@plurnk/plurnk-service 1.10.0 → 1.11.0

package/migrations/001_schema.sql

@@ -65,6 +65,9 @@ CREATE TABLE IF NOT EXISTS workers (
     -- validated at the client-input boundary (closed known-key set; unknown keys
     -- never persist).
     settings TEXT NOT NULL DEFAULT '{}' CHECK (json_valid(settings)),
+    -- Parent-derived capability ceiling, copied by value at child creation.
+    -- Root workers have the unrestricted empty policy.
+    capability_bound TEXT NOT NULL DEFAULT '{}' CHECK (json_valid(capability_bound)),
     -- {§env-delta-log-pull}: monotonic observation progress, not a private world snapshot.
     -- Creation captures the workspace high-water; a fork instead copies its
     -- parent's cursor and records the closed event boundary of its snapshot.
@@ -224,10 +227,8 @@ BEGIN
 END;
 
 -- loops
--- flags: per-loop runtime flags (auto, noProposals, noWeb, noInteraction,
--- mode). JSON column, merged over DEFAULT_LOOP_FLAGS in code so missing
--- keys read as their defaults. SchemeRegistry.resolveForLoop gates schemes
--- by manifest affinity (excludedInAsk / requiresWeb / requiresInteraction).
+-- policy: complete immutable per-loop capability attenuation and proposal
+-- disposition ({§loop-policy-effective-read}).
 CREATE TABLE IF NOT EXISTS loops (
     id       INTEGER NOT NULL PRIMARY KEY,
     version  INTEGER NOT NULL DEFAULT 0   CHECK (version >= 0),
@@ -238,7 +239,7 @@ CREATE TABLE IF NOT EXISTS loops (
     -- {§prompt-causal-source}: canonical actor address for the initial prompt;
     -- NULL means the owning worker itself.
     prompt_source TEXT CHECK (prompt_source IS NULL OR length(prompt_source) > 0),
-    flags    TEXT    NOT NULL DEFAULT '{}' CHECK (json_valid(flags)),
+    policy   TEXT    NOT NULL DEFAULT '{"capabilities":{},"proposals":"review"}' CHECK (json_valid(policy)),
     -- {§worker-model-selection}: immutable loop snapshots of the resolved model route and the
     -- effective spawn route (was provider_spec/child_provider_spec JSON).
     model_route_id       INTEGER          REFERENCES model_routes(id),
@@ -338,11 +339,18 @@ BEGIN
     FROM workers w
     WHERE w.id = NEW.worker_id
       AND w.parent_worker_id IS NOT NULL
-      AND EXISTS (
-          SELECT 1
-          FROM turns t
-          WHERE t.loop_id = NEW.id
-            AND NOT (t.producer = '_plurnk' AND t.kind = 'operation')
+      -- A loop whose only turns are client-driven operation turns is not the parent's
+      -- business (#323). A loop that never got a turn at all — a spawn refused before it
+      -- ran, e.g. a branch batch failing git-preflight — is, or the parent waits on a
+      -- ghost that vanished from Active Child Workers without a word (#385).
+      AND (
+          NOT EXISTS (SELECT 1 FROM turns t WHERE t.loop_id = NEW.id)
+          OR EXISTS (
+              SELECT 1
+              FROM turns t
+              WHERE t.loop_id = NEW.id
+                AND NOT (t.producer = '_plurnk' AND t.kind = 'operation')
+          )
       );
 END;
 
@@ -872,7 +880,7 @@ BEGIN
 END;
 
 -- symbol_defs
--- @graph NODES ({§relation-indexed-dialects}). Code symbol definitions, populated
+-- &graph NODES ({§relation-indexed-dialects}). Code symbol definitions, populated
 -- once per content-addressed derivation from mimetypes'
 -- `symbols` channel. Qualified path = container ? container || '.' || name : name.
 CREATE TABLE IF NOT EXISTS symbol_defs (
@@ -889,9 +897,9 @@ CREATE TABLE IF NOT EXISTS symbol_defs (
 CREATE INDEX IF NOT EXISTS symbol_defs_name ON symbol_defs (name);
 
