nil || !retry {
			return currentState, updated, err
		}
	}
	return "", false, fmt.Errorf("update task state if not archived: exceeded %d attempts for task %s",
		updateTaskStateIfNotArchivedMaxAttempts, id)
}

// tryUpdateTaskStateIfNotArchived is one attempt of the optimistic-retry loop
// above. retry=true means the state changed concurrently while the row
// stayed unarchived — the caller should re-read and try again.
func (r *Repository) tryUpdateTaskStateIfNotArchived(
	ctx context.Context, id string, state v1.TaskState,
) (currentState v1.TaskState, updated, retry bool, err error) {
	tx, err := r.db.BeginTx(ctx, nil)
	if err != nil {
		return "", false, false, err
	}
	defer func() { _ = tx.Rollback() }()

	var archivedAt sql.NullTime
	err = tx.QueryRowContext(ctx, r.db.Rebind(`SELECT state, archived_at FROM tasks WHERE id = ?`), id).
		Scan(&currentState, &archivedAt)
	if err != nil {
		if errors.Is(err, sql.ErrNoRows) {
			return "", false, false, fmt.Errorf("%w: %s", ErrTaskNotFound, id)
		}
		return "", false, false, err
	}
	if archivedAt.Valid {
		return currentState, false, false, nil
	}

	result, err := tx.ExecContext(ctx, r.db.Rebind(`
		UPDATE tasks SET state = ?, updated_at = ?
		WHERE id = ? AND state = ? AND archived_at IS NULL
	`), state, time.Now().UTC(), id, currentState)
	if err != nil {
		if isRetryableStateRaceError(err) {
			// SQLite (under WAL) can refuse to upgrade this transaction's
			// already-established read snapshot to a writer once another
			// connection committed a conflicting write in between — it
			// returns SQLITE_BUSY ("database is locked") on the UPDATE
			// itself rather than a clean 0-rows-affected. Same underlying
			// condition as the rows==0 branch below: retry with a fresh
			// transaction/snapshot instead of surfacing a transient error.
			return currentState, false, true, nil
		}
		return "", false, false, err
	}
	rows, _ := result.RowsAffected()
	if rows == 0 {
		// archived_at IS NULL was true moments ago (checked above, inside
		// this same transaction) — a concurrent writer changed state, not
		// archived_at. Retry with a fresh read rather than reporting a
		// stale old-state/no-op.
		return currentState, false, true, nil
	}
	if err := tx.Commit(); err != nil {
		return "", false, false, err
	}
	return currentState, true, false, nil
}

// isRetryableStateRaceError reports whether err is a database-level
// contention error rather than a genuine failure: SQLite's WAL snapshot
// conflict (a write following a read in the same transaction, after
// another connection committed a conflicting write — surfaces as
// SQLITE_BUSY/"database is locked" on the write itself, not a clean
// 0-rows-affected), or a Postgres serialization/deadlock/lock-timeout
// error. UpdateTaskStateIfNotArchived's retry loop treats this the same as
// rows==0: the underlying condition (another writer changed the row) is
// exactly the one it already retries for.
func isRetryableStateRaceError(err error) bool {
	if err == nil {
		return false
	}
	var pgErr *pgconn.PgError
	if errors.As(err, &pgErr) {
		switch pgErr.Code {
		case "40001", "40P01", "55P03": // serialization_failure, deadlock_detected, lock_not_available
			return true
		}
		return false
	}
	s := err.Error()
	return strings.Contains(s, "database is locked") || strings.Contains(s, "database table is locked")
}

func taskStateInSet(state v1.TaskState, allowed []v1.TaskState) bool {
	for _, candidate := range allowed {
		if state == candidate {
			return true
		}
	}
	return false
}

