@plurnk/plurnk-service 1.18.0 → 1.19.0

package/migrations/003_loops.sql

@@ -12,39 +12,37 @@ CREATE TABLE IF NOT EXISTS loops (
     sequence INTEGER NOT NULL             CHECK (sequence >= 1),
     status   INTEGER NOT NULL DEFAULT 102 CHECK (status IN (100, 102, 200, 202, 413, 429, 499, 500, 504, 508)),
     prompt   TEXT    NOT NULL,
-    -- {§prompt-causal-source}: canonical actor address for the initial prompt;
-    -- NULL means the owning worker itself.
+    -- {§message-causal-source}: canonical actor address for the initial message;
+    -- NULL means the owning worker itself. Denormalized headline of the loop's
+    -- first message ({§message-arrival}); the inbox row below is the one published.
     prompt_source TEXT CHECK (prompt_source IS NULL OR length(prompt_source) > 0),
-    policy   TEXT    NOT NULL DEFAULT '{"proposals":"review"}' CHECK (json_valid(policy)),
+    -- {§loop-policy-composition}: every insert states the complete policy; a column default would
+    -- be a second home for a choice the panel owns. Likewise max_turns below.
+    policy   TEXT    NOT NULL CHECK (json_valid(policy)),
     -- {§worker-model-selection}: immutable loop snapshots of the resolved model route and the
     -- effective spawn route (was provider_spec/child_provider_spec JSON).
     model_route_id       INTEGER          REFERENCES model_routes(id),
     spawn_model_route_id INTEGER          REFERENCES model_routes(id),
     reasoning_policy TEXT CHECK (reasoning_policy IS NULL OR length(reasoning_policy) > 0),
-    max_turns INTEGER NOT NULL DEFAULT 50 CHECK (max_turns >= -1),
-    -- {§worker-scheduled-send}: the selected cadence slot, coalesced at claim.
-    scheduled_at INTEGER CHECK (scheduled_at IS NULL OR scheduled_at BETWEEN 0 AND 8640000000000000),
-    repeat_interval_ms INTEGER CHECK (repeat_interval_ms IS NULL OR repeat_interval_ms > 0),
-    recurrence_root_loop_id INTEGER REFERENCES loops(id),
+    max_turns INTEGER NOT NULL CHECK (max_turns >= -1),
     -- {§loop-execution-allowance}: initialized on first execution, charged with disposition.
     execution_budget_ms INTEGER CHECK (execution_budget_ms IS NULL OR execution_budget_ms > 0),
     execution_elapsed_ms REAL NOT NULL DEFAULT 0 CHECK (execution_elapsed_ms >= 0),
-    -- {§worker-wait-timing}: epoch milliseconds; NULL polling inherits streams.
+    -- {§loop-wake-identity}: the wait generation; wait_poll_at below is the next inherited
+    -- observation of the worker's open streams ({§exec-lifetime}), epoch milliseconds.
     wait_revision INTEGER NOT NULL DEFAULT 0 CHECK (wait_revision >= 0),
     -- {§loop-rail-continuity}: one loop-owned streak and bounded repetition window.
     strike_streak INTEGER NOT NULL DEFAULT 0 CHECK (strike_streak >= 0),
     cycle_history TEXT NOT NULL DEFAULT '[]' CHECK (json_valid(cycle_history) AND json_type(cycle_history) = 'array'),
     cycle_wait_revision INTEGER NOT NULL DEFAULT 0 CHECK (cycle_wait_revision >= 0 AND cycle_wait_revision <= wait_revision),
     observed_wake_revision INTEGER NOT NULL DEFAULT 0 CHECK (observed_wake_revision >= 0),
-    wait_deadline_at INTEGER,
-    wait_poll_interval INTEGER CHECK (wait_poll_interval IS NULL OR wait_poll_interval >= 0),
     wait_poll_at INTEGER,
-    -- {§methods-loop-run-open-paths}: the initial prompt frame's selected paths,
-    -- held here until turn 1 materializes that frame (string[] JSON).
-    open_paths TEXT NOT NULL DEFAULT '[]' CHECK (json_valid(open_paths)),
-    -- {§prompt-loop-containment}: one queued recovery loop may carry the
-    -- complete orphan frame set of one concluded source loop.
+    -- {§message-loop-containment}: one queued recovery loop may carry the
+    -- complete unpublished message set of one concluded source loop.
     orphan_source_loop_id INTEGER,
+    -- {§loop-claim-latency}: the first time the loop was claimed to run (status 102), stamped by
+    -- trigger; its first model turn's start minus this is the wake latency a stall shows up as.
+    claimed_at       TEXT,
     -- {§worker-scheme} loop-termination delta: terminated_at is stamped by the trigger
     -- below when status crosses into terminal (every death-path, uniformly).
     terminated_at    TEXT,
@@ -55,10 +53,6 @@ CREATE TABLE IF NOT EXISTS loops (
     CONSTRAINT loops_generation_policy_contract CHECK (
         (model_route_id IS NULL) = (reasoning_policy IS NULL)
     ),
-    CONSTRAINT loops_schedule_contract CHECK (
-        (repeat_interval_ms IS NULL OR scheduled_at IS NOT NULL)
-        AND (recurrence_root_loop_id IS NULL OR repeat_interval_ms IS NOT NULL)
-    ),
     CONSTRAINT loops_terminal_result_contract CHECK (
         CASE
             WHEN status IN (100, 102, 202) THEN terminal_result IS NULL
@@ -105,16 +99,75 @@ CREATE UNIQUE INDEX IF NOT EXISTS loops_worker_id_sequence ON loops (worker_id,
 