 -- symbol_refs
--- @graph EDGES ({§relation-indexed-dialects}), from mimetypes' `references` channel.
+-- &graph EDGES ({§relation-indexed-dialects}), from mimetypes' `references` channel.
 -- name = edge TARGET; container = the SOURCE def's full qualified path (the
--- @> join key; module-level → NULL); kind ∈ import|call|instantiate|inherit|
+-- &> join key; module-level → NULL); kind ∈ import|call|instantiate|inherit|
 -- type|use (frozen, edge metadata only — traversal is kind-agnostic).
 CREATE TABLE IF NOT EXISTS symbol_refs (
     id         INTEGER NOT NULL PRIMARY KEY,
@@ -942,8 +950,9 @@ CREATE TABLE IF NOT EXISTS derivation_embeddings (
 -- status⊥state: status is the HTTP outcome, state is where in the
 -- lifecycle the entry sits. Most rows write 'resolved' directly;
 -- proposing schemes transition 'proposed' → resolved/failed/cancelled.
--- folded: canonical hidden log-body line intervals for OPEN/FOLD. [] is
--- wholly open and [[1,-1]] is wholly folded.
+-- initial_folded is the immutable visibility with which the event entered the
+-- log. Current model-facing membership and folded intervals belong to
+-- log_entry_projections below; curation never rewrites or removes this event.
 CREATE TABLE IF NOT EXISTS log_entries (
     id              INTEGER NOT NULL PRIMARY KEY,
     version         INTEGER NOT NULL DEFAULT 0 CHECK (version >= 0),
@@ -954,8 +963,9 @@ CREATE TABLE IF NOT EXISTS log_entries (
     sequence        INTEGER NOT NULL           CHECK (sequence >= 1),
     at              TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
     origin          TEXT    NOT NULL           CHECK (origin IN ('model', 'client', '_plurnk', 'plugin')),
-    -- {§env-delta-attribution}: a worker:// name or stable subsystem token ('file');
-    -- NULL = the owning worker itself, rendered without causal attribution.
+    -- {§env-delta-attribution}: a causal worker:// identity, log:/// operation
+    -- address, or stable subsystem token ('file'); NULL = the owning worker
+    -- itself, rendered without causal attribution.
     source          TEXT,
     -- Engine-owned occurrence identity. Source rows are stamped NULL→id by the
     -- journal trigger; observer and fork copies carry it at insertion.
@@ -1015,8 +1025,8 @@ CREATE TABLE IF NOT EXISTS log_entries (
     outcome         TEXT,
     attrs           TEXT    NOT NULL DEFAULT '{}' CHECK (json_valid(attrs)),
 
-    folded           TEXT    NOT NULL DEFAULT '[]'
-                    CHECK (json_valid(folded) AND json_type(folded) = 'array'),
+    initial_folded   TEXT    NOT NULL DEFAULT '[]'
+                    CHECK (json_valid(initial_folded) AND json_type(initial_folded) = 'array'),
 
     CHECK (
         (op IS NULL) = COALESCE(
@@ -1045,6 +1055,52 @@ CREATE UNIQUE INDEX IF NOT EXISTS log_entries_worker_ambient_event
     ON log_entries (worker_id, ambient_event_id)
     WHERE ambient_event_id IS NOT NULL;
 
+-- {§log-history-projection} — log_entries is append-only execution evidence;
+-- this one-to-one row is the current model-facing projection of that evidence.
+-- KILL is a terminal active→inactive transition. OPEN/FOLD mutate only folded
+-- intervals while active. The initial state is created in the same statement as
+-- its event so no durable row can exist without one projection state.
+CREATE TABLE IF NOT EXISTS log_entry_projections (
+    log_entry_id INTEGER NOT NULL PRIMARY KEY,
+    active       INTEGER NOT NULL DEFAULT 1 CHECK (active IN (0, 1)),
+    folded       TEXT    NOT NULL DEFAULT '[]'
+                         CHECK (json_valid(folded) AND json_type(folded) = 'array'),
+    FOREIGN KEY (log_entry_id) REFERENCES log_entries(id) ON DELETE CASCADE
+) STRICT, WITHOUT ROWID;
+
+-- The ordinary operation surface reads this view. Forensic and lifecycle
+-- machinery names log_entries directly and therefore retains complete history.
+CREATE VIEW IF NOT EXISTS active_log_entries AS
+SELECT le.*, projection.folded
+FROM log_entries le
+JOIN log_entry_projections projection ON projection.log_entry_id = le.id
+WHERE projection.active = 1;
+
+CREATE TRIGGER IF NOT EXISTS log_entries_initialize_projection
+AFTER INSERT ON log_entries
+BEGIN
+    INSERT INTO log_entry_projections (log_entry_id, active, folded)
+    VALUES (NEW.id, 1, NEW.initial_folded);
+END;
+
+-- Individual execution events are append-only. Containing-history teardown is
+-- the one removal owner: a cascading delete has already removed at least one
+-- ancestor in the workspace→worker→loop→turn chain. A direct row delete while
+-- that complete owner chain remains would fabricate chronology and is rejected.
+CREATE TRIGGER IF NOT EXISTS log_entries_delete_with_owner_only
+BEFORE DELETE ON log_entries
+WHEN EXISTS (
+    SELECT 1
+    FROM turns
+    JOIN loops ON loops.id = turns.loop_id
+    JOIN workers ON workers.id = loops.worker_id
+    JOIN workspaces ON workspaces.id = workers.workspace_id
+    WHERE turns.id = OLD.turn_id
+)
+BEGIN
+    SELECT RAISE(ABORT, 'log entries can only be removed with their containing history');
+END;
+
 -- A log row belongs to one exact worker/loop/turn chain. Its writer is either
 -- that turn's producer or `_plurnk` observing the turn. Primitive absence,
 -- enum, and foreign-key failures remain owned by their column constraints.
@@ -1091,8 +1147,8 @@ END;
 -- A folded interval is an inclusive [start,end] pair. Ranges are positive,
 -- sorted, disjoint, and non-adjacent; -1 is the final open-ended endpoint.
 -- Canonical intervals make visibility equality and curation effects exact.
-CREATE TRIGGER IF NOT EXISTS log_entries_folded_valid_insert
-BEFORE INSERT ON log_entries
+CREATE TRIGGER IF NOT EXISTS log_entry_projections_folded_valid_insert
+BEFORE INSERT ON log_entry_projections
 WHEN EXISTS (
     SELECT 1
     FROM json_each(NEW.folded) range
@@ -1116,11 +1172,11 @@ WHEN EXISTS (
        )
 )
 BEGIN
-    SELECT RAISE(ABORT, 'log entry folded ranges are invalid');
+    SELECT RAISE(ABORT, 'log entry projection folded ranges are invalid');
 END;
 
