@maiaos/node 0.1.0-canary.44938d4.manual.1

package/dist/storage/migration-nine.js

@@ -0,0 +1,1224 @@
+import { MAX_LIVE_TERMINALS, MAX_RETAINED_INACTIVE_TERMINALS, MAX_TERMINAL_CONTROLLER_REQUESTS_GLOBAL, MAX_TERMINAL_CONTROLLER_REQUESTS_PER_TERMINAL, MAX_TERMINAL_DURABLE_SCROLLBACK_BYTES_GLOBAL, MAX_TERMINAL_GENERATION, MAX_TERMINAL_MUTATION_SEQUENCE, MAX_TERMINAL_NATIVE_OPERATION_SEQUENCE, MAX_TERMINAL_OBSERVERS_GLOBAL, MAX_TERMINAL_OBSERVERS_PER_TERMINAL, MAX_TERMINAL_SCROLLBACK_BYTES, MAX_TERMINAL_SCROLLBACK_LINES, } from "@maiaos/protocol";
+const MAX_TERMINAL_DURABLE_EVENTS_PER_TERMINAL = 50_000;
+const MAX_TERMINAL_MUTATIONS_PER_TERMINAL = 65_536;
+export const migrationNineSql = `
+CREATE TABLE terminal_live_generations (
+  terminal_id TEXT NOT NULL
+    REFERENCES terminals(terminal_id) ON DELETE RESTRICT,
+  generation INTEGER NOT NULL CHECK (
+    generation BETWEEN 1 AND ${String(MAX_TERMINAL_GENERATION)}
+  ),
+  cleanup_state TEXT NOT NULL CHECK (
+    cleanup_state IN ('pending', 'known_identity_members_complete', 'unknown')
+  ),
+  cleanup_reason TEXT CHECK (
+    cleanup_reason IS NULL OR cleanup_reason IN (
+      'cleanup_deadline', 'containment_lost', 'host_failed',
+      'identity_observation_lost', 'native_acknowledgement_lost',
+      'node_restarted'
+    )
+  ),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (terminal_id, generation),
+  CHECK (
+    (cleanup_state = 'unknown' AND cleanup_reason IS NOT NULL) OR
+    (cleanup_state <> 'unknown' AND cleanup_reason IS NULL)
+  )
+) STRICT, WITHOUT ROWID;
+
+CREATE TABLE terminal_live_sessions (
+  terminal_id TEXT PRIMARY KEY NOT NULL
+    REFERENCES terminals(terminal_id) ON DELETE RESTRICT,
+  generation INTEGER NOT NULL CHECK (
+    generation BETWEEN 1 AND ${String(MAX_TERMINAL_GENERATION)}
+  ),
+  state TEXT NOT NULL CHECK (
+    state IN ('creating', 'running', 'closing', 'restarting', 'exited', 'disconnected')
+  ),
+  cleanup_state TEXT NOT NULL CHECK (
+    cleanup_state IN ('pending', 'known_identity_members_complete', 'unknown')
+  ),
+  cleanup_reason TEXT CHECK (
+    cleanup_reason IS NULL OR cleanup_reason IN (
+      'cleanup_deadline', 'containment_lost', 'host_failed',
+      'identity_observation_lost', 'native_acknowledgement_lost',
+      'node_restarted'
+    )
+  ),
+  revision INTEGER NOT NULL CHECK (revision >= 1),
+  event_head INTEGER NOT NULL DEFAULT 0 CHECK (event_head >= 0),
+  chunk_head INTEGER NOT NULL DEFAULT 0 CHECK (chunk_head >= 0),
+  mutation_head INTEGER NOT NULL DEFAULT 0 CHECK (
+    mutation_head BETWEEN 0 AND ${String(MAX_TERMINAL_MUTATION_SEQUENCE)}
+  ),
+  native_operation_head INTEGER NOT NULL DEFAULT 0 CHECK (
+    native_operation_head BETWEEN 0 AND ${String(MAX_TERMINAL_NATIVE_OPERATION_SEQUENCE)}
+  ),
+  columns INTEGER NOT NULL CHECK (columns BETWEEN 2 AND 500),
+  rows INTEGER NOT NULL CHECK (rows BETWEEN 2 AND 300),
+  retained_bytes INTEGER NOT NULL DEFAULT 0 CHECK (
+    retained_bytes BETWEEN 0 AND ${String(MAX_TERMINAL_SCROLLBACK_BYTES)}
+  ),
+  retained_lines INTEGER NOT NULL DEFAULT 0 CHECK (
+    retained_lines BETWEEN 0 AND ${String(MAX_TERMINAL_SCROLLBACK_LINES)}
+  ),
+  exit_code INTEGER,
+  exit_signal TEXT CHECK (
+    exit_signal IS NULL OR exit_signal IN (
+      'hangup', 'interrupt', 'kill', 'terminate', 'unknown'
+    )
+  ),
+  exit_observed_at TEXT,
+  deleted_at TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  FOREIGN KEY (terminal_id, generation)
+    REFERENCES terminal_live_generations(terminal_id, generation) ON DELETE RESTRICT,
+  CHECK (
+    (cleanup_state = 'unknown' AND cleanup_reason IS NOT NULL) OR
+    (cleanup_state <> 'unknown' AND cleanup_reason IS NULL)
+  ),
+  CHECK (
+    (state IN ('creating', 'running', 'closing') AND cleanup_state = 'pending') OR
+    (state = 'restarting' AND cleanup_state IN ('pending', 'known_identity_members_complete')) OR
+    (state = 'disconnected' AND cleanup_state = 'unknown') OR
+    state = 'exited'
+  ),
+  CHECK (
+    (state = 'exited' AND exit_observed_at IS NOT NULL) OR
+    (state = 'disconnected' AND (
+      (exit_code IS NULL AND exit_signal IS NULL AND exit_observed_at IS NULL) OR
+      exit_observed_at IS NOT NULL
+    )) OR
+    (state NOT IN ('exited', 'disconnected') AND exit_code IS NULL
+      AND exit_signal IS NULL AND exit_observed_at IS NULL)
+  )
+) STRICT;
+
+CREATE TRIGGER terminal_live_sessions_admit
+BEFORE INSERT ON terminal_live_sessions
+BEGIN
+  SELECT CASE WHEN NOT (
+    NEW.generation = 1 AND NEW.state = 'creating'
+    AND NEW.cleanup_state = 'pending' AND NEW.cleanup_reason IS NULL
+    AND NEW.revision = 1 AND NEW.event_head = 0 AND NEW.chunk_head = 0
+    AND NEW.mutation_head = 0 AND NEW.native_operation_head = 0
+    AND NEW.deleted_at IS NULL
+  ) THEN RAISE(ABORT, 'terminal_live_initial_state_invalid') END;
+  SELECT CASE WHEN (
+    SELECT COUNT(*) FROM terminal_live_sessions
+    WHERE state IN ('creating', 'running', 'closing', 'restarting')
+      OR cleanup_state IN ('pending', 'unknown')
+  ) >= ${String(MAX_LIVE_TERMINALS)}
+  THEN RAISE(ABORT, 'terminal_live_global_limit') END;
+  SELECT CASE WHEN NEW.state = 'exited'
+    AND NEW.cleanup_state = 'known_identity_members_complete'
+    AND NEW.deleted_at IS NULL
+    AND (
+      SELECT COUNT(*) FROM terminal_live_sessions
+      WHERE state = 'exited'
+        AND cleanup_state = 'known_identity_members_complete'
+        AND deleted_at IS NULL
+    ) >= ${String(MAX_RETAINED_INACTIVE_TERMINALS)}
+  THEN RAISE(ABORT, 'terminal_live_inactive_history_limit') END;
+  SELECT CASE WHEN NOT EXISTS (
+    SELECT 1 FROM terminals
+    WHERE terminal_id = NEW.terminal_id AND platform = 'darwin'
+      AND state = 'unavailable'
+      AND unavailability_code = 'terminal_containment_unsupported'
+      AND revision = 1 AND chunk_head = 0
+  ) THEN RAISE(ABORT, 'terminal_live_base_identity_invalid') END;
+  SELECT CASE WHEN EXISTS (
+    SELECT 1 FROM orchestration_runs WHERE terminal_id = NEW.terminal_id
+  ) THEN RAISE(ABORT, 'terminal_live_orchestration_ineligible') END;
+END;
+
+CREATE TRIGGER terminal_live_sessions_lifecycle_update
+BEFORE UPDATE OF state, cleanup_state, cleanup_reason ON terminal_live_sessions
+WHEN NEW.generation = OLD.generation AND (
+  NEW.state <> OLD.state OR NEW.cleanup_state <> OLD.cleanup_state
+  OR NEW.cleanup_reason IS NOT OLD.cleanup_reason
+)
+BEGIN
+  SELECT CASE WHEN NOT (
+    (OLD.state = 'creating' AND OLD.cleanup_state = 'pending'
+      AND NEW.state = 'running' AND NEW.cleanup_state = 'pending') OR