// ListTasksByProject returns all non-archived, non-ephemeral tasks for a project.
func (r *Repository) ListTasksByProject(ctx context.Context, projectID string) ([]*models.Task, error) {
	rows, err := r.ro.QueryContext(ctx, r.ro.Rebind(`
		SELECT `+taskSelectColumns("t")+`
		FROM tasks t
		WHERE t.project_id = ? AND t.archived_at IS NULL AND t.is_ephemeral = 0`+andNotAutomationOriginT+`
		ORDER BY t.created_at ASC
	`), projectID)
	if err != nil {
		return nil, err
	}
	defer func() { _ = rows.Close() }()
	return r.scanTasks(rows)
}

// ListTasksByAssignee returns all non-archived, non-ephemeral tasks assigned to an agent.
// The lookup goes through the runner participant projection so it picks
// up both per-task overrides and step-primary fallbacks (ADR 0005 Wave F).
func (r *Repository) ListTasksByAssignee(ctx context.Context, agentInstanceID string) ([]*models.Task, error) {
	rows, err := r.ro.QueryContext(ctx, r.ro.Rebind(`
		SELECT `+taskSelectColumns("t")+`
		FROM tasks t
		WHERE `+runnerProjection("t")+` = ?
		  AND t.archived_at IS NULL AND t.is_ephemeral = 0`+andNotAutomationOriginT+`
		ORDER BY t.created_at ASC
	`), agentInstanceID)
	if err != nil {
		return nil, err
	}
	defer func() { _ = rows.Close() }()
	return r.scanTasks(rows)
}

// ListTaskTree returns a flat list of non-archived tasks for a workspace, suitable for
// building a tree using each task's ParentID field.
func (r *Repository) ListTaskTree(ctx context.Context, workspaceID string, filters models.TaskTreeFilters) ([]*models.Task, error) {
	query := `SELECT ` + taskSelectColumns("t") + ` FROM tasks t WHERE t.workspace_id = ? AND t.archived_at IS NULL AND t.is_ephemeral = 0` + andNotAutomationOriginT
	args := []interface{}{workspaceID}

	if filters.ProjectID != "" {
		query += " AND t.project_id = ?"
		args = append(args, filters.ProjectID)
	}
	if filters.AssigneeID != "" {
		query += " AND " + runnerProjection("t") + " = ?"
		args = append(args, filters.AssigneeID)
	}
	if filters.WorkflowID != "" {
		query += " AND t.workflow_id = ?"
		args = append(args, filters.WorkflowID)
	}
	if filters.Origin != "" {
		query += " AND t.origin = ?"
		args = append(args, filters.Origin)
	}
	query += " ORDER BY t.created_at ASC"

	rows, err := r.ro.QueryContext(ctx, r.ro.Rebind(query), args...)
	if err != nil {
		return nil, err
	}
	defer func() { _ = rows.Close() }()
	return r.scanTasks(rows)
}

// IncrementTaskSequence atomically increments the workspace task_sequence and returns the new value.
func (r *Repository) IncrementTaskSequence(ctx context.Context, workspaceID string) (int, error) {
	var seq int
	err := r.db.QueryRowContext(ctx, r.db.Rebind(`
		UPDATE workspaces SET task_sequence = task_sequence + 1
		WHERE id = ?
		RETURNING task_sequence
	`), workspaceID).Scan(&seq)
	if err != nil {
		return 0, fmt.Errorf("increment task sequence for workspace %s: %w", workspaceID, err)
	}
	return seq, nil
}

// GetWorkspaceTaskPrefix returns the task prefix and office workflow ID for a workspace.
func (r *Repository) GetWorkspaceTaskPrefix(ctx context.Context, workspaceID string) (prefix, officeWorkflowID string, err error) {
	err = r.ro.QueryRowContext(ctx, r.ro.Rebind(`
		SELECT COALESCE(task_prefix, 'KAN'), COALESCE(office_workflow_id, '')
		FROM workspaces WHERE id = ?
	`), workspaceID).Scan(&prefix, &officeWorkflowID)
	return
}