-CREATE TRIGGER IF NOT EXISTS log_entries_folded_valid_update
-BEFORE UPDATE OF folded ON log_entries
+CREATE TRIGGER IF NOT EXISTS log_entry_projections_folded_valid_update
+BEFORE UPDATE OF folded ON log_entry_projections
 WHEN EXISTS (
     SELECT 1
     FROM json_each(NEW.folded) range
@@ -1144,7 +1200,21 @@ WHEN EXISTS (
        )
 )
 BEGIN
-    SELECT RAISE(ABORT, 'log entry folded ranges are invalid');
+    SELECT RAISE(ABORT, 'log entry projection folded ranges are invalid');
+END;
+
+CREATE TRIGGER IF NOT EXISTS log_entry_projections_kill_terminal
+BEFORE UPDATE OF active ON log_entry_projections
+WHEN OLD.active = 0 AND NEW.active != 0
+BEGIN
+    SELECT RAISE(ABORT, 'a killed log entry cannot re-enter the active projection');
+END;
+
+CREATE TRIGGER IF NOT EXISTS log_entry_projections_delete_with_event_only
+BEFORE DELETE ON log_entry_projections
+WHEN EXISTS (SELECT 1 FROM log_entries WHERE id = OLD.log_entry_id)
+BEGIN
+    SELECT RAISE(ABORT, 'a durable log event must retain its projection');
 END;
 
 CREATE TRIGGER IF NOT EXISTS log_entries_model_call_valid
@@ -1170,7 +1240,8 @@ BEGIN
 END;
 
 -- {§log-item-tags} — log classification plus OPEN/FOLD selection and mutation.
--- CASCADE erases the classification with its row.
+-- A containing-history teardown cascades its classifications; log KILL leaves
+-- both the event and its forensic classifications intact.
 CREATE TABLE IF NOT EXISTS log_tags (
     log_entry_id INTEGER NOT NULL,
     tag          TEXT    NOT NULL,
@@ -1336,13 +1407,15 @@ BEGIN
       );
 END;
 
--- Successful OPEN/FOLD rows are durable curation events even though their
--- ordinary packet projection is suppressed ({§fold-open-meta-operations}).
--- Preserve the exact selected set and each target's before/after visibility so a
--- broad selector never collapses into the lossy fact `matched: N`.
+-- Successful OPEN/FOLD/log-KILL rows are durable curation events even though
+-- their ordinary packet projection is suppressed. Preserve the exact selected
+-- set and each target's before/after projection so a broad selector never
+-- collapses into the lossy fact `matched: N`.
 CREATE TABLE IF NOT EXISTS log_curation_effects (
     operation_log_entry_id INTEGER NOT NULL,
     target_log_entry_id    INTEGER NOT NULL,
+    active_before          INTEGER NOT NULL CHECK (active_before IN (0, 1)),
+    active_after           INTEGER NOT NULL CHECK (active_after IN (0, 1)),
     folded_before          TEXT    NOT NULL
                                   CHECK (json_valid(folded_before) AND json_type(folded_before) = 'array'),
     folded_after           TEXT    NOT NULL
@@ -1360,9 +1433,30 @@ CREATE TABLE IF NOT EXISTS log_curation_effects (
 CREATE INDEX IF NOT EXISTS log_curation_effects_target
     ON log_curation_effects (target_log_entry_id);
 