+    (OLD.state = 'creating' AND OLD.cleanup_state = 'pending'
+      AND NEW.state = 'disconnected' AND NEW.cleanup_state = 'unknown') OR
+    (OLD.state = 'creating' AND OLD.cleanup_state = 'pending'
+      AND NEW.state = 'exited'
+      AND NEW.cleanup_state = 'known_identity_members_complete') OR
+    (OLD.state = 'running' AND OLD.cleanup_state = 'pending'
+      AND NEW.state IN ('closing', 'restarting')
+      AND NEW.cleanup_state = 'pending') OR
+    (OLD.state = 'running' AND OLD.cleanup_state = 'pending'
+      AND NEW.state = 'exited'
+      AND NEW.cleanup_state = 'pending') OR
+    (OLD.state = 'running' AND OLD.cleanup_state = 'pending'
+      AND NEW.state = 'disconnected' AND NEW.cleanup_state = 'unknown') OR
+    (OLD.state = 'closing' AND OLD.cleanup_state = 'pending'
+      AND NEW.state = 'exited'
+      AND NEW.cleanup_state = 'pending') OR
+    (OLD.state = 'closing' AND OLD.cleanup_state = 'pending'
+      AND NEW.state = 'disconnected' AND NEW.cleanup_state = 'unknown') OR
+    (OLD.state = 'restarting' AND OLD.cleanup_state = 'pending'
+      AND NEW.state = 'restarting'
+      AND NEW.cleanup_state = 'known_identity_members_complete') OR
+    (OLD.state = 'restarting' AND OLD.cleanup_state = 'pending'
+      AND NEW.state = 'disconnected' AND NEW.cleanup_state = 'unknown') OR
+    (OLD.state = 'exited' AND OLD.cleanup_state = 'pending'
+      AND NEW.state = 'exited'
+      AND NEW.cleanup_state IN ('known_identity_members_complete', 'unknown')) OR
+    (OLD.state = 'exited'
+      AND OLD.cleanup_state = 'known_identity_members_complete'
+      AND NEW.state = 'restarting'
+      AND NEW.cleanup_state = 'known_identity_members_complete')
+  ) OR NEW.revision <> OLD.revision + 1
+  THEN RAISE(ABORT, 'terminal_live_lifecycle_transition_invalid') END;
+  SELECT CASE WHEN OLD.state = 'creating' AND NEW.state = 'running'
+    AND NOT EXISTS (
+      SELECT 1 FROM terminal_live_mutations
+      WHERE terminal_id = OLD.terminal_id AND generation = OLD.generation
+        AND mutation_sequence = OLD.mutation_head
+        AND method = 'terminal.create' AND dispatch_state = 'acknowledged'
+        AND acknowledgement_kind = 'process-started'
+    )
+  THEN RAISE(ABORT, 'terminal_live_create_acknowledgement_required') END;
+  SELECT CASE WHEN OLD.state = 'running' AND NEW.state = 'closing'
+    AND NOT EXISTS (
+      SELECT 1 FROM terminal_live_mutations
+      WHERE terminal_id = OLD.terminal_id AND generation = OLD.generation
+        AND mutation_sequence = OLD.mutation_head
+        AND method = 'terminal.session.close'
+        AND effect_phase = 'native-effect' AND dispatch_state = 'prepared'
+    )
+  THEN RAISE(ABORT, 'terminal_live_close_dispatch_required') END;
+  SELECT CASE WHEN OLD.state <> 'restarting' AND NEW.state = 'restarting'
+    AND NOT EXISTS (
+      SELECT 1 FROM terminal_live_mutations
+      WHERE terminal_id = OLD.terminal_id AND generation = OLD.generation
+        AND mutation_sequence = OLD.mutation_head
+        AND method = 'terminal.session.restart' AND dispatch_state = 'prepared'
+        AND (
+          (OLD.state = 'running' AND effect_phase = 'source-cleanup'
+            AND restart_source_cleanup_required = 1) OR
+          (OLD.state = 'exited' AND effect_phase = 'target-start'
+            AND restart_source_cleanup_required = 0)
+        )
+    )
+  THEN RAISE(ABORT, 'terminal_live_restart_dispatch_required') END;
+  SELECT CASE WHEN OLD.state = 'exited' AND NEW.state = 'restarting'
+    AND NOT EXISTS (
+      SELECT 1 FROM terminal_live_generations
+      WHERE terminal_id = OLD.terminal_id AND generation = OLD.generation + 1
+        AND cleanup_state = 'pending'
+    )
+  THEN RAISE(ABORT, 'terminal_live_restart_target_generation_required') END;
+  SELECT CASE WHEN OLD.state = 'restarting'
+    AND OLD.cleanup_state = 'pending'
+    AND NEW.state = 'restarting'
+    AND NEW.cleanup_state = 'known_identity_members_complete'
+    AND NOT EXISTS (
+      SELECT 1 FROM terminal_live_mutations
+      WHERE terminal_id = OLD.terminal_id AND generation = OLD.generation
+        AND mutation_sequence = OLD.mutation_head
+        AND method = 'terminal.session.restart'
+        AND effect_phase = 'source-cleanup'
+        AND dispatch_state = 'attempted'
+        AND source_cleanup_ack_digest IS NOT NULL
+    )
+  THEN RAISE(ABORT, 'terminal_live_restart_source_cleanup_ack_required') END;
+  SELECT CASE WHEN OLD.state = 'creating' AND NEW.state = 'disconnected'
+    AND NOT EXISTS (
+      SELECT 1 FROM terminal_live_mutations
+      WHERE terminal_id = OLD.terminal_id AND generation = OLD.generation
+        AND mutation_sequence = OLD.mutation_head
+        AND method = 'terminal.create' AND dispatch_state = 'outcome_unknown'
+    )
+  THEN RAISE(ABORT, 'terminal_live_create_unknown_required') END;
+  SELECT CASE WHEN OLD.state = 'creating' AND NEW.state = 'exited'
+    AND NOT EXISTS (
+      SELECT 1 FROM terminal_live_mutations
+      WHERE terminal_id = OLD.terminal_id AND generation = OLD.generation
+        AND mutation_sequence = OLD.mutation_head
+        AND method = 'terminal.create' AND dispatch_state = 'outcome_unknown'
+        AND effect_phase = 'native-effect'
+        AND mutation_sequence = 1 AND native_operation_sequence = 1
+        AND unknown_reason = 'native_acknowledgement_lost'
+        AND acknowledgement_command_id IS NULL
+        AND acknowledgement_kind IS NULL
+        AND acknowledgement_digest IS NULL
+    )
+  THEN RAISE(ABORT, 'terminal_live_create_cleanup_required') END;
+  SELECT CASE WHEN OLD.state = 'closing' AND NEW.state = 'disconnected'
+    AND NOT EXISTS (
+      SELECT 1 FROM terminal_live_mutations
+      WHERE terminal_id = OLD.terminal_id AND generation = OLD.generation
+        AND mutation_sequence = OLD.mutation_head
+        AND method = 'terminal.session.close'
+        AND dispatch_state = 'outcome_unknown'
+    )
+  THEN RAISE(ABORT, 'terminal_live_close_unknown_required') END;
+  SELECT CASE WHEN OLD.state = 'restarting'
+    AND OLD.cleanup_state = 'pending' AND NEW.state = 'disconnected'
+    AND NOT EXISTS (
+      SELECT 1 FROM terminal_live_mutations
+      WHERE terminal_id = OLD.terminal_id AND generation = OLD.generation
+        AND mutation_sequence = OLD.mutation_head
+        AND method = 'terminal.session.restart'
+        AND effect_phase = 'source-cleanup'
+        AND dispatch_state = 'outcome_unknown'
+    )
+  THEN RAISE(ABORT, 'terminal_live_restart_source_unknown_required') END;