 CREATE UNIQUE INDEX IF NOT EXISTS loops_orphan_source_loop_id ON loops (orphan_source_loop_id);
 
--- {§db-fk-indexes} Foreign-key check paths (route replacement, recurrence-root cascade) stop scanning loops.
+-- {§db-fk-indexes} Model-route foreign-key checks stop scanning loops.
 CREATE INDEX IF NOT EXISTS loops_model_route_id         ON loops (model_route_id)         WHERE model_route_id IS NOT NULL;
 
 CREATE INDEX IF NOT EXISTS loops_spawn_model_route_id   ON loops (spawn_model_route_id)   WHERE spawn_model_route_id IS NOT NULL;
 
-CREATE INDEX IF NOT EXISTS loops_recurrence_root_loop_id ON loops (recurrence_root_loop_id) WHERE recurrence_root_loop_id IS NOT NULL;
+-- {§message-arrival}: the loop's inbox. Every message the loop contains, in arrival order, until
+-- the turn boundary that publishes it as an inbound SEND row in the loop's log; the initial
+-- message is ordinal 1 and doubles as the loop's `prompt` headline. `log_entry_id` is NULL until
+-- publication; a concluded loop's unpublished rows move to its recovery loop
+-- ({§message-loop-containment}).
+CREATE TABLE IF NOT EXISTS loop_messages (
+    id           INTEGER NOT NULL PRIMARY KEY,
+    loop_id      INTEGER NOT NULL REFERENCES loops(id) ON DELETE CASCADE,
+    ordinal      INTEGER NOT NULL CHECK (ordinal >= 1),
+    message_key  TEXT NOT NULL DEFAULT (lower(hex(randomblob(4)))),
+    address      TEXT CHECK (address IS NULL OR length(address) > 0),
+    -- {§message-causal-source}: NULL means the owning worker itself.
+    source       TEXT CHECK (source IS NULL OR length(source) > 0),
+    body         TEXT NOT NULL CHECK (length(body) > 0),
+    evidence     TEXT NOT NULL DEFAULT '{}' CHECK (json_valid(evidence) AND json_type(evidence) = 'object'),
+    -- {§methods-loop-run-open-paths}: the message's selected paths (string[] JSON), read at publication.
+    open_paths   TEXT NOT NULL DEFAULT '[]' CHECK (json_valid(open_paths)),
+    -- The inbound SEND row this message became (log_entries, chapter 006); NULL until published.
+    log_entry_id INTEGER,
+    UNIQUE (loop_id, ordinal)
+);
+CREATE INDEX IF NOT EXISTS loop_messages_unpublished ON loop_messages (loop_id) WHERE log_entry_id IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS loop_messages_key ON loop_messages (message_key);
+CREATE INDEX IF NOT EXISTS loop_messages_address ON loop_messages (address) WHERE address IS NOT NULL;
+
+-- {§message-source-scheme}: an address identifies exactly one accepted source in its workspace.
+CREATE TRIGGER IF NOT EXISTS loop_messages_address_unique
+BEFORE INSERT ON loop_messages
+WHEN NEW.address IS NOT NULL AND EXISTS (
+    SELECT 1 FROM loop_messages m
+    JOIN loops l ON l.id = m.loop_id
+    JOIN workers w ON w.id = l.worker_id
+    WHERE m.address = NEW.address AND w.workspace_id = (
+        SELECT w2.workspace_id FROM loops l2 JOIN workers w2 ON w2.id = l2.worker_id
+        WHERE l2.id = NEW.loop_id
+    )
+)
+BEGIN
+    SELECT RAISE(ABORT, 'message address already accepted in this workspace');
+END;
+
+CREATE TRIGGER IF NOT EXISTS loop_messages_immutable_source
+BEFORE UPDATE OF message_key, address, source, body, evidence, open_paths ON loop_messages
+BEGIN
+    SELECT RAISE(ABORT, 'accepted message source is immutable');
+END;
+
+CREATE TRIGGER IF NOT EXISTS loop_messages_delete_with_history_only
+BEFORE DELETE ON loop_messages
+WHEN EXISTS (SELECT 1 FROM loops WHERE id = OLD.loop_id)
+BEGIN
+    SELECT RAISE(ABORT, 'accepted messages can only be removed with their containing history');
+END;
 