+-- Curation effects are append-only execution evidence. They may disappear
+-- only when either referenced event is already being removed with its
+-- containing history; direct mutation while both events survive is forbidden.
+CREATE TRIGGER IF NOT EXISTS log_curation_effects_immutable
+BEFORE UPDATE ON log_curation_effects
+BEGIN
+    SELECT RAISE(ABORT, 'log curation effects are immutable execution evidence');
+END;
+
+CREATE TRIGGER IF NOT EXISTS log_curation_effects_delete_with_history_only
+BEFORE DELETE ON log_curation_effects
+WHEN EXISTS (
+    SELECT 1 FROM log_entries WHERE id = OLD.operation_log_entry_id
+)
+AND EXISTS (
+    SELECT 1 FROM log_entries WHERE id = OLD.target_log_entry_id
+)
+BEGIN
+    SELECT RAISE(ABORT, 'log curation effects can only be removed with their containing history');
+END;
+
 -- Make an invalid curation record structurally unavailable: the event must be
--- one successful OPEN/FOLD row, both rows must belong to the same worker, and
--- both exact delta sets must contain only unique canonical tag identities.
+-- one successful OPEN/FOLD/log-KILL row, both rows must belong to the same
+-- worker, and its state transition and exact tag deltas must match that op.
 CREATE TRIGGER IF NOT EXISTS log_curation_effects_valid
 BEFORE INSERT ON log_curation_effects
 BEGIN
@@ -1372,10 +1466,31 @@ BEGIN
             FROM log_entries operation
             JOIN log_entries target ON target.id = NEW.target_log_entry_id
             WHERE operation.id = NEW.operation_log_entry_id
-              AND operation.op IN ('OPEN', 'FOLD')
+              AND operation.op IN ('OPEN', 'FOLD', 'KILL')
               AND operation.status_rx < 400
               AND operation.worker_id = target.worker_id
         )
+        OR NOT EXISTS (
+            SELECT 1
+            FROM log_entries operation
+            WHERE operation.id = NEW.operation_log_entry_id
+              AND (
+                  (
+                      operation.op IN ('OPEN', 'FOLD')
+                      AND NEW.active_before = 1
+                      AND NEW.active_after = 1
+                  )
+                  OR (
+                      operation.op = 'KILL'
+                      AND operation.scheme = 'log'
+                      AND NEW.active_before = 1
+                      AND NEW.active_after = 0
+                      AND json(NEW.folded_before) = json(NEW.folded_after)
+                      AND json_array_length(NEW.tags_added) = 0
+                      AND json_array_length(NEW.tags_removed) = 0
+                  )
+              )
+        )
         OR EXISTS (
             SELECT 1
             FROM (
@@ -1450,27 +1565,29 @@ BEGIN
 END;
 
 -- The dispatcher binds an exact, transient curation plan into attrs on the
--- successful OPEN/FOLD row. No other row may carry that private payload.
+-- successful OPEN/FOLD/log-KILL row. No other row may carry that payload.
 CREATE TRIGGER IF NOT EXISTS log_entries_curation_payload_valid
 BEFORE INSERT ON log_entries
 WHEN json_type(NEW.attrs, '$.__plurnk_curation') IS NOT NULL
  AND NOT (
-    NEW.op IN ('OPEN', 'FOLD')
+    NEW.op IN ('OPEN', 'FOLD', 'KILL')
     AND NEW.status_rx < 400
+    AND (NEW.op != 'KILL' OR NEW.scheme = 'log')
     AND json_type(NEW.attrs, '$.__plurnk_curation') = 'object'
  )
 BEGIN
-    SELECT RAISE(ABORT, 'private log curation payload requires a successful OPEN/FOLD row');
+    SELECT RAISE(ABORT, 'private log curation payload requires a successful log curation row');
 END;
 
