@north-light/cli 0.3.532 → 0.3.533

package/dist/core/canvas/schema-pg.sql

@@ -0,0 +1,1022 @@
+-- Canvas schema for Postgres 18. Equivalent to the SQLite canvas.db at user_version 98 with the
+-- changes in the Postgres-swap design (Data model): text-id foreign keys (objects.id), `seq`
+-- identity columns for insertion order, jsonb where JSON functions run, bytea blobs, PL/pgSQL
+-- triggers, and pg_notify triggers for the broker-signal bus.
+--
+-- Applied once, in one transaction, by db.ts when canvas_meta has no `schema_version` row. Every
+-- later change is a numbered delta file, never an edit of this file's tables once released.
+-- Types: SQLite INTEGER (64-bit) is bigint everywhere, including 0/1 flags and epoch-ms columns.
+
+-- ---------------------------------------------------------------- objects and their satellites
+
+CREATE TABLE objects (
+  id         text PRIMARY KEY,
+  seq        bigint GENERATED BY DEFAULT AS IDENTITY UNIQUE,
+  type       text NOT NULL,
+  kind       text,
+  owner      text REFERENCES objects(id),
+  privacy    text NOT NULL DEFAULT 'public' CHECK (privacy IN ('public','friends','private')),
+  name       text NOT NULL,
+  preview    text NOT NULL DEFAULT '',
+  created_at text NOT NULL,
+  deleted_at text,
+  reception  bigint NOT NULL DEFAULT 0,
+  listen_json text,
+  home_machine text
+);
+CREATE INDEX objects_owner_type ON objects(owner, type, kind);
+CREATE INDEX objects_type_kind ON objects(type, kind);
+CREATE INDEX objects_receiving ON objects(seq) WHERE reception = 2;
+CREATE UNIQUE INDEX objects_named ON objects(owner, name)
+  WHERE deleted_at IS NULL AND home_machine IS NULL AND (type = 'document' OR strpos(type, '.') > 0);
+CREATE UNIQUE INDEX objects_handle ON objects(type, name)
+  WHERE home_machine IS NULL AND type IN ('person','app','repo','profile');
+
+CREATE TABLE documents (
+  object        text PRIMARY KEY REFERENCES objects(id) ON DELETE CASCADE,
+  summary       text,
+  heads_key     text NOT NULL,
+  revision      bigint NOT NULL,
+  why_it_exists text,
+  unlisted      bigint NOT NULL DEFAULT 0,
+  lint_ignore_json text,
+  extensions_json  text,
+  source_path   text
+);
+
+CREATE TABLE revisions (
+  rev_id     text PRIMARY KEY,
+  seq        bigint GENERATED BY DEFAULT AS IDENTITY UNIQUE,
+  document   text NOT NULL REFERENCES objects(id) ON DELETE CASCADE,
+  number     bigint NOT NULL,
+  body_hash  text NOT NULL,
+  author     text REFERENCES objects(id),
+  rationale  text,
+  verbatim   bigint NOT NULL DEFAULT 0,
+  created_at text NOT NULL
+);
+CREATE INDEX revisions_doc ON revisions(document, number);
+
+CREATE TABLE revision_parents (
+  child  text NOT NULL REFERENCES revisions(rev_id) ON DELETE CASCADE,
+  parent text NOT NULL REFERENCES revisions(rev_id) ON DELETE CASCADE,
+  PRIMARY KEY (child, parent)
+);
+CREATE INDEX revision_parents_parent ON revision_parents(parent);
+
+CREATE TABLE jobs (
+  object    text PRIMARY KEY REFERENCES objects(id) ON DELETE CASCADE,
+  command   text NOT NULL,
+  status    text NOT NULL CHECK (status IN ('running','exited','killed')),
+  exit_code bigint,
+  job_dir   text NOT NULL,
+  log_path  text NOT NULL
+);
+
+CREATE TABLE identities (
+  object      text PRIMARY KEY REFERENCES objects(id) ON DELETE CASCADE,
+  scheme      text NOT NULL,
+  external_id text NOT NULL,
+  UNIQUE (scheme, external_id)
+);
+
+CREATE TABLE custom_objects (
+  object        text PRIMARY KEY REFERENCES objects(id) ON DELETE CASCADE,
+  receiver_json text,
+  payload_json  text,
+  description   text,
+  summary       text,
+  state_json    text,
+  published_at  text,
+  token_hash    text,
+  dropped       bigint NOT NULL DEFAULT 0,
+  registered_by text
+);
+
+CREATE TABLE context_sessions (
+  node                text PRIMARY KEY REFERENCES objects(id) ON DELETE CASCADE,
+  preference_snapshot text,
+  listed_json         text NOT NULL DEFAULT '{}'
+);
+
+CREATE TABLE peer_stubs (
+  object        text PRIMARY KEY REFERENCES objects(id) ON DELETE CASCADE,
+  home_machine  text NOT NULL,
+  envelope_json jsonb,
+  created_at    text NOT NULL
+);
+
+CREATE TABLE object_kinds (
+  name        text PRIMARY KEY,
+  owner       text NOT NULL REFERENCES objects(id),
+  description text NOT NULL DEFAULT '',
+  events_json text NOT NULL,
+  created_at  text NOT NULL,