+END;
+
+CREATE TRIGGER terminal_live_sessions_bound_inactive_update
+BEFORE UPDATE OF state, cleanup_state, deleted_at ON terminal_live_sessions
+WHEN NEW.state = 'exited'
+  AND NEW.cleanup_state = 'known_identity_members_complete'
+  AND NEW.deleted_at IS NULL
+  AND NOT (
+    OLD.state = 'exited'
+    AND OLD.cleanup_state = 'known_identity_members_complete'
+    AND OLD.deleted_at IS NULL
+  )
+BEGIN
+  SELECT CASE WHEN (
+    SELECT COUNT(*) FROM terminal_live_sessions
+    WHERE state = 'exited'
+      AND cleanup_state = 'known_identity_members_complete'
+      AND deleted_at IS NULL
+  ) >= ${String(MAX_RETAINED_INACTIVE_TERMINALS)}
+  THEN RAISE(ABORT, 'terminal_live_inactive_history_limit') END;
+END;
+
+CREATE TRIGGER terminal_live_generations_admit
+BEFORE INSERT ON terminal_live_generations
+BEGIN
+  SELECT CASE WHEN EXISTS (
+    SELECT 1 FROM orchestration_runs WHERE terminal_id = NEW.terminal_id
+  ) THEN RAISE(ABORT, 'terminal_live_orchestration_ineligible') END;
+  SELECT CASE WHEN (
+    (NOT EXISTS (
+      SELECT 1 FROM terminal_live_generations
+      WHERE terminal_id = NEW.terminal_id
+    ) AND NOT (
+      NEW.generation = 1 AND NEW.cleanup_state = 'pending'
+        AND NEW.cleanup_reason IS NULL
+    )) OR
+    (EXISTS (
+      SELECT 1 FROM terminal_live_generations
+      WHERE terminal_id = NEW.terminal_id
+    ) AND NOT EXISTS (
+      SELECT 1 FROM terminal_live_sessions current
+      JOIN terminal_live_generations previous
+        ON previous.terminal_id = current.terminal_id
+       AND previous.generation = current.generation
+      WHERE current.terminal_id = NEW.terminal_id
+        AND NEW.generation = current.generation + 1
+        AND current.state IN ('exited', 'restarting')
+        AND current.cleanup_state = 'known_identity_members_complete'
+        AND previous.cleanup_state = 'known_identity_members_complete'
+        AND NEW.cleanup_state = 'pending' AND NEW.cleanup_reason IS NULL
+        AND EXISTS (
+          SELECT 1 FROM terminal_live_mutations mutation
+          WHERE mutation.terminal_id = current.terminal_id
+            AND mutation.generation = current.generation
+            AND mutation.mutation_sequence = current.mutation_head
+            AND mutation.method = 'terminal.session.restart'
+            AND mutation.planned_target_generation = NEW.generation
+            AND mutation.effect_phase = 'target-start'
+            AND mutation.dispatch_state = 'prepared'
+        )
+    ))
+  ) THEN RAISE(ABORT, 'terminal_live_generation_not_next') END;
+END;
+
+CREATE TRIGGER terminal_live_generations_identity_immutable
+BEFORE UPDATE OF terminal_id, generation ON terminal_live_generations
+BEGIN
+  SELECT RAISE(ABORT, 'terminal_live_generation_identity_immutable');
+END;
+
+CREATE TRIGGER terminal_live_generations_cleanup_monotonic
+BEFORE UPDATE OF cleanup_state, cleanup_reason ON terminal_live_generations
+WHEN (
+  OLD.cleanup_state IN ('known_identity_members_complete', 'unknown')
+  AND (
+    NEW.cleanup_state <> OLD.cleanup_state OR
+    NEW.cleanup_reason IS NOT OLD.cleanup_reason
+  )
+) OR (
+  OLD.cleanup_state = 'pending'
+  AND NEW.cleanup_state NOT IN (
+    'pending', 'known_identity_members_complete', 'unknown'
+  )
+)
+BEGIN
+  SELECT RAISE(ABORT, 'terminal_live_generation_cleanup_final');
+END;
+
+CREATE TRIGGER terminal_live_generations_identity_retained
+BEFORE DELETE ON terminal_live_generations
+BEGIN
+  SELECT RAISE(ABORT, 'terminal_live_generation_identity_retained');
+END;
+
+CREATE TRIGGER terminal_live_sessions_generation_advance
+BEFORE UPDATE OF generation ON terminal_live_sessions
+WHEN NEW.generation <> OLD.generation
+BEGIN
+  SELECT CASE WHEN NOT (
+    NEW.generation = OLD.generation + 1
+    AND OLD.state = 'restarting'
+    AND OLD.cleanup_state = 'known_identity_members_complete'
+    AND NEW.revision = OLD.revision + 1
+    AND EXISTS (
+      SELECT 1 FROM terminal_live_mutations
+      WHERE terminal_id = OLD.terminal_id AND generation = OLD.generation
+        AND mutation_sequence = OLD.mutation_head
+        AND method = 'terminal.session.restart'
+        AND planned_target_generation = NEW.generation
+        AND effect_phase = 'target-start'
+        AND (
+          (dispatch_state = 'acknowledged'
+            AND acknowledgement_kind = 'process-started'
+            AND NEW.state = 'running' AND NEW.cleanup_state = 'pending'
+            AND NEW.cleanup_reason IS NULL) OR
+          (dispatch_state = 'outcome_unknown'
+            AND unknown_reason = 'native_acknowledgement_lost'
+            AND NEW.state = 'disconnected' AND NEW.cleanup_state = 'unknown'
+            AND NEW.cleanup_reason = 'native_acknowledgement_lost')
+        )
+    )
+    AND NOT EXISTS (
+      SELECT 1 FROM terminal_live_observers
+      WHERE terminal_id = OLD.terminal_id AND generation = OLD.generation
+    )
+    AND NOT EXISTS (
+      SELECT 1 FROM terminal_live_controller_requests
+      WHERE terminal_id = OLD.terminal_id AND generation = OLD.generation
+        AND state IN ('pending', 'ready')
+    )
+    AND NOT EXISTS (
+      SELECT 1 FROM terminal_live_controller_leases
+      WHERE terminal_id = OLD.terminal_id AND generation = OLD.generation
+        AND state = 'active'
+    )
+    AND NOT EXISTS (
+      SELECT 1 FROM terminal_live_mutations
+      WHERE terminal_id = OLD.terminal_id AND generation = OLD.generation
+        AND dispatch_state IN ('prepared', 'dispatching', 'attempted')
+    )
+  ) THEN RAISE(ABORT, 'terminal_live_generation_advance_invalid') END;
+END;
+
+CREATE TRIGGER terminal_live_sessions_sync_generation_insert
+AFTER INSERT ON terminal_live_sessions
+BEGIN
+  UPDATE terminal_live_generations
+  SET cleanup_state = NEW.cleanup_state,
+    cleanup_reason = NEW.cleanup_reason,
+    updated_at = NEW.updated_at
+  WHERE terminal_id = NEW.terminal_id AND generation = NEW.generation;
+END;
+
+CREATE TRIGGER terminal_live_sessions_sync_generation_update
+AFTER UPDATE OF cleanup_state, cleanup_reason, generation ON terminal_live_sessions
+BEGIN
+  UPDATE terminal_live_generations
+  SET cleanup_state = NEW.cleanup_state,
+    cleanup_reason = NEW.cleanup_reason,
+    updated_at = NEW.updated_at
+  WHERE terminal_id = NEW.terminal_id AND generation = NEW.generation;
+END;
+
+CREATE TRIGGER terminal_live_sessions_identity_immutable
+BEFORE UPDATE OF terminal_id ON terminal_live_sessions
+BEGIN
+  SELECT RAISE(ABORT, 'terminal_live_identity_immutable');
+END;
+
+CREATE TRIGGER terminal_live_sessions_kind_marker_immutable
