feat(aihr): harden M0-M2 mobile training flows

scripts/release-preflight.sh

@@ -125,6 +125,7 @@ FROM (
   UNION ALL SELECT 'aihr_practice_audio'
   UNION ALL SELECT 'aihr_practice_audio_upload'
   UNION ALL SELECT 'aihr_practice_calibration'
+  UNION ALL SELECT 'aihr_practice_help_event'
   UNION ALL SELECT 'aihr_knowledge_gap'
   UNION ALL SELECT 'aihr_knowledge_answer_feedback'
   UNION ALL SELECT 'aihr_knowledge_space_grant'
@@ -155,6 +156,8 @@ FROM (
   UNION ALL SELECT 'aihr_sop_applicability'
   UNION ALL SELECT 'aihr_onboard_task'
   UNION ALL SELECT 'aihr_qualification_gate'
+  UNION ALL SELECT 'aihr_org_directory'
+  UNION ALL SELECT 'aihr_tenant_org_binding'
   UNION ALL SELECT 'aihr_memory_candidate'
   UNION ALL SELECT 'aihr_assistant_capture'
   UNION ALL SELECT 'aihr_assistant_capture_status_log'
@@ -165,6 +168,8 @@ FROM (
   UNION ALL SELECT 'aihr_broadcast_message'
   UNION ALL SELECT 'aihr_broadcast_read'
   UNION ALL SELECT 'aihr_broadcast_version'
+  UNION ALL SELECT 'aihr_broadcast_target_rule'
+  UNION ALL SELECT 'aihr_broadcast_target_recipient'
   UNION ALL SELECT 'aihr_personal_space'
   UNION ALL SELECT 'aihr_personal_item'
   UNION ALL SELECT 'aihr_personal_fragment'
@@ -394,6 +399,79 @@ REMOTE
 