+  updated_at  text NOT NULL,
+  read_json   text,
+  source      text NOT NULL DEFAULT 'register' CHECK (source IN ('register','manifest','peer')),
+  declared    bigint NOT NULL DEFAULT 1
+);
+
+CREATE TABLE watches (
+  watch_id       text PRIMARY KEY,
+  seq            bigint GENERATED BY DEFAULT AS IDENTITY UNIQUE,
+  watcher        text NOT NULL REFERENCES objects(id) ON DELETE CASCADE,
+  object         text NOT NULL REFERENCES objects(id) ON DELETE CASCADE,
+  in_tree        bigint NOT NULL DEFAULT 0,
+  read_heads_key text,
+  created_at     text NOT NULL,
+  link_app       text REFERENCES objects(id) ON DELETE CASCADE,
+  UNIQUE (watcher, object)
+);
+CREATE INDEX watches_object ON watches(object, watcher);
+CREATE INDEX watches_tree_down ON watches(watcher, object) WHERE in_tree = 1;
+CREATE INDEX watches_tree_up ON watches(object, watcher) WHERE in_tree = 1;
+
+CREATE TABLE watch_subscriptions (
+  subscription_id text PRIMARY KEY,
+  seq             bigint GENERATED BY DEFAULT AS IDENTITY UNIQUE,
+  watch           text NOT NULL REFERENCES watches(watch_id) ON DELETE CASCADE,
+  pattern         text NOT NULL,
+  filter_json     text,
+  config_json     text,
+  started_by      text NOT NULL CHECK (started_by IN ('spawn','job-start','ask','read','write','act','message','deliver','fork')),
+  ends_on         text,
+  created_at      text NOT NULL
+);
+CREATE INDEX watch_subscriptions_watch ON watch_subscriptions(watch);
+
+CREATE TABLE exposures (
+  node         text NOT NULL REFERENCES objects(id) ON DELETE CASCADE,
+  object       text NOT NULL REFERENCES objects(id) ON DELETE CASCADE,
+  channel      text NOT NULL CHECK (channel IN ('system','transcript')),
+  level        text NOT NULL CHECK (level IN ('name','preview','content')),
+  heads_key    text,
+  content_hash text,
+  PRIMARY KEY (node, object, channel)
+);
+
+CREATE TABLE rules (
+  object   text NOT NULL REFERENCES objects(id) ON DELETE CASCADE,
+  position bigint NOT NULL,
+  owner    text,
+  on_event text NOT NULL CHECK (on_event IN ('boot','workspace-open','file-read','document-read','command','pre-command','slash-command')),
+  match_json text,
+  match_frontmatter_json text,
+  if_json  text,
+  deliver  text NOT NULL CHECK (deliver IN ('name','preview','content')),
+  PRIMARY KEY (object, position)
+);
+CREATE INDEX rules_on_owner ON rules(on_event, owner);
+
+CREATE TABLE edges (
+  type       text NOT NULL CHECK (type IN ('acted-on','links-to')),
+  src        text NOT NULL REFERENCES objects(id) ON DELETE CASCADE,
+  dst        text NOT NULL REFERENCES objects(id) ON DELETE CASCADE,
+  written_as text,
+  created_at text NOT NULL,
+  PRIMARY KEY (type, src, dst)
+);
+CREATE INDEX edges_dst ON edges(type, dst, src);
+
+CREATE TABLE unresolved_links (
+  src  text NOT NULL REFERENCES objects(id) ON DELETE CASCADE,
+  name text NOT NULL,
+  PRIMARY KEY (src, name)
+);
+
+-- ---------------------------------------------------------------- nodes and runtime state
+
+CREATE TABLE nodes (
+  node_id    text PRIMARY KEY,
+  mode       text NOT NULL DEFAULT 'base',
+  lifecycle  text NOT NULL DEFAULT 'terminal',
+  status     text NOT NULL DEFAULT 'active',
+  cwd        text NOT NULL,
+  parent     text,
+  created    text NOT NULL,
+  intent     text,
+  "window"   text,
+  tmux_session text,
+  pane       text,
+  host_kind  text,
+  profile_id text,
+  final_report text,
+  finalized_at text,
+  frozen_at  text,
+  respawn_failures bigint NOT NULL DEFAULT 0,
+  respawn_not_before text,
+  launched_at text,
+  last_settled_at text,
+  terminal_reason text,
+  description text,
+  cycles     bigint,
+  outcome_kind text,
+  outcome_reason text,
+  outcome_at text,
+  outcome_revision bigint NOT NULL DEFAULT 0,
+  outcome_detail_json text,
+  deadline_at text,
+  title      text,
+  icon       text,
+  spawned_by text,
+  creator    text,
+  fork_from  text,
+  fork_source_file text,
+  passive_default bigint NOT NULL DEFAULT 0 CHECK (passive_default IN (0,1)),
+  cycle_pending bigint NOT NULL DEFAULT 0 CHECK (cycle_pending IN (0,1)),
+  model_override text,
+  persona_ack_json text,
+  review_binding_json text,
+  launch_config_json text,
+  scopes_json text,
+  telemetry_tokens_in bigint,
+  telemetry_context_tokens bigint,
+  telemetry_last_activity text,