 -- One outer INSERT owns the whole landed curation event: exact selected rows,
--- their before/after visibility and tag deltas, and the
--- resulting classifications. Trigger failure rolls the operation row and all
--- effects back together. The private plan is erased before INSERT returns.
+-- their before/after projection and tag deltas, and the resulting current
+-- state. Trigger failure rolls the operation row and all effects back together.
+-- The private plan is erased before INSERT returns.
 CREATE TRIGGER IF NOT EXISTS log_entries_apply_curation
 AFTER INSERT ON log_entries
-WHEN NEW.op IN ('OPEN', 'FOLD')
+WHEN NEW.op IN ('OPEN', 'FOLD', 'KILL')
  AND NEW.status_rx < 400
+ AND (NEW.op != 'KILL' OR NEW.scheme = 'log')
  AND json_type(NEW.attrs, '$.__plurnk_curation') = 'object'
 BEGIN
     SELECT CASE WHEN
@@ -1484,20 +1601,24 @@ BEGIN
             WHERE selected.type != 'object'
                OR COALESCE(json_type(selected.value, '$.id'), '') != 'integer'
                OR json_extract(selected.value, '$.id') <= 0
-               OR COALESCE(json_type(selected.value, '$.before'), '') != 'array'
-               OR COALESCE(json_type(selected.value, '$.after'), '') != 'array'
+               OR COALESCE(json_type(selected.value, '$.activeBefore'), '') != 'integer'
+               OR json_extract(selected.value, '$.activeBefore') NOT IN (0, 1)
+               OR COALESCE(json_type(selected.value, '$.activeAfter'), '') != 'integer'
+               OR json_extract(selected.value, '$.activeAfter') NOT IN (0, 1)
+               OR COALESCE(json_type(selected.value, '$.foldedBefore'), '') != 'array'
+               OR COALESCE(json_type(selected.value, '$.foldedAfter'), '') != 'array'
                OR EXISTS (
                    SELECT 1 FROM json_each(selected.value) field
-                   WHERE field.key NOT IN ('id', 'before', 'after')
+                   WHERE field.key NOT IN ('id', 'activeBefore', 'activeAfter', 'foldedBefore', 'foldedAfter')
                )
                OR EXISTS (
                    SELECT 1
                    FROM (
                        SELECT 'before' AS side, range.key, range.value, range.type
-                       FROM json_each(json_extract(selected.value, '$.before')) range
+                       FROM json_each(json_extract(selected.value, '$.foldedBefore')) range
                        UNION ALL
                        SELECT 'after' AS side, range.key, range.value, range.type
-                       FROM json_each(json_extract(selected.value, '$.after')) range
+                       FROM json_each(json_extract(selected.value, '$.foldedAfter')) range
                    ) range
                    WHERE range.type != 'array'
                       OR json_array_length(range.value) != 2
@@ -1512,8 +1633,8 @@ BEGIN
                           SELECT 1
                           FROM json_each(
                               CASE range.side
-                                  WHEN 'before' THEN json_extract(selected.value, '$.before')
-                                  ELSE json_extract(selected.value, '$.after')
+                                  WHEN 'before' THEN json_extract(selected.value, '$.foldedBefore')
+                                  ELSE json_extract(selected.value, '$.foldedAfter')
                               END
                           ) previous
                           WHERE previous.key = range.key - 1
@@ -1534,10 +1655,28 @@ BEGIN
             SELECT 1
             FROM json_each(NEW.attrs, '$.__plurnk_curation.targets') selected
             LEFT JOIN log_entries target ON target.id = json_extract(selected.value, '$.id')
+            LEFT JOIN log_entry_projections projection ON projection.log_entry_id = target.id
             WHERE target.id IS NULL
+               OR projection.log_entry_id IS NULL
                OR target.worker_id != NEW.worker_id
                OR target.id = NEW.id
-               OR json(target.folded) != json(json_extract(selected.value, '$.before'))
+               OR projection.active != json_extract(selected.value, '$.activeBefore')
+               OR json(projection.folded) != json(json_extract(selected.value, '$.foldedBefore'))
+               OR (
+                   NEW.op IN ('OPEN', 'FOLD')
+                   AND NOT (
+                       json_extract(selected.value, '$.activeBefore') = 1
+                       AND json_extract(selected.value, '$.activeAfter') = 1
+                   )
+               )
+               OR (
+                   NEW.op = 'KILL'
+                   AND NOT (
+                       json_extract(selected.value, '$.activeBefore') = 1
+                       AND json_extract(selected.value, '$.activeAfter') = 0
+                       AND json(json_extract(selected.value, '$.foldedBefore')) = json(json_extract(selected.value, '$.foldedAfter'))
+                   )
+               )
         )
         OR EXISTS (
             SELECT 1
@@ -1588,6 +1727,8 @@ BEGIN
     INSERT INTO log_curation_effects (
         operation_log_entry_id,
         target_log_entry_id,
+        active_before,
+        active_after,
         folded_before,
         folded_after,
         tags_added,
@@ -1596,8 +1737,10 @@ BEGIN
     SELECT
         NEW.id,
         target.id,
-        json_extract(selected.value, '$.before'),
-        json_extract(selected.value, '$.after'),
+        json_extract(selected.value, '$.activeBefore'),
+        json_extract(selected.value, '$.activeAfter'),
+        json_extract(selected.value, '$.foldedBefore'),
+        json_extract(selected.value, '$.foldedAfter'),
         COALESCE((
             SELECT json_group_array(ordered.tag)
             FROM (
@@ -1625,13 +1768,18 @@ BEGIN
     FROM json_each(NEW.attrs, '$.__plurnk_curation.targets') selected
     JOIN log_entries target ON target.id = json_extract(selected.value, '$.id');
 