+BEFORE DELETE ON terminal_live_sessions
+BEGIN
+  SELECT RAISE(ABORT, 'terminal_live_kind_marker_immutable');
+END;
+
+CREATE TRIGGER orchestration_runs_reject_live_terminal_insert
+BEFORE INSERT ON orchestration_runs
+WHEN EXISTS (
+  SELECT 1 FROM terminal_live_generations
+  WHERE terminal_id = NEW.terminal_id
+)
+BEGIN
+  SELECT RAISE(ABORT, 'orchestration_live_terminal_ineligible');
+END;
+
+CREATE TRIGGER orchestration_runs_reject_live_terminal_update
+BEFORE UPDATE OF terminal_id ON orchestration_runs
+WHEN EXISTS (
+  SELECT 1 FROM terminal_live_generations
+  WHERE terminal_id = NEW.terminal_id
+)
+BEGIN
+  SELECT RAISE(ABORT, 'orchestration_live_terminal_ineligible');
+END;
+
+CREATE TABLE terminal_live_chunks (
+  terminal_id TEXT NOT NULL,
+  chunk_cursor INTEGER NOT NULL CHECK (chunk_cursor >= 1),
+  generation INTEGER NOT NULL CHECK (
+    generation BETWEEN 1 AND ${String(MAX_TERMINAL_GENERATION)}
+  ),
+  content BLOB NOT NULL,
+  byte_length INTEGER NOT NULL CHECK (
+    byte_length BETWEEN 1 AND 32768 AND length(content) = byte_length
+  ),
+  line_count INTEGER NOT NULL CHECK (
+    line_count BETWEEN 0 AND byte_length
+  ),
+  content_digest TEXT NOT NULL CHECK (
+    length(content_digest) = 64 AND content_digest NOT GLOB '*[^a-f0-9]*'
+  ),
+  recorded_at TEXT NOT NULL,
+  PRIMARY KEY (terminal_id, chunk_cursor),
+  UNIQUE (terminal_id, chunk_cursor, generation),
+  FOREIGN KEY (terminal_id, generation)
+    REFERENCES terminal_live_generations(terminal_id, generation) ON DELETE RESTRICT
+) STRICT, WITHOUT ROWID;
+
+CREATE TRIGGER terminal_live_chunks_bound_insert
+BEFORE INSERT ON terminal_live_chunks
+BEGIN
+  SELECT CASE WHEN NOT EXISTS (
+    SELECT 1 FROM terminal_live_sessions
+    WHERE terminal_id = NEW.terminal_id
+      AND generation = NEW.generation
+      AND chunk_head + 1 = NEW.chunk_cursor
+      AND deleted_at IS NULL
+      AND state IN ('running', 'closing', 'restarting')
+  ) THEN RAISE(ABORT, 'terminal_live_chunk_sequence_invalid') END;
+  SELECT CASE WHEN (
+    SELECT COUNT(*) FROM terminal_live_chunks
+    WHERE terminal_id = NEW.terminal_id
+  ) >= ${String(MAX_TERMINAL_DURABLE_EVENTS_PER_TERMINAL)}
+  THEN RAISE(ABORT, 'terminal_live_chunk_history_limit') END;
+  SELECT CASE WHEN (
+    SELECT retained_bytes + NEW.byte_length FROM terminal_live_sessions
+    WHERE terminal_id = NEW.terminal_id
+  ) > ${String(MAX_TERMINAL_SCROLLBACK_BYTES)}
+  THEN RAISE(ABORT, 'terminal_live_scrollback_bytes_limit') END;
+  SELECT CASE WHEN (
+    SELECT retained_lines + NEW.line_count FROM terminal_live_sessions
+    WHERE terminal_id = NEW.terminal_id
+  ) > ${String(MAX_TERMINAL_SCROLLBACK_LINES)}
+  THEN RAISE(ABORT, 'terminal_live_scrollback_lines_limit') END;
+  SELECT CASE WHEN (
+    SELECT COALESCE(SUM(retained_bytes), 0) FROM terminal_live_sessions
+  ) + NEW.byte_length > ${String(MAX_TERMINAL_DURABLE_SCROLLBACK_BYTES_GLOBAL)}
+  THEN RAISE(ABORT, 'terminal_live_global_scrollback_limit') END;
+END;
+
+CREATE TRIGGER terminal_live_chunks_immutable
+BEFORE UPDATE ON terminal_live_chunks
+BEGIN
+  SELECT RAISE(ABORT, 'terminal_live_chunk_immutable');
+END;
+
+CREATE TRIGGER terminal_live_chunks_account_insert
+AFTER INSERT ON terminal_live_chunks
+BEGIN
+  UPDATE terminal_live_sessions
+  SET retained_bytes = retained_bytes + NEW.byte_length,
+    retained_lines = retained_lines + NEW.line_count,
+    chunk_head = NEW.chunk_cursor
+  WHERE terminal_id = NEW.terminal_id;
+END;
+
+CREATE TRIGGER terminal_live_chunks_account_delete
+AFTER DELETE ON terminal_live_chunks
+BEGIN
+  UPDATE terminal_live_sessions
+  SET retained_bytes = retained_bytes - OLD.byte_length,
+    retained_lines = retained_lines - OLD.line_count
+  WHERE terminal_id = OLD.terminal_id;
+END;
+
+CREATE TABLE terminal_live_events (
+  terminal_id TEXT NOT NULL,
+  event_cursor INTEGER NOT NULL CHECK (event_cursor >= 1),
+  generation INTEGER NOT NULL CHECK (
+    generation BETWEEN 1 AND ${String(MAX_TERMINAL_GENERATION)}
+  ),
+  event_type TEXT NOT NULL CHECK (
+    event_type IN (
+      'output', 'cleanup', 'exit', 'gap', 'controller-revoked',
+      'lifecycle-transition'
+    )
+  ),
+  chunk_cursor INTEGER,
+  metadata_json TEXT NOT NULL CHECK (
+    json_valid(metadata_json) AND length(CAST(metadata_json AS BLOB)) <= 65536
+      AND instr(metadata_json, 'bytesBase64') = 0
+  ),
+  recorded_at TEXT NOT NULL,
+  PRIMARY KEY (terminal_id, event_cursor),
+  CHECK (
+    (event_type = 'output' AND chunk_cursor IS NOT NULL) OR
+    (event_type <> 'output' AND chunk_cursor IS NULL)
+  ),
+  FOREIGN KEY (terminal_id, generation)
+    REFERENCES terminal_live_generations(terminal_id, generation) ON DELETE RESTRICT,
+  FOREIGN KEY (terminal_id, chunk_cursor, generation)
+    REFERENCES terminal_live_chunks(terminal_id, chunk_cursor, generation) ON DELETE CASCADE
+) STRICT, WITHOUT ROWID;
+
+CREATE TRIGGER terminal_live_events_bound_insert
+BEFORE INSERT ON terminal_live_events
+BEGIN
+  SELECT CASE WHEN NOT EXISTS (
+    SELECT 1 FROM terminal_live_sessions
+    WHERE terminal_id = NEW.terminal_id
+      AND generation = NEW.generation
+      AND event_head + 1 = NEW.event_cursor
+      AND deleted_at IS NULL
+  ) THEN RAISE(ABORT, 'terminal_live_event_sequence_invalid') END;
+  SELECT CASE WHEN (
+    SELECT COUNT(*) FROM terminal_live_events
+    WHERE terminal_id = NEW.terminal_id
+  ) >= ${String(MAX_TERMINAL_DURABLE_EVENTS_PER_TERMINAL)}
+  THEN RAISE(ABORT, 'terminal_live_event_history_limit') END;
+END;
+
+CREATE TRIGGER terminal_live_events_advance_head
+AFTER INSERT ON terminal_live_events
+BEGIN
+  UPDATE terminal_live_sessions
+  SET event_head = NEW.event_cursor
+  WHERE terminal_id = NEW.terminal_id;
+END;
+
+CREATE TRIGGER terminal_live_events_immutable
+BEFORE UPDATE ON terminal_live_events
+BEGIN
+  SELECT RAISE(ABORT, 'terminal_live_event_immutable');
+END;
+
+CREATE TABLE terminal_live_observers (
+  observer_id TEXT PRIMARY KEY NOT NULL,
+  terminal_id TEXT NOT NULL,
+  generation INTEGER NOT NULL CHECK (
+    generation BETWEEN 1 AND ${String(MAX_TERMINAL_GENERATION)}
+  ),
+  attach_id TEXT NOT NULL,
+  command_id TEXT UNIQUE NOT NULL,
+  after_cursor INTEGER NOT NULL CHECK (after_cursor >= 0),
+  expires_at TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  UNIQUE (terminal_id, attach_id),
+  FOREIGN KEY (terminal_id, generation)
+    REFERENCES terminal_live_generations(terminal_id, generation) ON DELETE RESTRICT
+) STRICT;
+
+CREATE TRIGGER terminal_live_observers_bound_insert