+  telemetry_updated_at text,
+  sub        text,
+  grant_id   text,
+  client_id  text,
+  metadata_json text,
+  run_id     text,
+  event_cursor bigint,
+  usage_json text,
+  deleting_at text,
+  last_activity_at text,
+  isolated   bigint NOT NULL DEFAULT 0 CHECK (isolated IN (0,1)),
+  last_turn_error_json text,
+  reply_at   text,
+  read_at    text
+);
+CREATE INDEX idx_nodes_status ON nodes(status);
+CREATE INDEX idx_nodes_parent ON nodes(parent);
+CREATE INDEX idx_nodes_created ON nodes(created);
+CREATE INDEX idx_nodes_parent_created ON nodes(parent, created);
+CREATE INDEX idx_nodes_run_id ON nodes(run_id);
+CREATE INDEX idx_nodes_deadline ON nodes(deadline_at) WHERE deadline_at IS NOT NULL;
+CREATE INDEX idx_nodes_cycle_pending ON nodes(cycle_pending) WHERE cycle_pending = 1;
+CREATE INDEX idx_nodes_terminal_placement_created ON nodes(created)
+  WHERE status IN ('done', 'canceled', 'dead')
+    AND (pane IS NOT NULL OR "window" IS NOT NULL OR tmux_session IS NOT NULL);
+CREATE INDEX idx_nodes_supervision_frozen ON nodes(node_id) WHERE frozen_at IS NOT NULL;
+
+CREATE TABLE focuses (
+  focus_id text PRIMARY KEY,
+  pane     text,
+  session  text,
+  node_id  text NOT NULL UNIQUE
+);
+
+CREATE TABLE canvas_meta (
+  key   text PRIMARY KEY,
+  value text NOT NULL
+);
+
+CREATE TABLE runtime_state (
+  key   text PRIMARY KEY,
+  value text NOT NULL
+);
+
+CREATE TABLE warm_pool (
+  node_id    text PRIMARY KEY REFERENCES nodes(node_id) ON DELETE CASCADE,
+  recipe_key text NOT NULL,
+  created    text NOT NULL
+);
+CREATE INDEX idx_warm_pool_recipe ON warm_pool(recipe_key, created);
+
+CREATE TABLE sessions (
+  binding_id text PRIMARY KEY,
+  seq        bigint GENERATED BY DEFAULT AS IDENTITY UNIQUE,
+  session_id text,
+  node_id    text NOT NULL REFERENCES nodes(node_id) ON DELETE CASCADE,
+  transcript_path text,
+  source_session_id text,
+  fork_entry_id text,
+  created_at text NOT NULL,
+  bound_at   text NOT NULL,
+  unbound_at text,
+  event_offset bigint,
+  indexed_entry_id text,
+  input_ids_json text NOT NULL DEFAULT '[]'
+);
+CREATE INDEX idx_sessions_node ON sessions(node_id, created_at);
+CREATE INDEX idx_sessions_session ON sessions(session_id);
+CREATE UNIQUE INDEX idx_sessions_live_node ON sessions(node_id) WHERE unbound_at IS NULL;
+CREATE UNIQUE INDEX idx_sessions_live_transcript ON sessions(transcript_path)
+  WHERE unbound_at IS NULL AND transcript_path IS NOT NULL;
+
+CREATE TABLE executions (
+  execution_id text PRIMARY KEY,
+  seq          bigint GENERATED BY DEFAULT AS IDENTITY UNIQUE,
+  node_id      text NOT NULL REFERENCES nodes(node_id) ON DELETE CASCADE,
+  daemon_epoch text,
+  pid          bigint,
+  process_identity text,
+  state        text NOT NULL CHECK (state IN ('launching','running','exited')),
+  started_at   text NOT NULL,
+  ended_at     text,
+  exit_reason  text,
+  turn_open_at text,
+  turn_progress_at text,
+  turn_closed_at text,
+  turn_end_reason text CHECK (turn_end_reason IS NULL OR turn_end_reason IN ('settled', 'teardown-aborted')),
+  exit_diagnostic_json text,
+  CHECK ((state = 'exited') = (ended_at IS NOT NULL))
+);
+CREATE INDEX idx_executions_node ON executions(node_id, started_at);
+CREATE UNIQUE INDEX idx_executions_live_node ON executions(node_id) WHERE state != 'exited';
+
+CREATE TABLE worktrees (
+  node_id text PRIMARY KEY REFERENCES nodes(node_id) ON DELETE CASCADE,
+  state   text NOT NULL CHECK (state IN ('open','closed','abandoned')),
+  cleanup_state text CHECK (cleanup_state IS NULL OR cleanup_state IN ('pending','complete')),
+  path    text NOT NULL,
+  branch  text NOT NULL,
+  repo_root text NOT NULL,
+  base_ref text NOT NULL,
+  base_sha text NOT NULL,
+  created_at text NOT NULL,
+  closed_at text,
+  next_attempt_at text,
+  attempts bigint NOT NULL DEFAULT 0 CHECK (attempts >= 0),
+  quarantined bigint NOT NULL DEFAULT 0 CHECK (quarantined IN (0,1)),
+  sweep_reason text,
+  sweep_detail text,
+  sweep_last_at text,
+  sweep_observed_json text,
+  abandoned_json text,
+  land_intent_json text,
+  disposal_json text
+);
+CREATE INDEX idx_worktrees_sweep ON worktrees(state, cleanup_state, next_attempt_at);
+
+CREATE TABLE node_faults (
+  fault_id text PRIMARY KEY,
+  node_id  text NOT NULL REFERENCES nodes(node_id) ON DELETE CASCADE,