-CREATE UNIQUE INDEX IF NOT EXISTS loops_live_recurrence
-ON loops (COALESCE(recurrence_root_loop_id, id))
-WHERE repeat_interval_ms IS NOT NULL AND status IN (100, 102, 202);
+-- {§message-short-identity}: `key_path` is the model's address for a message — always short, always
+-- `message://<worker>/<key>`, exactly as the worker docs teach. `path` stays the durable identity a
+-- client minted (an AG-UI message UUID, say), which correlation and delivery keep using.
+CREATE VIEW IF NOT EXISTS message_sources AS
+SELECT m.*, w.workspace_id, w.id AS worker_id,
+       'message://' || w.name || '/' || m.message_key AS key_path,
+       COALESCE(m.address, 'message://' || w.name || '/' || m.message_key) AS path
+FROM loop_messages m
+JOIN loops l ON l.id = m.loop_id
+JOIN workers w ON w.id = l.worker_id;
 
 -- turns
 -- finish_reason / model: accepted provider-call metadata from the provider
@@ -291,18 +344,19 @@ FROM turns t;
 -- its curatable log. Derivation attachments are replaceable, source bytes are not.
 CREATE TABLE IF NOT EXISTS turn_sources (
     turn_id INTEGER NOT NULL REFERENCES turns(id) ON DELETE CASCADE,
-    kind TEXT NOT NULL CHECK (kind IN ('ops', 'reasoning')),
+    kind TEXT NOT NULL CHECK (kind IN ('ops', 'reasoning', 'note')),
+    sequence INTEGER NOT NULL DEFAULT 0 CHECK ((kind = 'note' AND sequence > 0) OR (kind != 'note' AND sequence = 0)),
     content TEXT NOT NULL,
     model_call_id INTEGER REFERENCES model_calls(id),
     deep_hash TEXT REFERENCES derivations(deep_hash),
-    PRIMARY KEY (turn_id, kind)
+    PRIMARY KEY (turn_id, kind, sequence)
 ) STRICT;
 
 -- {§db-fk-indexes} A derivation replacement checks its referrers; the hash is indexed where it is a foreign key.
 CREATE INDEX IF NOT EXISTS turn_sources_deep_hash ON turn_sources (deep_hash) WHERE deep_hash IS NOT NULL;
 
 CREATE TRIGGER IF NOT EXISTS turn_sources_immutable
-BEFORE UPDATE OF turn_id, kind, content, model_call_id ON turn_sources
+BEFORE UPDATE OF turn_id, kind, sequence, content, model_call_id ON turn_sources
 BEGIN
     SELECT RAISE(ABORT, 'turn source evidence is immutable');
 END;

package/migrations/005_entries.sql

@@ -3,6 +3,23 @@
 -- Version numbers order the chapters on a fresh database; they are not history. A shape
 -- change edits the chapter in place; existing development databases are recreated.
 
+-- {§content-store} Every settled body is stored once, addressed by its sha256, however many
+-- channels, workspaces, forks or full-text rows carry it. Rows are immutable; retention collects
+-- what nothing references.
+-- The ONE engine-imposed constraint (SPEC {§stream-constraints}, {§stream-constraints-engine-one-cap}): 100 MiB char-length cap
+-- per content body. All other limits are extrinsic.
+CREATE TABLE IF NOT EXISTS contents (
+    id      INTEGER NOT NULL PRIMARY KEY,
+    hash    TEXT    NOT NULL UNIQUE CHECK (length(hash) = 64),
+    content TEXT    NOT NULL CHECK (length(content) <= 104857600)
+) STRICT;
+
+CREATE TRIGGER IF NOT EXISTS contents_immutable
+BEFORE UPDATE ON contents
+BEGIN
+    SELECT RAISE(ABORT, 'content is immutable');
+END;
+
 -- derivations
 -- Content-addressed deep projections. Entry channels and log projections point
 -- at a COMPLETE artifact by deep_hash; graph and FTS are stored once
@@ -15,6 +32,8 @@ CREATE TABLE IF NOT EXISTS derivations (
     disposition TEXT    CHECK (disposition IN ('indexed', 'excluded', 'unsearchable', 'failed')),
     reason      TEXT,
     parse_issues INTEGER CHECK (parse_issues IS NULL OR parse_issues > 0),
+    -- {§content-store} The text this artifact full-text indexes; NULL = nothing indexed.
+    content_id  INTEGER REFERENCES contents(id),
     summary     TEXT    CHECK (
         summary IS NULL OR (
             length(summary) > 0
@@ -37,9 +56,7 @@ CREATE TABLE IF NOT EXISTS entries (
     authority  TEXT    NOT NULL DEFAULT '',
     pathname   TEXT    NOT NULL,
     workspace_id INTEGER NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
-    -- Entry-private metadata. Prompt frames use `openPaths` to carry selected
-    -- workspace paths into the exact turn that publishes the frame
-    -- ({§methods-loop-run-open-paths}).
+    -- Scheme-owned entry metadata.
     attributes TEXT    NOT NULL DEFAULT '{}' CHECK (json_valid(attributes)),
     default_channel TEXT NOT NULL DEFAULT 'body' CHECK (length(default_channel) > 0),
     output INTEGER NOT NULL DEFAULT 0 CHECK (output IN (0, 1)),
@@ -65,25 +82,20 @@ CREATE TABLE IF NOT EXISTS entries (
 -- {§entry-owner}, {§execution-output-identity}: one canonical resource key.
 CREATE UNIQUE INDEX IF NOT EXISTS entries_identity ON entries (workspace_id, scheme, authority, pathname);
 