-    UPDATE log_entries
-    SET folded = (
-        SELECT json_extract(selected.value, '$.after')
+    UPDATE log_entry_projections
+    SET active = (
+        SELECT json_extract(selected.value, '$.activeAfter')
         FROM json_each(NEW.attrs, '$.__plurnk_curation.targets') selected
-        WHERE json_extract(selected.value, '$.id') = log_entries.id
+        WHERE json_extract(selected.value, '$.id') = log_entry_projections.log_entry_id
+    ),
+        folded = (
+        SELECT json_extract(selected.value, '$.foldedAfter')
+        FROM json_each(NEW.attrs, '$.__plurnk_curation.targets') selected
+        WHERE json_extract(selected.value, '$.id') = log_entry_projections.log_entry_id
     )
-    WHERE id IN (
+    WHERE log_entry_id IN (
         SELECT json_extract(value, '$.id')
         FROM json_each(NEW.attrs, '$.__plurnk_curation.targets')
     );
@@ -1655,20 +1803,20 @@ BEGIN
     WHERE id = NEW.id;
 END;
 
--- Column-scoped immutability: the original action's identity and target never
--- change; the proposal lifecycle is allowed to mutate state, outcome,
--- status_rx, rx, folded. Keep attrs separate so the curation trigger's one
--- private-payload removal cannot exempt changes to any other core column.
+-- Column-scoped immutability: the original action's identity, target, and
+-- initial projection never change. Proposal lifecycle may mutate its outcome;
+-- curation state lives outside the event row. Keep attrs separate so the
+-- curation trigger's private-payload removal cannot exempt other columns.
 CREATE TRIGGER IF NOT EXISTS log_entries_immutable_core
 BEFORE UPDATE OF
     worker_id, loop_id, turn_id, sequence, at, origin, source, inherited_history, model_call_id,
     op, delimiter, signal,
     scheme, username, password, hostname,
     port, pathname, query, fragment,
-    lineMarker, tx, mimetype_tx, mimetype_rx
+    lineMarker, tx, mimetype_tx, mimetype_rx, initial_folded
 ON log_entries
 BEGIN
-    SELECT RAISE(ABORT, 'log_entries core fields are immutable; only state/outcome/status_rx/rx/folded may change');
+    SELECT RAISE(ABORT, 'log_entries core fields are immutable; only lifecycle outcome and derived attachments may change');
 END;
 