+  link     text NOT NULL CHECK (link IN ('pi→provider', 'viewer↔broker', 'relay↔broker', 'viewer↔crtrd', 'daemon→node', 'crtr→pi')),
+  op       text NOT NULL,
+  kind     text NOT NULL CHECK (kind IN ('rate-limit', 'overloaded', 'connection', 'auth', 'protocol', 'context-overflow', 'other', 'wedged', 'model-not-found')),
+  message  text NOT NULL,
+  since    text NOT NULL,
+  operation_id text NOT NULL,
+  anchor_entry_id text,
+  retry_disposition text NOT NULL CHECK (retry_disposition IN ('auto', 'manual', 'fatal')),
+  retry_by text CHECK (retry_by IS NULL OR retry_by IN ('sdk', 'daemon', 'client')),
+  retry_attempt bigint,
+  retry_max bigint,
+  retry_next_at text,
+  provider_error_json text,
+  active   bigint NOT NULL DEFAULT 0 CHECK (active IN (0, 1)),
+  episode_state text CHECK (episode_state IS NULL OR episode_state IN ('pending', 'admitted', 'invalidated')),
+  episode_binding_id text REFERENCES sessions(binding_id),
+  created_at text NOT NULL,
+  updated_at text NOT NULL,
+  notified_since text
+);
+CREATE UNIQUE INDEX idx_node_faults_active ON node_faults(node_id) WHERE active = 1;
+CREATE UNIQUE INDEX idx_node_faults_episode ON node_faults(node_id) WHERE episode_state IS NOT NULL;
+
+CREATE TABLE node_tokens (
+  broker_process_id text PRIMARY KEY REFERENCES executions(execution_id) ON DELETE CASCADE,
+  node_id   text NOT NULL REFERENCES nodes(node_id) ON DELETE CASCADE,
+  token_hash text NOT NULL UNIQUE,
+  grantee   text NOT NULL,
+  uid       bigint NOT NULL,
+  sub       text NOT NULL,
+  "grant"   text,
+  client_id text,
+  scopes_json text,
+  issued_at text NOT NULL,
+  revoked_at text
+);
+
+CREATE TABLE node_outcome_deliveries (
+  node_id text PRIMARY KEY REFERENCES nodes(node_id) ON DELETE CASCADE,
+  state   text NOT NULL,
+  attempt bigint NOT NULL DEFAULT 0,
+  action_name text NOT NULL,
+  argv_json text NOT NULL,
+  cwd     text NOT NULL,
+  config_origin text NOT NULL,
+  payload_json text,
+  document_json text,
+  next_attempt_at bigint NOT NULL DEFAULT 0,
+  claimed_at bigint,
+  claim_owner text,
+  accepted_at bigint,
+  permanent_failed_at bigint,
+  last_failure_json text,
+  created_at bigint NOT NULL,
+  updated_at bigint NOT NULL
+);
+CREATE INDEX idx_node_outcome_deliveries_due ON node_outcome_deliveries(state, next_attempt_at);
+
+CREATE TABLE deleted_isolated_nodes (
+  node_id text PRIMARY KEY,
+  run_id  text NOT NULL
+);
+
+CREATE TABLE create_requests (
+  request_key text PRIMARY KEY,
+  node_id     text,
+  expires_at  bigint NOT NULL,
+  state       text NOT NULL DEFAULT 'reserved' CHECK (state IN ('reserved', 'warm_claimed', 'complete'))
+);
+CREATE INDEX idx_create_requests_expires ON create_requests(expires_at);
+
+CREATE TABLE waits (
+  wait_id    text PRIMARY KEY,
+  seq        bigint GENERATED BY DEFAULT AS IDENTITY UNIQUE,
+  node_id    text NOT NULL REFERENCES nodes(node_id) ON DELETE CASCADE,
+  kind       text NOT NULL CHECK (kind IN ('controller', 'object')),
+  target_id  text NOT NULL,
+  generation bigint NOT NULL,
+  created_at bigint NOT NULL,
+  satisfied_at bigint
+);
+CREATE UNIQUE INDEX waits_live ON waits(node_id) WHERE satisfied_at IS NULL AND kind = 'controller';
+CREATE UNIQUE INDEX waits_live_object ON waits(node_id, target_id) WHERE satisfied_at IS NULL AND kind = 'object';
+CREATE INDEX waits_target ON waits(target_id) WHERE satisfied_at IS NULL;
+CREATE INDEX waits_node ON waits(node_id);
+
+-- ---------------------------------------------------------------- messaging
+
+CREATE TABLE messages (
+  message_id text PRIMARY KEY,
+  seq        bigint NOT NULL UNIQUE,
+  operation_id text NOT NULL,
+  created_at text NOT NULL,
+  sender_node_id text,
+  sender_name text,
+  kind       text NOT NULL CHECK (kind IN ('update', 'urgent', 'final', 'message', 'completed')),
+  label      text NOT NULL,
+  body_ref   text,
+  body_json  jsonb,
+  disposition text CHECK (disposition IS NULL OR disposition IN ('human-answer', 'human-canceled')),
+  event      text,
+  object_id  text,
+  level      bigint,
+  actor_id   text,
+  cause_message_id text,
+  depth      bigint NOT NULL DEFAULT 0
+);
+
+CREATE TABLE message_sequence (
+  id  bigint PRIMARY KEY CHECK (id = 1),
+  seq bigint NOT NULL
+);
+-- The single counter row feed/messages.ts increments; the SQLite importer sets seq to MAX(messages.seq).