--- The ONE engine-imposed constraint (SPEC {§stream-constraints}, {§stream-constraints-engine-one-cap}): 100 MiB char-length cap
--- per channel content body. All other limits are extrinsic.
-CREATE TABLE IF NOT EXISTS entry_channels (
+-- entry_channel_rows: the stored shape of a channel. A settled channel points at its body in
+-- `contents`; an active stream's body is a private buffer that is interned when it settles.
+-- Everything reads and writes channels through the `entry_channels` view below.
+CREATE TABLE IF NOT EXISTS entry_channel_rows (
     entry_id INTEGER NOT NULL,
     name     TEXT    NOT NULL             CHECK (length(name) > 0),
-    content  TEXT    NOT NULL             CHECK (length(content) <= 104857600),
+    content_id INTEGER REFERENCES contents(id),
+    buffer   TEXT                         CHECK (buffer IS NULL OR length(buffer) <= 104857600),
     mimetype TEXT    NOT NULL             CHECK (length(mimetype) > 0),
     weight   INTEGER NOT NULL DEFAULT 0   CHECK (weight >= 0),
-    -- Line count of content, kept by SQLite on every write so a catalog lists extent
-    -- without reading bodies: a trailing newline terminates the last line; empty
-    -- content has none ({§tokenomics-weight-stored-at-write}).
-    lines    INTEGER GENERATED ALWAYS AS (
-        CASE WHEN length(content) = 0 THEN 0
-             WHEN substr(content, -1) = char(10) THEN length(content) - length(replace(content, char(10), ''))
-             ELSE length(content) - length(replace(content, char(10), '')) + 1 END
-    ) STORED,
-    -- Content identity: sha256 of content, stamped at static writes; streamed
-    -- appends leave it NULL. Curation weight remains model-independent.
-    content_hash TEXT,
+    -- Line count of the body, kept at every write so a catalog lists extent without reading
+    -- bodies: a trailing newline terminates the last line; empty content has none
+    -- ({§tokenomics-weight-stored-at-write}).
+    lines    INTEGER NOT NULL             CHECK (lines >= 0),
     -- Search derivation for this exact addressable channel representation.
     -- Content or mimetype changes invalidate it at the owning channel row.
     deep_hash TEXT,
@@ -118,13 +130,92 @@ CREATE TABLE IF NOT EXISTS entry_channels (
                 END
         END
     ),
+    CHECK ((content_id IS NULL) <> (buffer IS NULL)),
     PRIMARY KEY (entry_id, name),
     FOREIGN KEY (entry_id) REFERENCES entries(id) ON DELETE CASCADE,
     FOREIGN KEY (deep_hash) REFERENCES derivations(deep_hash)
 ) STRICT, WITHOUT ROWID;
 