   [[ "$broadcast_version_unique_index" = "0|tenant_id,message_id,version|0" ]] \
     || fail "remote broadcast-version unique index invalid: expected unique full columns tenant_id,message_id,version; got ${broadcast_version_unique_index:-missing}"
+  local broadcast_targeting_column_contract
+  broadcast_targeting_column_contract="$(ssh -o BatchMode=yes -o ConnectTimeout=10 "$remote_ssh" bash -s -- "$remote_db" <<'REMOTE'
+set -euo pipefail
+db="$1"
+mysql --batch --skip-column-names --connect-timeout=5 "$db" <<'SQL'
+SELECT CONCAT(column_name, '|', column_type, '|', is_nullable, '|', COALESCE(column_default, '<NULL>'))
+FROM information_schema.columns
+WHERE table_schema = DATABASE()
+  AND table_name = 'aihr_broadcast_message'
+  AND column_name IN ('required_read', 'target_payload_hash')
+ORDER BY FIELD(column_name, 'required_read', 'target_payload_hash');
+SQL
+REMOTE
+  )" || fail "remote broadcast M1 column check failed: $remote_ssh:$remote_db"
+
+  [[ "$broadcast_targeting_column_contract" = $'required_read|tinyint(1)|NO|0\ntarget_payload_hash|char(64)|YES|<NULL>' ]] \
+    || fail "remote broadcast M1 column contract invalid: expected required_read tinyint(1) NOT NULL DEFAULT 0 and nullable target_payload_hash char(64); got ${broadcast_targeting_column_contract:-missing}"
+  local broadcast_target_table_contract
+  broadcast_target_table_contract="$(ssh -o BatchMode=yes -o ConnectTimeout=10 "$remote_ssh" bash -s -- "$remote_db" <<'REMOTE'
+set -euo pipefail
+db="$1"
+mysql --batch --skip-column-names --connect-timeout=5 "$db" <<'SQL'
+SELECT CONCAT(table_name, '.', column_name, '|', column_type, '|', is_nullable)
+FROM information_schema.columns
+WHERE table_schema = DATABASE()
+  AND table_name IN ('aihr_broadcast_target_rule', 'aihr_broadcast_target_recipient')
+ORDER BY FIELD(table_name, 'aihr_broadcast_target_rule', 'aihr_broadcast_target_recipient'), ordinal_position;
+SQL
+REMOTE
+  )" || fail "remote broadcast target-table contract check failed: $remote_ssh:$remote_db"
+
+  [[ "$broadcast_target_table_contract" = $'aihr_broadcast_target_rule.id|bigint|NO\naihr_broadcast_target_rule.tenant_id|varchar(20)|NO\naihr_broadcast_target_rule.message_id|bigint|NO\naihr_broadcast_target_rule.target_type|varchar(20)|NO\naihr_broadcast_target_rule.target_value|varchar(100)|NO\naihr_broadcast_target_rule.create_time|datetime|NO\naihr_broadcast_target_recipient.id|bigint|NO\naihr_broadcast_target_recipient.tenant_id|varchar(20)|NO\naihr_broadcast_target_recipient.message_id|bigint|NO\naihr_broadcast_target_recipient.recipient_key|varchar(180)|NO\naihr_broadcast_target_recipient.subject_ref|varchar(100)|NO\naihr_broadcast_target_recipient.user_id|bigint|YES\naihr_broadcast_target_recipient.target_status|varchar(20)|NO\naihr_broadcast_target_recipient.target_reason|varchar(100)|NO\naihr_broadcast_target_recipient.create_time|datetime|NO\naihr_broadcast_target_recipient.update_time|datetime|NO' ]] \
+    || fail "remote broadcast target-table contract invalid: expected server-written recipient identity, status, reason, and timing fields; got ${broadcast_target_table_contract:-missing}"
+  local broadcast_target_rule_unique_index
+  broadcast_target_rule_unique_index="$(ssh -o BatchMode=yes -o ConnectTimeout=10 "$remote_ssh" bash -s -- "$remote_db" <<'REMOTE'
+set -euo pipefail
+db="$1"
+mysql --batch --skip-column-names --connect-timeout=5 "$db" <<'SQL'
+SELECT CONCAT(
+  MIN(non_unique), '|',
+  COALESCE(GROUP_CONCAT(column_name ORDER BY seq_in_index), ''), '|',
+  SUM(sub_part IS NOT NULL)
+)
+FROM information_schema.statistics
+WHERE table_schema = DATABASE()
+  AND table_name = 'aihr_broadcast_target_rule'
+  AND index_name = 'uk_aihr_broadcast_target_rule';
+SQL
+REMOTE
+  )" || fail "remote broadcast target-rule unique-index check failed: $remote_ssh:$remote_db"
+
+  [[ "$broadcast_target_rule_unique_index" = "0|tenant_id,message_id,target_type,target_value|0" ]] \
+    || fail "remote broadcast target-rule unique index invalid: expected unique full columns tenant_id,message_id,target_type,target_value; got ${broadcast_target_rule_unique_index:-missing}"
+  local broadcast_target_recipient_unique_index
+  broadcast_target_recipient_unique_index="$(ssh -o BatchMode=yes -o ConnectTimeout=10 "$remote_ssh" bash -s -- "$remote_db" <<'REMOTE'
+set -euo pipefail
+db="$1"
+mysql --batch --skip-column-names --connect-timeout=5 "$db" <<'SQL'
+SELECT CONCAT(
+  MIN(non_unique), '|',
+  COALESCE(GROUP_CONCAT(column_name ORDER BY seq_in_index), ''), '|',
+  SUM(sub_part IS NOT NULL)
+)
+FROM information_schema.statistics
+WHERE table_schema = DATABASE()
+  AND table_name = 'aihr_broadcast_target_recipient'
+  AND index_name = 'uk_aihr_broadcast_target_recipient';
+SQL
+REMOTE
+  )" || fail "remote broadcast target-recipient unique-index check failed: $remote_ssh:$remote_db"
+
+  [[ "$broadcast_target_recipient_unique_index" = "0|tenant_id,message_id,recipient_key|0" ]] \
+    || fail "remote broadcast target-recipient unique index invalid: expected unique full columns tenant_id,message_id,recipient_key; got ${broadcast_target_recipient_unique_index:-missing}"
   local missing_work_assistant_columns
   missing_work_assistant_columns="$(ssh -o BatchMode=yes -o ConnectTimeout=10 "$remote_ssh" bash -s -- "$remote_db" <<'REMOTE'
 set -euo pipefail
@@ -422,13 +500,17 @@ REMOTE
 
   [[ -z "$missing_work_assistant_columns" ]] \
     || fail "remote work-assistant schema missing required columns: $(printf '%s' "$missing_work_assistant_columns" | tr '\n' ', ' | sed 's/, $//')"
-  echo "remote_schema=57/57 $remote_ssh:$remote_db"
+  echo "remote_schema=62/62 $remote_ssh:$remote_db"
   echo "remote_work_report_idempotency=3/3 $remote_ssh:$remote_db"
   echo "remote_knowledge_category_columns=7/7 $remote_ssh:$remote_db"
   echo "remote_broadcast_publish_audit_columns=3/3 $remote_ssh:$remote_db"
   echo "remote_broadcast_publish_idempotency=3/3 $remote_ssh:$remote_db"
   echo "remote_broadcast_read_idempotency=3/3 $remote_ssh:$remote_db"
   echo "remote_broadcast_version_uniqueness=3/3 $remote_ssh:$remote_db"
+  echo "remote_broadcast_targeting_contract=2/2 $remote_ssh:$remote_db"
+  echo "remote_broadcast_target_table_contract=16/16 $remote_ssh:$remote_db"
+  echo "remote_broadcast_target_rule_uniqueness=4/4 $remote_ssh:$remote_db"
+  echo "remote_broadcast_target_recipient_uniqueness=3/3 $remote_ssh:$remote_db"
   echo "remote_broadcast_question_context=1/1 $remote_ssh:$remote_db"
   echo "remote_work_assistant_columns=8/8 $remote_ssh:$remote_db"
   echo "remote_personal_oss_configuration=true $remote_ssh:$remote_db"