+INSERT INTO message_sequence (id, seq) VALUES (1, 0);
+
+CREATE TABLE message_causes (
+  message_id text PRIMARY KEY,
+  depth      bigint NOT NULL
+);
+
+CREATE TABLE deliveries (
+  delivery_id text PRIMARY KEY,
+  seq         bigint GENERATED BY DEFAULT AS IDENTITY UNIQUE,
+  message_id  text NOT NULL REFERENCES messages(message_id),
+  destination_id text NOT NULL,
+  urgency     text NOT NULL CHECK (urgency IN ('critical', 'urgent', 'normal', 'deferred')),
+  wake        bigint NOT NULL CHECK (wake IN (0, 1)),
+  state       text NOT NULL CHECK (state IN ('pending', 'handed_off', 'acknowledged', 'permanent_failed')),
+  attempts    bigint NOT NULL DEFAULT 0 CHECK (attempts >= 0),
+  next_attempt_at bigint,
+  claimed_at  bigint,
+  claim_owner text,
+  acknowledged_at bigint,
+  failed_at   bigint,
+  last_failure_json text,
+  idempotency_key text,
+  canceled_at bigint,
+  created_at  bigint NOT NULL,
+  updated_at  bigint NOT NULL
+);
+CREATE INDEX deliveries_destination ON deliveries(destination_id, wake, state, created_at);
+CREATE INDEX deliveries_due ON deliveries(state, next_attempt_at, created_at, delivery_id)
+  WHERE next_attempt_at IS NOT NULL AND canceled_at IS NULL;
+CREATE INDEX deliveries_handed_off ON deliveries(claim_owner) WHERE state = 'handed_off';
+CREATE INDEX deliveries_message ON deliveries(message_id);
+CREATE UNIQUE INDEX deliveries_idempotency ON deliveries(idempotency_key) WHERE idempotency_key IS NOT NULL;
+
+CREATE TABLE structured_requests (
+  request_id text PRIMARY KEY,
+  seq        bigint GENERATED BY DEFAULT AS IDENTITY UNIQUE,
+  node_id    text REFERENCES nodes(node_id) ON DELETE CASCADE,
+  mode       text NOT NULL,
+  submission text NOT NULL,
+  dedicated  bigint NOT NULL,
+  state      text NOT NULL,
+  schema_json text NOT NULL,
+  result_json text,
+  deadline_at bigint,
+  created_at bigint NOT NULL,
+  settled_at bigint,
+  effects_done_at bigint,
+  result_path text,
+  declined_reason text,
+  declined_code text,
+  declined_retryable bigint,
+  failure_reason text,
+  failure_detail_json text,
+  request_message_id text
+);
+CREATE UNIQUE INDEX idx_structured_requests_one_pending_node ON structured_requests(node_id) WHERE state = 'pending';
+CREATE INDEX idx_structured_requests_expiry ON structured_requests(state, deadline_at);
+CREATE INDEX idx_structured_requests_effects ON structured_requests(effects_done_at) WHERE effects_done_at IS NULL;
+
+CREATE TABLE daemon_actions (
+  action_id text PRIMARY KEY,
+  adapter_json text NOT NULL,
+  body_json text,
+  idempotency_key text NOT NULL UNIQUE,
+  state text NOT NULL CHECK (state IN ('pending', 'handed_off', 'acknowledged', 'permanent_failed')),
+  attempts bigint NOT NULL DEFAULT 0 CHECK (attempts >= 0),
+  next_attempt_at bigint,
+  claimed_at bigint,
+  claim_owner text,
+  acknowledged_at bigint,
+  failed_at bigint,
+  last_failure_json text,
+  canceled_at bigint,
+  created_at bigint NOT NULL,
+  updated_at bigint NOT NULL
+);
+CREATE INDEX daemon_actions_due ON daemon_actions(state, next_attempt_at, created_at, action_id) WHERE canceled_at IS NULL;
+
+-- ---------------------------------------------------------------- human requests and reviews
+
+CREATE TABLE human_requests (
+  request_id text PRIMARY KEY,
+  kind       text NOT NULL CHECK (kind IN ('page','review')),
+  inbox_ticket_id text NOT NULL UNIQUE,
+  request_dir text NOT NULL,
+  presentation_dir text,
+  requester_node_id text,
+  companion_node_id text UNIQUE,
+  idempotency_key text UNIQUE,
+  state      text NOT NULL CHECK (state IN ('binding','open','settled')),
+  outcome    text CHECK (outcome IN ('approved','answered','canceled','dismissed')),
+  inbox_listed bigint NOT NULL,
+  settleable bigint NOT NULL,
+  title      text NOT NULL,
+  subtitle   text,
+  file       text,
+  specification_json jsonb NOT NULL,
+  action_json jsonb,
+  progress_json jsonb,
+  feedback_json jsonb,
+  result_json jsonb,
+  anchor_base_sha256 text,
+  anchor_base_bytes bytea,
+  created_at text NOT NULL,
+  opened_at  text,
+  submit_requested_at text,
+  settled_at text,
+  settlement_delivery_id text,
+  action_delivery_id text,
+  submit_note_delivery_id text,
+  projected_at text,
+  projection_error text,
+  companion_retired_at text,
+  updated_at text NOT NULL,
+  CHECK ((state = 'settled') = (outcome IS NOT NULL)),
+  CHECK ((state = 'settled') = (result_json IS NOT NULL)),
+  CHECK (kind <> 'page' OR presentation_dir IS NOT NULL)
+);
+CREATE INDEX idx_human_requests_inbox ON human_requests(state, inbox_listed);
+CREATE INDEX idx_human_requests_kind_state ON human_requests(kind, state);
+CREATE INDEX idx_human_requests_submit ON human_requests(state, submit_requested_at);
+CREATE INDEX idx_human_requests_file ON human_requests(file);
+CREATE INDEX idx_human_requests_requester ON human_requests(requester_node_id);
+CREATE INDEX idx_human_requests_page_source ON human_requests((specification_json #>> '{source,nodeId}'))
+  WHERE kind = 'page';
+CREATE INDEX idx_human_requests_page_invalid_spec ON human_requests(created_at, request_id)
+  WHERE kind = 'page' AND jsonb_typeof(specification_json) <> 'object';
+CREATE INDEX idx_human_requests_page_result_exception ON human_requests(created_at, request_id)
+  WHERE kind = 'page' AND result_json IS NOT NULL
+    AND (result_json ->> 'kind') = 'page'
+    AND jsonb_typeof(result_json -> 'summary') IS DISTINCT FROM 'string';
+
+CREATE TABLE human_action_deliveries (
+  request_id text PRIMARY KEY,