 -- {§db-fk-indexes} Derivation replacement checks channels by hash; catalog joins drive on it too.
-CREATE INDEX IF NOT EXISTS entry_channels_deep_hash ON entry_channels (deep_hash) WHERE deep_hash IS NOT NULL;
+CREATE INDEX IF NOT EXISTS entry_channel_rows_deep_hash ON entry_channel_rows (deep_hash) WHERE deep_hash IS NOT NULL;
+-- {§db-fk-indexes} Content collection asks whether any channel still points at a body.
+CREATE INDEX IF NOT EXISTS entry_channel_rows_content ON entry_channel_rows (content_id) WHERE content_id IS NOT NULL;
+
+-- {§content-store} The channel as every reader and writer sees it. content_hash is the stored
+-- body's identity (NULL while a stream is active); a writer may bind it, and a bound hash must
+-- be the content's.
+CREATE VIEW IF NOT EXISTS entry_channels AS
+SELECT entry_channel_rows.entry_id, entry_channel_rows.name,
+       COALESCE(entry_channel_rows.buffer, contents.content) AS content,
+       entry_channel_rows.mimetype, entry_channel_rows.weight, entry_channel_rows.lines,
+       contents.hash AS content_hash, entry_channel_rows.deep_hash, entry_channel_rows.state,
+       entry_channel_rows.producer_result
+FROM entry_channel_rows
+LEFT JOIN contents ON contents.id = entry_channel_rows.content_id;
+
+CREATE TRIGGER IF NOT EXISTS entry_channels_insert
+INSTEAD OF INSERT ON entry_channels
+BEGIN
+    SELECT RAISE(ABORT, 'a channel requires content') WHERE NEW.content IS NULL;
+    SELECT RAISE(ABORT, 'content_hash does not match content')
+    WHERE NEW.content_hash IS NOT NULL AND NEW.content_hash IS NOT sha256(NEW.content);
+    INSERT INTO contents (hash, content)
+    SELECT COALESCE(NEW.content_hash, sha256(NEW.content)), NEW.content
+    WHERE COALESCE(NEW.state, 'static') <> 'active'
+    ON CONFLICT (hash) DO NOTHING;
+    INSERT INTO entry_channel_rows (entry_id, name, content_id, buffer, mimetype, weight, lines, deep_hash, state, producer_result)
+    VALUES (
+        NEW.entry_id, NEW.name,
+        CASE WHEN COALESCE(NEW.state, 'static') <> 'active'
+             THEN (SELECT id FROM contents WHERE hash = COALESCE(NEW.content_hash, sha256(NEW.content))) END,
+        CASE WHEN COALESCE(NEW.state, 'static') = 'active' THEN NEW.content END,
+        NEW.mimetype, COALESCE(NEW.weight, 0),
+        CASE WHEN length(NEW.content) = 0 THEN 0
+             WHEN substr(NEW.content, -1) = char(10) THEN length(NEW.content) - length(replace(NEW.content, char(10), ''))
+             ELSE length(NEW.content) - length(replace(NEW.content, char(10), '')) + 1 END,
+        NEW.deep_hash, COALESCE(NEW.state, 'static'), NEW.producer_result
+    );
+END;
+
+-- Each column group is written only when it changed, so a search attachment never reads as a
+-- representation write and a lifecycle write never re-stores a body.
+CREATE TRIGGER IF NOT EXISTS entry_channels_update
+INSTEAD OF UPDATE ON entry_channels
+BEGIN
+    SELECT RAISE(ABORT, 'a channel is addressed by (entry_id, name)')
+    WHERE NEW.entry_id IS NOT OLD.entry_id OR NEW.name IS NOT OLD.name;
+    SELECT RAISE(ABORT, 'a channel requires content') WHERE NEW.content IS NULL;
+    SELECT RAISE(ABORT, 'content_hash does not match content')
+    WHERE NEW.content_hash IS NOT NULL AND NEW.content_hash IS NOT OLD.content_hash
+      AND NEW.content_hash IS NOT sha256(NEW.content);
+    INSERT INTO contents (hash, content)
+    SELECT sha256(NEW.content), NEW.content
+    WHERE NEW.state <> 'active' AND (NEW.content IS NOT OLD.content OR OLD.state = 'active')
+    ON CONFLICT (hash) DO NOTHING;
+    UPDATE entry_channel_rows
+    SET content_id = CASE WHEN NEW.state <> 'active'
+                          THEN (SELECT id FROM contents WHERE hash = sha256(NEW.content)) END,
+        buffer = CASE WHEN NEW.state = 'active' THEN NEW.content END,
+        lines = CASE WHEN length(NEW.content) = 0 THEN 0
+             WHEN substr(NEW.content, -1) = char(10) THEN length(NEW.content) - length(replace(NEW.content, char(10), ''))
+             ELSE length(NEW.content) - length(replace(NEW.content, char(10), '')) + 1 END
+    WHERE entry_id = OLD.entry_id AND name = OLD.name
+      AND (NEW.content IS NOT OLD.content OR (NEW.state = 'active') IS NOT (OLD.state = 'active'));
+    UPDATE entry_channel_rows
+    SET mimetype = NEW.mimetype, weight = NEW.weight, state = NEW.state, producer_result = NEW.producer_result
+    WHERE entry_id = OLD.entry_id AND name = OLD.name
+      AND (NEW.mimetype IS NOT OLD.mimetype OR NEW.weight IS NOT OLD.weight
+           OR NEW.state IS NOT OLD.state OR NEW.producer_result IS NOT OLD.producer_result);
+    UPDATE entry_channel_rows
+    SET deep_hash = NEW.deep_hash
+    WHERE entry_id = OLD.entry_id AND name = OLD.name AND NEW.deep_hash IS NOT OLD.deep_hash;
+END;
+
+CREATE TRIGGER IF NOT EXISTS entry_channels_delete
+INSTEAD OF DELETE ON entry_channels
+BEGIN
+    DELETE FROM entry_channel_rows WHERE entry_id = OLD.entry_id AND name = OLD.name;
+END;
 