 CREATE TRIGGER IF NOT EXISTS log_entries_immutable_attrs
@@ -2098,10 +2246,15 @@ END;
 -- source. Composed at membership resolution; node:path.matchesGlob.
 CREATE TABLE IF NOT EXISTS workspace_constraints (
     workspace_id INTEGER NOT NULL,
-    effect     TEXT    NOT NULL CHECK (effect IN ('pick', 'hide', 'view')),
+    -- include admits files git misses; exclude removes members — the members family's lexicon
+    -- ({§members-projection}). An inclusion is a pattern scan; a creation record is one exact path.
+    effect     TEXT    NOT NULL CHECK (effect IN ('include', 'exclude')),
     glob       TEXT    NOT NULL,
-    source     TEXT    NOT NULL CHECK (source IN ('explicit', 'create')),
-    CHECK (source = 'explicit' OR effect = 'pick'),
+    -- create: the exact record of a file Plurnk wrote ({§fs-create-record}); members: a
+    -- human-authored definition projected by the members family; model: a definition the model
+    -- proposed under the members scope — never admitted past the repository's ignore rules.
+    source     TEXT    NOT NULL CHECK (source IN ('create', 'members', 'model')),
+    CHECK (source IN ('members', 'model') OR effect = 'include'),
     PRIMARY KEY (workspace_id, effect, glob),
     FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE
 ) STRICT, WITHOUT ROWID;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@plurnk/plurnk-service",
-    "version": "1.10.0",
+    "version": "1.11.0",
     "description": "Plurnk agent runtime — the server / engine / core. Implements the @plurnk/plurnk-contracts contract.",
     "type": "module",
     "license": "MIT",
@@ -87,43 +87,41 @@
         "@opentelemetry/resources": "^2.10.0",
         "@opentelemetry/sdk-metrics": "^2.10.0",
         "@opentelemetry/sdk-trace-base": "^2.10.0",
-        "@plurnk/gbnf": "1.10.0",
-        "@plurnk/plurnk-a2a": "1.10.0",
-        "@plurnk/plurnk-agui": "1.10.0",
-        "@plurnk/plurnk-contracts": "1.10.0",
-        "@plurnk/plurnk-execs": "1.10.0",
-        "@plurnk/plurnk-execs-common": "1.10.0",
-        "@plurnk/plurnk-execs-git": "1.10.0",
-        "@plurnk/plurnk-execs-jq": "1.10.0",
-        "@plurnk/plurnk-execs-sqlite": "1.10.0",
-        "@plurnk/plurnk-execs-wasm": "1.10.0",
-        "@plurnk/plurnk-hooks": "1.10.0",
-        "@plurnk/plurnk-mcp": "1.10.0",
-        "@plurnk/plurnk-meta": "1.10.0",
-        "@plurnk/plurnk-mimetypes": "1.10.0",
-        "@plurnk/plurnk-mimetypes-application-ipynb": "1.10.0",
-        "@plurnk/plurnk-mimetypes-application-json": "1.10.0",
-        "@plurnk/plurnk-mimetypes-application-jsonl": "1.10.0",
-        "@plurnk/plurnk-mimetypes-application-xml": "1.10.0",
-        "@plurnk/plurnk-mimetypes-embeddings": "1.10.0",
-        "@plurnk/plurnk-mimetypes-text-csv": "1.10.0",
-        "@plurnk/plurnk-mimetypes-text-diff": "1.10.0",
-        "@plurnk/plurnk-mimetypes-text-dotenv": "1.10.0",
-        "@plurnk/plurnk-mimetypes-text-html": "1.10.0",
-        "@plurnk/plurnk-mimetypes-text-ini": "1.10.0",
-        "@plurnk/plurnk-mimetypes-text-markdown": "1.10.0",
-        "@plurnk/plurnk-mimetypes-text-plain": "1.10.0",
-        "@plurnk/plurnk-models": "1.10.0",
-        "@plurnk/plurnk-providers": "1.10.0",
-        "@plurnk/plurnk-schemes": "1.10.0",
-        "@plurnk/plurnk-schemes-http": "1.10.0",
+        "@plurnk/gbnf": "1.11.0",
+        "@plurnk/plurnk-a2a": "1.11.0",
+        "@plurnk/plurnk-agui": "1.11.0",
+        "@plurnk/plurnk-contracts": "1.11.0",
+        "@plurnk/plurnk-execs": "1.11.0",
+        "@plurnk/plurnk-execs-common": "1.11.0",
+        "@plurnk/plurnk-execs-jq": "1.11.0",
+        "@plurnk/plurnk-execs-sqlite": "1.11.0",
+        "@plurnk/plurnk-hooks": "1.11.0",
+        "@plurnk/plurnk-mcp": "1.11.0",
+        "@plurnk/plurnk-meta": "1.11.0",
+        "@plurnk/plurnk-mimetypes": "1.11.0",
+        "@plurnk/plurnk-mimetypes-application-ipynb": "1.11.0",
+        "@plurnk/plurnk-mimetypes-application-json": "1.11.0",
+        "@plurnk/plurnk-mimetypes-application-jsonl": "1.11.0",
+        "@plurnk/plurnk-mimetypes-application-xml": "1.11.0",
+        "@plurnk/plurnk-mimetypes-embeddings": "1.11.0",
+        "@plurnk/plurnk-mimetypes-text-csv": "1.11.0",
+        "@plurnk/plurnk-mimetypes-text-diff": "1.11.0",
+        "@plurnk/plurnk-mimetypes-text-dotenv": "1.11.0",
+        "@plurnk/plurnk-mimetypes-text-html": "1.11.0",
+        "@plurnk/plurnk-mimetypes-text-ini": "1.11.0",
+        "@plurnk/plurnk-mimetypes-text-markdown": "1.11.0",
+        "@plurnk/plurnk-mimetypes-text-plain": "1.11.0",
+        "@plurnk/plurnk-models": "1.11.0",
+        "@plurnk/plurnk-providers": "1.11.0",
+        "@plurnk/plurnk-schemes": "1.11.0",
+        "@plurnk/plurnk-schemes-http": "1.11.0",
         "@possumtech/sqlrite": "^6.5.2",
         "diff": "^9.0.0",
         "yaml": "^2.9.0"
     },
     "devDependencies": {
         "@opentelemetry/core": "^2.10.0",
-        "@plurnk/plurnk-mimetypes-tokenizers": "1.10.0",
+        "@plurnk/plurnk-mimetypes-tokenizers": "1.11.0",
         "@types/diff": "^7.0.2"
     },
     "homepage": "https://github.com/plurnk/plurnk-service/tree/main/plurnk-core#readme",