+  state      text NOT NULL,
+  attempt    bigint NOT NULL DEFAULT 0,
+  argv_json  text NOT NULL,
+  cwd        text NOT NULL,
+  completion_json text NOT NULL,
+  next_attempt_at bigint NOT NULL,
+  claimed_at bigint,
+  claim_owner text,
+  accepted_at bigint,
+  permanent_failed_at bigint,
+  last_failure_json text,
+  created_at bigint NOT NULL,
+  updated_at bigint NOT NULL
+);
+CREATE INDEX idx_human_action_deliveries_due ON human_action_deliveries(state, next_attempt_at);
+
+CREATE TABLE review_comments (
+  comment_id text PRIMARY KEY,
+  review_id  text NOT NULL,
+  status     text NOT NULL CHECK (status IN ('open', 'resolved', 'deleted')),
+  revision   bigint NOT NULL,
+  text       text NOT NULL,
+  anchor_line bigint NOT NULL,
+  anchor_end_line bigint NOT NULL,
+  anchor_col_start bigint,
+  anchor_col_end bigint,
+  anchor_quote text,
+  anchor_line_text text NOT NULL,
+  anchor_doc_hash text NOT NULL,
+  author_kind text NOT NULL CHECK (author_kind IN ('human', 'node')),
+  author_node_id text,
+  updated_by_kind text NOT NULL CHECK (updated_by_kind IN ('human', 'node')),
+  updated_by_node_id text,
+  created_at text NOT NULL,
+  updated_at text NOT NULL,
+  resolved_at text,
+  deleted_at text,
+  created_seq bigint NOT NULL,
+  anchor_state text NOT NULL DEFAULT 'live' CHECK (anchor_state IN ('live', 'detached'))
+);
+CREATE INDEX idx_review_comments_review_line_seq ON review_comments(review_id, anchor_line, created_seq);
+CREATE INDEX idx_review_comments_review_status ON review_comments(review_id, status);
+
+CREATE TABLE review_comment_events (
+  seq        bigint GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  review_id  text NOT NULL,
+  comment_id text NOT NULL,
+  kind       text NOT NULL CHECK (kind IN ('created', 'edited', 'resolved', 'reopened', 'deleted', 'reanchored', 'notified', 'notify_failed')),
+  state_change bigint NOT NULL,
+  revision_after bigint,
+  actor_kind text NOT NULL CHECK (actor_kind IN ('human', 'node', 'system')),
+  actor_node_id text,
+  at         text NOT NULL,
+  operation_id text NOT NULL,
+  payload    text
+);
+CREATE INDEX idx_review_comment_events_review_seq ON review_comment_events(review_id, seq);
+CREATE INDEX idx_review_comment_events_comment_seq ON review_comment_events(comment_id, seq);
+
+-- ---------------------------------------------------------------- runs, grants, audit, usage
+
+-- body_json stays text: 77 rows carry the JSON escape \u0000, which jsonb and json operators reject.
+CREATE TABLE run_events (
+  run_id          text NOT NULL REFERENCES nodes(node_id) ON DELETE CASCADE,
+  sequence_number bigint NOT NULL,
+  seq             bigint GENERATED BY DEFAULT AS IDENTITY UNIQUE,
+  node_id         text NOT NULL,
+  type            text NOT NULL,
+  ts              text NOT NULL,
+  body_json       text NOT NULL,
+  grantee         text NOT NULL,
+  PRIMARY KEY (run_id, sequence_number)
+);
+CREATE INDEX idx_run_events_ts ON run_events(ts);
+CREATE INDEX idx_run_events_node_type ON run_events(run_id, node_id, type);
+
+CREATE TABLE idempotency_keys (
+  grantee   text NOT NULL,
+  key       text NOT NULL,
+  body_hash text NOT NULL,
+  run_id    text NOT NULL REFERENCES nodes(node_id) ON DELETE CASCADE,
+  response_json text NOT NULL,
+  created_at text NOT NULL,
+  PRIMARY KEY (grantee, key)
+);
+CREATE INDEX idx_idempotency_keys_created_at ON idempotency_keys(created_at);
+
+CREATE TABLE grants (
+  id        text PRIMARY KEY,
+  runtime   text NOT NULL,
+  sub       text NOT NULL,
+  grantee   text NOT NULL,
+  rev       bigint NOT NULL,
+  scopes_json text NOT NULL,
+  resolved_scopes_json text NOT NULL,
+  spend_cap double precision,
+  expires_at text,
+  status    text NOT NULL,
+  revoked_at text,
+  approved_at text,
+  payer     text,
+  synced_at text NOT NULL,
+  dependencies_json text NOT NULL DEFAULT '{}',
+  run_notice_url text,
+  inference_endpoint_json text
+);
+CREATE UNIQUE INDEX idx_grants_grantee_sub ON grants(grantee, sub);
+
+CREATE TABLE memory_reads (
+  node_id text NOT NULL REFERENCES nodes(node_id) ON DELETE CASCADE,
+  name    text NOT NULL,
+  scope   text NOT NULL,
+  at      text NOT NULL,
+  type    text NOT NULL CHECK (type IN ('read','loaded'))
+);
+CREATE INDEX idx_memory_reads_at ON memory_reads(at);
+CREATE INDEX idx_memory_reads_node ON memory_reads(node_id);
+
+CREATE TABLE app_users (
+  uid     bigint GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  app     text NOT NULL,
+  created text NOT NULL,
+  status  text NOT NULL CHECK (status IN ('active', 'removed')),
+  removed_at text
+);
+CREATE UNIQUE INDEX idx_app_users_active_app ON app_users(app) WHERE status = 'active';
+
+CREATE TABLE uploads (
+  upload_id  text PRIMARY KEY,
+  grantee    text NOT NULL,
+  name       text NOT NULL,
+  media_type text NOT NULL,
+  size       bigint NOT NULL,
+  created_at text NOT NULL,
+  delete_pending_since text
+);
+CREATE INDEX idx_uploads_grantee ON uploads(grantee);
+CREATE INDEX idx_uploads_delete_pending ON uploads(delete_pending_since) WHERE delete_pending_since IS NOT NULL;
+
+CREATE TABLE upload_uses (
+  upload_id text NOT NULL,
+  run_id    text NOT NULL,
+  path      text NOT NULL,
+  PRIMARY KEY (run_id, path)
+);
+CREATE INDEX idx_upload_uses_upload ON upload_uses(upload_id);
+
+CREATE TABLE shares (
+  share_id  text PRIMARY KEY,
+  source_space text NOT NULL,
+  source_path text NOT NULL,
+  storage_key text NOT NULL,
+  url       text NOT NULL,
+  created_by text NOT NULL,