 -- {§crud} A publication is one SQL statement: failure rolls back metadata and
 -- every channel. The view is an input boundary, not a second persisted copy.
@@ -149,14 +240,28 @@ BEGIN
     DELETE FROM entry_channels WHERE entry_id = (
         SELECT id FROM entries WHERE workspace_id = NEW.workspace_id
           AND scheme = NEW.scheme AND authority = NEW.authority AND pathname = NEW.pathname
-    );
+    ) AND name NOT IN (SELECT key FROM json_each(NEW.channels));
+    UPDATE entry_channels
+    SET content = json_extract(c.value, '$.content'),
+        mimetype = json_extract(c.value, '$.mimetype'),
+        weight = json_extract(c.value, '$.weight'),
+        content_hash = json_extract(c.value, '$.content_hash'),
+        state = json_extract(c.value, '$.state'),
+        producer_result = json_extract(c.value, '$.producer_result')
+    FROM (SELECT key, value FROM json_each(NEW.channels)) AS c
+    WHERE entry_channels.name = c.key
+      AND entry_channels.entry_id = (
+        SELECT id FROM entries WHERE workspace_id = NEW.workspace_id
+          AND scheme = NEW.scheme AND authority = NEW.authority AND pathname = NEW.pathname
+      );
     INSERT INTO entry_channels (entry_id, name, content, mimetype, weight, content_hash, state, producer_result)
     SELECT e.id, c.key, json_extract(c.value, '$.content'), json_extract(c.value, '$.mimetype'),
            json_extract(c.value, '$.weight'), json_extract(c.value, '$.content_hash'),
            json_extract(c.value, '$.state'), json_extract(c.value, '$.producer_result')
     FROM entries e, json_each(NEW.channels) c
     WHERE e.workspace_id = NEW.workspace_id AND e.scheme = NEW.scheme
-      AND e.authority = NEW.authority AND e.pathname = NEW.pathname;
+      AND e.authority = NEW.authority AND e.pathname = NEW.pathname
+      AND NOT EXISTS (SELECT 1 FROM entry_channel_rows r WHERE r.entry_id = e.id AND r.name = c.key);
 END;
 
 -- symbol_defs
@@ -200,7 +305,15 @@ CREATE INDEX IF NOT EXISTS symbol_refs_source ON symbol_refs (derivation_id, con
 
 -- {§find-fulltext-selection} Native full-text index of the addressed READ body.
 -- rowid is the content-addressed derivation id.
-CREATE VIRTUAL TABLE IF NOT EXISTS derivation_fts USING fts5(content);
+-- {§content-store} The index reads its text from the content store instead of keeping a copy:
+-- external content, kept in step by the derivation triggers in _entry-fts.sql.
+CREATE VIEW IF NOT EXISTS derivation_texts AS
+SELECT derivations.id AS id, contents.content AS content
+FROM derivations
+JOIN contents ON contents.id = derivations.content_id;
+CREATE VIRTUAL TABLE IF NOT EXISTS derivation_fts USING fts5(content, content='derivation_texts', content_rowid='id');
+-- {§db-fk-indexes} Content collection asks whether any derivation still indexes a body.
+CREATE INDEX IF NOT EXISTS derivations_content ON derivations (content_id) WHERE content_id IS NOT NULL;
 
 -- {§packet-attachment-parts}: READ snapshots survive source changes and log curation.
 CREATE TABLE IF NOT EXISTS native_contents (

package/migrations/006_log.sql

@@ -112,25 +112,73 @@ CREATE        INDEX IF NOT EXISTS log_entries_loop_id          ON log_entries (l
 -- {§db-fk-indexes} Derivation replacement checks the rows that cite the hash.
 CREATE        INDEX IF NOT EXISTS log_entries_deep_hash        ON log_entries (deep_hash) WHERE deep_hash IS NOT NULL;
 