package/dist/core/LoopFlagsReader.d.ts

@@ -1,7 +0,0 @@
-import { type LoopFlags } from "@plurnk/plurnk-contracts";
-import type { Db } from "./Db.ts";
-export default class LoopFlagsReader {
-    static parse(raw: string, loopId: number): LoopFlags;
-    static read(db: Db, loopId: number): Promise<LoopFlags>;
-}
-//# sourceMappingURL=LoopFlagsReader.d.ts.map

package/dist/core/LoopFlagsReader.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"LoopFlagsReader.d.ts","sourceRoot":"","sources":["../../src/core/LoopFlagsReader.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,KAAK,SAAS,EACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAIlC,MAAM,CAAC,OAAO,OAAO,eAAe;IAChC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CAmBnD;IAED,OAAa,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAM5D;CACJ"}

package/dist/core/LoopFlagsReader.js

@@ -1,33 +0,0 @@
-import { DEFAULT_LOOP_FLAGS, Validator, } from "@plurnk/plurnk-contracts";
-// {§loop-flags-effective-read} — persistence may contain a partial object, but
-// runtime policy is always the complete contracts-owned shape.
-export default class LoopFlagsReader {
-    static parse(raw, loopId) {
-        let partial;
-        try {
-            partial = JSON.parse(raw);
-        }
-        catch (cause) {
-            throw new Error(`Loop ${loopId} has invalid persisted flags JSON.`, { cause });
-        }
-        if (partial === null || typeof partial !== "object" || Array.isArray(partial)) {
-            throw new Error(`Loop ${loopId} has invalid persisted flags.`, {
-                cause: new TypeError("Persisted loop flags must be a JSON object."),
-            });
-        }
-        try {
-            return Validator.assertLoopFlags({ ...DEFAULT_LOOP_FLAGS, ...partial });
-        }
-        catch (cause) {
-            throw new Error(`Loop ${loopId} has invalid persisted flags.`, { cause });
-        }
-    }
-    static async read(db, loopId) {
-        const row = await db.engine_get_loop_flags.get({ loop_id: loopId });
-        if (row === undefined) {
-            throw new Error(`Loop ${loopId} does not exist while reading its persisted flags.`);
-        }
-        return LoopFlagsReader.parse(row.flags, loopId);
-    }
-}
-//# sourceMappingURL=LoopFlagsReader.js.map

package/dist/core/LoopFlagsReader.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"LoopFlagsReader.js","sourceRoot":"","sources":["../../src/core/LoopFlagsReader.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,kBAAkB,EAClB,SAAS,GAEZ,MAAM,0BAA0B,CAAC;AAGlC,+EAA+E;AAC/E,+DAA+D;AAC/D,MAAM,CAAC,OAAO,OAAO,eAAe;IAChC,MAAM,CAAC,KAAK,CAAC,GAAW,EAAE,MAAc;QACpC,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,oCAAoC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,+BAA+B,EAAE;gBAC3D,KAAK,EAAE,IAAI,SAAS,CAAC,6CAA6C,CAAC;aACtE,CAAC,CAAC;QACP,CAAC;QAED,IAAI,CAAC;YACD,OAAO,SAAS,CAAC,eAAe,CAAC,EAAE,GAAG,kBAAkB,EAAE,GAAG,OAAO,EAAe,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;IACL,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAM,EAAE,MAAc;QACpC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACvF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,oDAAoD,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;CACJ"}

package/dist/core/resolveForLoop.d.ts

@@ -1,5 +0,0 @@
-import type { LoopFlags } from "./types.ts";
-export default class ResolveForLoop {
-    static resolveForLoop(handlers: ReadonlyMap<string, object>, flags: LoopFlags): Set<string>;
-}
-//# sourceMappingURL=resolveForLoop.d.ts.map

package/dist/core/resolveForLoop.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolveForLoop.d.ts","sourceRoot":"","sources":["../../src/core/resolveForLoop.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,CAAC,OAAO,OAAO,cAAc;IAC/B,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,CAE1F;CACJ"}