+  created_at text NOT NULL,
+  expires_at text,
+  status    text NOT NULL CHECK (status IN ('on', 'off')),
+  object_deleted_at text
+);
+CREATE INDEX idx_shares_created_by ON shares(created_by);
+
+CREATE TABLE audit_rows (
+  id         bigint GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  request_id text NOT NULL,
+  time       text NOT NULL,
+  grantee    text,
+  sub        text,
+  client_id  text,
+  class      text,
+  operation  text NOT NULL,
+  scope_checked text,
+  outcome    text NOT NULL,
+  node_id    text,
+  run_id     text,
+  payer      text,
+  resource   text,
+  initiator_chain text,
+  provider   text,
+  tool       text,
+  jti        text,
+  receipt_id text,
+  responder  text,
+  question_id text,
+  via        text
+);
+CREATE INDEX audit_rows_grantee_time ON audit_rows(grantee, id DESC);
+CREATE INDEX audit_rows_request ON audit_rows(request_id);
+CREATE INDEX audit_rows_time ON audit_rows(id DESC);
+
+CREATE TABLE grantee_usage (
+  grantee text NOT NULL,
+  month   text NOT NULL,
+  usd_equivalent double precision NOT NULL DEFAULT 0,
+  PRIMARY KEY (grantee, month)
+);
+
+CREATE TABLE provider_receipts (
+  provider   text NOT NULL,
+  receipt_id text NOT NULL,
+  grantee    text NOT NULL,
+  run_id     text,
+  usd_equivalent double precision NOT NULL,
+  received_at text NOT NULL,
+  PRIMARY KEY (provider, receipt_id)
+);
+
+CREATE TABLE provider_approvals (
+  question_id text PRIMARY KEY,
+  grantee    text NOT NULL,
+  sub        text NOT NULL,
+  provider   text NOT NULL,
+  tool       text NOT NULL,
+  version    bigint,
+  args_hash  text NOT NULL,
+  request_id text NOT NULL,
+  status     text NOT NULL CHECK (status IN ('open','answered','consumed','canceled')),
+  option_id  text,
+  call_shape text,
+  prepared_files text
+);
+
+CREATE TABLE usage (
+  grantee text NOT NULL,
+  month   text NOT NULL,
+  payer   text NOT NULL,
+  source  text NOT NULL,
+  served_model text NOT NULL,
+  input_tokens bigint NOT NULL DEFAULT 0,
+  output_tokens bigint NOT NULL DEFAULT 0,
+  cached_tokens bigint NOT NULL DEFAULT 0,
+  usd_equivalent double precision,
+  PRIMARY KEY (grantee, month, payer, source, served_model)
+);
+
+-- ---------------------------------------------------------------- crons
+
+CREATE TABLE crons (
+  cron_id          text PRIMARY KEY,
+  name             text NOT NULL,
+  created_by       text,
+  command          text NOT NULL,
+  fire_at          text NOT NULL,
+  recur            text,
+  tz               text,
+  expires_at       text,
+  anchor_node      text REFERENCES nodes(node_id) ON DELETE CASCADE,
+  cancel_on_wake   bigint NOT NULL DEFAULT 0,
+  cwd              text NOT NULL,
+  env_json         text,
+  profile          text,
+  scope            text NOT NULL DEFAULT 'profile',
+  run_timeout_s    bigint NOT NULL DEFAULT 300,
+  overlap          text NOT NULL DEFAULT 'skip',
+  on_output        text NOT NULL DEFAULT 'on-failure',
+  sink             text NOT NULL,
+  tier             text NOT NULL DEFAULT 'normal',
+  last_output_hash text,
+  state            text NOT NULL DEFAULT 'active',
+  run_state        text NOT NULL DEFAULT 'idle',
+  run_pid          bigint,
+  run_pid_identity text,
+  run_started_at   text,
+  run_lease_owner  text,
+  run_out_of_band  bigint NOT NULL DEFAULT 0,
+  created          text NOT NULL,
+  updated          text NOT NULL,
+  held             bigint NOT NULL DEFAULT 0,
+  last_poke_at     text,
+  grantee          text NOT NULL DEFAULT 'app:terminal',
+  isolated         bigint NOT NULL DEFAULT 0 CHECK (isolated IN (0, 1)),
+  sub              text,
+  grant_id         text,
+  scopes_json      text,
+  origin_run_id    text,
+  run_execution_id text
+);
+CREATE UNIQUE INDEX idx_crons_deadline ON crons(anchor_node) WHERE cancel_on_wake = 1;
+CREATE INDEX idx_crons_fire ON crons(fire_at);
+
+CREATE TABLE cron_runs (
+  run_id      text PRIMARY KEY,
+  cron_id     text NOT NULL REFERENCES crons(cron_id) ON DELETE CASCADE,
+  started     text NOT NULL,
+  finished    text,
+  duration_ms bigint,
+  exit_code   bigint,
+  stdout_head text,
+  stderr_head text,
+  delivered   text
+);
+CREATE INDEX idx_cron_runs_cron ON cron_runs(cron_id, started);
+
+-- ---------------------------------------------------------------- peer
+
+CREATE TABLE peer_outbox (
+  id              bigint GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  peer            text NOT NULL,
+  kind            text NOT NULL,
+  payload_json    text NOT NULL,
+  idempotency_key text NOT NULL UNIQUE,
+  state           text NOT NULL CHECK (state IN ('pending','waiting','claimed','done','expired')),
+  attempts        bigint NOT NULL DEFAULT 0,
+  next_at         bigint,
+  claimed_by      text,
+  claimed_at      bigint,
+  first_failed_at bigint,
+  created_at      bigint NOT NULL
+);
+CREATE INDEX peer_outbox_due ON peer_outbox(next_at) WHERE state = 'pending';
+CREATE INDEX peer_outbox_peer ON peer_outbox(peer, state);
+
+CREATE TABLE peer_locations (
+  id         text PRIMARY KEY,
+  machine_id text NOT NULL,
+  learned_at bigint NOT NULL
+);
+
+CREATE TABLE peer_ingested (
+  key         text PRIMARY KEY,
+  ingested_at bigint NOT NULL
+);
+
+CREATE TABLE peer_ingested_destinations (
+  key         text PRIMARY KEY,
+  ingested_at bigint NOT NULL
+);
+
+-- ---------------------------------------------------------------- view
+
+-- Column list is fixed at creation (n.* expands here): a later nodes column needs a delta that
+-- recreates this view.