+BEFORE INSERT ON terminal_live_observers
+BEGIN
+  SELECT CASE WHEN NOT EXISTS (
+    SELECT 1 FROM terminal_live_sessions
+    WHERE terminal_id = NEW.terminal_id AND generation = NEW.generation
+      AND deleted_at IS NULL
+      AND state IN ('creating', 'running', 'closing', 'restarting')
+  ) THEN RAISE(ABORT, 'terminal_live_observer_generation_stale') END;
+  SELECT CASE WHEN (
+    SELECT COUNT(*) FROM terminal_live_observers
+  ) >= ${String(MAX_TERMINAL_OBSERVERS_GLOBAL)}
+  THEN RAISE(ABORT, 'terminal_live_observer_global_limit') END;
+  SELECT CASE WHEN (
+    SELECT COUNT(*) FROM terminal_live_observers
+    WHERE terminal_id = NEW.terminal_id
+  ) >= ${String(MAX_TERMINAL_OBSERVERS_PER_TERMINAL)}
+  THEN RAISE(ABORT, 'terminal_live_observer_terminal_limit') END;
+END;
+
+CREATE TRIGGER terminal_live_observers_bound_update
+BEFORE UPDATE ON terminal_live_observers
+BEGIN
+  SELECT CASE WHEN NEW.observer_id <> OLD.observer_id
+    OR NEW.terminal_id <> OLD.terminal_id OR NEW.generation <> OLD.generation
+    OR NEW.attach_id <> OLD.attach_id OR NEW.command_id <> OLD.command_id
+    OR NEW.created_at <> OLD.created_at
+  THEN RAISE(ABORT, 'terminal_live_observer_identity_immutable') END;
+  SELECT CASE WHEN NOT EXISTS (
+    SELECT 1 FROM terminal_live_sessions
+    WHERE terminal_id = NEW.terminal_id AND generation = NEW.generation
+      AND deleted_at IS NULL
+      AND state IN ('creating', 'running', 'closing', 'restarting')
+  ) THEN RAISE(ABORT, 'terminal_live_observer_generation_stale') END;
+END;
+
+CREATE TABLE terminal_live_controller_requests (
+  controller_request_id TEXT PRIMARY KEY NOT NULL,
+  terminal_id TEXT NOT NULL,
+  generation INTEGER NOT NULL CHECK (
+    generation BETWEEN 1 AND ${String(MAX_TERMINAL_GENERATION)}
+  ),
+  command_id TEXT UNIQUE NOT NULL,
+  state TEXT NOT NULL CHECK (state IN ('pending', 'ready', 'denied')),
+  position INTEGER,
+  requested_lease_ms INTEGER NOT NULL CHECK (
+    requested_lease_ms BETWEEN 1000 AND 30000
+  ),
+  denial_reason TEXT CHECK (
+    denial_reason IS NULL OR denial_reason IN ('expired', 'policy', 'queue_saturated')
+  ),
+  requested_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  UNIQUE (terminal_id, generation, position),
+  CHECK (
+    (state = 'pending' AND position BETWEEN 1 AND ${String(MAX_TERMINAL_CONTROLLER_REQUESTS_PER_TERMINAL)}
+      AND denial_reason IS NULL) OR
+    (state = 'ready' AND position IS NULL AND denial_reason IS NULL) OR
+    (state = 'denied' AND position IS NULL AND denial_reason IS NOT NULL)
+  ),
+  FOREIGN KEY (terminal_id, generation)
+    REFERENCES terminal_live_generations(terminal_id, generation) ON DELETE RESTRICT
+) STRICT;
+
+CREATE TRIGGER terminal_live_controller_requests_bound_insert
+BEFORE INSERT ON terminal_live_controller_requests
+BEGIN
+  SELECT CASE WHEN NOT EXISTS (
+    SELECT 1 FROM terminal_live_sessions
+    WHERE terminal_id = NEW.terminal_id AND generation = NEW.generation
+      AND state = 'running' AND deleted_at IS NULL
+  ) THEN RAISE(ABORT, 'terminal_live_controller_generation_stale') END;
+  SELECT CASE WHEN (
+    SELECT COUNT(*) FROM terminal_live_controller_requests
+    WHERE state IN ('pending', 'ready')
+  ) >= ${String(MAX_TERMINAL_CONTROLLER_REQUESTS_GLOBAL)}
+  THEN RAISE(ABORT, 'terminal_live_controller_request_global_limit') END;
+  SELECT CASE WHEN (
+    SELECT COUNT(*) FROM terminal_live_controller_requests
+    WHERE terminal_id = NEW.terminal_id AND state IN ('pending', 'ready')
+  ) >= ${String(MAX_TERMINAL_CONTROLLER_REQUESTS_PER_TERMINAL)}
+  THEN RAISE(ABORT, 'terminal_live_controller_request_terminal_limit') END;
+END;
+
+CREATE TRIGGER terminal_live_controller_requests_bound_update
+BEFORE UPDATE ON terminal_live_controller_requests
+BEGIN
+  SELECT CASE WHEN NEW.controller_request_id <> OLD.controller_request_id
+    OR NEW.terminal_id <> OLD.terminal_id OR NEW.generation <> OLD.generation
+    OR NEW.command_id <> OLD.command_id
+    OR NEW.requested_lease_ms <> OLD.requested_lease_ms
+    OR NEW.requested_at <> OLD.requested_at
+  THEN RAISE(ABORT, 'terminal_live_controller_request_identity_immutable') END;
+  SELECT CASE WHEN NOT (
+    (OLD.state = 'pending' AND NEW.state = 'pending'
+      AND NEW.denial_reason IS NULL) OR
+    (OLD.state = 'pending' AND NEW.state IN ('ready', 'denied')) OR
+    (OLD.state = 'ready' AND NEW.state = 'denied')
+  ) THEN RAISE(ABORT, 'terminal_live_controller_request_final') END;
+  SELECT CASE WHEN NOT EXISTS (
+    SELECT 1 FROM terminal_live_sessions
+    WHERE terminal_id = NEW.terminal_id AND generation = NEW.generation
+      AND deleted_at IS NULL
+      AND state IN ('running', 'closing', 'restarting')
+  ) THEN RAISE(ABORT, 'terminal_live_controller_generation_stale') END;
+END;
+
+CREATE TABLE terminal_live_controller_leases (
+  lease_id TEXT PRIMARY KEY NOT NULL,
+  terminal_id TEXT NOT NULL,
+  generation INTEGER NOT NULL CHECK (
+    generation BETWEEN 1 AND ${String(MAX_TERMINAL_GENERATION)}
+  ),
+  epoch INTEGER NOT NULL CHECK (epoch >= 1),
+  revision INTEGER NOT NULL CHECK (revision >= 1),
+  state TEXT NOT NULL CHECK (state IN ('active', 'expired', 'released', 'revoked')),
+  expires_at TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  UNIQUE (terminal_id, generation, epoch),
+  FOREIGN KEY (terminal_id, generation)
+    REFERENCES terminal_live_generations(terminal_id, generation) ON DELETE RESTRICT
+) STRICT;
+
+CREATE UNIQUE INDEX terminal_live_controller_one_active
+ON terminal_live_controller_leases(terminal_id) WHERE state = 'active';
+
+CREATE TRIGGER terminal_live_controller_leases_bound_insert
+BEFORE INSERT ON terminal_live_controller_leases
+BEGIN
+  SELECT CASE WHEN NEW.state <> 'active' OR NOT EXISTS (
+    SELECT 1 FROM terminal_live_sessions
+    WHERE terminal_id = NEW.terminal_id AND generation = NEW.generation
+      AND state = 'running' AND deleted_at IS NULL
+  ) THEN RAISE(ABORT, 'terminal_live_controller_lease_invalid') END;
+END;
+
+CREATE TRIGGER terminal_live_controller_leases_reactivate_guard
+BEFORE UPDATE ON terminal_live_controller_leases
+BEGIN
+  SELECT CASE WHEN NEW.lease_id <> OLD.lease_id
+    OR NEW.terminal_id <> OLD.terminal_id OR NEW.generation <> OLD.generation
+    OR NEW.epoch <> OLD.epoch OR NEW.created_at <> OLD.created_at
+  THEN RAISE(ABORT, 'terminal_live_controller_lease_identity_immutable') END;
+  SELECT CASE WHEN OLD.state <> 'active'
+    OR NEW.state NOT IN ('active', 'expired', 'released', 'revoked')
+    OR NEW.revision <> OLD.revision + 1