--- {§loop-response-messages}: the response is the last delivered message, read from
--- executed evidence so curation cannot retract it. This projection is also used inside
--- atomic cancellation; no second response projection exists.
-CREATE VIEW IF NOT EXISTS loop_responses AS
-SELECT loop_id, content FROM (
-    SELECT le.loop_id,
-        json_extract(le.tx, '$.body.raw') AS content,
-        ROW_NUMBER() OVER (PARTITION BY le.loop_id ORDER BY t.sequence DESC, le.sequence DESC) AS recency
-    FROM log_entries le JOIN turns t ON t.id = le.turn_id
-    WHERE le.op = 'SEND' AND le.state = 'resolved' AND le.status_rx BETWEEN 200 AND 299
+-- {§loop-response-messages}: delivered messages remain executed evidence;
+-- curation and loop termination cannot retract or replace them.
+CREATE VIEW IF NOT EXISTS log_responses AS
+SELECT le.id, le.loop_id, le.turn_id, le.worker_id, le.sequence, le.source, le.origin,
+       CASE WHEN json_valid(le.rx) THEN le.rx END AS rx,
+       CASE WHEN json_valid(le.tx) THEN COALESCE(json_extract(le.tx, '$.body.raw'), '') END AS content
+FROM log_entries le
+    WHERE le.state = 'resolved'
+      AND le.op = 'SEND' AND le.status_rx BETWEEN 200 AND 299
       AND le.source IS NULL AND le.inherited_history = 0
       AND json_valid(le.tx)
-      -- {§send-prompt-acceptance}: a SEND to one of this loop's own prompts is the response too;
-      -- the dispatcher admits only own-loop prompt addresses, so the scheme alone identifies them.
-      AND (json_type(le.tx, '$.target') = 'null' OR json_extract(le.tx, '$.target.scheme') = 'prompt')
-      AND json_type(le.tx, '$.body.raw') = 'text'
-      AND length(json_extract(le.tx, '$.body.raw')) > 0
-)
-WHERE recency = 1;
+      AND json_type(CASE WHEN json_valid(le.rx) THEN le.rx END, '$.answers') = 'array'
+      AND typeof(content) = 'text';
+
+CREATE VIEW IF NOT EXISTS message_responses AS
+SELECT DISTINCT r.id, m.loop_id, m.worker_id, r.source, r.content, r.rx
+FROM log_responses r
+JOIN workers producer ON producer.id = r.worker_id
+JOIN json_each(r.rx, '$.answers') answer
+JOIN message_sources m ON m.path = answer.value AND m.workspace_id = producer.workspace_id
+UNION ALL
+SELECT r.id, r.loop_id, r.worker_id, r.source, r.content, r.rx
+FROM log_responses r WHERE json_array_length(r.rx, '$.answers') = 0;
+
+CREATE VIEW IF NOT EXISTS unanswered_messages AS
+SELECT m.* FROM message_sources m
+WHERE NOT EXISTS (
+    SELECT 1 FROM log_responses r
+    JOIN workers w ON w.id = r.worker_id, json_each(r.rx, '$.answers') answer
+    WHERE w.workspace_id = m.workspace_id AND answer.value = m.path
+);
+
+-- {§message-reply-delivery}: notify the sender and the assigned conversation.
+-- UNION prevents duplicate delivery when both roles belong to the same worker.
+-- {§loop-answer}: a child's answer to the very task its parent delegated is NOT delivered here;
+-- the parent receives it once, as the child's termination row, which carries that answer at
+-- ops://<child>/<loop> (operator, 2026-09-19). Replies to any other message still deliver.
+CREATE VIEW IF NOT EXISTS delegated_task_answers AS
+SELECT r.id AS source_record_id, parent.id AS recipient_worker_id
+FROM log_responses r
+JOIN workers producer ON producer.id = r.worker_id
+JOIN workers parent ON parent.id = producer.parent_worker_id
+JOIN json_each(r.rx, '$.answers') answer
+JOIN message_sources m ON m.path = answer.value AND m.workspace_id = producer.workspace_id
+WHERE m.loop_id = r.loop_id AND m.ordinal = 1 AND m.source = 'worker://' || parent.name;
+
+CREATE VIEW IF NOT EXISTS message_reply_deliveries AS
+SELECT DISTINCT r.id AS source_record_id, r.loop_id, m.workspace_id,
+       r.worker_id AS producer_worker_id, m.worker_id AS recipient_worker_id
+FROM log_responses r
+JOIN workers producer ON producer.id = r.worker_id
+JOIN json_each(r.rx, '$.answers') answer
+JOIN message_sources m ON m.path = answer.value AND m.workspace_id = producer.workspace_id
+UNION
+SELECT r.id, r.loop_id, m.workspace_id, r.worker_id, sender.id
+FROM log_responses r
+JOIN workers producer ON producer.id = r.worker_id
+JOIN json_each(r.rx, '$.answers') answer
+JOIN message_sources m ON m.path = answer.value AND m.workspace_id = producer.workspace_id
+JOIN workers sender ON sender.workspace_id = m.workspace_id AND m.source = 'worker://' || sender.name;
+
+CREATE VIEW IF NOT EXISTS delivered_message_replies AS
+SELECT d.* FROM message_reply_deliveries d
+WHERE NOT EXISTS (
+    SELECT 1 FROM delegated_task_answers t
+    WHERE t.source_record_id = d.source_record_id AND t.recipient_worker_id = d.recipient_worker_id
+);
 