+CREATE VIEW node_rows AS
+SELECT n.*,
+       o.name,
+       o.kind,
+       oi.external_id AS grantee,
+       CASE WHEN e.state = 'running' THEN e.pid ELSE NULL END AS pi_pid,
+       CASE WHEN e.state = 'running' THEN e.process_identity ELSE NULL END AS pi_pid_identity,
+       e.turn_open_at,
+       e.turn_closed_at,
+       s.session_id AS pi_session_id,
+       s.transcript_path AS pi_session_file,
+       f.fault_id,
+       f.link AS fault_link,
+       f.op AS fault_op,
+       f.kind AS fault_kind,
+       f.message AS fault_message,
+       f.since AS fault_since,
+       f.operation_id AS fault_operation_id,
+       f.anchor_entry_id AS fault_anchor_entry_id,
+       f.retry_disposition AS fault_retry_disposition,
+       f.retry_by AS fault_retry_by,
+       f.retry_attempt AS fault_retry_attempt,
+       f.retry_max AS fault_retry_max,
+       f.retry_next_at AS fault_retry_next_at,
+       f.provider_error_json AS fault_provider_error_json
+  FROM nodes n
+  JOIN objects o ON o.id = n.node_id
+  LEFT JOIN identities oi ON oi.object = o.owner
+  LEFT JOIN executions e ON e.node_id = n.node_id AND e.state != 'exited'
+  LEFT JOIN sessions s ON s.node_id = n.node_id AND s.unbound_at IS NULL
+  LEFT JOIN node_faults f ON f.node_id = n.node_id AND f.active = 1;
+
+-- ---------------------------------------------------------------- triggers
+
+CREATE FUNCTION nodes_reception_set() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  UPDATE objects SET reception = CASE WHEN NEW.status IN ('active','idle') THEN 2 ELSE 1 END
+    WHERE id = NEW.node_id;
+  RETURN NULL;
+END $$;
+CREATE TRIGGER nodes_reception_insert AFTER INSERT ON nodes
+  FOR EACH ROW EXECUTE FUNCTION nodes_reception_set();
+CREATE TRIGGER nodes_reception_status AFTER UPDATE OF status ON nodes
+  FOR EACH ROW EXECUTE FUNCTION nodes_reception_set();
+
+CREATE FUNCTION preserve_message_cause() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  INSERT INTO message_causes (message_id, depth) VALUES (OLD.message_id, OLD.depth)
+    ON CONFLICT DO NOTHING;
+  RETURN OLD;
+END $$;
+CREATE TRIGGER preserve_message_cause BEFORE DELETE ON messages
+  FOR EACH ROW EXECUTE FUNCTION preserve_message_cause();
+
+-- Broker-signal bus: notifications arrive at commit as 'mail:<node id>' / 'node:<node id>' on
+-- channel crtr_signal. These replace the four TEMP triggers in daemon/broker-signals/bus.ts.
+-- The node trigger's column list must equal BROKER_SIGNAL_NODE_COLUMNS in bus.ts.
+CREATE FUNCTION crtr_signal_mail() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    PERFORM pg_notify('crtr_signal', 'mail:' || OLD.destination_id);
+    RETURN OLD;
+  END IF;
+  PERFORM pg_notify('crtr_signal', 'mail:' || NEW.destination_id);
+  RETURN NEW;
+END $$;
+CREATE TRIGGER crtr_sig_deliv_ins AFTER INSERT ON deliveries
+  FOR EACH ROW WHEN (NEW.wake = 1) EXECUTE FUNCTION crtr_signal_mail();
+CREATE TRIGGER crtr_sig_deliv_upd AFTER UPDATE OF state, canceled_at, claim_owner ON deliveries
+  FOR EACH ROW WHEN (NEW.wake = 1) EXECUTE FUNCTION crtr_signal_mail();
+CREATE TRIGGER crtr_sig_deliv_del AFTER DELETE ON deliveries
+  FOR EACH ROW WHEN (OLD.wake = 1) EXECUTE FUNCTION crtr_signal_mail();
+
+CREATE FUNCTION crtr_signal_node() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  PERFORM pg_notify('crtr_signal', 'node:' || NEW.node_id);
+  RETURN NEW;
+END $$;
+CREATE TRIGGER crtr_sig_node_upd AFTER UPDATE OF
+    description, title, icon, mode, lifecycle, status, cwd, parent, fork_from, profile_id,
+    review_binding_json, persona_ack_json, intent
+  ON nodes FOR EACH ROW EXECUTE FUNCTION crtr_signal_node();
+
+-- ---------------------------------------------------------------- schema version
+
+INSERT INTO canvas_meta (key, value) VALUES ('schema_version', '1');
+INSERT INTO canvas_meta (key, value)
+  VALUES ('memory_reads.started_at', to_char(now() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'));