+  THEN RAISE(ABORT, 'terminal_live_controller_lease_final') END;
+  SELECT CASE WHEN NOT EXISTS (
+    SELECT 1 FROM terminal_live_sessions
+    WHERE terminal_id = NEW.terminal_id AND generation = NEW.generation
+      AND state IN ('running', 'closing', 'restarting') AND deleted_at IS NULL
+  ) THEN RAISE(ABORT, 'terminal_live_controller_lease_generation_stale') END;
+END;
+
+CREATE TABLE terminal_live_mutations (
+  command_id TEXT PRIMARY KEY NOT NULL,
+  terminal_id TEXT NOT NULL,
+  generation INTEGER NOT NULL CHECK (
+    generation BETWEEN 1 AND ${String(MAX_TERMINAL_GENERATION)}
+  ),
+  planned_target_generation INTEGER CHECK (
+    planned_target_generation IS NULL OR planned_target_generation BETWEEN 2 AND ${String(MAX_TERMINAL_GENERATION)}
+  ),
+  restart_source_cleanup_required INTEGER CHECK (
+    restart_source_cleanup_required IS NULL OR
+      restart_source_cleanup_required IN (0, 1)
+  ),
+  mutation_sequence INTEGER NOT NULL CHECK (
+    mutation_sequence BETWEEN 1 AND ${String(MAX_TERMINAL_MUTATION_SEQUENCE)}
+  ),
+  native_operation_sequence INTEGER CHECK (
+    native_operation_sequence IS NULL OR native_operation_sequence BETWEEN 1 AND ${String(MAX_TERMINAL_NATIVE_OPERATION_SEQUENCE)}
+  ),
+  method TEXT NOT NULL CHECK (method IN (
+    'terminal.create', 'terminal.controller.request',
+    'terminal.controller.acquire', 'terminal.controller.renew',
+    'terminal.controller.release', 'terminal.input.write',
+    'terminal.session.resize', 'terminal.session.signal',
+    'terminal.session.close', 'terminal.session.restart',
+    'terminal.session.delete'
+  )),
+  request_digest TEXT NOT NULL CHECK (
+    length(request_digest) = 64 AND request_digest NOT GLOB '*[^a-f0-9]*'
+  ),
+  controller_epoch INTEGER CHECK (controller_epoch IS NULL OR controller_epoch >= 1),
+  controller_revision INTEGER CHECK (controller_revision IS NULL OR controller_revision >= 1),
+  input_id TEXT,
+  input_sequence INTEGER CHECK (
+    input_sequence IS NULL OR input_sequence BETWEEN 1 AND 2147483647
+  ),
+  input_byte_length INTEGER CHECK (
+    input_byte_length IS NULL OR input_byte_length BETWEEN 1 AND 32768
+  ),
+  input_digest TEXT CHECK (
+    input_digest IS NULL OR (
+      length(input_digest) = 64 AND input_digest NOT GLOB '*[^a-f0-9]*'
+    )
+  ),
+  resize_columns INTEGER CHECK (
+    resize_columns IS NULL OR resize_columns BETWEEN 2 AND 500
+  ),
+  resize_rows INTEGER CHECK (
+    resize_rows IS NULL OR resize_rows BETWEEN 2 AND 300
+  ),
+  signal_name TEXT CHECK (
+    signal_name IS NULL OR signal_name IN ('hangup', 'interrupt', 'terminate')
+  ),
+  effect_phase TEXT NOT NULL CHECK (
+    effect_phase IN ('policy', 'native-effect', 'source-cleanup', 'target-start')
+  ),
+  dispatch_state TEXT NOT NULL CHECK (
+    dispatch_state IN (
+      'prepared', 'dispatching', 'attempted', 'acknowledged', 'outcome_unknown'
+    )
+  ),
+  target_attempt TEXT CHECK (
+    target_attempt IS NULL OR target_attempt IN (
+      'not-attempted', 'may-have-been-attempted', 'attempted'
+    )
+  ),
+  source_cleanup_ack_digest TEXT CHECK (
+    source_cleanup_ack_digest IS NULL OR (
+      length(source_cleanup_ack_digest) = 64
+        AND source_cleanup_ack_digest NOT GLOB '*[^a-f0-9]*'
+    )
+  ),
+  acknowledgement_command_id TEXT
+    REFERENCES command_receipts(command_id) ON DELETE RESTRICT,
+  acknowledgement_kind TEXT CHECK (
+    acknowledgement_kind IS NULL OR acknowledgement_kind IN (
+      'policy-recorded', 'process-started', 'pty-write-accepted',
+      'pty-resized', 'signal-delivered', 'cleanup-known'
+    )
+  ),
+  acknowledgement_digest TEXT CHECK (
+    acknowledgement_digest IS NULL OR (
+      length(acknowledgement_digest) = 64
+        AND acknowledgement_digest NOT GLOB '*[^a-f0-9]*'
+    )
+  ),
+  acknowledged_byte_length INTEGER CHECK (
+    acknowledged_byte_length IS NULL OR
+      acknowledged_byte_length BETWEEN 1 AND 32768
+  ),
+  unknown_reason TEXT CHECK (
+    unknown_reason IS NULL OR unknown_reason IN (
+      'deadline_exceeded', 'host_failed', 'interrupted',
+      'native_acknowledgement_lost', 'node_restarted', 'transport_failed'
+    )
+  ),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  UNIQUE (terminal_id, generation, mutation_sequence),
+  UNIQUE (terminal_id, generation, native_operation_sequence),
+  UNIQUE (terminal_id, generation, input_id, input_sequence),
+  CHECK (
+    (method IN (
+      'terminal.create', 'terminal.input.write', 'terminal.session.resize',
+      'terminal.session.signal', 'terminal.session.close'
+    ) AND native_operation_sequence IS NOT NULL) OR
+    (method NOT IN (
+      'terminal.create', 'terminal.input.write', 'terminal.session.resize',
+      'terminal.session.signal', 'terminal.session.close'
+    ) AND native_operation_sequence IS NULL)
+  ),
+  CHECK (
+    (method = 'terminal.session.resize' AND resize_columns IS NOT NULL
+      AND resize_rows IS NOT NULL) OR
+    (method <> 'terminal.session.resize' AND resize_columns IS NULL
+      AND resize_rows IS NULL)
+  ),
+  CHECK (
+    (method = 'terminal.session.signal' AND signal_name IS NOT NULL) OR
+    (method <> 'terminal.session.signal' AND signal_name IS NULL)
+  ),
+  CHECK (
+    (method = 'terminal.session.restart'
+      AND generation < ${String(MAX_TERMINAL_GENERATION)}
+      AND planned_target_generation = generation + 1
+      AND restart_source_cleanup_required IS NOT NULL
+      AND effect_phase IN ('source-cleanup', 'target-start')
+      AND target_attempt IS NOT NULL
+      AND (
+        (effect_phase = 'source-cleanup'
+          AND restart_source_cleanup_required = 1
+          AND target_attempt = 'not-attempted'
+          AND (
+            source_cleanup_ack_digest IS NULL OR
+            (dispatch_state = 'attempted'
+              AND source_cleanup_ack_digest IS NOT NULL)
+          )) OR
+        (effect_phase = 'target-start'
+          AND (
+            (restart_source_cleanup_required = 0
+              AND source_cleanup_ack_digest IS NULL) OR
+            (restart_source_cleanup_required = 1
+              AND source_cleanup_ack_digest IS NOT NULL)
+          ))
+      )) OR
+    (method <> 'terminal.session.restart'
+      AND planned_target_generation IS NULL
+      AND restart_source_cleanup_required IS NULL
+      AND target_attempt IS NULL
+      AND source_cleanup_ack_digest IS NULL
+      AND (
+        (method IN (
+          'terminal.controller.request', 'terminal.controller.acquire',