 CREATE UNIQUE INDEX IF NOT EXISTS log_entries_model_call_id
     ON log_entries (model_call_id)
@@ -517,8 +565,12 @@ FROM (
            -- private to the worker it serves and never crosses to the parent.
            CASE
                WHEN t.producer = '_plurnk' AND t.kind IN ('operation', 'initialization', 'maintenance') THEN NULL
+               WHEN EXISTS (
+                   SELECT 1 FROM message_reply_deliveries d
+                   WHERE d.source_record_id = le.id AND d.recipient_worker_id = w.parent_worker_id
+               ) THEN NULL
                ELSE w.parent_worker_id
-           END AS target_parent_worker_id,
+           END AS recipient_worker_id,
            CASE
                WHEN le.state = 'resolved'
                 AND NOT (t.producer = '_plurnk' AND t.kind = 'maintenance')
@@ -567,15 +619,15 @@ FROM (
            json_remove(le.attrs, '$.__plurnk_curation') AS attrs
     FROM log_entries le
     JOIN workers w ON w.id = le.worker_id
-    JOIN loops l ON l.id = le.loop_id
     JOIN turns t ON t.id = le.turn_id
     WHERE le.ambient_event_id IS NULL
       AND le.inherited_history = 0
-      AND le.op IS NOT NULL
-      AND le.state != 'proposed'
-      AND NOT (
-          le.op IN ('NEXT', 'WAIT', 'DONE', 'FAIL')
-          AND l.status IN (200, 413, 429, 499, 500, 504, 508)
+      AND COALESCE(json_extract(le.attrs, '$.kind'), '') != 'message'
+      AND (
+          le.op IN ('EDIT', 'COPY', 'MOVE', 'SEND', 'WORK', 'FORK')
+          OR CASE WHEN json_valid(le.tx) THEN json_type(le.tx, '$.runtime') END = 'text'
+          OR (le.op = 'KILL' AND COALESCE(le.scheme, 'file') != 'log')
       )
+      AND le.state != 'proposed'
 ) candidate
-WHERE target_parent_worker_id IS NOT NULL OR workspace_broadcast = 1;
+WHERE recipient_worker_id IS NOT NULL OR workspace_broadcast = 1;

package/migrations/007_subscriptions.sql

@@ -1,5 +1,5 @@
 -- MIGRATE: 7 subscriptions
--- Chapter 7 of the schema baseline ({§db-schema-baseline}): Subscriptions to streams and their publication cursors.
+-- Chapter 7 of the schema baseline ({§db-schema-baseline}): held streams, events and their observation cursors.
 -- Version numbers order the chapters on a fresh database; they are not history. A shape
 -- change edits the chapter in place; existing development databases are recreated.
 
@@ -19,13 +19,10 @@ CREATE TABLE IF NOT EXISTS subscriptions (
     published_channel TEXT          CHECK (published_channel IS NULL OR length(published_channel) > 0),
     source       TEXT             CHECK (source IS NULL OR length(source) > 0),
     opened_at    TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-    -- Execution `<T,P>` poll policy: NULL = default backoff, 0 = disabled, positive = fixed cadence.
-    -- While the owning loop hibernates (202), an armed policy wakes it to inspect the stream ({§exec-poll}).
-    poll_seconds INTEGER          CHECK (poll_seconds IS NULL OR poll_seconds >= 0),
-    -- Execution `<0>` — turn-scoped: the stream is reaped at the worker's next pre-turn so it never survives
-    -- into the subsequent turn; its terminal output surfaces initially visible like any conclusion. {§exec-poll}
+    -- `[{"lifetime":"turn"}]`: the stream is reaped at the worker's next pre-turn so it never survives
+    -- into the subsequent turn; its terminal output surfaces initially visible like any conclusion. {§exec-lifetime}
     turn_scoped  INTEGER NOT NULL DEFAULT 0 CHECK (turn_scoped IN (0, 1)),
-    -- {§worker-obligations}: a `<-1>` spawn outlives its loop and is nobody's obligation ({§exec-timeout}).
+    -- {§worker-obligations}: a `[{"lifetime":"detached"}]` spawn outlives its loop and is nobody's obligation.
     detached     INTEGER NOT NULL DEFAULT 0 CHECK (detached IN (0, 1)),
     closed_at    TEXT,
     close_status INTEGER          CHECK (close_status IS NULL OR (close_status BETWEEN 100 AND 599)),
@@ -140,14 +137,7 @@ BEGIN
     SELECT RAISE(ABORT, 'subscription channel result violates the channel producer contract');
 END;
 
--- One durable publication cursor per selected subscription channel. Log rows
--- are curated model context and therefore cannot own this lifecycle fact.
--- The row survives KILLing any generated observation and disappears only with
--- its subscription. {§exec-stream}
--- {§worker-obligations}: what a worker still holds — an open stream that is not detached, or a
--- child with an unresolved loop (the same liveness the Delegation section shows, so the 409 gate
--- and the section the model reads never disagree, {§child-orientation}). The one definition the
--- completion gate, the wait matrix, and the drain's wake settlement all read.
+-- {§worker-obligations}: the shared worker work a loop is held on.
 CREATE VIEW IF NOT EXISTS worker_obligations AS
 SELECT w.id AS worker_id,
        EXISTS (
@@ -160,6 +150,11 @@ SELECT w.id AS worker_id,
        ) AS workers
 FROM workers w;
 
+CREATE VIEW IF NOT EXISTS loop_obligations AS
+SELECT l.id AS loop_id, held.streams, held.workers
+FROM loops l JOIN worker_obligations held ON held.worker_id = l.worker_id;
+
+-- {§exec-stream}: publication cursors survive curation of generated observations.
 CREATE TABLE IF NOT EXISTS subscription_publications (
     id                 INTEGER NOT NULL PRIMARY KEY,
     version            INTEGER NOT NULL DEFAULT 0 CHECK (version >= 0),