+          'terminal.controller.renew', 'terminal.controller.release',
+          'terminal.session.delete'
+        ) AND effect_phase = 'policy') OR
+        (method IN (
+          'terminal.create', 'terminal.input.write', 'terminal.session.resize',
+          'terminal.session.signal', 'terminal.session.close'
+        ) AND effect_phase = 'native-effect')
+      ))
+  ),
+  CHECK (
+    (method = 'terminal.input.write' AND input_id IS NOT NULL AND
+      input_sequence IS NOT NULL AND input_byte_length IS NOT NULL AND
+      input_digest IS NOT NULL) OR
+    (method <> 'terminal.input.write' AND input_id IS NULL AND
+      input_sequence IS NULL AND input_byte_length IS NULL AND
+      input_digest IS NULL)
+  ),
+  CHECK (
+    (method IN (
+      'terminal.controller.renew', 'terminal.controller.release',
+      'terminal.input.write', 'terminal.session.resize',
+      'terminal.session.signal', 'terminal.session.close',
+      'terminal.session.restart'
+    ) AND controller_epoch IS NOT NULL AND controller_revision IS NOT NULL) OR
+    (method NOT IN (
+      'terminal.controller.renew', 'terminal.controller.release',
+      'terminal.input.write', 'terminal.session.resize',
+      'terminal.session.signal', 'terminal.session.close',
+      'terminal.session.restart'
+    ) AND controller_epoch IS NULL AND controller_revision IS NULL)
+  ),
+  CHECK (
+    (method IN (
+      'terminal.controller.request', 'terminal.controller.acquire',
+      'terminal.controller.renew', 'terminal.controller.release',
+      'terminal.session.delete'
+    ) AND dispatch_state = 'acknowledged') OR
+    (method IN (
+      'terminal.create', 'terminal.input.write', 'terminal.session.resize',
+      'terminal.session.signal', 'terminal.session.close',
+      'terminal.session.restart'
+    ) AND dispatch_state IN (
+      'prepared', 'dispatching', 'attempted', 'acknowledged', 'outcome_unknown'
+    ))
+  ),
+  CHECK (
+    (dispatch_state = 'acknowledged'
+      AND acknowledgement_command_id = command_id
+      AND acknowledgement_kind IS NOT NULL
+      AND acknowledgement_digest IS NOT NULL
+      AND unknown_reason IS NULL
+      AND (
+        (method IN (
+          'terminal.controller.request', 'terminal.controller.acquire',
+          'terminal.controller.renew', 'terminal.controller.release',
+          'terminal.session.delete'
+        ) AND acknowledgement_kind = 'policy-recorded'
+          AND acknowledged_byte_length IS NULL) OR
+        (method IN ('terminal.create', 'terminal.session.restart')
+          AND acknowledgement_kind = 'process-started'
+          AND acknowledged_byte_length IS NULL) OR
+        (method = 'terminal.input.write'
+          AND acknowledgement_kind = 'pty-write-accepted'
+          AND acknowledged_byte_length = input_byte_length) OR
+        (method = 'terminal.session.resize'
+          AND acknowledgement_kind = 'pty-resized'
+          AND acknowledged_byte_length IS NULL) OR
+        (method = 'terminal.session.signal'
+          AND acknowledgement_kind = 'signal-delivered'
+          AND acknowledged_byte_length IS NULL) OR
+        (method = 'terminal.session.close'
+          AND acknowledgement_kind = 'cleanup-known'
+          AND acknowledged_byte_length IS NULL)
+      )) OR
+    (dispatch_state = 'outcome_unknown'
+      AND method IN (
+        'terminal.create', 'terminal.input.write', 'terminal.session.resize',
+        'terminal.session.signal', 'terminal.session.close',
+        'terminal.session.restart'
+      ) AND acknowledgement_command_id IS NULL
+      AND acknowledgement_kind IS NULL AND acknowledgement_digest IS NULL
+      AND acknowledged_byte_length IS NULL AND unknown_reason IS NOT NULL) OR
+    (dispatch_state IN ('prepared', 'dispatching', 'attempted')
+      AND method IN (
+        'terminal.create', 'terminal.input.write', 'terminal.session.resize',
+        'terminal.session.signal', 'terminal.session.close',
+        'terminal.session.restart'
+      ) AND acknowledgement_command_id IS NULL
+      AND acknowledgement_kind IS NULL AND acknowledgement_digest IS NULL
+      AND acknowledged_byte_length IS NULL AND unknown_reason IS NULL)
+  ),
+  CHECK (
+    method <> 'terminal.session.restart' OR
+    (effect_phase = 'source-cleanup'
+      AND dispatch_state IN (
+        'prepared', 'dispatching', 'attempted', 'outcome_unknown'
+      ) AND target_attempt = 'not-attempted') OR
+    (effect_phase = 'target-start' AND (
+      (dispatch_state = 'prepared' AND target_attempt = 'not-attempted') OR
+      (dispatch_state = 'dispatching'
+        AND target_attempt = 'may-have-been-attempted') OR
+      (dispatch_state = 'attempted' AND target_attempt = 'attempted') OR
+      (dispatch_state = 'acknowledged' AND target_attempt = 'attempted') OR
+      (dispatch_state = 'outcome_unknown'
+        AND target_attempt IN ('may-have-been-attempted', 'attempted')
+        AND unknown_reason = 'native_acknowledgement_lost')
+    ))
+  ),
+  FOREIGN KEY (terminal_id, generation)
+    REFERENCES terminal_live_generations(terminal_id, generation) ON DELETE RESTRICT
+) STRICT;
+
+CREATE TRIGGER terminal_live_mutations_bound_insert
+BEFORE INSERT ON terminal_live_mutations
+BEGIN
+  SELECT CASE WHEN NOT EXISTS (
+    SELECT 1 FROM terminal_live_sessions
+    WHERE terminal_id = NEW.terminal_id
+      AND generation = NEW.generation
+      AND mutation_head + 1 = NEW.mutation_sequence
+      AND (
+        NEW.native_operation_sequence IS NULL OR
+        native_operation_head + 1 = NEW.native_operation_sequence
+      )
+      AND deleted_at IS NULL
+      AND (
+        (NEW.method = 'terminal.create' AND state = 'creating'
+          AND generation = 1 AND NEW.mutation_sequence = 1
+          AND NEW.native_operation_sequence = 1
+          AND NEW.effect_phase = 'native-effect'
+          AND NEW.dispatch_state = 'prepared') OR
+        (NEW.method IN (
+          'terminal.controller.request', 'terminal.controller.acquire',
+          'terminal.controller.renew', 'terminal.controller.release'
+        ) AND state = 'running' AND NEW.effect_phase = 'policy'
+          AND NEW.dispatch_state = 'acknowledged') OR
+        (NEW.method IN (
+          'terminal.input.write', 'terminal.session.resize',
+          'terminal.session.signal'
+        ) AND state = 'running' AND NEW.effect_phase = 'native-effect'
+          AND NEW.dispatch_state = 'prepared') OR
+        (NEW.method = 'terminal.session.close' AND state = 'running'
+          AND NEW.effect_phase = 'native-effect'
+          AND NEW.dispatch_state = 'prepared') OR
+        (NEW.method = 'terminal.session.restart'
+          AND (
+            (state = 'running' AND cleanup_state = 'pending'
+              AND NEW.effect_phase = 'source-cleanup'
+              AND NEW.restart_source_cleanup_required = 1) OR
+            (state = 'exited'
+              AND cleanup_state = 'known_identity_members_complete'
+              AND NEW.effect_phase = 'target-start'
+              AND NEW.restart_source_cleanup_required = 0)
+          ) AND NEW.dispatch_state = 'prepared') OR
+        (NEW.method = 'terminal.session.delete'
+          AND state IN ('exited', 'disconnected')
+          AND NEW.effect_phase = 'policy'
+          AND NEW.dispatch_state = 'acknowledged')
+      )
+  ) THEN RAISE(ABORT, 'terminal_live_mutation_sequence_invalid') END;
+  SELECT CASE WHEN NEW.dispatch_state <> 'acknowledged'
+    AND NEW.dispatch_state <> 'prepared'
+  THEN RAISE(ABORT, 'terminal_live_mutation_initial_state_invalid') END;
+  SELECT CASE WHEN NEW.dispatch_state = 'prepared' AND EXISTS (
+    SELECT 1 FROM terminal_live_mutations
+    WHERE terminal_id = NEW.terminal_id
+      AND dispatch_state IN ('prepared', 'dispatching', 'attempted')
+  ) THEN RAISE(ABORT, 'terminal_live_native_operation_in_flight') END;
+  SELECT CASE WHEN NEW.effect_phase = 'policy' AND EXISTS (
+    SELECT 1 FROM terminal_live_mutations
+    WHERE terminal_id = NEW.terminal_id
+      AND dispatch_state IN ('prepared', 'dispatching', 'attempted')
+  ) THEN RAISE(ABORT, 'terminal_live_native_operation_in_flight') END;
+  SELECT CASE WHEN (
+    SELECT COUNT(*) FROM terminal_live_mutations
+    WHERE terminal_id = NEW.terminal_id
+  ) >= ${String(MAX_TERMINAL_MUTATIONS_PER_TERMINAL)}
+  THEN RAISE(ABORT, 'terminal_live_mutation_history_limit') END;
+END;
+
+CREATE TRIGGER terminal_live_mutations_final_receipt_insert
+BEFORE INSERT ON terminal_live_mutations
+WHEN NEW.dispatch_state IN ('acknowledged', 'outcome_unknown')
+BEGIN
+  SELECT CASE WHEN NOT EXISTS (
+    SELECT 1 FROM command_receipts receipt
+    WHERE receipt.command_id = NEW.command_id
+      AND receipt.actor_id = 'actor_local_user'
+      AND receipt.method = NEW.method
+      AND receipt.target_type = 'terminal'
+      AND receipt.target_id = NEW.terminal_id
+      AND length(CAST(receipt.result_json AS BLOB)) <= 65536
+      AND instr(receipt.result_json, 'bytesBase64') = 0
+      AND instr(receipt.result_json, 'rawInput') = 0
+  ) THEN RAISE(ABORT, 'terminal_live_acknowledgement_receipt_invalid') END;
+END;
+
+CREATE TRIGGER terminal_live_mutations_advance_head
+AFTER INSERT ON terminal_live_mutations
+BEGIN
+  UPDATE terminal_live_sessions
+  SET mutation_head = NEW.mutation_sequence,
+    native_operation_head = COALESCE(
+      NEW.native_operation_sequence, native_operation_head
+    )
+  WHERE terminal_id = NEW.terminal_id;
+END;
+
+CREATE TRIGGER terminal_live_mutations_finality
+BEFORE UPDATE
+ON terminal_live_mutations
+BEGIN
+  SELECT CASE WHEN NOT (
+    (OLD.method <> 'terminal.session.restart' AND (
+      (OLD.dispatch_state = 'prepared' AND NEW.dispatch_state = 'dispatching') OR
+      (OLD.dispatch_state = 'dispatching' AND NEW.dispatch_state = 'attempted') OR
+      (OLD.dispatch_state IN ('dispatching', 'attempted')
+        AND NEW.dispatch_state = 'outcome_unknown') OR
+      (OLD.dispatch_state = 'attempted'
+        AND NEW.dispatch_state = 'acknowledged')
+    )) OR
+    (OLD.method = 'terminal.session.restart'
+      AND OLD.effect_phase = NEW.effect_phase AND (
+        (OLD.dispatch_state = 'prepared'
+          AND NEW.dispatch_state = 'dispatching') OR
+        (OLD.dispatch_state = 'dispatching'
+          AND NEW.dispatch_state = 'attempted') OR
+        (OLD.dispatch_state IN ('dispatching', 'attempted')
+          AND NEW.dispatch_state = 'outcome_unknown') OR
+        (OLD.effect_phase = 'target-start'
+          AND OLD.dispatch_state = 'attempted'
+          AND NEW.dispatch_state = 'acknowledged') OR
+        (OLD.effect_phase = 'source-cleanup'
+          AND OLD.dispatch_state = 'attempted'
+          AND NEW.dispatch_state = 'attempted'
+          AND OLD.source_cleanup_ack_digest IS NULL
+          AND NEW.source_cleanup_ack_digest IS NOT NULL)
+      )) OR
+    (OLD.method = 'terminal.session.restart'
+      AND OLD.effect_phase = 'source-cleanup'
+      AND OLD.dispatch_state = 'attempted'
+      AND NEW.effect_phase = 'target-start'
+      AND NEW.dispatch_state = 'prepared'
+      AND OLD.source_cleanup_ack_digest IS NOT NULL
+      AND NEW.source_cleanup_ack_digest = OLD.source_cleanup_ack_digest)
+  ) THEN RAISE(ABORT, 'terminal_live_mutation_transition_invalid') END;
+  SELECT CASE WHEN OLD.method = 'terminal.session.restart'
+    AND OLD.effect_phase = 'source-cleanup'
+    AND NEW.effect_phase = 'target-start'
+    AND NOT EXISTS (
+      SELECT 1 FROM terminal_live_sessions
+      WHERE terminal_id = OLD.terminal_id AND generation = OLD.generation
+        AND state = 'restarting'
+        AND cleanup_state = 'known_identity_members_complete'
+        AND deleted_at IS NULL
+    )
+  THEN RAISE(ABORT, 'terminal_live_restart_source_cleanup_incomplete') END;
+  SELECT CASE WHEN NEW.dispatch_state IN ('acknowledged', 'outcome_unknown')
+    AND NOT EXISTS (
+    SELECT 1 FROM command_receipts receipt
+    WHERE receipt.command_id = NEW.command_id
+      AND receipt.actor_id = 'actor_local_user'
+      AND receipt.method = NEW.method
+      AND receipt.target_type = 'terminal'
+      AND receipt.target_id = NEW.terminal_id
+      AND length(CAST(receipt.result_json AS BLOB)) <= 65536
+      AND instr(receipt.result_json, 'bytesBase64') = 0
+      AND instr(receipt.result_json, 'rawInput') = 0
+  ) THEN RAISE(ABORT, 'terminal_live_acknowledgement_receipt_invalid') END;
+END;
+
+CREATE TRIGGER terminal_live_mutations_identity_immutable
+BEFORE UPDATE OF command_id, terminal_id, generation, mutation_sequence,
+  native_operation_sequence,
+  planned_target_generation, restart_source_cleanup_required,
+  method, request_digest, controller_epoch, controller_revision,
+  input_id, input_sequence, input_byte_length, input_digest,
+  resize_columns, resize_rows, signal_name, created_at
+ON terminal_live_mutations
+BEGIN
+  SELECT RAISE(ABORT, 'terminal_live_mutation_identity_immutable');
+END;
+
+CREATE TRIGGER terminal_live_mutations_retained
+BEFORE DELETE ON terminal_live_mutations
+BEGIN
+  SELECT RAISE(ABORT, 'terminal_live_mutation_retained');
+END;
+`;
+//# sourceMappingURL=migration-nine.js.map